@noy-db/hub 0.6.0-pre.23 → 0.6.0-pre.24

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # Changelog — hub
 
+## 0.6.0-pre.24
+
+### Minor Changes
+
+- The roster tag authenticates the DEK key set (#1115).
+
+  `revoke` derives its rotation scope from `Object.keys(target.deks)`. That set was not covered by the roster tag, so a store could strip entries from the target's keyring before a revocation and have those collections silently skipped by the rotation — a revoked member colluding with that store keeps live DEKs for exactly the collections it removed. That contradicted `SECURITY.md`'s _"the rotation cannot be skipped"_.
+
+  `rosterCanonical` now binds the key **names** of `deks` and `pending_deks`. Names only: the wrapped values are AES-KW and self-authenticating, so what was unprotected was the shape of the map, not its contents. `pending_deks` is included because stripping it makes an interrupted rotation mint a fresh DEK instead of resuming, orphaning every record already rewritten under the pending key.
+
+  **This is a keyring format change with no migration** — consistent with the position recorded for `0.6.0-pre.21`: an existing vault must be re-seeded. `NOYDB_KEYRING_VERSION` is bumped to `2`, and a tag that cannot verify against an older declared version now reports the new `format-superseded` reason, which names the format transition instead of accusing the store. Classification only — access is refused either way, so a store rewriting the plaintext version field changes the wording and nothing else.
+
+  Also fixes `adoptPartition`, which merged partition DEKs into a freshly-minted keyring without restamping. That was invisible while the tag ignored `deks`; it now restamps, as `liberateVault` already did.
+
+- The blob content address survives a key rotation (#1126).
+
+  A blob's eTag is an HMAC over the plaintext. It was keyed by the `_blob` DEK — the very key `rotateKeys` replaces — so after any rotation `HMAC(live DEK, plaintext) !== storedETag` for every blob written before it, **permanently**. `decryptResponse()` checks that unconditionally, so the presigned-URL / external-object read path raised `TamperedError` on legitimate data forever; `verifyFlatETag` did the same on the flat-tier fallback; a resumed rehome mis-mapped; and dedup split, minting a second address for identical bytes.
+
+  Addresses now derive from `_blob_addr`, a **vault-lifetime keyring slot that rotation refuses to touch** — so a rotation re-keys chunk bodies while every stored address, chunk AAD and index row stays valid. The derivation stays **per tier**: the address is meant to be tier-scoped (`rehomeForTier` re-addresses on a tier move for exactly that reason); only the rotation coupling was ever wrong.
+
+  Reported by the same alarm as #1103, and this was the same cry-wolf class: a user who revoked a colleague was told their store may be attacking them.
+
+  **Format change, no migration** — consistent with the `0.6.0-pre.21` position: an existing vault must be re-seeded. **Residual:** a revoked member who kept the addressing root retains a confirmation oracle over content whose plaintext they already hold; they can read nothing, because bodies are sealed under DEKs that do rotate. See `SECURITY.md`.
+
+  Also restamps the roster tag on all three `recoverSecret` rebuild paths, which rewrote the keyring while carrying the previous tag.
+
+### Patch Changes
+
+- A narrowing re-grant rotates the collections it takes away (#1097, partial).
+
+  `writeKeyringFile` is a bare `put`, so a re-grant with a lower role or narrower permissions **overwrites in place** — and the file it replaces was legitimately minted by this vault. A store that kept a copy can re-serve it, and `loadKeyring` accepts it: the KEK unwraps, the canary checks out, the roster tag verifies. None of those is a claim about being _current_.
+
+  ADR 0003 bounded a suppressed keyring delete on the grounds that revocation rotates, so an old roster's DEKs cannot open post-rotation records. **A narrowing re-grant rotated nothing**, so a replayed file opened records written _after_ the narrowing — live access rather than stale access. Rotating the dropped collections restores that bound.
+
+  ⚠️ **This does not close the replay itself.** The old file also restores the old **role**, and role gates capabilities rather than keys, so rotation cannot touch it. That half needs an anchor the store cannot rewind, and #1097 stays open for it.
+
+  A widening re-grant and a first grant rotate nothing, so this is not a tax on every grant.
+
+- `rotateKeys` covers `collection#tier` DEK slots, in both directions (#1125).
+
+  Elevated records live in the same collection as their tier-0 siblings, distinguished by the envelope `_tier` field, and are sealed under `dekKey(collection, tier)`. Rotation keyed off the collection **name**, so it was broken twice over:
+
+  - **Rotating `docs` threw.** It met an elevated record it could not open under the tier-0 DEK and rethrew — and because `revoke` rotates as its final step, revoking anyone from a vault holding a single elevated record **failed after the keyring had already been deleted**. Part-applied.
+  - **Rotating `docs#1` was a silent no-op.** `store.list(vault, "docs#1")` is empty because the slot names a key, not a collection, so nothing was re-encrypted and a revoked member who retained the tier key kept opening elevated records.
+
+  Rotation now walks the base collection for every slot and classifies each envelope by **which key opens it** — never by the envelope's claimed `_tier`, which is unencrypted and store-written. Routing on `_tier` would let a store mark a tier-0 record `_tier: 5` and have the rotation skip real data.
+
+  Guarded by an output-domain invariant rather than a row per known defect: after a revocation, no retained key opens any envelope, and the owner can still read everything.
+
 ## 0.6.0-pre.23
 
 ### Minor Changes

package/dist/api-56KUWV6E.js

@@ -0,0 +1,20 @@
+import {
+  UserApi,
+  createUserApi
+} from "./chunk-CDHX3SRW.js";
+import "./chunk-SQWXF2HP.js";
+import "./chunk-43FOH2OK.js";
+import "./chunk-FX3UIDCS.js";
+import "./chunk-NK7DO6A2.js";
+import "./chunk-AM6V36AG.js";
+import "./chunk-AU45F5FD.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-D7STIWJO.js";
+import "./chunk-UJ4Z67UQ.js";
+import "./chunk-5OFC3QYL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  UserApi,
+  createUserApi
+};
+//# sourceMappingURL=api-56KUWV6E.js.map

package/dist/attestation/index.js

@@ -1,42 +1,42 @@
 import {
   issueAttestationCore
-} from "../chunk-Z7AHYSZF.js";
+} from "../chunk-C3FCXXNI.js";
 import {
   getRevokedDocIdsCore,
   publishRevocationListCore,
   revokeDocCore,
   unrevokeDocCore
-} from "../chunk-G6DAESDS.js";
+} from "../chunk-GDYDYUO7.js";
 import {
   ATTESTATIONS_COLLECTION
-} from "../chunk-23ODLABM.js";
+} from "../chunk-Z45PK2H5.js";
 import {
   NO_ATTESTATION
-} from "../chunk-D5DZ4R7X.js";
+} from "../chunk-ICGLT356.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-FUE2KPKM.js";
-import "../chunk-PENPHA45.js";
-import "../chunk-OMXUQAZJ.js";
-import "../chunk-PUGHLCBW.js";
-import "../chunk-2LHPMFSR.js";
+import "../chunk-43FOH2OK.js";
+import "../chunk-FX3UIDCS.js";
+import "../chunk-NK7DO6A2.js";
+import "../chunk-AM6V36AG.js";
+import "../chunk-AU45F5FD.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-RQQIB7CD.js";
-import "../chunk-IGNJOJEP.js";
+import "../chunk-D7STIWJO.js";
+import "../chunk-UJ4Z67UQ.js";
 import {
   AttestationError,
   AttestationNotEnabledError
-} from "../chunk-HKANJAOP.js";
+} from "../chunk-5OFC3QYL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/attestation/active.ts
 function withAttestation() {
   return {
     async issueAttestation(ctx, args) {
-      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-NLJ3FCKL.js");
+      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-LV2IWCKY.js");
       return issueAttestationCore2(ctx, args);
     },
     async getDocumentSigningPublicKey(deps) {
-      const { loadSigner, loadOrCreateSigner } = await import("../signer-N5TGVOTN.js");
+      const { loadSigner, loadOrCreateSigner } = await import("../signer-AJ3MCSPI.js");
       const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK);
       if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 };
       if (deps.role !== "owner") {
@@ -46,19 +46,19 @@ function withAttestation() {
       return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 };
     },
     async revokeAttestation(ctx, docId) {
-      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-XQ5STGT4.js");
+      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-6NSQWTED.js");
       return revokeDocCore2(ctx, docId);
     },
     async unrevokeAttestation(ctx, docId) {
-      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-XQ5STGT4.js");
+      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-6NSQWTED.js");
       return unrevokeDocCore2(ctx, docId);
     },
     async getRevokedDocIds(ctx) {
-      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-XQ5STGT4.js");
+      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-6NSQWTED.js");
       return getRevokedDocIdsCore2(ctx);
     },
     async publishRevocationList(ctx) {
-      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-XQ5STGT4.js");
+      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-6NSQWTED.js");
       return publishRevocationListCore2(ctx);
     }
   };

package/dist/{backup-UOLAXOJ4.js → backup-WLKPDY3V.js}

@@ -3,37 +3,37 @@ import {
 } from "./chunk-EPFF7LOX.js";
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-SZFNO7L4.js";
+} from "./chunk-AKPIBKHK.js";
 import {
   SEQUENCE_COLLECTION
-} from "./chunk-G4577GK7.js";
+} from "./chunk-2S6HROLU.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
   PERIOD_FREEZES_COLLECTION,
   PERIOD_REOPENS_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION
-} from "./chunk-VXH5Z22C.js";
+} from "./chunk-OQT3G55N.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
 } from "./chunk-I7FD46FF.js";
-import "./chunk-FUE2KPKM.js";
+import "./chunk-43FOH2OK.js";
 import {
   buildRecordEnvelope
-} from "./chunk-PENPHA45.js";
-import "./chunk-OMXUQAZJ.js";
-import "./chunk-PUGHLCBW.js";
-import "./chunk-2LHPMFSR.js";
+} from "./chunk-FX3UIDCS.js";
+import "./chunk-NK7DO6A2.js";
+import "./chunk-AM6V36AG.js";
+import "./chunk-AU45F5FD.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-RQQIB7CD.js";
+import "./chunk-D7STIWJO.js";
 import {
   NOYDB_BACKUP_VERSION
-} from "./chunk-IGNJOJEP.js";
+} from "./chunk-UJ4Z67UQ.js";
 import {
   BackupCorruptedError,
   BackupLedgerError
-} from "./chunk-HKANJAOP.js";
+} from "./chunk-5OFC3QYL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-pod/backup.ts
@@ -262,4 +262,4 @@ export {
   loadVault,
   verifyBackupIntegrity
 };
-//# sourceMappingURL=backup-UOLAXOJ4.js.map
+//# sourceMappingURL=backup-WLKPDY3V.js.map

package/dist/blobs/index.js

@@ -10,7 +10,7 @@ import {
   createExportBlobsHandle,
   reportOrphanBlobChunks,
   runCompaction
-} from "../chunk-TA67ZQUH.js";
+} from "../chunk-FKLKAO2C.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -25,21 +25,21 @@ import {
   detectMimeType,
   isPreCompressed,
   memoryBlobPinStore
-} from "../chunk-BYX3AUXH.js";
-import "../chunk-LZHIYH32.js";
-import "../chunk-3UIS6O6N.js";
-import "../chunk-6ZTPSVY7.js";
-import "../chunk-FUE2KPKM.js";
-import "../chunk-PENPHA45.js";
-import "../chunk-OMXUQAZJ.js";
-import "../chunk-PUGHLCBW.js";
-import "../chunk-2LHPMFSR.js";
+} from "../chunk-24ZDSTEQ.js";
+import "../chunk-6PLCNLBC.js";
+import "../chunk-57MEX4LL.js";
+import "../chunk-NSZGZYZL.js";
+import "../chunk-43FOH2OK.js";
+import "../chunk-FX3UIDCS.js";
+import "../chunk-NK7DO6A2.js";
+import "../chunk-AM6V36AG.js";
+import "../chunk-AU45F5FD.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-RQQIB7CD.js";
-import "../chunk-IGNJOJEP.js";
+import "../chunk-D7STIWJO.js";
+import "../chunk-UJ4Z67UQ.js";
 import {
   BlobOfflineError
-} from "../chunk-HKANJAOP.js";
+} from "../chunk-5OFC3QYL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/via/blob/active.ts

package/dist/broker/index.js

@@ -1,22 +1,22 @@
 import {
   NO_BROKER
-} from "../chunk-LYQUFIHL.js";
+} from "../chunk-K7HPGV5K.js";
 import {
   issueChallenge,
   verifyBrokerProof
-} from "../chunk-FUE2KPKM.js";
-import "../chunk-PENPHA45.js";
-import "../chunk-OMXUQAZJ.js";
-import "../chunk-PUGHLCBW.js";
-import "../chunk-2LHPMFSR.js";
+} from "../chunk-43FOH2OK.js";
+import "../chunk-FX3UIDCS.js";
+import "../chunk-NK7DO6A2.js";
+import "../chunk-AM6V36AG.js";
+import "../chunk-AU45F5FD.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-RQQIB7CD.js";
-import "../chunk-IGNJOJEP.js";
+import "../chunk-D7STIWJO.js";
+import "../chunk-UJ4Z67UQ.js";
 import {
   BrokerEnrolmentError,
   BrokerNotEnabledError,
   BrokerProofError
-} from "../chunk-HKANJAOP.js";
+} from "../chunk-5OFC3QYL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-party/broker/active.ts
@@ -30,7 +30,7 @@ function withBroker(config) {
   const cache = /* @__PURE__ */ new Map();
   return {
     async enroll(ctx) {
-      const { enrollSeed } = await import("../seed-WJWCFPZL.js");
+      const { enrollSeed } = await import("../seed-ZLOK3Z4M.js");
       return enrollSeed({ ...ctx, config });
     },
     async rotate(ctx) {
@@ -39,7 +39,7 @@ function withBroker(config) {
       const inFlight = scoped.map(([, e]) => e.inFlight).filter((p) => p !== void 0);
       await Promise.allSettled(inFlight);
       for (const [key] of scoped) cache.delete(key);
-      const { rotateSeed } = await import("../seed-WJWCFPZL.js");
+      const { rotateSeed } = await import("../seed-ZLOK3Z4M.js");
       return rotateSeed({ ...ctx, config });
     },
     credentialSource(ctx, profile) {
@@ -56,7 +56,7 @@ function withBroker(config) {
         const skewMs = config.skewMs ?? DEFAULT_SKEW_MS;
         const capturedEntry = entry;
         const inFlight = (async () => {
-          const { mintStoreCredentials } = await import("../seed-WJWCFPZL.js");
+          const { mintStoreCredentials } = await import("../seed-ZLOK3Z4M.js");
           const creds = await mintStoreCredentials({ ...ctx, config }, profile);
           capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) };
           return creds;

package/dist/cargo/index.js

@@ -6,67 +6,67 @@ import {
   diffVault,
   unsealDeks,
   withCargo
-} from "../chunk-UWRVDBDC.js";
+} from "../chunk-LU2HAOVP.js";
 import {
   extractPartition,
   walkClosure
-} from "../chunk-SIACMXFK.js";
+} from "../chunk-RTBCWDJ3.js";
 import {
   createDeedOwner,
   isDeedVault,
   liberateVault,
   loadDeedMarker
-} from "../chunk-ISRAQIYY.js";
-import "../chunk-I3D67XD7.js";
-import "../chunk-7LWBD3NO.js";
+} from "../chunk-PZEDIO72.js";
+import "../chunk-576CTQ77.js";
+import "../chunk-35K4VWMD.js";
 import {
   NO_CARGO,
   isQuorum,
   runDrainBarrier
-} from "../chunk-WBFJZCDJ.js";
-import "../chunk-OTHHO3KI.js";
-import "../chunk-SZFNO7L4.js";
+} from "../chunk-GCTZNHDO.js";
+import "../chunk-S2I5MYSA.js";
+import "../chunk-AKPIBKHK.js";
 import {
   CustodyApi
-} from "../chunk-WG66ZPEV.js";
-import "../chunk-XXONVJWA.js";
-import "../chunk-5FRZ7YYU.js";
+} from "../chunk-KEMD6B3W.js";
+import "../chunk-DM2BZDNV.js";
+import "../chunk-TTGZ6KGY.js";
 import {
   fuseRetrieval
 } from "../chunk-AURFOK3D.js";
-import "../chunk-BYX3AUXH.js";
+import "../chunk-24ZDSTEQ.js";
 import {
   groupAndReduce,
   reduceRecords
-} from "../chunk-DXJXVWWE.js";
+} from "../chunk-264AKW4K.js";
 import "../chunk-XZHEOSQ2.js";
 import "../chunk-ATL3ZVXT.js";
 import {
   readPath
 } from "../chunk-NSITFOCJ.js";
-import "../chunk-U5ZDYJLQ.js";
-import "../chunk-LZHIYH32.js";
-import "../chunk-AK6EWGDO.js";
-import "../chunk-GJ5TMHKC.js";
-import "../chunk-3UIS6O6N.js";
+import "../chunk-IYXP6OR5.js";
+import "../chunk-6PLCNLBC.js";
+import "../chunk-YEEV4ZXL.js";
+import "../chunk-SQWXF2HP.js";
+import "../chunk-57MEX4LL.js";
 import {
   generateULID
 } from "../chunk-4AOERLTV.js";
 import "../chunk-SVLR4POP.js";
-import "../chunk-OGB2UTBC.js";
+import "../chunk-FJGNYSB3.js";
 import "../chunk-I7FD46FF.js";
-import "../chunk-YLIGPHN4.js";
-import "../chunk-6ZTPSVY7.js";
-import "../chunk-FUE2KPKM.js";
-import "../chunk-PENPHA45.js";
-import "../chunk-OMXUQAZJ.js";
-import "../chunk-PUGHLCBW.js";
-import "../chunk-2LHPMFSR.js";
+import "../chunk-GU5XWSH4.js";
+import "../chunk-NSZGZYZL.js";
+import "../chunk-43FOH2OK.js";
+import "../chunk-FX3UIDCS.js";
+import "../chunk-NK7DO6A2.js";
+import "../chunk-AM6V36AG.js";
+import "../chunk-AU45F5FD.js";
 import "../chunk-LP7BEXCT.js";
 import {
   sha256Hex
-} from "../chunk-RQQIB7CD.js";
-import "../chunk-IGNJOJEP.js";
+} from "../chunk-D7STIWJO.js";
+import "../chunk-UJ4Z67UQ.js";
 import {
   AdoptionStateError,
   CargoNotEnabledError,
@@ -81,7 +81,7 @@ import {
   UnknownShardError,
   ValidationError,
   VaultTemplateNotFoundError
-} from "../chunk-HKANJAOP.js";
+} from "../chunk-5OFC3QYL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   AdoptionStateError,

package/dist/{chunk-BYX3AUXH.js → chunk-24ZDSTEQ.js}

@@ -1,24 +1,25 @@
 import {
   assertTierAccess
-} from "./chunk-3UIS6O6N.js";
+} from "./chunk-57MEX4LL.js";
 import {
   dekKey,
   liveRecordIsElevated,
   liveRecordTier
-} from "./chunk-6ZTPSVY7.js";
+} from "./chunk-NSZGZYZL.js";
 import {
   buildRecordAad,
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-FUE2KPKM.js";
+} from "./chunk-43FOH2OK.js";
 import {
   buildRecordEnvelope,
   buildSealedRecordEnvelope
-} from "./chunk-PENPHA45.js";
+} from "./chunk-FX3UIDCS.js";
 import {
   base64ToBuffer,
   bufferToBase64,
   decryptBytesWithAAD,
+  deriveBlobAddressKey,
   encrypt,
   encryptBytesWithAAD,
   generateDEK,
@@ -26,8 +27,9 @@ import {
   sha256Hex,
   unwrapCek,
   wrapCek
-} from "./chunk-RQQIB7CD.js";
+} from "./chunk-D7STIWJO.js";
 import {
+  BLOB_ADDRESS_KEY_ID,
   BlobIntentPendingError,
   BlobOfflineError,
   ConflictError,
@@ -37,7 +39,7 @@ import {
   UnsupportedTierCompositionError,
   ValidationError,
   isConflictError
-} from "./chunk-HKANJAOP.js";
+} from "./chunk-5OFC3QYL.js";
 
 // src/with-shape/blobs/blob-pinning.ts
 function memoryBlobPinStore() {
@@ -567,6 +569,26 @@ var BlobSet = class _BlobSet {
    * write throws an AEAD decrypt error rather than silently writing under
    * the wrong key.
    */
+  /**
+   * The content-addressing key for `tier` (#1126).
+   *
+   * Derived from `_blob_addr`, a vault-lifetime keyring slot `rotateKeys`
+   * refuses to touch — so a rotation re-keys chunk BODIES while every stored
+   * eTag, and therefore every chunk AAD and every `_blob_index` /
+   * `_blob_slots_*` / `_blob_versions_*` row, survives it unchanged.
+   *
+   * Before this the address was keyed by the `_blob` DEK itself, so after any
+   * rotation `HMAC(live DEK, plaintext) !== storedETag` permanently, for every
+   * blob written earlier: `decryptResponse()` raised `TamperedError` on the
+   * presigned-URL path forever, and dedup split.
+   *
+   * Still derived PER TIER, because the address is meant to be tier-scoped —
+   * `rehomeForTier` re-addresses on a tier move for exactly that reason. Only
+   * the ROTATION coupling was ever wrong.
+   */
+  async addressKey(tier) {
+    return deriveBlobAddressKey(await this.getDEK(BLOB_ADDRESS_KEY_ID), tier);
+  }
   async ownerTier() {
     if (this.clearedTier !== void 0) return this.clearedTier;
     return liveRecordTier(this.store, this.vault, this.collection, this.recordId);
@@ -1667,7 +1689,6 @@ var BlobSet = class _BlobSet {
     if (Object.keys(slots).length > 0) {
       if (slotsAtTier === toTier) {
         const toBlobDEK = await this.getDEK(dekKey(BLOB_COLLECTION, toTier));
-        const fromBlobDEK = await this.getDEK(dekKey(BLOB_COLLECTION, fromTier));
         const doneETags = new Set(Object.values(slots).map((s) => s.eTag).filter((eTag) => eTag !== ""));
         for (const eTag of doneETags) {
           let loaded;
@@ -1679,7 +1700,7 @@ var BlobSet = class _BlobSet {
           }
           if (!loaded || loaded.atTier !== toTier || loaded.blob._cek === void 0) continue;
           const plaintext = await this.fetchAllChunks(loaded.blob, toBlobDEK);
-          const oldETag = await hmacSha256Hex(fromBlobDEK, plaintext);
+          const oldETag = await hmacSha256Hex(await this.addressKey(fromTier), plaintext);
           if (oldETag !== eTag) rehomedETags.set(oldETag, eTag);
         }
       } else {
@@ -1695,7 +1716,7 @@ var BlobSet = class _BlobSet {
             if (blob._cek === void 0) continue;
             if (policy === "dedup" && blob.refCount > 1) continue;
             const plaintext = await this.fetchAllChunks(blob, fromBlobDEK);
-            rehomedETags.set(eTag, await hmacSha256Hex(toBlobDEK, plaintext));
+            rehomedETags.set(eTag, await hmacSha256Hex(await this.addressKey(toTier), plaintext));
             for (const [slotName, slot] of Object.entries(slots)) {
               if (slot.eTag !== eTag) continue;
               await this.putUnderDEK(slotName, plaintext, toBlobDEK, {
@@ -2067,7 +2088,7 @@ var BlobSet = class _BlobSet {
    * attacker-controlled content pulled from the same forged row and would
    * make the check tautological). After assembling the plaintext, we
    * recompute the SAME content address every write path mints
-   * (`hmacSha256Hex(flatBlobDEK, plaintext)` — `writeBlobContent`'s Step 1,
+   * (`hmacSha256Hex(addressKey(tier), plaintext)` — `writeBlobContent`'s Step 1,
    * unconditional on `_cek`) and compare it to that requested eTag. A
    * forged row can produce valid ciphertext under the flat DEK, but can't
    * produce plaintext that re-hashes to an address it doesn't control.
@@ -2095,7 +2116,7 @@ var BlobSet = class _BlobSet {
     const assembled = concatChunks(chunks);
     const plaintext = blob.compression === "gzip" ? await decompressBytes(assembled) : assembled;
     if (verifyFlatETag !== void 0 && blobDEK) {
-      const recomputed = await hmacSha256Hex(blobDEK, plaintext);
+      const recomputed = await hmacSha256Hex(await this.addressKey(0), plaintext);
       if (recomputed !== verifyFlatETag) {
         throw new TamperedError(
           `Blob content for eTag "${verifyFlatETag}" failed content-address verification after a flat-tier fallback open \u2014 the _blob_index/_blob_chunks rows do not match the requested content address (#747/#749 review I1)`
@@ -2179,8 +2200,9 @@ var BlobSet = class _BlobSet {
       return;
     }
     this.assertBlobWritable();
-    const blobDEK = this.encrypted ? await this.getDEK(dekKey(BLOB_COLLECTION, await this.ownerTier())) : null;
-    return this.putUnderDEK(slotName, data, blobDEK, opts);
+    const ownerTier = await this.ownerTier();
+    const blobDEK = this.encrypted ? await this.getDEK(dekKey(BLOB_COLLECTION, ownerTier)) : null;
+    return this.putUnderDEK(slotName, data, blobDEK, opts, void 0, ownerTier);
   }
   /**
    * The slot-attachment core of `put()` (Step 7 — CAS the slot metadata),
@@ -2345,7 +2367,7 @@ var BlobSet = class _BlobSet {
    * dedup-hit branch's behavior exactly.
    */
   async writeBlobContent(data, blobDEK, opts, tier, incrementStamp, knownApplied) {
-    const eTag = blobDEK ? await hmacSha256Hex(blobDEK, data) : await plainSha256Hex(data);
+    const eTag = blobDEK ? await hmacSha256Hex(await this.addressKey(tier ?? 0), data) : await plainSha256Hex(data);
     let mimeType = opts?.mimeType;
     if (!mimeType) {
       const detected = detectMagic(data.subarray(0, 16));
@@ -3041,7 +3063,7 @@ var BlobSet = class _BlobSet {
     const aad = chunkAAD(slot.eTag, 0, result.blob.chunkCount);
     const decrypted = await decryptBytesWithAAD(envelope._iv, envelope._data, chunkKey, aad);
     const plaintext = result.blob.compression === "gzip" ? await decompressBytes(decrypted) : decrypted;
-    const recomputed = await hmacSha256Hex(blobDEK, plaintext);
+    const recomputed = await hmacSha256Hex(await this.addressKey(await this.ownerTier()), plaintext);
     if (recomputed !== slot.eTag) {
       throw new TamperedError(
         `Blob content for eTag "${slot.eTag}" failed content-address verification in decryptResponse() \u2014 the caller-provided ciphertext does not match the requested content address (#757)`
@@ -3115,4 +3137,4 @@ export {
   DEFAULT_CHUNK_SIZE,
   BlobSet
 };
-//# sourceMappingURL=chunk-BYX3AUXH.js.map
+//# sourceMappingURL=chunk-24ZDSTEQ.js.map