@noy-db/hub 0.6.0-pre.2 → 0.6.0-pre.21

package/dist/{chunk-66W5OOCX.js → chunk-JLYQQNY4.js}

@@ -1,15 +1,20 @@
 import {
-  assertTierAccess,
-  dekKey
-} from "./chunk-AHLJSVRL.js";
+  assertTierAccess
+} from "./chunk-NW4TY6VC.js";
 import {
+  dekKey,
   liveRecordIsElevated,
   liveRecordTier
-} from "./chunk-3FSX6LDG.js";
+} from "./chunk-PPCOKVFA.js";
 import {
+  buildRecordAad,
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-VN45YLWM.js";
+} from "./chunk-OHOKBMTM.js";
+import {
+  buildRecordEnvelope,
+  buildSealedRecordEnvelope
+} from "./chunk-PENPHA45.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -21,10 +26,7 @@ import {
   sha256Hex,
   unwrapCek,
   wrapCek
-} from "./chunk-VCETL77O.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-W5W6KHN2.js";
+} from "./chunk-AU3AUJIZ.js";
 import {
   BlobIntentPendingError,
   BlobOfflineError,
@@ -35,7 +37,7 @@ import {
   UnsupportedTierCompositionError,
   ValidationError,
   isConflictError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-CWM4GQD2.js";
 
 // src/with-shape/blobs/blob-pinning.ts
 function memoryBlobPinStore() {
@@ -301,30 +303,28 @@ function parseIntentKey(key) {
   if (idx === -1) return null;
   return { collection: key.slice(0, idx), recordId: key.slice(idx + 2) };
 }
-async function encodeIntentEnvelope(intent, dek, newVersion = 1) {
+async function encodeIntentEnvelope(intent, dek, key, newVersion = 1) {
   const json = JSON.stringify(intent);
-  const body = await writeEnvelopeBody(json, dek);
-  return {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: newVersion,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    ...body
-  };
+  return buildSealedRecordEnvelope(
+    { collection: BLOB_INTENT_COLLECTION, id: key, version: newVersion },
+    (identity) => writeEnvelopeBody(identity, json, dek),
+    {}
+  );
 }
-async function decodeIntentEnvelope(envelope, dek) {
-  const json = await openEnvelopeJson(envelope, dek);
+async function decodeIntentEnvelope(key, envelope, dek) {
+  const json = await openEnvelopeJson({ collection: BLOB_INTENT_COLLECTION, id: key }, envelope, dek);
   return JSON.parse(json);
 }
 async function getIntent(adapter, vault, collection, recordId, getDEK) {
   const envelope = await adapter.get(vault, BLOB_INTENT_COLLECTION, intentKey(collection, recordId));
   if (!envelope) return null;
   const dek = await getDEK(collection);
-  return decodeIntentEnvelope(envelope, dek);
+  return decodeIntentEnvelope(intentKey(collection, recordId), envelope, dek);
 }
 async function createIntent(adapter, vault, collection, recordId, getDEK, intent) {
   const key = intentKey(collection, recordId);
   const dek = await getDEK(collection);
-  const envelope = await encodeIntentEnvelope(intent, dek);
+  const envelope = await encodeIntentEnvelope(intent, dek, key);
   try {
     await adapter.put(vault, BLOB_INTENT_COLLECTION, key, envelope, 0);
   } catch (err) {
@@ -344,10 +344,10 @@ async function recordAppliedStamp(adapter, vault, collection, recordId, getDEK,
   for (let attempt = 0; attempt < MAX_APPLIED_STAMP_RETRIES; attempt++) {
     const envelope = await adapter.get(vault, BLOB_INTENT_COLLECTION, key);
     if (!envelope) return;
-    const intent = await decodeIntentEnvelope(envelope, dek);
+    const intent = await decodeIntentEnvelope(key, envelope, dek);
     if (intent.op !== "rehome" || intent.appliedStamps?.includes(stamp)) return;
     const updated = { ...intent, appliedStamps: [...intent.appliedStamps ?? [], stamp] };
-    const newEnvelope = await encodeIntentEnvelope(updated, dek, envelope._v + 1);
+    const newEnvelope = await encodeIntentEnvelope(updated, dek, key, envelope._v + 1);
     try {
       await adapter.put(vault, BLOB_INTENT_COLLECTION, key, newEnvelope, envelope._v);
       return;
@@ -366,7 +366,7 @@ async function sweepBlobIntents(adapter, vault, getDEK, resume, onResumeError) {
       const envelope = await adapter.get(vault, BLOB_INTENT_COLLECTION, key);
       if (!envelope) continue;
       const dek = await getDEK(parsed.collection);
-      const intent = await decodeIntentEnvelope(envelope, dek);
+      const intent = await decodeIntentEnvelope(key, envelope, dek);
       await resume(parsed.collection, parsed.recordId, intent);
     } catch (err) {
       onResumeError?.(parsed.collection, parsed.recordId, err);
@@ -654,7 +654,7 @@ var BlobSet = class _BlobSet {
       };
     }
     const dek = await this.getDEK(dekKey(this.collection, tier ?? await this.ownerTier()));
-    const json = await openEnvelopeJson(envelope, dek);
+    const json = await openEnvelopeJson({ collection: this.slotsCollection, id: this.recordId }, envelope, dek);
     return {
       slots: JSON.parse(json),
       version: envelope._v
@@ -678,38 +678,28 @@ var BlobSet = class _BlobSet {
     }
     const fromDek = await this.getDEK(dekKey(this.collection, fromTier));
     try {
-      const json2 = await openEnvelopeJson(envelope, fromDek);
+      const json2 = await openEnvelopeJson({ collection: this.slotsCollection, id: this.recordId }, envelope, fromDek);
       return { slots: JSON.parse(json2), version: envelope._v, atTier: fromTier };
     } catch (err) {
       if (!(err instanceof TamperedError) || fromTier === toTier) throw err;
     }
     const toDek = await this.getDEK(dekKey(this.collection, toTier));
-    const json = await openEnvelopeJson(envelope, toDek);
+    const json = await openEnvelopeJson({ collection: this.slotsCollection, id: this.recordId }, envelope, toDek);
     return { slots: JSON.parse(json), version: envelope._v, atTier: toTier };
   }
   /** @param tier See {@link loadSlots}'s `tier` param — same resolution. */
   async saveSlots(slots, currentVersion, tier) {
     const json = JSON.stringify(slots);
     const now = (/* @__PURE__ */ new Date()).toISOString();
+    const identity = { collection: this.slotsCollection, id: this.recordId, version: currentVersion + 1 };
+    const body = { ts: now };
     let envelope;
     if (this.encrypted) {
       const dek = await this.getDEK(dekKey(this.collection, tier ?? await this.ownerTier()));
-      const { iv, data } = await encrypt(json, dek);
-      envelope = {
-        _noydb: NOYDB_FORMAT_VERSION,
-        _v: currentVersion + 1,
-        _ts: now,
-        _iv: iv,
-        _data: data
-      };
+      const { iv, data } = await encrypt(json, dek, buildRecordAad(identity));
+      envelope = buildRecordEnvelope(identity, { ...body, iv, data });
     } else {
-      envelope = {
-        _noydb: NOYDB_FORMAT_VERSION,
-        _v: currentVersion + 1,
-        _ts: now,
-        _iv: "",
-        _data: json
-      };
+      envelope = buildRecordEnvelope(identity, { ...body, iv: "", data: json });
     }
     await this.store.put(
       this.vault,
@@ -844,14 +834,14 @@ var BlobSet = class _BlobSet {
     const fallbackTier = alsoTryTier ?? (t > 0 ? 0 : void 0);
     const primaryDek = await this.getDEK(dekKey(BLOB_COLLECTION, t));
     try {
-      const json2 = await openEnvelopeJson(envelope, primaryDek);
+      const json2 = await openEnvelopeJson({ collection: BLOB_INDEX_COLLECTION, id: eTag }, envelope, primaryDek);
       return { blob: JSON.parse(json2), version: envelope._v, atTier: t };
     } catch (err) {
       if (!(err instanceof TamperedError)) throw err;
       if (fallbackTier === void 0 || fallbackTier === t) throw err;
     }
     const fallbackDek = await this.getDEK(dekKey(BLOB_COLLECTION, fallbackTier));
-    const json = await openEnvelopeJson(envelope, fallbackDek);
+    const json = await openEnvelopeJson({ collection: BLOB_INDEX_COLLECTION, id: eTag }, envelope, fallbackDek);
     return { blob: JSON.parse(json), version: envelope._v, atTier: fallbackTier };
   }
   /**
@@ -891,12 +881,13 @@ var BlobSet = class _BlobSet {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const newVersion = (expectedVersion ?? 0) + 1;
     let envelope;
+    const identity = { collection: BLOB_INDEX_COLLECTION, id: blob.eTag, version: newVersion };
     if (this.encrypted) {
       const dek = await this.getDEK(dekKey(BLOB_COLLECTION, tier ?? await this.ownerTier()));
-      const { iv, data } = await encrypt(json, dek);
-      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: newVersion, _ts: now, _iv: iv, _data: data };
+      const { iv, data } = await encrypt(json, dek, buildRecordAad(identity));
+      envelope = buildRecordEnvelope(identity, { ts: now, iv, data });
     } else {
-      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: newVersion, _ts: now, _iv: "", _data: json };
+      envelope = buildRecordEnvelope(identity, { ts: now, iv: "", data: json });
     }
     await this.store.put(
       this.vault,
@@ -1449,7 +1440,7 @@ var BlobSet = class _BlobSet {
       const envelope = await this.store.get(this.vault, this.versionsCollection, key);
       if (!envelope) continue;
       try {
-        const record = this.encrypted ? JSON.parse(await openEnvelopeJson(envelope, dek)) : JSON.parse(envelope._data);
+        const record = this.encrypted ? JSON.parse(await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, dek)) : JSON.parse(envelope._data);
         holds.set(record.eTag, (holds.get(record.eTag) ?? 0) + 1);
         readable.push(key);
       } catch {
@@ -1733,13 +1724,13 @@ var BlobSet = class _BlobSet {
     if (!this.encrypted) return { record: JSON.parse(envelope._data), atTier: fromTier };
     const fromDek = await this.getDEK(dekKey(this.collection, fromTier));
     try {
-      const json2 = await openEnvelopeJson(envelope, fromDek);
+      const json2 = await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, fromDek);
       return { record: JSON.parse(json2), atTier: fromTier };
     } catch (err) {
       if (!(err instanceof TamperedError) || fromTier === toTier) throw err;
     }
     const toDek = await this.getDEK(dekKey(this.collection, toTier));
-    const json = await openEnvelopeJson(envelope, toDek);
+    const json = await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, toDek);
     return { record: JSON.parse(json), atTier: toTier };
   }
   /**
@@ -1901,18 +1892,13 @@ var BlobSet = class _BlobSet {
     const id = `${eTag}_${index}`;
     const now = (/* @__PURE__ */ new Date()).toISOString();
     let envelope;
+    const identity = { collection: BLOB_CHUNKS_COLLECTION, id, version: 1 };
     if (dek) {
       const aad = chunkAAD(eTag, index, chunkCount);
       const { iv, data } = await encryptBytesWithAAD(chunk, dek, aad);
-      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: now, _iv: iv, _data: data };
+      envelope = buildRecordEnvelope(identity, { ts: now, iv, data });
     } else {
-      envelope = {
-        _noydb: NOYDB_FORMAT_VERSION,
-        _v: 1,
-        _ts: now,
-        _iv: "",
-        _data: bufferToBase64(chunk)
-      };
+      envelope = buildRecordEnvelope(identity, { ts: now, iv: "", data: bufferToBase64(chunk) });
     }
     await this.store.put(this.vault, BLOB_CHUNKS_COLLECTION, id, envelope);
   }
@@ -1962,7 +1948,7 @@ var BlobSet = class _BlobSet {
       return JSON.parse(envelope._data);
     }
     const dek = await this.getDEK(dekKey(this.collection, tier ?? await this.ownerTier()));
-    const json = await openEnvelopeJson(envelope, dek);
+    const json = await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, dek);
     return JSON.parse(json);
   }
   /** @param tier See {@link loadVersionRecord}'s `tier` param — same resolution. */
@@ -1983,12 +1969,13 @@ var BlobSet = class _BlobSet {
     const json = JSON.stringify(record);
     const now = (/* @__PURE__ */ new Date()).toISOString();
     let envelope;
+    const identity = { collection: this.versionsCollection, id: key, version: 1 };
     if (this.encrypted) {
       const dek = await this.getDEK(dekKey(this.collection, tier));
-      const { iv, data } = await encrypt(json, dek);
-      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: now, _iv: iv, _data: data };
+      const { iv, data } = await encrypt(json, dek, buildRecordAad(identity));
+      envelope = buildRecordEnvelope(identity, { ts: now, iv, data });
     } else {
-      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: now, _iv: "", _data: json };
+      envelope = buildRecordEnvelope(identity, { ts: now, iv: "", data: json });
     }
     await this.store.put(this.vault, this.versionsCollection, key, envelope);
   }
@@ -2887,7 +2874,7 @@ var BlobSet = class _BlobSet {
         versions.push(JSON.parse(envelope._data));
       } else {
         const dek = await this.getDEK(this.collection);
-        const json = await openEnvelopeJson(envelope, dek);
+        const json = await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, dek);
         versions.push(JSON.parse(json));
       }
     }
@@ -3070,4 +3057,4 @@ export {
   DEFAULT_CHUNK_SIZE,
   BlobSet
 };
-//# sourceMappingURL=chunk-66W5OOCX.js.map
+//# sourceMappingURL=chunk-JLYQQNY4.js.map