Encryption protects sensitive data by transforming it with a key. Here, encryption and decryption run inside a libSQL database as sandboxed WebAssembly UDFs, avoiding unnecessary transfer of plaintext to other systems. section 5.3.1
The implementation must respect WebAssembly isolation and libSQL type compatibility: it cannot access network, filesystem, or system time, and uses supported primitive, string, or byte types. section 5.3.1















