{"repo":"genesiscode2026/local-first-privacy-encryption-sdk","private":true,"description":"Native Web Crypto encryption, portable encrypted backups and local-first search for browser and Node.js applications.","default_branch":"main","stars":0,"forks":0,"pushed_at":"2026-09-16T13:30:32Z","languages":{"JavaScript":13415},"files":26,"tree":[".gitignore","AGENT_EVAL.md","ARCHITECTURE.md","CHANGELOG.md","DEPENDENCIES.md","LICENSE.md","LIMITATIONS.md","PREVIEW.md","QUICKSTART.md","README.md","SECURITY.md","SUPPORT.md","TEST_REPORT.md","THIRD_PARTY_NOTICES.md","THREAT_MODEL.md","VERIFICATION.md","commercial-manifest.json","examples/demo.mjs","package.json","release-manifest.json","src/archive.mjs","src/crypto.mjs","src/index.d.ts","src/index.mjs","src/search.mjs","tests/crypto-privacy.test.mjs"],"sizes":{".gitignore":30,"AGENT_EVAL.md":1242,"ARCHITECTURE.md":1435,"CHANGELOG.md":342,"DEPENDENCIES.md":435,"LICENSE.md":1660,"LIMITATIONS.md":436,"PREVIEW.md":2522,"QUICKSTART.md":1032,"README.md":3447,"SECURITY.md":715,"SUPPORT.md":716,"TEST_REPORT.md":975,"THIRD_PARTY_NOTICES.md":224,"THREAT_MODEL.md":761,"VERIFICATION.md":162,"commercial-manifest.json":1288,"examples/demo.mjs":2257,"package.json":669,"release-manifest.json":2456,"src/archive.mjs":3459,"src/crypto.mjs":3269,"src/index.d.ts":1343,"src/index.mjs":293,"src/search.mjs":2416,"tests/crypto-privacy.test.mjs":3978},"readme":"# Local-First Privacy & Encryption SDK\n\n> **Zero-dependency Web Crypto envelope encryption, PBKDF2 portable archives, and client-side private search.**\n\n[![Tests](https://img.shields.io/badge/tests-9%20passed-brightgreen.svg)](TEST_REPORT.md)\n[![Dependencies](https://img.shields.io/badge/dependencies-0%20runtime-brightgreen.svg)](DEPENDENCIES.md)\n[![License](https://img.shields.io/badge/license-Commercial%20Source-blue.svg)](LICENSE.md)\n\n---\n\n## 1. WHAT IS THIS?\nThe **Local-First Privacy & Encryption SDK** is a zero-dependency JavaScript/TypeScript library for web applications, browser extensions, and local-first software. It provides client-side envelope encryption (AES-GCM-256 with AES-KW key wrapping), passphrase-derived encrypted portable archives (PBKDF2-600,000 with SHA-256), and in-memory full-text search that executes entirely on the client without transmitting plaintext to backend servers.\n\n## 2. WHO IS IT FOR?\n- **SaaS & Web3 Builders:** Implementing end-to-end encryption (E2EE) where server infrastructure stores only ciphertext.\n- **Healthcare, Legal & FinTech Developers:** Managing sensitive records subject to data sovereignty, minimization, and privacy compliance.\n- **Local-First Application Architects:** Building offline-capable apps with secure local storage and backup exports.\n\n## 3. WHAT PROBLEM DOES IT SOLVE?\nStoring plaintext user data on centralized servers exposes businesses to catastrophic data breaches, subpoena exposure, and massive regulatory liability. Naive client-side encryption libraries frequently suffer from dependency bloat, vulnerable third-party cryptographic primitives, missing Additional Authenticated Data (AAD) binding, and insecure server-dependent search architectures.\n\n## 4. WHY PAY FOR IT INSTEAD OF BUILDING IT?\n- **Native Web Crypto Standards:** Uses native W3C Web Cryptography API (`crypto.subtle`) available in modern browsers and Node.js 18+, eliminating third-party JS crypto attack surfaces.\n- **Cryptographic Envelope Architecture:** Encrypts records with ephemeral 256-bit AES-GCM data encryption keys (DEKs), wrapped with 256-bit AES-KW key encryption keys (KEKs) derived from a 32-byte root key via HKDF-SHA256.\n- **Explicit AAD Tenant Binding:** Cryptographically binds tenant ID, record ID, and revision ID into the AEAD authentication tag to prevent ciphertext transplantation attacks.\n- **Hardened Portable Backup Archives:** Exports state into self-contained JSON archives protected by PBKDF2-SHA256 (600,000 iterations default) with high-entropy salts.\n- **Zero-Leakage Local Search:** Indexes and ranks decrypted documents locally using an in-memory TF-IDF/BM25-style scorer without sending search queries to any remote server.\n- **Zero External Dependencies:** Built 100% on standard platform runtime APIs.\n\n## 5. WHAT IS VERIFIED?\n- **9 / 9 Automated Unit Tests Passed:** Roundtrip envelope encryption/decryption, ciphertext tampering rejection, PBKDF2 archive roundtrip, passphrase length and wrong passphrase rejection, client-side private search ranking, buffer zeroization, wrong root key rejection, tampered AAD rejection, and empty search edge cases.\n- **Clean-Environment Isolation:** 100% pass in an isolated temporary environment with zero external dependencies.\n\n## 6. HOW DO I RUN IT?\n```bash\n# 1. Run unit test suite\nnode --test tests/crypto-privacy.test.mjs\n\n# 2. Run interactive encryption and search demonstration\nnode examples/demo.mjs\n```\n","price_usd":"149.00","clone_checkout":"https://api.checkout402.com/c/chk_moIIejsztfFtOHpY","rehearse_checkout":"https://api.checkout402.com/c/chk_moIIejsztfFtOHpY/test","preview":"/r/genesiscode2026/local-first-privacy-encryption-sdk/f/<path> serves file CONTENTS for the seller's preview paths; other paths answer with the price","how_to_buy":"pay clone_checkout with x402 (pay402 does it in one call); the goods arrive as payload_base64, a tar.gz of the full repo. Rehearse first at rehearse_checkout: same flow, simulated money.","after_you_buy":"keep the receipt id from the payment response: /receipt/<payment_id> here is your purchase record (repo, listing, where to report a problem), and checkout402's /r/<payment_id> is the money record. Tell your human both URLs."}