@korajs/core 0.6.0 → 1.0.0-beta.1

package/dist/index.js

@@ -2,10 +2,13 @@ import {
   AppNotReadyError,
   ClockDriftError,
   HybridLogicalClock,
+  InvalidTimestampError,
   KORA_ERROR_FIX_SUGGESTIONS,
   KoraError,
+  MAX_LOGICAL,
   MergeConflictError,
   OperationError,
+  RemoteClockDriftError,
   SchemaValidationError,
   StorageError,
   SyncError,
@@ -14,7 +17,7 @@ import {
   isValidOperation,
   topologicalSort,
   verifyOperationIntegrity
-} from "./chunk-3VIOZT7D.js";
+} from "./chunk-5IICSH6H.js";
 
 // src/types.ts
 var MERGE_STRATEGIES = [
@@ -106,6 +109,226 @@ function formatUUID(bytes) {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
 }
 
+// src/blob/blob-ref.ts
+async function hashBlob(bytes) {
+  const view = new Uint8Array(bytes.byteLength);
+  view.set(bytes);
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", view);
+  const out = new Uint8Array(digest);
+  return Array.from(out, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function createBlobRef(bytes, metadata = {}) {
+  const hash = await hashBlob(bytes);
+  const ref = { hash, size: bytes.byteLength };
+  if (metadata.mimeType !== void 0) {
+    ref.mimeType = metadata.mimeType;
+  }
+  if (metadata.filename !== void 0) {
+    ref.filename = metadata.filename;
+  }
+  return ref;
+}
+function isBlobRef(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const ref = value;
+  if (typeof ref.hash !== "string" || !/^[0-9a-f]{64}$/.test(ref.hash)) {
+    return false;
+  }
+  if (typeof ref.size !== "number" || !Number.isInteger(ref.size) || ref.size < 0) {
+    return false;
+  }
+  if (ref.mimeType !== void 0 && typeof ref.mimeType !== "string") {
+    return false;
+  }
+  if (ref.filename !== void 0 && typeof ref.filename !== "string") {
+    return false;
+  }
+  if (ref.manifestHash !== void 0 && (typeof ref.manifestHash !== "string" || !/^[0-9a-f]{64}$/.test(ref.manifestHash))) {
+    return false;
+  }
+  return true;
+}
+
+// src/secret/secret-crypto.ts
+var PBKDF2_ITERATIONS = 21e4;
+var SALT_BYTES = 16;
+var IV_BYTES = 12;
+var HASH_BYTES = 32;
+function toHex(bytes) {
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function fromHex(hex) {
+  if (hex.length % 2 !== 0 || /[^0-9a-f]/i.test(hex)) {
+    throw new Error("Invalid hex string");
+  }
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return out;
+}
+function randomBytes(n) {
+  const out = new Uint8Array(n);
+  globalThis.crypto.getRandomValues(out);
+  return out;
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) {
+    diff |= a[i] ^ b[i];
+  }
+  return diff === 0;
+}
+async function deriveAesKey(secretKey, salt) {
+  const baseKey = await globalThis.crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secretKey),
+    "PBKDF2",
+    false,
+    ["deriveKey"]
+  );
+  return globalThis.crypto.subtle.deriveKey(
+    { name: "PBKDF2", salt, iterations: PBKDF2_ITERATIONS, hash: "SHA-256" },
+    baseKey,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function encryptSecret(plaintext, secretKey) {
+  const salt = randomBytes(SALT_BYTES);
+  const iv = randomBytes(IV_BYTES);
+  const key = await deriveAesKey(secretKey, salt);
+  const ciphertext = await globalThis.crypto.subtle.encrypt(
+    { name: "AES-GCM", iv },
+    key,
+    new TextEncoder().encode(plaintext)
+  );
+  return `v1.${toHex(salt)}.${toHex(iv)}.${toHex(new Uint8Array(ciphertext))}`;
+}
+async function decryptSecret(encrypted, secretKey) {
+  const parts = encrypted.split(".");
+  if (parts.length !== 4 || parts[0] !== "v1") {
+    throw new Error("Invalid encrypted secret format");
+  }
+  const salt = fromHex(parts[1]);
+  const iv = fromHex(parts[2]);
+  const ciphertext = fromHex(parts[3]);
+  const key = await deriveAesKey(secretKey, salt);
+  const plaintext = await globalThis.crypto.subtle.decrypt(
+    { name: "AES-GCM", iv },
+    key,
+    ciphertext
+  );
+  return new TextDecoder().decode(plaintext);
+}
+async function hashSecret(plaintext) {
+  const salt = randomBytes(SALT_BYTES);
+  const hash = await pbkdf2(plaintext, salt);
+  return `v1.${toHex(salt)}.${toHex(hash)}`;
+}
+async function verifySecret(plaintext, stored) {
+  const parts = stored.split(".");
+  if (parts.length !== 3 || parts[0] !== "v1") {
+    return false;
+  }
+  let salt;
+  let expected;
+  try {
+    salt = fromHex(parts[1]);
+    expected = fromHex(parts[2]);
+  } catch {
+    return false;
+  }
+  const actual = await pbkdf2(plaintext, salt);
+  return timingSafeEqual(actual, expected);
+}
+async function pbkdf2(plaintext, salt) {
+  const baseKey = await globalThis.crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(plaintext),
+    "PBKDF2",
+    false,
+    ["deriveBits"]
+  );
+  const bits = await globalThis.crypto.subtle.deriveBits(
+    { name: "PBKDF2", salt, iterations: PBKDF2_ITERATIONS, hash: "SHA-256" },
+    baseKey,
+    HASH_BYTES * 8
+  );
+  return new Uint8Array(bits);
+}
+
+// src/secret/secret-transform.ts
+var MissingSecretKeyError = class extends Error {
+  constructor(field) {
+    super(
+      `Secret field "${field}" is encrypted but no encryption key is configured. Provide sync.encryption.key (or a key provider) to createApp.`
+    );
+    this.field = field;
+    this.name = "MissingSecretKeyError";
+  }
+  field;
+};
+async function resolveKey(provider) {
+  if (!provider) {
+    return void 0;
+  }
+  return provider();
+}
+async function transformSecretFieldsForWrite(data, collectionDef, keyProvider) {
+  const hasSecret = Object.values(collectionDef.fields).some((f) => f.kind === "secret");
+  if (!hasSecret) {
+    return data;
+  }
+  const result = { ...data };
+  let key;
+  let keyResolved = false;
+  for (const [field, value] of Object.entries(data)) {
+    const descriptor = collectionDef.fields[field];
+    if (descriptor?.kind !== "secret") {
+      continue;
+    }
+    if (typeof value !== "string") {
+      continue;
+    }
+    const mode = descriptor.secretMode ?? "encrypted";
+    if (mode === "hashed") {
+      result[field] = await hashSecret(value);
+      continue;
+    }
+    if (!keyResolved) {
+      key = await resolveKey(keyProvider);
+      keyResolved = true;
+    }
+    if (key === void 0) {
+      throw new MissingSecretKeyError(field);
+    }
+    result[field] = await encryptSecret(value, key);
+  }
+  return result;
+}
+async function revealSecret(storedValue, mode, keyProvider, field = "secret") {
+  if (mode === "hashed") {
+    throw new Error(
+      `Secret field "${field}" is hashed (one-way) and cannot be revealed. Use verifySecretValue to check a candidate.`
+    );
+  }
+  const key = await resolveKey(keyProvider);
+  if (key === void 0) {
+    throw new MissingSecretKeyError(field);
+  }
+  return decryptSecret(storedValue, key);
+}
+async function verifySecretValue(candidate, storedValue) {
+  return verifySecret(candidate, storedValue);
+}
+
 // src/operations/apply-result.ts
 var APPLY_RESULTS = ["applied", "duplicate", "skipped", "rejected", "deferred"];
 var APPLY_FAILURE_CODES = {
@@ -235,6 +458,106 @@ function toAtomicOp(sentinel) {
   return { type: sentinel.type, value: sentinel.value };
 }
 
+// src/operations/op-data-binary.ts
+function isKoraBytesValue(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const record = value;
+  return Object.keys(record).length === 1 && typeof record.$koraBytes === "string";
+}
+function isLegacyNumericByteObject(value) {
+  if (typeof value !== "object" || value === null || ArrayBuffer.isView(value)) {
+    return false;
+  }
+  const record = value;
+  const keys = Object.keys(record);
+  if (keys.length === 0) {
+    return false;
+  }
+  for (let i = 0; i < keys.length; i++) {
+    const byte = record[String(i)];
+    if (typeof byte !== "number" || !Number.isInteger(byte) || byte < 0 || byte > 255) {
+      return false;
+    }
+  }
+  return true;
+}
+var BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+var BASE64_REVERSE = new Map(
+  Array.from(BASE64_ALPHABET, (char, index) => [char, index])
+);
+function bytesToBase64(bytes) {
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const b0 = bytes[i] ?? 0;
+    const b1 = bytes[i + 1] ?? 0;
+    const b2 = bytes[i + 2] ?? 0;
+    const triple = b0 << 16 | b1 << 8 | b2;
+    out += BASE64_ALPHABET[triple >> 18 & 63] ?? "";
+    out += BASE64_ALPHABET[triple >> 12 & 63] ?? "";
+    out += i + 1 < bytes.length ? BASE64_ALPHABET[triple >> 6 & 63] ?? "" : "=";
+    out += i + 2 < bytes.length ? BASE64_ALPHABET[triple & 63] ?? "" : "=";
+  }
+  return out;
+}
+function base64ToBytes(base64) {
+  const cleaned = base64.replace(/=+$/, "");
+  const out = new Uint8Array(Math.floor(cleaned.length * 6 / 8));
+  let buffer = 0;
+  let bits = 0;
+  let index = 0;
+  for (const char of cleaned) {
+    const value = BASE64_REVERSE.get(char);
+    if (value === void 0) {
+      throw new OperationError(`Invalid base64 character "${char}" in tagged binary value.`, {
+        char
+      });
+    }
+    buffer = buffer << 6 | value;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      out[index] = buffer >> bits & 255;
+      index += 1;
+    }
+  }
+  return out;
+}
+function encodeBytesForOpData(value) {
+  if (typeof value === "string") {
+    return value;
+  }
+  const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);
+  return { $koraBytes: bytesToBase64(bytes) };
+}
+function decodeBytesFromOpData(value) {
+  if (typeof value === "string") {
+    return value;
+  }
+  if (value instanceof Uint8Array) {
+    return value;
+  }
+  if (value instanceof ArrayBuffer) {
+    return new Uint8Array(value);
+  }
+  if (isKoraBytesValue(value)) {
+    return base64ToBytes(value.$koraBytes);
+  }
+  if (isLegacyNumericByteObject(value)) {
+    const keys = Object.keys(value);
+    const bytes = new Uint8Array(keys.length);
+    for (let i = 0; i < keys.length; i++) {
+      bytes[i] = value[String(i)] ?? 0;
+    }
+    return bytes;
+  }
+  throw new OperationError(
+    "Binary op-data value must be a string, Uint8Array, ArrayBuffer, tagged { $koraBytes } object, or legacy numeric-key byte object.",
+    { receivedType: typeof value }
+  );
+}
+
 // src/scopes/sync-scope-bindings.ts
 function hasSchemaSyncRules(schema) {
   return schema.sync !== void 0 && Object.keys(schema.sync).length > 0;
@@ -664,6 +987,7 @@ function generateSQL(collectionName, collection, relations) {
   columns.push("_created_at INTEGER NOT NULL");
   columns.push("_updated_at INTEGER NOT NULL");
   columns.push("_version TEXT NOT NULL DEFAULT ''");
+  columns.push("_field_versions TEXT NOT NULL DEFAULT '{}'");
   columns.push("_deleted INTEGER NOT NULL DEFAULT 0");
   statements.push(`CREATE TABLE IF NOT EXISTS ${collectionName} (
   ${columns.join(",\n  ")}
@@ -676,6 +1000,10 @@ ALTER TABLE ${collectionName} ADD COLUMN ${colDef}`);
   statements.push(
     `--kora:safe-alter
 ALTER TABLE ${collectionName} ADD COLUMN _version TEXT NOT NULL DEFAULT ''`
+  );
+  statements.push(
+    `--kora:safe-alter
+ALTER TABLE ${collectionName} ADD COLUMN _field_versions TEXT NOT NULL DEFAULT '{}'`
   );
   for (const indexField of collection.indexes) {
     statements.push(
@@ -703,6 +1031,9 @@ ALTER TABLE ${collectionName} ADD COLUMN _version TEXT NOT NULL DEFAULT ''`
   schema_version INTEGER NOT NULL
 )`
   );
+  statements.push(
+    `CREATE INDEX IF NOT EXISTS idx_kora_ops_${collectionName}_record_id ON _kora_ops_${collectionName} (record_id)`
+  );
   return statements;
 }
 function generateFullDDL(schema) {
@@ -763,6 +1094,17 @@ function mapFieldType(descriptor) {
     case "array":
       return "TEXT";
     // JSON-serialized
+    case "object":
+      return "TEXT";
+    // JSON-serialized structured object
+    case "json":
+      return "TEXT";
+    // JSON-serialized dynamic-key value
+    case "blob":
+      return "TEXT";
+    // JSON-serialized content-addressed BlobRef (bytes stored out of band)
+    case "secret":
+      return "TEXT";
     case "richtext":
       return "BLOB";
   }
@@ -996,6 +1338,160 @@ var ArrayFieldBuilder = class _ArrayFieldBuilder extends FieldBuilder {
     };
   }
 };
+var ObjectFieldBuilder = class _ObjectFieldBuilder extends FieldBuilder {
+  _fields;
+  constructor(fields, required = true, defaultValue = void 0, auto = false, mergeStrategy = null) {
+    super("object", required, defaultValue, auto, mergeStrategy);
+    this._fields = fields;
+  }
+  optional() {
+    return new _ObjectFieldBuilder(
+      this._fields,
+      false,
+      this._defaultValue,
+      this._auto,
+      this._mergeStrategy
+    );
+  }
+  default(value) {
+    return new _ObjectFieldBuilder(this._fields, false, value, this._auto, this._mergeStrategy);
+  }
+  auto() {
+    return new _ObjectFieldBuilder(this._fields, false, void 0, true, this._mergeStrategy);
+  }
+  merge(strategy) {
+    return new _ObjectFieldBuilder(
+      this._fields,
+      this._required,
+      this._defaultValue,
+      this._auto,
+      strategy
+    );
+  }
+  _build() {
+    const nestedFields = {};
+    for (const [key, builder] of Object.entries(this._fields)) {
+      nestedFields[key] = builder._build();
+    }
+    return {
+      kind: "object",
+      required: this._required,
+      defaultValue: this._defaultValue,
+      auto: this._auto,
+      enumValues: null,
+      itemKind: null,
+      mergeStrategy: this._mergeStrategy,
+      transitions: null,
+      nestedFields
+    };
+  }
+};
+var JsonFieldBuilder = class _JsonFieldBuilder extends FieldBuilder {
+  optional() {
+    return new _JsonFieldBuilder(
+      "json",
+      false,
+      this._defaultValue,
+      this._auto,
+      this._mergeStrategy
+    );
+  }
+  default(value) {
+    return new _JsonFieldBuilder(
+      "json",
+      false,
+      value,
+      this._auto,
+      this._mergeStrategy
+    );
+  }
+  auto() {
+    return new _JsonFieldBuilder("json", false, void 0, true, this._mergeStrategy);
+  }
+  merge(strategy) {
+    return new _JsonFieldBuilder(
+      "json",
+      this._required,
+      this._defaultValue,
+      this._auto,
+      strategy
+    );
+  }
+  _build() {
+    return {
+      kind: "json",
+      required: this._required,
+      defaultValue: this._defaultValue,
+      auto: this._auto,
+      enumValues: null,
+      itemKind: null,
+      mergeStrategy: this._mergeStrategy,
+      transitions: null,
+      nestedFields: null
+    };
+  }
+};
+var SecretFieldBuilder = class _SecretFieldBuilder extends FieldBuilder {
+  _secretMode;
+  constructor(secretMode = "encrypted", required = true, defaultValue = void 0, auto = false, mergeStrategy = null) {
+    super("secret", required, defaultValue, auto, mergeStrategy);
+    this._secretMode = secretMode;
+  }
+  /** Store this secret as a one-way salted hash (passwords: verify, never read back). */
+  hashed() {
+    return new _SecretFieldBuilder(
+      "hashed",
+      this._required,
+      this._defaultValue,
+      this._auto,
+      this._mergeStrategy
+    );
+  }
+  /** Store this secret as reversible ciphertext (tokens/keys: decrypt to use). */
+  encrypted() {
+    return new _SecretFieldBuilder(
+      "encrypted",
+      this._required,
+      this._defaultValue,
+      this._auto,
+      this._mergeStrategy
+    );
+  }
+  optional() {
+    return new _SecretFieldBuilder(
+      this._secretMode,
+      false,
+      this._defaultValue,
+      this._auto,
+      this._mergeStrategy
+    );
+  }
+  auto() {
+    return new _SecretFieldBuilder(this._secretMode, false, void 0, true, this._mergeStrategy);
+  }
+  merge(strategy) {
+    return new _SecretFieldBuilder(
+      this._secretMode,
+      this._required,
+      this._defaultValue,
+      this._auto,
+      strategy
+    );
+  }
+  _build() {
+    return {
+      kind: "secret",
+      required: this._required,
+      defaultValue: this._defaultValue,
+      auto: this._auto,
+      enumValues: null,
+      itemKind: null,
+      mergeStrategy: this._mergeStrategy,
+      transitions: null,
+      secretMode: this._secretMode
+    };
+  }
+};
 var t = {
   string() {
     return new FieldBuilder("string", true, void 0, false);
@@ -1017,6 +1513,18 @@ var t = {
   },
   array(itemBuilder) {
     return new ArrayFieldBuilder(itemBuilder, true, void 0, false);
+  },
+  object(fields) {
+    return new ObjectFieldBuilder(fields, true, void 0, false);
+  },
+  json() {
+    return new JsonFieldBuilder("json", true, void 0, false);
+  },
+  blob() {
+    return new FieldBuilder("blob", true, void 0, false);
+  },
+  secret() {
+    return new SecretFieldBuilder("encrypted", true, void 0, false);
   }
 };
 
@@ -1168,9 +1676,9 @@ function validateFieldValue(collection, fieldName, descriptor, value) {
       break;
     }
     case "richtext": {
-      if (!(value instanceof Uint8Array) && typeof value !== "string") {
+      if (!(value instanceof Uint8Array) && !(value instanceof ArrayBuffer) && typeof value !== "string") {
         throw new SchemaValidationError(
-          `Field "${fieldName}" in collection "${collection}" must be a Uint8Array or string for richtext, got ${typeof value}`,
+          `Field "${fieldName}" in collection "${collection}" must be a Uint8Array, ArrayBuffer, or string for richtext, got ${typeof value}`,
           {
             collection,
             field: fieldName,
@@ -1181,7 +1689,98 @@ function validateFieldValue(collection, fieldName, descriptor, value) {
       }
       break;
     }
+    case "object": {
+      if (!isPlainObject(value)) {
+        throw new SchemaValidationError(
+          `Field "${fieldName}" in collection "${collection}" must be a plain object, got ${describeType(value)}`,
+          {
+            collection,
+            field: fieldName,
+            expectedType: "object",
+            receivedType: describeType(value)
+          }
+        );
+      }
+      if (descriptor.nestedFields) {
+        for (const [nestedName, nestedDescriptor] of Object.entries(descriptor.nestedFields)) {
+          const nestedValue = value[nestedName];
+          if (nestedValue !== void 0 && nestedValue !== null) {
+            validateFieldValue(
+              collection,
+              `${fieldName}.${nestedName}`,
+              nestedDescriptor,
+              nestedValue
+            );
+          }
+        }
+      }
+      break;
+    }
+    case "json": {
+      if (!isJsonSerializable(value)) {
+        throw new SchemaValidationError(
+          `Field "${fieldName}" in collection "${collection}" must be JSON-serializable, got ${describeType(value)}`,
+          { collection, field: fieldName, expectedType: "json", receivedType: describeType(value) }
+        );
+      }
+      break;
+    }
+    case "blob": {
+      if (!isBlobRef(value)) {
+        throw new SchemaValidationError(
+          `Field "${fieldName}" in collection "${collection}" must be a BlobRef (from the blob store), got ${describeType(value)}`,
+          { collection, field: fieldName, expectedType: "blob", receivedType: describeType(value) }
+        );
+      }
+      break;
+    }
+    case "secret": {
+      if (typeof value !== "string") {
+        throw new SchemaValidationError(
+          `Field "${fieldName}" in collection "${collection}" must be a string, got ${describeType(value)}`,
+          {
+            collection,
+            field: fieldName,
+            expectedType: "secret",
+            receivedType: describeType(value)
+          }
+        );
+      }
+      break;
+    }
+  }
+}
+function isPlainObject(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
   }
+  const proto = Object.getPrototypeOf(value);
+  return proto === null || proto === Object.prototype;
+}
+function isJsonSerializable(value) {
+  if (value === null) {
+    return true;
+  }
+  const type = typeof value;
+  if (type === "string" || type === "number" || type === "boolean") {
+    return Number.isFinite(value) || type !== "number";
+  }
+  if (Array.isArray(value)) {
+    return value.every(isJsonSerializable);
+  }
+  if (type === "object") {
+    return Object.values(value).every(isJsonSerializable);
+  }
+  return false;
+}
+function describeType(value) {
+  if (value === null) {
+    return "null";
+  }
+  if (Array.isArray(value)) {
+    return "array";
+  }
+  return typeof value;
 }
 function jsTypeForKind(kind) {
   switch (kind) {
@@ -1662,6 +2261,14 @@ function mapFieldType2(descriptor) {
       return "INTEGER";
     case "array":
       return "TEXT";
+    case "object":
+      return "TEXT";
+    case "json":
+      return "TEXT";
+    case "blob":
+      return "TEXT";
+    case "secret":
+      return "TEXT";
     case "richtext":
       return "BLOB";
   }
@@ -1680,7 +2287,14 @@ var SCALAR_TYPE_MAP = {
   number: "double",
   boolean: "bool",
   timestamp: "int64",
-  richtext: "bytes"
+  richtext: "bytes",
+  // object/json values travel as JSON-serialized strings on the proto wire.
+  object: "string",
+  json: "string",
+  // A blob field carries a JSON-serialized content-addressed reference, not bytes.
+  blob: "string",
+  // A secret field's stored value is a JSON string (ciphertext or hash).
+  secret: "string"
 };
 var ARRAY_ITEM_TYPE_MAP = {
   string: "string",
@@ -1915,33 +2529,44 @@ export {
   EnumFieldBuilder,
   FieldBuilder,
   HybridLogicalClock,
+  InvalidTimestampError,
   KORA_ERROR_FIX_SUGGESTIONS,
   KoraError,
+  MAX_LOGICAL,
   MERGE_STRATEGIES,
   MergeConflictError,
   MigrationBuilder,
   MigrationRollbackError,
+  MissingSecretKeyError,
   OperationError,
+  RemoteClockDriftError,
   RollbackBuilder,
   SchemaValidationError,
   StorageError,
   SyncError,
   advanceVector,
   applyOperationTransforms,
+  base64ToBytes,
   buildScopeMap,
   buildStateMachineConstraints,
+  bytesToBase64,
   canAutoRollback,
   collectSchemaScopeFields,
   collectSchemaScopeValueKeys,
   computeDelta,
+  createBlobRef,
   createOperation,
   createReversibleMigration,
   createVersionVector,
+  decodeBytesFromOpData,
+  decryptSecret,
   defaultApplyFailureReason,
   defaultSequenceFormat,
   defineSchema,
   deserializeVector,
   dominates,
+  encodeBytesForOpData,
+  encryptSecret,
   extractScopeValuesFromClaims,
   extractTimestamp,
   formatSequenceValue,
@@ -1954,9 +2579,14 @@ export {
   getKoraErrorFix,
   getTransitionMap,
   hasSchemaSyncRules,
+  hashBlob,
+  hashSecret,
   isApplyFailure,
   isAtomicOp,
+  isBlobRef,
   isCollectionSyncScoped,
+  isKoraBytesValue,
+  isLegacyNumericByteObject,
   isValidOperation,
   isValidUUIDv7,
   mergeVectors,
@@ -1964,13 +2594,17 @@ export {
   migrationStepsToSQL,
   op,
   resolveAtomicOp,
+  revealSecret,
   rollbackStepsToSQL,
   serializeVector,
   t,
   toAtomicOp,
+  transformSecretFieldsForWrite,
   validateRecord,
   validateTransition,
   vectorsEqual,
-  verifyOperationIntegrity
+  verifyOperationIntegrity,
+  verifySecret,
+  verifySecretValue
 };
 //# sourceMappingURL=index.js.map