Security

import { encrypt, decryptString } from '@localmode/core';

// Encrypt data with a passphrase
const encrypted = await encrypt('sensitive data', 'user-password');

// Decrypt back to string
const decrypted = await decryptString(encrypted, 'user-password');
console.log(decrypted); // 'sensitive data'

interface EncryptedData {
  /** Base64-encoded encrypted data */
  ciphertext: string;
  /** Base64-encoded initialization vector */
  iv: string;
  /** Key derivation salt */
  salt: string;
  /** Algorithm identifier */
  algorithm: 'AES-GCM';
  /** Version for future compatibility */
  version: 1;
}

import { deriveEncryptionKey } from '@localmode/core';

// Generate a new key (random salt created automatically)
const { key, salt } = await deriveEncryptionKey('user-password');

// Re-derive the same key later using the stored salt
const { key: sameKey } = await deriveEncryptionKey('user-password', salt);

import { hashPassphrase, verifyPassphrase } from '@localmode/core';

const hash = await hashPassphrase('user-password');
const isValid = await verifyPassphrase('user-password', hash); // true

import { createKeystore } from '@localmode/core';

const keystore = createKeystore();

// Initialize encryption for a database
await keystore.initialize('my-vectors', 'user-password');

// Later, unlock with the passphrase
const valid = await keystore.unlock('my-vectors', 'user-password');

if (valid) {
  const passphrase = keystore.getPassphrase();
  // Use passphrase with encrypt()/decrypt() functions
}

// Lock when done (clears passphrase from memory)
keystore.lock();

interface KeyMetadata {
  /** Database this key is for */
  dbName: string;
  /** Hash of the passphrase for verification */
  passphraseHash: string;
  /** When the key was created */
  createdAt: number;
  /** When the key was last used */
  lastUsedAt: number;
  /** Number of key derivation iterations */
  iterations: number;
  /** Whether encryption is currently enabled */
  enabled: boolean;
}

import { wrapEmbeddingModel, encryptionMiddleware, deriveEncryptionKey } from '@localmode/core';

const { key } = await deriveEncryptionKey('user-password');

const model = wrapEmbeddingModel(baseModel, [encryptionMiddleware({ key })]);

// Embeddings are automatically encrypted
const { embedding } = await embed({ model, value: 'sensitive text' });

import { redactPII } from '@localmode/core';

const text = 'Contact John at john@example.com or call 555-123-4567';

const redacted = redactPII(text, {
  patterns: ['email', 'phone'],
  replacement: '[REDACTED]',
});

console.log(redacted);
// 'Contact John at [REDACTED] or call [REDACTED]'

const redacted = redactPII(text, {
  patterns: ['email', 'phone'],
  custom: [
    {
      name: 'employeeId',
      regex: /EMP-\d{6}/g,
    },
  ],
  replacement: (match, pattern) => `[${pattern.toUpperCase()}]`,
});

import { wrapEmbeddingModel, piiRedactionMiddleware } from '@localmode/core';

const model = wrapEmbeddingModel(baseModel, [
  piiRedactionMiddleware({
    patterns: ['email', 'phone', 'ssn'],
    replacement: '[REDACTED]',
  }),
]);

// PII is automatically redacted before embedding
const { embedding } = await embed({
  model,
  value: 'Email me at john@example.com',
});
// Actually embeds: 'Email me at [REDACTED]'

import { isCryptoSupported, isCrossOriginIsolated } from '@localmode/core';

if (!isCryptoSupported()) {
  console.warn('Web Crypto API not available');
}

if (!isCrossOriginIsolated()) {
  console.warn('SharedArrayBuffer not available');
}

import {
  wrapEmbeddingModel,
  piiRedactionMiddleware,
  encryptionMiddleware,
  deriveEncryptionKey,
} from '@localmode/core';

// Setup secure model
const { key } = await deriveEncryptionKey(userPassword);

const secureModel = wrapEmbeddingModel(baseModel, [
  piiRedactionMiddleware({
    patterns: ['email', 'phone', 'ssn', 'creditCard'],
  }),
  encryptionMiddleware({ key }),
]);

// All embeddings are PII-redacted and encrypted
const { embedding } = await embed({
  model: secureModel,
  value: userInput,
});

import { embed, wrapEmbeddingModel, dpEmbeddingMiddleware } from '@localmode/core';
import { transformers } from '@localmode/transformers';

const privateModel = wrapEmbeddingModel({
  model: transformers.embedding('Xenova/all-MiniLM-L6-v2'),
  middleware: dpEmbeddingMiddleware({
    epsilon: 1.0,        // Privacy parameter (lower = more private)
    delta: 1e-5,         // Probability of privacy failure
    mechanism: 'gaussian', // or 'laplacian'
  }),
});

// Embeddings now have calibrated noise added
const { embedding } = await embed({
  model: privateModel,
  value: 'sensitive medical record',
});

import { createPrivacyBudget, dpEmbeddingMiddleware, wrapEmbeddingModel } from '@localmode/core';

const budget = await createPrivacyBudget({
  maxEpsilon: 10.0,
  persistKey: 'my-app-budget', // Persists across sessions via IndexedDB
  onExhausted: 'block',       // Throws PrivacyBudgetExhaustedError when exceeded
});

const privateModel = wrapEmbeddingModel({
  model: baseModel,
  middleware: dpEmbeddingMiddleware({ epsilon: 1.0 }, budget),
});

// Each embed call consumes 1.0 epsilon from the budget
await embed({ model: privateModel, value: 'query 1' }); // 9.0 remaining
await embed({ model: privateModel, value: 'query 2' }); // 8.0 remaining

console.log(budget.remaining()); // 8.0
console.log(budget.isExhausted()); // false

import { randomizedResponse, dpClassificationMiddleware } from '@localmode/core';

// Direct usage
const label = randomizedResponse(
  'positive',                           // True label
  ['positive', 'negative', 'neutral'], // All possible labels
  2.0                                   // Epsilon
);

// As middleware
const middleware = dpClassificationMiddleware({
  epsilon: 2.0,
  labels: ['positive', 'negative', 'neutral'],
});

import { gaussianNoise, laplacianNoise, addNoise } from '@localmode/core';

// Generate noise directly
const gNoise = gaussianNoise(384, 0.1);   // 384-dim, sigma=0.1
const lNoise = laplacianNoise(384, 0.5);  // 384-dim, scale=0.5

// Add to an embedding
const noisyEmbedding = addNoise(embedding, gNoise);

import {
  wrapEmbeddingModel,
  composeEmbeddingMiddleware,
  piiRedactionMiddleware,
  dpEmbeddingMiddleware,
} from '@localmode/core';

const secureModel = wrapEmbeddingModel({
  model: baseModel,
  middleware: composeEmbeddingMiddleware([
    piiRedactionMiddleware({ emails: true, phones: true }),
    dpEmbeddingMiddleware({ epsilon: 1.0 }),
  ]),
});

// next.config.js
const securityHeaders = [
  {
    key: 'Content-Security-Policy',
    value: [
      "default-src 'self'",
      "script-src 'self' 'wasm-unsafe-eval'", // Required for WASM
      "worker-src 'self' blob:", // Required for workers
      "connect-src 'self' https://huggingface.co https://cdn-lfs.huggingface.co",
    ].join('; '),
  },
];

// Check if isolated
if (crossOriginIsolated) {
  // SharedArrayBuffer available
  // Better performance for workers
}

// Enable via headers:
// Cross-Origin-Opener-Policy: same-origin
// Cross-Origin-Embedder-Policy: require-corp

import { wrapEmbeddingModel, loggingMiddleware } from '@localmode/core';

const model = wrapEmbeddingModel(baseModel, [
  loggingMiddleware({
    logger: (event) => {
      // Log to secure audit trail
      auditLog.log({
        timestamp: new Date().toISOString(),
        action: 'embedding',
        model: event.modelId,
        inputCount: event.inputCount,
        // Don't log actual input values!
      });
    },
  }),
]);