菜单
Use when opening a SQLite database with at-rest (transparent page-level) encryption — writing/reading an encrypted file, key handling, reopening, and constraints.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when storing large or growing binary content (files, uploads, blobs) in SQLite as streamed io.ReaderAt/io.WriterAt instead of loading whole []byte — the orm.LOB field + liteorm.org/dialect/sqlite/lob.
Use when working with liteorm's declarative orm front-end — model structs and tags, AutoMigrate, the orm.Repo, associations (Load/Attach), hooks, or soft delete.
Use when liteorm code behaves unexpectedly, or proactively before writing it, to avoid the common gotchas around loading, soft delete, types, and dialect-gated operators.
Use when migrating a gorm codebase to liteorm — running models on gorm tags as-is, rewriting them to native orm tags, and adjusting for what differs.
Use when adding vector (sqlite-vec), full-text (FTS5), or hybrid RRF search to liteorm's SQLite backend.
Use when capturing, applying, inverting, or concatenating SQLite changesets (the SESSION extension) for audit logs, one-way replication, or undo — the liteorm.org/dialect/sqlite/changeset package. SQLite backend only.
| name | encryption |
| description | Use when opening a SQLite database with at-rest (transparent page-level) encryption — writing/reading an encrypted file, key handling, reopening, and constraints. |
liteorm opens an encrypted SQLite database through gosqlite's transparent, page-level cipher. Encryption is an open-time concern, orthogonal to queries: once the database is open, query, orm, migrations, and search all work exactly as on an unencrypted database.
import "liteorm.org/dialect/sqlite"
db, err := sqlite.OpenEncrypted(path, key) // key is 32 bytes; default Adiantum cipher
// use db as a normal *liteorm.DB: orm.AutoMigrate, orm.NewRepo, query.Select, …
key is a 32-byte secret — source it from a KMS/secret store, never a literal. Losing it loses the data (no recovery).import (
gosqlite "gosqlite.org"
"gosqlite.org/vfs/crypto"
)
db, err := sqlite.OpenEncryptedConfig(
gosqlite.Config{Path: path, Pragmas: gosqlite.RecommendedPragmas()},
crypto.Options{Key: key, Cipher: crypto.Adiantum},
)
crypto.AESXTS (a 64-byte key) selects AES-XTS-256 for compliance regimes that mandate AES; the default crypto.Adiantum (32-byte key) is otherwise the better choice.crypto.DeriveKey(passphrase, salt, cipher) turns a passphrase + per-database salt into a correctly-sized key (Argon2id). The salt must be at least 16 bytes and unique per database; persist it alongside the database.:memory: is rejected (nothing to encrypt at rest).examples/encryption (write encrypted, verify ciphertext on disk, reopen, reject the wrong key).OpenEncrypted, OpenEncryptedConfig, OpenConfig).