Local Vault

interface VaultKeyRecord {
  userId: string;           // Primary key
  salt: string;             // PBKDF2 salt (base64)
  wrapped_dek: string;      // AES-KW wrapped DEK (base64)
  pin_hash: string;         // SHA-256 PIN hash (quick verification)
  created_at: string;       // ISO timestamp
}

interface LocalStoryRecord {
  localId: string;          // Primary key (UUID)
  userId: string;
  encrypted_title: string;  // Base64 ciphertext
  title_iv: string;         // Base64 IV
  encrypted_content: string;
  content_iv: string;
  checksum: string;         // SHA-256 hash of plaintext
  cloud_id?: string;        // Linked Supabase story ID
  sync_status: 'local' | 'pending' | 'synced' | 'error';
  is_public: boolean;
  story_date: string;       // User-selected memory date
  created_at: string;
  updated_at: string;
}

// 1. Save to Supabase (plaintext, protected by RLS)
const { story } = await fetch('/api/stories', {
  method: 'POST',
  body: JSON.stringify({ title, content, is_public })
})

// 2. Save to Vault (encrypted, if unlocked)
if (vaultUnlocked) {
  const encTitle = await encryptString(title, dek)
  const encContent = await encryptString(content, dek)
  await db.stories.put({
    localId: crypto.randomUUID(),
    encrypted_title: encTitle.ciphertext,
    title_iv: encTitle.iv,
    encrypted_content: encContent.ciphertext,
    content_iv: encContent.iv,
    cloud_id: story.id,
    sync_status: 'synced'
  })
}

import { VaultGuard } from '@/components/vault/VaultGuard'

<VaultGuard fallback={<p>Vault is locked</p>}>
  <EncryptedStoryList />
</VaultGuard>

import { useLocalStories } from '@/app/hooks/useLocalStories'

const { stories, isLoading } = useLocalStories(userId)

// Stories auto-decrypt if vault is unlocked