deepbase-json 3.9.0 → 3.10.1

package/README.md

@@ -484,58 +484,63 @@ await db.set("a", "b", "circular", "self", await db.get("a", "b"));
 
 ## 🔒 Secure Storage with Encryption
 
-You can create encrypted storage by extending DeepBase with custom serialization:
+Use the built-in plugin to encrypt every value with AES-256-GCM before it
+reaches the driver. With `JsonDriver`, values stay encrypted both on disk and
+in its internal memory cache; no custom serialization or memory hooks are needed.
 
 ```javascript
-import CryptoJS from 'crypto-js';
 import DeepBase from 'deepbase';
+import { encryptedValues } from 'deepbase/plugins/encryption';
 import { JsonDriver } from 'deepbase-json';
 
-class DeepbaseSecure extends DeepBase {
-  constructor(opts) {
-    const encryptionKey = opts.encryptionKey;
-    delete opts.encryptionKey;
-
-    // Create JSON driver with encryption
-    const driver = new JsonDriver({
-      ...opts,
-      stringify: (obj) => {
-        const iv = CryptoJS.lib.WordArray.random(128 / 8);
-        const encrypted = CryptoJS.AES.encrypt(
-          JSON.stringify(obj), 
-          encryptionKey, 
-          { iv }
-        );
-        return iv.toString(CryptoJS.enc.Hex) + ':' + encrypted.toString();
-      },
-      parse: (encryptedData) => {
-        const [ivHex, encrypted] = encryptedData.split(':');
-        const iv = CryptoJS.enc.Hex.parse(ivHex);
-        const bytes = CryptoJS.AES.decrypt(encrypted, encryptionKey, { iv });
-        return JSON.parse(bytes.toString(CryptoJS.enc.Utf8));
-      }
-    });
-
-    super(driver);
-  }
+const encodedKey = process.env.DEEPBASE_ENCRYPTION_KEY;
+if (!encodedKey) {
+  throw new Error('DEEPBASE_ENCRYPTION_KEY is required');
 }
 
-// Create an encrypted database
-const secureDB = new DeepbaseSecure({
+const encryptionKey = Buffer.from(encodedKey, 'base64');
+const encryption = encryptedValues({
+  activeKeyId: 'primary',
+  keys: { primary: encryptionKey }
+});
+
+const driver = new JsonDriver({
   path: '/var/lib/myapp/data',
-  name: 'secure_db',
-  encryptionKey: 'your-secret-key-here'
+  name: 'secure_db'
 });
+const secureDB = new DeepBase(driver).use(encryption);
 
-await secureDB.connect();
+try {
+  await secureDB.set('config', {
+    service: 'my-app',
+    accessToken: 'example-token',
+    retries: 0
+  });
+
+  await secureDB.inc('config', 'retries', 1);
+  const config = await secureDB.get('config'); // Decrypted for the application
+} finally {
+  await secureDB.dispose({ clearMemory: true, releaseInstance: true });
+  encryptionKey.fill(0);
+}
+```
 
-// Use it like a regular DeepBase instance
-await secureDB.set("users", "admin", { password: "secret123" });
-const admin = await secureDB.get("users", "admin");
-console.log(admin); // { password: 'secret123' }
+Provide a base64-encoded, randomly generated 32-byte key through your
+application's secret manager or environment. The application reads it explicitly;
+the plugin requires a 32-byte `Buffer` or `Uint8Array` and never supplies a
+default key. Keep the key available under the same `keyId` to reopen the database.
 
-// But the file on disk is encrypted!
-```
+Object keys, array lengths, and empty containers remain visible. Plaintext
+exists while your application supplies or reads values, including inside
+`upd()` callbacks; the plugin does not cache decrypted values. Disposal clears
+the JSON driver's cache and the plugin's internal key copies.
+
+Authentication failures, malformed envelopes, and unknown key IDs throw.
+Existing plaintext data is encrypted when rewritten through the plugin;
+registering it does not migrate existing data automatically.
+
+See the [encryption plugin documentation](../core/docs/plugins/encryption.md)
+for additional keys and key rotation.
 
 ## 🛠️ Creating Custom Drivers
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepbase-json",
-  "version": "3.9.0",
+  "version": "3.10.1",
   "description": "⚡ DeepBase JSON - filesystem driver",
   "type": "module",
   "main": "src/index.cjs",
@@ -18,7 +18,10 @@
     "steno": "^0.4.4"
   },
   "peerDependencies": {
-    "deepbase": "^3.9.0"
+    "deepbase": "^3.10.1"
+  },
+  "scripts": {
+    "test": "mocha test/test.js"
   },
   "devDependencies": {
     "mocha": "^10.8.2"
@@ -42,8 +45,5 @@
   "bugs": {
     "url": "https://github.com/clasen/DeepBase/issues"
   },
-  "homepage": "https://github.com/clasen/DeepBase/tree/main/packages/driver-json",
-  "scripts": {
-    "test": "mocha test/test.js"
-  }
-}
+  "homepage": "https://github.com/clasen/DeepBase/tree/main/packages/driver-json"
+}