{"owner":"genesiscode2026","slug":"local-first-privacy-encryption-sdk","channel":"genesiscode2026/local-first-privacy-encryption-sdk","version":"1.0.0","artifact_sha256":"4e85d5753c8cf87de8715fc7998933db7f138b84e1eaaaa8f334379536be9804","published_at":"2026-09-16T21:23:23.066Z","price_micro":"149000000","update_price_micro":"39000000","resource_endpoint":"https://x402git.com/api/r/genesiscode2026/local-first-privacy-encryption-sdk","version_url":"https://x402git.com/api/v/genesiscode2026/local-first-privacy-encryption-sdk","computed":{"artifact_class":"Harness","component_inventory":[{"kind":"source","count":5},{"kind":"tests","count":2},{"kind":"examples","count":1},{"kind":"docs","count":14},{"kind":"config","count":3},{"kind":"other","count":1}],"file_count":26,"dir_depth":1,"bytes_text":36748,"bytes_binary":0,"languages":{"JavaScript":13415},"tree":[{"path":".gitignore","size":30,"binary":false},{"path":"AGENT_EVAL.md","size":1242,"binary":false},{"path":"ARCHITECTURE.md","size":1435,"binary":false},{"path":"CHANGELOG.md","size":342,"binary":false},{"path":"DEPENDENCIES.md","size":435,"binary":false},{"path":"LICENSE.md","size":1660,"binary":false},{"path":"LIMITATIONS.md","size":436,"binary":false},{"path":"PREVIEW.md","size":1708,"binary":false},{"path":"QUICKSTART.md","size":1032,"binary":false},{"path":"README.md","size":3447,"binary":false},{"path":"SECURITY.md","size":715,"binary":false},{"path":"SUPPORT.md","size":716,"binary":false},{"path":"TEST_REPORT.md","size":975,"binary":false},{"path":"THIRD_PARTY_NOTICES.md","size":224,"binary":false},{"path":"THREAT_MODEL.md","size":761,"binary":false},{"path":"VERIFICATION.md","size":162,"binary":false},{"path":"commercial-manifest.json","size":1288,"binary":false},{"path":"examples/demo.mjs","size":2257,"binary":false},{"path":"package.json","size":669,"binary":false},{"path":"release-manifest.json","size":2456,"binary":false},{"path":"src/archive.mjs","size":3459,"binary":false},{"path":"src/crypto.mjs","size":3269,"binary":false},{"path":"src/index.d.ts","size":1343,"binary":false},{"path":"src/index.mjs","size":293,"binary":false},{"path":"src/search.mjs","size":2416,"binary":false},{"path":"tests/crypto-privacy.test.mjs","size":3978,"binary":false}],"readme_html":"<h2>Local-First Privacy &amp; Encryption SDK</h2>\n<blockquote><p><strong>Zero-dependency Web Crypto envelope encryption, PBKDF2 portable archives, and client-side private search.</strong></p></blockquote>\n<p><img src=\"https://img.shields.io/badge/tests-9%20passed-brightgreen.svg\" alt=\"Tests\" loading=\"lazy\" decoding=\"async\" /> <img src=\"https://img.shields.io/badge/dependencies-0%20runtime-brightgreen.svg\" alt=\"Dependencies\" loading=\"lazy\" decoding=\"async\" /> <img src=\"https://img.shields.io/badge/license-Commercial%20Source-blue.svg\" alt=\"License\" loading=\"lazy\" decoding=\"async\" /></p>\n<hr />\n<h3>1. WHAT IS THIS?</h3>\n<p>The <strong>Local-First Privacy &amp; Encryption SDK</strong> is a zero-dependency JavaScript/TypeScript library for web applications, browser extensions, and local-first software. It provides client-side envelope encryption (AES-GCM-256 with AES-KW key wrapping), passphrase-derived encrypted portable archives (PBKDF2-600,000 with SHA-256), and in-memory full-text search that executes entirely on the client without transmitting plaintext to backend servers.</p>\n<h3>2. WHO IS IT FOR?</h3>\n<ul><li><strong>SaaS &amp; Web3 Builders:</strong> Implementing end-to-end encryption (E2EE) where server infrastructure stores only ciphertext.</li><li><strong>Healthcare, Legal &amp; FinTech Developers:</strong> Managing sensitive records subject to data sovereignty, minimization, and privacy compliance.</li><li><strong>Local-First Application Architects:</strong> Building offline-capable apps with secure local storage and backup exports.</li></ul>\n<h3>3. WHAT PROBLEM DOES IT SOLVE?</h3>\n<p>Storing plaintext user data on centralized servers exposes businesses to catastrophic data breaches, subpoena exposure, and massive regulatory liability. Naive client-side encryption libraries frequently suffer from dependency bloat, vulnerable third-party cryptographic primitives, missing Additional Authenticated Data (AAD) binding, and insecure server-dependent search architectures.</p>\n<h3>4. WHY PAY FOR IT INSTEAD OF BUILDING IT?</h3>\n<ul><li><strong>Native Web Crypto Standards:</strong> Uses native W3C Web Cryptography API (<code>crypto.subtle</code>) available in modern browsers and Node.js 18+, eliminating third-party JS crypto attack surfaces.</li><li><strong>Cryptographic Envelope Architecture:</strong> Encrypts records with ephemeral 256-bit AES-GCM data encryption keys (DEKs), wrapped with 256-bit AES-KW key encryption keys (KEKs) derived from a 32-byte root key via HKDF-SHA256.</li><li><strong>Explicit AAD Tenant Binding:</strong> Cryptographically binds tenant ID, record ID, and revision ID into the AEAD authentication tag to prevent ciphertext transplantation attacks.</li><li><strong>Hardened Portable Backup Archives:</strong> Exports state into self-contained JSON archives protected by PBKDF2-SHA256 (600,000 iterations default) with high-entropy salts.</li><li><strong>Zero-Leakage Local Search:</strong> Indexes and ranks decrypted documents locally using an in-memory TF-IDF/BM25-style scorer without sending search queries to any remote server.</li><li><strong>Zero External Dependencies:</strong> Built 100% on standard platform runtime APIs.</li></ul>\n<h3>5. WHAT IS VERIFIED?</h3>\n<ul><li><strong>9 / 9 Automated Unit Tests Passed:</strong> Roundtrip envelope encryption/decryption, ciphertext tampering rejection, PBKDF2 archive roundtrip, passphrase length and wrong passphrase rejection, client-side private search ranking, buffer zeroization, wrong root key rejection, tampered AAD rejection, and empty search edge cases.</li><li><strong>Clean-Environment Isolation:</strong> 100% pass in an isolated temporary environment with zero external dependencies.</li></ul>\n<h3>6. HOW DO I RUN IT?</h3>\n<pre><code class=\"language-bash\"># 1. Run unit test suite\nnode --test tests/crypto-privacy.test.mjs\n\n# 2. Run interactive encryption and search demonstration\nnode examples/demo.mjs\n</code></pre>","dependencies":[],"licence":{"verdict":"manual"},"scan":{"verdict":"pass","scanner_version":"2026.09.1","at":"2026-09-16T21:23:26.098Z","checks":[{"id":"secrets","tool":"x402git/secrets","tool_version":"2026.09.1","status":"pass","at":"2026-09-16T21:23:26.098Z","findings":0},{"id":"limits","tool":"x402git/limits","tool_version":"2026.09.1","status":"pass","at":"2026-09-16T21:23:26.098Z","findings":0},{"id":"known_vulns","tool":"osv.dev","tool_version":"2026-09-16","status":"pass","at":"2026-09-16T21:23:26.098Z","findings":0,"packages":0},{"id":"known_malware","tool":"osv.dev/MAL","tool_version":"2026-09-16","status":"pass","at":"2026-09-16T21:23:26.098Z","findings":0,"packages":0},{"id":"dep_behaviour","tool":"socket.dev","tool_version":"2026-09-16","status":"findings","at":"2026-09-16T21:23:26.098Z","findings":1,"packages":1},{"id":"capabilities","tool":"x402git/caps","tool_version":"2026.09.1","status":"pass","at":"2026-09-16T21:23:26.098Z","findings":0},{"id":"injection","tool":"x402git/inject","tool_version":"2026.09.1","status":"pass","at":"2026-09-16T21:23:26.098Z","findings":0}],"findings":[{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"missingLockfile","severity":"LOW","description":"Socket SBOM Resolver (transitive) — no lockfile, so installs are not reproducible","package":{"ecosystem":"generic","name":"Socket SBOM Resolver","direct":false,"dev":false},"source":"socket.dev"}],"capabilities":{"tools":[],"runs":[],"hosts":[{"host":"img.shields.io","local":false,"from":"docs","paths":["README.md"]}],"env":[],"install_runs":false,"summary":"links to 1 host in its docs · nothing runs at install"},"counts":{"blocking":0,"disclosed":1,"review":0}},"originality":{"blob_overlap_ratio":0.04,"blobs_seen_elsewhere":1,"blobs_total":25,"nearest_listing":"genesiscode2026/agent-workspace-guard-sdk","derivative_of":null},"engineering":{"unique_5gram_ratio":0.672,"type_token_ratio":0.397,"effective_code_lines":340,"effective_doc_words":1431,"code_files":7,"test_files":2,"padding_suspected":false},"cadence":{"releases":0,"median_days_between_releases":null,"on_time_fraction":null,"days_since_last":null,"score":null,"finished":false},"inventory_sentence":"5 source files · 2 test files · 1 example · 14 docs","extensions":{"md":15,"ts":1,"mjs":6,"json":3,"(none)":1},"lines_of_code":505,"warnings":["sbom_unavailable"],"repo_meta":{"repo_id":1372979109,"name":"local-first-privacy-encryption-sdk","full_name":"genesiscode2026/local-first-privacy-encryption-sdk","description":"Native Web Crypto encryption, portable encrypted backups and local-first search for browser and Node.js applications.","homepage":null,"topics":["encryption","local-first","privacy","security","typescript","webcrypto"],"language":"JavaScript","default_branch":"main","size_kb":19,"created_at":"2026-09-16T12:09:31Z","pushed_at":"2026-09-16T13:30:32Z","licence_spdx":null,"open_issues":null,"stars":null,"forks":null,"watchers":null,"archived":false,"private":true,"html_url":null},"owner":{"login":"genesiscode2026","name":null,"avatar_url":"https://avatars.githubusercontent.com/u/329895054?v=4","bio":null,"blog":null,"company":null,"location":null,"twitter_username":null,"followers":null,"public_repos":1,"created_at":"2026-09-16T08:01:39Z","html_url":"https://github.com/genesiscode2026"},"computed_at":"2026-09-16T21:23:33.903Z","analyzer_version":"0.1.0"},"self_reported":{"description":"Local-first client-side encryption SDK with AES-256-GCM, zero-knowledge key derivation and integrity checks.","trigger_hint":"When requiring verified Local-First Encryption functionality in autonomous workflows"}}