Graphorin API reference v0.15.1
Graphorin API reference / @graphorin/store-sqlite-encrypted / / EncryptDatabaseOptions
Interface: EncryptDatabaseOptions
Defined in: packages/store-sqlite-encrypted/src/encrypt.ts:42
Stable
Options for encryptDatabase.
Properties
| Property | Modifier | Type | Description | Defined in |
|---|---|---|---|---|
cipher? | readonly | EncryptionCipher | Cipher selection. Default 'sqlcipher' (SQLCipher v4 compatible). | packages/store-sqlite-encrypted/src/encrypt.ts:50 |
overwriteTarget? | readonly | boolean | If true, overwrite an existing targetPath instead of failing. Default false. | packages/store-sqlite-encrypted/src/encrypt.ts:75 |
passphrase | readonly | string | Buffer<ArrayBufferLike> | Passphrase for the new encrypted DB. | packages/store-sqlite-encrypted/src/encrypt.ts:48 |
sourcePath | readonly | string | Path to the existing unencrypted source DB. | packages/store-sqlite-encrypted/src/encrypt.ts:44 |
swap? | readonly | boolean | If true, atomically rename targetPath -> sourcePath after the integrity check passes. The original sourcePath is renamed to ${sourcePath}.bak.${timestamp} (WAL/SHM sidecars move with it) so an operator can recover. Default false - the CLI does the swap explicitly. REQUIRES A STOPPED SERVER: a live writer keeps its file descriptor on the renamed .bak inode and every post-snapshot commit silently diverges from the new encrypted file (and is later deleted by storage cleanup-backups). A fail-closed live-writer check refuses the swap with EncryptSwapLiveWriterError while ANY other connection holds the database - WAL sidecar presence first (also refuses after an unclean shutdown), then a journal-mode probe - once before the copy and again immediately before the rename pair, so the remaining check-to-rename race is microseconds wide. Treat the check as a seatbelt, not a lock: stop every writer first. | packages/store-sqlite-encrypted/src/encrypt.ts:70 |
targetPath | readonly | string | Path the encrypted output is written to. Must not exist. | packages/store-sqlite-encrypted/src/encrypt.ts:46 |