@vollcrypt/db-guard 0.1.2 → 0.9.1

package/dist/prisma.d.ts

@@ -1,13 +1,6 @@
-import { KmsProvider } from './kms';
+import { DbGuardKeysOptions } from './kms';
 import { RateLimiterOptions } from './security';
-export interface PrismaDbGuardOptions {
-    key?: Buffer | Record<string, Buffer>;
-    kms?: {
-        provider: KmsProvider;
-        wrappedKey: Buffer | Record<string, Buffer>;
-        wrappedKek?: Buffer | Record<string, Buffer>;
-        activeKeyVersion?: string;
-    };
+export interface PrismaDbGuardOptions extends DbGuardKeysOptions {
     models: Record<string, string[]>;
     blindIndexes?: {
         rootSalt: Buffer;
@@ -31,24 +24,11 @@ export interface PrismaDbGuardOptions {
         } | undefined>;
     };
 }
-/**
- * Resolves the plaintext keys asynchronously from local config or KMS provider.
- */
-export declare function resolveKeys(options: PrismaDbGuardOptions): Promise<Record<string, Buffer>>;
-export declare function encryptValue(val: any, key: Buffer, version: string): string;
-export declare function decryptValue(stored: any, keys: Record<string, Buffer>): any;
-/**
- * Traverses query `where` arguments to rewrite exact match queries on encrypted fields
- * to target shadow `_bidx` columns using dynamic HKDF-SHA256 blind indexing.
- */
-export declare function rewriteQueryWhere(where: any, fields: string[], rootSalt: Buffer, modelName: string): void;
-/**
- * Appends calculated blind indexes to the write payload (create/update).
- */
-export declare function addBlindIndexes(data: any, fields: string[], rootSalt: Buffer, modelName: string): void;
 /**
  * Prisma DbGuard Extension Factory
  *
  * Bootstraps client-level field encryption, query translation, and automatic decryption.
  */
 export declare const prismaDbGuard: (options: PrismaDbGuardOptions, resolvedKeys?: Record<string, Buffer>) => (client: any) => import("@prisma/client").PrismaClientExtends<import("@prisma/client/runtime/library").InternalArgs<{}, {}, {}, {}> & import("@prisma/client/runtime/library").DefaultArgs>;
+export { encryptValue, decryptValue, rewriteQueryWhere, addBlindIndexes } from './security';
+export { resolveKeys } from './kms';

package/dist/prisma.js

@@ -1,164 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.prismaDbGuard = void 0;
-exports.resolveKeys = resolveKeys;
-exports.encryptValue = encryptValue;
-exports.decryptValue = decryptValue;
-exports.rewriteQueryWhere = rewriteQueryWhere;
-exports.addBlindIndexes = addBlindIndexes;
-const client_1 = require("@prisma/client");
-const blind_index_1 = require("./blind-index");
+exports.resolveKeys = exports.addBlindIndexes = exports.rewriteQueryWhere = exports.decryptValue = exports.encryptValue = exports.prismaDbGuard = void 0;
 const kms_1 = require("./kms");
 const security_1 = require("./security");
-/**
- * Resolves the plaintext keys asynchronously from local config or KMS provider.
- */
-async function resolveKeys(options) {
-    let rawKeys = {};
-    if (options.key) {
-        if (Buffer.isBuffer(options.key)) {
-            rawKeys = { '1': options.key };
-        }
-        else {
-            rawKeys = { ...options.key };
-        }
-    }
-    else if (options.kms) {
-        const { provider, wrappedKey, wrappedKek } = options.kms;
-        if (Buffer.isBuffer(wrappedKey)) {
-            if (wrappedKek && Buffer.isBuffer(wrappedKek)) {
-                const unwrappedKek = await provider.decrypt(wrappedKek);
-                const dek = (0, kms_1.unwrapDekLocal)(wrappedKey, unwrappedKek);
-                unwrappedKek.fill(0); // RAM Security: zeroize KEK immediately
-                rawKeys = { '1': dek };
-            }
-            else {
-                const key = await provider.decrypt(wrappedKey);
-                rawKeys = { '1': key };
-            }
-        }
-        else {
-            for (const [ver, wrapped] of Object.entries(wrappedKey)) {
-                if (wrappedKek) {
-                    const wKek = Buffer.isBuffer(wrappedKek) ? wrappedKek : wrappedKek[ver];
-                    if (wKek) {
-                        const unwrappedKek = await provider.decrypt(wKek);
-                        const dek = (0, kms_1.unwrapDekLocal)(wrapped, unwrappedKek);
-                        unwrappedKek.fill(0); // RAM Security: zeroize KEK immediately
-                        rawKeys[ver] = dek;
-                    }
-                    else {
-                        rawKeys[ver] = await provider.decrypt(wrapped);
-                    }
-                }
-                else {
-                    rawKeys[ver] = await provider.decrypt(wrapped);
-                }
-            }
-        }
-    }
-    else {
-        throw new Error("Either 'key' or 'kms' configuration must be provided.");
-    }
-    return rawKeys;
-}
-function encryptValue(val, key, version) {
-    if (val === null || val === undefined)
-        return val;
-    const plaintext = typeof val === 'string' ? val : JSON.stringify(val);
-    const plaintextBuf = Buffer.from(plaintext, 'utf8');
-    const encrypted = security_1.CRYPTO_ALGORITHMS['1'].encrypt(plaintextBuf, key);
-    // RAM Security: Zeroize the plaintext buffer immediately
-    plaintextBuf.fill(0);
-    return `VOLLVALT:v${version}:${encrypted.toString('base64')}`;
-}
-function decryptValue(stored, keys) {
-    if (typeof stored !== 'string') {
-        return stored;
-    }
-    const parsed = (0, security_1.parseCiphertext)(stored);
-    if (!parsed) {
-        return stored;
-    }
-    const { algoId, version, base64Data } = parsed;
-    const key = keys[version];
-    if (!key) {
-        throw new Error(`Decryption key version "${version}" not found in registered keys`);
-    }
-    try {
-        const encryptedBuf = Buffer.from(base64Data, 'base64');
-        const decryptor = security_1.CRYPTO_ALGORITHMS[algoId];
-        if (!decryptor) {
-            throw new Error(`Unsupported decryption algorithm ID "${algoId}"`);
-        }
-        const decrypted = decryptor.decrypt(encryptedBuf, key);
-        const plaintext = decrypted.toString('utf8');
-        // RAM Security: Zeroize the decrypted buffer
-        decrypted.fill(0);
-        try {
-            return JSON.parse(plaintext);
-        }
-        catch {
-            return plaintext;
-        }
-    }
-    catch (err) {
-        throw new Error(`Failed to decrypt field value: ${err.message}`);
-    }
-}
-/**
- * Traverses query `where` arguments to rewrite exact match queries on encrypted fields
- * to target shadow `_bidx` columns using dynamic HKDF-SHA256 blind indexing.
- */
-function rewriteQueryWhere(where, fields, rootSalt, modelName) {
-    if (!where || typeof where !== 'object')
-        return;
-    for (const field of fields) {
-        if (where[field] !== undefined) {
-            const val = where[field];
-            const bidxField = `${field}_bidx`;
-            if (typeof val === 'string' || typeof val === 'number' || typeof val === 'boolean') {
-                where[bidxField] = (0, blind_index_1.computeBlindIndex)(val, rootSalt, `${modelName}.${field}`);
-                delete where[field];
-            }
-            else if (val && typeof val === 'object') {
-                if (val.equals !== undefined) {
-                    where[bidxField] = {
-                        equals: (0, blind_index_1.computeBlindIndex)(val.equals, rootSalt, `${modelName}.${field}`),
-                    };
-                    delete where[field];
-                }
-            }
-        }
-    }
-    // Recurse into compound logical operators
-    const operators = ['AND', 'OR', 'NOT'];
-    for (const op of operators) {
-        if (Array.isArray(where[op])) {
-            where[op].forEach((item) => rewriteQueryWhere(item, fields, rootSalt, modelName));
-        }
-        else if (where[op] && typeof where[op] === 'object') {
-            rewriteQueryWhere(where[op], fields, rootSalt, modelName);
-        }
-    }
-}
-/**
- * Appends calculated blind indexes to the write payload (create/update).
- */
-function addBlindIndexes(data, fields, rootSalt, modelName) {
-    if (!data || typeof data !== 'object')
-        return;
-    if (Array.isArray(data)) {
-        data.forEach((item) => addBlindIndexes(item, fields, rootSalt, modelName));
-        return;
-    }
-    for (const field of fields) {
-        if (data[field] !== undefined && data[field] !== null) {
-            const bidxField = `${field}_bidx`;
-            data[bidxField] = (0, blind_index_1.computeBlindIndex)(data[field], rootSalt, `${modelName}.${field}`);
-        }
-    }
-}
 /**
  * Prisma DbGuard Extension Factory
  *
@@ -169,10 +13,13 @@ const prismaDbGuard = (options, resolvedKeys) => {
     if (!keys) {
         if (options.key) {
             if (Buffer.isBuffer(options.key)) {
-                keys = { '1': options.key };
+                keys = { '1': Buffer.from(options.key) };
             }
             else {
-                keys = { ...options.key };
+                keys = {};
+                for (const [v, k] of Object.entries(options.key)) {
+                    keys[v] = Buffer.from(k);
+                }
             }
         }
         else if (options.kms || options.multiTenant) {
@@ -183,6 +30,11 @@ const prismaDbGuard = (options, resolvedKeys) => {
         }
     }
     if (keys) {
+        const clonedKeys = {};
+        for (const [v, k] of Object.entries(keys)) {
+            clonedKeys[v] = Buffer.from(k);
+        }
+        keys = clonedKeys;
         (0, security_1.registerKeysForZeroization)(keys);
     }
     const activeVersion = options.kms?.activeKeyVersion || '1';
@@ -194,41 +46,49 @@ const prismaDbGuard = (options, resolvedKeys) => {
                 return { keys: { '1': bgKey }, activeKey: bgKey, activeVersion: '1' };
             }
         }
-        if (!tenantId || !options.multiTenant) {
+        if (options.multiTenant && !tenantId) {
+            throw new Error("Vollcrypt Security: tenantId must be provided in multi-tenant mode.");
+        }
+        if (!options.multiTenant) {
             if (!keys || !activeKey) {
                 throw new Error("Vollcrypt Security: Global keys are not resolved.");
             }
             return { keys, activeKey, activeVersion };
         }
+        const tId = tenantId;
         // Check Secure TTL Cache
-        const cachedActiveKey = (0, security_1.getCachedKey)(tenantId, activeVersion);
+        const cachedActiveKey = (0, security_1.getCachedKey)(tId, activeVersion);
         if (cachedActiveKey) {
             return { keys: { [activeVersion]: cachedActiveKey }, activeKey: cachedActiveKey, activeVersion };
         }
         // Cache miss: resolve configuration
         let tenantConfig;
         if (options.multiTenant.tenants) {
-            tenantConfig = options.multiTenant.tenants[tenantId];
+            tenantConfig = options.multiTenant.tenants[tId];
         }
         else if (options.multiTenant.getTenantConfig) {
-            tenantConfig = await options.multiTenant.getTenantConfig(tenantId);
+            tenantConfig = await options.multiTenant.getTenantConfig(tId);
         }
         if (!tenantConfig) {
-            throw new Error(`Vollcrypt Security: Configuration not found for tenantId "${tenantId}".`);
+            throw new Error(`Vollcrypt Security: Configuration not found for tenantId "${tId}".`);
         }
-        const resolvedTenantKeys = await resolveKeys({
+        const resolvedTenantKeysRaw = await (0, kms_1.resolveKeys)({
             ...options,
             key: tenantConfig.key,
             kms: tenantConfig.kms
         });
-        (0, security_1.registerKeysForZeroization)(resolvedTenantKeys);
+        const resolvedTenantKeys = {};
+        for (const [v, k] of Object.entries(resolvedTenantKeysRaw)) {
+            resolvedTenantKeys[v] = Buffer.from(k);
+        }
+        (0, security_1.registerKeysForZeroization)(resolvedTenantKeys, tId);
         const tActiveVersion = tenantConfig.kms?.activeKeyVersion || '1';
         const tActiveKey = resolvedTenantKeys[tActiveVersion];
         if (!tActiveKey) {
-            throw new Error(`Vollcrypt Security: Active key version "${tActiveVersion}" not found for tenantId "${tenantId}".`);
+            throw new Error(`Vollcrypt Security: Active key version "${tActiveVersion}" not found for tenantId "${tId}".`);
         }
         for (const [ver, keyBuf] of Object.entries(resolvedTenantKeys)) {
-            (0, security_1.setCachedKey)(tenantId, ver, keyBuf);
+            (0, security_1.setCachedKey)(tId, ver, keyBuf);
         }
         return { keys: resolvedTenantKeys, activeKey: tActiveKey, activeVersion: tActiveVersion };
     };
@@ -239,7 +99,7 @@ const prismaDbGuard = (options, resolvedKeys) => {
         const cloned = { ...data };
         for (const field of fieldsToEncrypt) {
             if (cloned[field] !== undefined) {
-                cloned[field] = encryptValue(cloned[field], encKey, encVer);
+                cloned[field] = (0, security_1.encryptValue)(cloned[field], encKey, encVer);
             }
         }
         return cloned;
@@ -263,7 +123,7 @@ const prismaDbGuard = (options, resolvedKeys) => {
         const cloned = { ...result };
         for (const field of fieldsToEncrypt) {
             if (cloned[field] !== undefined) {
-                cloned[field] = (0, security_1.decryptWithSecurity)(cloned[field], (val) => decryptValue(val, decKeys), modelName, field, cloned.id || cloned._id, options);
+                cloned[field] = (0, security_1.decryptWithSecurity)(cloned[field], (val) => (0, security_1.decryptValue)(val, decKeys), modelName, field, cloned.id || cloned._id, options);
             }
         }
         return cloned;
@@ -285,13 +145,13 @@ const prismaDbGuard = (options, resolvedKeys) => {
         const bidxFields = options.blindIndexes?.models[modelName];
         if (bidxFields && options.blindIndexes?.rootSalt) {
             if (args.data) {
-                addBlindIndexes(args.data, bidxFields, options.blindIndexes.rootSalt, modelName);
+                (0, security_1.addBlindIndexes)(args.data, bidxFields, options.blindIndexes.rootSalt, modelName);
             }
             if (args.create) {
-                addBlindIndexes(args.create, bidxFields, options.blindIndexes.rootSalt, modelName);
+                (0, security_1.addBlindIndexes)(args.create, bidxFields, options.blindIndexes.rootSalt, modelName);
             }
             if (args.update) {
-                addBlindIndexes(args.update, bidxFields, options.blindIndexes.rootSalt, modelName);
+                (0, security_1.addBlindIndexes)(args.update, bidxFields, options.blindIndexes.rootSalt, modelName);
             }
         }
     };
@@ -301,10 +161,11 @@ const prismaDbGuard = (options, resolvedKeys) => {
         // Rewrite queries targeting encrypted columns to use the blind index column
         const bidxFields = options.blindIndexes?.models[modelName];
         if (bidxFields && options.blindIndexes?.rootSalt && args.where) {
-            rewriteQueryWhere(args.where, bidxFields, options.blindIndexes.rootSalt, modelName);
+            (0, security_1.rewriteQueryWhere)(args.where, bidxFields, options.blindIndexes.rootSalt, modelName);
         }
     };
-    return client_1.Prisma.defineExtension((client) => {
+    const { Prisma } = require('@prisma/client');
+    return Prisma.defineExtension((client) => {
         return client.$extends({
             name: 'vollcrypt-db-guard',
             query: {
@@ -325,7 +186,7 @@ const prismaDbGuard = (options, resolvedKeys) => {
                                     const encrypted = encryptPayload(model, item, resolved.activeKey, resolved.activeVersion);
                                     const bidxFields = options.blindIndexes?.models[model];
                                     if (bidxFields && options.blindIndexes?.rootSalt) {
-                                        addBlindIndexes(encrypted, bidxFields, options.blindIndexes.rootSalt, model);
+                                        (0, security_1.addBlindIndexes)(encrypted, bidxFields, options.blindIndexes.rootSalt, model);
                                     }
                                     return encrypted;
                                 });
@@ -388,3 +249,10 @@ const prismaDbGuard = (options, resolvedKeys) => {
     });
 };
 exports.prismaDbGuard = prismaDbGuard;
+var security_2 = require("./security");
+Object.defineProperty(exports, "encryptValue", { enumerable: true, get: function () { return security_2.encryptValue; } });
+Object.defineProperty(exports, "decryptValue", { enumerable: true, get: function () { return security_2.decryptValue; } });
+Object.defineProperty(exports, "rewriteQueryWhere", { enumerable: true, get: function () { return security_2.rewriteQueryWhere; } });
+Object.defineProperty(exports, "addBlindIndexes", { enumerable: true, get: function () { return security_2.addBlindIndexes; } });
+var kms_2 = require("./kms");
+Object.defineProperty(exports, "resolveKeys", { enumerable: true, get: function () { return kms_2.resolveKeys; } });

package/dist/provenance.json

@@ -4,13 +4,13 @@
     {
       "name": "dist/blind-index.d.ts",
       "digest": {
-        "sha256": "7e613b58cf47bc14d647cfbfa2a9cc0f9e805dbab7562daa00ac679c30830ba7"
+        "sha256": "54df5b23b93c61111ba6124b9557fb4fe3f5e4af8ef18d1aeb5477826679363f"
       }
     },
     {
       "name": "dist/blind-index.js",
       "digest": {
-        "sha256": "fb28a7038cc818346aeb212ece2e5d4f1db4b72fd3ed9dda78a1a7f5744d7455"
+        "sha256": "d417966c32408676efa5399b6e960b68d6015d66837b9b2bad9fa0bb9396b4be"
       }
     },
     {
@@ -22,7 +22,7 @@
     {
       "name": "dist/cli.js",
       "digest": {
-        "sha256": "bf91d9b9d820796590d8b030e409031623d177e45cc487da8bcb66af13078ec0"
+        "sha256": "33c313c9195a9e00099652c3e8fac9eac169ac3b94088222fbe97e7a2e51442a"
       }
     },
     {
@@ -46,7 +46,7 @@
     {
       "name": "dist/drivers.js",
       "digest": {
-        "sha256": "44623a5cf632c22a41b8196b809a3c00d50276bde28c2fbde13d6f4bef3177ce"
+        "sha256": "fac1fd60cc16c2dafa9daf234177fd2f17d41cf1015d4fcd1821adb2cdbdb970"
       }
     },
     {
@@ -58,79 +58,79 @@
     {
       "name": "dist/drizzle.js",
       "digest": {
-        "sha256": "aad49d4c9dd41f2e44175465da6ae7f4a7ae35337ce12f7b3a87113ec0f25424"
+        "sha256": "3686b5a03b627e3262257f6a6d2d3addcb7f2cf3377ece458c434aad3b15d2ba"
       }
     },
     {
       "name": "dist/index.d.ts",
       "digest": {
-        "sha256": "a4864c4ea0bb9e9cc9bc1f58cdbc31863e5543a572e6049ee900b53b9fecb003"
+        "sha256": "ed2935e0d96814bcf3192294462ae707acfe6934ce2aed9f859683aed88a3ea8"
       }
     },
     {
       "name": "dist/index.js",
       "digest": {
-        "sha256": "496292f1edd16bd779f6e8712291c4b90e5b3f404d71b54f5c369c6736c26814"
+        "sha256": "37b74d238138bb80b65341520257b9390be3cc5b9b1f5adf579894eb4995c2ab"
       }
     },
     {
       "name": "dist/kms.d.ts",
       "digest": {
-        "sha256": "822f37608176917f438febaaea06a3b65508c45474bd7e137c4df815c50b4854"
+        "sha256": "757dba651cf48b6ab68e11b5c92e8ccc81c1ca6eb9129f60a2a3b224fc4f712e"
       }
     },
     {
       "name": "dist/kms.js",
       "digest": {
-        "sha256": "4b1a32b35545e2e7944ebba3f84272b7421ffedd1cc3c7eb569e1a6b2fcc4a02"
+        "sha256": "1619f068398e57c2044457d18d24ee1c626b54e12153246093d4c51add64368c"
       }
     },
     {
       "name": "dist/mongoose.d.ts",
       "digest": {
-        "sha256": "a3bf00d62fecf9266325a9dd18c4ec272de9559355dbf3f9f43836a4688fe86b"
+        "sha256": "18f77aa838f2cd861cd31dd5a03fdfd86d34563a090340177dba1420b5ea9b53"
       }
     },
     {
       "name": "dist/mongoose.js",
       "digest": {
-        "sha256": "42b2177825713fa1c618b80af6cf7a5d9f4055399c8e95b67018a0410add2a3f"
+        "sha256": "0b7c921d254a3c12d6d0924f3778ac39d7e95383086f1f8a893ff361a29c380b"
       }
     },
     {
       "name": "dist/prisma.d.ts",
       "digest": {
-        "sha256": "f6b85a786a9bb964f0620df4bcad0787e5c972e853df35551cf8fc902bb79691"
+        "sha256": "d55f39802671b594be9c0a0512c06cb1828569dea9024c78e890c53085cf0232"
       }
     },
     {
       "name": "dist/prisma.js",
       "digest": {
-        "sha256": "e2b7a8fa24c120f59ab48ebb508a18c01e3e24245e04c197b08ad0e327a2d9a8"
+        "sha256": "de57df0c3fc6657a996c804d6deee6ff83f889f457c82f55ea35064df6372eab"
       }
     },
     {
       "name": "dist/security.d.ts",
       "digest": {
-        "sha256": "554d9ba00f800470666ab66127079df889b8d717a9cf7b28ab252f0adad64304"
+        "sha256": "dbe2dce83e417dc20d476e5bd476e31c3cf43e58fd363011a77dbc56ab82386f"
       }
     },
     {
       "name": "dist/security.js",
       "digest": {
-        "sha256": "5e907c9f5ec9fb93ef07f6360d7f8572aa5a1ea1c0a32d0b10496477d0b8fd33"
+        "sha256": "390eb8dbf9f2eab968445dadc43e1dfa6a13217851aa2b5138a5215059c487ed"
       }
     },
     {
       "name": "dist/typeorm.d.ts",
       "digest": {
-        "sha256": "6cc82bbbe82e260abcc789495fe85f984138c5c8368901881edaece1ffa46d8c"
+        "sha256": "47200df068a368cdd80b5818ae8dafc749686f8a09a0be8bd9847b175dd89fe6"
       }
     },
     {
       "name": "dist/typeorm.js",
       "digest": {
-        "sha256": "154827069a5496e043a9f69b3249bd5dddd62690783dfa8675d06d0f574ac76b"
+        "sha256": "80e1908e97ffc89c426e89c71efbbd7dbea98191ec7da8ecc9d37cc439a262d8"
       }
     }
   ],
@@ -141,7 +141,7 @@
       "externalParameters": {
         "packageJson": {
           "name": "@vollcrypt/db-guard",
-          "version": "0.1.2",
+          "version": "0.9.1",
           "scripts": {
             "build": "tsc && node scripts/generate-sbom.js",
             "test": "node --import tsx --test tests/*.test.ts"
@@ -170,6 +170,22 @@
           "uri": "pkg:npm/typeorm@0.3.0",
           "digest": {}
         },
+        {
+          "uri": "pkg:npm/@aws-sdk/client-kms@3.0.0",
+          "digest": {}
+        },
+        {
+          "uri": "pkg:npm/@google-cloud/kms@3.0.0",
+          "digest": {}
+        },
+        {
+          "uri": "pkg:npm/node-vault@0.9.0",
+          "digest": {}
+        },
+        {
+          "uri": "pkg:npm/pkcs11js@1.0.0",
+          "digest": {}
+        },
         {
           "uri": "pkg:rust/aes-gcm",
           "digest": {}
@@ -225,9 +241,9 @@
         "id": "https://vollcrypt.dev/builders/local-hermetic-env"
       },
       "metadata": {
-        "invocationId": "19095e456ee2a685d43df5cc56999080",
-        "startedOn": "2026-06-11T16:17:36.609Z",
-        "finishedOn": "2026-06-11T16:17:36.610Z"
+        "invocationId": "e52b6b317496bccb3dd2fbc3c609d1f0",
+        "startedOn": "2026-07-09T19:07:03.950Z",
+        "finishedOn": "2026-07-09T19:07:03.951Z"
       }
     }
   }

package/dist/provenance.json.sig

@@ -1 +1,2 @@
-?NENc0�HӰ�@�S�t��J�ɽ<(:3�8O �7X�q-du�Y�^~՚�8�z� Dž�
+T&�~����*F��
+p��ƕ�A9�>t���V7��b���ޡA����z�oח�%!��)�