npm package: @shivam-secure/secure-layer-sdk
Description: Enterprise-grade security SDK for license verification and field-level encryption
Latest version: 1.0.3

# @yourorg/secure-layer-sdk

Enterprise-grade security SDK for license verification and field-level encryption. Verifies encrypted, signed licenses and integrates with the secure-agent for dynamic key derivation.

## Requirements

- **Node.js** >= 18
- **Secure Layer** installed on the host (VPS) with:
  - `secure-agent` at `/usr/local/bin/secure-agent` (Linux) or `C:\secure-layer\bin\secure-agent.bat` (Windows)
  - `machine.id` at `/etc/secure-layer/machine.id` (Linux) or `C:\secure-layer\machine.id` (Windows)
  - `license.dat` at `/etc/secure-layer/license.dat` (Linux) or `C:\secure-layer\license.dat` (Windows)

## Installation

```bash
npm install @yourorg/secure-layer-sdk
```

## Backend integration (middleware, request/response flow)

For a **centralized middleware-based** setup (decrypt on request, encrypt on response, one place to update): see **[docs/BACKEND_INTEGRATION.md](docs/BACKEND_INTEGRATION.md)**.

## Usage

```typescript
import { SecureLayer } from "@yourorg/secure-layer-sdk";

async function main() {
  const sdk = await SecureLayer.init();

  const license = sdk.getLicenseInfo();
  console.log(license.company, license.plan);

  const encrypted = await sdk.encryptField("user-123", "email", "user@example.com");
  const decrypted = await sdk.decryptField("user-123", "email", encrypted);
}
```

### Custom License Path

```typescript
const sdk = await SecureLayer.init("/path/to/license.dat");
```

## API

### `SecureLayer.init(licensePath?: string): Promise<SecureLayer>`

Initializes the SDK. Must be called before any other methods.

- Verifies the license (decrypt, signature, expiry, machineId)
- Ensures secure-agent connectivity
- Returns the SDK instance

### `SecureLayer.getInstance(): SecureLayer`

Returns the current initialized instance. Throws if `init()` was not called.

### `sdk.encryptField(userId: string, field: string, value: string): Promise<EncryptedPayload>`

Encrypts a field value using agent-derived keys and AES-256-GCM. Returns `{ data, iv, tag }`.

### `sdk.decryptField(userId: string, field: string, encryptedObj: EncryptedPayload): Promise<string>`

Decrypts a field value. Uses the same `userId` and `field` as used during encryption.

### `sdk.getLicenseInfo(): License`

Returns the validated license object (company, product, machineId, expiry, plan, created).

## License Installation

1. Generate a license using the [license-generator](../license-generator) tool:
   ```bash
   node license-cli.js create --company "Acme Inc" --machine auto --expiry 2026-12-31 --plan enterprise
   ```

2. Copy `license.dat` to the target machine:
   - Linux: `/etc/secure-layer/license.dat`
   - Windows: `C:\secure-layer\license.dat`

3. Ensure `machine.id` on the target matches the license's machineId.

## Security Architecture

- **License**: Encrypted with AES-256-CBC, signed with RSA-SHA256. Key derived from SHA256("SECURE_LAYER_LICENSE"). Public key in package for verification.
- **Field encryption**: AES-256-GCM. Keys derived by secure-agent (root.secret + userId + field) on the VPS. Keys never leave the agent.
- **Agent**: Runs on VPS, holds root.secret. Returns derived keys for valid (userId, field) pairs. Uses `execFile` (no shell injection), 3s timeout.
- **No plaintext keys**, no global mutable state, fail-closed validation.

## Production Best Practices

1. Run the SDK only on machines where secure-agent is installed and configured.
2. Use `init()` at application startup; fail fast if license or agent is invalid.
3. Do not log decrypted values, keys, or license contents.
4. Keep `public.pem` in the package; never ship `private.pem`.
5. Ensure file permissions on `/etc/secure-layer` (or `C:\secure-layer`) restrict access.

## Supported Platforms

- Linux
- Windows
- macOS (uses Linux-style paths)

## License

Proprietary. See your organization's terms.
# secure-layer-sdk