Metadata-Version: 2.4
Name: sealed-fields
Version: 0.2.0
Summary: Field-level encryption for PII at rest: AES-256-GCM with versioned key rotation, key namespaces, HMAC blind indexes, and row helpers with systemic-failure detection. Wire-compatible with the sealed-fields npm package.
Project-URL: Homepage, https://github.com/mpointer/sealed-fields
Project-URL: Issues, https://github.com/mpointer/sealed-fields/issues
Author-email: Michael Pointer <mpointer@gmail.com>
License-Expression: MIT
Keywords: aes-256-gcm,blind-index,encryption,encryption-at-rest,field-encryption,key-rotation,pii,searchable-encryption,sqlalchemy
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security :: Cryptography
Requires-Python: >=3.10
Requires-Dist: cryptography>=41
Description-Content-Type: text/markdown

# sealed-fields (Python)

Field-level encryption for PII at rest. This is the Python twin of the
[sealed-fields npm package](https://www.npmjs.com/package/sealed-fields):
identical wire format, identical API shape, shared cross-language test
vectors. Data sealed by either implementation unseals in the other.

```
pip install sealed-fields
```

```python
from sealed_fields import create_sealed_fields, generate_key

sf = create_sealed_fields(
    namespaces={"PII": {"key": os.environ["SEALED_KEY_PII"]}},
    blind_index_key=os.environ.get("SEALED_BLIND_INDEX_KEY"),
)

token = sf.seal("free-text note about a real person")  # "v1:..."
sf.unseal(token)                                        # plaintext
sf.blind_index("alice@example.com")                     # HMAC lookup token
```

See the [repository README](https://github.com/mpointer/sealed-fields) for
the full design: key rotation without a flag day, key namespaces, blind
index entropy rules, row helpers, legacy-format decoders, and the
fail-closed default.
