chore: update FFI bindings, WASM API, examples, docs, and dependency versions

FFI (nodedb-lite-ffi):
- Add `handle_registry.rs`: opaque-handle registry used by C and JNI
  APIs to avoid raw pointer exposure.
- Add `jni_bridge/document.rs`: JNI document engine bridge.
- Update C header (`nodedb_lite.h`) and all FFI source files to match
  renamed storage types and new `Encryption` parameter on `open`.
- Update JNI bridge (`array`, `core`, `mod`) to use handle registry.

WASM (nodedb-lite-wasm):
- Update `lib.rs` to use `PagedbStorageMem` and the new
  `vector_search` signature with `allowed_ids` parameter.
- Update WASM README to reflect pagedb backend and new API surface.

Docs:
- README: update storage backend name from redb to pagedb throughout;
  update `vector_search` call sites to include the `allowed_ids`
  argument; add `nodedb-array` and `nodedb-physical` to dev-patch
  example.
- `docs/lite-support-matrix.md`: remove reference to internal
  protocol notes directory.
- `SECURITY.md`: minor copy cleanup.

Workspace:
- `Cargo.toml`: pin all nodedb-* dependency versions to `0.3`.

Examples:
- `live_sync.rs`, `load_test.rs`: update to new API signatures.

Author: farhan-syah

Cargo.toml

@@ -14,20 +14,20 @@ homepage = "https://nodedb.dev"
 [workspace.dependencies]
 # Internal
 nodedb-lite = { path = "nodedb-lite", version = "0.1.0", default-features = false }
-nodedb-types = { version = "*" }
-nodedb-client = { version = "*" }
-nodedb-codec = { version = "*" }
-nodedb-crdt = { version = "*" }
-nodedb-query = { version = "*" }
-nodedb-spatial = { version = "*" }
-nodedb-graph = { version = "*" }
-nodedb-vector = { version = "*" }
-nodedb-fts = { version = "*" }
-nodedb-strict = { version = "*" }
-nodedb-columnar = { version = "*" }
-nodedb-sql = { version = "*" }
-nodedb-array = { version = "*" }
-nodedb-physical = { version = "*" }
+nodedb-types = { version = "0.3" }
+nodedb-client = { version = "0.3" }
+nodedb-codec = { version = "0.3" }
+nodedb-crdt = { version = "0.3" }
+nodedb-query = { version = "0.3" }
+nodedb-spatial = { version = "0.3" }
+nodedb-graph = { version = "0.3" }
+nodedb-vector = { version = "0.3" }
+nodedb-fts = { version = "0.3" }
+nodedb-strict = { version = "0.3" }
+nodedb-columnar = { version = "0.3" }
+nodedb-sql = { version = "0.3" }
+nodedb-array = { version = "0.3" }
+nodedb-physical = { version = "0.3" }
 
 # Async
 tokio = { version = "1" }

README.md

@@ -51,7 +51,7 @@ NodeDB Lite replaces the usual SQLite + vector sidecar + ad hoc cache + custom s
 
 NodeDB Lite is in **public beta** as of **v0.1.0 (2026-05-23)**. All engines listed in [`docs/lite-support-matrix.md`](docs/lite-support-matrix.md) are feature-complete and covered by tests. The public surface — the `NodeDb` trait, the supported SQL plan variants, the C FFI ABI, and the WASM / npm bindings — is stable; clients written against 0.1.0 will keep working through 1.0.
 
-**v0.1.0 — Beta (today).** Use it for embedded workloads and for piloting Lite ↔ Origin sync. The public surface is stable; expect internal changes (redb layout, on-disk index format, sync-protocol internals) between minor releases. Patch and minor bumps will land as needed.
+**v0.1.0 — Beta (today).** Use it for embedded workloads and for piloting Lite ↔ Origin sync. The public surface is stable; expect internal changes (pagedb layout, on-disk index format, sync-protocol internals) between minor releases. Patch and minor bumps will land as needed.
 
 **v1.0.0 — Production-ready (target: 2026-07-23).** What 1.0 guarantees:
 
@@ -85,12 +85,12 @@ Pre-1.0 versions may change internals between releases — that work is critical
 
 | Platform                                  | Crate              | Backend                   | Size                                                               |
 | ----------------------------------------- | ------------------ | ------------------------- | ------------------------------------------------------------------ |
-| Linux                                     | `nodedb-lite`      | redb (file-backed)        | Native                                                             |
-| macOS                                     | `nodedb-lite`      | redb (file-backed)        | Native                                                             |
-| Windows                                   | `nodedb-lite`      | redb (file-backed)        | Native                                                             |
-| Android                                   | `nodedb-lite-ffi`  | redb + C FFI + Kotlin/JNI | Native                                                             |
-| iOS _(in progress — not in 0.1.0)_ | `nodedb-lite-ffi`  | redb + C FFI (cbindgen)   | Native _(requires macOS build environment — not yet built/tested)_ |
-| Browser                                   | `nodedb-lite-wasm` | redb (in-memory + OPFS)   | Target: < 10 MB                                                    |
+| Linux                                     | `nodedb-lite`      | pagedb (file-backed)        | Native                                                             |
+| macOS                                     | `nodedb-lite`      | pagedb (file-backed)        | Native                                                             |
+| Windows                                   | `nodedb-lite`      | pagedb (file-backed)        | Native                                                             |
+| Android                                   | `nodedb-lite-ffi`  | pagedb + C FFI + Kotlin/JNI | Native                                                             |
+| iOS _(in progress — not in 0.1.0)_ | `nodedb-lite-ffi`  | pagedb + C FFI (cbindgen)   | Native _(requires macOS build environment — not yet built/tested)_ |
+| Browser                                   | `nodedb-lite-wasm` | pagedb (in-memory + OPFS)   | Target: < 10 MB                                                    |
 
 ## Packages
 
@@ -107,11 +107,11 @@ npm install @nodedb/lite
 The Rust crate API in `0.1.0`:
 
 ```rust
-use nodedb_lite::{NodeDbLite, RedbStorage};
+use nodedb_lite::{NodeDbLite, PagedbStorageMem};
 use nodedb_client::NodeDb;
 
 // Open an in-memory database (peer_id uniquely identifies this device/replica):
-let storage = RedbStorage::open_in_memory()?;
+let storage = PagedbStorageMem::open_in_memory().await?;
 let db = NodeDbLite::open(storage, 1u64).await?;
 
 // Insert a document
@@ -125,7 +125,8 @@ db.document_put("notes", doc).await?;
 
 // Vector search
 db.vector_insert("articles", "a1", &embedding, None).await?;
-let results = db.vector_search("articles", &embedding, 10, None).await?;
+// vector_search(collection, query, k, filter, allowed_ids)
+let results = db.vector_search("articles", &embedding, 10, None, None).await?;
 
 // Graph traversal
 use nodedb_types::id::NodeId;
@@ -140,7 +141,7 @@ The `NodeDb` trait is identical across Lite and Origin. Application code doesn't
 ```rust
 // Works with both NodeDbLite (in-process) and NodeDbRemote (over network)
 async fn search(db: &dyn NodeDb, query: &[f32]) -> Result<Vec<Article>> {
-    db.vector_search("articles", query, 10).await
+    db.vector_search("articles", query, 10, None, None).await
 }
 ```
 
@@ -151,7 +152,7 @@ Moving from embedded to server is a connection string change, not a rewrite.
 Every write produces a delta. Deltas sync to Origin over WebSocket when online. Multiple devices converge regardless of operation order.
 
 ```
-Offline:    App writes locally -> Loro generates delta -> delta persisted to redb
+Offline:    App writes locally -> Loro generates delta -> delta persisted to pagedb
 Reconnect:  Device opens WebSocket -> sends vector clock + accumulated deltas
 Cloud:      Origin validates (RLS, UNIQUE, FK) -> merges -> pushes back missed changes
 Conflict:   Rejected deltas -> dead-letter queue + CompensationHint -> device handles
@@ -233,9 +234,15 @@ nodedb-vector = { path = "../nodedb/nodedb-vector" }
 nodedb-fts = { path = "../nodedb/nodedb-fts" }
 nodedb-strict = { path = "../nodedb/nodedb-strict" }
 nodedb-columnar = { path = "../nodedb/nodedb-columnar" }
+nodedb-array = { path = "../nodedb/nodedb-array" }
 nodedb-sql = { path = "../nodedb/nodedb-sql" }
+nodedb-physical = { path = "../nodedb/nodedb-physical" }
 ```
 
 ## License
 
-Apache-2.0. See [LICENSE](LICENSE) for details.
+**Apache-2.0** — see [LICENSE](LICENSE). NodeDB Lite is fully open source, with
+**no BSL anywhere in its dependency tree**: it builds only on NodeDB's Apache-2.0
+engine and foundation crates. The Business Source License applies _only_ to the
+[NodeDB Origin](https://github.com/NodeDB-Lab/nodedb) server — never to Lite.
+Embed it anywhere: apps, browsers (WASM/OPFS), mobile, desktop, edge.

SECURITY.md

@@ -2,17 +2,15 @@
 
 ## Supported versions
 
-| Version      | Supported |
-| ------------ | --------- |
-| 0.1.0-beta.x | Yes       |
+| Version | Supported |
+| ------- | --------- |
+| 0.1.x   | Yes       |
 
 ## Reporting a vulnerability
 
 Please **do not** open a public GitHub issue for security vulnerabilities.
 
-Report security issues by email to **security@nodedb.io**.
-
-Decision pending: a permanent security contact address will be confirmed before the stable 0.1.0 release. If you receive no acknowledgement within 72 hours, follow up by opening a GitHub issue marked `[security]` with no vulnerability details included.
+Report security issues by email to **security@nodedb.io**. If you receive no acknowledgement within 72 hours, follow up by opening a GitHub issue marked `[security]` with no vulnerability details included.
 
 ## Disclosure process
 

docs/lite-support-matrix.md

@@ -88,9 +88,8 @@ drive a `NodeDbLite` instance against it.
 | Spatial insert / delete sync| `SpatialInsert` (`0xAA`/`0xAB`), `SpatialDelete` (`0xAC`/`0xAD`)     | `tests/sync_interop_spatial.rs`          |
 | Timeseries insert sync      | Shares the `ColumnarInsert` (`0xA0`) frame                           | `tests/sync_interop_timeseries.rs`       |
 
-A clean public version of the sync wire contract (wire version,
-vector-clock encoding, frame catalogue) will land in `docs/` before 1.0;
-the internal protocol notes are maintained in the `resource/` directory.
+A documented public version of the sync wire contract (wire version,
+vector-clock encoding, frame catalogue) will land in `docs/` before 1.0.
 
 ---
 

nodedb-lite-ffi/include/nodedb_lite.h

@@ -38,25 +38,43 @@ typedef struct NodeDbNodeDbHandle NodeDbNodeDbHandle;
  * The caller must call `nodedb_close` to free the handle.
  *
  * # Safety
- * `path` must be a valid null-terminated UTF-8 string.
+ * - `path` must be a valid null-terminated UTF-8 string.
+ * - `passphrase` must be NULL or a valid null-terminated UTF-8 string.
+ *
+ * Encryption convention:
+ * - `passphrase` is NULL and `path` is `":memory:"` → `Encryption::Plaintext` (volatile data, safe).
+ * - `passphrase` is NULL and `path` is a real path → returns NULL (silent plaintext persistent
+ *   storage is refused; pass an empty string to opt out explicitly).
+ * - `passphrase` is `""` (empty string) → `Encryption::Plaintext` (explicit conscious opt-out).
+ * - `passphrase` is a non-empty string → `Encryption::passphrase(passphrase)`.
+ * - `passphrase` is non-NULL but invalid UTF-8 → returns NULL.
  */
-struct NodeDbNodeDbHandle *nodedb_open(const char *path, uint64_t peer_id);
+struct NodeDbNodeDbHandle *nodedb_open(const char *path,
+                                       uint64_t peer_id,
+                                       const char *passphrase);
 
 /**
  * Open or create a NodeDB-Lite database with an explicit memory budget.
  *
  * # Safety
- * `path` must be a valid null-terminated UTF-8 string.
+ * - `path` must be a valid null-terminated UTF-8 string.
+ * - `passphrase` must be NULL or a valid null-terminated UTF-8 string.
+ *
+ * See `nodedb_open` for the passphrase/encryption convention.
+ * `memory_mb` of 0 uses the default memory budget.
  */
 struct NodeDbNodeDbHandle *nodedb_open_with_config(const char *path,
                                                    uint64_t peer_id,
-                                                   uint64_t memory_mb);
+                                                   uint64_t memory_mb,
+                                                   const char *passphrase);
 
 /**
  * Close a NodeDB-Lite database and free the handle.
  *
  * # Safety
- * `handle` must be a valid pointer returned by `nodedb_open`, or NULL (no-op).
+ * `handle` must be a token returned by `nodedb_open`, or NULL/0 (no-op).
+ * The token is a `u64` id packed into a pointer-width integer; it is never
+ * dereferenced as a raw pointer.
  */
 void nodedb_close(struct NodeDbNodeDbHandle *handle);
 
@@ -357,7 +375,10 @@ int32_t nodedb_graph_shortest_path(struct NodeDbNodeDbHandle *handle,
  * Insert a vector into a collection.
  *
  * # Safety
- * All pointer parameters must be valid. `embedding` must point to `dim` floats.
+ * All pointer parameters must be valid. `embedding` must be non-null, properly
+ * aligned for `f32`, and valid for exactly `dim` elements for the entire duration
+ * of this call. No runtime length validation is possible; passing a mismatched
+ * `dim` or a dangling pointer is immediate undefined behaviour.
  */
 int32_t nodedb_vector_insert(struct NodeDbNodeDbHandle *handle,
                              const char *collection,
@@ -371,7 +392,10 @@ int32_t nodedb_vector_insert(struct NodeDbNodeDbHandle *handle,
  * `*out_json` is only written on success. The caller must free via `nodedb_free_string`.
  *
  * # Safety
- * `query` must point to `dim` valid floats. `out_json` must not be null.
+ * `query` must be non-null, properly aligned for `f32`, and valid for exactly `dim`
+ * elements for the entire duration of this call. No runtime length validation is
+ * possible; passing a mismatched `dim` or a dangling pointer is immediate undefined
+ * behaviour. `out_json` must not be null.
  */
 int32_t nodedb_vector_search(struct NodeDbNodeDbHandle *handle,
                              const char *collection,