Add the fieldEncryptionKey init option: the same encryption hooks are attached
to every datastore of a persistent instance, and in-memory instances ignore it.
init() now waits for every datastore to load before repairing the database, and
rejects with an AggregateError naming the datastores that failed, instead of
hanging at the first query on a datastore that never became ready. A failed
init discards the half-loaded datastores, forces autoload on, and installs a
no-op onload handler so NeDB does not also raise an unhandled rejection. With a
key, the encrypted path table is derived up front so a broken schema fails init.
The decryption failure report is created per init() and reconciled after the
load (a .db file holds several lines per document, so failures on lines that a
later line replaced or deleted are dropped). It is exposed to a
createNedbDatabase wrapper as getFieldDecryptionFailures().
Tests run real NeDB datastores in a temp directory. Update the design doc to
match, and replace the crypto mock in the hook tests with a fake key.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Add the encrypted() mark and getEncryptedFieldPaths(), which derives the
encrypted field paths from a Zod model schema with an exhaustive walk over
the Zod node kinds (unknown kinds and unaddressable marks throw instead of
being skipped). getEncryptedFieldPathsByType() / getEncryptedFieldPathsForType()
build the path table for every model type.
Mark the sensitive fields of Request (and the schemas that share its
authentication: RequestGroup, WebSocketRequest, SocketIORequest, McpRequest),
CookieJar and GrpcRequest, and add temporary encryptedFields arrays for
ClientCertificate, CloudCredential, GitCredentials, OAuth2Token and
RequestVersion until they move to Zod.
The hook path walker supports arrays of arrays, and the read hook logs
failures after parsing without logging the line. Update the design doc to
match the implementation.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Value encrypt/decrypt with node:crypto AES-256-GCM, the enc:insomnia:v1:
value format and ciphertext well-formedness check, encrypted path walking,
and createFieldEncryptionHooks() for NeDB serialization hooks. The read hook
never throws and never drops a document; failed decryptions keep the original
value and are recorded in a failure report. The write hook never writes
plaintext for an encrypted field.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
