@noy-db/hub 0.2.0-pre.16 → 0.2.0-pre.17

package/dist/attestation/index.d.cts

@@ -1,11 +1,13 @@
-import { a$ as NoydbStore } from '../types-Bze6vkwm.cjs';
+import { b2 as NoydbStore } from '../types-CrSpRDuG.cjs';
 import { AttestationFieldSchema, QrPayload, RevocationList } from '@noy-db/attestation';
 export { AttestationFieldSchema, QrPayload, RevocationList, VerifyInput, VerifyResult, decodeQr, isRevoked, signRevocationList, verifyAttestation, verifyRevocationList } from '@noy-db/attestation';
-export { W as AttestationError } from '../strategy-BtW8fAjz.cjs';
+export { r as AttestationError } from '../errors-Dz64FA65.cjs';
 import '../lazy-builder-eYZzLEL1.cjs';
 import '../predicate-BmhBSPCH.cjs';
+import '../strategy-CLC1j79g.cjs';
 import '../strategy-BSxFXGzb.cjs';
-import '../index-C8Bk3-VF.cjs';
+import '../index-C-SSRIxP.cjs';
+import '../index-u-kWzSrL.cjs';
 
 /** Everything issueAttestationCore needs from the Vault, injected for testability. */
 interface IssueContext {

package/dist/attestation/index.d.ts

@@ -1,11 +1,13 @@
-import { a$ as NoydbStore } from '../types-DrmBTscX.js';
+import { b2 as NoydbStore } from '../types-CljIHm_J.js';
 import { AttestationFieldSchema, QrPayload, RevocationList } from '@noy-db/attestation';
 export { AttestationFieldSchema, QrPayload, RevocationList, VerifyInput, VerifyResult, decodeQr, isRevoked, signRevocationList, verifyAttestation, verifyRevocationList } from '@noy-db/attestation';
-export { W as AttestationError } from '../strategy-BtW8fAjz.js';
+export { r as AttestationError } from '../errors-Dz64FA65.js';
 import '../lazy-builder-ChSqcF5t.js';
 import '../predicate-BmhBSPCH.js';
+import '../strategy-4M9jo172.js';
 import '../strategy-BSxFXGzb.js';
-import '../index-nP99bXLg.js';
+import '../index-C-SSRIxP.js';
+import '../index-DpU6KWof.js';
 
 /** Everything issueAttestationCore needs from the Vault, injected for testability. */
 interface IssueContext {

package/dist/attestation/index.js

@@ -1,21 +1,21 @@
 import {
   issueAttestationCore
-} from "../chunk-3YWP3WBP.js";
+} from "../chunk-SNMJ7SB3.js";
 import {
   getRevokedDocIdsCore,
   publishRevocationListCore,
   revokeDocCore,
   unrevokeDocCore
-} from "../chunk-E2CDVKMH.js";
+} from "../chunk-CD2AVTEM.js";
 import {
   ATTESTATIONS_COLLECTION
-} from "../chunk-IXBIFDEW.js";
+} from "../chunk-TIDXB5DF.js";
 import "../chunk-FZU343FL.js";
-import "../chunk-F3BPIPLS.js";
-import "../chunk-YULZKK4F.js";
+import "../chunk-SISBMAPO.js";
+import "../chunk-UNTGHX5A.js";
 import {
   AttestationError
-} from "../chunk-535SSHBS.js";
+} from "../chunk-ZEGSDPB7.js";
 
 // src/attestation/index.ts
 import { verifyAttestation, decodeQr, verifyRevocationList, isRevoked, signRevocationList } from "@noy-db/attestation";

package/dist/blobs/index.cjs

@@ -90,7 +90,9 @@ __export(crypto_exports, {
   generateSalt: () => generateSalt,
   hmacSha256Hex: () => hmacSha256Hex,
   sha256Hex: () => sha256Hex,
+  unwrapCek: () => unwrapCek,
   unwrapKey: () => unwrapKey,
+  wrapCek: () => wrapCek,
   wrapKey: () => wrapKey
 });
 async function deriveKey(passphrase, salt) {
@@ -141,6 +143,39 @@ async function unwrapKey(wrappedBase64, kek) {
     throw new InvalidKeyError();
   }
 }
+async function asKwKey(dek) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-cek-wrap");
+  const info = new TextEncoder().encode("v1");
+  const bits = await subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    KEY_BITS
+  );
+  return subtle.importKey("raw", bits, "AES-KW", false, ["wrapKey", "unwrapKey"]);
+}
+async function wrapCek(cek, dek) {
+  const kw = await asKwKey(dek);
+  const wrapped = await subtle.wrapKey("raw", cek, kw, "AES-KW");
+  return bufferToBase64(wrapped);
+}
+async function unwrapCek(wrappedBase64, dek) {
+  const kw = await asKwKey(dek);
+  try {
+    return await subtle.unwrapKey(
+      "raw",
+      base64ToBuffer(wrappedBase64),
+      kw,
+      "AES-KW",
+      { name: "AES-GCM", length: KEY_BITS },
+      true,
+      ["encrypt", "decrypt"]
+    );
+  } catch {
+    throw new InvalidKeyError();
+  }
+}
 async function encrypt(plaintext, dek) {
   const iv = generateIV();
   const encoded = new TextEncoder().encode(plaintext);
@@ -373,6 +408,11 @@ var NOYDB_FORMAT_VERSION = 1;
 
 // src/blobs/blob-set.ts
 init_crypto();
+
+// src/record-keys/index.ts
+init_crypto();
+
+// src/blobs/blob-set.ts
 init_errors();
 
 // src/blobs/mime-magic.ts
@@ -642,6 +682,7 @@ var BlobSet = class {
   encrypted;
   userId;
   maxBlobBytes;
+  erasableBlobs;
   constructor(opts) {
     this.store = opts.store;
     this.vault = opts.vault;
@@ -651,6 +692,21 @@ var BlobSet = class {
     this.encrypted = opts.encrypted;
     this.userId = opts.userId;
     this.maxBlobBytes = opts.maxBlobBytes;
+    this.erasableBlobs = opts.erasableBlobs === true;
+  }
+  /**
+   * Resolve the key the blob's CHUNKS are encrypted under.
+   *
+   * - `_cek` present (erasable blob) → unwrap the per-blob content CEK under
+   *   the `_blob` DEK. Deleting the BlobObject (at `refCount → 0`) makes this
+   *   key unrecoverable → the chunks are crypto-shredded.
+   * - `_cek` absent (legacy) → the `_blob` DEK encrypts chunks directly.
+   * - unencrypted vault → `null` (chunks stored as plaintext base64).
+   */
+  async resolveChunkKey(blob) {
+    if (!this.encrypted) return null;
+    const blobDEK = await this.getDEK(BLOB_COLLECTION);
+    return blob._cek !== void 0 ? await unwrapCek(blob._cek, blobDEK) : blobDEK;
   }
   /** The internal collection that holds slot metadata for this collection's blobs. */
   get slotsCollection() {
@@ -768,12 +824,163 @@ var BlobSet = class {
       const updated = { ...blob, refCount: blob.refCount + delta };
       try {
         await this.writeBlobObject(updated, version);
+        return updated.refCount;
+      } catch (err) {
+        if (err instanceof ConflictError && attempt < MAX_CAS_RETRIES - 1) continue;
+        throw err;
+      }
+    }
+    throw new ConflictError(-1);
+  }
+  /**
+   * Release `n` references to a blob and reclaim it at refCount 0 (#365 slice 4).
+   *
+   * The single reclaim choke point for every reference-drop path — slot
+   * delete/overwrite, published-version delete, and `forget()` shred — so the
+   * refCount-0 policy is uniform:
+   *  - **erasable blob** (`_cek` present) → delete the `BlobObject` (the SOLE
+   *    copy of the wrapped content CEK → chunks permanently undecryptable) and
+   *    reclaim the chunks. The crypto-shred is EAGER on every path: GDPR erasure
+   *    must not wait on orphan retention.
+   *  - **legacy blob** (no `_cek`) → reclaimed only when `reclaimLegacy` (the
+   *    `forget()` erasure path); otherwise left for deferred GC so the existing
+   *    `BlobLifecyclePolicy.orphanRetentionDays` semantics are preserved.
+   *
+   * @returns `'shredded'` (erasable, refCount 0, chunks dead) · `'retainedShared'`
+   *   (erasable, still referenced) · `'residue'` (legacy — not a crypto-shred).
+   */
+  async releaseRef(eTag, n, reclaimLegacy) {
+    const loaded = await this.loadBlobObject(eTag);
+    if (!loaded) return "shredded";
+    const erasable = loaded.blob._cek !== void 0;
+    const remaining = await this.casUpdateRefCount(eTag, -n);
+    if (remaining > 0) return erasable ? "retainedShared" : "residue";
+    if (erasable || reclaimLegacy) {
+      await this.store.delete(this.vault, BLOB_INDEX_COLLECTION, eTag);
+      for (let i = 0; i < loaded.blob.chunkCount; i++) {
+        await this.store.delete(this.vault, BLOB_CHUNKS_COLLECTION, `${eTag}_${i}`);
+      }
+    }
+    return erasable ? "shredded" : "residue";
+  }
+  /**
+   * Crypto-shred this record's blob attachments (#365 slice 2) — called by
+   * `vault.forget()`.
+   *
+   * For each distinct eTag the record references (a record may attach the same
+   * content under several slot names → several refCount holds): decrement the
+   * blob's refCount by that many. When it reaches 0:
+   *  - **erasable blob** (`_cek` present) → delete the `BlobObject` (the SOLE
+   *    recoverable copy of the wrapped content CEK → chunks permanently
+   *    undecryptable) and reclaim the chunk bytes. This is the crypto-shred.
+   *  - **legacy blob** (no `_cek`) → chunks are under the shared `_blob` DEK and
+   *    stay decryptable until byte-deleted; we delete the orphaned chunks +
+   *    index but report it as residue, not a cryptographic erasure.
+   * When refCount stays > 0 the content legitimately persists for its other
+   * owner — reported as `retainedShared` (or `residue` if legacy).
+   *
+   * Finally drops the record's slot map, severing the subject's link.
+   */
+  async shredAllForRecord() {
+    const { slots } = await this.loadSlots();
+    const slotNames = Object.keys(slots);
+    const shredded = [];
+    const retainedShared = [];
+    const residue = [];
+    if (slotNames.length === 0) return { shredded, retainedShared, residue };
+    const holds = /* @__PURE__ */ new Map();
+    for (const name of slotNames) {
+      const eTag = slots[name].eTag;
+      holds.set(eTag, (holds.get(eTag) ?? 0) + 1);
+    }
+    for (const [eTag, n] of holds) {
+      const outcome = await this.releaseRef(eTag, n, true);
+      if (outcome === "shredded") shredded.push(eTag);
+      else if (outcome === "retainedShared") retainedShared.push(eTag);
+      else residue.push(eTag);
+    }
+    await this.store.delete(this.vault, this.slotsCollection, this.recordId);
+    return { shredded, retainedShared, residue };
+  }
+  /** CAS retry loop for an arbitrary BlobObject mutation. */
+  async casUpdateBlobObject(eTag, mutate) {
+    for (let attempt = 0; attempt < MAX_CAS_RETRIES; attempt++) {
+      const result = await this.loadBlobObject(eTag);
+      if (!result) throw new NotFoundError(`BlobObject ${eTag} not found`);
+      try {
+        await this.writeBlobObject(mutate(result.blob), result.version);
         return;
       } catch (err) {
         if (err instanceof ConflictError && attempt < MAX_CAS_RETRIES - 1) continue;
         throw err;
       }
     }
+    throw new ConflictError(-1);
+  }
+  /**
+   * Migrate this record's LEGACY blobs (no `_cek`, chunks under the shared
+   * `_blob` DEK) to per-blob content CEKs so they become crypto-shreddable
+   * (#365 slice 3). Returns the eTags migrated vs. already-erasable.
+   *
+   * **Explicit maintenance pass** (mirrors the record-CEK migration posture):
+   * re-encrypts the existing compressed chunks IN PLACE under a fresh content
+   * CEK — preserving the eTag, chunkCount, chunkSize, and compression — then
+   * flips the `_cek` discriminant. Crash-safe + idempotent via `_cekPending`:
+   *   1. persist the wrapped content CEK in `_cekPending` (readers ignore it →
+   *      the blob stays readable under the `_blob` DEK; the key survives a crash);
+   *   2. re-encrypt each chunk under the content CEK (a resume reads an
+   *      already-migrated chunk under the content CEK, else under the `_blob` DEK);
+   *   3. promote `_cekPending` → `_cek` (atomic flip). Reads now use the CEK.
+   * A re-run after a crash resumes from whichever phase was reached.
+   *
+   * Dedup-safe: migrating a shared blob (refCount > 1) re-keys it for every
+   * referencer at once; a non-erasable collection still reads it (it unwraps
+   * `_cek` under the `_blob` DEK it holds).
+   */
+  async migrate() {
+    const migrated = [];
+    const alreadyErasable = [];
+    if (!this.encrypted) return { migrated, alreadyErasable };
+    const blobDEK = await this.getDEK(BLOB_COLLECTION);
+    const { slots } = await this.loadSlots();
+    const eTags = new Set(Object.values(slots).map((s) => s.eTag));
+    for (const eTag of eTags) {
+      const loaded = await this.loadBlobObject(eTag);
+      if (!loaded) continue;
+      const blob = loaded.blob;
+      if (blob._cek !== void 0) {
+        alreadyErasable.push(eTag);
+        continue;
+      }
+      let contentCek;
+      if (blob._cekPending !== void 0) {
+        contentCek = await unwrapCek(blob._cekPending, blobDEK);
+      } else {
+        contentCek = await generateDEK();
+        const wrapped = await wrapCek(contentCek, blobDEK);
+        await this.casUpdateBlobObject(eTag, (b) => ({ ...b, _cekPending: wrapped }));
+      }
+      for (let i = 0; i < blob.chunkCount; i++) {
+        let raw;
+        try {
+          raw = await this.readChunk(eTag, i, blob.chunkCount, blobDEK);
+        } catch {
+          raw = await this.readChunk(eTag, i, blob.chunkCount, contentCek);
+        }
+        if (!raw) {
+          throw new NotFoundError(
+            `Blob chunk ${i}/${blob.chunkCount} missing for eTag "${eTag}" during migration`
+          );
+        }
+        await this.writeChunk(eTag, i, blob.chunkCount, raw, contentCek);
+      }
+      await this.casUpdateBlobObject(eTag, (b) => {
+        const { _cekPending, ...rest } = b;
+        return _cekPending === void 0 ? b : { ...rest, _cek: _cekPending };
+      });
+      migrated.push(eTag);
+    }
+    return { migrated, alreadyErasable };
   }
   // ─── Chunk I/O (with AAD binding) ─────────────────────────────────
   async writeChunk(eTag, index, chunkCount, chunk, dek) {
@@ -845,10 +1052,10 @@ var BlobSet = class {
   }
   // ─── Fetch all chunks for a blob ──────────────────────────────────
   async fetchAllChunks(blob) {
-    const blobDEK = this.encrypted ? await this.getDEK(BLOB_COLLECTION) : null;
+    const chunkKey = await this.resolveChunkKey(blob);
     const chunks = [];
     for (let i = 0; i < blob.chunkCount; i++) {
-      const chunk = await this.readChunk(blob.eTag, i, blob.chunkCount, blobDEK);
+      const chunk = await this.readChunk(blob.eTag, i, blob.chunkCount, chunkKey);
       if (!chunk) {
         throw new NotFoundError(
           `Blob chunk ${i}/${blob.chunkCount} missing for eTag "${blob.eTag}" on record "${this.recordId}"`
@@ -895,6 +1102,13 @@ var BlobSet = class {
       const { bytes: compressed, algorithm } = shouldCompress ? await compressBytes(data) : { bytes: data, algorithm: "none" };
       const chunkSize = this.effectiveChunkSize(opts);
       const chunkCount = Math.max(1, Math.ceil(compressed.byteLength / chunkSize));
+      let chunkKey = blobDEK;
+      let wrappedCek;
+      if (blobDEK && this.erasableBlobs) {
+        const contentCek = await generateDEK();
+        wrappedCek = await wrapCek(contentCek, blobDEK);
+        chunkKey = contentCek;
+      }
       for (let i = 0; i < chunkCount; i++) {
         const start = i * chunkSize;
         await this.writeChunk(
@@ -902,7 +1116,7 @@ var BlobSet = class {
           i,
           chunkCount,
           compressed.subarray(start, start + chunkSize),
-          blobDEK
+          chunkKey
         );
       }
       await this.writeBlobObject({
@@ -914,7 +1128,8 @@ var BlobSet = class {
         chunkCount,
         ...mimeType !== void 0 ? { mimeType } : {},
         createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-        refCount: 1
+        refCount: 1,
+        ...wrappedCek !== void 0 ? { _cek: wrappedCek } : {}
       });
     }
     const uploaderUserId = opts?.uploadedBy ?? this.userId;
@@ -936,7 +1151,7 @@ var BlobSet = class {
     if (this._deferredRefDecrement) {
       const oldETag = this._deferredRefDecrement;
       this._deferredRefDecrement = void 0;
-      await this.casUpdateRefCount(oldETag, -1).catch(() => {
+      await this.releaseRef(oldETag, 1, false).catch(() => {
       });
     }
   }
@@ -967,15 +1182,15 @@ var BlobSet = class {
    * Decrements refCount on the blob. Chunks are GC'd by `vault.blobGC()`.
    */
   async delete(slotName) {
-    let eTagToDecrement;
+    let eTagToRelease;
     await this.casUpdateSlots((slots) => {
       if (!(slotName in slots)) return null;
-      eTagToDecrement = slots[slotName].eTag;
+      eTagToRelease = slots[slotName].eTag;
       delete slots[slotName];
       return slots;
     });
-    if (eTagToDecrement) {
-      await this.casUpdateRefCount(eTagToDecrement, -1).catch(() => {
+    if (eTagToRelease) {
+      await this.releaseRef(eTagToRelease, 1, false).catch(() => {
       });
     }
   }
@@ -1058,7 +1273,7 @@ var BlobSet = class {
     await this.writeVersionRecord(slotName, record);
     await this.casUpdateRefCount(slot.eTag, 1);
     if (existing && existing.eTag !== slot.eTag) {
-      await this.casUpdateRefCount(existing.eTag, -1).catch(() => {
+      await this.releaseRef(existing.eTag, 1, false).catch(() => {
       });
     }
   }
@@ -1101,7 +1316,7 @@ var BlobSet = class {
     const record = await this.loadVersionRecord(slotName, label);
     if (!record) return;
     await this.deleteVersionRecord(slotName, label);
-    await this.casUpdateRefCount(record.eTag, -1).catch(() => {
+    await this.releaseRef(record.eTag, 1, false).catch(() => {
     });
   }
   /**