What problem does it solve? Encrypting SQLite databases at rest in .NET with SQLCipher involves subtle traps: raw-key versus passphrase modes, PRAGMA rekey constraints with WAL, key-source selection that cannot live inside the encrypted store, and Dapper mapping failures over SQLite3MC. This Skill captures measured, verified guidance so these pitfalls are avoided instead of rediscovered. ## Core Features & Use Cases - Raw 256-bit key channel: Key the database with Password = "x'<64-hex>'" for no-KDF, brute-force-resistant encryption, including deriving keys from ed25519 SSH private keys via SHA-256 with a stable label. - Rekey and key-source architecture: Covers PRAGMA rekey legs (raw↔raw, passphrase→raw, plaintext→raw), the WAL-unsupported constraint, and a pluggable provider pattern with an unencrypted sidecar file for pre-open source selection. - Bitwarden bws integration and Dapper traps: Documents bws CLI usage, rotation traps, bootstrap ranking for vault tokens, and measured Dapper-over-SQLite3MC failures such as Int64 count columns and NULL-typed aggregates. - Use Case: A .NET service storing sensitive data in SQLite needs to switch its encryption key source from an environment variable to Bitwarden Secrets Manager without bricking existing databases; this Skill provides the rekey ordering, crash-recovery legs, and sidecar pattern to do it safely. ## Quick Start Ask the agent to set up SQLCipher encryption for a .NET SQLite database using a raw 256-bit key derived from an ed25519 SSH key, following this Skill's guidance.
