Security

import { encrypt, decryptString } from '@localmode/core';

// Encrypt data with a passphrase
const encrypted = await encrypt('sensitive data', 'user-password');

// Decrypt back to string
const decrypted = await decryptString(encrypted, 'user-password');
console.log(decrypted); // 'sensitive data'

interface EncryptedData {
  /** Base64-encoded encrypted data */
  ciphertext: string;
  /** Base64-encoded initialization vector */
  iv: string;
  /** Key derivation salt */
  salt: string;
  /** Algorithm identifier */
  algorithm: 'AES-GCM';
  /** Version for future compatibility */
  version: 1;
}

import { deriveEncryptionKey } from '@localmode/core';

// Generate a new key (random salt created automatically)
const { key, salt } = await deriveEncryptionKey('user-password');

// Re-derive the same key later using the stored salt
const { key: sameKey } = await deriveEncryptionKey('user-password', salt);

import { hashPassphrase, verifyPassphrase } from '@localmode/core';

const hash = await hashPassphrase('user-password');
const isValid = await verifyPassphrase('user-password', hash); // true

import { createKeystore } from '@localmode/core';

const keystore = createKeystore();

// Initialize encryption for a database
await keystore.initialize('my-vectors', 'user-password');

// Later, unlock with the passphrase
const valid = await keystore.unlock('my-vectors', 'user-password');

if (valid) {
  const passphrase = keystore.getPassphrase();
  // Use passphrase with encrypt()/decrypt() functions
}

// Lock when done (clears passphrase from memory)
keystore.lock();

interface KeyMetadata {
  /** Database this key is for */
  dbName: string;
  /** Hash of the passphrase for verification */
  passphraseHash: string;
  /** When the key was created */
  createdAt: number;
  /** When the key was last used */
  lastUsedAt: number;
  /** Number of key derivation iterations */
  iterations: number;
  /** Whether encryption is currently enabled */
  enabled: boolean;
}

import { createVectorDB, wrapVectorDB, encryptionMiddleware, deriveEncryptionKey } from '@localmode/core';

const { key, salt } = await deriveEncryptionKey('user-password');
// Persist `salt` (it is not secret) to derive the same key next session

const db = wrapVectorDB({
  db: await createVectorDB({ name: 'notes', dimensions: 384 }),
  middleware: encryptionMiddleware({
    key,
    excludeFields: ['category'], // stays plaintext so it can be filtered on
  }),
});

await db.add({ id: 'n1', vector: embedding, metadata: { text: 'sensitive text', category: 'medical' } });
const results = await db.search(queryVector, { k: 5 }); // metadata decrypted

import { redactPII } from '@localmode/core';

const text = 'Contact John at john@example.com or call 555-123-4567';

const redacted = redactPII(text, {
  emails: true,
  phones: true,
  replacement: '[REDACTED]',
});

console.log(redacted);
// 'Contact John at [REDACTED] or call [REDACTED]'

const redacted = redactPII(text, {
  emails: true,
  phones: true,
  customPatterns: [{ pattern: /EMP-\d{6}/g, replacement: '[EMPLOYEE_ID]' }],
});

import { wrapEmbeddingModel, piiRedactionMiddleware } from '@localmode/core';

const model = wrapEmbeddingModel({
  model: baseModel,
  middleware: piiRedactionMiddleware({ emails: true, phones: true, ssn: true }),
});

// PII is automatically redacted before embedding
const { embedding } = await embed({
  model,
  value: 'Email me at john@example.com',
});
// Actually embeds: 'Email me at [EMAIL_REDACTED]'

import { isCryptoSupported, isCrossOriginIsolated } from '@localmode/core';

if (!isCryptoSupported()) {
  console.warn('Web Crypto API not available');
}

if (!isCrossOriginIsolated()) {
  console.warn('SharedArrayBuffer not available');
}

import {
  embed,
  createVectorDB,
  wrapEmbeddingModel,
  wrapVectorDB,
  piiRedactionMiddleware,
  encryptionMiddleware,
  deriveEncryptionKey,
} from '@localmode/core';

const { key } = await deriveEncryptionKey(userPassword, storedSalt);

// Embedding model: redact PII before embedding
const secureModel = wrapEmbeddingModel({
  model: baseModel,
  middleware: piiRedactionMiddleware({ emails: true, phones: true, ssn: true, creditCards: true }),
});

// Vector DB: encrypt metadata before storage
const db = wrapVectorDB({
  db: await createVectorDB({ name: 'secure-rag', dimensions: 384 }),
  middleware: encryptionMiddleware({ key }),
});

// The embedding is computed from PII-redacted text; the stored text is encrypted
const { embedding } = await embed({ model: secureModel, value: userInput });
await db.add({ id: crypto.randomUUID(), vector: embedding, metadata: { text: userInput } });

import { embed, wrapEmbeddingModel, dpEmbeddingMiddleware } from '@localmode/core';
import { transformers } from '@localmode/transformers';

const privateModel = wrapEmbeddingModel({
  model: transformers.embedding('Xenova/all-MiniLM-L6-v2'),
  middleware: dpEmbeddingMiddleware({
    epsilon: 1.0,        // Privacy parameter (lower = more private)
    delta: 1e-5,         // Probability of privacy failure
    mechanism: 'gaussian', // or 'laplacian'
  }),
});

// Embeddings now have calibrated noise added
const { embedding } = await embed({
  model: privateModel,
  value: 'sensitive medical record',
});

import { createPrivacyBudget, dpEmbeddingMiddleware, wrapEmbeddingModel } from '@localmode/core';

const budget = await createPrivacyBudget({
  maxEpsilon: 10.0,
  persistKey: 'my-app-budget', // Persists across sessions via IndexedDB
  onExhausted: 'block',       // Throws PrivacyBudgetExhaustedError when exceeded
});

const privateModel = wrapEmbeddingModel({
  model: baseModel,
  middleware: dpEmbeddingMiddleware({ epsilon: 1.0 }, budget),
});

// Each embed call consumes 1.0 epsilon from the budget
await embed({ model: privateModel, value: 'query 1' }); // 9.0 remaining
await embed({ model: privateModel, value: 'query 2' }); // 8.0 remaining

console.log(budget.remaining()); // 8.0
console.log(budget.isExhausted()); // false

import { randomizedResponse, dpClassificationMiddleware } from '@localmode/core';

// Direct usage
const label = randomizedResponse(
  'positive',                           // True label
  ['positive', 'negative', 'neutral'], // All possible labels
  2.0                                   // Epsilon
);

// As middleware
const middleware = dpClassificationMiddleware({
  epsilon: 2.0,
  labels: ['positive', 'negative', 'neutral'],
});

import { gaussianNoise, laplacianNoise, addNoise } from '@localmode/core';

// Generate noise directly
const gNoise = gaussianNoise(384, 0.1);   // 384-dim, sigma=0.1
const lNoise = laplacianNoise(384, 0.5);  // 384-dim, scale=0.5

// Add to an embedding
const noisyEmbedding = addNoise(embedding, gNoise);

import {
  wrapEmbeddingModel,
  composeEmbeddingMiddleware,
  piiRedactionMiddleware,
  dpEmbeddingMiddleware,
} from '@localmode/core';

const secureModel = wrapEmbeddingModel({
  model: baseModel,
  middleware: composeEmbeddingMiddleware([
    piiRedactionMiddleware({ emails: true, phones: true }),
    dpEmbeddingMiddleware({ epsilon: 1.0 }),
  ]),
});

// next.config.js
const securityHeaders = [
  {
    key: 'Content-Security-Policy',
    value: [
      "default-src 'self'",
      "script-src 'self' 'wasm-unsafe-eval'", // Required for WASM
      "worker-src 'self' blob:", // Required for workers
      "connect-src 'self' https://huggingface.co https://cdn-lfs.huggingface.co",
    ].join('; '),
  },
];

// Check if isolated
if (crossOriginIsolated) {
  // SharedArrayBuffer available
  // Better performance for workers
}

// Enable via headers:
// Cross-Origin-Opener-Policy: same-origin
// Cross-Origin-Embedder-Policy: require-corp

import { wrapVectorDB, loggingMiddleware } from '@localmode/core';

const db = wrapVectorDB({
  db: baseDB,
  middleware: loggingMiddleware({
    operations: ['add', 'delete', 'clear'],
    formatter: (operation, data) => JSON.stringify({ at: new Date().toISOString(), operation, ...data }),
    logger: (line) => securityLog.push(String(line)),
  }),
});