aegis-lock 2.0.0

package/README.md

@@ -0,0 +1,103 @@
+# aegis-lock
+
+**Database-agnostic client-side AES-256-GCM field-level encryption.**
+
+Encrypt sensitive fields before they leave the browser or server. Decrypt after select. Zero plaintext hits the wire or your database. Works with **Supabase**, **MongoDB**, or any database via custom adapters.
+
+## Install
+
+```bash
+npm install aegis-lock
+```
+
+## Quick Start — Supabase
+
+```typescript
+import { createClient } from "@supabase/supabase-js";
+import { AegisClient, SupabaseAdapter, generateKey, exportKey } from "aegis-lock";
+
+const supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY);
+const adapter = new SupabaseAdapter(supabase);
+
+const key = await generateKey();
+const exported = await exportKey(key); // save this securely!
+
+const aegis = new AegisClient(adapter, key, {
+  secure_fields: ["encrypted_content", "ssn", "credit_card"],
+});
+
+// Insert — fields are auto-encrypted
+await aegis.insert("secure_fields", {
+  record_id: "some-uuid",
+  encrypted_content: "Top secret",
+});
+
+// Select — fields are auto-decrypted
+const { data } = await aegis.select("secure_fields");
+```
+
+## Quick Start — MongoDB
+
+```typescript
+import { MongoClient } from "mongodb";
+import { AegisClient, MongoDBAdapter, generateKey } from "aegis-lock";
+
+const mongo = new MongoClient("mongodb://localhost:27017");
+await mongo.connect();
+const adapter = new MongoDBAdapter(mongo.db("myapp"));
+
+const key = await generateKey();
+
+const aegis = new AegisClient(adapter, key, {
+  users: ["ssn", "credit_card"],
+});
+
+await aegis.insert("users", { name: "Alice", ssn: "123-45-6789" });
+const { data } = await aegis.select("users", { column: "name", value: "Alice" });
+// data[0].ssn → "123-45-6789" (decrypted)
+```
+
+## Custom Adapter
+
+Implement the `DatabaseAdapter` interface for any database:
+
+```typescript
+import { DatabaseAdapter, AegisClient } from "aegis-lock";
+
+class MyAdapter implements DatabaseAdapter {
+  async insert(table: string, data: Record<string, unknown>) {
+    // your insert logic
+    return { data: [data], error: null };
+  }
+  async select(table: string, query?) {
+    // your select logic
+    return { data: [], error: null };
+  }
+}
+```
+
+## API
+
+### `new AegisClient(adapter, key, encryptedFields)`
+- `adapter` — any `DatabaseAdapter` (SupabaseAdapter, MongoDBAdapter, or custom)
+- `key` — CryptoKey from `generateKey()` or `importKey()`
+- `encryptedFields` — `Record<tableName, fieldName[]>`
+
+### Adapters
+- `new SupabaseAdapter(supabaseClient)`
+- `new MongoDBAdapter(mongoDb)`
+
+### Crypto
+- `generateKey()` / `exportKey(key)` / `importKey(base64)`
+- `encrypt(plaintext, key)` / `decrypt(payload, key)`
+
+## How It Works
+
+- **Web Crypto API** (AES-256-GCM) — runs in any modern browser or edge runtime
+- Each row gets a unique **IV** stored alongside the ciphertext
+- Encryption/decryption happens client-side — your server never sees plaintext
+- Database-agnostic: swap adapters without changing application code
+
+## License
+
+MIT

package/dist/adapters/mongodb.d.ts

@@ -0,0 +1,44 @@
+import type { DatabaseAdapter } from "../types";
+/**
+ * MongoDB adapter for aegis-mern.
+ *
+ * Works with any MongoDB client that exposes a `db()` method (e.g. the official
+ * `mongodb` Node.js driver). Pass the Db instance directly.
+ *
+ * Usage:
+ * ```ts
+ * import { MongoClient } from "mongodb";
+ * import { MongoDBAdapter } from "aegis-mern/adapters/mongodb";
+ *
+ * const client = new MongoClient(uri);
+ * await client.connect();
+ * const adapter = new MongoDBAdapter(client.db("mydb"));
+ * ```
+ */
+export declare class MongoDBAdapter implements DatabaseAdapter {
+    private db;
+    constructor(db: any);
+    insert(table: string, data: Record<string, unknown>): Promise<{
+        data: {
+            _id: any;
+        }[];
+        error: null;
+    } | {
+        data: null;
+        error: unknown;
+    }>;
+    select(table: string, query?: {
+        column?: string;
+        value?: unknown;
+        limit?: number;
+    }): Promise<{
+        data: Record<string, unknown>[];
+        error: null;
+    } | {
+        data: null;
+        error: unknown;
+    }>;
+    /** Access the underlying MongoDB Db instance. */
+    get database(): any;
+}
+//# sourceMappingURL=mongodb.d.ts.map

package/dist/adapters/mongodb.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mongodb.d.ts","sourceRoot":"","sources":["../../adapters/mongodb.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAEhD;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,cAAe,YAAW,eAAe;IACpD,OAAO,CAAC,EAAE,CAAM;gBAEJ,EAAE,EAAE,GAAG;IAIb,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;;;;IAWnD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;cAY7D,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;;;;;;IAMpD,iDAAiD;IACjD,IAAI,QAAQ,QAEX;CACF"}

package/dist/adapters/mongodb.js

@@ -0,0 +1,55 @@
+/**
+ * MongoDB adapter for aegis-mern.
+ *
+ * Works with any MongoDB client that exposes a `db()` method (e.g. the official
+ * `mongodb` Node.js driver). Pass the Db instance directly.
+ *
+ * Usage:
+ * ```ts
+ * import { MongoClient } from "mongodb";
+ * import { MongoDBAdapter } from "aegis-mern/adapters/mongodb";
+ *
+ * const client = new MongoClient(uri);
+ * await client.connect();
+ * const adapter = new MongoDBAdapter(client.db("mydb"));
+ * ```
+ */
+export class MongoDBAdapter {
+    constructor(db) {
+        this.db = db;
+    }
+    async insert(table, data) {
+        try {
+            const collection = this.db.collection(table);
+            const result = await collection.insertOne(data);
+            const inserted = { ...data, _id: result.insertedId };
+            return { data: [inserted], error: null };
+        }
+        catch (error) {
+            return { data: null, error };
+        }
+    }
+    async select(table, query) {
+        try {
+            const collection = this.db.collection(table);
+            const filter = {};
+            if (query?.column && query?.value !== undefined) {
+                filter[query.column] = query.value;
+            }
+            let cursor = collection.find(filter);
+            if (query?.limit) {
+                cursor = cursor.limit(query.limit);
+            }
+            const data = await cursor.toArray();
+            return { data: data, error: null };
+        }
+        catch (error) {
+            return { data: null, error };
+        }
+    }
+    /** Access the underlying MongoDB Db instance. */
+    get database() {
+        return this.db;
+    }
+}
+//# sourceMappingURL=mongodb.js.map

package/dist/adapters/mongodb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mongodb.js","sourceRoot":"","sources":["../../adapters/mongodb.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,cAAc;IAGzB,YAAY,EAAO;QACjB,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,IAA6B;QACvD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;YACrD,OAAO,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAA4D;QACtF,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,MAAM,GAA4B,EAAE,CAAC;YAC3C,IAAI,KAAK,EAAE,MAAM,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;gBAChD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YACrC,CAAC;YACD,IAAI,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC;gBACjB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,OAAO,EAAE,IAAI,EAAE,IAAiC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;CACF"}

package/dist/adapters/supabase.d.ts

@@ -0,0 +1,22 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+import type { DatabaseAdapter } from "../types";
+/** Supabase adapter for aegis-mern. */
+export declare class SupabaseAdapter implements DatabaseAdapter {
+    private supabase;
+    constructor(supabase: SupabaseClient);
+    insert(table: string, data: Record<string, unknown>): Promise<{
+        data: Record<string, unknown>[] | null;
+        error: import("@supabase/postgrest-js").PostgrestError | null;
+    }>;
+    select(table: string, query?: {
+        column?: string;
+        value?: unknown;
+        limit?: number;
+    }): Promise<{
+        data: Record<string, unknown>[] | null;
+        error: import("@supabase/postgrest-js").PostgrestError | null;
+    }>;
+    /** Access the underlying Supabase client for non-encrypted ops. */
+    get client(): SupabaseClient<any, "public", "public", any, any>;
+}
+//# sourceMappingURL=supabase.d.ts.map

package/dist/adapters/supabase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.d.ts","sourceRoot":"","sources":["../../adapters/supabase.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAEhD,uCAAuC;AACvC,qBAAa,eAAgB,YAAW,eAAe;IACrD,OAAO,CAAC,QAAQ,CAAiB;gBAErB,QAAQ,EAAE,cAAc;IAI9B,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;cAE9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI;;;IAGrD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;cAS/D,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI;;;IAGzD,mEAAmE;IACnE,IAAI,MAAM,sDAET;CACF"}

package/dist/adapters/supabase.js

@@ -0,0 +1,26 @@
+/** Supabase adapter for aegis-mern. */
+export class SupabaseAdapter {
+    constructor(supabase) {
+        this.supabase = supabase;
+    }
+    async insert(table, data) {
+        const { data: result, error } = await this.supabase.from(table).insert(data).select();
+        return { data: result, error };
+    }
+    async select(table, query) {
+        let q = this.supabase.from(table).select("*");
+        if (query?.column && query?.value !== undefined) {
+            q = q.eq(query.column, query.value);
+        }
+        if (query?.limit) {
+            q = q.limit(query.limit);
+        }
+        const { data, error } = await q;
+        return { data: data, error };
+    }
+    /** Access the underlying Supabase client for non-encrypted ops. */
+    get client() {
+        return this.supabase;
+    }
+}
+//# sourceMappingURL=supabase.js.map

package/dist/adapters/supabase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../../adapters/supabase.ts"],"names":[],"mappings":"AAGA,uCAAuC;AACvC,MAAM,OAAO,eAAe;IAG1B,YAAY,QAAwB;QAClC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,IAA6B;QACvD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACtF,OAAO,EAAE,IAAI,EAAE,MAA0C,EAAE,KAAK,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAA4D;QACtF,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,MAAM,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAChD,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC;YACjB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,IAAwC,EAAE,KAAK,EAAE,CAAC;IACnE,CAAC;IAED,mEAAmE;IACnE,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF"}

package/dist/client.d.ts

@@ -0,0 +1,33 @@
+import type { DatabaseAdapter } from "./types";
+export declare class AegisClient {
+    private adapter;
+    private key;
+    private encryptedFields;
+    constructor(adapter: DatabaseAdapter, key: CryptoKey, encryptedFields: Record<string, string[]>);
+    /** Insert a row, auto-encrypting configured fields. Returns a shared IV for the row. */
+    insert(table: string, data: Record<string, unknown>): Promise<{
+        data: Record<string, unknown>[] | null;
+        error: unknown;
+    }>;
+    /** Select rows, auto-decrypting configured fields. */
+    select(table: string, query?: {
+        column?: string;
+        value?: unknown;
+        limit?: number;
+    }): Promise<{
+        data: Record<string, unknown>[] | null;
+        error: unknown;
+    }>;
+    /** Select rows WITHOUT decrypting — exposes raw ciphertext. */
+    selectRaw(table: string, query?: {
+        column?: string;
+        value?: unknown;
+        limit?: number;
+    }): Promise<{
+        data: Record<string, unknown>[] | null;
+        error: unknown;
+    }>;
+    /** Access the underlying database adapter. */
+    get db(): DatabaseAdapter;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAG/C,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,GAAG,CAAY;IACvB,OAAO,CAAC,eAAe,CAA2B;gBAEtC,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAM/F,wFAAwF;IAClF,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;IAsBzD,sDAAsD;IAChD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;;;;IAgCxF,+DAA+D;IACzD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;;;;IAI3F,8CAA8C;IAC9C,IAAI,EAAE,IAAI,eAAe,CAExB;CACF"}

package/dist/client.js

@@ -0,0 +1,62 @@
+import { encrypt, decrypt } from "./crypto";
+export class AegisClient {
+    constructor(adapter, key, encryptedFields) {
+        this.adapter = adapter;
+        this.key = key;
+        this.encryptedFields = encryptedFields;
+    }
+    /** Insert a row, auto-encrypting configured fields. Returns a shared IV for the row. */
+    async insert(table, data) {
+        const fields = this.encryptedFields[table] || [];
+        const row = { ...data };
+        // Generate a single IV and reuse it for all fields in this row
+        const ivBuffer = crypto.getRandomValues(new Uint8Array(12));
+        const sharedIv = btoa(String.fromCharCode(...ivBuffer));
+        for (const field of fields) {
+            if (row[field] != null) {
+                const { ciphertext } = await encrypt(String(row[field]), this.key, ivBuffer);
+                row[field] = ciphertext;
+            }
+        }
+        if (fields.length > 0) {
+            row.iv = sharedIv;
+        }
+        return this.adapter.insert(table, row);
+    }
+    /** Select rows, auto-decrypting configured fields. */
+    async select(table, query) {
+        const { data, error } = await this.adapter.select(table, query);
+        if (error || !data)
+            return { data, error };
+        const fields = this.encryptedFields[table] || [];
+        if (fields.length === 0)
+            return { data, error };
+        const decrypted = await Promise.all(data.map(async (row) => {
+            const decRow = { ...row };
+            const iv = row.iv;
+            if (!iv)
+                return decRow;
+            for (const field of fields) {
+                if (decRow[field] != null) {
+                    try {
+                        decRow[field] = await decrypt({ ciphertext: String(decRow[field]), iv }, this.key);
+                    }
+                    catch {
+                        // leave as ciphertext if decryption fails
+                    }
+                }
+            }
+            return decRow;
+        }));
+        return { data: decrypted, error };
+    }
+    /** Select rows WITHOUT decrypting — exposes raw ciphertext. */
+    async selectRaw(table, query) {
+        return this.adapter.select(table, query);
+    }
+    /** Access the underlying database adapter. */
+    get db() {
+        return this.adapter;
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAE5C,MAAM,OAAO,WAAW;IAKtB,YAAY,OAAwB,EAAE,GAAc,EAAE,eAAyC;QAC7F,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,IAA6B;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,GAAG,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;QAEjD,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC;QAExD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC7E,GAAG,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,EAAE,GAAG,QAAQ,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAA4D;QACtF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChE,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAE3C,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAEhD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAA4B,EAAE,EAAE;YAC9C,MAAM,MAAM,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;YAC1B,MAAM,EAAE,GAAG,GAAG,CAAC,EAAY,CAAC;YAC5B,IAAI,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC;YAEvB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;oBAC1B,IAAI,CAAC;wBACH,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,OAAO,CAC3B,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,EACzC,IAAI,CAAC,GAAG,CACT,CAAC;oBACJ,CAAC;oBAAC,MAAM,CAAC;wBACP,0CAA0C;oBAC5C,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACpC,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,KAA4D;QACzF,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,8CAA8C;IAC9C,IAAI,EAAE;QACJ,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;CACF"}

package/dist/crypto.d.ts

@@ -0,0 +1,7 @@
+import { EncryptedPayload } from "./types";
+export declare function generateKey(): Promise<CryptoKey>;
+export declare function exportKey(key: CryptoKey): Promise<string>;
+export declare function importKey(base64: string): Promise<CryptoKey>;
+export declare function encrypt(plaintext: string, key: CryptoKey, existingIv?: Uint8Array): Promise<EncryptedPayload>;
+export declare function decrypt(payload: EncryptedPayload, key: CryptoKey): Promise<string>;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAK3C,wBAAsB,WAAW,IAAI,OAAO,CAAC,SAAS,CAAC,CAMtD;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAG/D;AAED,wBAAsB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAMlE;AAED,wBAAsB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAQnH;AAED,wBAAsB,OAAO,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAKxF"}

package/dist/crypto.js

@@ -0,0 +1,32 @@
+const ALGO = "AES-GCM";
+const KEY_LENGTH = 256;
+export async function generateKey() {
+    return crypto.subtle.generateKey({ name: ALGO, length: KEY_LENGTH }, true, ["encrypt", "decrypt"]);
+}
+export async function exportKey(key) {
+    const raw = await crypto.subtle.exportKey("raw", key);
+    return btoa(String.fromCharCode(...new Uint8Array(raw)));
+}
+export async function importKey(base64) {
+    const raw = Uint8Array.from(atob(base64), (c) => c.charCodeAt(0));
+    return crypto.subtle.importKey("raw", raw, { name: ALGO, length: KEY_LENGTH }, true, [
+        "encrypt",
+        "decrypt",
+    ]);
+}
+export async function encrypt(plaintext, key, existingIv) {
+    const iv = existingIv ? new Uint8Array(existingIv) : crypto.getRandomValues(new Uint8Array(12));
+    const encoded = new TextEncoder().encode(plaintext);
+    const cipherBuffer = await crypto.subtle.encrypt({ name: ALGO, iv }, key, encoded);
+    return {
+        ciphertext: btoa(String.fromCharCode(...new Uint8Array(cipherBuffer))),
+        iv: btoa(String.fromCharCode(...iv)),
+    };
+}
+export async function decrypt(payload, key) {
+    const cipherBytes = Uint8Array.from(atob(payload.ciphertext), (c) => c.charCodeAt(0));
+    const iv = Uint8Array.from(atob(payload.iv), (c) => c.charCodeAt(0));
+    const decrypted = await crypto.subtle.decrypt({ name: ALGO, iv }, key, cipherBytes);
+    return new TextDecoder().decode(decrypted);
+}
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../crypto.ts"],"names":[],"mappings":"AAEA,MAAM,IAAI,GAAG,SAAS,CAAC;AACvB,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,OAAO,MAAM,CAAC,MAAM,CAAC,WAAW,CAC9B,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,EAClC,IAAI,EACJ,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAc;IAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc;IAC5C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE;QACnF,SAAS;QACT,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,SAAiB,EAAE,GAAc,EAAE,UAAuB;IACtF,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChG,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACnF,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;QACtE,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAyB,EAAE,GAAc;IACrE,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IACpF,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { AegisClient } from "./client";
+export { generateKey, exportKey, importKey, encrypt, decrypt } from "./crypto";
+export { SupabaseAdapter } from "./adapters/supabase";
+export { MongoDBAdapter } from "./adapters/mongodb";
+export type { AegisConfig, EncryptedPayload, AegisKeyPair, DatabaseAdapter } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export { AegisClient } from "./client";
+export { generateKey, exportKey, importKey, encrypt, decrypt } from "./crypto";
+export { SupabaseAdapter } from "./adapters/supabase";
+export { MongoDBAdapter } from "./adapters/mongodb";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,30 @@
+/** Generic database adapter interface — implement this for any database. */
+export interface DatabaseAdapter {
+    /** Insert a row into a table/collection. Returns the inserted data. */
+    insert(table: string, data: Record<string, unknown>): Promise<{
+        data: Record<string, unknown>[] | null;
+        error: unknown;
+    }>;
+    /** Select rows from a table/collection with optional filters. */
+    select(table: string, query?: {
+        column?: string;
+        value?: unknown;
+        limit?: number;
+    }): Promise<{
+        data: Record<string, unknown>[] | null;
+        error: unknown;
+    }>;
+}
+export interface AegisConfig {
+    adapter: DatabaseAdapter;
+    encryptedFields: Record<string, string[]>;
+}
+export interface EncryptedPayload {
+    ciphertext: string;
+    iv: string;
+}
+export interface AegisKeyPair {
+    key: CryptoKey;
+    exported: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../types.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAE1H,iEAAiE;IACjE,MAAM,CACJ,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3D,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,eAAe,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,SAAS,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "aegis-lock",
+  "version": "2.0.0",
+  "description": "Database-agnostic client-side AES-256-GCM field-level encryption. Works with Supabase, MongoDB, or any database via pluggable adapters.",
+  "type": "module",
+  "main": "dist/index.js",
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./adapters/supabase": {
+      "import": "./dist/adapters/supabase.js",
+      "types": "./dist/adapters/supabase.d.ts"
+    },
+    "./adapters/mongodb": {
+      "import": "./dist/adapters/mongodb.js",
+      "types": "./dist/adapters/mongodb.d.ts"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "encryption",
+    "aes-gcm",
+    "supabase",
+    "mongodb",
+    "mern",
+    "client-side-encryption",
+    "field-level-encryption",
+    "database-agnostic",
+    "aegis",
+    "security",
+    "crypto"
+  ],
+  "author": "",
+  "license": "MIT",
+  "peerDependencies": {
+    "@supabase/supabase-js": "^2.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@supabase/supabase-js": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@supabase/supabase-js": "^2.0.0",
+    "typescript": "^5.9.3"
+  }
+}