@graphorin/store-sqlite-encrypted 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @graphorin/store-sqlite-encrypted
 
+## 0.6.1
+
+### Patch Changes
+
+- [#142](https://github.com/o-stepper/graphorin/pull/142) [`436d6ca`](https://github.com/o-stepper/graphorin/commit/436d6ca5ebbd16df094e915682d3915c279a8430) Thanks [@o-stepper](https://github.com/o-stepper)! - Version constants and version-bearing strings now derive from each package's manifest at build time (`VERSION = pkg.version`; writer ids, client/server info, OTLP framework attributes, build-info metrics interpolate it). No behavioral change at the current version: the rendered strings are byte-identical. A release bump no longer edits source; the new `check-version-consistency` gate fails any reintroduced hardcoded framework version.
+
+- Updated dependencies [[`436d6ca`](https://github.com/o-stepper/graphorin/commit/436d6ca5ebbd16df094e915682d3915c279a8430)]:
+  - @graphorin/store-sqlite@0.6.1
+
 ## 0.6.0
 
 ### Patch Changes

package/README.md

@@ -7,14 +7,14 @@
 > encrypt / rekey / integrity-check runners that back the `graphorin storage`
 > CLI subcommand group.
 >
-> Project Graphorin · v0.6.0 · MIT License · © 2026 Oleksiy Stepurenko ·
+> Project Graphorin · v0.6.1 · MIT License · © 2026 Oleksiy Stepurenko ·
 > <https://github.com/o-stepper/graphorin>
 
 ---
 
 ## Status
 
-- **Published:** v0.6.0 (optional sub-pack)
+- **Published:** v0.6.1 (optional sub-pack)
 - **Default cipher:** `sqlcipher` (SQLCipher v4 compatible, `legacy=4`)
 - **Defaults:** encryption-at-rest is **OFF by default**. Opt in through
   `graphorin init --encrypted`.
@@ -159,4 +159,4 @@ MIT © 2026 Oleksiy Stepurenko
 
 ---
 
-**Project Graphorin** · v0.6.0 · MIT License · © 2026 Oleksiy Stepurenko · <https://github.com/o-stepper/graphorin>
+**Project Graphorin** · v0.6.1 · MIT License · © 2026 Oleksiy Stepurenko · <https://github.com/o-stepper/graphorin>

package/dist/index.d.ts

@@ -44,8 +44,7 @@ import { RekeyDatabaseOptions, RekeyDatabaseResult, rekeyDatabase } from "./reke
  *
  * @packageDocumentation
  */
-/** Canonical version constant. Mirrors the `package.json` version. */
-declare const VERSION = "0.6.0";
+declare const VERSION: string;
 //#endregion
 export { type CipherIntegrityCheckResult, DEFAULT_CIPHER, type EncryptDatabaseOptions, type EncryptDatabaseResult, EncryptedStorePeerMissingError, type EncryptionCipher, type RekeyDatabaseOptions, type RekeyDatabaseResult, VERSION, _resetCipherPeerCacheForTesting, _setCipherPeerForTesting, cipherIntegrityCheck, createEncryptedConnection, encodePassphraseForPragma, encryptDatabase, loadCipherPeer, pragmaSequenceForCipher, rekeyDatabase };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;;;;;AAuCA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAAa,OAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;;;;;AAyCA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAAa"}

package/dist/index.js

@@ -1,3 +1,4 @@
+import { version } from "./package.js";
 import { DEFAULT_CIPHER, encodePassphraseForPragma, pragmaSequenceForCipher } from "./cipher-config.js";
 import { EncryptedStorePeerMissingError, _resetCipherPeerCacheForTesting, _setCipherPeerForTesting, loadCipherPeer } from "./cipher-peer.js";
 import { createEncryptedConnection } from "./connection.js";
@@ -43,8 +44,8 @@ import { rekeyDatabase } from "./rekey.js";
 *
 * @packageDocumentation
 */
-/** Canonical version constant. Mirrors the `package.json` version. */
-const VERSION = "0.6.0";
+/** Canonical version constant, derived from `package.json` at build time. */
+const VERSION = version;
 
 //#endregion
 export { DEFAULT_CIPHER, EncryptedStorePeerMissingError, VERSION, _resetCipherPeerCacheForTesting, _setCipherPeerForTesting, cipherIntegrityCheck, createEncryptedConnection, encodePassphraseForPragma, encryptDatabase, loadCipherPeer, pragmaSequenceForCipher, rekeyDatabase };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["/**\n * @graphorin/store-sqlite-encrypted - optional encryption-at-rest\n * sub-pack for the Graphorin framework's default SQLite store.\n *\n * Installing this package pulls in the cipher peer driver\n * (`better-sqlite3-multiple-ciphers@^12.9.0`), which is a drop-in fork\n * of `better-sqlite3` that bundles the SQLite3MultipleCiphers\n * extension (SQLCipher v4 / wxSQLite3 / AES-256-CBC / AES-128-CBC /\n * RC4 cipher modes).\n *\n * The package exposes:\n *\n *  - {@link createEncryptedConnection} - convenience wrapper around\n *    `openConnection` from `@graphorin/store-sqlite/connection` that\n *    pre-loads the cipher peer.\n *  - {@link encryptDatabase} - converts an unencrypted SQLite file\n *    into an encrypted one. Backs `graphorin storage encrypt`.\n *  - {@link rekeyDatabase} - re-keys an already encrypted file. Backs\n *    `graphorin storage rekey`.\n *  - {@link cipherIntegrityCheck} - runs `PRAGMA cipher_integrity_\n *    check`. Used by the triggers daemon's daily verification cron\n *    and the `/v1/health/storage` endpoint.\n *  - {@link DEFAULT_CIPHER}, {@link pragmaSequenceForCipher},\n *    {@link encodePassphraseForPragma} - cipher-config helpers shared\n *    by the runners and consumable for advanced setups.\n *  - {@link loadCipherPeer} / {@link EncryptedStorePeerMissingError} -\n *    explicit peer-loader surface for callers that want to fail-fast\n *    at startup before opening the DB.\n *\n * Defaults follow ADR-030 / DEC-129:\n *  - Cipher: `'sqlcipher'` (SQLCipher v4 compatible, `legacy=4`).\n *  - Default OFF; opt-in through `graphorin init --encrypted`.\n *  - audit.db is ALWAYS encrypted regardless of this opt-in\n *    (DEC-124); this package satisfies that requirement too.\n *\n * @packageDocumentation\n */\n\n/** Canonical version constant. Mirrors the `package.json` version. */\nexport const VERSION = '0.6.0';\n\nexport {\n  DEFAULT_CIPHER,\n  type EncryptionCipher,\n  encodePassphraseForPragma,\n  pragmaSequenceForCipher,\n} from './cipher-config.js';\nexport {\n  _resetCipherPeerCacheForTesting,\n  _setCipherPeerForTesting,\n  EncryptedStorePeerMissingError,\n  loadCipherPeer,\n} from './cipher-peer.js';\nexport { createEncryptedConnection } from './connection.js';\nexport {\n  type EncryptDatabaseOptions,\n  type EncryptDatabaseResult,\n  encryptDatabase,\n} from './encrypt.js';\nexport { type CipherIntegrityCheckResult, cipherIntegrityCheck } from './integrity-check.js';\nexport {\n  type RekeyDatabaseOptions,\n  type RekeyDatabaseResult,\n  rekeyDatabase,\n} from './rekey.js';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,MAAa,UAAU"}
+{"version":3,"file":"index.js","names":["VERSION: string","pkg.version"],"sources":["../src/index.ts"],"sourcesContent":["/**\n * @graphorin/store-sqlite-encrypted - optional encryption-at-rest\n * sub-pack for the Graphorin framework's default SQLite store.\n *\n * Installing this package pulls in the cipher peer driver\n * (`better-sqlite3-multiple-ciphers@^12.9.0`), which is a drop-in fork\n * of `better-sqlite3` that bundles the SQLite3MultipleCiphers\n * extension (SQLCipher v4 / wxSQLite3 / AES-256-CBC / AES-128-CBC /\n * RC4 cipher modes).\n *\n * The package exposes:\n *\n *  - {@link createEncryptedConnection} - convenience wrapper around\n *    `openConnection` from `@graphorin/store-sqlite/connection` that\n *    pre-loads the cipher peer.\n *  - {@link encryptDatabase} - converts an unencrypted SQLite file\n *    into an encrypted one. Backs `graphorin storage encrypt`.\n *  - {@link rekeyDatabase} - re-keys an already encrypted file. Backs\n *    `graphorin storage rekey`.\n *  - {@link cipherIntegrityCheck} - runs `PRAGMA cipher_integrity_\n *    check`. Used by the triggers daemon's daily verification cron\n *    and the `/v1/health/storage` endpoint.\n *  - {@link DEFAULT_CIPHER}, {@link pragmaSequenceForCipher},\n *    {@link encodePassphraseForPragma} - cipher-config helpers shared\n *    by the runners and consumable for advanced setups.\n *  - {@link loadCipherPeer} / {@link EncryptedStorePeerMissingError} -\n *    explicit peer-loader surface for callers that want to fail-fast\n *    at startup before opening the DB.\n *\n * Defaults follow ADR-030 / DEC-129:\n *  - Cipher: `'sqlcipher'` (SQLCipher v4 compatible, `legacy=4`).\n *  - Default OFF; opt-in through `graphorin init --encrypted`.\n *  - audit.db is ALWAYS encrypted regardless of this opt-in\n *    (DEC-124); this package satisfies that requirement too.\n *\n * @packageDocumentation\n */\n\n/** Canonical version constant, derived from `package.json` at build time. */\nimport pkg from '../package.json' with { type: 'json' };\n\nexport const VERSION: string = pkg.version;\n\nexport {\n  DEFAULT_CIPHER,\n  type EncryptionCipher,\n  encodePassphraseForPragma,\n  pragmaSequenceForCipher,\n} from './cipher-config.js';\nexport {\n  _resetCipherPeerCacheForTesting,\n  _setCipherPeerForTesting,\n  EncryptedStorePeerMissingError,\n  loadCipherPeer,\n} from './cipher-peer.js';\nexport { createEncryptedConnection } from './connection.js';\nexport {\n  type EncryptDatabaseOptions,\n  type EncryptDatabaseResult,\n  encryptDatabase,\n} from './encrypt.js';\nexport { type CipherIntegrityCheckResult, cipherIntegrityCheck } from './integrity-check.js';\nexport {\n  type RekeyDatabaseOptions,\n  type RekeyDatabaseResult,\n  rekeyDatabase,\n} from './rekey.js';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,MAAaA,UAAkBC"}

package/dist/package.js

@@ -0,0 +1,6 @@
+//#region package.json
+var version = "0.6.1";
+
+//#endregion
+export { version };
+//# sourceMappingURL=package.js.map

package/dist/package.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package.js","names":[],"sources":["../package.json"],"sourcesContent":["{\n  \"name\": \"@graphorin/store-sqlite-encrypted\",\n  \"version\": \"0.6.1\",\n  \"description\": \"Optional encryption-at-rest sub-pack for the Graphorin framework's default SQLite store. Pulls in `better-sqlite3-multiple-ciphers@^12.9.0` (a drop-in fork of `better-sqlite3` that bundles SQLite3MultipleCiphers / SQLCipher v4), exposes the `encryptDatabase` / `rekeyDatabase` / `cipherIntegrityCheck` runners that back `graphorin storage encrypt` / `graphorin storage rekey` / `graphorin storage status`, and provides a `createEncryptedConnection` convenience wrapper around `@graphorin/store-sqlite/connection` for callers that bypass the CLI. Default cipher: `sqlcipher` (SQLCipher v4 compatible). Opt-in alternatives: `chacha20` (the peer default), `aes256cbc`, `aes128cbc`, `rc4`. Default OFF; opt-in through `graphorin init --encrypted` per ADR-030 / DEC-129. Created and maintained by Oleksiy Stepurenko.\",\n  \"license\": \"MIT\",\n  \"author\": \"Oleksiy Stepurenko\",\n  \"homepage\": \"https://github.com/o-stepper/graphorin/tree/main/packages/store-sqlite-encrypted\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"git+https://github.com/o-stepper/graphorin.git\",\n    \"directory\": \"packages/store-sqlite-encrypted\"\n  },\n  \"bugs\": {\n    \"url\": \"https://github.com/o-stepper/graphorin/issues\"\n  },\n  \"keywords\": [\n    \"graphorin\",\n    \"ai\",\n    \"agents\",\n    \"framework\",\n    \"sqlite\",\n    \"sqlcipher\",\n    \"encryption\",\n    \"encryption-at-rest\",\n    \"better-sqlite3-multiple-ciphers\",\n    \"rekey\",\n    \"vacuum-into\"\n  ],\n  \"type\": \"module\",\n  \"engines\": {\n    \"node\": \">=22.0.0\"\n  },\n  \"main\": \"./dist/index.js\",\n  \"module\": \"./dist/index.js\",\n  \"types\": \"./dist/index.d.ts\",\n  \"sideEffects\": false,\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\"\n    },\n    \"./package.json\": \"./package.json\"\n  },\n  \"files\": [\n    \"dist\",\n    \"README.md\",\n    \"CHANGELOG.md\",\n    \"LICENSE\"\n  ],\n  \"scripts\": {\n    \"build\": \"tsdown\",\n    \"typecheck\": \"tsc --noEmit && tsc -p tsconfig.tests.json\",\n    \"test\": \"vitest run\",\n    \"lint\": \"biome check .\",\n    \"clean\": \"rimraf dist .turbo *.tsbuildinfo\"\n  },\n  \"dependencies\": {\n    \"@graphorin/store-sqlite\": \"workspace:*\"\n  },\n  \"peerDependencies\": {\n    \"better-sqlite3-multiple-ciphers\": \"^12.9.0\"\n  },\n  \"peerDependenciesMeta\": {\n    \"better-sqlite3-multiple-ciphers\": {\n      \"optional\": false\n    }\n  },\n  \"publishConfig\": {\n    \"access\": \"public\",\n    \"provenance\": true\n  },\n  \"devDependencies\": {\n    \"@graphorin/security\": \"workspace:*\",\n    \"@types/better-sqlite3\": \"^7.6.13\"\n  }\n}\n"],"mappings":";cAEa"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@graphorin/store-sqlite-encrypted",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Optional encryption-at-rest sub-pack for the Graphorin framework's default SQLite store. Pulls in `better-sqlite3-multiple-ciphers@^12.9.0` (a drop-in fork of `better-sqlite3` that bundles SQLite3MultipleCiphers / SQLCipher v4), exposes the `encryptDatabase` / `rekeyDatabase` / `cipherIntegrityCheck` runners that back `graphorin storage encrypt` / `graphorin storage rekey` / `graphorin storage status`, and provides a `createEncryptedConnection` convenience wrapper around `@graphorin/store-sqlite/connection` for callers that bypass the CLI. Default cipher: `sqlcipher` (SQLCipher v4 compatible). Opt-in alternatives: `chacha20` (the peer default), `aes256cbc`, `aes128cbc`, `rc4`. Default OFF; opt-in through `graphorin init --encrypted` per ADR-030 / DEC-129. Created and maintained by Oleksiy Stepurenko.",
   "license": "MIT",
   "author": "Oleksiy Stepurenko",
@@ -48,7 +48,7 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@graphorin/store-sqlite": "0.6.0"
+    "@graphorin/store-sqlite": "0.6.1"
   },
   "peerDependencies": {
     "better-sqlite3-multiple-ciphers": "^12.9.0"
@@ -64,7 +64,7 @@
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",
-    "@graphorin/security": "0.6.0"
+    "@graphorin/security": "0.6.1"
   },
   "scripts": {
     "build": "tsdown",