feat: SQLCipher-encrypted local database migration (expo-sqlite + Drizzle)

[diegolmello]

Proposed changes

Long-lived integration branch for replacing WatermelonDB with expo-sqlite + Drizzle ORM, with every local database SQLCipher-encrypted from byte zero. Goal: offline forensic extraction of a powered-down or backed-up device yields no chat content or auth tokens.

Each sub-task lands here as its own PR (so each gets full native iOS/Android CI); this branch merges to develop only once the facade cutover is ready. The Drizzle schema, the driver adapter, the native key store, and the encrypted native readers are all additive and inert — nothing reads them until the cutover flips the database singleton from WatermelonDB to Drizzle and enables SQLCipher, so each piece can merge and revert independently.

Landed so far:

• Fail-closed DatabaseKeyStore TurboModule (feat: fail-closed DatabaseKeyStore TurboModule #7418) — per-database 32-byte key minted and stored in the iOS Keychain (App Group access group, accessible after first unlock, non-synchronizable) and the Android Keystore (hardware-backed where available). Durable writes, write-once semantics symmetric across both platforms, and 64-hex key-format validation before the key reaches SQLCipher.

Issue(s)

NATIVE-1272 — https://rocketchat.atlassian.net/browse/NATIVE-1272

How to test or reproduce

Nothing is wired into the running app yet — the key store is additive and inert until the cutover, so there is no user-visible change to exercise. Verify the merged sub-task in isolation:

• TZ=UTC pnpm test --testPathPattern='keyStore' — JS wrapper contract (mint, fail-closed read, malformed-key rejection).
• pnpm lint — eslint + tsc.

Native key-store behavior (durable write, write-once, Keychain/Keystore) has no JS-reachable harness; it is exercised by the iOS and Android builds on CI.

Types of changes

• New feature (non-breaking change which adds functionality)

Checklist

• Lint and unit tests pass locally with my changes
• I have added tests that prove my fix is effective or that my feature works (if applicable)

Further comments

Subsequent sub-tasks — driver adapter + key service, Drizzle schema, native reader rewrite, facade cutover, wipe-and-restore migration, performance parity gates, hardening, and rollout — target this branch as separate PRs. Delivery sequencing and dependency order are tracked on NATIVE-1272.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 87d03fe1-19ef-4c0c-986a-c8b08896fffb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}