@vollcrypt/db-guard 0.1.2 → 0.9.0

package/dist/blind-index.js

@@ -15,10 +15,14 @@ function computeBlindIndex(value, rootSalt, columnName) {
     const columnNameBuf = Buffer.from(columnName, 'utf8');
     // 1. Derive column-specific key using HKDF-SHA256
     const derivedColumnKey = (0, security_1.deriveHkdf)(rootSalt, null, columnNameBuf, 32);
-    // 2. Compute the final blind index using the derived column key
-    const plaintextBuf = Buffer.from(plaintext, 'utf8');
-    const blindIndex = (0, security_1.deriveHkdf)(derivedColumnKey, null, plaintextBuf, 32);
-    // 3. RAM Security: Zeroize the derived key immediately (Anti-Core Dump)
-    derivedColumnKey.fill(0);
-    return blindIndex.toString('hex');
+    try {
+        // 2. Compute the final blind index using the derived column key
+        const plaintextBuf = Buffer.from(plaintext, 'utf8');
+        const blindIndex = (0, security_1.deriveHkdf)(derivedColumnKey, null, plaintextBuf, 32);
+        return blindIndex.toString('hex');
+    }
+    finally {
+        // 3. RAM Security: Zeroize the derived key immediately (Anti-Core Dump)
+        derivedColumnKey.fill(0);
+    }
 }

package/dist/drivers.js

@@ -5,37 +5,50 @@ exports.wrapOracleConnection = wrapOracleConnection;
 const prisma_js_1 = require("./prisma.js");
 const security_js_1 = require("./security.js");
 function getKeys(options) {
-    let keys;
+    let keys = {};
     let activeVersion;
     if (Buffer.isBuffer(options.key)) {
-        keys = { '1': options.key };
+        keys = { '1': Buffer.from(options.key) };
         activeVersion = '1';
     }
     else {
-        keys = options.key;
+        for (const [v, k] of Object.entries(options.key)) {
+            keys[v] = Buffer.from(k);
+        }
         activeVersion = options.activeKeyVersion || Object.keys(keys)[0];
     }
     return { keys, activeVersion };
 }
+function cleanIdentifier(identifier) {
+    if (!identifier)
+        return identifier;
+    let cleaned = identifier.trim();
+    if ((cleaned.startsWith('"') && cleaned.endsWith('"')) ||
+        (cleaned.startsWith('`') && cleaned.endsWith('`')) ||
+        (cleaned.startsWith('[') && cleaned.endsWith(']'))) {
+        cleaned = cleaned.slice(1, -1);
+    }
+    return cleaned.trim();
+}
 function getParamColumns(sql) {
     const sqlClean = sql.replace(/\s+/g, ' ').trim();
     // Match INSERT INTO table (col1, col2) ...
-    const insertMatch = sqlClean.match(/INSERT\s+INTO\s+(\w+)\s*\(([^)]+)\)/i);
+    const insertMatch = sqlClean.match(/INSERT\s+INTO\s+([a-zA-Z0-9_"`[\]]+)\s*\(([^)]+)\)/i);
     if (insertMatch) {
-        const table = insertMatch[1];
-        const columns = insertMatch[2].split(',').map(c => c.trim());
+        const table = cleanIdentifier(insertMatch[1]);
+        const columns = insertMatch[2].split(',').map(c => cleanIdentifier(c));
         return { table, columns };
     }
     // Match UPDATE table SET col1 = ?, col2 = ? ...
-    const updateMatch = sqlClean.match(/UPDATE\s+(\w+)\s+SET\s+([\s\S]+?)(?:\s+WHERE|$)/i);
+    const updateMatch = sqlClean.match(/UPDATE\s+([a-zA-Z0-9_"`[\]]+)\s+SET\s+([\s\S]+?)(?:\s+WHERE|$)/i);
     if (updateMatch) {
-        const table = updateMatch[1];
+        const table = cleanIdentifier(updateMatch[1]);
         const setParts = updateMatch[2].split(',');
         const columns = [];
         for (const part of setParts) {
-            const match = part.match(/(\w+)\s*=/);
+            const match = part.match(/([a-zA-Z0-9_"`[\]]+)\s*=/);
             if (match) {
-                columns.push(match[1]);
+                columns.push(cleanIdentifier(match[1]));
             }
         }
         return { table, columns };
@@ -96,6 +109,30 @@ function wrapSqliteDatabase(db, options) {
             const fieldsToEncrypt = options.entities[table] || [];
             if (fieldsToEncrypt.length === 0)
                 return params;
+            // Case 1: single array parameter, e.g., stmt.run([val1, val2])
+            if (params.length === 1 && Array.isArray(params[0])) {
+                const arrayParams = params[0].map((param, index) => {
+                    const colName = columns[index];
+                    if (colName && fieldsToEncrypt.includes(colName)) {
+                        return (0, prisma_js_1.encryptValue)(param, activeKey, activeVersion);
+                    }
+                    return param;
+                });
+                return [arrayParams];
+            }
+            // Case 2: single object parameter for named binds, e.g., stmt.run({ col1: val1 })
+            if (params.length === 1 && params[0] && typeof params[0] === 'object' && !Buffer.isBuffer(params[0])) {
+                const obj = { ...params[0] };
+                for (const [key, val] of Object.entries(obj)) {
+                    // Strip prefix character (@, :, $) if present
+                    const cleanKey = key.replace(/^[@:$]/, '');
+                    if (fieldsToEncrypt.includes(cleanKey)) {
+                        obj[key] = (0, prisma_js_1.encryptValue)(val, activeKey, activeVersion);
+                    }
+                }
+                return [obj];
+            }
+            // Case 3: multiple positional parameters, e.g., stmt.run(val1, val2)
             return params.map((param, index) => {
                 const colName = columns[index];
                 if (colName && fieldsToEncrypt.includes(colName)) {

package/dist/drizzle.js

@@ -11,11 +11,14 @@ function getKeys(options) {
     let keys;
     let activeVersion;
     if (Buffer.isBuffer(options.key)) {
-        keys = { '1': options.key };
+        keys = { '1': Buffer.from(options.key) };
         activeVersion = '1';
     }
     else {
-        keys = options.key;
+        keys = {};
+        for (const [v, k] of Object.entries(options.key)) {
+            keys[v] = Buffer.from(k);
+        }
         activeVersion = options.activeKeyVersion || Object.keys(keys)[0];
     }
     return { keys, activeVersion };

package/dist/kms.js

@@ -106,7 +106,14 @@ class Pkcs11KmsProvider {
             const pkcs11js = require('pkcs11js');
             const pkcs11 = new pkcs11js.PKCS11();
             pkcs11.load(this.config.libraryPath);
-            pkcs11.C_Initialize();
+            try {
+                pkcs11.C_Initialize();
+            }
+            catch (e) {
+                if (!e.message?.includes('CRYPTOKI_ALREADY_INITIALIZED') && e.code !== 0x00000191 && e.code !== 401) {
+                    throw e;
+                }
+            }
             const slots = pkcs11.C_GetSlotList(true);
             const slotIndex = this.config.slotId !== undefined ? this.config.slotId : 0;
             if (!slots || slots.length <= slotIndex) {
@@ -143,7 +150,6 @@ class Pkcs11KmsProvider {
             finally {
                 pkcs11.C_Logout(session);
                 pkcs11.C_CloseSession(session);
-                pkcs11.C_Finalize();
             }
         }
         catch (err) {

package/dist/mongoose.js

@@ -6,14 +6,16 @@ const blind_index_1 = require("./blind-index");
 const security_1 = require("./security");
 function mongooseDbGuard(schema, options) {
     const { fields } = options;
-    let keys;
+    let keys = {};
     let activeVersion;
     if (Buffer.isBuffer(options.key)) {
-        keys = { '1': options.key };
+        keys = { '1': Buffer.from(options.key) };
         activeVersion = '1';
     }
     else {
-        keys = options.key;
+        for (const [v, k] of Object.entries(options.key)) {
+            keys[v] = Buffer.from(k);
+        }
         activeVersion = options.activeKeyVersion || Object.keys(keys)[0];
     }
     (0, security_1.registerKeysForZeroization)(keys);
@@ -28,11 +30,15 @@ function mongooseDbGuard(schema, options) {
                 return { keys: { '1': bgKey }, activeKey: bgKey, activeVersion: '1' };
             }
         }
-        if (!tenantId || !options.multiTenant) {
+        if (options.multiTenant && !tenantId) {
+            throw new Error("Vollcrypt Security: tenantId must be provided in multi-tenant mode.");
+        }
+        if (!options.multiTenant) {
             return { keys, activeKey, activeVersion };
         }
+        const tId = tenantId;
         // Check Secure TTL Cache
-        const cachedActiveKey = (0, security_1.getCachedKey)(tenantId, activeVersion);
+        const cachedActiveKey = (0, security_1.getCachedKey)(tId, activeVersion);
         if (cachedActiveKey) {
             return { keys: { [activeVersion]: cachedActiveKey }, activeKey: cachedActiveKey, activeVersion };
         }
@@ -44,27 +50,31 @@ function mongooseDbGuard(schema, options) {
             }
             let tenantConfig;
             if (multiTenant.tenants) {
-                tenantConfig = multiTenant.tenants[tenantId];
+                tenantConfig = multiTenant.tenants[tId];
             }
             else if (multiTenant.getTenantConfig) {
-                tenantConfig = await multiTenant.getTenantConfig(tenantId);
+                tenantConfig = await multiTenant.getTenantConfig(tId);
             }
             if (!tenantConfig) {
-                throw new Error(`Vollcrypt Security: Configuration not found for tenantId "${tenantId}".`);
+                throw new Error(`Vollcrypt Security: Configuration not found for tenantId "${tId}".`);
             }
-            const resolvedTenantKeys = await (0, prisma_1.resolveKeys)({
+            const resolvedTenantKeysRaw = await (0, prisma_1.resolveKeys)({
                 ...options,
                 key: tenantConfig.key,
                 kms: tenantConfig.kms
             });
-            (0, security_1.registerKeysForZeroization)(resolvedTenantKeys);
+            const resolvedTenantKeys = {};
+            for (const [v, k] of Object.entries(resolvedTenantKeysRaw)) {
+                resolvedTenantKeys[v] = Buffer.from(k);
+            }
+            (0, security_1.registerKeysForZeroization)(resolvedTenantKeys, tId);
             const tActiveVersion = tenantConfig.kms?.activeKeyVersion || '1';
             const tActiveKey = resolvedTenantKeys[tActiveVersion];
             if (!tActiveKey) {
-                throw new Error(`Vollcrypt Security: Active key version "${tActiveVersion}" not found for tenantId "${tenantId}".`);
+                throw new Error(`Vollcrypt Security: Active key version "${tActiveVersion}" not found for tenantId "${tId}".`);
             }
             for (const [ver, keyBuf] of Object.entries(resolvedTenantKeys)) {
-                (0, security_1.setCachedKey)(tenantId, ver, keyBuf);
+                (0, security_1.setCachedKey)(tId, ver, keyBuf);
             }
             return { keys: resolvedTenantKeys, activeKey: tActiveKey, activeVersion: tActiveVersion };
         };

package/dist/prisma.js

@@ -65,6 +65,11 @@ async function resolveKeys(options) {
 function encryptValue(val, key, version) {
     if (val === null || val === undefined)
         return val;
+    const context = security_1.dbGuardContextStore.getStore();
+    const tId = context?.tenantId || 'global';
+    if (key.every(b => b === 0) || (0, security_1.getFailClosedStatus)(tId)) {
+        throw new Error(`Vollcrypt Security: Fail-Closed mode is active for tenant "${tId}". Encryption blocked.`);
+    }
     const plaintext = typeof val === 'string' ? val : JSON.stringify(val);
     const plaintextBuf = Buffer.from(plaintext, 'utf8');
     const encrypted = security_1.CRYPTO_ALGORITHMS['1'].encrypt(plaintextBuf, key);
@@ -85,6 +90,9 @@ function decryptValue(stored, keys) {
     if (!key) {
         throw new Error(`Decryption key version "${version}" not found in registered keys`);
     }
+    if (key.every(b => b === 0)) {
+        throw new Error(`Vollcrypt Security: Decryption blocked. Key version "${version}" is zeroized due to a Fail-Closed event.`);
+    }
     try {
         const encryptedBuf = Buffer.from(base64Data, 'base64');
         const decryptor = security_1.CRYPTO_ALGORITHMS[algoId];
@@ -169,10 +177,13 @@ const prismaDbGuard = (options, resolvedKeys) => {
     if (!keys) {
         if (options.key) {
             if (Buffer.isBuffer(options.key)) {
-                keys = { '1': options.key };
+                keys = { '1': Buffer.from(options.key) };
             }
             else {
-                keys = { ...options.key };
+                keys = {};
+                for (const [v, k] of Object.entries(options.key)) {
+                    keys[v] = Buffer.from(k);
+                }
             }
         }
         else if (options.kms || options.multiTenant) {
@@ -183,6 +194,11 @@ const prismaDbGuard = (options, resolvedKeys) => {
         }
     }
     if (keys) {
+        const clonedKeys = {};
+        for (const [v, k] of Object.entries(keys)) {
+            clonedKeys[v] = Buffer.from(k);
+        }
+        keys = clonedKeys;
         (0, security_1.registerKeysForZeroization)(keys);
     }
     const activeVersion = options.kms?.activeKeyVersion || '1';
@@ -194,41 +210,49 @@ const prismaDbGuard = (options, resolvedKeys) => {
                 return { keys: { '1': bgKey }, activeKey: bgKey, activeVersion: '1' };
             }
         }
-        if (!tenantId || !options.multiTenant) {
+        if (options.multiTenant && !tenantId) {
+            throw new Error("Vollcrypt Security: tenantId must be provided in multi-tenant mode.");
+        }
+        if (!options.multiTenant) {
             if (!keys || !activeKey) {
                 throw new Error("Vollcrypt Security: Global keys are not resolved.");
             }
             return { keys, activeKey, activeVersion };
         }
+        const tId = tenantId;
         // Check Secure TTL Cache
-        const cachedActiveKey = (0, security_1.getCachedKey)(tenantId, activeVersion);
+        const cachedActiveKey = (0, security_1.getCachedKey)(tId, activeVersion);
         if (cachedActiveKey) {
             return { keys: { [activeVersion]: cachedActiveKey }, activeKey: cachedActiveKey, activeVersion };
         }
         // Cache miss: resolve configuration
         let tenantConfig;
         if (options.multiTenant.tenants) {
-            tenantConfig = options.multiTenant.tenants[tenantId];
+            tenantConfig = options.multiTenant.tenants[tId];
         }
         else if (options.multiTenant.getTenantConfig) {
-            tenantConfig = await options.multiTenant.getTenantConfig(tenantId);
+            tenantConfig = await options.multiTenant.getTenantConfig(tId);
         }
         if (!tenantConfig) {
-            throw new Error(`Vollcrypt Security: Configuration not found for tenantId "${tenantId}".`);
+            throw new Error(`Vollcrypt Security: Configuration not found for tenantId "${tId}".`);
         }
-        const resolvedTenantKeys = await resolveKeys({
+        const resolvedTenantKeysRaw = await resolveKeys({
             ...options,
             key: tenantConfig.key,
             kms: tenantConfig.kms
         });
-        (0, security_1.registerKeysForZeroization)(resolvedTenantKeys);
+        const resolvedTenantKeys = {};
+        for (const [v, k] of Object.entries(resolvedTenantKeysRaw)) {
+            resolvedTenantKeys[v] = Buffer.from(k);
+        }
+        (0, security_1.registerKeysForZeroization)(resolvedTenantKeys, tId);
         const tActiveVersion = tenantConfig.kms?.activeKeyVersion || '1';
         const tActiveKey = resolvedTenantKeys[tActiveVersion];
         if (!tActiveKey) {
-            throw new Error(`Vollcrypt Security: Active key version "${tActiveVersion}" not found for tenantId "${tenantId}".`);
+            throw new Error(`Vollcrypt Security: Active key version "${tActiveVersion}" not found for tenantId "${tId}".`);
         }
         for (const [ver, keyBuf] of Object.entries(resolvedTenantKeys)) {
-            (0, security_1.setCachedKey)(tenantId, ver, keyBuf);
+            (0, security_1.setCachedKey)(tId, ver, keyBuf);
         }
         return { keys: resolvedTenantKeys, activeKey: tActiveKey, activeVersion: tActiveVersion };
     };

package/dist/provenance.json

@@ -10,7 +10,7 @@
     {
       "name": "dist/blind-index.js",
       "digest": {
-        "sha256": "fb28a7038cc818346aeb212ece2e5d4f1db4b72fd3ed9dda78a1a7f5744d7455"
+        "sha256": "83364c9d2a86d43f775f15537ee10bdfb8e06c852adceb5b3c7358bcfc412907"
       }
     },
     {
@@ -46,7 +46,7 @@
     {
       "name": "dist/drivers.js",
       "digest": {
-        "sha256": "44623a5cf632c22a41b8196b809a3c00d50276bde28c2fbde13d6f4bef3177ce"
+        "sha256": "4b418fae086ee440bd1c9fe99328c86923ab83467ecfb70fd9bb4ebee324e7f6"
       }
     },
     {
@@ -58,7 +58,7 @@
     {
       "name": "dist/drizzle.js",
       "digest": {
-        "sha256": "aad49d4c9dd41f2e44175465da6ae7f4a7ae35337ce12f7b3a87113ec0f25424"
+        "sha256": "c7b3210b0cca48f2b45c5b789cea13f55f14fc2c620e155d15987b9b8e434f4a"
       }
     },
     {
@@ -82,7 +82,7 @@
     {
       "name": "dist/kms.js",
       "digest": {
-        "sha256": "4b1a32b35545e2e7944ebba3f84272b7421ffedd1cc3c7eb569e1a6b2fcc4a02"
+        "sha256": "5c748722412b465c01cebd70e2242836f8f0c10f4303189548061f88d67eb4e4"
       }
     },
     {
@@ -94,7 +94,7 @@
     {
       "name": "dist/mongoose.js",
       "digest": {
-        "sha256": "42b2177825713fa1c618b80af6cf7a5d9f4055399c8e95b67018a0410add2a3f"
+        "sha256": "a2ff33065a1c52707bdc3b7b1b49e79c5878e7edc547e219779426d3376a8f5b"
       }
     },
     {
@@ -106,19 +106,19 @@
     {
       "name": "dist/prisma.js",
       "digest": {
-        "sha256": "e2b7a8fa24c120f59ab48ebb508a18c01e3e24245e04c197b08ad0e327a2d9a8"
+        "sha256": "dc5d221dfc6e2f790fd13abc1408e98e4d8a3a1f61ee876cc691963d5517395a"
       }
     },
     {
       "name": "dist/security.d.ts",
       "digest": {
-        "sha256": "554d9ba00f800470666ab66127079df889b8d717a9cf7b28ab252f0adad64304"
+        "sha256": "6fed9ab5d0e7d940fd8e0e65f3e0a6be6581fbeddb82a6ad9706397efa4ec2b2"
       }
     },
     {
       "name": "dist/security.js",
       "digest": {
-        "sha256": "5e907c9f5ec9fb93ef07f6360d7f8572aa5a1ea1c0a32d0b10496477d0b8fd33"
+        "sha256": "a7323f84eaa90838dcaba18f82cba8c48d6fdb708715786cae1c60bdaeb0050d"
       }
     },
     {
@@ -130,7 +130,7 @@
     {
       "name": "dist/typeorm.js",
       "digest": {
-        "sha256": "154827069a5496e043a9f69b3249bd5dddd62690783dfa8675d06d0f574ac76b"
+        "sha256": "d88d0aa0eff62675e732c5fd2f7c7885d601d5234729687aecbd5b1282e6a7bd"
       }
     }
   ],
@@ -141,7 +141,7 @@
       "externalParameters": {
         "packageJson": {
           "name": "@vollcrypt/db-guard",
-          "version": "0.1.2",
+          "version": "0.9.0",
           "scripts": {
             "build": "tsc && node scripts/generate-sbom.js",
             "test": "node --import tsx --test tests/*.test.ts"
@@ -170,6 +170,22 @@
           "uri": "pkg:npm/typeorm@0.3.0",
           "digest": {}
         },
+        {
+          "uri": "pkg:npm/@aws-sdk/client-kms@3.0.0",
+          "digest": {}
+        },
+        {
+          "uri": "pkg:npm/@google-cloud/kms@3.0.0",
+          "digest": {}
+        },
+        {
+          "uri": "pkg:npm/node-vault@0.9.0",
+          "digest": {}
+        },
+        {
+          "uri": "pkg:npm/pkcs11js@1.0.0",
+          "digest": {}
+        },
         {
           "uri": "pkg:rust/aes-gcm",
           "digest": {}
@@ -225,9 +241,9 @@
         "id": "https://vollcrypt.dev/builders/local-hermetic-env"
       },
       "metadata": {
-        "invocationId": "19095e456ee2a685d43df5cc56999080",
-        "startedOn": "2026-06-11T16:17:36.609Z",
-        "finishedOn": "2026-06-11T16:17:36.610Z"
+        "invocationId": "394b345f273d241cc656eb0efdf34f57",
+        "startedOn": "2026-07-08T14:31:16.765Z",
+        "finishedOn": "2026-07-08T14:31:16.767Z"
       }
     }
   }

package/dist/provenance.json.sig

@@ -1 +1 @@
-?NENc0�HӰ�@�S�t��J�ɽ<(:3�8O �7X�q-du�Y�^~՚�8�z� Dž�
+&�/�!/�[5_\4|�%�u����C>t}���Ɋ��kV[�3SI!�#�	K�%#�cP��

package/dist/sbom.json

@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:45a7c8f7-12f3-4e25-ab52-81be917b4646",
+  "serialNumber": "urn:uuid:dc37a041-235d-478b-85b1-b33d761679d6",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-11T16:17:36.609Z",
+    "timestamp": "2026-07-08T14:31:16.765Z",
     "tools": [
       {
         "vendor": "Vollcrypt",
@@ -13,10 +13,10 @@
       }
     ],
     "component": {
-      "bomRef": "pkg:npm/@vollcrypt/db-guard@0.1.2",
+      "bomRef": "pkg:npm/@vollcrypt/db-guard@0.9.0",
       "type": "library",
       "name": "@vollcrypt/db-guard",
-      "version": "0.1.2",
+      "version": "0.9.0",
       "description": "Database field-level encryption integrations for Vollcrypt (Prisma, Mongoose, Drizzle, TypeORM)",
       "hashes": [
         {
@@ -25,7 +25,7 @@
         },
         {
           "alg": "SHA-256",
-          "content": "fb28a7038cc818346aeb212ece2e5d4f1db4b72fd3ed9dda78a1a7f5744d7455"
+          "content": "83364c9d2a86d43f775f15537ee10bdfb8e06c852adceb5b3c7358bcfc412907"
         },
         {
           "alg": "SHA-256",
@@ -49,7 +49,7 @@
         },
         {
           "alg": "SHA-256",
-          "content": "44623a5cf632c22a41b8196b809a3c00d50276bde28c2fbde13d6f4bef3177ce"
+          "content": "4b418fae086ee440bd1c9fe99328c86923ab83467ecfb70fd9bb4ebee324e7f6"
         },
         {
           "alg": "SHA-256",
@@ -57,7 +57,7 @@
         },
         {
           "alg": "SHA-256",
-          "content": "aad49d4c9dd41f2e44175465da6ae7f4a7ae35337ce12f7b3a87113ec0f25424"
+          "content": "c7b3210b0cca48f2b45c5b789cea13f55f14fc2c620e155d15987b9b8e434f4a"
         },
         {
           "alg": "SHA-256",
@@ -73,7 +73,7 @@
         },
         {
           "alg": "SHA-256",
-          "content": "4b1a32b35545e2e7944ebba3f84272b7421ffedd1cc3c7eb569e1a6b2fcc4a02"
+          "content": "5c748722412b465c01cebd70e2242836f8f0c10f4303189548061f88d67eb4e4"
         },
         {
           "alg": "SHA-256",
@@ -81,7 +81,7 @@
         },
         {
           "alg": "SHA-256",
-          "content": "42b2177825713fa1c618b80af6cf7a5d9f4055399c8e95b67018a0410add2a3f"
+          "content": "a2ff33065a1c52707bdc3b7b1b49e79c5878e7edc547e219779426d3376a8f5b"
         },
         {
           "alg": "SHA-256",
@@ -89,15 +89,15 @@
         },
         {
           "alg": "SHA-256",
-          "content": "e2b7a8fa24c120f59ab48ebb508a18c01e3e24245e04c197b08ad0e327a2d9a8"
+          "content": "dc5d221dfc6e2f790fd13abc1408e98e4d8a3a1f61ee876cc691963d5517395a"
         },
         {
           "alg": "SHA-256",
-          "content": "554d9ba00f800470666ab66127079df889b8d717a9cf7b28ab252f0adad64304"
+          "content": "6fed9ab5d0e7d940fd8e0e65f3e0a6be6581fbeddb82a6ad9706397efa4ec2b2"
         },
         {
           "alg": "SHA-256",
-          "content": "5e907c9f5ec9fb93ef07f6360d7f8572aa5a1ea1c0a32d0b10496477d0b8fd33"
+          "content": "a7323f84eaa90838dcaba18f82cba8c48d6fdb708715786cae1c60bdaeb0050d"
         },
         {
           "alg": "SHA-256",
@@ -105,7 +105,7 @@
         },
         {
           "alg": "SHA-256",
-          "content": "154827069a5496e043a9f69b3249bd5dddd62690783dfa8675d06d0f574ac76b"
+          "content": "d88d0aa0eff62675e732c5fd2f7c7885d601d5234729687aecbd5b1282e6a7bd"
         }
       ]
     },
@@ -141,6 +141,30 @@
       "version": ">=0.3.0",
       "purl": "pkg:npm/typeorm@0.3.0"
     },
+    {
+      "type": "library",
+      "name": "@aws-sdk/client-kms",
+      "version": ">=3.0.0",
+      "purl": "pkg:npm/@aws-sdk/client-kms@3.0.0"
+    },
+    {
+      "type": "library",
+      "name": "@google-cloud/kms",
+      "version": ">=3.0.0",
+      "purl": "pkg:npm/@google-cloud/kms@3.0.0"
+    },
+    {
+      "type": "library",
+      "name": "node-vault",
+      "version": ">=0.9.0",
+      "purl": "pkg:npm/node-vault@0.9.0"
+    },
+    {
+      "type": "library",
+      "name": "pkcs11js",
+      "version": ">=1.0.0",
+      "purl": "pkg:npm/pkcs11js@1.0.0"
+    },
     {
       "type": "library",
       "name": "rust-crate:aes-gcm",

package/dist/sbom.json.sig

@@ -1,2 +1,2 @@
-��7gu
-�
+���ǂDm�`��Z>s=��"Y
&��ؐ7�#b"h��S��W��
+"�ޚ���*P?��

package/dist/security.d.ts

@@ -46,11 +46,11 @@ export declare function activateBreakGlass(signatures: {
     signature: string;
     timestamp: number;
 }[], emergencyBackupKey: Buffer): void;
-export declare function registerKeysForZeroization(keys: Record<string, Buffer>): void;
-export declare function triggerFailClosed(onFailClosedCallback?: () => void): void;
+export declare function registerKeysForZeroization(keys: Record<string, Buffer>, tenantId?: string): void;
+export declare function triggerFailClosed(onFailClosedCallback?: () => void, tenantId?: string): void;
 export declare function checkRateLimit(options?: RateLimiterOptions): void;
 export declare function checkPageSize(count: number, options?: RateLimiterOptions): 'ok' | 'warn' | 'bypass' | 'error';
-export declare function getFailClosedStatus(): boolean;
+export declare function getFailClosedStatus(tenantId?: string): boolean;
 export declare function resetFailClosedStatusForTesting(): void;
 export interface AuditLogEntry {
     timestamp: string;

package/dist/security.js

@@ -209,15 +209,14 @@ function maskValue(val, rule) {
             return '***';
     }
 }
-let decryptCount = 0;
-let windowStart = Date.now();
-let isFailClosed = false;
-const globalKeysToZeroize = [];
 // Ephemeral Master Key generated randomly on startup
 let ephemeralMasterKey = crypto.randomBytes(32);
+const tenantFailClosed = new Map();
+const tenantKeys = new Map();
+const tenantRateLimitStates = new Map();
 const secureKeyCache = new Map();
 function getCachedKey(tenantId, version) {
-    const cacheKey = `${tenantId || 'global'}:${version}`;
+    const cacheKey = JSON.stringify([tenantId || 'global', version]);
     const entry = secureKeyCache.get(cacheKey);
     if (!entry)
         return undefined;
@@ -234,7 +233,7 @@ function getCachedKey(tenantId, version) {
     }
 }
 function setCachedKey(tenantId, version, plaintextKey, ttlMs = 120000) {
-    const cacheKey = `${tenantId || 'global'}:${version}`;
+    const cacheKey = JSON.stringify([tenantId || 'global', version]);
     const existing = secureKeyCache.get(cacheKey);
     if (existing) {
         existing.wrappedKey.fill(0);
@@ -327,27 +326,58 @@ function activateBreakGlass(signatures, emergencyBackupKey) {
     isBreakGlassActiveFlag = true;
     logDecryption('SYSTEM', 'BREAK_GLASS_ACTIVATED', undefined);
 }
-function registerKeysForZeroization(keys) {
-    if (!globalKeysToZeroize.includes(keys)) {
-        globalKeysToZeroize.push(keys);
+function registerKeysForZeroization(keys, tenantId) {
+    const tId = tenantId || 'global';
+    let list = tenantKeys.get(tId);
+    if (!list) {
+        list = [];
+        tenantKeys.set(tId, list);
+    }
+    if (!list.includes(keys)) {
+        list.push(keys);
+    }
+}
+function triggerFailClosed(onFailClosedCallback, tenantId) {
+    const tId = tenantId || exports.dbGuardContextStore.getStore()?.tenantId || 'global';
+    tenantFailClosed.set(tId, true);
+    // Zeroize all registered keys immediately in memory for this tenant
+    const list = tenantKeys.get(tId);
+    if (list && list.length > 0) {
+        for (const keyMap of list) {
+            for (const key of Object.values(keyMap)) {
+                key.fill(0);
+            }
+        }
     }
-}
-function triggerFailClosed(onFailClosedCallback) {
-    isFailClosed = true;
-    // Zeroize all registered keys immediately in memory
-    for (const keyMap of globalKeysToZeroize) {
-        for (const key of Object.values(keyMap)) {
-            key.fill(0);
+    else {
+        // Fallback to global keys if no tenant-specific keys are registered
+        const globalList = tenantKeys.get('global');
+        if (globalList) {
+            for (const keyMap of globalList) {
+                for (const key of Object.values(keyMap)) {
+                    key.fill(0);
+                }
+            }
         }
     }
     // Zeroize cache and ephemeral master key
-    for (const entry of secureKeyCache.values()) {
-        entry.wrappedKey.fill(0);
+    for (const [cacheKey, entry] of secureKeyCache.entries()) {
+        try {
+            const parsed = JSON.parse(cacheKey);
+            if (Array.isArray(parsed) && parsed[0] === tId) {
+                entry.wrappedKey.fill(0);
+                secureKeyCache.delete(cacheKey);
+            }
+        }
+        catch {
+            // fallback
+        }
     }
-    secureKeyCache.clear();
-    ephemeralMasterKey.fill(0);
-    if (breakGlassEmergencyKey) {
-        breakGlassEmergencyKey.fill(0);
+    if (tId === 'global') {
+        ephemeralMasterKey.fill(0);
+        if (breakGlassEmergencyKey) {
+            breakGlassEmergencyKey.fill(0);
+        }
     }
     if (onFailClosedCallback) {
         try {
@@ -357,59 +387,45 @@ function triggerFailClosed(onFailClosedCallback) {
             // prevent user callback crash from blocking zeroization
         }
     }
-    throw new Error('Vollcrypt Security: Decryption rate limit exceeded. Fail-Closed mode triggered. Keys zeroized.');
+    throw new Error(`Vollcrypt Security: Decryption rate limit exceeded. Fail-Closed mode triggered for tenant "${tId}". Keys zeroized.`);
 }
 function checkRateLimit(options) {
-    if (isFailClosed) {
-        throw new Error('Vollcrypt Security: Fail-Closed mode is active. Decryption blocked.');
-    }
     const context = exports.dbGuardContextStore.getStore();
+    const tId = context?.tenantId || 'global';
+    if (tenantFailClosed.get(tId)) {
+        throw new Error(`Vollcrypt Security: Fail-Closed mode is active for tenant "${tId}". Decryption blocked.`);
+    }
     if (context?.bypassRateLimit) {
         return; // Rate limit check bypassed for this request context
     }
     const limit = context?.maxDecryptionsPerSecond || options?.maxDecryptionsPerSecond || 500;
     const mode = context?.rateLimiterMode || options?.mode || 'fail_closed';
     const now = Date.now();
-    if (context) {
-        if (context.windowStart === undefined || context.decryptCount === undefined) {
-            context.windowStart = now;
-            context.decryptCount = 0;
+    let state = tenantRateLimitStates.get(tId);
+    if (!state) {
+        state = { decryptCount: 0, windowStart: now };
+        tenantRateLimitStates.set(tId, state);
+    }
+    if (now - state.windowStart > 1000) {
+        state.decryptCount = 0;
+        state.windowStart = now;
+    }
+    state.decryptCount++;
+    if (state.decryptCount > limit) {
+        if (mode === 'fail_closed') {
+            triggerFailClosed(options?.onFailClosed, tId);
         }
-        if (now - context.windowStart > 1000) {
-            context.decryptCount = 0;
-            context.windowStart = now;
-        }
-        context.decryptCount++;
-        if (context.decryptCount > limit) {
-            if (mode === 'fail_closed') {
-                triggerFailClosed(options?.onFailClosed);
-            }
-            else if (mode === 'warn') {
-                console.warn(`Vollcrypt Warning: Decryption rate limit exceeded. ${context.decryptCount} decryptions in the current window (limit: ${limit}).`);
-            }
-        }
-    }
-    else {
-        if (now - windowStart > 1000) {
-            decryptCount = 0;
-            windowStart = now;
-        }
-        decryptCount++;
-        if (decryptCount > limit) {
-            if (mode === 'fail_closed') {
-                triggerFailClosed(options?.onFailClosed);
-            }
-            else if (mode === 'warn') {
-                console.warn(`Vollcrypt Warning: Decryption rate limit exceeded. ${decryptCount} decryptions in the current window (limit: ${limit}).`);
-            }
+        else if (mode === 'warn') {
+            console.warn(`Vollcrypt Warning: Decryption rate limit exceeded for tenant "${tId}". ${state.decryptCount} decryptions in the current window (limit: ${limit}).`);
         }
     }
 }
 function checkPageSize(count, options) {
-    if (isFailClosed) {
-        throw new Error('Vollcrypt Security: Fail-Closed mode is active. Decryption blocked.');
-    }
     const context = exports.dbGuardContextStore.getStore();
+    const tId = context?.tenantId || 'global';
+    if (tenantFailClosed.get(tId)) {
+        throw new Error(`Vollcrypt Security: Fail-Closed mode is active for tenant "${tId}". Decryption blocked.`);
+    }
     const maxPageSize = context?.maxPageSize !== undefined
         ? context.maxPageSize
         : (options?.maxPageSize !== undefined ? options.maxPageSize : 250);
@@ -430,17 +446,19 @@ function checkPageSize(count, options) {
     }
     return 'ok';
 }
-function getFailClosedStatus() {
-    return isFailClosed;
+function getFailClosedStatus(tenantId) {
+    const tId = tenantId || exports.dbGuardContextStore.getStore()?.tenantId || 'global';
+    return tenantFailClosed.get(tId) || false;
 }
 function resetFailClosedStatusForTesting() {
-    isFailClosed = false;
-    decryptCount = 0;
-    windowStart = Date.now();
+    tenantFailClosed.clear();
+    tenantRateLimitStates.clear();
+    tenantKeys.clear();
 }
 let lastLogHash = '0'.repeat(64);
 let auditLogPath;
 let onAuditLogCallback;
+let auditWriteQueue = Promise.resolve();
 function configureAuditLogger(options) {
     if (options?.path) {
         auditLogPath = options.path;
@@ -470,6 +488,7 @@ function resetAuditLoggerForTesting() {
     lastLogHash = '0'.repeat(64);
     auditLogPath = undefined;
     onAuditLogCallback = undefined;
+    auditWriteQueue = Promise.resolve();
 }
 function logDecryption(model, field, recordId) {
     const context = exports.dbGuardContextStore.getStore();
@@ -497,12 +516,11 @@ function logDecryption(model, field, recordId) {
         }
     }
     if (auditLogPath) {
-        try {
-            fs.appendFileSync(auditLogPath, JSON.stringify(fullEntry) + '\n', 'utf8');
-        }
-        catch {
-            // prevent filesystem errors from throwing
-        }
+        const line = JSON.stringify(fullEntry) + '\n';
+        const currentPath = auditLogPath;
+        auditWriteQueue = auditWriteQueue.then(() => {
+            return fs.promises.appendFile(currentPath, line, 'utf8').catch(() => { });
+        });
     }
 }
 function decryptWithSecurity(stored, decryptRawFn, modelName, fieldName, recordId, options) {
@@ -543,7 +561,8 @@ function decryptWithSecurity(stored, decryptRawFn, modelName, fieldName, recordI
     return result;
 }
 exports.VERSION_ALGORITHMS = {
-    '1': '1'
+    '1': '1',
+    '2': '1'
 };
 exports.CRYPTO_ALGORITHMS = {
     '1': {
@@ -557,12 +576,16 @@ function parseCiphertext(stored) {
     const content = stored.slice('VOLLVALT:'.length);
     if (content.startsWith('v')) {
         const colon = content.indexOf(':');
-        if (colon === -1)
-            return null;
+        if (colon === -1) {
+            throw new Error("Vollcrypt Security: Malformed ciphertext format.");
+        }
         const versionPart = content.slice(1, colon);
         const base64Part = content.slice(colon + 1);
-        const algoId = exports.VERSION_ALGORITHMS[versionPart] || '1';
+        const algoId = exports.VERSION_ALGORITHMS[versionPart];
+        if (!algoId) {
+            throw new Error(`Vollcrypt Security: Deprecated or unsupported encryption version "v${versionPart}".`);
+        }
         return { algoId, version: versionPart, base64Data: base64Part };
     }
-    return null;
+    throw new Error("Vollcrypt Security: Legacy unversioned ciphertexts are deprecated and unsupported.");
 }

package/dist/typeorm.js

@@ -43,11 +43,14 @@ function getKeys(options) {
     let keys;
     let activeVersion;
     if (Buffer.isBuffer(options.key)) {
-        keys = { '1': options.key };
+        keys = { '1': Buffer.from(options.key) };
         activeVersion = '1';
     }
     else {
-        keys = options.key;
+        keys = {};
+        for (const [v, k] of Object.entries(options.key)) {
+            keys[v] = Buffer.from(k);
+        }
         activeVersion = options.activeKeyVersion || Object.keys(keys)[0];
     }
     return { keys, activeVersion };

package/package.json

@@ -1,50 +1,80 @@
-{
-  "name": "@vollcrypt/db-guard",
-  "version": "0.1.2",
-  "description": "Database field-level encryption integrations for Vollcrypt (Prisma, Mongoose, Drizzle, TypeORM)",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "bin": {
-    "vollcrypt-db-guard": "dist/cli.js"
-  },
-  "files": [
-    "dist",
-    "README.md",
-    "compliance-config.json"
-  ],
-  "publishConfig": {
-    "access": "public"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/BeratVural/vollcrypt.git",
-    "directory": "db-guard/node"
-  },
-  "author": "Berat Vural <berat.vural.tr@gmail.com>",
-  "license": "GPL-3.0-only OR LicenseRef-Commercial",
-  "bugs": {
-    "url": "https://github.com/BeratVural/vollcrypt/issues"
-  },
-  "homepage": "https://github.com/BeratVural/vollcrypt/tree/main/db-guard/node#readme",
-  "scripts": {
-    "build": "tsc && node scripts/generate-sbom.js",
-    "test": "node --import tsx --test tests/*.test.ts"
-  },
-  "dependencies": {},
-  "peerDependencies": {
-    "@prisma/client": ">=4.7.0",
-    "mongoose": ">=6.0.0",
-    "drizzle-orm": ">=0.28.0",
-    "typeorm": ">=0.3.0"
-  },
-  "devDependencies": {
-    "@prisma/client": "^5.0.0",
-    "@types/node": "^20.11.0",
-    "mongoose": "^8.0.0",
-    "prisma": "^5.0.0",
-    "drizzle-orm": "^0.30.0",
-    "typeorm": "^0.3.20",
-    "tsx": "^4.7.0",
-    "typescript": "^5.5.2"
-  }
-}
+{
+  "name": "@vollcrypt/db-guard",
+  "version": "0.9.0",
+  "description": "Database field-level encryption integrations for Vollcrypt (Prisma, Mongoose, Drizzle, TypeORM)",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "vollcrypt-db-guard": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "compliance-config.json"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/BeratVural/vollcrypt.git",
+    "directory": "db-guard/node"
+  },
+  "author": "Berat Vural <berat.vural.tr@gmail.com>",
+  "license": "GPL-3.0-only OR LicenseRef-Commercial",
+  "bugs": {
+    "url": "https://github.com/BeratVural/vollcrypt/issues"
+  },
+  "homepage": "https://github.com/BeratVural/vollcrypt/tree/main/db-guard/node#readme",
+  "scripts": {
+    "build": "tsc && node scripts/generate-sbom.js",
+    "test": "node --import tsx --test tests/*.test.ts"
+  },
+  "dependencies": {},
+  "peerDependencies": {
+    "@prisma/client": ">=4.7.0",
+    "mongoose": ">=6.0.0",
+    "drizzle-orm": ">=0.28.0",
+    "typeorm": ">=0.3.0",
+    "@aws-sdk/client-kms": ">=3.0.0",
+    "@google-cloud/kms": ">=3.0.0",
+    "node-vault": ">=0.9.0",
+    "pkcs11js": ">=1.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@prisma/client": {
+      "optional": true
+    },
+    "mongoose": {
+      "optional": true
+    },
+    "drizzle-orm": {
+      "optional": true
+    },
+    "typeorm": {
+      "optional": true
+    },
+    "@aws-sdk/client-kms": {
+      "optional": true
+    },
+    "@google-cloud/kms": {
+      "optional": true
+    },
+    "node-vault": {
+      "optional": true
+    },
+    "pkcs11js": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@prisma/client": "^5.0.0",
+    "@types/node": "^20.11.0",
+    "mongoose": "^8.0.0",
+    "prisma": "^5.0.0",
+    "drizzle-orm": "^0.30.0",
+    "typeorm": "^0.3.20",
+    "tsx": "^4.7.0",
+    "typescript": "^5.5.2"
+  }
+}