@noy-db/hub 0.6.0-pre.21 → 0.6.0-pre.23

package/dist/{chunk-JLYQQNY4.js → chunk-BYX3AUXH.js}

@@ -1,16 +1,16 @@
 import {
   assertTierAccess
-} from "./chunk-NW4TY6VC.js";
+} from "./chunk-3UIS6O6N.js";
 import {
   dekKey,
   liveRecordIsElevated,
   liveRecordTier
-} from "./chunk-PPCOKVFA.js";
+} from "./chunk-6ZTPSVY7.js";
 import {
   buildRecordAad,
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-OHOKBMTM.js";
+} from "./chunk-FUE2KPKM.js";
 import {
   buildRecordEnvelope,
   buildSealedRecordEnvelope
@@ -26,7 +26,7 @@ import {
   sha256Hex,
   unwrapCek,
   wrapCek
-} from "./chunk-AU3AUJIZ.js";
+} from "./chunk-RQQIB7CD.js";
 import {
   BlobIntentPendingError,
   BlobOfflineError,
@@ -37,7 +37,7 @@ import {
   UnsupportedTierCompositionError,
   ValidationError,
   isConflictError
-} from "./chunk-CWM4GQD2.js";
+} from "./chunk-HKANJAOP.js";
 
 // src/with-shape/blobs/blob-pinning.ts
 function memoryBlobPinStore() {
@@ -1012,13 +1012,18 @@ var BlobSet = class _BlobSet {
    *  - not yet stamped → apply via `casUpdateRefCountStamped`, then proceed
    *    exactly like the unstamped path below.
    *
-   * A crash can also land AFTER the index row is deleted but BEFORE every
-   * chunk is — `loadBlobObject` then returns null (indistinguishable from
-   * "never existed") and the object's `chunkCount` is gone with it. A
-   * stamped caller who knows the true count (the journal marker's captured
-   * `holds`, once that plumbing lands) supplies it via `chunkCountHint` so
-   * this call can still finish the chunk deletion; without it, an
-   * already-index-gone eTag is reported `'shredded'` same as today (best
+   * A crash can also land part-way through the deletion itself. Since #1127
+   * that deletion runs CHUNKS FIRST (see `deleteChunksThenIndex`), so what
+   * survives is an index row with some chunks already gone — a reachable,
+   * re-runnable state rather than chunks nothing can ever address again.
+   *
+   * An eTag whose index row is ALREADY absent on entry is therefore either
+   * pre-#1127 residue or a completed deletion. `loadBlobObject` returns null
+   * (indistinguishable from "never existed") and the object's `chunkCount` is
+   * gone with it. A stamped caller who knows the true count (the journal
+   * marker's captured `holds`, once that plumbing lands) supplies it via
+   * `chunkCountHint` so this call can still finish the chunk deletion; without
+   * it, an already-index-gone eTag is reported `'shredded'` same as today (best
    * effort — nothing left to key the cleanup off of).
    */
   async releaseRef(eTag, n, reclaimLegacy, tier, stamp, chunkCountHint) {
@@ -1035,24 +1040,72 @@ var BlobSet = class _BlobSet {
     if (stamp !== void 0 && loaded.blob.lastOps?.includes(stamp)) {
       if (loaded.blob.refCount > 0) return erasable ? "retainedShared" : "residue";
       if (erasable || reclaimLegacy) {
-        await this.store.delete(this.vault, BLOB_INDEX_COLLECTION, eTag);
         const chunkCount = chunkCountHint ?? loaded.blob.chunkCount;
-        for (let i = 0; i < chunkCount; i++) {
-          await this.store.delete(this.vault, BLOB_CHUNKS_COLLECTION, `${eTag}_${i}`);
-        }
+        await this.deleteChunksThenIndex(eTag, chunkCount);
       }
       return erasable ? "shredded" : "residue";
     }
     const remaining = stamp !== void 0 ? (await this.casUpdateRefCountStamped(eTag, -n, tier, stamp)).refCount : await this.casUpdateRefCount(eTag, -n, tier);
     if (remaining > 0) return erasable ? "retainedShared" : "residue";
     if (erasable || reclaimLegacy) {
-      await this.store.delete(this.vault, BLOB_INDEX_COLLECTION, eTag);
-      for (let i = 0; i < loaded.blob.chunkCount; i++) {
-        await this.store.delete(this.vault, BLOB_CHUNKS_COLLECTION, `${eTag}_${i}`);
-      }
+      await this.deleteChunksThenIndex(eTag, loaded.blob.chunkCount);
     }
     return erasable ? "shredded" : "residue";
   }
+  /**
+   * Delete a blob's chunks, THEN its index row. The order is the whole point
+   * (#1127).
+   *
+   * Both deletions used to run index-first, which meant a crash in between
+   * stranded chunks with no index row. Nothing can ever reach those again:
+   * `loadBlobObject` returns null, so no reader addresses them — and
+   * `rekeyBlobSet` derives its chunk ids from each index entry's `chunkCount`,
+   * so a rotation never visits them either. For a LEGACY blob (bytes under the
+   * `_blob` DEK itself rather than a per-blob content CEK) the bodies then stay
+   * openable under the retired `_blob` DEK — precisely the key a revoked member
+   * walked away with. Crash during `forget()`, revoke later, and real blob
+   * content sits readable indefinitely, with no error on either side.
+   *
+   * Reversing it removes the class rather than cleaning up after it: every
+   * chunk that still exists has an index row, so every chunk is reachable by
+   * `rekeyBlobSet` and gets re-keyed. There is no orphan to sweep because none
+   * is produced.
+   *
+   * The residue this ordering leaves instead is an index row whose chunks are
+   * partly gone. That state is better, but it is NOT free — it cost one reader
+   * correction (`resolveRehomedVersionETag`, which read an old blob's bytes
+   * while resuming a rehome and now checks `refCount <= 0` instead of relying
+   * on the row having vanished). An earlier draft of this comment called the
+   * new state "strictly better"; the full suite disproved that, and any future
+   * path that reads a blob by index needs the same care. What is true of it:
+   *   - it is REACHABLE, so a re-run of `releaseRef` completes the deletion
+   *     idempotently (both `store.delete` calls are void on an absent key);
+   *   - `rekeyBlobSet` already tolerates it — a missing chunk hits its
+   *     `if (!chunkEnv || !chunkEnv._iv) continue`, so a rotation still
+   *     succeeds and still re-keys every chunk that remains;
+   *   - it cannot leak, because the bytes that survive are the ones still
+   *     covered by rotation.
+   *
+   * This also makes one ordering rule true across the blob subsystem rather
+   * than two opposite ones: `kernel/enclave/record-keys/rekey-blob.ts` already
+   * re-encrypts chunks before re-sealing their index entry, and documents that
+   * order as its resume property.
+   *
+   * Deliberately NOT paired with a sweep that deletes pre-existing orphans:
+   * such a sweep must decide "orphaned" from `store.list(_blob_index)`, and the
+   * store is untrusted. A store that withholds one index row could make a LIVE
+   * blob's chunks look orphaned and have us destroy them — turning withholding,
+   * which is reversible, into permanent loss. Reporting them is safe; deleting
+   * them on the store's word is not. The report half shipped as
+   * `reportOrphanBlobChunks` (#1133), surfaced through `vault.compact()`; a
+   * reclaim pass remains deliberately unbuilt for the reason above.
+   */
+  async deleteChunksThenIndex(eTag, chunkCount) {
+    for (let i = 0; i < chunkCount; i++) {
+      await this.store.delete(this.vault, BLOB_CHUNKS_COLLECTION, `${eTag}_${i}`);
+    }
+    await this.store.delete(this.vault, BLOB_INDEX_COLLECTION, eTag);
+  }
   /**
    * Crypto-shred this record's blob attachments — called by
    * `vault.forget()`.
@@ -1784,7 +1837,12 @@ var BlobSet = class _BlobSet {
       return already;
     }
     const loaded = await this.loadBlobObject(record.eTag, fromTier);
-    if (!loaded || loaded.blob._cek === void 0) return record.eTag;
+    if (!loaded) return record.eTag;
+    if (loaded.blob.refCount <= 0) {
+      await this.releaseOldETagAfterMove(record.eTag, fromTier, stamp);
+      return record.eTag;
+    }
+    if (loaded.blob._cek === void 0) return record.eTag;
     if (policy === "dedup" && loaded.blob.refCount > 1) return record.eTag;
     const plaintext = await this.fetchAllChunks(loaded.blob, fromBlobDEK);
     const { eTag: newETag } = await this.writeBlobContent(plaintext, toBlobDEK, {
@@ -3057,4 +3115,4 @@ export {
   DEFAULT_CHUNK_SIZE,
   BlobSet
 };
-//# sourceMappingURL=chunk-JLYQQNY4.js.map
+//# sourceMappingURL=chunk-BYX3AUXH.js.map