@molecule/api-encryption 1.0.0

package/LICENSE

@@ -0,0 +1,115 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work.
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship.
+
+      "Contribution" shall mean any work of authorship, including the
+      original version of the Work and any modifications or additions
+      to that Work, that is intentionally submitted to the Licensor for
+      inclusion in the Work by the copyright owner or by an individual or
+      Legal Entity authorized to submit on behalf of the copyright owner.
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      patent license to make, have made, use, offer to sell, sell, import,
+      and otherwise transfer the Work.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file.
+
+   5. Submission of Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND.
+
+   8. Limitation of Liability. In no event and under no legal theory shall
+      any Contributor be liable to You for damages.
+
+   9. Accepting Warranty or Additional Liability.
+
+   Copyright 2026 Molecule Dev, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/browser-guard.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=browser-guard.d.ts.map

package/dist/browser-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-guard.d.ts","sourceRoot":"","sources":["../src/browser-guard.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,CAAA"}

package/dist/browser-guard.js

@@ -0,0 +1,18 @@
+/**
+ * Browser guard — `@molecule/api-encryption` is SERVER-ONLY.
+ *
+ * Generated by scripts/gen-browser-guards.mjs (workspace root) — edit THAT, not this.
+ * Evaluating a server package in a browser bundle is always an import-graph mistake
+ * (node APIs, secrets); without this guard it surfaces as a cryptic downstream crash
+ * ("Buffer is not defined") far from the culprit. Throwing here names the package and
+ * the fix at the exact moment the client bundle evaluates it. jsdom tests and SSR are
+ * unaffected: the throw requires browser globals AND the absence of a node runtime.
+ */
+const g = globalThis;
+if (g.window !== undefined && g.document !== undefined && !g.process?.versions?.node) {
+    throw new Error('@molecule/api-encryption is SERVER-ONLY: it was bundled into browser/client code. Import it only ' +
+        'from server code (a server route/function or your API), or dynamic-import it inside ' +
+        'the server handler — never from components or shared client modules, and never ' +
+        'polyfill Buffer/process to silence this.');
+}
+export {};

package/dist/index.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Encryption core interface for molecule.dev.
+ *
+ * Provides the `EncryptionProvider` interface for field-level encryption,
+ * decryption, hashing, and key rotation. Bond a concrete provider
+ * (e.g. `@molecule/api-encryption-aes`) at startup via `setProvider()`.
+ *
+ * @module
+ * @example
+ * ```typescript
+ * import { setProvider, encrypt, decrypt, hash, verify } from '@molecule/api-encryption'
+ * import { provider } from '@molecule/api-encryption-aes'
+ *
+ * // Wire the provider at startup
+ * setProvider(provider)
+ *
+ * // Field-level encryption for sensitive data at rest
+ * const ciphertext = await encrypt(accessToken)
+ * const plaintext = await decrypt(ciphertext)
+ *
+ * // Integrity hashing (checksums, dedupe keys) — NOT for passwords
+ * const checksum = await hash(documentBody)
+ * const untampered = await verify(documentBody, checksum)
+ * ```
+ *
+ * @remarks
+ * - **NEVER hash passwords with `hash()`.** It is a fast, unsalted integrity
+ *   hash (e.g. SHA-256 in the AES bond) — fine for checksums and dedupe keys,
+ *   catastrophic for credentials. Passwords go through
+ *   `@molecule/api-password` (salted, slow KDF).
+ * - **The key is a server-side secret** (e.g. the AES bond's `ENCRYPTION_KEY`,
+ *   auto-generated at scaffold). Never hardcode, log, or expose it — and a
+ *   lost key makes every ciphertext permanently unreadable, so treat key
+ *   changes as a rotation (`rotateKey`), never an edit.
+ * - **Ciphertext is opaque.** An encrypted DB column cannot be filtered,
+ *   sorted, or `like`-searched on its plaintext. Encrypt narrow sensitive
+ *   fields (tokens, PII), not fields you query by.
+ * - **`context` (AAD) must match at decrypt.** If you pass a context to
+ *   `encrypt(value, context)`, the identical context is required to decrypt.
+ *   Binding a ciphertext to e.g. its record id stops cross-row copy-paste —
+ *   but then the id can never change.
+ * - `decrypt()` throws on a wrong key or tampered ciphertext — treat that as
+ *   corruption/misconfiguration to surface, not a condition to retry.
+ */
+export * from './browser-guard.js';
+export * from './provider.js';
+export * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA"}

package/dist/index.js

@@ -0,0 +1,47 @@
+/**
+ * Encryption core interface for molecule.dev.
+ *
+ * Provides the `EncryptionProvider` interface for field-level encryption,
+ * decryption, hashing, and key rotation. Bond a concrete provider
+ * (e.g. `@molecule/api-encryption-aes`) at startup via `setProvider()`.
+ *
+ * @module
+ * @example
+ * ```typescript
+ * import { setProvider, encrypt, decrypt, hash, verify } from '@molecule/api-encryption'
+ * import { provider } from '@molecule/api-encryption-aes'
+ *
+ * // Wire the provider at startup
+ * setProvider(provider)
+ *
+ * // Field-level encryption for sensitive data at rest
+ * const ciphertext = await encrypt(accessToken)
+ * const plaintext = await decrypt(ciphertext)
+ *
+ * // Integrity hashing (checksums, dedupe keys) — NOT for passwords
+ * const checksum = await hash(documentBody)
+ * const untampered = await verify(documentBody, checksum)
+ * ```
+ *
+ * @remarks
+ * - **NEVER hash passwords with `hash()`.** It is a fast, unsalted integrity
+ *   hash (e.g. SHA-256 in the AES bond) — fine for checksums and dedupe keys,
+ *   catastrophic for credentials. Passwords go through
+ *   `@molecule/api-password` (salted, slow KDF).
+ * - **The key is a server-side secret** (e.g. the AES bond's `ENCRYPTION_KEY`,
+ *   auto-generated at scaffold). Never hardcode, log, or expose it — and a
+ *   lost key makes every ciphertext permanently unreadable, so treat key
+ *   changes as a rotation (`rotateKey`), never an edit.
+ * - **Ciphertext is opaque.** An encrypted DB column cannot be filtered,
+ *   sorted, or `like`-searched on its plaintext. Encrypt narrow sensitive
+ *   fields (tokens, PII), not fields you query by.
+ * - **`context` (AAD) must match at decrypt.** If you pass a context to
+ *   `encrypt(value, context)`, the identical context is required to decrypt.
+ *   Binding a ciphertext to e.g. its record id stops cross-row copy-paste —
+ *   but then the id can never change.
+ * - `decrypt()` throws on a wrong key or tampered ciphertext — treat that as
+ *   corruption/misconfiguration to surface, not a condition to retry.
+ */
+export * from './browser-guard.js';
+export * from './provider.js';
+export * from './types.js';

package/dist/provider.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Encryption provider bond accessor and convenience functions.
+ *
+ * Bond packages (e.g. `@molecule/api-encryption-aes`) call `setProvider()`
+ * during setup. Application code uses the convenience functions which
+ * delegate to the bonded provider.
+ *
+ * @module
+ */
+import type { EncryptionProvider } from './types.js';
+/**
+ * Registers an encryption provider as the active singleton. Called by
+ * bond packages during application startup.
+ *
+ * @param provider - The encryption provider implementation to bond.
+ */
+export declare const setProvider: (provider: EncryptionProvider) => void;
+/**
+ * Retrieves the bonded encryption provider, throwing if none is configured.
+ *
+ * @returns The bonded encryption provider.
+ * @throws {Error} If no encryption provider has been bonded.
+ */
+export declare const getProvider: () => EncryptionProvider;
+/**
+ * Checks whether an encryption provider is currently bonded.
+ *
+ * @returns `true` if an encryption provider is bonded.
+ */
+export declare const hasProvider: () => boolean;
+/**
+ * Encrypts a plaintext string using the bonded provider.
+ *
+ * @param plaintext - The data to encrypt.
+ * @param context - Optional additional authenticated data (AAD).
+ * @returns The encrypted ciphertext string.
+ * @throws {Error} If no encryption provider has been bonded.
+ */
+export declare const encrypt: (plaintext: string, context?: string) => Promise<string>;
+/**
+ * Decrypts a ciphertext string using the bonded provider.
+ *
+ * @param ciphertext - The encrypted data to decrypt.
+ * @param context - Optional additional authenticated data (AAD).
+ * @returns The decrypted plaintext string.
+ * @throws {Error} If no encryption provider has been bonded.
+ */
+export declare const decrypt: (ciphertext: string, context?: string) => Promise<string>;
+/**
+ * Produces a one-way hash of the given data using the bonded provider.
+ *
+ * @param data - The data to hash.
+ * @returns The hash string.
+ * @throws {Error} If no encryption provider has been bonded.
+ */
+export declare const hash: (data: string) => Promise<string>;
+/**
+ * Verifies that data matches a previously computed hash.
+ *
+ * @param data - The original data to verify.
+ * @param hashed - The hash to verify against.
+ * @returns `true` if the data matches the hash.
+ * @throws {Error} If no encryption provider has been bonded.
+ */
+export declare const verify: (data: string, hashed: string) => Promise<boolean>;
+/**
+ * Rotates the encryption key using the bonded provider.
+ *
+ * @param oldKey - The current encryption key.
+ * @param newKey - The new encryption key to rotate to.
+ * @returns Resolves when rotation completes successfully.
+ * @throws {Error} If no encryption provider has been bonded.
+ */
+export declare const rotateKey: (oldKey: string, newKey: string) => Promise<void>;
+//# sourceMappingURL=provider.d.ts.map

package/dist/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAKpD;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,UAAU,kBAAkB,KAAG,IAE1D,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,QAAO,kBAW9B,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAO,OAE9B,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,GAAU,WAAW,MAAM,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAEjF,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,GAAU,YAAY,MAAM,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAElF,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,IAAI,GAAU,MAAM,MAAM,KAAG,OAAO,CAAC,MAAM,CAEvD,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,GAAU,MAAM,MAAM,EAAE,QAAQ,MAAM,KAAG,OAAO,CAAC,OAAO,CAE1E,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,GAAU,QAAQ,MAAM,EAAE,QAAQ,MAAM,KAAG,OAAO,CAAC,IAAI,CAE5E,CAAA"}

package/dist/provider.js

@@ -0,0 +1,100 @@
+/**
+ * Encryption provider bond accessor and convenience functions.
+ *
+ * Bond packages (e.g. `@molecule/api-encryption-aes`) call `setProvider()`
+ * during setup. Application code uses the convenience functions which
+ * delegate to the bonded provider.
+ *
+ * @module
+ */
+import { bond, expectBond, isBonded, require as bondRequire } from '@molecule/api-bond';
+import { t } from '@molecule/api-i18n';
+const BOND_TYPE = 'encryption';
+expectBond(BOND_TYPE);
+/**
+ * Registers an encryption provider as the active singleton. Called by
+ * bond packages during application startup.
+ *
+ * @param provider - The encryption provider implementation to bond.
+ */
+export const setProvider = (provider) => {
+    bond(BOND_TYPE, provider);
+};
+/**
+ * Retrieves the bonded encryption provider, throwing if none is configured.
+ *
+ * @returns The bonded encryption provider.
+ * @throws {Error} If no encryption provider has been bonded.
+ */
+export const getProvider = () => {
+    try {
+        return bondRequire(BOND_TYPE);
+    }
+    catch (error) {
+        throw new Error(t('encryption.error.noProvider', undefined, {
+            defaultValue: 'Encryption provider not configured. Call setProvider() first.',
+        }), { cause: error });
+    }
+};
+/**
+ * Checks whether an encryption provider is currently bonded.
+ *
+ * @returns `true` if an encryption provider is bonded.
+ */
+export const hasProvider = () => {
+    return isBonded(BOND_TYPE);
+};
+/**
+ * Encrypts a plaintext string using the bonded provider.
+ *
+ * @param plaintext - The data to encrypt.
+ * @param context - Optional additional authenticated data (AAD).
+ * @returns The encrypted ciphertext string.
+ * @throws {Error} If no encryption provider has been bonded.
+ */
+export const encrypt = async (plaintext, context) => {
+    return getProvider().encrypt(plaintext, context);
+};
+/**
+ * Decrypts a ciphertext string using the bonded provider.
+ *
+ * @param ciphertext - The encrypted data to decrypt.
+ * @param context - Optional additional authenticated data (AAD).
+ * @returns The decrypted plaintext string.
+ * @throws {Error} If no encryption provider has been bonded.
+ */
+export const decrypt = async (ciphertext, context) => {
+    return getProvider().decrypt(ciphertext, context);
+};
+/**
+ * Produces a one-way hash of the given data using the bonded provider.
+ *
+ * @param data - The data to hash.
+ * @returns The hash string.
+ * @throws {Error} If no encryption provider has been bonded.
+ */
+export const hash = async (data) => {
+    return getProvider().hash(data);
+};
+/**
+ * Verifies that data matches a previously computed hash.
+ *
+ * @param data - The original data to verify.
+ * @param hashed - The hash to verify against.
+ * @returns `true` if the data matches the hash.
+ * @throws {Error} If no encryption provider has been bonded.
+ */
+export const verify = async (data, hashed) => {
+    return getProvider().verify(data, hashed);
+};
+/**
+ * Rotates the encryption key using the bonded provider.
+ *
+ * @param oldKey - The current encryption key.
+ * @param newKey - The new encryption key to rotate to.
+ * @returns Resolves when rotation completes successfully.
+ * @throws {Error} If no encryption provider has been bonded.
+ */
+export const rotateKey = async (oldKey, newKey) => {
+    return getProvider().rotateKey(oldKey, newKey);
+};

package/dist/types.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Type definitions for the encryption core interface.
+ *
+ * Defines the `EncryptionProvider` interface for field-level encryption,
+ * decryption, hashing, and key rotation. Bond packages implement this
+ * interface to provide concrete encryption algorithms (AES-256-GCM, etc.).
+ *
+ * @module
+ */
+/**
+ * Configuration options for an encryption provider.
+ */
+export interface EncryptionConfig {
+    /** The encryption key (or key identifier for KMS-backed providers). */
+    key: string;
+    /** Optional algorithm identifier (provider-specific). */
+    algorithm?: string;
+    /** Optional key version for rotation tracking. */
+    keyVersion?: number;
+}
+/**
+ * Encryption provider interface.
+ *
+ * All encryption providers must implement this interface to provide
+ * field-level encryption, decryption, hashing, and key rotation.
+ */
+export interface EncryptionProvider {
+    /**
+     * Encrypts a plaintext string.
+     *
+     * @param plaintext - The data to encrypt.
+     * @param context - Optional additional authenticated data (AAD) for
+     *   authenticated encryption schemes.
+     * @returns The encrypted ciphertext string (typically base64-encoded).
+     */
+    encrypt(plaintext: string, context?: string): Promise<string>;
+    /**
+     * Decrypts a ciphertext string.
+     *
+     * @param ciphertext - The encrypted data to decrypt.
+     * @param context - Optional additional authenticated data (AAD) that was
+     *   used during encryption.
+     * @returns The decrypted plaintext string.
+     */
+    decrypt(ciphertext: string, context?: string): Promise<string>;
+    /**
+     * Produces a one-way hash of the given data.
+     *
+     * @param data - The data to hash.
+     * @returns The hash string (hex or base64 encoded).
+     */
+    hash(data: string): Promise<string>;
+    /**
+     * Verifies that data matches a previously computed hash.
+     *
+     * @param data - The original data to verify.
+     * @param hash - The hash to verify against.
+     * @returns `true` if the data matches the hash.
+     */
+    verify(data: string, hash: string): Promise<boolean>;
+    /**
+     * Rotates the encryption key. Re-encrypts internal state or markers
+     * so that future operations use the new key while previously encrypted
+     * data can still be decrypted during a transition period.
+     *
+     * @param oldKey - The current encryption key.
+     * @param newKey - The new encryption key to rotate to.
+     */
+    rotateKey(oldKey: string, newKey: string): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAA;IAEX,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;;;OAOG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAE7D;;;;;;;OAOG;IACH,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAE9D;;;;;OAKG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAEnC;;;;;;OAMG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAEpD;;;;;;;OAOG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACzD"}

package/dist/types.js

@@ -0,0 +1,10 @@
+/**
+ * Type definitions for the encryption core interface.
+ *
+ * Defines the `EncryptionProvider` interface for field-level encryption,
+ * decryption, hashing, and key rotation. Bond packages implement this
+ * interface to provide concrete encryption algorithms (AES-256-GCM, etc.).
+ *
+ * @module
+ */
+export {};

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@molecule/api-encryption",
+  "version": "1.0.0",
+  "description": "Field-level encryption core interface for molecule.dev — encrypt, decrypt, hash, verify, and rotate keys",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "keywords": [
+    "molecule",
+    "encryption",
+    "aes",
+    "field-level-encryption",
+    "key-rotation"
+  ],
+  "license": "Apache-2.0",
+  "peerDependencies": {
+    "@molecule/api-bond": "^1.0.0",
+    "@molecule/api-i18n": "^1.0.0"
+  },
+  "devDependencies": {
+    "@molecule/api-bond": "1.0.0",
+    "@molecule/api-i18n": "1.0.0",
+    "@types/node": "26.1.2",
+    "typescript": "6.0.3",
+    "vitest": "4.1.10"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/molecule-dev/molecule.git",
+    "directory": "packages/api/core/encryption"
+  },
+  "homepage": "https://github.com/molecule-dev/molecule/tree/main/packages/api/core/encryption",
+  "bugs": "https://github.com/molecule-dev/molecule/issues",
+  "publishConfig": {
+    "access": "public"
+  }
+}