{"_id":"@aiao/rxdb-adapter-encrypted","_rev":"6-b3d4d8be1daf160d3dbbd2ca1920a71c","name":"@aiao/rxdb-adapter-encrypted","dist-tags":{"latest":"0.0.26"},"versions":{"0.0.21":{"name":"@aiao/rxdb-adapter-encrypted","version":"0.0.21","_id":"@aiao/rxdb-adapter-encrypted@0.0.21","maintainers":[{"name":"aiao","email":"hero63418@gmail.com"}],"nx":{"name":"rxdb-adapter-encrypted","tags":["js-lib"]},"dist":{"shasum":"14cd21f390b3981099f23d1f3987b01ee9b4ecd8","tarball":"https://registry.npmjs.org/@aiao/rxdb-adapter-encrypted/-/rxdb-adapter-encrypted-0.0.21.tgz","fileCount":31,"integrity":"sha512-/08evmgAsTgYARoGZI4SvfZElGRQxCqP3iffFmedQjtf2zrEmyO4n+Og5R80cBvctFXBW53pIn5SkA9ROHShwQ==","signatures":[{"sig":"MEYCIQD7RWOjTDKmVolw8H9a4OcjkhfhCLNZ5+jLmeskoELTmwIhAPFWFM5mwnYEOfHiUxEekAK1yD963qx1IQDDuEe4UXYa","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":59549},"main":"./dist/index.js","type":"module","_from":"file:aiao-rxdb-adapter-encrypted-0.0.21.tgz","types":"./dist/index.d.ts","module":"./dist/index.js","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","default":"./dist/index.js","@aiao/source":"./src/index.ts"},"./testing":{"types":"./dist/testing.d.ts","import":"./dist/testing.js","default":"./dist/testing.js","@aiao/source":"./src/testing.ts"},"./package.json":"./package.json"},"_npmUser":{"name":"aiao","email":"hero63418@gmail.com"},"_resolved":"/private/var/folders/1s/1sk5kvms7jj4z6glj40__v300000gn/T/6298ad0aa3cb3880f4da362c52144245/aiao-rxdb-adapter-encrypted-0.0.21.tgz","_integrity":"sha512-/08evmgAsTgYARoGZI4SvfZElGRQxCqP3iffFmedQjtf2zrEmyO4n+Og5R80cBvctFXBW53pIn5SkA9ROHShwQ==","_npmVersion":"11.16.0","description":"Local field-level **AES-GCM-256** envelope encryption for [`@aiao/rxdb`](../rxdb). Plugs into the SQLite-core / PGlite / wa-sqlite / sqliteai adapters with zero-plaintext-at-rest guarantees on the structural database files, change log, query cache and his","directories":{},"sideEffects":false,"_nodeVersion":"24.18.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"peerDependencies":{"rxjs":"^7.8.0","@aiao/rxdb":"0.0.21"},"_npmOperationalInternal":{"tmp":"tmp/rxdb-adapter-encrypted_0.0.21_1784362905979_0.5604161124436453","host":"s3://npm-registry-packages-npm-production"}},"0.0.22":{"name":"@aiao/rxdb-adapter-encrypted","version":"0.0.22","_id":"@aiao/rxdb-adapter-encrypted@0.0.22","maintainers":[{"name":"aiao","email":"hero63418@gmail.com"}],"nx":{"name":"rxdb-adapter-encrypted","tags":["js-lib"]},"dist":{"shasum":"0b742fbc92394b7e66b46b5125e731a4b5e73a54","tarball":"https://registry.npmjs.org/@aiao/rxdb-adapter-encrypted/-/rxdb-adapter-encrypted-0.0.22.tgz","fileCount":31,"integrity":"sha512-bsybHaVinO3sszOACFQLkrRN6b/aMPNLV4MmTjUwVLMPhfyzBlp6IBBbg1j/b1sD9xvqdKpB/TqPM6xlnx6AXg==","signatures":[{"sig":"MEUCICTc6O1QRIsUKCHIFWi8TZOb01n0JQ7ED/Y/UQuZMRt3AiEAtNtfqez4V5SShvZXpuz36OAWwwtJ3FhftTpEZZWrX3U=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":59549},"main":"./dist/index.js","type":"module","_from":"file:aiao-rxdb-adapter-encrypted-0.0.22.tgz","types":"./dist/index.d.ts","module":"./dist/index.js","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","default":"./dist/index.js","@aiao/source":"./src/index.ts"},"./testing":{"types":"./dist/testing.d.ts","import":"./dist/testing.js","default":"./dist/testing.js","@aiao/source":"./src/testing.ts"},"./package.json":"./package.json"},"_npmUser":{"name":"aiao","email":"hero63418@gmail.com"},"_resolved":"/private/var/folders/1s/1sk5kvms7jj4z6glj40__v300000gn/T/153d1218dd19f1afada4894560edaf60/aiao-rxdb-adapter-encrypted-0.0.22.tgz","_integrity":"sha512-bsybHaVinO3sszOACFQLkrRN6b/aMPNLV4MmTjUwVLMPhfyzBlp6IBBbg1j/b1sD9xvqdKpB/TqPM6xlnx6AXg==","_npmVersion":"10.9.2","description":"Local field-level **AES-GCM-256** envelope encryption for [`@aiao/rxdb`](../rxdb). Plugs into the SQLite-core / PGlite / wa-sqlite / sqliteai adapters with zero-plaintext-at-rest guarantees on the structural database files, change log, query cache and his","directories":{},"sideEffects":false,"_nodeVersion":"22.14.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"peerDependencies":{"rxjs":"^7.8.0","@aiao/rxdb":"0.0.22"},"_npmOperationalInternal":{"tmp":"tmp/rxdb-adapter-encrypted_0.0.22_1785482794871_0.2276178855285349","host":"s3://npm-registry-packages-npm-production"}},"0.0.23":{"name":"@aiao/rxdb-adapter-encrypted","version":"0.0.23","_id":"@aiao/rxdb-adapter-encrypted@0.0.23","maintainers":[{"name":"aiao","email":"hero63418@gmail.com"}],"nx":{"name":"rxdb-adapter-encrypted","tags":["js-lib"]},"dist":{"shasum":"0d2068f38d4ddd20a630aeb69f64ded26a8b05db","tarball":"https://registry.npmjs.org/@aiao/rxdb-adapter-encrypted/-/rxdb-adapter-encrypted-0.0.23.tgz","fileCount":31,"integrity":"sha512-SWZzuCm9T20X9yezGtnzy2XknDZXlOE2L5c5SJ+BaH9QevSr9udPAF1cprPyDGJkdHYJi5W0ETZvTDb1RtSwJA==","signatures":[{"sig":"MEQCIDSRgUz1emqh9OfxZ0s8Qwv6J3VCeQnPgaelyXC42dbCAiBjnTOOyVClqqpJNWjQa5Knkr6xvLaGSoObxg1WlMWJdg==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":59549},"main":"./dist/index.js","type":"module","_from":"file:aiao-rxdb-adapter-encrypted-0.0.23.tgz","types":"./dist/index.d.ts","module":"./dist/index.js","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","default":"./dist/index.js","@aiao/source":"./src/index.ts"},"./testing":{"types":"./dist/testing.d.ts","import":"./dist/testing.js","default":"./dist/testing.js","@aiao/source":"./src/testing.ts"},"./package.json":"./package.json"},"_npmUser":{"name":"aiao","email":"hero63418@gmail.com"},"_resolved":"/private/var/folders/1s/1sk5kvms7jj4z6glj40__v300000gn/T/48f1a84dcea80c4875c969f6158388af/aiao-rxdb-adapter-encrypted-0.0.23.tgz","_integrity":"sha512-SWZzuCm9T20X9yezGtnzy2XknDZXlOE2L5c5SJ+BaH9QevSr9udPAF1cprPyDGJkdHYJi5W0ETZvTDb1RtSwJA==","_npmVersion":"10.9.2","description":"Local field-level **AES-GCM-256** envelope encryption for [`@aiao/rxdb`](../rxdb). Plugs into the SQLite-core / PGlite / wa-sqlite / sqliteai adapters with zero-plaintext-at-rest guarantees on the structural database files, change log, query cache and his","directories":{},"sideEffects":false,"_nodeVersion":"22.14.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"peerDependencies":{"rxjs":"^7.8.0","@aiao/rxdb":"0.0.23"},"_npmOperationalInternal":{"tmp":"tmp/rxdb-adapter-encrypted_0.0.23_1785736167375_0.8835094237264884","host":"s3://npm-registry-packages-npm-production"}},"0.0.24":{"name":"@aiao/rxdb-adapter-encrypted","version":"0.0.24","license":"MIT","_id":"@aiao/rxdb-adapter-encrypted@0.0.24","maintainers":[{"name":"aiao","email":"hero63418@gmail.com"}],"nx":{"name":"rxdb-adapter-encrypted","tags":["js-lib"]},"dist":{"shasum":"78084b151c1468a0706c2bf51349f3df1f256e7e","tarball":"https://registry.npmjs.org/@aiao/rxdb-adapter-encrypted/-/rxdb-adapter-encrypted-0.0.24.tgz","fileCount":44,"integrity":"sha512-50H5vOGN/9TGEE6+iZqFXypYMVWBu6T31mNo2wbzDJL5XdQoxuq0/84EsaDX+yBm4jNDwRfwBJOmh8fdECD1Lw==","signatures":[{"sig":"MEYCIQCRQk64J1d7TI5AAPybC9UortBODSBZwpJ07wUZLwEEmgIhAMNjKBXxKTe5lqSLnD6gLQsI0+vy3CkWScbQ6WAbmOId","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":147638},"main":"./dist/index.js","type":"module","_from":"file:aiao-rxdb-adapter-encrypted-0.0.24.tgz","types":"./dist/index.d.ts","module":"./dist/index.js","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","default":"./dist/index.js"},"./testing":{"types":"./dist/testing.d.ts","import":"./dist/testing.js","default":"./dist/testing.js"},"./package.json":"./package.json"},"_npmUser":{"name":"aiao","email":"hero63418@gmail.com"},"_resolved":"/private/var/folders/1s/1sk5kvms7jj4z6glj40__v300000gn/T/8e5e42c298f041ac62deeb5f3096c119/aiao-rxdb-adapter-encrypted-0.0.24.tgz","_integrity":"sha512-50H5vOGN/9TGEE6+iZqFXypYMVWBu6T31mNo2wbzDJL5XdQoxuq0/84EsaDX+yBm4jNDwRfwBJOmh8fdECD1Lw==","_npmVersion":"11.19.0","description":"Local field-level **AES-GCM-256** envelope encryption for [`@aiao/rxdb`](../rxdb). Plugs into the SQLite-core / PGlite / wa-sqlite / sqliteai adapters with zero-plaintext-at-rest guarantees on the structural database files, change log, query cache and his","directories":{},"sideEffects":false,"_nodeVersion":"26.7.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"peerDependencies":{"rxjs":"^7.8.0","@aiao/rxdb":"0.0.24"},"_npmOperationalInternal":{"tmp":"tmp/rxdb-adapter-encrypted_0.0.24_1786439088927_0.9988255495026126","host":"s3://npm-registry-packages-npm-production"}},"0.0.25":{"name":"@aiao/rxdb-adapter-encrypted","version":"0.0.25","license":"MIT","_id":"@aiao/rxdb-adapter-encrypted@0.0.25","maintainers":[{"name":"aiao","email":"hero63418@gmail.com"}],"homepage":"https://github.com/aiao-io/rxdb#readme","bugs":{"url":"https://github.com/aiao-io/rxdb/issues"},"nx":{"name":"rxdb-adapter-encrypted","tags":["js-lib"]},"dist":{"shasum":"17f22bc4db983ec20cdf11d65feb73d88964d70d","tarball":"https://registry.npmjs.org/@aiao/rxdb-adapter-encrypted/-/rxdb-adapter-encrypted-0.0.25.tgz","fileCount":44,"integrity":"sha512-mvuAN7ad3CNqFDrA0BmI5Qx8qwkg5S/5uVQgm6DB003VQZzy9wozVGqEGL/dRTZs13SN89MZ/Tz50KDuittKew==","signatures":[{"sig":"MEUCIQDvlkKLT4SkbyE6y6hRDw4wgN8CIJs3AaM5d6ec1xkjhAIgR2GPYMqZF+GZPWbcuChbugDVh9hBWNjwdGo/xGpwsMs=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@aiao%2frxdb-adapter-encrypted@0.0.25","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":149237},"main":"./dist/index.js","type":"module","_from":"file:aiao-rxdb-adapter-encrypted-0.0.25.tgz","types":"./dist/index.d.ts","module":"./dist/index.js","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","default":"./dist/index.js"},"./testing":{"types":"./dist/testing.d.ts","import":"./dist/testing.js","default":"./dist/testing.js"},"./package.json":"./package.json"},"_npmUser":{"name":"aiao","email":"hero63418@gmail.com"},"_resolved":"/tmp/62eb6ef1a9c22a902511e04780f34ae9/aiao-rxdb-adapter-encrypted-0.0.25.tgz","_integrity":"sha512-mvuAN7ad3CNqFDrA0BmI5Qx8qwkg5S/5uVQgm6DB003VQZzy9wozVGqEGL/dRTZs13SN89MZ/Tz50KDuittKew==","repository":{"url":"git+https://github.com/aiao-io/rxdb.git","type":"git","directory":"packages/rxdb-adapter-encrypted"},"_npmVersion":"11.19.0","description":"Local field-level **AES-GCM-256** envelope encryption for [`@aiao/rxdb`](../rxdb). Plugs into the SQLite-core / PGlite / wa-sqlite / sqliteai adapters with zero-plaintext-at-rest guarantees on the structural database files, change log, query cache and his","directories":{},"sideEffects":false,"_nodeVersion":"26.7.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"peerDependencies":{"rxjs":"^7.8.0","@aiao/rxdb":"0.0.25"},"_npmOperationalInternal":{"tmp":"tmp/rxdb-adapter-encrypted_0.0.25_1786694755265_0.1018282832497952","host":"s3://npm-registry-packages-npm-production"}},"0.0.26":{"nx":{"name":"rxdb-adapter-encrypted","tags":["js-lib"]},"_id":"@aiao/rxdb-adapter-encrypted@0.0.26","bugs":{"url":"https://github.com/aiao-io/rxdb/issues"},"dist":{"shasum":"21537fa2126a12f8f0e727e82e2d98e824630f56","tarball":"https://registry.npmjs.org/@aiao/rxdb-adapter-encrypted/-/rxdb-adapter-encrypted-0.0.26.tgz","fileCount":44,"integrity":"sha512-6fj7EoqTRkzavkPlkMzish7h9S+7d+FWYB2Wsven7WzOan1B6eglRunsB+976+R2wmbFWVb4Rama/9NCN1MxwA==","signatures":[{"sig":"MEYCIQC1uNVbm94LGE/8oSCyQSR/uRQ+o/F6DCXPuya72J+WGQIhAMWpKown2M47EZyTfGpVz+PEVuexOE5XmVnIDRyjFNRX","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCIAHohV/TT7cOfPVDrjha9+vABA8Eq3yviihQdKTU8bQwAiBas7CeBPGa0Nj2eYySGuLAKcVfJ53oYbl+bIxaptUMWw=="}],"unpackedSize":149655},"main":"./dist/index.js","name":"@aiao/rxdb-adapter-encrypted","type":"module","_from":"file:aiao-rxdb-adapter-encrypted-0.0.26.tgz","types":"./dist/index.d.ts","module":"./dist/index.js","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","default":"./dist/index.js"},"./testing":{"types":"./dist/testing.d.ts","import":"./dist/testing.js","default":"./dist/testing.js","@aiao/source":"./src/testing.ts"},"./package.json":"./package.json"},"license":"MIT","version":"0.0.26","_npmUser":{"name":"aiao","email":"hero63418@gmail.com"},"homepage":"https://rxdb.netlify.app/docs/adapters/encrypted","keywords":["aiao","rxdb","encryption","aes-gcm","webcrypto","sqlite"],"_resolved":"/private/tmp/pack-0.0.26/aiao-rxdb-adapter-encrypted-0.0.26.tgz","_integrity":"sha512-6fj7EoqTRkzavkPlkMzish7h9S+7d+FWYB2Wsven7WzOan1B6eglRunsB+976+R2wmbFWVb4Rama/9NCN1MxwA==","repository":{"url":"git+https://github.com/aiao-io/rxdb.git","type":"git","directory":"packages/rxdb-adapter-encrypted"},"_npmVersion":"12.0.2","description":"Transparent AES-GCM field encryption wrapper for Aiao database adapters.","directories":{},"maintainers":[{"name":"aiao","email":"hero63418@gmail.com"}],"sideEffects":false,"_nodeVersion":"26.7.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"peerDependencies":{"rxjs":"^7.8.0","@aiao/rxdb":"0.0.26"},"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/rxdb-adapter-encrypted_0.0.26_1790793439663_0.7015194081248357"}}},"time":{"created":"2026-07-18T08:21:45.831Z","modified":"2026-09-30T18:37:19.896Z","0.0.21":"2026-07-18T08:21:46.106Z","0.0.22":"2026-07-31T07:26:35.011Z","0.0.23":"2026-08-03T05:49:27.502Z","0.0.24":"2026-08-11T09:04:49.083Z","0.0.25":"2026-08-14T08:05:55.437Z","0.0.26":"2026-09-30T18:37:19.753Z"},"bugs":{"url":"https://github.com/aiao-io/rxdb/issues"},"license":"MIT","homepage":"https://rxdb.netlify.app/docs/adapters/encrypted","repository":{"url":"git+https://github.com/aiao-io/rxdb.git","type":"git","directory":"packages/rxdb-adapter-encrypted"},"description":"Transparent AES-GCM field encryption wrapper for Aiao database adapters.","maintainers":[{"name":"aiao","email":"hero63418@gmail.com"}],"readme":"# @aiao/rxdb-adapter-encrypted\n\nLocal field-level **AES-GCM-256** envelope encryption for [`@aiao/rxdb`](../rxdb).\nPlugs into the SQLite-core / PGlite / wa-sqlite / sqliteai adapters with\nzero-plaintext-at-rest guarantees on the structural database files,\nchange log, query cache and history snapshots.\n\n---\n\n## Install\n\n```bash\npnpm add @aiao/rxdb-adapter-encrypted\n```\n\nPeer of any local SQLite-family adapter\n(`@aiao/rxdb-adapter-wa-sqlite`, `@aiao/rxdb-adapter-pglite`,\n`@aiao/rxdb-adapter-sqlite-wasm`, `@aiao/rxdb-adapter-sqliteai`).\nNot needed for Supabase or remote-only adapters.\n\n---\n\n## Quickstart\n\n```ts\nimport { Entity, EntityBase, PropertyType, RxDB, SyncType } from '@aiao/rxdb';\nimport { RxDBAdapterWaSqlite } from '@aiao/rxdb-adapter-wa-sqlite';\n\n@Entity({\n  name: 'User',\n  tableName: 'users',\n  properties: [\n    { name: 'displayName', type: PropertyType.string },\n    { name: 'email', type: PropertyType.string, encrypted: true }\n  ]\n})\nclass User extends EntityBase {\n  displayName!: string;\n  email!: string;\n}\n\nconst rxdb = new RxDB({\n  dbName: 'app.db',\n  context: { userId: 'current-user' },\n  entities: [User],\n  sync: { local: { adapter: 'wa-sqlite' }, type: SyncType.None }\n});\n\nrxdb.adapter('wa-sqlite', async db => new RxDBAdapterWaSqlite(db, { vfs: 'OPFSAdaptiveVFS' }));\nawait rxdb.connect('wa-sqlite');\n\nconst adapter = await rxdb.getAdapter('wa-sqlite');\n\nawait adapter.encryption.unlock({\n  passphrase: 'correct horse battery staple'\n  // idleTimeoutMs: 10 * 60_000  // override default 5-minute auto-lock\n  // idleTimeoutMs: 0            // disable auto-lock\n});\n\nawait rxdb.entityManager.getRepository(User).create(\n  new User({\n    displayName: 'Ada',\n    email: 'ada@example.com' // encrypted at rest\n  })\n);\n```\n\n---\n\n## Public API\n\n```ts\nimport {\n  // Keyring lifecycle\n  Keyring,\n  createKeyring,\n  type UnlockOptions,\n  type PassphraseUnlockOptions,\n  type KeyBytesUnlockOptions,\n  type CryptoKeyUnlockOptions,\n  type KeyProviderUnlockOptions,\n  type LegacyEnvelopePolicy,\n\n  // Envelope codec\n  encodeEnvelope,\n  decodeEnvelope,\n  isEnvelope,\n  buildAAD,\n  ENVELOPE_VERSION,\n  ENVELOPE_ALG,\n  type CryptoEnvelope,\n  type EnvelopeVersion,\n\n  // Schema + query validators\n  validateEncryptedPropertyMetadata,\n  validateFTSRegistrationAgainstEncryptedColumns,\n  validateQueryAgainstEncryptedColumns,\n  type EncryptedAwareEntity,\n\n  // Typed errors\n  EncryptedError,\n  EncryptedConfigurationError,\n  EncryptedDecryptError,\n  EncryptedLockedError,\n  EncryptedQueryError,\n  EncryptedUnlockError,\n  type EncryptedErrorCode,\n  type EncryptedErrorInit,\n\n  // Keyring persistence binding\n  type KeyringRow,\n  type KeyringStorageBinding,\n\n  // Verifier sentinel constant\n  VERIFIER_SENTINEL\n} from '@aiao/rxdb-adapter-encrypted';\n\nimport { scanForPlaintext, type ScanHit } from '@aiao/rxdb-adapter-encrypted/testing';\n```\n\nRefer to the TSDoc on each export for its security and lifecycle contract.\n\n---\n\n## Guarantees\n\n| Spec   | Guarantee                                                                                                                                                                 |\n| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| FR-001 | Schema validation rejects encrypted PK / FK / index / unique / sortable / FTS / computed columns                                                                          |\n| FR-002 | Envelope text form `v\\|alg\\|kid\\|iv\\|ct\\|tag`; new writes use v2                                                                                                          |\n| FR-003 | AES-GCM-256 with a unique 96-bit IV; length-prefixed AAD binds the database, entity namespace, table, column, typed ID and `kid`                                          |\n| FR-004 | `unlock()` accepts exactly one of `passphrase` / `keyBytes` / `key` / `keyProvider`                                                                                       |\n| FR-005 | All encrypted columns are emitted as `TEXT` regardless of logical type                                                                                                    |\n| FR-006 | Zero plaintext in DB files, `rxdb_change` patches, query cache, history snapshots                                                                                         |\n| US-804 | Encrypted bigint is signed 64-bit decimal; binary copies the current Uint8Array view and restores an independent Uint8Array                                               |\n| FR-007 | Filter / order / group / projection over encrypted columns throws `EncryptedQueryError`; FTS registration throws `EncryptedConfigurationError('encrypted_fts_forbidden')` |\n| FR-008 | Locked-state reads throw `EncryptedLockedError`; idle auto-lock after `5 min` (configurable, `0` disables)                                                                |\n| FR-009 | `unlock()` verifies passphrase against persisted `verifier` probe; wrong passphrase never retains key                                                                     |\n\n---\n\n## Migrating v1 Envelopes\n\nv1 entity envelopes are rejected by default because their AAD does not bind the\nentity namespace and uses ambiguous delimiter boundaries. Enable legacy reads\nonly for a bounded migration:\n\n```ts\nawait adapter.encryption.unlock({\n  passphrase: 'correct horse battery staple',\n  legacyEnvelopePolicy: 'migration'\n});\n```\n\nRead and rewrite every encrypted entity while this policy is active. Every\nwrite produces v2. After the rewrite, lock and unlock without\n`legacyEnvelopePolicy`; any remaining v1 entity envelope then fails with\n`EncryptedDecryptError.code === 'legacy_envelope_forbidden'`. Existing v1\nkeyring verifiers remain readable during unlock so a legacy database can enter\nthe migration flow. A failed v2 authentication is never retried with v1 AAD.\n\n---\n\n## What this package does NOT do (MVP)\n\n- No full-database encryption — only declared columns are sealed.\n- No native keychain / passkey / WebAuthn — bring your own passphrase or key bytes.\n- No searchable encryption — `where` / `order` / `group` / FTS on encrypted columns is rejected.\n- No key rotation — single `kid` per database for the MVP.\n- No audit log — decrypt failures throw, not persisted.\n- No automatic relock on tab visibility — subscribe to `document.visibilitychange` yourself.\n\n---\n\n## License\n\nMIT\n","readmeFilename":"README.md","keywords":["aiao","rxdb","encryption","aes-gcm","webcrypto","sqlite"]}