@vollcrypt/db-guard 0.1.2 → 0.9.1

package/dist/blind-index.js

@@ -1,24 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.computeBlindIndex = computeBlindIndex;
-const security_1 = require("./security");
-/**
- * Computes a hardened, frequency-resistant blind index for a database field.
- *
- * Uses HKDF-SHA256 to derive a unique column key from the root salt,
- * preventing cross-column frequency analysis. Zeroizes intermediate keys immediately.
- */
-function computeBlindIndex(value, rootSalt, columnName) {
-    if (value === null || value === undefined)
-        return value;
-    const plaintext = typeof value === 'string' ? value : JSON.stringify(value);
-    const columnNameBuf = Buffer.from(columnName, 'utf8');
-    // 1. Derive column-specific key using HKDF-SHA256
-    const derivedColumnKey = (0, security_1.deriveHkdf)(rootSalt, null, columnNameBuf, 32);
-    // 2. Compute the final blind index using the derived column key
-    const plaintextBuf = Buffer.from(plaintext, 'utf8');
-    const blindIndex = (0, security_1.deriveHkdf)(derivedColumnKey, null, plaintextBuf, 32);
-    // 3. RAM Security: Zeroize the derived key immediately (Anti-Core Dump)
-    derivedColumnKey.fill(0);
-    return blindIndex.toString('hex');
-}
+exports.computeBlindIndex = void 0;
+var security_1 = require("./security");
+Object.defineProperty(exports, "computeBlindIndex", { enumerable: true, get: function () { return security_1.computeBlindIndex; } });

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const prisma_1 = require("./prisma");
+const security_1 = require("./security");
 function printProgressBar(current, total) {
     const percentage = Math.min(100, Math.floor((current / total) * 100));
     const barLength = 40;
@@ -138,7 +138,7 @@ async function migratePostgres(url, table, column, idCol, key, version, chunkSiz
             // 3. Encrypt and update each row
             for (const row of batchRes.rows) {
                 const rawVal = row[column];
-                const encryptedVal = (0, prisma_1.encryptValue)(rawVal, key, version);
+                const encryptedVal = (0, security_1.encryptValue)(rawVal, key, version);
                 await client.query(`UPDATE "${table}" SET "${column}" = $1 WHERE "${idCol}" = $2`, [encryptedVal, row[idCol]]);
                 processed++;
                 printProgressBar(processed, total);
@@ -190,7 +190,7 @@ async function migrateMongo(url, collectionName, field, idCol, key, version, chu
             }
             for (const doc of batch) {
                 const rawVal = doc[field];
-                const encryptedVal = (0, prisma_1.encryptValue)(rawVal, key, version);
+                const encryptedVal = (0, security_1.encryptValue)(rawVal, key, version);
                 await collection.updateOne({ [idCol]: doc[idCol] }, { $set: { [field]: encryptedVal } });
                 processed++;
                 printProgressBar(processed, total);

package/dist/drivers.js

@@ -2,40 +2,52 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.wrapSqliteDatabase = wrapSqliteDatabase;
 exports.wrapOracleConnection = wrapOracleConnection;
-const prisma_js_1 = require("./prisma.js");
 const security_js_1 = require("./security.js");
 function getKeys(options) {
-    let keys;
+    let keys = {};
     let activeVersion;
     if (Buffer.isBuffer(options.key)) {
-        keys = { '1': options.key };
+        keys = { '1': Buffer.from(options.key) };
         activeVersion = '1';
     }
     else {
-        keys = options.key;
+        for (const [v, k] of Object.entries(options.key)) {
+            keys[v] = Buffer.from(k);
+        }
         activeVersion = options.activeKeyVersion || Object.keys(keys)[0];
     }
     return { keys, activeVersion };
 }
+function cleanIdentifier(identifier) {
+    if (!identifier)
+        return identifier;
+    let cleaned = identifier.trim();
+    if ((cleaned.startsWith('"') && cleaned.endsWith('"')) ||
+        (cleaned.startsWith('`') && cleaned.endsWith('`')) ||
+        (cleaned.startsWith('[') && cleaned.endsWith(']'))) {
+        cleaned = cleaned.slice(1, -1);
+    }
+    return cleaned.trim();
+}
 function getParamColumns(sql) {
     const sqlClean = sql.replace(/\s+/g, ' ').trim();
     // Match INSERT INTO table (col1, col2) ...
-    const insertMatch = sqlClean.match(/INSERT\s+INTO\s+(\w+)\s*\(([^)]+)\)/i);
+    const insertMatch = sqlClean.match(/INSERT\s+INTO\s+([a-zA-Z0-9_"`[\]]+)\s*\(([^)]+)\)/i);
     if (insertMatch) {
-        const table = insertMatch[1];
-        const columns = insertMatch[2].split(',').map(c => c.trim());
+        const table = cleanIdentifier(insertMatch[1]);
+        const columns = insertMatch[2].split(',').map(c => cleanIdentifier(c));
         return { table, columns };
     }
     // Match UPDATE table SET col1 = ?, col2 = ? ...
-    const updateMatch = sqlClean.match(/UPDATE\s+(\w+)\s+SET\s+([\s\S]+?)(?:\s+WHERE|$)/i);
+    const updateMatch = sqlClean.match(/UPDATE\s+([a-zA-Z0-9_"`[\]]+)\s+SET\s+([\s\S]+?)(?:\s+WHERE|$)/i);
     if (updateMatch) {
-        const table = updateMatch[1];
+        const table = cleanIdentifier(updateMatch[1]);
         const setParts = updateMatch[2].split(',');
         const columns = [];
         for (const part of setParts) {
-            const match = part.match(/(\w+)\s*=/);
+            const match = part.match(/([a-zA-Z0-9_"`[\]]+)\s*=/);
             if (match) {
-                columns.push(match[1]);
+                columns.push(cleanIdentifier(match[1]));
             }
         }
         return { table, columns };
@@ -53,7 +65,7 @@ function decryptRow(row, table, keys, options) {
                 const val = row[i];
                 if (typeof val === 'string' && val.startsWith('VOLLVALT:')) {
                     try {
-                        cloned[i] = (0, security_js_1.decryptWithSecurity)(val, (v) => (0, prisma_js_1.decryptValue)(v, keys), table, `column_${i}`, undefined, options);
+                        cloned[i] = (0, security_js_1.decryptWithSecurity)(val, (v) => (0, security_js_1.decryptValue)(v, keys), table, `column_${i}`, undefined, options);
                     }
                     catch {
                         // Keep original on failure
@@ -67,7 +79,7 @@ function decryptRow(row, table, keys, options) {
             for (const [key, val] of Object.entries(row)) {
                 if (typeof val === 'string' && val.startsWith('VOLLVALT:')) {
                     try {
-                        cloned[key] = (0, security_js_1.decryptWithSecurity)(val, (v) => (0, prisma_js_1.decryptValue)(v, keys), table, key, row.id || row._id, options);
+                        cloned[key] = (0, security_js_1.decryptWithSecurity)(val, (v) => (0, security_js_1.decryptValue)(v, keys), table, key, row.id || row._id, options);
                     }
                     catch {
                         // Keep original on failure
@@ -96,10 +108,34 @@ function wrapSqliteDatabase(db, options) {
             const fieldsToEncrypt = options.entities[table] || [];
             if (fieldsToEncrypt.length === 0)
                 return params;
+            // Case 1: single array parameter, e.g., stmt.run([val1, val2])
+            if (params.length === 1 && Array.isArray(params[0])) {
+                const arrayParams = params[0].map((param, index) => {
+                    const colName = columns[index];
+                    if (colName && fieldsToEncrypt.includes(colName)) {
+                        return (0, security_js_1.encryptValue)(param, activeKey, activeVersion);
+                    }
+                    return param;
+                });
+                return [arrayParams];
+            }
+            // Case 2: single object parameter for named binds, e.g., stmt.run({ col1: val1 })
+            if (params.length === 1 && params[0] && typeof params[0] === 'object' && !Buffer.isBuffer(params[0])) {
+                const obj = { ...params[0] };
+                for (const [key, val] of Object.entries(obj)) {
+                    // Strip prefix character (@, :, $) if present
+                    const cleanKey = key.replace(/^[@:$]/, '');
+                    if (fieldsToEncrypt.includes(cleanKey)) {
+                        obj[key] = (0, security_js_1.encryptValue)(val, activeKey, activeVersion);
+                    }
+                }
+                return [obj];
+            }
+            // Case 3: multiple positional parameters, e.g., stmt.run(val1, val2)
             return params.map((param, index) => {
                 const colName = columns[index];
                 if (colName && fieldsToEncrypt.includes(colName)) {
-                    return (0, prisma_js_1.encryptValue)(param, activeKey, activeVersion);
+                    return (0, security_js_1.encryptValue)(param, activeKey, activeVersion);
                 }
                 return param;
             });
@@ -155,7 +191,7 @@ function wrapOracleConnection(connection, options) {
                     processedBinds = bindParams.map((param, index) => {
                         const colName = columns[index];
                         if (colName && fieldsToEncrypt.includes(colName)) {
-                            return (0, prisma_js_1.encryptValue)(param, activeKey, activeVersion);
+                            return (0, security_js_1.encryptValue)(param, activeKey, activeVersion);
                         }
                         return param;
                     });
@@ -164,7 +200,7 @@ function wrapOracleConnection(connection, options) {
                     processedBinds = { ...bindParams };
                     for (const field of fieldsToEncrypt) {
                         if (processedBinds[field] !== undefined && processedBinds[field] !== null) {
-                            processedBinds[field] = (0, prisma_js_1.encryptValue)(processedBinds[field], activeKey, activeVersion);
+                            processedBinds[field] = (0, security_js_1.encryptValue)(processedBinds[field], activeKey, activeVersion);
                         }
                     }
                 }

package/dist/drizzle.js

@@ -1,26 +1,27 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createDrizzleGuard = void 0;
-const pg_core_1 = require("drizzle-orm/pg-core");
-const mysql_core_1 = require("drizzle-orm/mysql-core");
-const sqlite_core_1 = require("drizzle-orm/sqlite-core");
-const prisma_1 = require("./prisma");
-const blind_index_1 = require("./blind-index");
 const security_1 = require("./security");
 function getKeys(options) {
     let keys;
     let activeVersion;
     if (Buffer.isBuffer(options.key)) {
-        keys = { '1': options.key };
+        keys = { '1': Buffer.from(options.key) };
         activeVersion = '1';
     }
     else {
-        keys = options.key;
+        keys = {};
+        for (const [v, k] of Object.entries(options.key)) {
+            keys[v] = Buffer.from(k);
+        }
         activeVersion = options.activeKeyVersion || Object.keys(keys)[0];
     }
     return { keys, activeVersion };
 }
 const createDrizzleGuard = (options) => {
+    const pgCustomType = require('drizzle-orm/pg-core').customType;
+    const mysqlCustomType = require('drizzle-orm/mysql-core').customType;
+    const sqliteCustomType = require('drizzle-orm/sqlite-core').customType;
     const { keys, activeVersion } = getKeys(options);
     const activeKey = keys[activeVersion];
     if (!activeKey) {
@@ -29,49 +30,49 @@ const createDrizzleGuard = (options) => {
     (0, security_1.registerKeysForZeroization)(keys);
     const rootSalt = options.blindIndexes?.rootSalt;
     return {
-        pgText: (name, columnPath) => (0, pg_core_1.customType)({
+        pgText: (name, columnPath) => pgCustomType({
             dataType() {
                 return 'text';
             },
             toDriver(value) {
-                return (0, prisma_1.encryptValue)(value, activeKey, activeVersion);
+                return (0, security_1.encryptValue)(value, activeKey, activeVersion);
             },
             fromDriver(value) {
                 const parts = columnPath?.split('.') || [name];
                 const mName = parts[0] || 'Model';
                 const fName = parts[1] || name;
-                return (0, security_1.decryptWithSecurity)(value, (val) => (0, prisma_1.decryptValue)(val, keys), mName, fName, undefined, options);
+                return (0, security_1.decryptWithSecurity)(value, (val) => (0, security_1.decryptValue)(val, keys), mName, fName, undefined, options);
             }
         })(name),
-        mysqlText: (name, columnPath) => (0, mysql_core_1.customType)({
+        mysqlText: (name, columnPath) => mysqlCustomType({
             dataType() {
                 return 'text';
             },
             toDriver(value) {
-                return (0, prisma_1.encryptValue)(value, activeKey, activeVersion);
+                return (0, security_1.encryptValue)(value, activeKey, activeVersion);
             },
             fromDriver(value) {
                 const parts = columnPath?.split('.') || [name];
                 const mName = parts[0] || 'Model';
                 const fName = parts[1] || name;
-                return (0, security_1.decryptWithSecurity)(value, (val) => (0, prisma_1.decryptValue)(val, keys), mName, fName, undefined, options);
+                return (0, security_1.decryptWithSecurity)(value, (val) => (0, security_1.decryptValue)(val, keys), mName, fName, undefined, options);
             }
         })(name),
-        sqliteText: (name, columnPath) => (0, sqlite_core_1.customType)({
+        sqliteText: (name, columnPath) => sqliteCustomType({
             dataType() {
                 return 'text';
             },
             toDriver(value) {
-                return (0, prisma_1.encryptValue)(value, activeKey, activeVersion);
+                return (0, security_1.encryptValue)(value, activeKey, activeVersion);
             },
             fromDriver(value) {
                 const parts = columnPath?.split('.') || [name];
                 const mName = parts[0] || 'Model';
                 const fName = parts[1] || name;
-                return (0, security_1.decryptWithSecurity)(value, (val) => (0, prisma_1.decryptValue)(val, keys), mName, fName, undefined, options);
+                return (0, security_1.decryptWithSecurity)(value, (val) => (0, security_1.decryptValue)(val, keys), mName, fName, undefined, options);
             }
         })(name),
-        pgBlindIndex: (name, columnName) => (0, pg_core_1.customType)({
+        pgBlindIndex: (name, columnName) => pgCustomType({
             dataType() {
                 return 'text';
             },
@@ -79,13 +80,13 @@ const createDrizzleGuard = (options) => {
                 if (!rootSalt) {
                     throw new Error('Blind index root salt is not configured in Drizzle guard options.');
                 }
-                return (0, blind_index_1.computeBlindIndex)(value, rootSalt, columnName);
+                return (0, security_1.computeBlindIndex)(value, rootSalt, columnName);
             },
             fromDriver(value) {
                 return value;
             }
         })(name),
-        mysqlBlindIndex: (name, columnName) => (0, mysql_core_1.customType)({
+        mysqlBlindIndex: (name, columnName) => mysqlCustomType({
             dataType() {
                 return 'text';
             },
@@ -93,13 +94,13 @@ const createDrizzleGuard = (options) => {
                 if (!rootSalt) {
                     throw new Error('Blind index root salt is not configured in Drizzle guard options.');
                 }
-                return (0, blind_index_1.computeBlindIndex)(value, rootSalt, columnName);
+                return (0, security_1.computeBlindIndex)(value, rootSalt, columnName);
             },
             fromDriver(value) {
                 return value;
             }
         })(name),
-        sqliteBlindIndex: (name, columnName) => (0, sqlite_core_1.customType)({
+        sqliteBlindIndex: (name, columnName) => sqliteCustomType({
             dataType() {
                 return 'text';
             },
@@ -107,7 +108,7 @@ const createDrizzleGuard = (options) => {
                 if (!rootSalt) {
                     throw new Error('Blind index root salt is not configured in Drizzle guard options.');
                 }
-                return (0, blind_index_1.computeBlindIndex)(value, rootSalt, columnName);
+                return (0, security_1.computeBlindIndex)(value, rootSalt, columnName);
             },
             fromDriver(value) {
                 return value;

package/dist/index.d.ts

@@ -1,9 +1,5 @@
-export { prismaDbGuard, PrismaDbGuardOptions, encryptValue, decryptValue, resolveKeys } from './prisma';
-export { mongooseDbGuard, MongooseDbGuardOptions } from './mongoose';
-export { createDrizzleGuard } from './drizzle';
-export { createTypeOrmSubscriber } from './typeorm';
 export { wrapSqliteDatabase, wrapOracleConnection, DbGuardDriverOptions } from './drivers';
-export { KmsProvider, AwsKmsProvider, GcpKmsProvider, VaultKmsProvider, unwrapDekLocal, Pkcs11KmsProvider } from './kms';
+export { KmsProvider, AwsKmsProvider, GcpKmsProvider, VaultKmsProvider, unwrapDekLocal, Pkcs11KmsProvider, resolveKeys, DbGuardKeysOptions } from './kms';
 export { computeBlindIndex } from './blind-index';
-export { dbGuardContextStore, configureAuditLogger, decryptWithSecurity, checkRateLimit, checkPageSize, resetFailClosedStatusForTesting, resetAuditLoggerForTesting, getCachedKey, setCachedKey, resetSecureKeyCacheForTesting, configureBreakGlass, deactivateBreakGlass, isBreakGlassActive, getBreakGlassKey, activateBreakGlass, parseCiphertext, CRYPTO_ALGORITHMS, VERSION_ALGORITHMS, maskValue } from './security';
+export { dbGuardContextStore, configureAuditLogger, decryptWithSecurity, checkRateLimit, checkPageSize, resetFailClosedStatusForTesting, resetAuditLoggerForTesting, getCachedKey, setCachedKey, resetSecureKeyCacheForTesting, configureBreakGlass, deactivateBreakGlass, isBreakGlassActive, getBreakGlassKey, activateBreakGlass, parseCiphertext, CRYPTO_ALGORITHMS, VERSION_ALGORITHMS, maskValue, encryptValue, decryptValue } from './security';
 export { auditConfiguration, generateComplianceHtmlReport, ComplianceAuditInput, ComplianceScorecard } from './compliance';

package/dist/index.js

@@ -1,17 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateComplianceHtmlReport = exports.auditConfiguration = exports.maskValue = exports.VERSION_ALGORITHMS = exports.CRYPTO_ALGORITHMS = exports.parseCiphertext = exports.activateBreakGlass = exports.getBreakGlassKey = exports.isBreakGlassActive = exports.deactivateBreakGlass = exports.configureBreakGlass = exports.resetSecureKeyCacheForTesting = exports.setCachedKey = exports.getCachedKey = exports.resetAuditLoggerForTesting = exports.resetFailClosedStatusForTesting = exports.checkPageSize = exports.checkRateLimit = exports.decryptWithSecurity = exports.configureAuditLogger = exports.dbGuardContextStore = exports.computeBlindIndex = exports.Pkcs11KmsProvider = exports.unwrapDekLocal = exports.VaultKmsProvider = exports.GcpKmsProvider = exports.AwsKmsProvider = exports.wrapOracleConnection = exports.wrapSqliteDatabase = exports.createTypeOrmSubscriber = exports.createDrizzleGuard = exports.mongooseDbGuard = exports.resolveKeys = exports.decryptValue = exports.encryptValue = exports.prismaDbGuard = void 0;
-var prisma_1 = require("./prisma");
-Object.defineProperty(exports, "prismaDbGuard", { enumerable: true, get: function () { return prisma_1.prismaDbGuard; } });
-Object.defineProperty(exports, "encryptValue", { enumerable: true, get: function () { return prisma_1.encryptValue; } });
-Object.defineProperty(exports, "decryptValue", { enumerable: true, get: function () { return prisma_1.decryptValue; } });
-Object.defineProperty(exports, "resolveKeys", { enumerable: true, get: function () { return prisma_1.resolveKeys; } });
-var mongoose_1 = require("./mongoose");
-Object.defineProperty(exports, "mongooseDbGuard", { enumerable: true, get: function () { return mongoose_1.mongooseDbGuard; } });
-var drizzle_1 = require("./drizzle");
-Object.defineProperty(exports, "createDrizzleGuard", { enumerable: true, get: function () { return drizzle_1.createDrizzleGuard; } });
-var typeorm_1 = require("./typeorm");
-Object.defineProperty(exports, "createTypeOrmSubscriber", { enumerable: true, get: function () { return typeorm_1.createTypeOrmSubscriber; } });
+exports.generateComplianceHtmlReport = exports.auditConfiguration = exports.decryptValue = exports.encryptValue = exports.maskValue = exports.VERSION_ALGORITHMS = exports.CRYPTO_ALGORITHMS = exports.parseCiphertext = exports.activateBreakGlass = exports.getBreakGlassKey = exports.isBreakGlassActive = exports.deactivateBreakGlass = exports.configureBreakGlass = exports.resetSecureKeyCacheForTesting = exports.setCachedKey = exports.getCachedKey = exports.resetAuditLoggerForTesting = exports.resetFailClosedStatusForTesting = exports.checkPageSize = exports.checkRateLimit = exports.decryptWithSecurity = exports.configureAuditLogger = exports.dbGuardContextStore = exports.computeBlindIndex = exports.resolveKeys = exports.Pkcs11KmsProvider = exports.unwrapDekLocal = exports.VaultKmsProvider = exports.GcpKmsProvider = exports.AwsKmsProvider = exports.wrapOracleConnection = exports.wrapSqliteDatabase = void 0;
 var drivers_1 = require("./drivers");
 Object.defineProperty(exports, "wrapSqliteDatabase", { enumerable: true, get: function () { return drivers_1.wrapSqliteDatabase; } });
 Object.defineProperty(exports, "wrapOracleConnection", { enumerable: true, get: function () { return drivers_1.wrapOracleConnection; } });
@@ -21,6 +10,7 @@ Object.defineProperty(exports, "GcpKmsProvider", { enumerable: true, get: functi
 Object.defineProperty(exports, "VaultKmsProvider", { enumerable: true, get: function () { return kms_1.VaultKmsProvider; } });
 Object.defineProperty(exports, "unwrapDekLocal", { enumerable: true, get: function () { return kms_1.unwrapDekLocal; } });
 Object.defineProperty(exports, "Pkcs11KmsProvider", { enumerable: true, get: function () { return kms_1.Pkcs11KmsProvider; } });
+Object.defineProperty(exports, "resolveKeys", { enumerable: true, get: function () { return kms_1.resolveKeys; } });
 var blind_index_1 = require("./blind-index");
 Object.defineProperty(exports, "computeBlindIndex", { enumerable: true, get: function () { return blind_index_1.computeBlindIndex; } });
 var security_1 = require("./security");
@@ -43,6 +33,8 @@ Object.defineProperty(exports, "parseCiphertext", { enumerable: true, get: funct
 Object.defineProperty(exports, "CRYPTO_ALGORITHMS", { enumerable: true, get: function () { return security_1.CRYPTO_ALGORITHMS; } });
 Object.defineProperty(exports, "VERSION_ALGORITHMS", { enumerable: true, get: function () { return security_1.VERSION_ALGORITHMS; } });
 Object.defineProperty(exports, "maskValue", { enumerable: true, get: function () { return security_1.maskValue; } });
+Object.defineProperty(exports, "encryptValue", { enumerable: true, get: function () { return security_1.encryptValue; } });
+Object.defineProperty(exports, "decryptValue", { enumerable: true, get: function () { return security_1.decryptValue; } });
 var compliance_1 = require("./compliance");
 Object.defineProperty(exports, "auditConfiguration", { enumerable: true, get: function () { return compliance_1.auditConfiguration; } });
 Object.defineProperty(exports, "generateComplianceHtmlReport", { enumerable: true, get: function () { return compliance_1.generateComplianceHtmlReport; } });

package/dist/kms.d.ts

@@ -44,3 +44,13 @@ export declare class Pkcs11KmsProvider implements KmsProvider {
     });
     decrypt(ciphertext: Buffer): Promise<Buffer>;
 }
+export interface DbGuardKeysOptions {
+    key?: Buffer | Record<string, Buffer>;
+    kms?: {
+        provider: KmsProvider;
+        wrappedKey: Buffer | Record<string, Buffer>;
+        wrappedKek?: Buffer | Record<string, Buffer>;
+        activeKeyVersion?: string;
+    };
+}
+export declare function resolveKeys(options: DbGuardKeysOptions): Promise<Record<string, Buffer>>;

package/dist/kms.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Pkcs11KmsProvider = exports.VaultKmsProvider = exports.GcpKmsProvider = exports.AwsKmsProvider = void 0;
 exports.unwrapDekLocal = unwrapDekLocal;
+exports.resolveKeys = resolveKeys;
 const security_1 = require("./security");
 class AwsKmsProvider {
     config;
@@ -106,7 +107,14 @@ class Pkcs11KmsProvider {
             const pkcs11js = require('pkcs11js');
             const pkcs11 = new pkcs11js.PKCS11();
             pkcs11.load(this.config.libraryPath);
-            pkcs11.C_Initialize();
+            try {
+                pkcs11.C_Initialize();
+            }
+            catch (e) {
+                if (!e.message?.includes('CRYPTOKI_ALREADY_INITIALIZED') && e.code !== 0x00000191 && e.code !== 401) {
+                    throw e;
+                }
+            }
             const slots = pkcs11.C_GetSlotList(true);
             const slotIndex = this.config.slotId !== undefined ? this.config.slotId : 0;
             if (!slots || slots.length <= slotIndex) {
@@ -143,7 +151,6 @@ class Pkcs11KmsProvider {
             finally {
                 pkcs11.C_Logout(session);
                 pkcs11.C_CloseSession(session);
-                pkcs11.C_Finalize();
             }
         }
         catch (err) {
@@ -152,3 +159,52 @@ class Pkcs11KmsProvider {
     }
 }
 exports.Pkcs11KmsProvider = Pkcs11KmsProvider;
+async function resolveKeys(options) {
+    let rawKeys = {};
+    if (options.key) {
+        if (Buffer.isBuffer(options.key)) {
+            rawKeys = { '1': options.key };
+        }
+        else {
+            rawKeys = { ...options.key };
+        }
+    }
+    else if (options.kms) {
+        const { provider, wrappedKey, wrappedKek } = options.kms;
+        if (Buffer.isBuffer(wrappedKey)) {
+            if (wrappedKek && Buffer.isBuffer(wrappedKek)) {
+                const unwrappedKek = await provider.decrypt(wrappedKek);
+                const dek = unwrapDekLocal(wrappedKey, unwrappedKek);
+                unwrappedKek.fill(0); // RAM Security: zeroize KEK immediately
+                rawKeys = { '1': dek };
+            }
+            else {
+                const key = await provider.decrypt(wrappedKey);
+                rawKeys = { '1': key };
+            }
+        }
+        else {
+            for (const [ver, wrapped] of Object.entries(wrappedKey)) {
+                if (wrappedKek) {
+                    const wKek = Buffer.isBuffer(wrappedKek) ? wrappedKek : wrappedKek[ver];
+                    if (wKek) {
+                        const unwrappedKek = await provider.decrypt(wKek);
+                        const dek = unwrapDekLocal(wrapped, unwrappedKek);
+                        unwrappedKek.fill(0); // RAM Security: zeroize KEK immediately
+                        rawKeys[ver] = dek;
+                    }
+                    else {
+                        rawKeys[ver] = await provider.decrypt(wrapped);
+                    }
+                }
+                else {
+                    rawKeys[ver] = await provider.decrypt(wrapped);
+                }
+            }
+        }
+    }
+    else {
+        throw new Error("Either 'key' or 'kms' configuration must be provided.");
+    }
+    return rawKeys;
+}

package/dist/mongoose.d.ts

@@ -1,4 +1,4 @@
-import { Schema } from 'mongoose';
+import type { Schema } from 'mongoose';
 import { RateLimiterOptions } from './security';
 export interface MongooseDbGuardOptions {
     key: Buffer | Record<string, Buffer>;

package/dist/mongoose.js

@@ -1,19 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.mongooseDbGuard = mongooseDbGuard;
-const prisma_1 = require("./prisma");
-const blind_index_1 = require("./blind-index");
+const kms_1 = require("./kms");
 const security_1 = require("./security");
 function mongooseDbGuard(schema, options) {
     const { fields } = options;
-    let keys;
+    let keys = {};
     let activeVersion;
     if (Buffer.isBuffer(options.key)) {
-        keys = { '1': options.key };
+        keys = { '1': Buffer.from(options.key) };
         activeVersion = '1';
     }
     else {
-        keys = options.key;
+        for (const [v, k] of Object.entries(options.key)) {
+            keys[v] = Buffer.from(k);
+        }
         activeVersion = options.activeKeyVersion || Object.keys(keys)[0];
     }
     (0, security_1.registerKeysForZeroization)(keys);
@@ -28,11 +29,15 @@ function mongooseDbGuard(schema, options) {
                 return { keys: { '1': bgKey }, activeKey: bgKey, activeVersion: '1' };
             }
         }
-        if (!tenantId || !options.multiTenant) {
+        if (options.multiTenant && !tenantId) {
+            throw new Error("Vollcrypt Security: tenantId must be provided in multi-tenant mode.");
+        }
+        if (!options.multiTenant) {
             return { keys, activeKey, activeVersion };
         }
+        const tId = tenantId;
         // Check Secure TTL Cache
-        const cachedActiveKey = (0, security_1.getCachedKey)(tenantId, activeVersion);
+        const cachedActiveKey = (0, security_1.getCachedKey)(tId, activeVersion);
         if (cachedActiveKey) {
             return { keys: { [activeVersion]: cachedActiveKey }, activeKey: cachedActiveKey, activeVersion };
         }
@@ -44,27 +49,31 @@ function mongooseDbGuard(schema, options) {
             }
             let tenantConfig;
             if (multiTenant.tenants) {
-                tenantConfig = multiTenant.tenants[tenantId];
+                tenantConfig = multiTenant.tenants[tId];
             }
             else if (multiTenant.getTenantConfig) {
-                tenantConfig = await multiTenant.getTenantConfig(tenantId);
+                tenantConfig = await multiTenant.getTenantConfig(tId);
             }
             if (!tenantConfig) {
-                throw new Error(`Vollcrypt Security: Configuration not found for tenantId "${tenantId}".`);
+                throw new Error(`Vollcrypt Security: Configuration not found for tenantId "${tId}".`);
             }
-            const resolvedTenantKeys = await (0, prisma_1.resolveKeys)({
+            const resolvedTenantKeysRaw = await (0, kms_1.resolveKeys)({
                 ...options,
                 key: tenantConfig.key,
                 kms: tenantConfig.kms
             });
-            (0, security_1.registerKeysForZeroization)(resolvedTenantKeys);
+            const resolvedTenantKeys = {};
+            for (const [v, k] of Object.entries(resolvedTenantKeysRaw)) {
+                resolvedTenantKeys[v] = Buffer.from(k);
+            }
+            (0, security_1.registerKeysForZeroization)(resolvedTenantKeys, tId);
             const tActiveVersion = tenantConfig.kms?.activeKeyVersion || '1';
             const tActiveKey = resolvedTenantKeys[tActiveVersion];
             if (!tActiveKey) {
-                throw new Error(`Vollcrypt Security: Active key version "${tActiveVersion}" not found for tenantId "${tenantId}".`);
+                throw new Error(`Vollcrypt Security: Active key version "${tActiveVersion}" not found for tenantId "${tId}".`);
             }
             for (const [ver, keyBuf] of Object.entries(resolvedTenantKeys)) {
-                (0, security_1.setCachedKey)(tenantId, ver, keyBuf);
+                (0, security_1.setCachedKey)(tId, ver, keyBuf);
             }
             return { keys: resolvedTenantKeys, activeKey: tActiveKey, activeVersion: tActiveVersion };
         };
@@ -79,7 +88,7 @@ function mongooseDbGuard(schema, options) {
             // 1. Encrypt fields
             for (const field of fields) {
                 if (doc.isModified(field) && doc[field] !== undefined && doc[field] !== null) {
-                    doc[field] = (0, prisma_1.encryptValue)(doc[field], resolved.activeKey, resolved.activeVersion);
+                    doc[field] = (0, security_1.encryptValue)(doc[field], resolved.activeKey, resolved.activeVersion);
                 }
             }
             // 2. Compute blind indexes
@@ -89,9 +98,9 @@ function mongooseDbGuard(schema, options) {
                         const bidxField = `${field}_bidx`;
                         // Decrypt temporary value if it was already encrypted in the previous step
                         const rawVal = doc.isModified(field) && doc[field].startsWith('VOLLVALT:')
-                            ? (0, prisma_1.decryptValue)(doc[field], keys)
+                            ? (0, security_1.decryptValue)(doc[field], keys)
                             : doc[field];
-                        doc[bidxField] = (0, blind_index_1.computeBlindIndex)(rawVal, options.blindIndexes.rootSalt, `${modelName}.${field}`);
+                        doc[bidxField] = (0, security_1.computeBlindIndex)(rawVal, options.blindIndexes.rootSalt, `${modelName}.${field}`);
                     }
                 }
             }
@@ -128,9 +137,9 @@ function mongooseDbGuard(schema, options) {
                 if (obj[currentPart] !== undefined && obj[currentPart] !== null) {
                     if (options.blindIndexes && options.blindIndexes.fields.includes(fullPath) && options.blindIndexes.rootSalt) {
                         const bidxField = `${currentPart}_bidx`;
-                        obj[bidxField] = (0, blind_index_1.computeBlindIndex)(obj[currentPart], options.blindIndexes.rootSalt, `${modelName}.${fullPath}`);
+                        obj[bidxField] = (0, security_1.computeBlindIndex)(obj[currentPart], options.blindIndexes.rootSalt, `${modelName}.${fullPath}`);
                     }
-                    obj[currentPart] = (0, prisma_1.encryptValue)(obj[currentPart], encKey, encVer);
+                    obj[currentPart] = (0, security_1.encryptValue)(obj[currentPart], encKey, encVer);
                 }
             }
             else {
@@ -141,9 +150,9 @@ function mongooseDbGuard(schema, options) {
                 if (obj[dotNotatedPath] !== undefined && obj[dotNotatedPath] !== null) {
                     if (options.blindIndexes && options.blindIndexes.fields.includes(fullPath) && options.blindIndexes.rootSalt) {
                         const bidxField = `${dotNotatedPath}_bidx`;
-                        obj[bidxField] = (0, blind_index_1.computeBlindIndex)(obj[dotNotatedPath], options.blindIndexes.rootSalt, `${modelName}.${fullPath}`);
+                        obj[bidxField] = (0, security_1.computeBlindIndex)(obj[dotNotatedPath], options.blindIndexes.rootSalt, `${modelName}.${fullPath}`);
                     }
-                    obj[dotNotatedPath] = (0, prisma_1.encryptValue)(obj[dotNotatedPath], encKey, encVer);
+                    obj[dotNotatedPath] = (0, security_1.encryptValue)(obj[dotNotatedPath], encKey, encVer);
                 }
             }
         };
@@ -178,7 +187,7 @@ function mongooseDbGuard(schema, options) {
                 // 2. Process query criteria (rewrite exact match search queries on conditions)
                 const conditions = typeof query.getQuery === 'function' ? query.getQuery() : null;
                 if (conditions && options.blindIndexes && options.blindIndexes.rootSalt) {
-                    (0, prisma_1.rewriteQueryWhere)(conditions, options.blindIndexes.fields, options.blindIndexes.rootSalt, modelName);
+                    (0, security_1.rewriteQueryWhere)(conditions, options.blindIndexes.fields, options.blindIndexes.rootSalt, modelName);
                 }
                 if (typeof next === 'function') {
                     next();
@@ -210,7 +219,7 @@ function mongooseDbGuard(schema, options) {
             const modelName = options.blindIndexes?.modelName || query.model?.modelName || 'Model';
             const conditions = typeof query.getQuery === 'function' ? query.getQuery() : null;
             if (conditions && options.blindIndexes && options.blindIndexes.rootSalt) {
-                (0, prisma_1.rewriteQueryWhere)(conditions, options.blindIndexes.fields, options.blindIndexes.rootSalt, modelName);
+                (0, security_1.rewriteQueryWhere)(conditions, options.blindIndexes.fields, options.blindIndexes.rootSalt, modelName);
             }
             next();
         });
@@ -222,7 +231,7 @@ function mongooseDbGuard(schema, options) {
         for (const field of fields) {
             if (doc[field] !== undefined && doc[field] !== null) {
                 try {
-                    doc[field] = (0, security_1.decryptWithSecurity)(doc[field], (val) => (0, prisma_1.decryptValue)(val, decKeys), modelName, field, doc.id || doc._id, options);
+                    doc[field] = (0, security_1.decryptWithSecurity)(doc[field], (val) => (0, security_1.decryptValue)(val, decKeys), modelName, field, doc.id || doc._id, options);
                 }
                 catch (err) {
                     throw new Error(`Mongoose db-guard failed to decrypt field "${field}": ${err.message}`);