@delali/sirannon-db 0.3.5 → 0.3.6-next.78

package/dist/{database-backup-BwTNiBm2.d.ts → database-backup-BhM8yJ1A.d.ts}

@@ -1,4 +1,4 @@
-import { i as BackupChainBase, j as BackupChainChange, h as BackupChain, l as BackupChainRecord, B as BackupDestination, J as SQLiteConnection, Q as DriverCapabilities, U as BackupEngine, q as BackupFileReport, z as BackupToDestinationOptions, g as BackupRunReport, P as BackupScheduleOptions, o as BackupCycleOptions, p as BackupCycleStatus, C as BackupVerifyResult } from './types-DTmi7pXp.js';
+import { i as BackupChainBase, j as BackupChainChange, h as BackupChain, l as BackupChainRecord, B as BackupDestination, L as SQLiteConnection, V as DriverCapabilities, W as BackupEngine, q as BackupFileReport, z as BackupToDestinationOptions, g as BackupRunReport, R as BackupScheduleOptions, o as BackupCycleOptions, p as BackupCycleStatus, C as BackupVerifyResult } from './types-BWyv_N18.js';
 
 /**
  * The backup operations that one runtime supports, so that a caller can check
@@ -110,11 +110,14 @@ declare class DatabaseBackupController {
     private readonly databaseId;
     private readonly sourcePath;
     private readonly engine?;
+    private readonly keyId;
     private readonly cancellers;
     private cycle;
     private cycleOptions;
     private cycleStarted;
-    constructor(runExclusive: RunExclusive, acquireWriter: () => SQLiteConnection, driverCapabilities: DriverCapabilities, databaseId: string, sourcePath: string, engine?: BackupEngine | undefined);
+    private readonly copies;
+    private readonly copyWriter;
+    constructor(runExclusive: RunExclusive, acquireWriter: () => SQLiteConnection, driverCapabilities: DriverCapabilities, databaseId: string, sourcePath: string, engine?: BackupEngine | undefined, keyId?: () => string | undefined);
     private require;
     private requireCycle;
     capabilities(): BackupCapabilities;
@@ -137,6 +140,33 @@ declare class DatabaseBackupController {
     piecesSafeToDelete(options?: BackupSafeToDeleteOptions): Promise<BackupChainRecord[]>;
     /** Stops the backup cycle after one last capture, which sends the writes made since the previous turn to the destination. */
     stopCycle(): Promise<void>;
+    /**
+     * Stops the backup cycle after one last capture, ahead of a key change that replaces the file.
+     *
+     * @returns `true` when a cycle was running, which {@link DatabaseBackupController.resumeCycle} starts again.
+     */
+    pauseCycle(): Promise<boolean>;
+    /**
+     * Stops new backup copies from starting ahead of a key change that replaces the file, and waits until SQLite has
+     * stopped writing every copy that started before, so that no copy reads pages from both files.
+     */
+    pauseCopies(): Promise<void>;
+    /** Lets backup copies start again once a key change has replaced the file or given up. */
+    resumeCopies(): void;
+    /**
+     * Drops the chain that the paused backup cycle extended, so that the cycle starts a new chain with a full copy
+     * whenever it starts again, including in a process that starts after a crash during the key change.
+     */
+    forgetPausedChain(): Promise<void>;
+    /**
+     * Starts the backup cycle again after a key change, on a new chain whose first piece is a full copy when the file
+     * now holds ciphertext under another key.
+     *
+     * @param options - Whether the cycle starts a new chain.
+     */
+    resumeCycle(options: {
+        newChain: boolean;
+    }): Promise<void>;
     cancelAll(): void;
 }
 

package/dist/driver/better-sqlite3.d.ts

@@ -1,4 +1,4 @@
-import { S as SQLiteDriver } from '../types-DTmi7pXp.js';
+import { S as SQLiteDriver } from '../types-BWyv_N18.js';
 import '../query-types-5B02ixH0.js';
 
 /**
@@ -37,6 +37,16 @@ interface BetterSqlite3Options {
      * needs Sirannon's SQLite, such as `rowCounts`, is set.
      */
     sqliteBindingPath?: string;
+    /**
+     * Set it to `true` to open every database through `@delali/sirannon-sqlite`,
+     * which contains better-sqlite3 built against SQLite3 Multiple Ciphers, so
+     * that a database opened with the `encryption` option keeps every page as
+     * AEGIS-256 ciphertext and
+     * `changeEncryption` can encrypt, decrypt, or rekey a database. With it unset,
+     * the driver keeps better-sqlite3's own SQLite and fails an open with a key
+     * with `ENCRYPTION_UNSUPPORTED`.
+     */
+    encryption?: boolean;
 }
 /**
  * Returns a driver that opens SQLite databases on Node through the `better-sqlite3` native module.

package/dist/driver/better-sqlite3.mjs

@@ -1,24 +1,63 @@
+import { reportEncryptedPageFailures } from '../chunk-BKO4SCEC.mjs';
 import { optionalDependencyError } from '../chunk-WOMADPM4.mjs';
-import { nodeResolveExtensionPath, asyncLocalWriterContext, nodeBackupEngine, nodeStreamingSupport, WriterWorker, createStatementCache, loadThroughRuntime, bindableParams, narrowSafeBigInt, narrowRowIntegers, narrowRowsIntegers } from '../chunk-G4AG3ESO.mjs';
+import { nodeResolveExtensionPath, nodeBackupEngine, nodeStreamingSupport, WriterWorker, createStatementCache } from '../chunk-FBA7P4ZA.mjs';
 import '../chunk-DX4WGJL7.mjs';
-import '../chunk-BTUD6XQO.mjs';
-import { defineDriver } from '../chunk-JAQ2I4OT.mjs';
-import '../chunk-W67A4H2E.mjs';
+import '../chunk-N3MHZV3B.mjs';
+import { asyncLocalWriterContext, loadThroughRuntime } from '../chunk-RLBV4YTB.mjs';
+import { bindableParams, narrowSafeBigInt, narrowRowIntegers, narrowRowsIntegers } from '../chunk-MX77PGEN.mjs';
+import '../chunk-Y4SP7CRF.mjs';
+import '../chunk-I4JY5QPA.mjs';
 import '../chunk-K43WJORM.mjs';
+import { defineDriver } from '../chunk-A5ULJVK7.mjs';
 import '../chunk-75IBRE73.mjs';
 import { withRowCounts } from '../chunk-E2GRX4ZD.mjs';
-import '../chunk-UHUDPQFI.mjs';
+import '../chunk-OJXV4L3N.mjs';
 import '../chunk-QGVRRKB2.mjs';
 import '../chunk-AHCMO4YL.mjs';
 import '../chunk-BUWJH3D3.mjs';
-import { synchronousPragmaValue } from '../chunk-YCMB6GR4.mjs';
-import '../chunk-CZL4D3BM.mjs';
+import '../chunk-6CABU54O.mjs';
 import '../chunk-BGJ5JVYL.mjs';
 import '../chunk-HO2XTXVX.mjs';
+import { synchronousPragmaValue } from '../chunk-YCMB6GR4.mjs';
+import { EncryptionError, keyRejected } from '../chunk-5O4J6LQQ.mjs';
 import { SirannonError, BackupError } from '../chunk-KINDFBQP.mjs';
+import { rename, rm, open } from 'fs/promises';
 import { createRequire } from 'module';
 import { resolve } from 'path';
 
+var NO_SUCH_FILE_CODES = /* @__PURE__ */ new Set(["ENOENT", "ENAMETOOLONG"]);
+function missingFile(err) {
+  return typeof err === "object" && err !== null && NO_SUCH_FILE_CODES.has(err.code);
+}
+var nodeDatabaseFiles = {
+  async readStart(path, length) {
+    let handle;
+    try {
+      handle = await open(path, "r");
+    } catch (err) {
+      if (missingFile(err)) return null;
+      throw err;
+    }
+    try {
+      const buffer = new Uint8Array(length);
+      const { bytesRead } = await handle.read(buffer, 0, length, 0);
+      return buffer.subarray(0, bytesRead);
+    } finally {
+      await handle.close();
+    }
+  },
+  async remove(path) {
+    try {
+      await rm(path, { force: true });
+    } catch (err) {
+      if (!missingFile(err)) throw err;
+    }
+  },
+  async rename(from, to) {
+    await rename(from, to);
+  }
+};
+
 // src/drivers/better-sqlite3/copy.ts
 var OPEN_TRANSACTION_MESSAGE = "A stepped copy cannot start while a transaction is open on the same connection, because SQLite copies no pages and reports success";
 async function copyDatabaseWithBetterSqlite3(db, request) {
@@ -32,6 +71,107 @@ async function copyDatabaseWithBetterSqlite3(db, request) {
   return final;
 }
 
+// src/drivers/better-sqlite3/encryption.ts
+var AEGIS_CIPHER_NAME = "aegis";
+var AEGIS_256_ALGORITHM_NAME = "aegis-256";
+var SQLITE_HEADER = "SQLite format 3\0";
+var SQLITE_HEADER_BYTES = SQLITE_HEADER.length;
+var ENCRYPTION_FEATURE = {
+  option: "encryption",
+  code: "ENCRYPTION_UNSUPPORTED",
+  description: "encryption engine",
+  presentIn: (addon) => typeof addon.Database?.prototype?.key === "function"
+};
+async function classifyDatabaseFile(path) {
+  if (path === "" || path === ":memory:") return "memory";
+  if (path.startsWith("file:")) return "unknown";
+  const start = await nodeDatabaseFiles.readStart(path, SQLITE_HEADER_BYTES);
+  if (start === null || start.length === 0) return "new";
+  if (start.length === SQLITE_HEADER_BYTES && String.fromCharCode(...start) === SQLITE_HEADER) return "plaintext";
+  return "encrypted";
+}
+function assertKeyFitsFile(path, kind, keyed) {
+  if (keyed && kind === "memory") {
+    throw new EncryptionError("An in-memory database cannot be encrypted", "ENCRYPTION_UNSUPPORTED");
+  }
+  if (keyed && kind === "plaintext") {
+    throw new EncryptionError(
+      `The database at ${path} is plaintext, so it opens without a key. Encrypt it through changeEncryption`,
+      "DATABASE_NOT_ENCRYPTED"
+    );
+  }
+  if (!keyed && kind === "encrypted") {
+    throw new EncryptionError(
+      `The database at ${path} is encrypted, so it opens only with the encryption option and its key`,
+      "ENCRYPTION_KEY_MISSING"
+    );
+  }
+}
+function sqliteCode(err) {
+  if (typeof err !== "object" || err === null) return void 0;
+  const { code } = err;
+  return typeof code === "string" ? code : void 0;
+}
+function probeDatabaseFile(open2) {
+  let probe;
+  try {
+    probe = open2();
+  } catch (err) {
+    if (sqliteCode(err) === "SQLITE_CANTOPEN") return "new";
+    throw err;
+  }
+  try {
+    const main = probe.prepare("SELECT file FROM pragma_database_list WHERE name = 'main'").get();
+    if (main?.file === "") return "memory";
+    probe.prepare("SELECT count(*) FROM sqlite_schema").get();
+    return Number(probe.pragma("page_count", { simple: true })) === 0 ? "new" : "plaintext";
+  } catch (err) {
+    if (sqliteCode(err) === "SQLITE_NOTADB") return "encrypted";
+    throw err;
+  } finally {
+    probe.close();
+  }
+}
+function readSchema(db, path) {
+  try {
+    db.prepare("SELECT count(*) FROM sqlite_schema").get();
+  } catch (err) {
+    const code = sqliteCode(err);
+    if (code === "SQLITE_NOTADB") throw keyRejected(path, err);
+    if (code?.startsWith("SQLITE_CORRUPT")) {
+      throw new EncryptionError(
+        `A schema page of the encrypted database at ${path} failed its authentication check`,
+        "ENCRYPTED_PAGE_CORRUPT",
+        err
+      );
+    }
+    throw err;
+  }
+}
+function engineVersion(db) {
+  try {
+    const row = db.prepare("SELECT sqlite3mc_version() AS version").get();
+    return row?.version;
+  } catch {
+    return void 0;
+  }
+}
+function keyConnection(db, path, rawKey) {
+  db.key(rawKey);
+  db.pragma("temp_store = MEMORY");
+  readSchema(db, path);
+  const version = engineVersion(db);
+  if (typeof version !== "string" || version.length === 0) {
+    throw new EncryptionError(
+      "The SQLite build reports no encryption engine version, so it cannot encrypt",
+      "ENCRYPTION_UNSUPPORTED"
+    );
+  }
+  if (db.pragma("cipher", { simple: true }) !== AEGIS_CIPHER_NAME || db.pragma("algorithm", { simple: true }) !== AEGIS_256_ALGORITHM_NAME) {
+    throw new EncryptionError("The SQLite build encrypts with a cipher other than AEGIS-256", "ENCRYPTION_UNSUPPORTED");
+  }
+}
+
 // src/drivers/better-sqlite3/row-counting.ts
 var ROW_COUNTS_FEATURE = {
   option: "rowCounts",
@@ -210,7 +350,7 @@ function plainStatement(stmt) {
     }
   };
 }
-function createConnection(db, taker) {
+function createConnection(db, taker, encrypting) {
   const batchStatementFor = createStatementCache((sql) => db.prepare(sql));
   const conn = {
     async exec(sql) {
@@ -266,22 +406,58 @@ function createConnection(db, taker) {
       db.close();
     }
   };
+  if (encrypting) {
+    conn.startChangeCapture = async () => {
+      encrypting.startChangeCapture();
+    };
+    conn.takeCapturedChanges = async () => encrypting.takeCapturedChanges();
+    conn.stopChangeCapture = async () => {
+      encrypting.stopChangeCapture();
+    };
+    conn.applyCapturedChanges = async (changes) => {
+      encrypting.applyChanges(changes);
+    };
+  }
   return conn;
 }
-async function openDatabase(path, readonly, driverOptions) {
-  if (driverOptions?.rowCounts !== true) {
+function sirannonSqliteFeatures(driverOptions) {
+  const features = [];
+  if (driverOptions?.encryption === true) features.push(ENCRYPTION_FEATURE);
+  if (driverOptions?.rowCounts === true) features.push(ROW_COUNTS_FEATURE);
+  return features;
+}
+async function openDatabase(path, readonly, driverOptions, rawKey) {
+  const [first, ...rest] = sirannonSqliteFeatures(driverOptions);
+  if (first === void 0) {
     const Database = (await import('better-sqlite3')).default;
-    return { db: new Database(path, { readonly }), taker: null };
+    return { db: new Database(path, { readonly }), taker: null, encrypting: null };
   }
-  const sqlite = await loadSirannonSqlite([ROW_COUNTS_FEATURE], driverOptions.sqliteBindingPath);
-  return { db: new sqlite.Database(path, { readonly, nativeBinding: sqlite.bindingPath }), taker: new RowCountTaker() };
+  const sqlite = await loadSirannonSqlite([first, ...rest], driverOptions?.sqliteBindingPath);
+  const openConnection = () => new sqlite.Database(path, { readonly, nativeBinding: sqlite.bindingPath });
+  if (driverOptions?.encryption === true) {
+    const kind = await classifyDatabaseFile(path);
+    const settled = kind === "unknown" ? probeDatabaseFile(() => openConnection()) : kind;
+    assertKeyFitsFile(path, settled, rawKey !== void 0);
+  }
+  const db = openConnection();
+  const encrypting = driverOptions?.encryption === true ? db : null;
+  try {
+    if (rawKey !== void 0 && encrypting) keyConnection(encrypting, path, rawKey);
+    else db.pragma("temp_store = FILE");
+  } catch (err) {
+    db.close();
+    throw err;
+  }
+  return { db, taker: driverOptions?.rowCounts === true ? new RowCountTaker() : null, encrypting };
 }
 function betterSqlite3(driverOptions) {
   const workerEntry = { specifier: import.meta.url, exportName: "betterSqlite3", config: driverOptions };
   const rowCounts = driverOptions?.rowCounts === true;
+  const encryption = driverOptions?.encryption === true;
   return defineDriver({
-    capabilities: { multipleConnections: true, extensions: true, steppedCopy: true, rowCounts },
+    capabilities: { multipleConnections: true, extensions: true, steppedCopy: true, rowCounts, encryption },
     worker: workerEntry,
+    files: nodeDatabaseFiles,
     startWriterHost: async (path, options, hostOptions) => {
       const host = await WriterWorker.start(workerEntry, path, options, { ...hostOptions, countsRows: rowCounts });
       return host.connection;
@@ -296,16 +472,29 @@ function betterSqlite3(driverOptions) {
     ),
     resolveExtensionPath: nodeResolveExtensionPath,
     async open(path, options) {
-      const { db, taker } = await openDatabase(path, options?.readonly ?? false, driverOptions);
-      db.defaultSafeIntegers(true);
-      if (options?.walMode !== false) db.pragma("journal_mode = WAL");
-      db.pragma(`synchronous = ${synchronousPragmaValue(options?.synchronous)}`);
-      db.pragma("foreign_keys = ON");
-      db.pragma(`busy_timeout = ${driverOptions?.busyTimeout ?? 5e3}`);
-      if (options?.walAutoCheckpoint !== void 0) {
-        db.pragma(`wal_autocheckpoint = ${Math.trunc(options.walAutoCheckpoint)}`);
+      const rawKey = options?.encryption?.key;
+      if (rawKey !== void 0 && !encryption) {
+        throw new EncryptionError(
+          "The better-sqlite3 driver opens encrypted databases only when you create it with betterSqlite3({ encryption: true })",
+          "ENCRYPTION_UNSUPPORTED"
+        );
+      }
+      const { db, taker, encrypting } = await openDatabase(path, options?.readonly ?? false, driverOptions, rawKey);
+      try {
+        db.defaultSafeIntegers(true);
+        if (options?.walMode !== false) db.pragma("journal_mode = WAL");
+        db.pragma(`synchronous = ${synchronousPragmaValue(options?.synchronous)}`);
+        db.pragma("foreign_keys = ON");
+        db.pragma(`busy_timeout = ${driverOptions?.busyTimeout ?? 5e3}`);
+        if (options?.walAutoCheckpoint !== void 0) {
+          db.pragma(`wal_autocheckpoint = ${Math.trunc(options.walAutoCheckpoint)}`);
+        }
+      } catch (err) {
+        db.close();
+        throw err;
       }
-      return createConnection(db, taker);
+      const connection = createConnection(db, taker, encrypting);
+      return rawKey === void 0 ? connection : reportEncryptedPageFailures(connection);
     }
   });
 }

package/dist/driver/bun.d.ts

@@ -1,4 +1,4 @@
-import { S as SQLiteDriver } from '../types-DTmi7pXp.js';
+import { S as SQLiteDriver } from '../types-BWyv_N18.js';
 import '../query-types-5B02ixH0.js';
 
 /**

package/dist/driver/bun.mjs

@@ -1,32 +1,25 @@
-import { defineDriver, synchronousPragmaValue, assertHoldsStatement, bindableParams, narrowSafeBigInt, narrowRowIntegers, narrowRowsIntegers, SirannonError, ExtensionError } from '../chunk-DBN57KVR.mjs';
+import { assertHoldsStatement } from '../chunk-22TYGH7J.mjs';
+import { asyncLocalWriterContext, loadThroughRuntime } from '../chunk-RLBV4YTB.mjs';
+import { bindableParams, narrowSafeBigInt, narrowRowIntegers, narrowRowsIntegers } from '../chunk-MX77PGEN.mjs';
+import { defineDriver } from '../chunk-A5ULJVK7.mjs';
+import { synchronousPragmaValue } from '../chunk-YCMB6GR4.mjs';
+import { refuseEncryptedOpen } from '../chunk-5O4J6LQQ.mjs';
+import '../chunk-KINDFBQP.mjs';
 import { resolve } from 'path';
-import { AsyncLocalStorage } from 'async_hooks';
 
-// src/core/driver/extension.ts
-async function loadThroughRuntime(extensionPath, load) {
-  try {
-    load();
-  } catch (err) {
-    if (err instanceof SirannonError) throw err;
-    throw new ExtensionError(extensionPath, err instanceof Error ? err.message : String(err));
-  }
-}
-function asyncLocalWriterContext() {
-  const held = new AsyncLocalStorage();
-  return {
-    run: (operation) => held.run(true, operation),
-    isActive: () => held.getStore() === true,
-    exit: (operation) => held.exit(operation)
-  };
-}
-
-// src/drivers/bun/index.ts
 function bunSqlite(driverOptions) {
   return defineDriver({
-    capabilities: { multipleConnections: true, extensions: true, steppedCopy: false, rowCounts: false },
+    capabilities: {
+      multipleConnections: true,
+      extensions: true,
+      steppedCopy: false,
+      rowCounts: false,
+      encryption: false
+    },
     resolveExtensionPath: (extensionPath) => resolve(extensionPath),
     createWriterContext: asyncLocalWriterContext,
     async open(path, options) {
+      refuseEncryptedOpen("bun:sqlite", options);
       const { Database } = await import('bun:sqlite');
       const db = new Database(path, { readonly: options?.readonly ?? false, safeIntegers: true, strict: true });
       if (options?.walMode !== false) {

package/dist/driver/expo.d.ts

@@ -1,4 +1,4 @@
-import { S as SQLiteDriver } from '../types-DTmi7pXp.js';
+import { S as SQLiteDriver } from '../types-BWyv_N18.js';
 import '../query-types-5B02ixH0.js';
 
 /**

package/dist/driver/expo.mjs

@@ -1,4 +1,11 @@
-import { defineDriver, synchronousPragmaValue, ExtensionError, assertHoldsStatement, isNamedParams } from '../chunk-DBN57KVR.mjs';
+import { reportEncryptedPageFailures } from '../chunk-BKO4SCEC.mjs';
+import { assertHoldsStatement } from '../chunk-22TYGH7J.mjs';
+import { isNamedParams } from '../chunk-MX77PGEN.mjs';
+import { defineDriver } from '../chunk-A5ULJVK7.mjs';
+import '../chunk-E2GRX4ZD.mjs';
+import { synchronousPragmaValue } from '../chunk-YCMB6GR4.mjs';
+import { EncryptionError, keyRejected } from '../chunk-5O4J6LQQ.mjs';
+import { ExtensionError } from '../chunk-KINDFBQP.mjs';
 
 // src/drivers/expo/bind.ts
 var LARGEST_SAFE_INTEGER = BigInt(Number.MAX_SAFE_INTEGER);
@@ -29,20 +36,179 @@ function expoBindParams(params) {
   return params.map(expoValue);
 }
 
+// src/drivers/expo/encryption.ts
+var NOT_A_DATABASE = /file is not a database/i;
+var HEX_DIGITS = "0123456789abcdef";
+var EXPO_SQLITE_ENCRYPTION_FLOOR = "15.0.0";
+var SQLCIPHER_FLOOR = [4, 6, 0];
+function meetsSqlcipherFloor(cipherVersion) {
+  const parts = /^(\d+)\.(\d+)\.(\d+)/.exec(cipherVersion);
+  if (parts === null) return false;
+  const found = [Number(parts[1]), Number(parts[2]), Number(parts[3])];
+  for (let at = 0; at < SQLCIPHER_FLOOR.length; at++) {
+    const floor = SQLCIPHER_FLOOR[at] ?? 0;
+    const value = found[at] ?? 0;
+    if (value !== floor) return value > floor;
+  }
+  return true;
+}
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function rawKeyLiteral(rawKey) {
+  let hex = "";
+  for (const byte of rawKey) hex += HEX_DIGITS[byte >> 4] + HEX_DIGITS[byte & 15];
+  return `"x'${hex}'"`;
+}
+async function readUnkeyedExpoSchema(handle, path) {
+  try {
+    await handle.getFirstAsync("SELECT count(*) FROM sqlite_schema");
+  } catch (err) {
+    if (!NOT_A_DATABASE.test(errorMessage(err))) throw err;
+    throw new EncryptionError(
+      `The database ${path} is encrypted, so it opens only with the encryption option and its key`,
+      "ENCRYPTION_KEY_MISSING",
+      err
+    );
+  }
+}
+async function probeExpoDatabase(open) {
+  const probe = await open();
+  try {
+    await probe.getFirstAsync("SELECT count(*) FROM sqlite_schema");
+    const pages = await probe.getFirstAsync("PRAGMA page_count");
+    return (pages?.page_count ?? 0) > 0 ? "plaintext" : "new";
+  } catch (err) {
+    if (NOT_A_DATABASE.test(errorMessage(err))) return "encrypted";
+    throw err;
+  } finally {
+    await probe.closeAsync();
+  }
+}
+async function keyExpoConnection(handle, path, rawKey) {
+  await handle.execAsync(`PRAGMA key = ${rawKeyLiteral(rawKey)}`);
+  await handle.execAsync("PRAGMA temp_store = MEMORY");
+  const version = await handle.getFirstAsync("PRAGMA cipher_version");
+  const cipherVersion = typeof version?.cipher_version === "string" ? version.cipher_version : "";
+  if (!meetsSqlcipherFloor(cipherVersion)) {
+    throw new EncryptionError(
+      `Encryption on the Expo driver needs expo-sqlite ${EXPO_SQLITE_ENCRYPTION_FLOOR} or later, built with the useSQLCipher option of its config plugin, which carries SQLCipher ${SQLCIPHER_FLOOR.join(".")} or later. This app reports ${cipherVersion === "" ? "no SQLCipher" : `SQLCipher ${cipherVersion}`}`,
+      "ENCRYPTION_UNSUPPORTED"
+    );
+  }
+  try {
+    await handle.getFirstAsync("SELECT count(*) FROM sqlite_schema");
+  } catch (err) {
+    if (NOT_A_DATABASE.test(errorMessage(err))) throw keyRejected(path, err);
+    throw err;
+  }
+}
+
+// src/drivers/expo/files.ts
+var EXPO_FILE_SYSTEM_FLOOR = "19.0.0";
+var BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+var BASE64_VALUES = new Map([...BASE64_ALPHABET].map((char, value) => [char, value]));
+var modules = null;
+async function loadLegacyFileSystem() {
+  try {
+    return await import('expo-file-system/legacy');
+  } catch {
+    return null;
+  }
+}
+function loadModules() {
+  modules ??= (async () => {
+    const [fs, sqlite] = await Promise.all([loadLegacyFileSystem(), import('expo-sqlite')]);
+    if (fs === null) {
+      throw new EncryptionError(
+        `A key change on the Expo driver needs expo-file-system ${EXPO_FILE_SYSTEM_FLOOR} or later, whose expo-file-system/legacy entry reads, deletes, and moves the database files`,
+        "ENCRYPTION_UNSUPPORTED"
+      );
+    }
+    return { fs, directory: String(sqlite.defaultDatabaseDirectory) };
+  })();
+  return modules;
+}
+function bytesOfBase64(text) {
+  const bytes = [];
+  let buffer = 0;
+  let bits = 0;
+  for (const char of text) {
+    const value = BASE64_VALUES.get(char);
+    if (value === void 0) continue;
+    buffer = buffer << 6 | value;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      bytes.push(buffer >> bits & 255);
+    }
+  }
+  return Uint8Array.from(bytes);
+}
+function fileUri(directory, path) {
+  const absolute = `${directory.replace(/\/*$/, "")}/${path.replace(/^\/+/, "")}`;
+  return `file://${absolute.split("/").map(encodeURIComponent).join("/")}`;
+}
+var expoDatabaseFiles = {
+  async readStart(path, length) {
+    const { fs, directory } = await loadModules();
+    const uri = fileUri(directory, path);
+    const info = await fs.getInfoAsync(uri);
+    if (!info.exists) return null;
+    if (info.size === 0) return new Uint8Array(0);
+    const text = await fs.readAsStringAsync(uri, { encoding: fs.EncodingType.Base64, position: 0, length });
+    return bytesOfBase64(text);
+  },
+  async remove(path) {
+    const { fs, directory } = await loadModules();
+    await fs.deleteAsync(fileUri(directory, path), { idempotent: true });
+  },
+  async rename(from, to) {
+    const { fs, directory } = await loadModules();
+    await fs.moveAsync({ from: fileUri(directory, from), to: fileUri(directory, to) });
+  }
+};
+
 // src/drivers/expo/index.ts
 function expoSqlite() {
   return defineDriver({
-    capabilities: { multipleConnections: false, extensions: false, steppedCopy: false, rowCounts: false },
+    capabilities: {
+      multipleConnections: false,
+      extensions: false,
+      steppedCopy: false,
+      rowCounts: false,
+      encryption: true
+    },
+    files: expoDatabaseFiles,
     async open(path, options) {
       const SQLite = await import('expo-sqlite');
-      const db = await SQLite.openDatabaseAsync(path, {
-        readOnly: options?.readonly
+      const openHandle = () => SQLite.openDatabaseAsync(path, {
+        readOnly: options?.readonly,
+        useNewConnection: true
       });
-      if (options?.walMode !== false) await db.execAsync("PRAGMA journal_mode = WAL");
-      await db.execAsync(`PRAGMA synchronous = ${synchronousPragmaValue(options?.synchronous)}`);
-      await db.execAsync("PRAGMA foreign_keys = ON");
-      if (options?.walAutoCheckpoint !== void 0) {
-        await db.execAsync(`PRAGMA wal_autocheckpoint = ${Math.trunc(options.walAutoCheckpoint)}`);
+      const rawKey = options?.encryption?.key;
+      if (rawKey !== void 0 && (path === "" || path === ":memory:")) {
+        throw new EncryptionError("An in-memory database cannot be encrypted", "ENCRYPTION_UNSUPPORTED");
+      }
+      if (rawKey !== void 0 && await probeExpoDatabase(openHandle) === "plaintext") {
+        throw new EncryptionError(
+          `The database ${path} is plaintext, so it opens without a key. Encrypt it through changeEncryption`,
+          "DATABASE_NOT_ENCRYPTED"
+        );
+      }
+      const db = await openHandle();
+      try {
+        if (rawKey !== void 0) await keyExpoConnection(db, path, rawKey);
+        else await readUnkeyedExpoSchema(db, path);
+        if (options?.walMode !== false) await db.execAsync("PRAGMA journal_mode = WAL");
+        await db.execAsync(`PRAGMA synchronous = ${synchronousPragmaValue(options?.synchronous)}`);
+        await db.execAsync("PRAGMA foreign_keys = ON");
+        if (options?.walAutoCheckpoint !== void 0) {
+          await db.execAsync(`PRAGMA wal_autocheckpoint = ${Math.trunc(options.walAutoCheckpoint)}`);
+        }
+      } catch (err) {
+        await db.closeAsync().catch(() => void 0);
+        throw err;
       }
       const buildConnectionFromHandle = (dbHandle) => ({
         async exec(sql) {
@@ -68,12 +234,15 @@ function expoSqlite() {
           };
         },
         async transaction(fn) {
-          let result;
-          await dbHandle.withExclusiveTransactionAsync(async (txDb) => {
-            const txConn = buildConnectionFromHandle(txDb);
-            result = await fn(txConn);
-          });
-          return result;
+          await dbHandle.execAsync("BEGIN");
+          try {
+            const result = await fn(conn);
+            await dbHandle.execAsync("COMMIT");
+            return result;
+          } catch (err) {
+            await dbHandle.execAsync("ROLLBACK").catch(() => void 0);
+            throw err;
+          }
         },
         async loadExtension(extensionPath) {
           throw new ExtensionError(
@@ -86,7 +255,7 @@ function expoSqlite() {
         }
       });
       const conn = buildConnectionFromHandle(db);
-      return conn;
+      return rawKey === void 0 ? conn : reportEncryptedPageFailures(conn);
     }
   });
 }

package/dist/driver/node.d.ts

@@ -1,4 +1,4 @@
-import { S as SQLiteDriver } from '../types-DTmi7pXp.js';
+import { S as SQLiteDriver } from '../types-BWyv_N18.js';
 import '../query-types-5B02ixH0.js';
 
 /**