@vollcrypt/db-guard 0.9.0 → 0.9.1

package/dist/prisma.js

@@ -1,172 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.prismaDbGuard = void 0;
-exports.resolveKeys = resolveKeys;
-exports.encryptValue = encryptValue;
-exports.decryptValue = decryptValue;
-exports.rewriteQueryWhere = rewriteQueryWhere;
-exports.addBlindIndexes = addBlindIndexes;
-const client_1 = require("@prisma/client");
-const blind_index_1 = require("./blind-index");
+exports.resolveKeys = exports.addBlindIndexes = exports.rewriteQueryWhere = exports.decryptValue = exports.encryptValue = exports.prismaDbGuard = void 0;
 const kms_1 = require("./kms");
 const security_1 = require("./security");
-/**
- * Resolves the plaintext keys asynchronously from local config or KMS provider.
- */
-async function resolveKeys(options) {
-    let rawKeys = {};
-    if (options.key) {
-        if (Buffer.isBuffer(options.key)) {
-            rawKeys = { '1': options.key };
-        }
-        else {
-            rawKeys = { ...options.key };
-        }
-    }
-    else if (options.kms) {
-        const { provider, wrappedKey, wrappedKek } = options.kms;
-        if (Buffer.isBuffer(wrappedKey)) {
-            if (wrappedKek && Buffer.isBuffer(wrappedKek)) {
-                const unwrappedKek = await provider.decrypt(wrappedKek);
-                const dek = (0, kms_1.unwrapDekLocal)(wrappedKey, unwrappedKek);
-                unwrappedKek.fill(0); // RAM Security: zeroize KEK immediately
-                rawKeys = { '1': dek };
-            }
-            else {
-                const key = await provider.decrypt(wrappedKey);
-                rawKeys = { '1': key };
-            }
-        }
-        else {
-            for (const [ver, wrapped] of Object.entries(wrappedKey)) {
-                if (wrappedKek) {
-                    const wKek = Buffer.isBuffer(wrappedKek) ? wrappedKek : wrappedKek[ver];
-                    if (wKek) {
-                        const unwrappedKek = await provider.decrypt(wKek);
-                        const dek = (0, kms_1.unwrapDekLocal)(wrapped, unwrappedKek);
-                        unwrappedKek.fill(0); // RAM Security: zeroize KEK immediately
-                        rawKeys[ver] = dek;
-                    }
-                    else {
-                        rawKeys[ver] = await provider.decrypt(wrapped);
-                    }
-                }
-                else {
-                    rawKeys[ver] = await provider.decrypt(wrapped);
-                }
-            }
-        }
-    }
-    else {
-        throw new Error("Either 'key' or 'kms' configuration must be provided.");
-    }
-    return rawKeys;
-}
-function encryptValue(val, key, version) {
-    if (val === null || val === undefined)
-        return val;
-    const context = security_1.dbGuardContextStore.getStore();
-    const tId = context?.tenantId || 'global';
-    if (key.every(b => b === 0) || (0, security_1.getFailClosedStatus)(tId)) {
-        throw new Error(`Vollcrypt Security: Fail-Closed mode is active for tenant "${tId}". Encryption blocked.`);
-    }
-    const plaintext = typeof val === 'string' ? val : JSON.stringify(val);
-    const plaintextBuf = Buffer.from(plaintext, 'utf8');
-    const encrypted = security_1.CRYPTO_ALGORITHMS['1'].encrypt(plaintextBuf, key);
-    // RAM Security: Zeroize the plaintext buffer immediately
-    plaintextBuf.fill(0);
-    return `VOLLVALT:v${version}:${encrypted.toString('base64')}`;
-}
-function decryptValue(stored, keys) {
-    if (typeof stored !== 'string') {
-        return stored;
-    }
-    const parsed = (0, security_1.parseCiphertext)(stored);
-    if (!parsed) {
-        return stored;
-    }
-    const { algoId, version, base64Data } = parsed;
-    const key = keys[version];
-    if (!key) {
-        throw new Error(`Decryption key version "${version}" not found in registered keys`);
-    }
-    if (key.every(b => b === 0)) {
-        throw new Error(`Vollcrypt Security: Decryption blocked. Key version "${version}" is zeroized due to a Fail-Closed event.`);
-    }
-    try {
-        const encryptedBuf = Buffer.from(base64Data, 'base64');
-        const decryptor = security_1.CRYPTO_ALGORITHMS[algoId];
-        if (!decryptor) {
-            throw new Error(`Unsupported decryption algorithm ID "${algoId}"`);
-        }
-        const decrypted = decryptor.decrypt(encryptedBuf, key);
-        const plaintext = decrypted.toString('utf8');
-        // RAM Security: Zeroize the decrypted buffer
-        decrypted.fill(0);
-        try {
-            return JSON.parse(plaintext);
-        }
-        catch {
-            return plaintext;
-        }
-    }
-    catch (err) {
-        throw new Error(`Failed to decrypt field value: ${err.message}`);
-    }
-}
-/**
- * Traverses query `where` arguments to rewrite exact match queries on encrypted fields
- * to target shadow `_bidx` columns using dynamic HKDF-SHA256 blind indexing.
- */
-function rewriteQueryWhere(where, fields, rootSalt, modelName) {
-    if (!where || typeof where !== 'object')
-        return;
-    for (const field of fields) {
-        if (where[field] !== undefined) {
-            const val = where[field];
-            const bidxField = `${field}_bidx`;
-            if (typeof val === 'string' || typeof val === 'number' || typeof val === 'boolean') {
-                where[bidxField] = (0, blind_index_1.computeBlindIndex)(val, rootSalt, `${modelName}.${field}`);
-                delete where[field];
-            }
-            else if (val && typeof val === 'object') {
-                if (val.equals !== undefined) {
-                    where[bidxField] = {
-                        equals: (0, blind_index_1.computeBlindIndex)(val.equals, rootSalt, `${modelName}.${field}`),
-                    };
-                    delete where[field];
-                }
-            }
-        }
-    }
-    // Recurse into compound logical operators
-    const operators = ['AND', 'OR', 'NOT'];
-    for (const op of operators) {
-        if (Array.isArray(where[op])) {
-            where[op].forEach((item) => rewriteQueryWhere(item, fields, rootSalt, modelName));
-        }
-        else if (where[op] && typeof where[op] === 'object') {
-            rewriteQueryWhere(where[op], fields, rootSalt, modelName);
-        }
-    }
-}
-/**
- * Appends calculated blind indexes to the write payload (create/update).
- */
-function addBlindIndexes(data, fields, rootSalt, modelName) {
-    if (!data || typeof data !== 'object')
-        return;
-    if (Array.isArray(data)) {
-        data.forEach((item) => addBlindIndexes(item, fields, rootSalt, modelName));
-        return;
-    }
-    for (const field of fields) {
-        if (data[field] !== undefined && data[field] !== null) {
-            const bidxField = `${field}_bidx`;
-            data[bidxField] = (0, blind_index_1.computeBlindIndex)(data[field], rootSalt, `${modelName}.${field}`);
-        }
-    }
-}
 /**
  * Prisma DbGuard Extension Factory
  *
@@ -236,7 +72,7 @@ const prismaDbGuard = (options, resolvedKeys) => {
         if (!tenantConfig) {
             throw new Error(`Vollcrypt Security: Configuration not found for tenantId "${tId}".`);
         }
-        const resolvedTenantKeysRaw = await resolveKeys({
+        const resolvedTenantKeysRaw = await (0, kms_1.resolveKeys)({
             ...options,
             key: tenantConfig.key,
             kms: tenantConfig.kms
@@ -263,7 +99,7 @@ const prismaDbGuard = (options, resolvedKeys) => {
         const cloned = { ...data };
         for (const field of fieldsToEncrypt) {
             if (cloned[field] !== undefined) {
-                cloned[field] = encryptValue(cloned[field], encKey, encVer);
+                cloned[field] = (0, security_1.encryptValue)(cloned[field], encKey, encVer);
             }
         }
         return cloned;
@@ -287,7 +123,7 @@ const prismaDbGuard = (options, resolvedKeys) => {
         const cloned = { ...result };
         for (const field of fieldsToEncrypt) {
             if (cloned[field] !== undefined) {
-                cloned[field] = (0, security_1.decryptWithSecurity)(cloned[field], (val) => decryptValue(val, decKeys), modelName, field, cloned.id || cloned._id, options);
+                cloned[field] = (0, security_1.decryptWithSecurity)(cloned[field], (val) => (0, security_1.decryptValue)(val, decKeys), modelName, field, cloned.id || cloned._id, options);
             }
         }
         return cloned;
@@ -309,13 +145,13 @@ const prismaDbGuard = (options, resolvedKeys) => {
         const bidxFields = options.blindIndexes?.models[modelName];
         if (bidxFields && options.blindIndexes?.rootSalt) {
             if (args.data) {
-                addBlindIndexes(args.data, bidxFields, options.blindIndexes.rootSalt, modelName);
+                (0, security_1.addBlindIndexes)(args.data, bidxFields, options.blindIndexes.rootSalt, modelName);
             }
             if (args.create) {
-                addBlindIndexes(args.create, bidxFields, options.blindIndexes.rootSalt, modelName);
+                (0, security_1.addBlindIndexes)(args.create, bidxFields, options.blindIndexes.rootSalt, modelName);
             }
             if (args.update) {
-                addBlindIndexes(args.update, bidxFields, options.blindIndexes.rootSalt, modelName);
+                (0, security_1.addBlindIndexes)(args.update, bidxFields, options.blindIndexes.rootSalt, modelName);
             }
         }
     };
@@ -325,10 +161,11 @@ const prismaDbGuard = (options, resolvedKeys) => {
         // Rewrite queries targeting encrypted columns to use the blind index column
         const bidxFields = options.blindIndexes?.models[modelName];
         if (bidxFields && options.blindIndexes?.rootSalt && args.where) {
-            rewriteQueryWhere(args.where, bidxFields, options.blindIndexes.rootSalt, modelName);
+            (0, security_1.rewriteQueryWhere)(args.where, bidxFields, options.blindIndexes.rootSalt, modelName);
         }
     };
-    return client_1.Prisma.defineExtension((client) => {
+    const { Prisma } = require('@prisma/client');
+    return Prisma.defineExtension((client) => {
         return client.$extends({
             name: 'vollcrypt-db-guard',
             query: {
@@ -349,7 +186,7 @@ const prismaDbGuard = (options, resolvedKeys) => {
                                     const encrypted = encryptPayload(model, item, resolved.activeKey, resolved.activeVersion);
                                     const bidxFields = options.blindIndexes?.models[model];
                                     if (bidxFields && options.blindIndexes?.rootSalt) {
-                                        addBlindIndexes(encrypted, bidxFields, options.blindIndexes.rootSalt, model);
+                                        (0, security_1.addBlindIndexes)(encrypted, bidxFields, options.blindIndexes.rootSalt, model);
                                     }
                                     return encrypted;
                                 });
@@ -412,3 +249,10 @@ const prismaDbGuard = (options, resolvedKeys) => {
     });
 };
 exports.prismaDbGuard = prismaDbGuard;
+var security_2 = require("./security");
+Object.defineProperty(exports, "encryptValue", { enumerable: true, get: function () { return security_2.encryptValue; } });
+Object.defineProperty(exports, "decryptValue", { enumerable: true, get: function () { return security_2.decryptValue; } });
+Object.defineProperty(exports, "rewriteQueryWhere", { enumerable: true, get: function () { return security_2.rewriteQueryWhere; } });
+Object.defineProperty(exports, "addBlindIndexes", { enumerable: true, get: function () { return security_2.addBlindIndexes; } });
+var kms_2 = require("./kms");
+Object.defineProperty(exports, "resolveKeys", { enumerable: true, get: function () { return kms_2.resolveKeys; } });

package/dist/provenance.json

@@ -4,13 +4,13 @@
     {
       "name": "dist/blind-index.d.ts",
       "digest": {
-        "sha256": "7e613b58cf47bc14d647cfbfa2a9cc0f9e805dbab7562daa00ac679c30830ba7"
+        "sha256": "54df5b23b93c61111ba6124b9557fb4fe3f5e4af8ef18d1aeb5477826679363f"
       }
     },
     {
       "name": "dist/blind-index.js",
       "digest": {
-        "sha256": "83364c9d2a86d43f775f15537ee10bdfb8e06c852adceb5b3c7358bcfc412907"
+        "sha256": "d417966c32408676efa5399b6e960b68d6015d66837b9b2bad9fa0bb9396b4be"
       }
     },
     {
@@ -22,7 +22,7 @@
     {
       "name": "dist/cli.js",
       "digest": {
-        "sha256": "bf91d9b9d820796590d8b030e409031623d177e45cc487da8bcb66af13078ec0"
+        "sha256": "33c313c9195a9e00099652c3e8fac9eac169ac3b94088222fbe97e7a2e51442a"
       }
     },
     {
@@ -46,7 +46,7 @@
     {
       "name": "dist/drivers.js",
       "digest": {
-        "sha256": "4b418fae086ee440bd1c9fe99328c86923ab83467ecfb70fd9bb4ebee324e7f6"
+        "sha256": "fac1fd60cc16c2dafa9daf234177fd2f17d41cf1015d4fcd1821adb2cdbdb970"
       }
     },
     {
@@ -58,79 +58,79 @@
     {
       "name": "dist/drizzle.js",
       "digest": {
-        "sha256": "c7b3210b0cca48f2b45c5b789cea13f55f14fc2c620e155d15987b9b8e434f4a"
+        "sha256": "3686b5a03b627e3262257f6a6d2d3addcb7f2cf3377ece458c434aad3b15d2ba"
       }
     },
     {
       "name": "dist/index.d.ts",
       "digest": {
-        "sha256": "a4864c4ea0bb9e9cc9bc1f58cdbc31863e5543a572e6049ee900b53b9fecb003"
+        "sha256": "ed2935e0d96814bcf3192294462ae707acfe6934ce2aed9f859683aed88a3ea8"
       }
     },
     {
       "name": "dist/index.js",
       "digest": {
-        "sha256": "496292f1edd16bd779f6e8712291c4b90e5b3f404d71b54f5c369c6736c26814"
+        "sha256": "37b74d238138bb80b65341520257b9390be3cc5b9b1f5adf579894eb4995c2ab"
       }
     },
     {
       "name": "dist/kms.d.ts",
       "digest": {
-        "sha256": "822f37608176917f438febaaea06a3b65508c45474bd7e137c4df815c50b4854"
+        "sha256": "757dba651cf48b6ab68e11b5c92e8ccc81c1ca6eb9129f60a2a3b224fc4f712e"
       }
     },
     {
       "name": "dist/kms.js",
       "digest": {
-        "sha256": "5c748722412b465c01cebd70e2242836f8f0c10f4303189548061f88d67eb4e4"
+        "sha256": "1619f068398e57c2044457d18d24ee1c626b54e12153246093d4c51add64368c"
       }
     },
     {
       "name": "dist/mongoose.d.ts",
       "digest": {
-        "sha256": "a3bf00d62fecf9266325a9dd18c4ec272de9559355dbf3f9f43836a4688fe86b"
+        "sha256": "18f77aa838f2cd861cd31dd5a03fdfd86d34563a090340177dba1420b5ea9b53"
       }
     },
     {
       "name": "dist/mongoose.js",
       "digest": {
-        "sha256": "a2ff33065a1c52707bdc3b7b1b49e79c5878e7edc547e219779426d3376a8f5b"
+        "sha256": "0b7c921d254a3c12d6d0924f3778ac39d7e95383086f1f8a893ff361a29c380b"
       }
     },
     {
       "name": "dist/prisma.d.ts",
       "digest": {
-        "sha256": "f6b85a786a9bb964f0620df4bcad0787e5c972e853df35551cf8fc902bb79691"
+        "sha256": "d55f39802671b594be9c0a0512c06cb1828569dea9024c78e890c53085cf0232"
       }
     },
     {
       "name": "dist/prisma.js",
       "digest": {
-        "sha256": "dc5d221dfc6e2f790fd13abc1408e98e4d8a3a1f61ee876cc691963d5517395a"
+        "sha256": "de57df0c3fc6657a996c804d6deee6ff83f889f457c82f55ea35064df6372eab"
       }
     },
     {
       "name": "dist/security.d.ts",
       "digest": {
-        "sha256": "6fed9ab5d0e7d940fd8e0e65f3e0a6be6581fbeddb82a6ad9706397efa4ec2b2"
+        "sha256": "dbe2dce83e417dc20d476e5bd476e31c3cf43e58fd363011a77dbc56ab82386f"
       }
     },
     {
       "name": "dist/security.js",
       "digest": {
-        "sha256": "a7323f84eaa90838dcaba18f82cba8c48d6fdb708715786cae1c60bdaeb0050d"
+        "sha256": "390eb8dbf9f2eab968445dadc43e1dfa6a13217851aa2b5138a5215059c487ed"
       }
     },
     {
       "name": "dist/typeorm.d.ts",
       "digest": {
-        "sha256": "6cc82bbbe82e260abcc789495fe85f984138c5c8368901881edaece1ffa46d8c"
+        "sha256": "47200df068a368cdd80b5818ae8dafc749686f8a09a0be8bd9847b175dd89fe6"
       }
     },
     {
       "name": "dist/typeorm.js",
       "digest": {
-        "sha256": "d88d0aa0eff62675e732c5fd2f7c7885d601d5234729687aecbd5b1282e6a7bd"
+        "sha256": "80e1908e97ffc89c426e89c71efbbd7dbea98191ec7da8ecc9d37cc439a262d8"
       }
     }
   ],
@@ -141,7 +141,7 @@
       "externalParameters": {
         "packageJson": {
           "name": "@vollcrypt/db-guard",
-          "version": "0.9.0",
+          "version": "0.9.1",
           "scripts": {
             "build": "tsc && node scripts/generate-sbom.js",
             "test": "node --import tsx --test tests/*.test.ts"
@@ -241,9 +241,9 @@
         "id": "https://vollcrypt.dev/builders/local-hermetic-env"
       },
       "metadata": {
-        "invocationId": "394b345f273d241cc656eb0efdf34f57",
-        "startedOn": "2026-07-08T14:31:16.765Z",
-        "finishedOn": "2026-07-08T14:31:16.767Z"
+        "invocationId": "e52b6b317496bccb3dd2fbc3c609d1f0",
+        "startedOn": "2026-07-09T19:07:03.950Z",
+        "finishedOn": "2026-07-09T19:07:03.951Z"
       }
     }
   }

package/dist/provenance.json.sig

@@ -1 +1,2 @@
-&�/�!/�[5_\4|�%�u����C>t}���Ɋ��kV[�3SI!�#�	K�%#�cP��
+T&�~����*F��
+p��ƕ�A9�>t���V7��b���ޡA����z�oח�%!��)�

package/dist/sbom.json

@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:dc37a041-235d-478b-85b1-b33d761679d6",
+  "serialNumber": "urn:uuid:54f5fdbd-84b0-47fe-95c1-e86fe565dcf8",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-08T14:31:16.765Z",
+    "timestamp": "2026-07-09T19:07:03.950Z",
     "tools": [
       {
         "vendor": "Vollcrypt",
@@ -13,19 +13,19 @@
       }
     ],
     "component": {
-      "bomRef": "pkg:npm/@vollcrypt/db-guard@0.9.0",
+      "bomRef": "pkg:npm/@vollcrypt/db-guard@0.9.1",
       "type": "library",
       "name": "@vollcrypt/db-guard",
-      "version": "0.9.0",
+      "version": "0.9.1",
       "description": "Database field-level encryption integrations for Vollcrypt (Prisma, Mongoose, Drizzle, TypeORM)",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7e613b58cf47bc14d647cfbfa2a9cc0f9e805dbab7562daa00ac679c30830ba7"
+          "content": "54df5b23b93c61111ba6124b9557fb4fe3f5e4af8ef18d1aeb5477826679363f"
         },
         {
           "alg": "SHA-256",
-          "content": "83364c9d2a86d43f775f15537ee10bdfb8e06c852adceb5b3c7358bcfc412907"
+          "content": "d417966c32408676efa5399b6e960b68d6015d66837b9b2bad9fa0bb9396b4be"
         },
         {
           "alg": "SHA-256",
@@ -33,7 +33,7 @@
         },
         {
           "alg": "SHA-256",
-          "content": "bf91d9b9d820796590d8b030e409031623d177e45cc487da8bcb66af13078ec0"
+          "content": "33c313c9195a9e00099652c3e8fac9eac169ac3b94088222fbe97e7a2e51442a"
         },
         {
           "alg": "SHA-256",
@@ -49,7 +49,7 @@
         },
         {
           "alg": "SHA-256",
-          "content": "4b418fae086ee440bd1c9fe99328c86923ab83467ecfb70fd9bb4ebee324e7f6"
+          "content": "fac1fd60cc16c2dafa9daf234177fd2f17d41cf1015d4fcd1821adb2cdbdb970"
         },
         {
           "alg": "SHA-256",
@@ -57,55 +57,55 @@
         },
         {
           "alg": "SHA-256",
-          "content": "c7b3210b0cca48f2b45c5b789cea13f55f14fc2c620e155d15987b9b8e434f4a"
+          "content": "3686b5a03b627e3262257f6a6d2d3addcb7f2cf3377ece458c434aad3b15d2ba"
         },
         {
           "alg": "SHA-256",
-          "content": "a4864c4ea0bb9e9cc9bc1f58cdbc31863e5543a572e6049ee900b53b9fecb003"
+          "content": "ed2935e0d96814bcf3192294462ae707acfe6934ce2aed9f859683aed88a3ea8"
         },
         {
           "alg": "SHA-256",
-          "content": "496292f1edd16bd779f6e8712291c4b90e5b3f404d71b54f5c369c6736c26814"
+          "content": "37b74d238138bb80b65341520257b9390be3cc5b9b1f5adf579894eb4995c2ab"
         },
         {
           "alg": "SHA-256",
-          "content": "822f37608176917f438febaaea06a3b65508c45474bd7e137c4df815c50b4854"
+          "content": "757dba651cf48b6ab68e11b5c92e8ccc81c1ca6eb9129f60a2a3b224fc4f712e"
         },
         {
           "alg": "SHA-256",
-          "content": "5c748722412b465c01cebd70e2242836f8f0c10f4303189548061f88d67eb4e4"
+          "content": "1619f068398e57c2044457d18d24ee1c626b54e12153246093d4c51add64368c"
         },
         {
           "alg": "SHA-256",
-          "content": "a3bf00d62fecf9266325a9dd18c4ec272de9559355dbf3f9f43836a4688fe86b"
+          "content": "18f77aa838f2cd861cd31dd5a03fdfd86d34563a090340177dba1420b5ea9b53"
         },
         {
           "alg": "SHA-256",
-          "content": "a2ff33065a1c52707bdc3b7b1b49e79c5878e7edc547e219779426d3376a8f5b"
+          "content": "0b7c921d254a3c12d6d0924f3778ac39d7e95383086f1f8a893ff361a29c380b"
         },
         {
           "alg": "SHA-256",
-          "content": "f6b85a786a9bb964f0620df4bcad0787e5c972e853df35551cf8fc902bb79691"
+          "content": "d55f39802671b594be9c0a0512c06cb1828569dea9024c78e890c53085cf0232"
         },
         {
           "alg": "SHA-256",
-          "content": "dc5d221dfc6e2f790fd13abc1408e98e4d8a3a1f61ee876cc691963d5517395a"
+          "content": "de57df0c3fc6657a996c804d6deee6ff83f889f457c82f55ea35064df6372eab"
         },
         {
           "alg": "SHA-256",
-          "content": "6fed9ab5d0e7d940fd8e0e65f3e0a6be6581fbeddb82a6ad9706397efa4ec2b2"
+          "content": "dbe2dce83e417dc20d476e5bd476e31c3cf43e58fd363011a77dbc56ab82386f"
         },
         {
           "alg": "SHA-256",
-          "content": "a7323f84eaa90838dcaba18f82cba8c48d6fdb708715786cae1c60bdaeb0050d"
+          "content": "390eb8dbf9f2eab968445dadc43e1dfa6a13217851aa2b5138a5215059c487ed"
         },
         {
           "alg": "SHA-256",
-          "content": "6cc82bbbe82e260abcc789495fe85f984138c5c8368901881edaece1ffa46d8c"
+          "content": "47200df068a368cdd80b5818ae8dafc749686f8a09a0be8bd9847b175dd89fe6"
         },
         {
           "alg": "SHA-256",
-          "content": "d88d0aa0eff62675e732c5fd2f7c7885d601d5234729687aecbd5b1282e6a7bd"
+          "content": "80e1908e97ffc89c426e89c71efbbd7dbea98191ec7da8ecc9d37cc439a262d8"
         }
       ]
     },

package/dist/sbom.json.sig

@@ -1,2 +1 @@
-���ǂDm�`��Z>s=��"Y
&��ؐ7�#b"h��S��W��
-"�ޚ���*P?��
+�0��cWA��8��c.*�+�F֛�U��g{s_7O�=��$�V�¿��Я�n9�Ҧ�

package/dist/security.d.ts

@@ -88,3 +88,11 @@ export declare function parseCiphertext(stored: string): {
     version: string;
     base64Data: string;
 } | null;
+/**
+ * Computes a hardened, frequency-resistant blind index for a database field.
+ */
+export declare function computeBlindIndex(value: any, rootSalt: Buffer, columnName: string): string;
+export declare function encryptValue(val: any, key: Buffer, version: string): string;
+export declare function decryptValue(stored: any, keys: Record<string, Buffer>): any;
+export declare function rewriteQueryWhere(where: any, fields: string[], rootSalt: Buffer, modelName: string): void;
+export declare function addBlindIndexes(data: any, fields: string[], rootSalt: Buffer, modelName: string): void;