@korajs/core 1.0.0-beta.0 → 1.0.0-beta.1

package/dist/index.cjs

@@ -38,6 +38,7 @@ __export(index_exports, {
   MergeConflictError: () => MergeConflictError,
   MigrationBuilder: () => MigrationBuilder,
   MigrationRollbackError: () => MigrationRollbackError,
+  MissingSecretKeyError: () => MissingSecretKeyError,
   OperationError: () => OperationError,
   RemoteClockDriftError: () => RemoteClockDriftError,
   RollbackBuilder: () => RollbackBuilder,
@@ -54,16 +55,19 @@ __export(index_exports, {
   collectSchemaScopeFields: () => collectSchemaScopeFields,
   collectSchemaScopeValueKeys: () => collectSchemaScopeValueKeys,
   computeDelta: () => computeDelta,
+  createBlobRef: () => createBlobRef,
   createOperation: () => createOperation,
   createReversibleMigration: () => createReversibleMigration,
   createVersionVector: () => createVersionVector,
   decodeBytesFromOpData: () => decodeBytesFromOpData,
+  decryptSecret: () => decryptSecret,
   defaultApplyFailureReason: () => defaultApplyFailureReason,
   defaultSequenceFormat: () => defaultSequenceFormat,
   defineSchema: () => defineSchema,
   deserializeVector: () => deserializeVector,
   dominates: () => dominates,
   encodeBytesForOpData: () => encodeBytesForOpData,
+  encryptSecret: () => encryptSecret,
   extractScopeValuesFromClaims: () => extractScopeValuesFromClaims,
   extractTimestamp: () => extractTimestamp,
   formatSequenceValue: () => formatSequenceValue,
@@ -76,8 +80,11 @@ __export(index_exports, {
   getKoraErrorFix: () => getKoraErrorFix,
   getTransitionMap: () => getTransitionMap,
   hasSchemaSyncRules: () => hasSchemaSyncRules,
+  hashBlob: () => hashBlob,
+  hashSecret: () => hashSecret,
   isApplyFailure: () => isApplyFailure,
   isAtomicOp: () => isAtomicOp,
+  isBlobRef: () => isBlobRef,
   isCollectionSyncScoped: () => isCollectionSyncScoped,
   isKoraBytesValue: () => isKoraBytesValue,
   isLegacyNumericByteObject: () => isLegacyNumericByteObject,
@@ -88,14 +95,18 @@ __export(index_exports, {
   migrationStepsToSQL: () => migrationStepsToSQL,
   op: () => op,
   resolveAtomicOp: () => resolveAtomicOp,
+  revealSecret: () => revealSecret,
   rollbackStepsToSQL: () => rollbackStepsToSQL,
   serializeVector: () => serializeVector,
   t: () => t,
   toAtomicOp: () => toAtomicOp,
+  transformSecretFieldsForWrite: () => transformSecretFieldsForWrite,
   validateRecord: () => validateRecord,
   validateTransition: () => validateTransition,
   vectorsEqual: () => vectorsEqual,
-  verifyOperationIntegrity: () => verifyOperationIntegrity
+  verifyOperationIntegrity: () => verifyOperationIntegrity,
+  verifySecret: () => verifySecret,
+  verifySecretValue: () => verifySecretValue
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -534,6 +545,226 @@ function formatUUID(bytes) {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
 }
 
+// src/blob/blob-ref.ts
+async function hashBlob(bytes) {
+  const view = new Uint8Array(bytes.byteLength);
+  view.set(bytes);
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", view);
+  const out = new Uint8Array(digest);
+  return Array.from(out, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function createBlobRef(bytes, metadata = {}) {
+  const hash = await hashBlob(bytes);
+  const ref = { hash, size: bytes.byteLength };
+  if (metadata.mimeType !== void 0) {
+    ref.mimeType = metadata.mimeType;
+  }
+  if (metadata.filename !== void 0) {
+    ref.filename = metadata.filename;
+  }
+  return ref;
+}
+function isBlobRef(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const ref = value;
+  if (typeof ref.hash !== "string" || !/^[0-9a-f]{64}$/.test(ref.hash)) {
+    return false;
+  }
+  if (typeof ref.size !== "number" || !Number.isInteger(ref.size) || ref.size < 0) {
+    return false;
+  }
+  if (ref.mimeType !== void 0 && typeof ref.mimeType !== "string") {
+    return false;
+  }
+  if (ref.filename !== void 0 && typeof ref.filename !== "string") {
+    return false;
+  }
+  if (ref.manifestHash !== void 0 && (typeof ref.manifestHash !== "string" || !/^[0-9a-f]{64}$/.test(ref.manifestHash))) {
+    return false;
+  }
+  return true;
+}
+
+// src/secret/secret-crypto.ts
+var PBKDF2_ITERATIONS = 21e4;
+var SALT_BYTES = 16;
+var IV_BYTES = 12;
+var HASH_BYTES = 32;
+function toHex(bytes) {
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function fromHex(hex) {
+  if (hex.length % 2 !== 0 || /[^0-9a-f]/i.test(hex)) {
+    throw new Error("Invalid hex string");
+  }
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return out;
+}
+function randomBytes(n) {
+  const out = new Uint8Array(n);
+  globalThis.crypto.getRandomValues(out);
+  return out;
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) {
+    diff |= a[i] ^ b[i];
+  }
+  return diff === 0;
+}
+async function deriveAesKey(secretKey, salt) {
+  const baseKey = await globalThis.crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secretKey),
+    "PBKDF2",
+    false,
+    ["deriveKey"]
+  );
+  return globalThis.crypto.subtle.deriveKey(
+    { name: "PBKDF2", salt, iterations: PBKDF2_ITERATIONS, hash: "SHA-256" },
+    baseKey,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function encryptSecret(plaintext, secretKey) {
+  const salt = randomBytes(SALT_BYTES);
+  const iv = randomBytes(IV_BYTES);
+  const key = await deriveAesKey(secretKey, salt);
+  const ciphertext = await globalThis.crypto.subtle.encrypt(
+    { name: "AES-GCM", iv },
+    key,
+    new TextEncoder().encode(plaintext)
+  );
+  return `v1.${toHex(salt)}.${toHex(iv)}.${toHex(new Uint8Array(ciphertext))}`;
+}
+async function decryptSecret(encrypted, secretKey) {
+  const parts = encrypted.split(".");
+  if (parts.length !== 4 || parts[0] !== "v1") {
+    throw new Error("Invalid encrypted secret format");
+  }
+  const salt = fromHex(parts[1]);
+  const iv = fromHex(parts[2]);
+  const ciphertext = fromHex(parts[3]);
+  const key = await deriveAesKey(secretKey, salt);
+  const plaintext = await globalThis.crypto.subtle.decrypt(
+    { name: "AES-GCM", iv },
+    key,
+    ciphertext
+  );
+  return new TextDecoder().decode(plaintext);
+}
+async function hashSecret(plaintext) {
+  const salt = randomBytes(SALT_BYTES);
+  const hash = await pbkdf2(plaintext, salt);
+  return `v1.${toHex(salt)}.${toHex(hash)}`;
+}
+async function verifySecret(plaintext, stored) {
+  const parts = stored.split(".");
+  if (parts.length !== 3 || parts[0] !== "v1") {
+    return false;
+  }
+  let salt;
+  let expected;
+  try {
+    salt = fromHex(parts[1]);
+    expected = fromHex(parts[2]);
+  } catch {
+    return false;
+  }
+  const actual = await pbkdf2(plaintext, salt);
+  return timingSafeEqual(actual, expected);
+}
+async function pbkdf2(plaintext, salt) {
+  const baseKey = await globalThis.crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(plaintext),
+    "PBKDF2",
+    false,
+    ["deriveBits"]
+  );
+  const bits = await globalThis.crypto.subtle.deriveBits(
+    { name: "PBKDF2", salt, iterations: PBKDF2_ITERATIONS, hash: "SHA-256" },
+    baseKey,
+    HASH_BYTES * 8
+  );
+  return new Uint8Array(bits);
+}
+
+// src/secret/secret-transform.ts
+var MissingSecretKeyError = class extends Error {
+  constructor(field) {
+    super(
+      `Secret field "${field}" is encrypted but no encryption key is configured. Provide sync.encryption.key (or a key provider) to createApp.`
+    );
+    this.field = field;
+    this.name = "MissingSecretKeyError";
+  }
+  field;
+};
+async function resolveKey(provider) {
+  if (!provider) {
+    return void 0;
+  }
+  return provider();
+}
+async function transformSecretFieldsForWrite(data, collectionDef, keyProvider) {
+  const hasSecret = Object.values(collectionDef.fields).some((f) => f.kind === "secret");
+  if (!hasSecret) {
+    return data;
+  }
+  const result = { ...data };
+  let key;
+  let keyResolved = false;
+  for (const [field, value] of Object.entries(data)) {
+    const descriptor = collectionDef.fields[field];
+    if (descriptor?.kind !== "secret") {
+      continue;
+    }
+    if (typeof value !== "string") {
+      continue;
+    }
+    const mode = descriptor.secretMode ?? "encrypted";
+    if (mode === "hashed") {
+      result[field] = await hashSecret(value);
+      continue;
+    }
+    if (!keyResolved) {
+      key = await resolveKey(keyProvider);
+      keyResolved = true;
+    }
+    if (key === void 0) {
+      throw new MissingSecretKeyError(field);
+    }
+    result[field] = await encryptSecret(value, key);
+  }
+  return result;
+}
+async function revealSecret(storedValue, mode, keyProvider, field = "secret") {
+  if (mode === "hashed") {
+    throw new Error(
+      `Secret field "${field}" is hashed (one-way) and cannot be revealed. Use verifySecretValue to check a candidate.`
+    );
+  }
+  const key = await resolveKey(keyProvider);
+  if (key === void 0) {
+    throw new MissingSecretKeyError(field);
+  }
+  return decryptSecret(storedValue, key);
+}
+async function verifySecretValue(candidate, storedValue) {
+  return verifySecret(candidate, storedValue);
+}
+
 // src/operations/apply-result.ts
 var APPLY_RESULTS = ["applied", "duplicate", "skipped", "rejected", "deferred"];
 var APPLY_FAILURE_CODES = {
@@ -1465,6 +1696,17 @@ function mapFieldType(descriptor) {
     case "array":
       return "TEXT";
     // JSON-serialized
+    case "object":
+      return "TEXT";
+    // JSON-serialized structured object
+    case "json":
+      return "TEXT";
+    // JSON-serialized dynamic-key value
+    case "blob":
+      return "TEXT";
+    // JSON-serialized content-addressed BlobRef (bytes stored out of band)
+    case "secret":
+      return "TEXT";
     case "richtext":
       return "BLOB";
   }
@@ -1698,6 +1940,160 @@ var ArrayFieldBuilder = class _ArrayFieldBuilder extends FieldBuilder {
     };
   }
 };
+var ObjectFieldBuilder = class _ObjectFieldBuilder extends FieldBuilder {
+  _fields;
+  constructor(fields, required = true, defaultValue = void 0, auto = false, mergeStrategy = null) {
+    super("object", required, defaultValue, auto, mergeStrategy);
+    this._fields = fields;
+  }
+  optional() {
+    return new _ObjectFieldBuilder(
+      this._fields,
+      false,
+      this._defaultValue,
+      this._auto,
+      this._mergeStrategy
+    );
+  }
+  default(value) {
+    return new _ObjectFieldBuilder(this._fields, false, value, this._auto, this._mergeStrategy);
+  }
+  auto() {
+    return new _ObjectFieldBuilder(this._fields, false, void 0, true, this._mergeStrategy);
+  }
+  merge(strategy) {
+    return new _ObjectFieldBuilder(
+      this._fields,
+      this._required,
+      this._defaultValue,
+      this._auto,
+      strategy
+    );
+  }
+  _build() {
+    const nestedFields = {};
+    for (const [key, builder] of Object.entries(this._fields)) {
+      nestedFields[key] = builder._build();
+    }
+    return {
+      kind: "object",
+      required: this._required,
+      defaultValue: this._defaultValue,
+      auto: this._auto,
+      enumValues: null,
+      itemKind: null,
+      mergeStrategy: this._mergeStrategy,
+      transitions: null,
+      nestedFields
+    };
+  }
+};
+var JsonFieldBuilder = class _JsonFieldBuilder extends FieldBuilder {
+  optional() {
+    return new _JsonFieldBuilder(
+      "json",
+      false,
+      this._defaultValue,
+      this._auto,
+      this._mergeStrategy
+    );
+  }
+  default(value) {
+    return new _JsonFieldBuilder(
+      "json",
+      false,
+      value,
+      this._auto,
+      this._mergeStrategy
+    );
+  }
+  auto() {
+    return new _JsonFieldBuilder("json", false, void 0, true, this._mergeStrategy);
+  }
+  merge(strategy) {
+    return new _JsonFieldBuilder(
+      "json",
+      this._required,
+      this._defaultValue,
+      this._auto,
+      strategy
+    );
+  }
+  _build() {
+    return {
+      kind: "json",
+      required: this._required,
+      defaultValue: this._defaultValue,
+      auto: this._auto,
+      enumValues: null,
+      itemKind: null,
+      mergeStrategy: this._mergeStrategy,
+      transitions: null,
+      nestedFields: null
+    };
+  }
+};
+var SecretFieldBuilder = class _SecretFieldBuilder extends FieldBuilder {
+  _secretMode;
+  constructor(secretMode = "encrypted", required = true, defaultValue = void 0, auto = false, mergeStrategy = null) {
+    super("secret", required, defaultValue, auto, mergeStrategy);
+    this._secretMode = secretMode;
+  }
+  /** Store this secret as a one-way salted hash (passwords: verify, never read back). */
+  hashed() {
+    return new _SecretFieldBuilder(
+      "hashed",
+      this._required,
+      this._defaultValue,
+      this._auto,
+      this._mergeStrategy
+    );
+  }
+  /** Store this secret as reversible ciphertext (tokens/keys: decrypt to use). */
+  encrypted() {
+    return new _SecretFieldBuilder(
+      "encrypted",
+      this._required,
+      this._defaultValue,
+      this._auto,
+      this._mergeStrategy
+    );
+  }
+  optional() {
+    return new _SecretFieldBuilder(
+      this._secretMode,
+      false,
+      this._defaultValue,
+      this._auto,
+      this._mergeStrategy
+    );
+  }
+  auto() {
+    return new _SecretFieldBuilder(this._secretMode, false, void 0, true, this._mergeStrategy);
+  }
+  merge(strategy) {
+    return new _SecretFieldBuilder(
+      this._secretMode,
+      this._required,
+      this._defaultValue,
+      this._auto,
+      strategy
+    );
+  }
+  _build() {
+    return {
+      kind: "secret",
+      required: this._required,
+      defaultValue: this._defaultValue,
+      auto: this._auto,
+      enumValues: null,
+      itemKind: null,
+      mergeStrategy: this._mergeStrategy,
+      transitions: null,
+      secretMode: this._secretMode
+    };
+  }
+};
 var t = {
   string() {
     return new FieldBuilder("string", true, void 0, false);
@@ -1719,6 +2115,18 @@ var t = {
   },
   array(itemBuilder) {
     return new ArrayFieldBuilder(itemBuilder, true, void 0, false);
+  },
+  object(fields) {
+    return new ObjectFieldBuilder(fields, true, void 0, false);
+  },
+  json() {
+    return new JsonFieldBuilder("json", true, void 0, false);
+  },
+  blob() {
+    return new FieldBuilder("blob", true, void 0, false);
+  },
+  secret() {
+    return new SecretFieldBuilder("encrypted", true, void 0, false);
   }
 };
 
@@ -1883,8 +2291,99 @@ function validateFieldValue(collection, fieldName, descriptor, value) {
       }
       break;
     }
+    case "object": {
+      if (!isPlainObject(value)) {
+        throw new SchemaValidationError(
+          `Field "${fieldName}" in collection "${collection}" must be a plain object, got ${describeType(value)}`,
+          {
+            collection,
+            field: fieldName,
+            expectedType: "object",
+            receivedType: describeType(value)
+          }
+        );
+      }
+      if (descriptor.nestedFields) {
+        for (const [nestedName, nestedDescriptor] of Object.entries(descriptor.nestedFields)) {
+          const nestedValue = value[nestedName];
+          if (nestedValue !== void 0 && nestedValue !== null) {
+            validateFieldValue(
+              collection,
+              `${fieldName}.${nestedName}`,
+              nestedDescriptor,
+              nestedValue
+            );
+          }
+        }
+      }
+      break;
+    }
+    case "json": {
+      if (!isJsonSerializable(value)) {
+        throw new SchemaValidationError(
+          `Field "${fieldName}" in collection "${collection}" must be JSON-serializable, got ${describeType(value)}`,
+          { collection, field: fieldName, expectedType: "json", receivedType: describeType(value) }
+        );
+      }
+      break;
+    }
+    case "blob": {
+      if (!isBlobRef(value)) {
+        throw new SchemaValidationError(
+          `Field "${fieldName}" in collection "${collection}" must be a BlobRef (from the blob store), got ${describeType(value)}`,
+          { collection, field: fieldName, expectedType: "blob", receivedType: describeType(value) }
+        );
+      }
+      break;
+    }
+    case "secret": {
+      if (typeof value !== "string") {
+        throw new SchemaValidationError(
+          `Field "${fieldName}" in collection "${collection}" must be a string, got ${describeType(value)}`,
+          {
+            collection,
+            field: fieldName,
+            expectedType: "secret",
+            receivedType: describeType(value)
+          }
+        );
+      }
+      break;
+    }
   }
 }
+function isPlainObject(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const proto = Object.getPrototypeOf(value);
+  return proto === null || proto === Object.prototype;
+}
+function isJsonSerializable(value) {
+  if (value === null) {
+    return true;
+  }
+  const type = typeof value;
+  if (type === "string" || type === "number" || type === "boolean") {
+    return Number.isFinite(value) || type !== "number";
+  }
+  if (Array.isArray(value)) {
+    return value.every(isJsonSerializable);
+  }
+  if (type === "object") {
+    return Object.values(value).every(isJsonSerializable);
+  }
+  return false;
+}
+function describeType(value) {
+  if (value === null) {
+    return "null";
+  }
+  if (Array.isArray(value)) {
+    return "array";
+  }
+  return typeof value;
+}
 function jsTypeForKind(kind) {
   switch (kind) {
     case "string":
@@ -2482,6 +2981,14 @@ function mapFieldType2(descriptor) {
       return "INTEGER";
     case "array":
       return "TEXT";
+    case "object":
+      return "TEXT";
+    case "json":
+      return "TEXT";
+    case "blob":
+      return "TEXT";
+    case "secret":
+      return "TEXT";
     case "richtext":
       return "BLOB";
   }
@@ -2500,7 +3007,14 @@ var SCALAR_TYPE_MAP = {
   number: "double",
   boolean: "bool",
   timestamp: "int64",
-  richtext: "bytes"
+  richtext: "bytes",
+  // object/json values travel as JSON-serialized strings on the proto wire.
+  object: "string",
+  json: "string",
+  // A blob field carries a JSON-serialized content-addressed reference, not bytes.
+  blob: "string",
+  // A secret field's stored value is a JSON string (ciphertext or hash).
+  secret: "string"
 };
 var ARRAY_ITEM_TYPE_MAP = {
   string: "string",
@@ -2744,6 +3258,7 @@ function generateProtoDefinitions(schema) {
   MergeConflictError,
   MigrationBuilder,
   MigrationRollbackError,
+  MissingSecretKeyError,
   OperationError,
   RemoteClockDriftError,
   RollbackBuilder,
@@ -2760,16 +3275,19 @@ function generateProtoDefinitions(schema) {
   collectSchemaScopeFields,
   collectSchemaScopeValueKeys,
   computeDelta,
+  createBlobRef,
   createOperation,
   createReversibleMigration,
   createVersionVector,
   decodeBytesFromOpData,
+  decryptSecret,
   defaultApplyFailureReason,
   defaultSequenceFormat,
   defineSchema,
   deserializeVector,
   dominates,
   encodeBytesForOpData,
+  encryptSecret,
   extractScopeValuesFromClaims,
   extractTimestamp,
   formatSequenceValue,
@@ -2782,8 +3300,11 @@ function generateProtoDefinitions(schema) {
   getKoraErrorFix,
   getTransitionMap,
   hasSchemaSyncRules,
+  hashBlob,
+  hashSecret,
   isApplyFailure,
   isAtomicOp,
+  isBlobRef,
   isCollectionSyncScoped,
   isKoraBytesValue,
   isLegacyNumericByteObject,
@@ -2794,13 +3315,17 @@ function generateProtoDefinitions(schema) {
   migrationStepsToSQL,
   op,
   resolveAtomicOp,
+  revealSecret,
   rollbackStepsToSQL,
   serializeVector,
   t,
   toAtomicOp,
+  transformSecretFieldsForWrite,
   validateRecord,
   validateTransition,
   vectorsEqual,
-  verifyOperationIntegrity
+  verifyOperationIntegrity,
+  verifySecret,
+  verifySecretValue
 });
 //# sourceMappingURL=index.cjs.map