メニュー
Use when opening a SQLite database with at-rest (transparent page-level) encryption — writing/reading an encrypted file, key handling, reopening, and constraints.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Use when storing large or growing binary content (files, uploads, blobs) in SQLite as streamed io.ReaderAt/io.WriterAt instead of loading whole []byte — the orm.LOB field + liteorm.org/dialect/sqlite/lob.
Use when working with liteorm's declarative orm front-end — model structs and tags, AutoMigrate, the orm.Repo, associations (Load/Attach), hooks, or soft delete.
Use when liteorm code behaves unexpectedly, or proactively before writing it, to avoid the common gotchas around loading, soft delete, types, and dialect-gated operators.
Use when migrating a gorm codebase to liteorm — running models on gorm tags as-is, rewriting them to native orm tags, and adjusting for what differs.
Use when adding vector (sqlite-vec), full-text (FTS5), or hybrid RRF search to liteorm's SQLite backend.
Use when capturing, applying, inverting, or concatenating SQLite changesets (the SESSION extension) for audit logs, one-way replication, or undo — the liteorm.org/dialect/sqlite/changeset package. SQLite backend only.
| name | encryption |
| description | Use when opening a SQLite database with at-rest (transparent page-level) encryption — writing/reading an encrypted file, key handling, reopening, and constraints. |
liteorm opens an encrypted SQLite database through gosqlite's transparent, page-level cipher. Encryption is an open-time concern, orthogonal to queries: once the database is open, query, orm, migrations, and search all work exactly as on an unencrypted database.
import "liteorm.org/dialect/sqlite"
db, err := sqlite.OpenEncrypted(path, key) // key is 32 bytes; default Adiantum cipher
// use db as a normal *liteorm.DB: orm.AutoMigrate, orm.NewRepo, query.Select, …
key is a 32-byte secret — source it from a KMS/secret store, never a literal. Losing it loses the data (no recovery).import (
gosqlite "gosqlite.org"
"gosqlite.org/vfs/crypto"
)
db, err := sqlite.OpenEncryptedConfig(
gosqlite.Config{Path: path, Pragmas: gosqlite.RecommendedPragmas()},
crypto.Options{Key: key, Cipher: crypto.Adiantum},
)
crypto.AESXTS (a 64-byte key) selects AES-XTS-256 for compliance regimes that mandate AES; the default crypto.Adiantum (32-byte key) is otherwise the better choice.crypto.DeriveKey(passphrase, salt, cipher) turns a passphrase + per-database salt into a correctly-sized key (Argon2id). The salt must be at least 16 bytes and unique per database; persist it alongside the database.:memory: is rejected (nothing to encrypt at rest).examples/encryption (write encrypted, verify ciphertext on disk, reopen, reject the wrong key).OpenEncrypted, OpenEncryptedConfig, OpenConfig).