@noy-db/hub 0.6.0-pre.22 → 0.6.0-pre.24

package/dist/{chunk-PNXJV4OS.js → chunk-24ZDSTEQ.js}

@@ -1,24 +1,25 @@
 import {
   assertTierAccess
-} from "./chunk-OCW3IM2F.js";
+} from "./chunk-57MEX4LL.js";
 import {
   dekKey,
   liveRecordIsElevated,
   liveRecordTier
-} from "./chunk-WUNRUSBJ.js";
+} from "./chunk-NSZGZYZL.js";
 import {
   buildRecordAad,
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-DIVPOJPV.js";
+} from "./chunk-43FOH2OK.js";
 import {
   buildRecordEnvelope,
   buildSealedRecordEnvelope
-} from "./chunk-PENPHA45.js";
+} from "./chunk-FX3UIDCS.js";
 import {
   base64ToBuffer,
   bufferToBase64,
   decryptBytesWithAAD,
+  deriveBlobAddressKey,
   encrypt,
   encryptBytesWithAAD,
   generateDEK,
@@ -26,8 +27,9 @@ import {
   sha256Hex,
   unwrapCek,
   wrapCek
-} from "./chunk-O5QXH7U7.js";
+} from "./chunk-D7STIWJO.js";
 import {
+  BLOB_ADDRESS_KEY_ID,
   BlobIntentPendingError,
   BlobOfflineError,
   ConflictError,
@@ -37,7 +39,7 @@ import {
   UnsupportedTierCompositionError,
   ValidationError,
   isConflictError
-} from "./chunk-PKUJ3JLQ.js";
+} from "./chunk-5OFC3QYL.js";
 
 // src/with-shape/blobs/blob-pinning.ts
 function memoryBlobPinStore() {
@@ -567,6 +569,26 @@ var BlobSet = class _BlobSet {
    * write throws an AEAD decrypt error rather than silently writing under
    * the wrong key.
    */
+  /**
+   * The content-addressing key for `tier` (#1126).
+   *
+   * Derived from `_blob_addr`, a vault-lifetime keyring slot `rotateKeys`
+   * refuses to touch — so a rotation re-keys chunk BODIES while every stored
+   * eTag, and therefore every chunk AAD and every `_blob_index` /
+   * `_blob_slots_*` / `_blob_versions_*` row, survives it unchanged.
+   *
+   * Before this the address was keyed by the `_blob` DEK itself, so after any
+   * rotation `HMAC(live DEK, plaintext) !== storedETag` permanently, for every
+   * blob written earlier: `decryptResponse()` raised `TamperedError` on the
+   * presigned-URL path forever, and dedup split.
+   *
+   * Still derived PER TIER, because the address is meant to be tier-scoped —
+   * `rehomeForTier` re-addresses on a tier move for exactly that reason. Only
+   * the ROTATION coupling was ever wrong.
+   */
+  async addressKey(tier) {
+    return deriveBlobAddressKey(await this.getDEK(BLOB_ADDRESS_KEY_ID), tier);
+  }
   async ownerTier() {
     if (this.clearedTier !== void 0) return this.clearedTier;
     return liveRecordTier(this.store, this.vault, this.collection, this.recordId);
@@ -1096,7 +1118,9 @@ var BlobSet = class _BlobSet {
    * store is untrusted. A store that withholds one index row could make a LIVE
    * blob's chunks look orphaned and have us destroy them — turning withholding,
    * which is reversible, into permanent loss. Reporting them is safe; deleting
-   * them on the store's word is not. See #1133 for the report-then-reclaim follow-up.
+   * them on the store's word is not. The report half shipped as
+   * `reportOrphanBlobChunks` (#1133), surfaced through `vault.compact()`; a
+   * reclaim pass remains deliberately unbuilt for the reason above.
    */
   async deleteChunksThenIndex(eTag, chunkCount) {
     for (let i = 0; i < chunkCount; i++) {
@@ -1665,7 +1689,6 @@ var BlobSet = class _BlobSet {
     if (Object.keys(slots).length > 0) {
       if (slotsAtTier === toTier) {
         const toBlobDEK = await this.getDEK(dekKey(BLOB_COLLECTION, toTier));
-        const fromBlobDEK = await this.getDEK(dekKey(BLOB_COLLECTION, fromTier));
         const doneETags = new Set(Object.values(slots).map((s) => s.eTag).filter((eTag) => eTag !== ""));
         for (const eTag of doneETags) {
           let loaded;
@@ -1677,7 +1700,7 @@ var BlobSet = class _BlobSet {
           }
           if (!loaded || loaded.atTier !== toTier || loaded.blob._cek === void 0) continue;
           const plaintext = await this.fetchAllChunks(loaded.blob, toBlobDEK);
-          const oldETag = await hmacSha256Hex(fromBlobDEK, plaintext);
+          const oldETag = await hmacSha256Hex(await this.addressKey(fromTier), plaintext);
           if (oldETag !== eTag) rehomedETags.set(oldETag, eTag);
         }
       } else {
@@ -1693,7 +1716,7 @@ var BlobSet = class _BlobSet {
             if (blob._cek === void 0) continue;
             if (policy === "dedup" && blob.refCount > 1) continue;
             const plaintext = await this.fetchAllChunks(blob, fromBlobDEK);
-            rehomedETags.set(eTag, await hmacSha256Hex(toBlobDEK, plaintext));
+            rehomedETags.set(eTag, await hmacSha256Hex(await this.addressKey(toTier), plaintext));
             for (const [slotName, slot] of Object.entries(slots)) {
               if (slot.eTag !== eTag) continue;
               await this.putUnderDEK(slotName, plaintext, toBlobDEK, {
@@ -2065,7 +2088,7 @@ var BlobSet = class _BlobSet {
    * attacker-controlled content pulled from the same forged row and would
    * make the check tautological). After assembling the plaintext, we
    * recompute the SAME content address every write path mints
-   * (`hmacSha256Hex(flatBlobDEK, plaintext)` — `writeBlobContent`'s Step 1,
+   * (`hmacSha256Hex(addressKey(tier), plaintext)` — `writeBlobContent`'s Step 1,
    * unconditional on `_cek`) and compare it to that requested eTag. A
    * forged row can produce valid ciphertext under the flat DEK, but can't
    * produce plaintext that re-hashes to an address it doesn't control.
@@ -2093,7 +2116,7 @@ var BlobSet = class _BlobSet {
     const assembled = concatChunks(chunks);
     const plaintext = blob.compression === "gzip" ? await decompressBytes(assembled) : assembled;
     if (verifyFlatETag !== void 0 && blobDEK) {
-      const recomputed = await hmacSha256Hex(blobDEK, plaintext);
+      const recomputed = await hmacSha256Hex(await this.addressKey(0), plaintext);
       if (recomputed !== verifyFlatETag) {
         throw new TamperedError(
           `Blob content for eTag "${verifyFlatETag}" failed content-address verification after a flat-tier fallback open \u2014 the _blob_index/_blob_chunks rows do not match the requested content address (#747/#749 review I1)`
@@ -2177,8 +2200,9 @@ var BlobSet = class _BlobSet {
       return;
     }
     this.assertBlobWritable();
-    const blobDEK = this.encrypted ? await this.getDEK(dekKey(BLOB_COLLECTION, await this.ownerTier())) : null;
-    return this.putUnderDEK(slotName, data, blobDEK, opts);
+    const ownerTier = await this.ownerTier();
+    const blobDEK = this.encrypted ? await this.getDEK(dekKey(BLOB_COLLECTION, ownerTier)) : null;
+    return this.putUnderDEK(slotName, data, blobDEK, opts, void 0, ownerTier);
   }
   /**
    * The slot-attachment core of `put()` (Step 7 — CAS the slot metadata),
@@ -2343,7 +2367,7 @@ var BlobSet = class _BlobSet {
    * dedup-hit branch's behavior exactly.
    */
   async writeBlobContent(data, blobDEK, opts, tier, incrementStamp, knownApplied) {
-    const eTag = blobDEK ? await hmacSha256Hex(blobDEK, data) : await plainSha256Hex(data);
+    const eTag = blobDEK ? await hmacSha256Hex(await this.addressKey(tier ?? 0), data) : await plainSha256Hex(data);
     let mimeType = opts?.mimeType;
     if (!mimeType) {
       const detected = detectMagic(data.subarray(0, 16));
@@ -3039,7 +3063,7 @@ var BlobSet = class _BlobSet {
     const aad = chunkAAD(slot.eTag, 0, result.blob.chunkCount);
     const decrypted = await decryptBytesWithAAD(envelope._iv, envelope._data, chunkKey, aad);
     const plaintext = result.blob.compression === "gzip" ? await decompressBytes(decrypted) : decrypted;
-    const recomputed = await hmacSha256Hex(blobDEK, plaintext);
+    const recomputed = await hmacSha256Hex(await this.addressKey(await this.ownerTier()), plaintext);
     if (recomputed !== slot.eTag) {
       throw new TamperedError(
         `Blob content for eTag "${slot.eTag}" failed content-address verification in decryptResponse() \u2014 the caller-provided ciphertext does not match the requested content address (#757)`
@@ -3113,4 +3137,4 @@ export {
   DEFAULT_CHUNK_SIZE,
   BlobSet
 };
-//# sourceMappingURL=chunk-PNXJV4OS.js.map
+//# sourceMappingURL=chunk-24ZDSTEQ.js.map