Cabinet 1.0.0

Cabinet

A secure, indexed offline datastore for .NET MAUI. It’s the simplest way to persist structured data locally - encrypted, searchable, and AOT-safe - without the complexity of a traditional database.

Why

Most mobile apps don’t need a database, they need an offline data store. Something that can securely persist structured data, search it quickly, and work seamlessly across all target platforms.

Traditional solutions like SQLite or LiteDB are excellent tools, but they bring baggage:

• Native dependencies and platform-specific quirks
• AOT compilation issues (LiteDB)
• Configuration overhead (SQLite encryption - which has commercial implications too)
• API friction for what often boils down to “store, query, retrieve”

Cabinet was created to solve that problem.

It gives you database-like capabilities without the database: encryption, indexing, fast lookups, and predictable performance — all in pure .NET.

What it is

OfflineData borrows the document-style persistence approach of NoSQL systems, but applies it in a lightweight, encrypted, AOT-friendly way tailored for mobile apps.

If you think you need a mobile database, you might actually need this.

What it isn't

If you’ve ever used IndexedDB in the browser, you can think of this as IndexedDB for MAUI, but simpler, safer, and designed for .NET idioms.

Features

• AES-256-GCM encryption (per file)
• HKDF key derivation with SecureStorage master key
• Persistent encrypted full-text index
• Atomic writes (no plaintext ever on disk)
• JSON serialisation (customisable)
• Extensible architecture (BYO store, index, encryption)
• 100% managed .NET, AOT-safe, no native dependencies

Performance Summary

Cabinet offers consistent, predictable performance, even with encryption.

Tests measure saving and indexing the entire dataset, not single-record inserts. For incremental operations, performance is effectively instantaneous.

Quick start

using Cabinet;
using Cabinet.Index;
using Cabinet.Security;

// Generate or retrieve a master encryption key (32 bytes)
var masterKey = new byte[32];
RandomNumberGenerator.Fill(masterKey);
// In production, store this key securely using SecureStorage

var encryption = new AesGcmEncryptionProvider(masterKey);
var index = new PersistentIndexProvider(FileSystem.AppDataDirectory, encryption);

var store = new FileOfflineStore(
    FileSystem.AppDataDirectory,
    encryption,
    index);

// Save
await store.SaveAsync("lesson-2025-10-27", new LessonRecord {
    Subject = "Science",
    Description = "Observed seagulls at the beach"
});

// Search
var results = await store.FindAsync("seagulls");

Extensibility

The core components (storage, indexing, and encryption) are all replaceable. You can implement IOfflineStore, IIndexProvider, or IEncryptionProvider to extend behaviour.

Examples:

• Replace AES-GCM with a hardware-backed key provider
• Implement a custom indexer for vector search
• Store large attachments in a separate encrypted volume

See Architecture for extension points and examples.

Conceptual Architecture

/AppData/
 ├── records/
 │    ├── {id}.dat        # Encrypted JSON
 │    ├── {id}.meta       # Encrypted metadata
 ├── attachments/
 │    ├── {id}-{filename}.bin
 ├── index/
 │    └── search.idx      # Encrypted inverted index
 └── summary/
      └── {year}.sum      # Encrypted summaries

Learn Mode