@p47h/vault-js 0.9.5 → 0.10.0

package/README.md

@@ -1,7 +1,7 @@
 # P47H Vault JS
 
-Secure, local-first cryptographic storage for browser environments.
-Backed by Argon2id, XChaCha20Poly1305, and Ed25519 via WebAssembly.
+Local-first encrypted vault for browser applications.
+Client-side key derivation, encryption, and signing via Rust/WASM.
 
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-green.svg)](./LICENSE)
 [![npm version](https://img.shields.io/npm/v/@p47h/vault-js)](https://www.npmjs.com/package/@p47h/vault-js)
@@ -12,15 +12,29 @@ P47H Vault JS addresses the insecurity of storing sensitive user secrets (API ke
 
 It provides an encrypted enclave within the client application, leveraging the P47H Core Rust implementation compiled to WebAssembly. This ensures that cryptographic operations are consistent across platforms and resistant to common JavaScript-based attack vectors.
 
+P47H Vault JS is designed for applications that require strong client-side guarantees.
+It is not a password manager, nor a replacement for server-side HSMs.
+
 ## Key Features
 
 * **WASM-Backed Cryptography:** Core logic resides in a compiled Rust binary, not interpreted JavaScript.
-* **Memory Isolation:** Private keys are generated within the WASM linear memory and are not exposed to the JavaScript heap as plain text during rest.
+* **Memory Isolation:** Private keys are generated and used inside WASM linear memory and are never exposed to the JavaScript heap in plaintext.
 * **Authenticated Encryption:** Data is persisted using XChaCha20Poly1305.
 * **Key Derivation:** Master keys are derived using Argon2id (OWASP recommendation) to resist brute-force attacks.
 * **Framework Agnostic:** Pure TypeScript implementation suitable for React, Vue, Angular, or vanilla JS.
 * **Apache 2.0 License:** Free for commercial and private use. No copyleft restrictions.
 
+## When should I use this?
+
+Use P47H Vault JS if you need to:
+
+* Store API keys, tokens, or credentials in the browser
+* Encrypt user data before it reaches your backend
+* Generate and use cryptographic identities client-side
+* Reduce compliance risk (GDPR, SOC2) by minimizing server-side exposure
+
+Do not use this library if your threat model requires server-side key custody.
+
 ## Architecture
 
 This library adheres to Clean Architecture principles. It exposes a strict interface (`IVault`) and allows for dependency injection of storage adapters, ensuring testability and modularity.