@vollcrypt/db-guard 0.9.0 → 0.9.1

package/dist/blind-index.js

@@ -1,28 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.computeBlindIndex = computeBlindIndex;
-const security_1 = require("./security");
-/**
- * Computes a hardened, frequency-resistant blind index for a database field.
- *
- * Uses HKDF-SHA256 to derive a unique column key from the root salt,
- * preventing cross-column frequency analysis. Zeroizes intermediate keys immediately.
- */
-function computeBlindIndex(value, rootSalt, columnName) {
-    if (value === null || value === undefined)
-        return value;
-    const plaintext = typeof value === 'string' ? value : JSON.stringify(value);
-    const columnNameBuf = Buffer.from(columnName, 'utf8');
-    // 1. Derive column-specific key using HKDF-SHA256
-    const derivedColumnKey = (0, security_1.deriveHkdf)(rootSalt, null, columnNameBuf, 32);
-    try {
-        // 2. Compute the final blind index using the derived column key
-        const plaintextBuf = Buffer.from(plaintext, 'utf8');
-        const blindIndex = (0, security_1.deriveHkdf)(derivedColumnKey, null, plaintextBuf, 32);
-        return blindIndex.toString('hex');
-    }
-    finally {
-        // 3. RAM Security: Zeroize the derived key immediately (Anti-Core Dump)
-        derivedColumnKey.fill(0);
-    }
-}
+exports.computeBlindIndex = void 0;
+var security_1 = require("./security");
+Object.defineProperty(exports, "computeBlindIndex", { enumerable: true, get: function () { return security_1.computeBlindIndex; } });

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const prisma_1 = require("./prisma");
+const security_1 = require("./security");
 function printProgressBar(current, total) {
     const percentage = Math.min(100, Math.floor((current / total) * 100));
     const barLength = 40;
@@ -138,7 +138,7 @@ async function migratePostgres(url, table, column, idCol, key, version, chunkSiz
             // 3. Encrypt and update each row
             for (const row of batchRes.rows) {
                 const rawVal = row[column];
-                const encryptedVal = (0, prisma_1.encryptValue)(rawVal, key, version);
+                const encryptedVal = (0, security_1.encryptValue)(rawVal, key, version);
                 await client.query(`UPDATE "${table}" SET "${column}" = $1 WHERE "${idCol}" = $2`, [encryptedVal, row[idCol]]);
                 processed++;
                 printProgressBar(processed, total);
@@ -190,7 +190,7 @@ async function migrateMongo(url, collectionName, field, idCol, key, version, chu
             }
             for (const doc of batch) {
                 const rawVal = doc[field];
-                const encryptedVal = (0, prisma_1.encryptValue)(rawVal, key, version);
+                const encryptedVal = (0, security_1.encryptValue)(rawVal, key, version);
                 await collection.updateOne({ [idCol]: doc[idCol] }, { $set: { [field]: encryptedVal } });
                 processed++;
                 printProgressBar(processed, total);

package/dist/drivers.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.wrapSqliteDatabase = wrapSqliteDatabase;
 exports.wrapOracleConnection = wrapOracleConnection;
-const prisma_js_1 = require("./prisma.js");
 const security_js_1 = require("./security.js");
 function getKeys(options) {
     let keys = {};
@@ -66,7 +65,7 @@ function decryptRow(row, table, keys, options) {
                 const val = row[i];
                 if (typeof val === 'string' && val.startsWith('VOLLVALT:')) {
                     try {
-                        cloned[i] = (0, security_js_1.decryptWithSecurity)(val, (v) => (0, prisma_js_1.decryptValue)(v, keys), table, `column_${i}`, undefined, options);
+                        cloned[i] = (0, security_js_1.decryptWithSecurity)(val, (v) => (0, security_js_1.decryptValue)(v, keys), table, `column_${i}`, undefined, options);
                     }
                     catch {
                         // Keep original on failure
@@ -80,7 +79,7 @@ function decryptRow(row, table, keys, options) {
             for (const [key, val] of Object.entries(row)) {
                 if (typeof val === 'string' && val.startsWith('VOLLVALT:')) {
                     try {
-                        cloned[key] = (0, security_js_1.decryptWithSecurity)(val, (v) => (0, prisma_js_1.decryptValue)(v, keys), table, key, row.id || row._id, options);
+                        cloned[key] = (0, security_js_1.decryptWithSecurity)(val, (v) => (0, security_js_1.decryptValue)(v, keys), table, key, row.id || row._id, options);
                     }
                     catch {
                         // Keep original on failure
@@ -114,7 +113,7 @@ function wrapSqliteDatabase(db, options) {
                 const arrayParams = params[0].map((param, index) => {
                     const colName = columns[index];
                     if (colName && fieldsToEncrypt.includes(colName)) {
-                        return (0, prisma_js_1.encryptValue)(param, activeKey, activeVersion);
+                        return (0, security_js_1.encryptValue)(param, activeKey, activeVersion);
                     }
                     return param;
                 });
@@ -127,7 +126,7 @@ function wrapSqliteDatabase(db, options) {
                     // Strip prefix character (@, :, $) if present
                     const cleanKey = key.replace(/^[@:$]/, '');
                     if (fieldsToEncrypt.includes(cleanKey)) {
-                        obj[key] = (0, prisma_js_1.encryptValue)(val, activeKey, activeVersion);
+                        obj[key] = (0, security_js_1.encryptValue)(val, activeKey, activeVersion);
                     }
                 }
                 return [obj];
@@ -136,7 +135,7 @@ function wrapSqliteDatabase(db, options) {
             return params.map((param, index) => {
                 const colName = columns[index];
                 if (colName && fieldsToEncrypt.includes(colName)) {
-                    return (0, prisma_js_1.encryptValue)(param, activeKey, activeVersion);
+                    return (0, security_js_1.encryptValue)(param, activeKey, activeVersion);
                 }
                 return param;
             });
@@ -192,7 +191,7 @@ function wrapOracleConnection(connection, options) {
                     processedBinds = bindParams.map((param, index) => {
                         const colName = columns[index];
                         if (colName && fieldsToEncrypt.includes(colName)) {
-                            return (0, prisma_js_1.encryptValue)(param, activeKey, activeVersion);
+                            return (0, security_js_1.encryptValue)(param, activeKey, activeVersion);
                         }
                         return param;
                     });
@@ -201,7 +200,7 @@ function wrapOracleConnection(connection, options) {
                     processedBinds = { ...bindParams };
                     for (const field of fieldsToEncrypt) {
                         if (processedBinds[field] !== undefined && processedBinds[field] !== null) {
-                            processedBinds[field] = (0, prisma_js_1.encryptValue)(processedBinds[field], activeKey, activeVersion);
+                            processedBinds[field] = (0, security_js_1.encryptValue)(processedBinds[field], activeKey, activeVersion);
                         }
                     }
                 }

package/dist/drizzle.js

@@ -1,11 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createDrizzleGuard = void 0;
-const pg_core_1 = require("drizzle-orm/pg-core");
-const mysql_core_1 = require("drizzle-orm/mysql-core");
-const sqlite_core_1 = require("drizzle-orm/sqlite-core");
-const prisma_1 = require("./prisma");
-const blind_index_1 = require("./blind-index");
 const security_1 = require("./security");
 function getKeys(options) {
     let keys;
@@ -24,6 +19,9 @@ function getKeys(options) {
     return { keys, activeVersion };
 }
 const createDrizzleGuard = (options) => {
+    const pgCustomType = require('drizzle-orm/pg-core').customType;
+    const mysqlCustomType = require('drizzle-orm/mysql-core').customType;
+    const sqliteCustomType = require('drizzle-orm/sqlite-core').customType;
     const { keys, activeVersion } = getKeys(options);
     const activeKey = keys[activeVersion];
     if (!activeKey) {
@@ -32,49 +30,49 @@ const createDrizzleGuard = (options) => {
     (0, security_1.registerKeysForZeroization)(keys);
     const rootSalt = options.blindIndexes?.rootSalt;
     return {
-        pgText: (name, columnPath) => (0, pg_core_1.customType)({
+        pgText: (name, columnPath) => pgCustomType({
             dataType() {
                 return 'text';
             },
             toDriver(value) {
-                return (0, prisma_1.encryptValue)(value, activeKey, activeVersion);
+                return (0, security_1.encryptValue)(value, activeKey, activeVersion);
             },
             fromDriver(value) {
                 const parts = columnPath?.split('.') || [name];
                 const mName = parts[0] || 'Model';
                 const fName = parts[1] || name;
-                return (0, security_1.decryptWithSecurity)(value, (val) => (0, prisma_1.decryptValue)(val, keys), mName, fName, undefined, options);
+                return (0, security_1.decryptWithSecurity)(value, (val) => (0, security_1.decryptValue)(val, keys), mName, fName, undefined, options);
             }
         })(name),
-        mysqlText: (name, columnPath) => (0, mysql_core_1.customType)({
+        mysqlText: (name, columnPath) => mysqlCustomType({
             dataType() {
                 return 'text';
             },
             toDriver(value) {
-                return (0, prisma_1.encryptValue)(value, activeKey, activeVersion);
+                return (0, security_1.encryptValue)(value, activeKey, activeVersion);
             },
             fromDriver(value) {
                 const parts = columnPath?.split('.') || [name];
                 const mName = parts[0] || 'Model';
                 const fName = parts[1] || name;
-                return (0, security_1.decryptWithSecurity)(value, (val) => (0, prisma_1.decryptValue)(val, keys), mName, fName, undefined, options);
+                return (0, security_1.decryptWithSecurity)(value, (val) => (0, security_1.decryptValue)(val, keys), mName, fName, undefined, options);
             }
         })(name),
-        sqliteText: (name, columnPath) => (0, sqlite_core_1.customType)({
+        sqliteText: (name, columnPath) => sqliteCustomType({
             dataType() {
                 return 'text';
             },
             toDriver(value) {
-                return (0, prisma_1.encryptValue)(value, activeKey, activeVersion);
+                return (0, security_1.encryptValue)(value, activeKey, activeVersion);
             },
             fromDriver(value) {
                 const parts = columnPath?.split('.') || [name];
                 const mName = parts[0] || 'Model';
                 const fName = parts[1] || name;
-                return (0, security_1.decryptWithSecurity)(value, (val) => (0, prisma_1.decryptValue)(val, keys), mName, fName, undefined, options);
+                return (0, security_1.decryptWithSecurity)(value, (val) => (0, security_1.decryptValue)(val, keys), mName, fName, undefined, options);
             }
         })(name),
-        pgBlindIndex: (name, columnName) => (0, pg_core_1.customType)({
+        pgBlindIndex: (name, columnName) => pgCustomType({
             dataType() {
                 return 'text';
             },
@@ -82,13 +80,13 @@ const createDrizzleGuard = (options) => {
                 if (!rootSalt) {
                     throw new Error('Blind index root salt is not configured in Drizzle guard options.');
                 }
-                return (0, blind_index_1.computeBlindIndex)(value, rootSalt, columnName);
+                return (0, security_1.computeBlindIndex)(value, rootSalt, columnName);
             },
             fromDriver(value) {
                 return value;
             }
         })(name),
-        mysqlBlindIndex: (name, columnName) => (0, mysql_core_1.customType)({
+        mysqlBlindIndex: (name, columnName) => mysqlCustomType({
             dataType() {
                 return 'text';
             },
@@ -96,13 +94,13 @@ const createDrizzleGuard = (options) => {
                 if (!rootSalt) {
                     throw new Error('Blind index root salt is not configured in Drizzle guard options.');
                 }
-                return (0, blind_index_1.computeBlindIndex)(value, rootSalt, columnName);
+                return (0, security_1.computeBlindIndex)(value, rootSalt, columnName);
             },
             fromDriver(value) {
                 return value;
             }
         })(name),
-        sqliteBlindIndex: (name, columnName) => (0, sqlite_core_1.customType)({
+        sqliteBlindIndex: (name, columnName) => sqliteCustomType({
             dataType() {
                 return 'text';
             },
@@ -110,7 +108,7 @@ const createDrizzleGuard = (options) => {
                 if (!rootSalt) {
                     throw new Error('Blind index root salt is not configured in Drizzle guard options.');
                 }
-                return (0, blind_index_1.computeBlindIndex)(value, rootSalt, columnName);
+                return (0, security_1.computeBlindIndex)(value, rootSalt, columnName);
             },
             fromDriver(value) {
                 return value;

package/dist/index.d.ts

@@ -1,9 +1,5 @@
-export { prismaDbGuard, PrismaDbGuardOptions, encryptValue, decryptValue, resolveKeys } from './prisma';
-export { mongooseDbGuard, MongooseDbGuardOptions } from './mongoose';
-export { createDrizzleGuard } from './drizzle';
-export { createTypeOrmSubscriber } from './typeorm';
 export { wrapSqliteDatabase, wrapOracleConnection, DbGuardDriverOptions } from './drivers';
-export { KmsProvider, AwsKmsProvider, GcpKmsProvider, VaultKmsProvider, unwrapDekLocal, Pkcs11KmsProvider } from './kms';
+export { KmsProvider, AwsKmsProvider, GcpKmsProvider, VaultKmsProvider, unwrapDekLocal, Pkcs11KmsProvider, resolveKeys, DbGuardKeysOptions } from './kms';
 export { computeBlindIndex } from './blind-index';
-export { dbGuardContextStore, configureAuditLogger, decryptWithSecurity, checkRateLimit, checkPageSize, resetFailClosedStatusForTesting, resetAuditLoggerForTesting, getCachedKey, setCachedKey, resetSecureKeyCacheForTesting, configureBreakGlass, deactivateBreakGlass, isBreakGlassActive, getBreakGlassKey, activateBreakGlass, parseCiphertext, CRYPTO_ALGORITHMS, VERSION_ALGORITHMS, maskValue } from './security';
+export { dbGuardContextStore, configureAuditLogger, decryptWithSecurity, checkRateLimit, checkPageSize, resetFailClosedStatusForTesting, resetAuditLoggerForTesting, getCachedKey, setCachedKey, resetSecureKeyCacheForTesting, configureBreakGlass, deactivateBreakGlass, isBreakGlassActive, getBreakGlassKey, activateBreakGlass, parseCiphertext, CRYPTO_ALGORITHMS, VERSION_ALGORITHMS, maskValue, encryptValue, decryptValue } from './security';
 export { auditConfiguration, generateComplianceHtmlReport, ComplianceAuditInput, ComplianceScorecard } from './compliance';

package/dist/index.js

@@ -1,17 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateComplianceHtmlReport = exports.auditConfiguration = exports.maskValue = exports.VERSION_ALGORITHMS = exports.CRYPTO_ALGORITHMS = exports.parseCiphertext = exports.activateBreakGlass = exports.getBreakGlassKey = exports.isBreakGlassActive = exports.deactivateBreakGlass = exports.configureBreakGlass = exports.resetSecureKeyCacheForTesting = exports.setCachedKey = exports.getCachedKey = exports.resetAuditLoggerForTesting = exports.resetFailClosedStatusForTesting = exports.checkPageSize = exports.checkRateLimit = exports.decryptWithSecurity = exports.configureAuditLogger = exports.dbGuardContextStore = exports.computeBlindIndex = exports.Pkcs11KmsProvider = exports.unwrapDekLocal = exports.VaultKmsProvider = exports.GcpKmsProvider = exports.AwsKmsProvider = exports.wrapOracleConnection = exports.wrapSqliteDatabase = exports.createTypeOrmSubscriber = exports.createDrizzleGuard = exports.mongooseDbGuard = exports.resolveKeys = exports.decryptValue = exports.encryptValue = exports.prismaDbGuard = void 0;
-var prisma_1 = require("./prisma");
-Object.defineProperty(exports, "prismaDbGuard", { enumerable: true, get: function () { return prisma_1.prismaDbGuard; } });
-Object.defineProperty(exports, "encryptValue", { enumerable: true, get: function () { return prisma_1.encryptValue; } });
-Object.defineProperty(exports, "decryptValue", { enumerable: true, get: function () { return prisma_1.decryptValue; } });
-Object.defineProperty(exports, "resolveKeys", { enumerable: true, get: function () { return prisma_1.resolveKeys; } });
-var mongoose_1 = require("./mongoose");
-Object.defineProperty(exports, "mongooseDbGuard", { enumerable: true, get: function () { return mongoose_1.mongooseDbGuard; } });
-var drizzle_1 = require("./drizzle");
-Object.defineProperty(exports, "createDrizzleGuard", { enumerable: true, get: function () { return drizzle_1.createDrizzleGuard; } });
-var typeorm_1 = require("./typeorm");
-Object.defineProperty(exports, "createTypeOrmSubscriber", { enumerable: true, get: function () { return typeorm_1.createTypeOrmSubscriber; } });
+exports.generateComplianceHtmlReport = exports.auditConfiguration = exports.decryptValue = exports.encryptValue = exports.maskValue = exports.VERSION_ALGORITHMS = exports.CRYPTO_ALGORITHMS = exports.parseCiphertext = exports.activateBreakGlass = exports.getBreakGlassKey = exports.isBreakGlassActive = exports.deactivateBreakGlass = exports.configureBreakGlass = exports.resetSecureKeyCacheForTesting = exports.setCachedKey = exports.getCachedKey = exports.resetAuditLoggerForTesting = exports.resetFailClosedStatusForTesting = exports.checkPageSize = exports.checkRateLimit = exports.decryptWithSecurity = exports.configureAuditLogger = exports.dbGuardContextStore = exports.computeBlindIndex = exports.resolveKeys = exports.Pkcs11KmsProvider = exports.unwrapDekLocal = exports.VaultKmsProvider = exports.GcpKmsProvider = exports.AwsKmsProvider = exports.wrapOracleConnection = exports.wrapSqliteDatabase = void 0;
 var drivers_1 = require("./drivers");
 Object.defineProperty(exports, "wrapSqliteDatabase", { enumerable: true, get: function () { return drivers_1.wrapSqliteDatabase; } });
 Object.defineProperty(exports, "wrapOracleConnection", { enumerable: true, get: function () { return drivers_1.wrapOracleConnection; } });
@@ -21,6 +10,7 @@ Object.defineProperty(exports, "GcpKmsProvider", { enumerable: true, get: functi
 Object.defineProperty(exports, "VaultKmsProvider", { enumerable: true, get: function () { return kms_1.VaultKmsProvider; } });
 Object.defineProperty(exports, "unwrapDekLocal", { enumerable: true, get: function () { return kms_1.unwrapDekLocal; } });
 Object.defineProperty(exports, "Pkcs11KmsProvider", { enumerable: true, get: function () { return kms_1.Pkcs11KmsProvider; } });
+Object.defineProperty(exports, "resolveKeys", { enumerable: true, get: function () { return kms_1.resolveKeys; } });
 var blind_index_1 = require("./blind-index");
 Object.defineProperty(exports, "computeBlindIndex", { enumerable: true, get: function () { return blind_index_1.computeBlindIndex; } });
 var security_1 = require("./security");
@@ -43,6 +33,8 @@ Object.defineProperty(exports, "parseCiphertext", { enumerable: true, get: funct
 Object.defineProperty(exports, "CRYPTO_ALGORITHMS", { enumerable: true, get: function () { return security_1.CRYPTO_ALGORITHMS; } });
 Object.defineProperty(exports, "VERSION_ALGORITHMS", { enumerable: true, get: function () { return security_1.VERSION_ALGORITHMS; } });
 Object.defineProperty(exports, "maskValue", { enumerable: true, get: function () { return security_1.maskValue; } });
+Object.defineProperty(exports, "encryptValue", { enumerable: true, get: function () { return security_1.encryptValue; } });
+Object.defineProperty(exports, "decryptValue", { enumerable: true, get: function () { return security_1.decryptValue; } });
 var compliance_1 = require("./compliance");
 Object.defineProperty(exports, "auditConfiguration", { enumerable: true, get: function () { return compliance_1.auditConfiguration; } });
 Object.defineProperty(exports, "generateComplianceHtmlReport", { enumerable: true, get: function () { return compliance_1.generateComplianceHtmlReport; } });

package/dist/kms.d.ts

@@ -44,3 +44,13 @@ export declare class Pkcs11KmsProvider implements KmsProvider {
     });
     decrypt(ciphertext: Buffer): Promise<Buffer>;
 }
+export interface DbGuardKeysOptions {
+    key?: Buffer | Record<string, Buffer>;
+    kms?: {
+        provider: KmsProvider;
+        wrappedKey: Buffer | Record<string, Buffer>;
+        wrappedKek?: Buffer | Record<string, Buffer>;
+        activeKeyVersion?: string;
+    };
+}
+export declare function resolveKeys(options: DbGuardKeysOptions): Promise<Record<string, Buffer>>;

package/dist/kms.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Pkcs11KmsProvider = exports.VaultKmsProvider = exports.GcpKmsProvider = exports.AwsKmsProvider = void 0;
 exports.unwrapDekLocal = unwrapDekLocal;
+exports.resolveKeys = resolveKeys;
 const security_1 = require("./security");
 class AwsKmsProvider {
     config;
@@ -158,3 +159,52 @@ class Pkcs11KmsProvider {
     }
 }
 exports.Pkcs11KmsProvider = Pkcs11KmsProvider;
+async function resolveKeys(options) {
+    let rawKeys = {};
+    if (options.key) {
+        if (Buffer.isBuffer(options.key)) {
+            rawKeys = { '1': options.key };
+        }
+        else {
+            rawKeys = { ...options.key };
+        }
+    }
+    else if (options.kms) {
+        const { provider, wrappedKey, wrappedKek } = options.kms;
+        if (Buffer.isBuffer(wrappedKey)) {
+            if (wrappedKek && Buffer.isBuffer(wrappedKek)) {
+                const unwrappedKek = await provider.decrypt(wrappedKek);
+                const dek = unwrapDekLocal(wrappedKey, unwrappedKek);
+                unwrappedKek.fill(0); // RAM Security: zeroize KEK immediately
+                rawKeys = { '1': dek };
+            }
+            else {
+                const key = await provider.decrypt(wrappedKey);
+                rawKeys = { '1': key };
+            }
+        }
+        else {
+            for (const [ver, wrapped] of Object.entries(wrappedKey)) {
+                if (wrappedKek) {
+                    const wKek = Buffer.isBuffer(wrappedKek) ? wrappedKek : wrappedKek[ver];
+                    if (wKek) {
+                        const unwrappedKek = await provider.decrypt(wKek);
+                        const dek = unwrapDekLocal(wrapped, unwrappedKek);
+                        unwrappedKek.fill(0); // RAM Security: zeroize KEK immediately
+                        rawKeys[ver] = dek;
+                    }
+                    else {
+                        rawKeys[ver] = await provider.decrypt(wrapped);
+                    }
+                }
+                else {
+                    rawKeys[ver] = await provider.decrypt(wrapped);
+                }
+            }
+        }
+    }
+    else {
+        throw new Error("Either 'key' or 'kms' configuration must be provided.");
+    }
+    return rawKeys;
+}

package/dist/mongoose.d.ts

@@ -1,4 +1,4 @@
-import { Schema } from 'mongoose';
+import type { Schema } from 'mongoose';
 import { RateLimiterOptions } from './security';
 export interface MongooseDbGuardOptions {
     key: Buffer | Record<string, Buffer>;

package/dist/mongoose.js

@@ -1,8 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.mongooseDbGuard = mongooseDbGuard;
-const prisma_1 = require("./prisma");
-const blind_index_1 = require("./blind-index");
+const kms_1 = require("./kms");
 const security_1 = require("./security");
 function mongooseDbGuard(schema, options) {
     const { fields } = options;
@@ -58,7 +57,7 @@ function mongooseDbGuard(schema, options) {
             if (!tenantConfig) {
                 throw new Error(`Vollcrypt Security: Configuration not found for tenantId "${tId}".`);
             }
-            const resolvedTenantKeysRaw = await (0, prisma_1.resolveKeys)({
+            const resolvedTenantKeysRaw = await (0, kms_1.resolveKeys)({
                 ...options,
                 key: tenantConfig.key,
                 kms: tenantConfig.kms
@@ -89,7 +88,7 @@ function mongooseDbGuard(schema, options) {
             // 1. Encrypt fields
             for (const field of fields) {
                 if (doc.isModified(field) && doc[field] !== undefined && doc[field] !== null) {
-                    doc[field] = (0, prisma_1.encryptValue)(doc[field], resolved.activeKey, resolved.activeVersion);
+                    doc[field] = (0, security_1.encryptValue)(doc[field], resolved.activeKey, resolved.activeVersion);
                 }
             }
             // 2. Compute blind indexes
@@ -99,9 +98,9 @@ function mongooseDbGuard(schema, options) {
                         const bidxField = `${field}_bidx`;
                         // Decrypt temporary value if it was already encrypted in the previous step
                         const rawVal = doc.isModified(field) && doc[field].startsWith('VOLLVALT:')
-                            ? (0, prisma_1.decryptValue)(doc[field], keys)
+                            ? (0, security_1.decryptValue)(doc[field], keys)
                             : doc[field];
-                        doc[bidxField] = (0, blind_index_1.computeBlindIndex)(rawVal, options.blindIndexes.rootSalt, `${modelName}.${field}`);
+                        doc[bidxField] = (0, security_1.computeBlindIndex)(rawVal, options.blindIndexes.rootSalt, `${modelName}.${field}`);
                     }
                 }
             }
@@ -138,9 +137,9 @@ function mongooseDbGuard(schema, options) {
                 if (obj[currentPart] !== undefined && obj[currentPart] !== null) {
                     if (options.blindIndexes && options.blindIndexes.fields.includes(fullPath) && options.blindIndexes.rootSalt) {
                         const bidxField = `${currentPart}_bidx`;
-                        obj[bidxField] = (0, blind_index_1.computeBlindIndex)(obj[currentPart], options.blindIndexes.rootSalt, `${modelName}.${fullPath}`);
+                        obj[bidxField] = (0, security_1.computeBlindIndex)(obj[currentPart], options.blindIndexes.rootSalt, `${modelName}.${fullPath}`);
                     }
-                    obj[currentPart] = (0, prisma_1.encryptValue)(obj[currentPart], encKey, encVer);
+                    obj[currentPart] = (0, security_1.encryptValue)(obj[currentPart], encKey, encVer);
                 }
             }
             else {
@@ -151,9 +150,9 @@ function mongooseDbGuard(schema, options) {
                 if (obj[dotNotatedPath] !== undefined && obj[dotNotatedPath] !== null) {
                     if (options.blindIndexes && options.blindIndexes.fields.includes(fullPath) && options.blindIndexes.rootSalt) {
                         const bidxField = `${dotNotatedPath}_bidx`;
-                        obj[bidxField] = (0, blind_index_1.computeBlindIndex)(obj[dotNotatedPath], options.blindIndexes.rootSalt, `${modelName}.${fullPath}`);
+                        obj[bidxField] = (0, security_1.computeBlindIndex)(obj[dotNotatedPath], options.blindIndexes.rootSalt, `${modelName}.${fullPath}`);
                     }
-                    obj[dotNotatedPath] = (0, prisma_1.encryptValue)(obj[dotNotatedPath], encKey, encVer);
+                    obj[dotNotatedPath] = (0, security_1.encryptValue)(obj[dotNotatedPath], encKey, encVer);
                 }
             }
         };
@@ -188,7 +187,7 @@ function mongooseDbGuard(schema, options) {
                 // 2. Process query criteria (rewrite exact match search queries on conditions)
                 const conditions = typeof query.getQuery === 'function' ? query.getQuery() : null;
                 if (conditions && options.blindIndexes && options.blindIndexes.rootSalt) {
-                    (0, prisma_1.rewriteQueryWhere)(conditions, options.blindIndexes.fields, options.blindIndexes.rootSalt, modelName);
+                    (0, security_1.rewriteQueryWhere)(conditions, options.blindIndexes.fields, options.blindIndexes.rootSalt, modelName);
                 }
                 if (typeof next === 'function') {
                     next();
@@ -220,7 +219,7 @@ function mongooseDbGuard(schema, options) {
             const modelName = options.blindIndexes?.modelName || query.model?.modelName || 'Model';
             const conditions = typeof query.getQuery === 'function' ? query.getQuery() : null;
             if (conditions && options.blindIndexes && options.blindIndexes.rootSalt) {
-                (0, prisma_1.rewriteQueryWhere)(conditions, options.blindIndexes.fields, options.blindIndexes.rootSalt, modelName);
+                (0, security_1.rewriteQueryWhere)(conditions, options.blindIndexes.fields, options.blindIndexes.rootSalt, modelName);
             }
             next();
         });
@@ -232,7 +231,7 @@ function mongooseDbGuard(schema, options) {
         for (const field of fields) {
             if (doc[field] !== undefined && doc[field] !== null) {
                 try {
-                    doc[field] = (0, security_1.decryptWithSecurity)(doc[field], (val) => (0, prisma_1.decryptValue)(val, decKeys), modelName, field, doc.id || doc._id, options);
+                    doc[field] = (0, security_1.decryptWithSecurity)(doc[field], (val) => (0, security_1.decryptValue)(val, decKeys), modelName, field, doc.id || doc._id, options);
                 }
                 catch (err) {
                     throw new Error(`Mongoose db-guard failed to decrypt field "${field}": ${err.message}`);

package/dist/prisma.d.ts

@@ -1,13 +1,6 @@
-import { KmsProvider } from './kms';
+import { DbGuardKeysOptions } from './kms';
 import { RateLimiterOptions } from './security';
-export interface PrismaDbGuardOptions {
-    key?: Buffer | Record<string, Buffer>;
-    kms?: {
-        provider: KmsProvider;
-        wrappedKey: Buffer | Record<string, Buffer>;
-        wrappedKek?: Buffer | Record<string, Buffer>;
-        activeKeyVersion?: string;
-    };
+export interface PrismaDbGuardOptions extends DbGuardKeysOptions {
     models: Record<string, string[]>;
     blindIndexes?: {
         rootSalt: Buffer;
@@ -31,24 +24,11 @@ export interface PrismaDbGuardOptions {
         } | undefined>;
     };
 }
-/**
- * Resolves the plaintext keys asynchronously from local config or KMS provider.
- */
-export declare function resolveKeys(options: PrismaDbGuardOptions): Promise<Record<string, Buffer>>;
-export declare function encryptValue(val: any, key: Buffer, version: string): string;
-export declare function decryptValue(stored: any, keys: Record<string, Buffer>): any;
-/**
- * Traverses query `where` arguments to rewrite exact match queries on encrypted fields
- * to target shadow `_bidx` columns using dynamic HKDF-SHA256 blind indexing.
- */
-export declare function rewriteQueryWhere(where: any, fields: string[], rootSalt: Buffer, modelName: string): void;
-/**
- * Appends calculated blind indexes to the write payload (create/update).
- */
-export declare function addBlindIndexes(data: any, fields: string[], rootSalt: Buffer, modelName: string): void;
 /**
  * Prisma DbGuard Extension Factory
  *
  * Bootstraps client-level field encryption, query translation, and automatic decryption.
  */
 export declare const prismaDbGuard: (options: PrismaDbGuardOptions, resolvedKeys?: Record<string, Buffer>) => (client: any) => import("@prisma/client").PrismaClientExtends<import("@prisma/client/runtime/library").InternalArgs<{}, {}, {}, {}> & import("@prisma/client/runtime/library").DefaultArgs>;
+export { encryptValue, decryptValue, rewriteQueryWhere, addBlindIndexes } from './security';
+export { resolveKeys } from './kms';