remult 3.3.19-next.1 → 3.3.19-next.2

package/esm/src/data-providers/indexed-db-data-provider.js

@@ -9,12 +9,27 @@ export class IndexedDbIndexBuilder {
         return this;
     }
 }
+const IDB_KEYS_STORE = '__remult_keys';
+const IDB_DEK_ID = 'dek';
+const IDB_ENC = '_enc';
+const IDB_IV = '_iv';
 export class IndexedDbDataProvider {
     dbName;
     //@internal
     declaredIndexes = [];
+    //@internal
+    encrypt;
+    //@internal
+    customGetKey;
+    //@internal
+    dek;
     constructor(dbName = 'remult', options) {
         this.dbName = dbName;
+        this.encrypt = options?.encrypt === true;
+        this.customGetKey = options?.getEncryptionKey;
+        if (this.encrypt && !(typeof crypto !== 'undefined' && crypto.subtle)) {
+            throw new Error('Web Crypto API is required when IndexedDB encryption is enabled');
+        }
         if (options?.indexes) {
             const builder = new IndexedDbIndexBuilder();
             options.indexes(builder);
@@ -66,10 +81,14 @@ export class IndexedDbDataProvider {
         const storeName = storeNameOf(entity);
         const prefetch = await idbPrefetchFromFilter(entity, where, this.storeIndexes(storeName));
         this.lastFetch = prefetch;
-        if (prefetch.type === 'all')
-            return this.getAll(storeName);
-        const ops = prefetch.type === 'or' ? prefetch.parts : [prefetch];
-        return this.fetchOps(storeName, entity, ops);
+        const rows = prefetch.type === 'all'
+            ? await this.getAll(storeName)
+            : await this.fetchOps(storeName, entity, prefetch.type === 'or' ? prefetch.parts : [prefetch]);
+        if (!this.encrypt)
+            return rows;
+        const dek = await this.loadDek();
+        const names = await dbNamesOf(entity, (x) => x);
+        return Promise.all(rows.map((row) => decryptJson(storeName, row, entity, names, dek)));
     }
     //@internal
     storeIndexes(storeName) {
@@ -106,18 +125,24 @@ export class IndexedDbDataProvider {
             };
         }));
         const db = await this.open();
-        const needsUpgrade = wanted.some((w) => {
-            if (!db.objectStoreNames.contains(w.name))
-                return true;
-            const existing = this.storeIndexes(w.name).map((i) => i.name);
-            return w.indexes.some((idx) => !existing.includes(idx.name));
-        });
+        const needsKeyStore = this.usesKeyStore() && !db.objectStoreNames.contains(IDB_KEYS_STORE);
+        const needsUpgrade = needsKeyStore ||
+            wanted.some((w) => {
+                if (!db.objectStoreNames.contains(w.name))
+                    return true;
+                const existing = this.storeIndexes(w.name).map((i) => i.name);
+                return w.indexes.some((idx) => !existing.includes(idx.name));
+            });
         if (!needsUpgrade)
             return;
         const nextVersion = db.version + 1;
         this.forget(db);
         db.close();
         await this.open(nextVersion, (upgradeDb, tx) => {
+            if (this.usesKeyStore() &&
+                !upgradeDb.objectStoreNames.contains(IDB_KEYS_STORE)) {
+                upgradeDb.createObjectStore(IDB_KEYS_STORE, { keyPath: 'id' });
+            }
             for (const { name, keyPath, autoIncrement, indexes } of wanted) {
                 const store = upgradeDb.objectStoreNames.contains(name)
                     ? tx.objectStore(name)
@@ -131,6 +156,63 @@ export class IndexedDbDataProvider {
         });
     }
     //@internal
+    usesKeyStore() {
+        return this.encrypt && !this.customGetKey;
+    }
+    //@internal
+    async loadDek() {
+        if (this.dek)
+            return this.dek;
+        if (this.customGetKey) {
+            const key = await this.customGetKey();
+            this.dek = key;
+            return key;
+        }
+        const existing = await this.withStore(IDB_KEYS_STORE, 'readonly', (s) => idbReq(s.get(IDB_DEK_ID)));
+        if (existing?.key) {
+            this.dek = existing.key;
+            return existing.key;
+        }
+        const generated = await crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+        const key = await this.withStore(IDB_KEYS_STORE, 'readwrite', async (s) => {
+            const rec = await idbReq(s.get(IDB_DEK_ID));
+            if (rec?.key)
+                return rec.key;
+            try {
+                await idbReq(s.add({ id: IDB_DEK_ID, key: generated }));
+                return generated;
+            }
+            catch (e) {
+                if (e?.name === 'ConstraintError') {
+                    const again = await idbReq(s.get(IDB_DEK_ID));
+                    if (!again?.key)
+                        throw new Error('Failed to load IndexedDB encryption key');
+                    return again.key;
+                }
+                throw e;
+            }
+        });
+        this.dek = key;
+        return key;
+    }
+    //@internal
+    async plaintextDbNames(entity) {
+        const names = await dbNamesOf(entity, (x) => x);
+        const set = new Set();
+        for (const f of entity.idMetadata.fields) {
+            set.add(names.$dbNameOf(f));
+        }
+        for (const def of this.indexesFor(entity)) {
+            const keys = Array.isArray(def) ? [...def] : [def];
+            for (const key of keys) {
+                const field = [...entity.fields].find((f) => f.key === key);
+                if (field)
+                    set.add(names.$dbNameOf(field));
+            }
+        }
+        return set;
+    }
+    //@internal
     forget(db) {
         if (this.db === db)
             this.db = undefined;
@@ -246,23 +328,48 @@ class IndexedDbEntityDataProvider {
                     delete json[idName];
                 return json;
             });
-            return this.provider.withStore(storeNameOf(this.entity), 'readwrite', async (store) => {
-                const result = [];
-                for (const json of rows) {
+            const storeName = storeNameOf(this.entity);
+            const dek = this.provider.encrypt
+                ? await this.provider.loadDek()
+                : undefined;
+            const keep = dek
+                ? await this.provider.plaintextDbNames(this.entity)
+                : undefined;
+            if (dek && auto) {
+                const keys = await this.provider.withStore(storeName, 'readwrite', async (store) => {
+                    const allocated = [];
+                    for (let i = 0; i < rows.length; i++) {
+                        allocated.push(await idbReq(store.add({})));
+                    }
+                    return allocated;
+                });
+                for (let i = 0; i < rows.length; i++) {
+                    rows[i][idName] = keys[i];
+                }
+            }
+            const toWrite = dek
+                ? await Promise.all(rows.map((json) => encryptJson(storeName, json, keep, keyFromRow(this.entity, names, json), dek)))
+                : rows;
+            await this.provider.withStore(storeName, 'readwrite', async (store) => {
+                for (let i = 0; i < toWrite.length; i++) {
                     try {
-                        const key = await idbReq(store.add(json));
-                        if (auto)
-                            json[idName] = json[idName] ?? key;
+                        if (dek && auto) {
+                            await idbReq(store.put(toWrite[i]));
+                        }
+                        else {
+                            const key = await idbReq(store.add(toWrite[i]));
+                            if (auto)
+                                rows[i][idName] = rows[i][idName] ?? key;
+                        }
                     }
                     catch (e) {
                         if (e?.name === 'ConstraintError')
                             throw Error('id already exists');
                         throw e;
                     }
-                    result.push(helper.translateFromJson(json, names));
                 }
-                return result;
             });
+            return rows.map((json) => helper.translateFromJson(json, names));
         });
     }
     update(id, data) {
@@ -271,28 +378,38 @@ class IndexedDbEntityDataProvider {
             const helper = new ArrayEntityDataProvider(this.entity, () => []);
             const names = await helper.init();
             const key = toIdbKey(this.entity, id);
-            return this.provider.withStore(storeNameOf(this.entity), 'readwrite', async (store) => {
-                const existing = await idbReq(store.get(key));
-                if (existing == null)
-                    throw new Error(`Couldn't find row with id "${id}" in entity "${this.entity.key}" to update`);
-                const json = { ...existing };
-                const keys = Object.keys(data);
-                for (const f of this.entity.fields) {
-                    if (!isDbReadonly(f, names) && keys.includes(f.key)) {
-                        json[names.$dbNameOf(f)] = f.valueConverter.toJson(data[f.key]);
-                    }
+            const storeName = storeNameOf(this.entity);
+            const existingRaw = await this.provider.withStore(storeName, 'readonly', (store) => idbReq(store.get(key)));
+            if (existingRaw == null)
+                throw new Error(`Couldn't find row with id "${id}" in entity "${this.entity.key}" to update`);
+            const dek = this.provider.encrypt
+                ? await this.provider.loadDek()
+                : undefined;
+            const existing = dek
+                ? await decryptJson(storeName, existingRaw, this.entity, names, dek)
+                : existingRaw;
+            const json = { ...existing };
+            const keys = Object.keys(data);
+            for (const f of this.entity.fields) {
+                if (!isDbReadonly(f, names) && keys.includes(f.key)) {
+                    json[names.$dbNameOf(f)] = f.valueConverter.toJson(data[f.key]);
                 }
-                helper.verifyThatRowHasAllNotNullColumns(json, names);
-                const newKey = keyFromRow(this.entity, names, json);
+            }
+            helper.verifyThatRowHasAllNotNullColumns(json, names);
+            const newKey = keyFromRow(this.entity, names, json);
+            const toWrite = dek
+                ? await encryptJson(storeName, json, await this.provider.plaintextDbNames(this.entity), newKey, dek)
+                : json;
+            await this.provider.withStore(storeName, 'readwrite', async (store) => {
                 if (!idbKeysEqual(key, newKey)) {
                     const conflict = await idbReq(store.get(newKey));
                     if (conflict != null)
                         throw Error('id already exists');
                     await idbReq(store.delete(key));
                 }
-                await idbReq(store.put(json));
-                return helper.translateFromJson(json, names);
+                await idbReq(store.put(toWrite));
             });
+            return helper.translateFromJson(json, names);
         });
     }
     delete(ids) {
@@ -642,3 +759,53 @@ function idbReq(request) {
         request.onerror = () => reject(request.error);
     });
 }
+function encAad(storeName, id) {
+    return new TextEncoder().encode(storeName + '\0' + JSON.stringify(id));
+}
+function asBufferSource(value, label) {
+    if (value instanceof Uint8Array || value instanceof ArrayBuffer)
+        return value;
+    throw new Error(`Failed to decrypt IndexedDB row: missing ${label}`);
+}
+async function encryptJson(storeName, json, plaintext, idbKey, dek) {
+    const stored = {};
+    const payload = {};
+    for (const k of Object.keys(json)) {
+        if (k === IDB_ENC || k === IDB_IV)
+            continue;
+        if (plaintext.has(k))
+            stored[k] = json[k];
+        else
+            payload[k] = json[k];
+    }
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    stored[IDB_ENC] = await crypto.subtle.encrypt({
+        name: 'AES-GCM',
+        iv,
+        additionalData: encAad(storeName, idbKey),
+    }, dek, new TextEncoder().encode(JSON.stringify(payload)));
+    stored[IDB_IV] = iv;
+    return stored;
+}
+async function decryptJson(storeName, row, entity, names, dek) {
+    if (row == null || row[IDB_ENC] == null)
+        return row;
+    const idbKey = keyFromRow(entity, names, row);
+    try {
+        const plain = await crypto.subtle.decrypt({
+            name: 'AES-GCM',
+            iv: asBufferSource(row[IDB_IV], IDB_IV),
+            additionalData: encAad(storeName, idbKey),
+        }, dek, asBufferSource(row[IDB_ENC], IDB_ENC));
+        const payload = JSON.parse(new TextDecoder().decode(plain));
+        const result = { ...row, ...payload };
+        delete result[IDB_ENC];
+        delete result[IDB_IV];
+        return result;
+    }
+    catch (e) {
+        if (e?.message?.startsWith('Failed to decrypt IndexedDB row'))
+            throw e;
+        throw new Error(`Failed to decrypt IndexedDB row in "${storeName}"`);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "remult",
-    "version": "3.3.19-next.1",
+    "version": "3.3.19-next.2",
     "description": "A CRUD framework for full-stack TypeScript",
     "homepage": "https://remult.dev",
     "repository": {

package/src/data-providers/indexed-db-data-provider.d.ts

@@ -7,6 +7,8 @@ export declare class IndexedDbIndexBuilder {
 }
 export type IndexedDbDataProviderOptions = {
     indexes?: (x: IndexedDbIndexBuilder) => void;
+    encrypt?: boolean;
+    getEncryptionKey?: () => CryptoKey | Promise<CryptoKey>;
 };
 export declare class IndexedDbDataProvider implements DataProvider {
     private dbName;

package/src/data-providers/indexed-db-data-provider.js

@@ -18,6 +18,10 @@ var IndexedDbIndexBuilder = /** @class */ (function () {
     return IndexedDbIndexBuilder;
 }());
 exports.IndexedDbIndexBuilder = IndexedDbIndexBuilder;
+var IDB_KEYS_STORE = '__remult_keys';
+var IDB_DEK_ID = 'dek';
+var IDB_ENC = '_enc';
+var IDB_IV = '_iv';
 var IndexedDbDataProvider = /** @class */ (function () {
     function IndexedDbDataProvider(dbName, options) {
         if (dbName === void 0) { dbName = 'remult'; }
@@ -26,6 +30,11 @@ var IndexedDbDataProvider = /** @class */ (function () {
         this.declaredIndexes = [];
         //@internal
         this.tail = Promise.resolve();
+        this.encrypt = (options === null || options === void 0 ? void 0 : options.encrypt) === true;
+        this.customGetKey = options === null || options === void 0 ? void 0 : options.getEncryptionKey;
+        if (this.encrypt && !(typeof crypto !== 'undefined' && crypto.subtle)) {
+            throw new Error('Web Crypto API is required when IndexedDB encryption is enabled');
+        }
         if (options === null || options === void 0 ? void 0 : options.indexes) {
             var builder = new IndexedDbIndexBuilder();
             options.indexes(builder);
@@ -114,19 +123,35 @@ var IndexedDbDataProvider = /** @class */ (function () {
     //@internal
     IndexedDbDataProvider.prototype.loadRows = function (entity, where) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var storeName, prefetch, ops;
-            return tslib_1.__generator(this, function (_a) {
-                switch (_a.label) {
+            var storeName, prefetch, rows, _a, dek, names;
+            return tslib_1.__generator(this, function (_b) {
+                switch (_b.label) {
                     case 0:
                         storeName = storeNameOf(entity);
                         return [4 /*yield*/, idbPrefetchFromFilter(entity, where, this.storeIndexes(storeName))];
                     case 1:
-                        prefetch = _a.sent();
+                        prefetch = _b.sent();
                         this.lastFetch = prefetch;
-                        if (prefetch.type === 'all')
-                            return [2 /*return*/, this.getAll(storeName)];
-                        ops = prefetch.type === 'or' ? prefetch.parts : [prefetch];
-                        return [2 /*return*/, this.fetchOps(storeName, entity, ops)];
+                        if (!(prefetch.type === 'all')) return [3 /*break*/, 3];
+                        return [4 /*yield*/, this.getAll(storeName)];
+                    case 2:
+                        _a = _b.sent();
+                        return [3 /*break*/, 5];
+                    case 3: return [4 /*yield*/, this.fetchOps(storeName, entity, prefetch.type === 'or' ? prefetch.parts : [prefetch])];
+                    case 4:
+                        _a = _b.sent();
+                        _b.label = 5;
+                    case 5:
+                        rows = _a;
+                        if (!this.encrypt)
+                            return [2 /*return*/, rows];
+                        return [4 /*yield*/, this.loadDek()];
+                    case 6:
+                        dek = _b.sent();
+                        return [4 /*yield*/, (0, filter_consumer_bridge_to_sql_request_js_1.dbNamesOf)(entity, function (x) { return x; })];
+                    case 7:
+                        names = _b.sent();
+                        return [2 /*return*/, Promise.all(rows.map(function (row) { return decryptJson(storeName, row, entity, names, dek); }))];
                 }
             });
         });
@@ -157,7 +182,7 @@ var IndexedDbDataProvider = /** @class */ (function () {
     //@internal
     IndexedDbDataProvider.prototype.ensureStores = function (entities) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var wanted, db, needsUpgrade, nextVersion;
+            var wanted, db, needsKeyStore, needsUpgrade, nextVersion;
             var _this = this;
             return tslib_1.__generator(this, function (_a) {
                 switch (_a.label) {
@@ -185,12 +210,14 @@ var IndexedDbDataProvider = /** @class */ (function () {
                         return [4 /*yield*/, this.open()];
                     case 2:
                         db = _a.sent();
-                        needsUpgrade = wanted.some(function (w) {
-                            if (!db.objectStoreNames.contains(w.name))
-                                return true;
-                            var existing = _this.storeIndexes(w.name).map(function (i) { return i.name; });
-                            return w.indexes.some(function (idx) { return !existing.includes(idx.name); });
-                        });
+                        needsKeyStore = this.usesKeyStore() && !db.objectStoreNames.contains(IDB_KEYS_STORE);
+                        needsUpgrade = needsKeyStore ||
+                            wanted.some(function (w) {
+                                if (!db.objectStoreNames.contains(w.name))
+                                    return true;
+                                var existing = _this.storeIndexes(w.name).map(function (i) { return i.name; });
+                                return w.indexes.some(function (idx) { return !existing.includes(idx.name); });
+                            });
                         if (!needsUpgrade)
                             return [2 /*return*/];
                         nextVersion = db.version + 1;
@@ -198,6 +225,10 @@ var IndexedDbDataProvider = /** @class */ (function () {
                         db.close();
                         return [4 /*yield*/, this.open(nextVersion, function (upgradeDb, tx) {
                                 var e_1, _a, e_2, _b;
+                                if (_this.usesKeyStore() &&
+                                    !upgradeDb.objectStoreNames.contains(IDB_KEYS_STORE)) {
+                                    upgradeDb.createObjectStore(IDB_KEYS_STORE, { keyPath: 'id' });
+                                }
                                 try {
                                     for (var wanted_1 = tslib_1.__values(wanted), wanted_1_1 = wanted_1.next(); !wanted_1_1.done; wanted_1_1 = wanted_1.next()) {
                                         var _c = wanted_1_1.value, name_2 = _c.name, keyPath = _c.keyPath, autoIncrement = _c.autoIncrement, indexes = _c.indexes;
@@ -237,6 +268,136 @@ var IndexedDbDataProvider = /** @class */ (function () {
         });
     };
     //@internal
+    IndexedDbDataProvider.prototype.usesKeyStore = function () {
+        return this.encrypt && !this.customGetKey;
+    };
+    //@internal
+    IndexedDbDataProvider.prototype.loadDek = function () {
+        return tslib_1.__awaiter(this, void 0, void 0, function () {
+            var key_1, existing, generated, key;
+            var _this = this;
+            return tslib_1.__generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if (this.dek)
+                            return [2 /*return*/, this.dek];
+                        if (!this.customGetKey) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this.customGetKey()];
+                    case 1:
+                        key_1 = _a.sent();
+                        this.dek = key_1;
+                        return [2 /*return*/, key_1];
+                    case 2: return [4 /*yield*/, this.withStore(IDB_KEYS_STORE, 'readonly', function (s) {
+                            return idbReq(s.get(IDB_DEK_ID));
+                        })];
+                    case 3:
+                        existing = _a.sent();
+                        if (existing === null || existing === void 0 ? void 0 : existing.key) {
+                            this.dek = existing.key;
+                            return [2 /*return*/, existing.key];
+                        }
+                        return [4 /*yield*/, crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt'])];
+                    case 4:
+                        generated = _a.sent();
+                        return [4 /*yield*/, this.withStore(IDB_KEYS_STORE, 'readwrite', function (s) { return tslib_1.__awaiter(_this, void 0, void 0, function () {
+                                var rec, e_3, again;
+                                return tslib_1.__generator(this, function (_a) {
+                                    switch (_a.label) {
+                                        case 0: return [4 /*yield*/, idbReq(s.get(IDB_DEK_ID))];
+                                        case 1:
+                                            rec = _a.sent();
+                                            if (rec === null || rec === void 0 ? void 0 : rec.key)
+                                                return [2 /*return*/, rec.key];
+                                            _a.label = 2;
+                                        case 2:
+                                            _a.trys.push([2, 4, , 7]);
+                                            return [4 /*yield*/, idbReq(s.add({ id: IDB_DEK_ID, key: generated }))];
+                                        case 3:
+                                            _a.sent();
+                                            return [2 /*return*/, generated];
+                                        case 4:
+                                            e_3 = _a.sent();
+                                            if (!((e_3 === null || e_3 === void 0 ? void 0 : e_3.name) === 'ConstraintError')) return [3 /*break*/, 6];
+                                            return [4 /*yield*/, idbReq(s.get(IDB_DEK_ID))];
+                                        case 5:
+                                            again = _a.sent();
+                                            if (!(again === null || again === void 0 ? void 0 : again.key))
+                                                throw new Error('Failed to load IndexedDB encryption key');
+                                            return [2 /*return*/, again.key];
+                                        case 6: throw e_3;
+                                        case 7: return [2 /*return*/];
+                                    }
+                                });
+                            }); })];
+                    case 5:
+                        key = _a.sent();
+                        this.dek = key;
+                        return [2 /*return*/, key];
+                }
+            });
+        });
+    };
+    //@internal
+    IndexedDbDataProvider.prototype.plaintextDbNames = function (entity) {
+        return tslib_1.__awaiter(this, void 0, void 0, function () {
+            var names, set, _a, _b, f, _c, _d, def, keys, _loop_1, keys_1, keys_1_1, key;
+            var e_4, _e, e_5, _f, e_6, _g;
+            return tslib_1.__generator(this, function (_h) {
+                switch (_h.label) {
+                    case 0: return [4 /*yield*/, (0, filter_consumer_bridge_to_sql_request_js_1.dbNamesOf)(entity, function (x) { return x; })];
+                    case 1:
+                        names = _h.sent();
+                        set = new Set();
+                        try {
+                            for (_a = tslib_1.__values(entity.idMetadata.fields), _b = _a.next(); !_b.done; _b = _a.next()) {
+                                f = _b.value;
+                                set.add(names.$dbNameOf(f));
+                            }
+                        }
+                        catch (e_4_1) { e_4 = { error: e_4_1 }; }
+                        finally {
+                            try {
+                                if (_b && !_b.done && (_e = _a.return)) _e.call(_a);
+                            }
+                            finally { if (e_4) throw e_4.error; }
+                        }
+                        try {
+                            for (_c = tslib_1.__values(this.indexesFor(entity)), _d = _c.next(); !_d.done; _d = _c.next()) {
+                                def = _d.value;
+                                keys = Array.isArray(def) ? tslib_1.__spreadArray([], tslib_1.__read(def), false) : [def];
+                                _loop_1 = function (key) {
+                                    var field = tslib_1.__spreadArray([], tslib_1.__read(entity.fields), false).find(function (f) { return f.key === key; });
+                                    if (field)
+                                        set.add(names.$dbNameOf(field));
+                                };
+                                try {
+                                    for (keys_1 = (e_6 = void 0, tslib_1.__values(keys)), keys_1_1 = keys_1.next(); !keys_1_1.done; keys_1_1 = keys_1.next()) {
+                                        key = keys_1_1.value;
+                                        _loop_1(key);
+                                    }
+                                }
+                                catch (e_6_1) { e_6 = { error: e_6_1 }; }
+                                finally {
+                                    try {
+                                        if (keys_1_1 && !keys_1_1.done && (_g = keys_1.return)) _g.call(keys_1);
+                                    }
+                                    finally { if (e_6) throw e_6.error; }
+                                }
+                            }
+                        }
+                        catch (e_5_1) { e_5 = { error: e_5_1 }; }
+                        finally {
+                            try {
+                                if (_d && !_d.done && (_f = _c.return)) _f.call(_c);
+                            }
+                            finally { if (e_5) throw e_5.error; }
+                        }
+                        return [2 /*return*/, set];
+                }
+            });
+        });
+    };
+    //@internal
     IndexedDbDataProvider.prototype.forget = function (db) {
         if (this.db === db)
             this.db = undefined;
@@ -288,17 +449,17 @@ var IndexedDbDataProvider = /** @class */ (function () {
     IndexedDbDataProvider.prototype.fetchOps = function (storeName, entity, ops) {
         var _this = this;
         return this.withStore(storeName, 'readonly', function (store) { return tslib_1.__awaiter(_this, void 0, void 0, function () {
-            var idKey, seen, rows, _loop_1, ops_1, ops_1_1, op, e_3_1;
-            var e_3, _a;
+            var idKey, seen, rows, _loop_2, ops_1, ops_1_1, op, e_7_1;
+            var e_7, _a;
             return tslib_1.__generator(this, function (_b) {
                 switch (_b.label) {
                     case 0:
                         idKey = entity.idMetadata.fields[0].key;
                         seen = new Set();
                         rows = [];
-                        _loop_1 = function (op) {
+                        _loop_2 = function (op) {
                             var source, chunk, _c, _d, chunk_1, chunk_1_1, row, k;
-                            var e_4, _e;
+                            var e_8, _e;
                             return tslib_1.__generator(this, function (_f) {
                                 switch (_f.label) {
                                     case 0:
@@ -323,7 +484,7 @@ var IndexedDbDataProvider = /** @class */ (function () {
                                     case 7:
                                         chunk = _c;
                                         try {
-                                            for (chunk_1 = (e_4 = void 0, tslib_1.__values(chunk)), chunk_1_1 = chunk_1.next(); !chunk_1_1.done; chunk_1_1 = chunk_1.next()) {
+                                            for (chunk_1 = (e_8 = void 0, tslib_1.__values(chunk)), chunk_1_1 = chunk_1.next(); !chunk_1_1.done; chunk_1_1 = chunk_1.next()) {
                                                 row = chunk_1_1.value;
                                                 if (row == null)
                                                     continue;
@@ -334,12 +495,12 @@ var IndexedDbDataProvider = /** @class */ (function () {
                                                 rows.push(row);
                                             }
                                         }
-                                        catch (e_4_1) { e_4 = { error: e_4_1 }; }
+                                        catch (e_8_1) { e_8 = { error: e_8_1 }; }
                                         finally {
                                             try {
                                                 if (chunk_1_1 && !chunk_1_1.done && (_e = chunk_1.return)) _e.call(chunk_1);
                                             }
-                                            finally { if (e_4) throw e_4.error; }
+                                            finally { if (e_8) throw e_8.error; }
                                         }
                                         return [2 /*return*/];
                                 }
@@ -353,7 +514,7 @@ var IndexedDbDataProvider = /** @class */ (function () {
                     case 2:
                         if (!!ops_1_1.done) return [3 /*break*/, 5];
                         op = ops_1_1.value;
-                        return [5 /*yield**/, _loop_1(op)];
+                        return [5 /*yield**/, _loop_2(op)];
                     case 3:
                         _b.sent();
                         _b.label = 4;
@@ -362,14 +523,14 @@ var IndexedDbDataProvider = /** @class */ (function () {
                         return [3 /*break*/, 2];
                     case 5: return [3 /*break*/, 8];
                     case 6:
-                        e_3_1 = _b.sent();
-                        e_3 = { error: e_3_1 };
+                        e_7_1 = _b.sent();
+                        e_7 = { error: e_7_1 };
                         return [3 /*break*/, 8];
                     case 7:
                         try {
                             if (ops_1_1 && !ops_1_1.done && (_a = ops_1.return)) _a.call(ops_1);
                         }
-                        finally { if (e_3) throw e_3.error; }
+                        finally { if (e_7) throw e_7.error; }
                         return [7 /*endfinally*/];
                     case 8: return [2 /*return*/, rows];
                 }
@@ -428,17 +589,17 @@ var IndexedDbEntityDataProvider = /** @class */ (function () {
     IndexedDbEntityDataProvider.prototype.insert = function (data) {
         var _this = this;
         return this.provider.enqueue(function () { return tslib_1.__awaiter(_this, void 0, void 0, function () {
-            var helper, names, auto, idName, rows;
+            var helper, names, auto, idName, rows, storeName, dek, _a, keep, _b, keys, i, toWrite, _c;
             var _this = this;
-            return tslib_1.__generator(this, function (_a) {
-                switch (_a.label) {
+            return tslib_1.__generator(this, function (_d) {
+                switch (_d.label) {
                     case 0: return [4 /*yield*/, this.provider.ensureStores([this.entity])];
                     case 1:
-                        _a.sent();
+                        _d.sent();
                         helper = new array_entity_data_provider_js_1.ArrayEntityDataProvider(this.entity, function () { return []; });
                         return [4 /*yield*/, helper.init()];
                     case 2:
-                        names = _a.sent();
+                        names = _d.sent();
                         auto = (0, RepositoryImplementation_js_1.isAutoIncrement)(this.entity.idMetadata.field);
                         idName = names.$dbNameOf(this.entity.idMetadata.field);
                         rows = data.map(function (row) {
@@ -448,57 +609,109 @@ var IndexedDbEntityDataProvider = /** @class */ (function () {
                                 delete json[idName];
                             return json;
                         });
-                        return [2 /*return*/, this.provider.withStore(storeNameOf(this.entity), 'readwrite', function (store) { return tslib_1.__awaiter(_this, void 0, void 0, function () {
-                                var result, rows_1, rows_1_1, json, key, e_5, e_6_1;
-                                var e_6, _a;
-                                var _b;
+                        storeName = storeNameOf(this.entity);
+                        if (!this.provider.encrypt) return [3 /*break*/, 4];
+                        return [4 /*yield*/, this.provider.loadDek()];
+                    case 3:
+                        _a = _d.sent();
+                        return [3 /*break*/, 5];
+                    case 4:
+                        _a = undefined;
+                        _d.label = 5;
+                    case 5:
+                        dek = _a;
+                        if (!dek) return [3 /*break*/, 7];
+                        return [4 /*yield*/, this.provider.plaintextDbNames(this.entity)];
+                    case 6:
+                        _b = _d.sent();
+                        return [3 /*break*/, 8];
+                    case 7:
+                        _b = undefined;
+                        _d.label = 8;
+                    case 8:
+                        keep = _b;
+                        if (!(dek && auto)) return [3 /*break*/, 10];
+                        return [4 /*yield*/, this.provider.withStore(storeName, 'readwrite', function (store) { return tslib_1.__awaiter(_this, void 0, void 0, function () {
+                                var allocated, i, _a, _b;
                                 return tslib_1.__generator(this, function (_c) {
                                     switch (_c.label) {
                                         case 0:
-                                            result = [];
+                                            allocated = [];
+                                            i = 0;
                                             _c.label = 1;
                                         case 1:
-                                            _c.trys.push([1, 9, 10, 11]);
-                                            rows_1 = tslib_1.__values(rows), rows_1_1 = rows_1.next();
-                                            _c.label = 2;
+                                            if (!(i < rows.length)) return [3 /*break*/, 4];
+                                            _b = (_a = allocated).push;
+                                            return [4 /*yield*/, idbReq(store.add({}))];
                                         case 2:
-                                            if (!!rows_1_1.done) return [3 /*break*/, 8];
-                                            json = rows_1_1.value;
+                                            _b.apply(_a, [_c.sent()]);
                                             _c.label = 3;
                                         case 3:
-                                            _c.trys.push([3, 5, , 6]);
-                                            return [4 /*yield*/, idbReq(store.add(json))];
-                                        case 4:
-                                            key = _c.sent();
-                                            if (auto)
-                                                json[idName] = (_b = json[idName]) !== null && _b !== void 0 ? _b : key;
+                                            i++;
+                                            return [3 /*break*/, 1];
+                                        case 4: return [2 /*return*/, allocated];
+                                    }
+                                });
+                            }); })];
+                    case 9:
+                        keys = _d.sent();
+                        for (i = 0; i < rows.length; i++) {
+                            rows[i][idName] = keys[i];
+                        }
+                        _d.label = 10;
+                    case 10:
+                        if (!dek) return [3 /*break*/, 12];
+                        return [4 /*yield*/, Promise.all(rows.map(function (json) {
+                                return encryptJson(storeName, json, keep, keyFromRow(_this.entity, names, json), dek);
+                            }))];
+                    case 11:
+                        _c = _d.sent();
+                        return [3 /*break*/, 13];
+                    case 12:
+                        _c = rows;
+                        _d.label = 13;
+                    case 13:
+                        toWrite = _c;
+                        return [4 /*yield*/, this.provider.withStore(storeName, 'readwrite', function (store) { return tslib_1.__awaiter(_this, void 0, void 0, function () {
+                                var i, key, e_9;
+                                var _a;
+                                return tslib_1.__generator(this, function (_b) {
+                                    switch (_b.label) {
+                                        case 0:
+                                            i = 0;
+                                            _b.label = 1;
+                                        case 1:
+                                            if (!(i < toWrite.length)) return [3 /*break*/, 9];
+                                            _b.label = 2;
+                                        case 2:
+                                            _b.trys.push([2, 7, , 8]);
+                                            if (!(dek && auto)) return [3 /*break*/, 4];
+                                            return [4 /*yield*/, idbReq(store.put(toWrite[i]))];
+                                        case 3:
+                                            _b.sent();
                                             return [3 /*break*/, 6];
+                                        case 4: return [4 /*yield*/, idbReq(store.add(toWrite[i]))];
                                         case 5:
-                                            e_5 = _c.sent();
-                                            if ((e_5 === null || e_5 === void 0 ? void 0 : e_5.name) === 'ConstraintError')
-                                                throw Error('id already exists');
-                                            throw e_5;
-                                        case 6:
-                                            result.push(helper.translateFromJson(json, names));
-                                            _c.label = 7;
+                                            key = _b.sent();
+                                            if (auto)
+                                                rows[i][idName] = (_a = rows[i][idName]) !== null && _a !== void 0 ? _a : key;
+                                            _b.label = 6;
+                                        case 6: return [3 /*break*/, 8];
                                         case 7:
-                                            rows_1_1 = rows_1.next();
-                                            return [3 /*break*/, 2];
-                                        case 8: return [3 /*break*/, 11];
-                                        case 9:
-                                            e_6_1 = _c.sent();
-                                            e_6 = { error: e_6_1 };
-                                            return [3 /*break*/, 11];
-                                        case 10:
-                                            try {
-                                                if (rows_1_1 && !rows_1_1.done && (_a = rows_1.return)) _a.call(rows_1);
-                                            }
-                                            finally { if (e_6) throw e_6.error; }
-                                            return [7 /*endfinally*/];
-                                        case 11: return [2 /*return*/, result];
+                                            e_9 = _b.sent();
+                                            if ((e_9 === null || e_9 === void 0 ? void 0 : e_9.name) === 'ConstraintError')
+                                                throw Error('id already exists');
+                                            throw e_9;
+                                        case 8:
+                                            i++;
+                                            return [3 /*break*/, 1];
+                                        case 9: return [2 /*return*/];
                                     }
                                 });
                             }); })];
+                    case 14:
+                        _d.sent();
+                        return [2 /*return*/, rows.map(function (json) { return helper.translateFromJson(json, names); })];
                 }
             });
         }); });
@@ -506,64 +719,104 @@ var IndexedDbEntityDataProvider = /** @class */ (function () {
     IndexedDbEntityDataProvider.prototype.update = function (id, data) {
         var _this = this;
         return this.provider.enqueue(function () { return tslib_1.__awaiter(_this, void 0, void 0, function () {
-            var helper, names, key;
+            var helper, names, key, storeName, existingRaw, dek, _a, existing, _b, json, keys, _c, _d, f, newKey, toWrite, _e, _f, _g;
+            var e_10, _h;
             var _this = this;
-            return tslib_1.__generator(this, function (_a) {
-                switch (_a.label) {
+            return tslib_1.__generator(this, function (_j) {
+                switch (_j.label) {
                     case 0: return [4 /*yield*/, this.provider.ensureStores([this.entity])];
                     case 1:
-                        _a.sent();
+                        _j.sent();
                         helper = new array_entity_data_provider_js_1.ArrayEntityDataProvider(this.entity, function () { return []; });
                         return [4 /*yield*/, helper.init()];
                     case 2:
-                        names = _a.sent();
+                        names = _j.sent();
                         key = toIdbKey(this.entity, id);
-                        return [2 /*return*/, this.provider.withStore(storeNameOf(this.entity), 'readwrite', function (store) { return tslib_1.__awaiter(_this, void 0, void 0, function () {
-                                var existing, json, keys, _a, _b, f, newKey, conflict;
-                                var e_7, _c;
-                                return tslib_1.__generator(this, function (_d) {
-                                    switch (_d.label) {
-                                        case 0: return [4 /*yield*/, idbReq(store.get(key))];
-                                        case 1:
-                                            existing = _d.sent();
-                                            if (existing == null)
-                                                throw new Error("Couldn't find row with id \"".concat(id, "\" in entity \"").concat(this.entity.key, "\" to update"));
-                                            json = tslib_1.__assign({}, existing);
-                                            keys = Object.keys(data);
-                                            try {
-                                                for (_a = tslib_1.__values(this.entity.fields), _b = _a.next(); !_b.done; _b = _a.next()) {
-                                                    f = _b.value;
-                                                    if (!(0, filter_consumer_bridge_to_sql_request_js_1.isDbReadonly)(f, names) && keys.includes(f.key)) {
-                                                        json[names.$dbNameOf(f)] = f.valueConverter.toJson(data[f.key]);
-                                                    }
-                                                }
-                                            }
-                                            catch (e_7_1) { e_7 = { error: e_7_1 }; }
-                                            finally {
-                                                try {
-                                                    if (_b && !_b.done && (_c = _a.return)) _c.call(_a);
-                                                }
-                                                finally { if (e_7) throw e_7.error; }
-                                            }
-                                            helper.verifyThatRowHasAllNotNullColumns(json, names);
-                                            newKey = keyFromRow(this.entity, names, json);
-                                            if (!!idbKeysEqual(key, newKey)) return [3 /*break*/, 4];
+                        storeName = storeNameOf(this.entity);
+                        return [4 /*yield*/, this.provider.withStore(storeName, 'readonly', function (store) { return idbReq(store.get(key)); })];
+                    case 3:
+                        existingRaw = _j.sent();
+                        if (existingRaw == null)
+                            throw new Error("Couldn't find row with id \"".concat(id, "\" in entity \"").concat(this.entity.key, "\" to update"));
+                        if (!this.provider.encrypt) return [3 /*break*/, 5];
+                        return [4 /*yield*/, this.provider.loadDek()];
+                    case 4:
+                        _a = _j.sent();
+                        return [3 /*break*/, 6];
+                    case 5:
+                        _a = undefined;
+                        _j.label = 6;
+                    case 6:
+                        dek = _a;
+                        if (!dek) return [3 /*break*/, 8];
+                        return [4 /*yield*/, decryptJson(storeName, existingRaw, this.entity, names, dek)];
+                    case 7:
+                        _b = _j.sent();
+                        return [3 /*break*/, 9];
+                    case 8:
+                        _b = existingRaw;
+                        _j.label = 9;
+                    case 9:
+                        existing = _b;
+                        json = tslib_1.__assign({}, existing);
+                        keys = Object.keys(data);
+                        try {
+                            for (_c = tslib_1.__values(this.entity.fields), _d = _c.next(); !_d.done; _d = _c.next()) {
+                                f = _d.value;
+                                if (!(0, filter_consumer_bridge_to_sql_request_js_1.isDbReadonly)(f, names) && keys.includes(f.key)) {
+                                    json[names.$dbNameOf(f)] = f.valueConverter.toJson(data[f.key]);
+                                }
+                            }
+                        }
+                        catch (e_10_1) { e_10 = { error: e_10_1 }; }
+                        finally {
+                            try {
+                                if (_d && !_d.done && (_h = _c.return)) _h.call(_c);
+                            }
+                            finally { if (e_10) throw e_10.error; }
+                        }
+                        helper.verifyThatRowHasAllNotNullColumns(json, names);
+                        newKey = keyFromRow(this.entity, names, json);
+                        if (!dek) return [3 /*break*/, 12];
+                        _f = encryptJson;
+                        _g = [storeName,
+                            json];
+                        return [4 /*yield*/, this.provider.plaintextDbNames(this.entity)];
+                    case 10: return [4 /*yield*/, _f.apply(void 0, _g.concat([_j.sent(), newKey,
+                            dek]))];
+                    case 11:
+                        _e = _j.sent();
+                        return [3 /*break*/, 13];
+                    case 12:
+                        _e = json;
+                        _j.label = 13;
+                    case 13:
+                        toWrite = _e;
+                        return [4 /*yield*/, this.provider.withStore(storeName, 'readwrite', function (store) { return tslib_1.__awaiter(_this, void 0, void 0, function () {
+                                var conflict;
+                                return tslib_1.__generator(this, function (_a) {
+                                    switch (_a.label) {
+                                        case 0:
+                                            if (!!idbKeysEqual(key, newKey)) return [3 /*break*/, 3];
                                             return [4 /*yield*/, idbReq(store.get(newKey))];
-                                        case 2:
-                                            conflict = _d.sent();
+                                        case 1:
+                                            conflict = _a.sent();
                                             if (conflict != null)
                                                 throw Error('id already exists');
                                             return [4 /*yield*/, idbReq(store.delete(key))];
-                                        case 3:
-                                            _d.sent();
-                                            _d.label = 4;
-                                        case 4: return [4 /*yield*/, idbReq(store.put(json))];
-                                        case 5:
-                                            _d.sent();
-                                            return [2 /*return*/, helper.translateFromJson(json, names)];
+                                        case 2:
+                                            _a.sent();
+                                            _a.label = 3;
+                                        case 3: return [4 /*yield*/, idbReq(store.put(toWrite))];
+                                        case 4:
+                                            _a.sent();
+                                            return [2 /*return*/];
                                     }
                                 });
                             }); })];
+                    case 14:
+                        _j.sent();
+                        return [2 /*return*/, helper.translateFromJson(json, names)];
                 }
             });
         }); });
@@ -580,8 +833,8 @@ var IndexedDbEntityDataProvider = /** @class */ (function () {
                     case 1:
                         _a.sent();
                         return [2 /*return*/, this.provider.withStore(storeNameOf(this.entity), 'readwrite', function (store) { return tslib_1.__awaiter(_this, void 0, void 0, function () {
-                                var ids_1, ids_1_1, id, key, existing, e_8_1;
-                                var e_8, _a;
+                                var ids_1, ids_1_1, id, key, existing, e_11_1;
+                                var e_11, _a;
                                 return tslib_1.__generator(this, function (_b) {
                                     switch (_b.label) {
                                         case 0:
@@ -606,14 +859,14 @@ var IndexedDbEntityDataProvider = /** @class */ (function () {
                                             return [3 /*break*/, 1];
                                         case 5: return [3 /*break*/, 8];
                                         case 6:
-                                            e_8_1 = _b.sent();
-                                            e_8 = { error: e_8_1 };
+                                            e_11_1 = _b.sent();
+                                            e_11 = { error: e_11_1 };
                                             return [3 /*break*/, 8];
                                         case 7:
                                             try {
                                                 if (ids_1_1 && !ids_1_1.done && (_a = ids_1.return)) _a.call(ids_1);
                                             }
-                                            finally { if (e_8) throw e_8.error; }
+                                            finally { if (e_11) throw e_11.error; }
                                             return [7 /*endfinally*/];
                                         case 8: return [2 /*return*/];
                                     }
@@ -632,7 +885,7 @@ function storeNameOf(entity) {
 function idbPrefetchFromFilter(entity_1, where_1) {
     return tslib_1.__awaiter(this, arguments, void 0, function (entity, where, indexes) {
         var names, c, r, ordered, ordered_1, ordered_1_1, idx, r;
-        var e_9, _a;
+        var e_12, _a;
         if (indexes === void 0) { indexes = []; }
         return tslib_1.__generator(this, function (_b) {
             switch (_b.label) {
@@ -658,12 +911,12 @@ function idbPrefetchFromFilter(entity_1, where_1) {
                                 return [2 /*return*/, withIndex(r, idx.name)];
                         }
                     }
-                    catch (e_9_1) { e_9 = { error: e_9_1 }; }
+                    catch (e_12_1) { e_12 = { error: e_12_1 }; }
                     finally {
                         try {
                             if (ordered_1_1 && !ordered_1_1.done && (_a = ordered_1.return)) _a.call(ordered_1);
                         }
-                        finally { if (e_9) throw e_9.error; }
+                        finally { if (e_12) throw e_12.error; }
                     }
                     return [2 /*return*/, { type: 'all' }];
             }
@@ -734,7 +987,7 @@ function pathLen(keyPath) {
     return Array.isArray(keyPath) ? keyPath.length : 1;
 }
 function fieldByDbName(entity, names, dbName) {
-    var e_10, _a;
+    var e_13, _a;
     try {
         for (var _b = tslib_1.__values(entity.fields), _c = _b.next(); !_c.done; _c = _b.next()) {
             var f = _c.value;
@@ -742,32 +995,32 @@ function fieldByDbName(entity, names, dbName) {
                 return f;
         }
     }
-    catch (e_10_1) { e_10 = { error: e_10_1 }; }
+    catch (e_13_1) { e_13 = { error: e_13_1 }; }
     finally {
         try {
             if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
         }
-        finally { if (e_10) throw e_10.error; }
+        finally { if (e_13) throw e_13.error; }
     }
 }
 function cartesian(lists) {
-    var e_11, _a;
+    var e_14, _a;
     var acc = [[]];
-    var _loop_2 = function (list) {
+    var _loop_3 = function (list) {
         acc = acc.flatMap(function (prefix) { return list.map(function (v) { return tslib_1.__spreadArray(tslib_1.__spreadArray([], tslib_1.__read(prefix), false), [v], false); }); });
     };
     try {
         for (var lists_1 = tslib_1.__values(lists), lists_1_1 = lists_1.next(); !lists_1_1.done; lists_1_1 = lists_1.next()) {
             var list = lists_1_1.value;
-            _loop_2(list);
+            _loop_3(list);
         }
     }
-    catch (e_11_1) { e_11 = { error: e_11_1 }; }
+    catch (e_14_1) { e_14 = { error: e_14_1 }; }
     finally {
         try {
             if (lists_1_1 && !lists_1_1.done && (_a = lists_1.return)) _a.call(lists_1);
         }
-        finally { if (e_11) throw e_11.error; }
+        finally { if (e_14) throw e_14.error; }
     }
     return acc;
 }
@@ -924,7 +1177,7 @@ var IdbPrefetchCollector = /** @class */ (function () {
     return IdbPrefetchCollector;
 }());
 function mergeOps(ops) {
-    var e_12, _a;
+    var e_15, _a;
     var _b, _c;
     var keyGroups = new Map();
     var ranges = [];
@@ -939,12 +1192,12 @@ function mergeOps(ops) {
                 ranges.push(op);
         }
     }
-    catch (e_12_1) { e_12 = { error: e_12_1 }; }
+    catch (e_15_1) { e_15 = { error: e_15_1 }; }
     finally {
         try {
             if (ops_2_1 && !ops_2_1.done && (_a = ops_2.return)) _a.call(ops_2);
         }
-        finally { if (e_12) throw e_12.error; }
+        finally { if (e_15) throw e_15.error; }
     }
     var parts = tslib_1.__spreadArray(tslib_1.__spreadArray([], tslib_1.__read(tslib_1.__spreadArray([], tslib_1.__read(keyGroups.entries()), false).map(function (_a) {
         var _b = tslib_1.__read(_a, 2), index = _b[0], keys = _b[1];
@@ -957,7 +1210,7 @@ function mergeOps(ops) {
 function resolveIndexDefs(entity, defs, storeKeyPath) {
     return tslib_1.__awaiter(this, void 0, void 0, function () {
         var names, result, seen, pk, defs_1, defs_1_1, def, keys, keyPath, path, name_3;
-        var e_13, _a;
+        var e_16, _a;
         return tslib_1.__generator(this, function (_b) {
             switch (_b.label) {
                 case 0:
@@ -989,12 +1242,12 @@ function resolveIndexDefs(entity, defs, storeKeyPath) {
                             result.push({ name: name_3, keyPath: path });
                         }
                     }
-                    catch (e_13_1) { e_13 = { error: e_13_1 }; }
+                    catch (e_16_1) { e_16 = { error: e_16_1 }; }
                     finally {
                         try {
                             if (defs_1_1 && !defs_1_1.done && (_a = defs_1.return)) _a.call(defs_1);
                         }
-                        finally { if (e_13) throw e_13.error; }
+                        finally { if (e_16) throw e_16.error; }
                     }
                     return [2 /*return*/, result];
             }
@@ -1046,3 +1299,89 @@ function idbReq(request) {
         request.onerror = function () { return reject(request.error); };
     });
 }
+function encAad(storeName, id) {
+    return new TextEncoder().encode(storeName + '\0' + JSON.stringify(id));
+}
+function asBufferSource(value, label) {
+    if (value instanceof Uint8Array || value instanceof ArrayBuffer)
+        return value;
+    throw new Error("Failed to decrypt IndexedDB row: missing ".concat(label));
+}
+function encryptJson(storeName, json, plaintext, idbKey, dek) {
+    return tslib_1.__awaiter(this, void 0, void 0, function () {
+        var stored, payload, _a, _b, k, iv, _c, _d;
+        var e_17, _e;
+        return tslib_1.__generator(this, function (_f) {
+            switch (_f.label) {
+                case 0:
+                    stored = {};
+                    payload = {};
+                    try {
+                        for (_a = tslib_1.__values(Object.keys(json)), _b = _a.next(); !_b.done; _b = _a.next()) {
+                            k = _b.value;
+                            if (k === IDB_ENC || k === IDB_IV)
+                                continue;
+                            if (plaintext.has(k))
+                                stored[k] = json[k];
+                            else
+                                payload[k] = json[k];
+                        }
+                    }
+                    catch (e_17_1) { e_17 = { error: e_17_1 }; }
+                    finally {
+                        try {
+                            if (_b && !_b.done && (_e = _a.return)) _e.call(_a);
+                        }
+                        finally { if (e_17) throw e_17.error; }
+                    }
+                    iv = crypto.getRandomValues(new Uint8Array(12));
+                    _c = stored;
+                    _d = IDB_ENC;
+                    return [4 /*yield*/, crypto.subtle.encrypt({
+                            name: 'AES-GCM',
+                            iv: iv,
+                            additionalData: encAad(storeName, idbKey),
+                        }, dek, new TextEncoder().encode(JSON.stringify(payload)))];
+                case 1:
+                    _c[_d] = _f.sent();
+                    stored[IDB_IV] = iv;
+                    return [2 /*return*/, stored];
+            }
+        });
+    });
+}
+function decryptJson(storeName, row, entity, names, dek) {
+    return tslib_1.__awaiter(this, void 0, void 0, function () {
+        var idbKey, plain, payload, result, e_18;
+        var _a;
+        return tslib_1.__generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    if (row == null || row[IDB_ENC] == null)
+                        return [2 /*return*/, row];
+                    idbKey = keyFromRow(entity, names, row);
+                    _b.label = 1;
+                case 1:
+                    _b.trys.push([1, 3, , 4]);
+                    return [4 /*yield*/, crypto.subtle.decrypt({
+                            name: 'AES-GCM',
+                            iv: asBufferSource(row[IDB_IV], IDB_IV),
+                            additionalData: encAad(storeName, idbKey),
+                        }, dek, asBufferSource(row[IDB_ENC], IDB_ENC))];
+                case 2:
+                    plain = _b.sent();
+                    payload = JSON.parse(new TextDecoder().decode(plain));
+                    result = tslib_1.__assign(tslib_1.__assign({}, row), payload);
+                    delete result[IDB_ENC];
+                    delete result[IDB_IV];
+                    return [2 /*return*/, result];
+                case 3:
+                    e_18 = _b.sent();
+                    if ((_a = e_18 === null || e_18 === void 0 ? void 0 : e_18.message) === null || _a === void 0 ? void 0 : _a.startsWith('Failed to decrypt IndexedDB row'))
+                        throw e_18;
+                    throw new Error("Failed to decrypt IndexedDB row in \"".concat(storeName, "\""));
+                case 4: return [2 /*return*/];
+            }
+        });
+    });
+}