BeatSQL — Zero-Trust Database EngineA next-generation zero-trust database language with native AES-256-GCM column encryption, blind searchable indexes, partially homomorphic arithmetic, Merkle tamper-evident ledger, AI vector search, and a built-in interactive learning academy. Installation Launch VS Code Quick Open ( Ctrl+P), paste the following command, and press enter.Copied to clipboard |
BeatSQL (BSQL)Zero-Trust Embedded Database Engine & Interactive Academy for Node.js & TypeScript BeatSQL is a next-generation embedded database language and engine that treats security as a first-class mathematical primitive. Every column is encrypted at rest using AES-256-GCM or ChaCha20-Poly1305. Search queries execute in $O(1)$ time over HMAC blind indexes without full-table decryption. Every write mutation appends to an immutable, cryptographically verifiable Merkle state ledger. Sensitive numerical columns support partially homomorphic arithmetic directly on ciphertexts. Quick Navigation
InstallationAs a Project Dependency (Library)As a Global CLI Tool(Or if developing locally: How to Run BeatSQL
Interactive REPL ShellStart the REPL shell by typing: Example Interactive SessionREPL Dot Commands Reference
CLI Command Reference1.
|
| Flag | Argument | Default | Description |
|---|---|---|---|
--db |
<name> |
beatsql_main |
Target database vault identifier |
--passphrase |
<string> |
Default key | Master passphrase for PBKDF2 key derivation |
--data-dir |
<path> |
./.beatdb_data |
Directory for encrypted database storage |
--role |
<role> |
SUPERADMIN |
Active RBAC role (SUPERADMIN, DEVELOPER, PUBLIC) |
--port |
<number> |
8080 / 7432 |
Port number for Studio or HTTP Server |
Programmatic API (Node.js / TypeScript)
TypeScript (ESM)
import { connect, createConnection, Database } from 'beatsql';
// Connect to local encrypted vault
const db = connect({
name: 'production_vault',
passphrase: process.env.DB_MASTER_PASSPHRASE || 'SecureSecretPassphrase!2026',
dataDir: './.beatdb_data',
defaultRole: 'SUPERADMIN'
});
// 1. Create zero-trust table
db.execute(`
CREATE TABLE IF NOT EXISTS patients (
id UUID PRIMARY KEY AUTO_GENERATE,
full_name VARCHAR(120) SEARCHABLE,
ssn VARCHAR(11) ENCRYPTED WITH 'CHACHA20_POLY1305'
MASKED FOR 'DEVELOPER' AS 'XXX-XX-####'
MASKED FOR 'PUBLIC' AS '[REDACTED]',
email VARCHAR(255) ENCRYPTED WITH 'AES_256_GCM' BLIND_INDEXED,
salary DECIMAL ENCRYPTED WITH 'PAILLIER_PHE' HOMOMORPHIC,
bio_vector VECTOR(768) AI_EMBEDDING,
created_at TIMESTAMP DEFAULT NOW() IMMUTABLE
);
`);
// 2. Insert record (auto-encrypted & blind-indexed)
db.execute(`
INSERT INTO patients (full_name, ssn, email, salary, bio_vector)
VALUES (
'Alice Walker',
'987-65-4321',
'alice@example.com',
145000.00,
[0.12, -0.45, 0.89, 0.22]
);
`);
// 3. O(1) Blind Search without full table decryption
const result = db.execute(`
FROM patients
|> WHERE email = 'alice@example.com'
|> SELECT id, full_name, email, ssn, salary;
`);
console.table(result.rows);
// 4. Role-based Dynamic Data Masking
const devView = db.execute(`SELECT full_name, ssn FROM patients;`, 'DEVELOPER');
console.log(devView.rows); // ssn: 'XXX-XX-4321'
// 5. Homomorphic addition over ciphertexts
const totalPayroll = db.execute(`SELECT HOMOMORPHIC_SUM(salary) AS total FROM patients;`);
console.log('Total Payroll:', totalPayroll.rows[0].total);
// 6. Merkle Ledger Verification
const proof = db.verifyIntegrity();
console.log('Merkle chain valid:', proof.integrityResult?.isValid);
CommonJS (CJS)
const { connect } = require('beatsql');
const db = connect({ name: 'myapp' });
db.execute(`CREATE TABLE IF NOT EXISTS users (id UUID PRIMARY KEY AUTO_GENERATE, email VARCHAR(255) ENCRYPTED WITH 'AES_256_GCM' BLIND_INDEXED);`);
db.execute(`INSERT INTO users (email) VALUES ('admin@example.com');`);
const res = db.execute(`SELECT * FROM users WHERE email = 'admin@example.com';`);
console.log(res.rows);
BSQL Language Syntax Reference
1. CREATE TABLE with Enclave Directives
CREATE TABLE IF NOT EXISTS accounts (
id UUID PRIMARY KEY AUTO_GENERATE,
account_no VARCHAR(30) SEARCHABLE,
email VARCHAR(255) ENCRYPTED WITH 'AES_256_GCM' BLIND_INDEXED,
card_pin TEXT ENCRYPTED WITH 'CHACHA20_POLY1305',
balance DECIMAL ENCRYPTED WITH 'PAILLIER_PHE' HOMOMORPHIC,
face_vec VECTOR(512) AI_EMBEDDING,
created_at TIMESTAMP DEFAULT NOW() IMMUTABLE
);
2. Stream Pipelines (|>)
FROM accounts
|> WHERE balance > 50000
|> SELECT account_no, email, balance
|> ORDER BY balance DESC
|> LIMIT 10;
3. Homomorphic Aggregation
-- Computes the sum directly over ciphertext without decrypting individual cells
SELECT HOMOMORPHIC_SUM(balance) AS total_balance FROM accounts;
4. AI Vector Similarity Search
-- Computes Cosine Similarity against high-dimensional AI embeddings
SELECT account_no, COSINE_SIMILARITY(face_vec, [0.05, 0.91, -0.32, 0.44]) AS score
FROM accounts
|> ORDER BY score DESC
|> LIMIT 5;
5. Merkle Integrity Verification
VERIFY INTEGRITY;
HTTP REST API
Start the API server:
beatsql server --port 7432
Execute Query (POST /query)
curl -X POST http://localhost:7432/query \
-H "Content-Type: application/json" \
-H "X-User-Role: SUPERADMIN" \
-d '{"sql": "FROM users |> SELECT id, username, role;"}'
Response:
{
"success": true,
"results": [
{
"statementType": "SELECT",
"rowCount": 1,
"rows": [{ "id": "4aa53f15-...", "username": "admin", "role": "ADMIN" }],
"executionTimeMs": 0.54
}
]
}
Server Health Check (GET /health)
curl http://localhost:7432/health
Dynamic Data Masking (RBAC)
Column masking rules are enforced at the database query engine level:
| Role | Query Result |
|---|---|
SUPERADMIN |
alice@example.com, $145,000.00, 987-65-4321 (Decrypted Plaintext) |
DEVELOPER |
al***@***.com, $***, XXX-XX-4321 (Partially Masked) |
PUBLIC |
[REDACTED], [REDACTED], [REDACTED] (Fully Redacted) |
Interactive Learning Academy
BeatSQL includes a built-in learning academy:
beatsql academy
- 500+ Progressive Lessons: From basic stream pipelines to zero-trust encryption enclaves.
- 200+ MySQL Lessons: Complete traditional relational SQL curriculum.
- 5 Multi-Language Capstone Projects: 100+ line real-world integration architectures with drivers for Python, Java, C++, and Rust.
- Mobile Reading Mode: Full-screen documentation view optimized for reading on phone and tablet screens without typing.
- GeeksforGeeks-Style Docs Engine: Syntax diagrams, time/space complexity analysis, common pitfalls, and enterprise use cases for every topic.
Security Architecture
| Security Layer | Cryptographic Primitive | Implementation |
|---|---|---|
| Master Key Derivation | PBKDF2-SHA512 | 100,000 iterations + 32-byte cryptographic salt |
| Key Encryption Key (KEK) | HKDF-SHA256 | Isolated per vault version |
| Data Encryption Key (DEK) | AES-256-GCM | 256-bit envelope key with authenticated tag validation |
| Column Encryption | AES-256-GCM / ChaCha20 | Authenticated cipher with AAD binding |
| Blind Indexing | HMAC-SHA256 | Column-isolated secret salt for zero-plaintext search |
| Homomorphic Arithmetic | Paillier Cryptosystem | Additive ciphertext arithmetic without private key disclosure |
| State Tamper Detection | Merkle DAG Hash Chain | SHA-256 block header chaining with mathematical proofs |
| Memory Security | Buffer Zeroization | Immediate wiping of key buffers after cryptographic operations |
License
Apache-2.0 © BeatSQL Foundation