Add encryption your own servers can’t read

// 1. Encrypt on the device with the open-source core (npm i @shieldfive/crypto)
import { xchachaV1, randomBytes, bytesToBase64 } from '@shieldfive/crypto'

const key = randomBytes(32)                      // your key — never sent to us
const { blob } = await xchachaV1.encryptBytes(
  new TextEncoder().encode('patient record #42'),
  { contentKey: key },
)
const ciphertext = bytesToBase64(new Uint8Array(await blob.arrayBuffer()))

// 2. Store the CIPHERTEXT (we never see plaintext or your key)
const stored = await fetch('https://shieldfive.com/api/v1/blobs', {
  method: 'POST',
  headers: {
    'authorization': 'Bearer ' + process.env.SHIELDFIVE_API_KEY,
    'content-type': 'application/json',
  },
  body: JSON.stringify({ ciphertext, meta: { record: 42 } }),
}).then((r) => r.json())          // -> { id, storedBytes, quotaBytes }

// 3. Retrieve + decrypt on the device
const got = await fetch('https://shieldfive.com/api/v1/blobs/' + stored.id, {
  headers: { 'authorization': 'Bearer ' + process.env.SHIELDFIVE_API_KEY },
}).then((r) => r.json())

const plaintext = await xchachaV1.decryptToBytes({
  blob: new Blob([Uint8Array.from(atob(got.ciphertext), (c) => c.charCodeAt(0))]),
  contentKey: key,
})