@vollcrypt/db-guard 0.1.2 → 0.9.1

package/dist/sbom.json

@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:45a7c8f7-12f3-4e25-ab52-81be917b4646",
+  "serialNumber": "urn:uuid:54f5fdbd-84b0-47fe-95c1-e86fe565dcf8",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-11T16:17:36.609Z",
+    "timestamp": "2026-07-09T19:07:03.950Z",
     "tools": [
       {
         "vendor": "Vollcrypt",
@@ -13,19 +13,19 @@
       }
     ],
     "component": {
-      "bomRef": "pkg:npm/@vollcrypt/db-guard@0.1.2",
+      "bomRef": "pkg:npm/@vollcrypt/db-guard@0.9.1",
       "type": "library",
       "name": "@vollcrypt/db-guard",
-      "version": "0.1.2",
+      "version": "0.9.1",
       "description": "Database field-level encryption integrations for Vollcrypt (Prisma, Mongoose, Drizzle, TypeORM)",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7e613b58cf47bc14d647cfbfa2a9cc0f9e805dbab7562daa00ac679c30830ba7"
+          "content": "54df5b23b93c61111ba6124b9557fb4fe3f5e4af8ef18d1aeb5477826679363f"
         },
         {
           "alg": "SHA-256",
-          "content": "fb28a7038cc818346aeb212ece2e5d4f1db4b72fd3ed9dda78a1a7f5744d7455"
+          "content": "d417966c32408676efa5399b6e960b68d6015d66837b9b2bad9fa0bb9396b4be"
         },
         {
           "alg": "SHA-256",
@@ -33,7 +33,7 @@
         },
         {
           "alg": "SHA-256",
-          "content": "bf91d9b9d820796590d8b030e409031623d177e45cc487da8bcb66af13078ec0"
+          "content": "33c313c9195a9e00099652c3e8fac9eac169ac3b94088222fbe97e7a2e51442a"
         },
         {
           "alg": "SHA-256",
@@ -49,7 +49,7 @@
         },
         {
           "alg": "SHA-256",
-          "content": "44623a5cf632c22a41b8196b809a3c00d50276bde28c2fbde13d6f4bef3177ce"
+          "content": "fac1fd60cc16c2dafa9daf234177fd2f17d41cf1015d4fcd1821adb2cdbdb970"
         },
         {
           "alg": "SHA-256",
@@ -57,55 +57,55 @@
         },
         {
           "alg": "SHA-256",
-          "content": "aad49d4c9dd41f2e44175465da6ae7f4a7ae35337ce12f7b3a87113ec0f25424"
+          "content": "3686b5a03b627e3262257f6a6d2d3addcb7f2cf3377ece458c434aad3b15d2ba"
         },
         {
           "alg": "SHA-256",
-          "content": "a4864c4ea0bb9e9cc9bc1f58cdbc31863e5543a572e6049ee900b53b9fecb003"
+          "content": "ed2935e0d96814bcf3192294462ae707acfe6934ce2aed9f859683aed88a3ea8"
         },
         {
           "alg": "SHA-256",
-          "content": "496292f1edd16bd779f6e8712291c4b90e5b3f404d71b54f5c369c6736c26814"
+          "content": "37b74d238138bb80b65341520257b9390be3cc5b9b1f5adf579894eb4995c2ab"
         },
         {
           "alg": "SHA-256",
-          "content": "822f37608176917f438febaaea06a3b65508c45474bd7e137c4df815c50b4854"
+          "content": "757dba651cf48b6ab68e11b5c92e8ccc81c1ca6eb9129f60a2a3b224fc4f712e"
         },
         {
           "alg": "SHA-256",
-          "content": "4b1a32b35545e2e7944ebba3f84272b7421ffedd1cc3c7eb569e1a6b2fcc4a02"
+          "content": "1619f068398e57c2044457d18d24ee1c626b54e12153246093d4c51add64368c"
         },
         {
           "alg": "SHA-256",
-          "content": "a3bf00d62fecf9266325a9dd18c4ec272de9559355dbf3f9f43836a4688fe86b"
+          "content": "18f77aa838f2cd861cd31dd5a03fdfd86d34563a090340177dba1420b5ea9b53"
         },
         {
           "alg": "SHA-256",
-          "content": "42b2177825713fa1c618b80af6cf7a5d9f4055399c8e95b67018a0410add2a3f"
+          "content": "0b7c921d254a3c12d6d0924f3778ac39d7e95383086f1f8a893ff361a29c380b"
         },
         {
           "alg": "SHA-256",
-          "content": "f6b85a786a9bb964f0620df4bcad0787e5c972e853df35551cf8fc902bb79691"
+          "content": "d55f39802671b594be9c0a0512c06cb1828569dea9024c78e890c53085cf0232"
         },
         {
           "alg": "SHA-256",
-          "content": "e2b7a8fa24c120f59ab48ebb508a18c01e3e24245e04c197b08ad0e327a2d9a8"
+          "content": "de57df0c3fc6657a996c804d6deee6ff83f889f457c82f55ea35064df6372eab"
         },
         {
           "alg": "SHA-256",
-          "content": "554d9ba00f800470666ab66127079df889b8d717a9cf7b28ab252f0adad64304"
+          "content": "dbe2dce83e417dc20d476e5bd476e31c3cf43e58fd363011a77dbc56ab82386f"
         },
         {
           "alg": "SHA-256",
-          "content": "5e907c9f5ec9fb93ef07f6360d7f8572aa5a1ea1c0a32d0b10496477d0b8fd33"
+          "content": "390eb8dbf9f2eab968445dadc43e1dfa6a13217851aa2b5138a5215059c487ed"
         },
         {
           "alg": "SHA-256",
-          "content": "6cc82bbbe82e260abcc789495fe85f984138c5c8368901881edaece1ffa46d8c"
+          "content": "47200df068a368cdd80b5818ae8dafc749686f8a09a0be8bd9847b175dd89fe6"
         },
         {
           "alg": "SHA-256",
-          "content": "154827069a5496e043a9f69b3249bd5dddd62690783dfa8675d06d0f574ac76b"
+          "content": "80e1908e97ffc89c426e89c71efbbd7dbea98191ec7da8ecc9d37cc439a262d8"
         }
       ]
     },
@@ -141,6 +141,30 @@
       "version": ">=0.3.0",
       "purl": "pkg:npm/typeorm@0.3.0"
     },
+    {
+      "type": "library",
+      "name": "@aws-sdk/client-kms",
+      "version": ">=3.0.0",
+      "purl": "pkg:npm/@aws-sdk/client-kms@3.0.0"
+    },
+    {
+      "type": "library",
+      "name": "@google-cloud/kms",
+      "version": ">=3.0.0",
+      "purl": "pkg:npm/@google-cloud/kms@3.0.0"
+    },
+    {
+      "type": "library",
+      "name": "node-vault",
+      "version": ">=0.9.0",
+      "purl": "pkg:npm/node-vault@0.9.0"
+    },
+    {
+      "type": "library",
+      "name": "pkcs11js",
+      "version": ">=1.0.0",
+      "purl": "pkg:npm/pkcs11js@1.0.0"
+    },
     {
       "type": "library",
       "name": "rust-crate:aes-gcm",

package/dist/sbom.json.sig

@@ -1,2 +1 @@
-��7gu
-�
+�0��cWA��8��c.*�+�F֛�U��g{s_7O�=��$�V�¿��Я�n9�Ҧ�

package/dist/security.d.ts

@@ -46,11 +46,11 @@ export declare function activateBreakGlass(signatures: {
     signature: string;
     timestamp: number;
 }[], emergencyBackupKey: Buffer): void;
-export declare function registerKeysForZeroization(keys: Record<string, Buffer>): void;
-export declare function triggerFailClosed(onFailClosedCallback?: () => void): void;
+export declare function registerKeysForZeroization(keys: Record<string, Buffer>, tenantId?: string): void;
+export declare function triggerFailClosed(onFailClosedCallback?: () => void, tenantId?: string): void;
 export declare function checkRateLimit(options?: RateLimiterOptions): void;
 export declare function checkPageSize(count: number, options?: RateLimiterOptions): 'ok' | 'warn' | 'bypass' | 'error';
-export declare function getFailClosedStatus(): boolean;
+export declare function getFailClosedStatus(tenantId?: string): boolean;
 export declare function resetFailClosedStatusForTesting(): void;
 export interface AuditLogEntry {
     timestamp: string;
@@ -88,3 +88,11 @@ export declare function parseCiphertext(stored: string): {
     version: string;
     base64Data: string;
 } | null;
+/**
+ * Computes a hardened, frequency-resistant blind index for a database field.
+ */
+export declare function computeBlindIndex(value: any, rootSalt: Buffer, columnName: string): string;
+export declare function encryptValue(val: any, key: Buffer, version: string): string;
+export declare function decryptValue(stored: any, keys: Record<string, Buffer>): any;
+export declare function rewriteQueryWhere(where: any, fields: string[], rootSalt: Buffer, modelName: string): void;
+export declare function addBlindIndexes(data: any, fields: string[], rootSalt: Buffer, modelName: string): void;

package/dist/security.js

@@ -65,6 +65,11 @@ exports.resetAuditLoggerForTesting = resetAuditLoggerForTesting;
 exports.logDecryption = logDecryption;
 exports.decryptWithSecurity = decryptWithSecurity;
 exports.parseCiphertext = parseCiphertext;
+exports.computeBlindIndex = computeBlindIndex;
+exports.encryptValue = encryptValue;
+exports.decryptValue = decryptValue;
+exports.rewriteQueryWhere = rewriteQueryWhere;
+exports.addBlindIndexes = addBlindIndexes;
 const async_hooks_1 = require("async_hooks");
 const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
@@ -209,15 +214,14 @@ function maskValue(val, rule) {
             return '***';
     }
 }
-let decryptCount = 0;
-let windowStart = Date.now();
-let isFailClosed = false;
-const globalKeysToZeroize = [];
 // Ephemeral Master Key generated randomly on startup
 let ephemeralMasterKey = crypto.randomBytes(32);
+const tenantFailClosed = new Map();
+const tenantKeys = new Map();
+const tenantRateLimitStates = new Map();
 const secureKeyCache = new Map();
 function getCachedKey(tenantId, version) {
-    const cacheKey = `${tenantId || 'global'}:${version}`;
+    const cacheKey = JSON.stringify([tenantId || 'global', version]);
     const entry = secureKeyCache.get(cacheKey);
     if (!entry)
         return undefined;
@@ -234,7 +238,7 @@ function getCachedKey(tenantId, version) {
     }
 }
 function setCachedKey(tenantId, version, plaintextKey, ttlMs = 120000) {
-    const cacheKey = `${tenantId || 'global'}:${version}`;
+    const cacheKey = JSON.stringify([tenantId || 'global', version]);
     const existing = secureKeyCache.get(cacheKey);
     if (existing) {
         existing.wrappedKey.fill(0);
@@ -327,27 +331,58 @@ function activateBreakGlass(signatures, emergencyBackupKey) {
     isBreakGlassActiveFlag = true;
     logDecryption('SYSTEM', 'BREAK_GLASS_ACTIVATED', undefined);
 }
-function registerKeysForZeroization(keys) {
-    if (!globalKeysToZeroize.includes(keys)) {
-        globalKeysToZeroize.push(keys);
+function registerKeysForZeroization(keys, tenantId) {
+    const tId = tenantId || 'global';
+    let list = tenantKeys.get(tId);
+    if (!list) {
+        list = [];
+        tenantKeys.set(tId, list);
+    }
+    if (!list.includes(keys)) {
+        list.push(keys);
+    }
+}
+function triggerFailClosed(onFailClosedCallback, tenantId) {
+    const tId = tenantId || exports.dbGuardContextStore.getStore()?.tenantId || 'global';
+    tenantFailClosed.set(tId, true);
+    // Zeroize all registered keys immediately in memory for this tenant
+    const list = tenantKeys.get(tId);
+    if (list && list.length > 0) {
+        for (const keyMap of list) {
+            for (const key of Object.values(keyMap)) {
+                key.fill(0);
+            }
+        }
     }
-}
-function triggerFailClosed(onFailClosedCallback) {
-    isFailClosed = true;
-    // Zeroize all registered keys immediately in memory
-    for (const keyMap of globalKeysToZeroize) {
-        for (const key of Object.values(keyMap)) {
-            key.fill(0);
+    else {
+        // Fallback to global keys if no tenant-specific keys are registered
+        const globalList = tenantKeys.get('global');
+        if (globalList) {
+            for (const keyMap of globalList) {
+                for (const key of Object.values(keyMap)) {
+                    key.fill(0);
+                }
+            }
         }
     }
     // Zeroize cache and ephemeral master key
-    for (const entry of secureKeyCache.values()) {
-        entry.wrappedKey.fill(0);
+    for (const [cacheKey, entry] of secureKeyCache.entries()) {
+        try {
+            const parsed = JSON.parse(cacheKey);
+            if (Array.isArray(parsed) && parsed[0] === tId) {
+                entry.wrappedKey.fill(0);
+                secureKeyCache.delete(cacheKey);
+            }
+        }
+        catch {
+            // fallback
+        }
     }
-    secureKeyCache.clear();
-    ephemeralMasterKey.fill(0);
-    if (breakGlassEmergencyKey) {
-        breakGlassEmergencyKey.fill(0);
+    if (tId === 'global') {
+        ephemeralMasterKey.fill(0);
+        if (breakGlassEmergencyKey) {
+            breakGlassEmergencyKey.fill(0);
+        }
     }
     if (onFailClosedCallback) {
         try {
@@ -357,59 +392,45 @@ function triggerFailClosed(onFailClosedCallback) {
             // prevent user callback crash from blocking zeroization
         }
     }
-    throw new Error('Vollcrypt Security: Decryption rate limit exceeded. Fail-Closed mode triggered. Keys zeroized.');
+    throw new Error(`Vollcrypt Security: Decryption rate limit exceeded. Fail-Closed mode triggered for tenant "${tId}". Keys zeroized.`);
 }
 function checkRateLimit(options) {
-    if (isFailClosed) {
-        throw new Error('Vollcrypt Security: Fail-Closed mode is active. Decryption blocked.');
-    }
     const context = exports.dbGuardContextStore.getStore();
+    const tId = context?.tenantId || 'global';
+    if (tenantFailClosed.get(tId)) {
+        throw new Error(`Vollcrypt Security: Fail-Closed mode is active for tenant "${tId}". Decryption blocked.`);
+    }
     if (context?.bypassRateLimit) {
         return; // Rate limit check bypassed for this request context
     }
     const limit = context?.maxDecryptionsPerSecond || options?.maxDecryptionsPerSecond || 500;
     const mode = context?.rateLimiterMode || options?.mode || 'fail_closed';
     const now = Date.now();
-    if (context) {
-        if (context.windowStart === undefined || context.decryptCount === undefined) {
-            context.windowStart = now;
-            context.decryptCount = 0;
-        }
-        if (now - context.windowStart > 1000) {
-            context.decryptCount = 0;
-            context.windowStart = now;
-        }
-        context.decryptCount++;
-        if (context.decryptCount > limit) {
-            if (mode === 'fail_closed') {
-                triggerFailClosed(options?.onFailClosed);
-            }
-            else if (mode === 'warn') {
-                console.warn(`Vollcrypt Warning: Decryption rate limit exceeded. ${context.decryptCount} decryptions in the current window (limit: ${limit}).`);
-            }
+    let state = tenantRateLimitStates.get(tId);
+    if (!state) {
+        state = { decryptCount: 0, windowStart: now };
+        tenantRateLimitStates.set(tId, state);
+    }
+    if (now - state.windowStart > 1000) {
+        state.decryptCount = 0;
+        state.windowStart = now;
+    }
+    state.decryptCount++;
+    if (state.decryptCount > limit) {
+        if (mode === 'fail_closed') {
+            triggerFailClosed(options?.onFailClosed, tId);
         }
-    }
-    else {
-        if (now - windowStart > 1000) {
-            decryptCount = 0;
-            windowStart = now;
-        }
-        decryptCount++;
-        if (decryptCount > limit) {
-            if (mode === 'fail_closed') {
-                triggerFailClosed(options?.onFailClosed);
-            }
-            else if (mode === 'warn') {
-                console.warn(`Vollcrypt Warning: Decryption rate limit exceeded. ${decryptCount} decryptions in the current window (limit: ${limit}).`);
-            }
+        else if (mode === 'warn') {
+            console.warn(`Vollcrypt Warning: Decryption rate limit exceeded for tenant "${tId}". ${state.decryptCount} decryptions in the current window (limit: ${limit}).`);
         }
     }
 }
 function checkPageSize(count, options) {
-    if (isFailClosed) {
-        throw new Error('Vollcrypt Security: Fail-Closed mode is active. Decryption blocked.');
-    }
     const context = exports.dbGuardContextStore.getStore();
+    const tId = context?.tenantId || 'global';
+    if (tenantFailClosed.get(tId)) {
+        throw new Error(`Vollcrypt Security: Fail-Closed mode is active for tenant "${tId}". Decryption blocked.`);
+    }
     const maxPageSize = context?.maxPageSize !== undefined
         ? context.maxPageSize
         : (options?.maxPageSize !== undefined ? options.maxPageSize : 250);
@@ -430,17 +451,19 @@ function checkPageSize(count, options) {
     }
     return 'ok';
 }
-function getFailClosedStatus() {
-    return isFailClosed;
+function getFailClosedStatus(tenantId) {
+    const tId = tenantId || exports.dbGuardContextStore.getStore()?.tenantId || 'global';
+    return tenantFailClosed.get(tId) || false;
 }
 function resetFailClosedStatusForTesting() {
-    isFailClosed = false;
-    decryptCount = 0;
-    windowStart = Date.now();
+    tenantFailClosed.clear();
+    tenantRateLimitStates.clear();
+    tenantKeys.clear();
 }
 let lastLogHash = '0'.repeat(64);
 let auditLogPath;
 let onAuditLogCallback;
+let auditWriteQueue = Promise.resolve();
 function configureAuditLogger(options) {
     if (options?.path) {
         auditLogPath = options.path;
@@ -470,6 +493,7 @@ function resetAuditLoggerForTesting() {
     lastLogHash = '0'.repeat(64);
     auditLogPath = undefined;
     onAuditLogCallback = undefined;
+    auditWriteQueue = Promise.resolve();
 }
 function logDecryption(model, field, recordId) {
     const context = exports.dbGuardContextStore.getStore();
@@ -497,12 +521,11 @@ function logDecryption(model, field, recordId) {
         }
     }
     if (auditLogPath) {
-        try {
-            fs.appendFileSync(auditLogPath, JSON.stringify(fullEntry) + '\n', 'utf8');
-        }
-        catch {
-            // prevent filesystem errors from throwing
-        }
+        const line = JSON.stringify(fullEntry) + '\n';
+        const currentPath = auditLogPath;
+        auditWriteQueue = auditWriteQueue.then(() => {
+            return fs.promises.appendFile(currentPath, line, 'utf8').catch(() => { });
+        });
     }
 }
 function decryptWithSecurity(stored, decryptRawFn, modelName, fieldName, recordId, options) {
@@ -543,7 +566,8 @@ function decryptWithSecurity(stored, decryptRawFn, modelName, fieldName, recordI
     return result;
 }
 exports.VERSION_ALGORITHMS = {
-    '1': '1'
+    '1': '1',
+    '2': '1'
 };
 exports.CRYPTO_ALGORITHMS = {
     '1': {
@@ -557,12 +581,135 @@ function parseCiphertext(stored) {
     const content = stored.slice('VOLLVALT:'.length);
     if (content.startsWith('v')) {
         const colon = content.indexOf(':');
-        if (colon === -1)
-            return null;
+        if (colon === -1) {
+            throw new Error("Vollcrypt Security: Malformed ciphertext format.");
+        }
         const versionPart = content.slice(1, colon);
         const base64Part = content.slice(colon + 1);
-        const algoId = exports.VERSION_ALGORITHMS[versionPart] || '1';
+        const algoId = exports.VERSION_ALGORITHMS[versionPart];
+        if (!algoId) {
+            throw new Error(`Vollcrypt Security: Deprecated or unsupported encryption version "v${versionPart}".`);
+        }
         return { algoId, version: versionPart, base64Data: base64Part };
     }
-    return null;
+    throw new Error("Vollcrypt Security: Legacy unversioned ciphertexts are deprecated and unsupported.");
+}
+/**
+ * Computes a hardened, frequency-resistant blind index for a database field.
+ */
+function computeBlindIndex(value, rootSalt, columnName) {
+    if (value === null || value === undefined)
+        return value;
+    const plaintext = typeof value === 'string' ? value : JSON.stringify(value);
+    const columnNameBuf = Buffer.from(columnName, 'utf8');
+    // 1. Derive column-specific key using HKDF-SHA256
+    const derivedColumnKey = deriveHkdf(rootSalt, null, columnNameBuf, 32);
+    try {
+        // 2. Compute the final blind index using the derived column key
+        const plaintextBuf = Buffer.from(plaintext, 'utf8');
+        const blindIndex = deriveHkdf(derivedColumnKey, null, plaintextBuf, 32);
+        return blindIndex.toString('hex');
+    }
+    finally {
+        // 3. RAM Security: Zeroize the derived key immediately (Anti-Core Dump)
+        derivedColumnKey.fill(0);
+    }
+}
+function encryptValue(val, key, version) {
+    if (val === null || val === undefined)
+        return val;
+    const context = exports.dbGuardContextStore.getStore();
+    const tId = context?.tenantId || 'global';
+    if (key.every(b => b === 0) || getFailClosedStatus(tId)) {
+        throw new Error(`Vollcrypt Security: Fail-Closed mode is active for tenant "${tId}". Encryption blocked.`);
+    }
+    const plaintext = typeof val === 'string' ? val : JSON.stringify(val);
+    const plaintextBuf = Buffer.from(plaintext, 'utf8');
+    const encrypted = exports.CRYPTO_ALGORITHMS['1'].encrypt(plaintextBuf, key);
+    // RAM Security: Zeroize the plaintext buffer immediately
+    plaintextBuf.fill(0);
+    return `VOLLVALT:v${version}:${encrypted.toString('base64')}`;
+}
+function decryptValue(stored, keys) {
+    if (typeof stored !== 'string') {
+        return stored;
+    }
+    const parsed = parseCiphertext(stored);
+    if (!parsed) {
+        return stored;
+    }
+    const { algoId, version, base64Data } = parsed;
+    const key = keys[version];
+    if (!key) {
+        throw new Error(`Decryption key version "${version}" not found in registered keys`);
+    }
+    if (key.every(b => b === 0)) {
+        throw new Error(`Vollcrypt Security: Decryption blocked. Key version "${version}" is zeroized due to a Fail-Closed event.`);
+    }
+    try {
+        const encryptedBuf = Buffer.from(base64Data, 'base64');
+        const decryptor = exports.CRYPTO_ALGORITHMS[algoId];
+        if (!decryptor) {
+            throw new Error(`Unsupported decryption algorithm ID "${algoId}"`);
+        }
+        const decrypted = decryptor.decrypt(encryptedBuf, key);
+        const plaintext = decrypted.toString('utf8');
+        // RAM Security: Zeroize the decrypted buffer
+        decrypted.fill(0);
+        try {
+            return JSON.parse(plaintext);
+        }
+        catch {
+            return plaintext;
+        }
+    }
+    catch (err) {
+        throw new Error(`Failed to decrypt field value: ${err.message}`);
+    }
+}
+function rewriteQueryWhere(where, fields, rootSalt, modelName) {
+    if (!where || typeof where !== 'object')
+        return;
+    for (const field of fields) {
+        if (where[field] !== undefined) {
+            const val = where[field];
+            const bidxField = `${field}_bidx`;
+            if (typeof val === 'string' || typeof val === 'number' || typeof val === 'boolean') {
+                where[bidxField] = computeBlindIndex(val, rootSalt, `${modelName}.${field}`);
+                delete where[field];
+            }
+            else if (val && typeof val === 'object') {
+                if (val.equals !== undefined) {
+                    where[bidxField] = {
+                        equals: computeBlindIndex(val.equals, rootSalt, `${modelName}.${field}`),
+                    };
+                    delete where[field];
+                }
+            }
+        }
+    }
+    // Recurse into compound logical operators
+    const operators = ['AND', 'OR', 'NOT'];
+    for (const op of operators) {
+        if (Array.isArray(where[op])) {
+            where[op].forEach((item) => rewriteQueryWhere(item, fields, rootSalt, modelName));
+        }
+        else if (where[op] && typeof where[op] === 'object') {
+            rewriteQueryWhere(where[op], fields, rootSalt, modelName);
+        }
+    }
+}
+function addBlindIndexes(data, fields, rootSalt, modelName) {
+    if (!data || typeof data !== 'object')
+        return;
+    if (Array.isArray(data)) {
+        data.forEach((item) => addBlindIndexes(item, fields, rootSalt, modelName));
+        return;
+    }
+    for (const field of fields) {
+        if (data[field] !== undefined && data[field] !== null) {
+            const bidxField = `${field}_bidx`;
+            data[bidxField] = computeBlindIndex(data[field], rootSalt, `${modelName}.${field}`);
+        }
+    }
 }

package/dist/typeorm.d.ts

@@ -1,4 +1,4 @@
-import { InsertEvent, UpdateEvent } from 'typeorm';
+import type { InsertEvent, UpdateEvent } from 'typeorm';
 import { RateLimiterOptions } from './security';
 export interface TypeOrmDbGuardOptions {
     key: Buffer | Record<string, Buffer>;