@noy-db/hub 0.6.0-pre.8 → 0.6.0

package/dist/{chunk-PL2GHSCM.js → chunk-JMJSCI7U.js}

@@ -1,19 +1,25 @@
 import {
-  assertTierAccess,
-  dekKey
-} from "./chunk-AHLJSVRL.js";
+  assertTierAccess
+} from "./chunk-3YGUHUJA.js";
 import {
+  dekKey,
   liveRecordIsElevated,
   liveRecordTier
-} from "./chunk-3FSX6LDG.js";
+} from "./chunk-D2YFQ7XG.js";
 import {
+  buildRecordAad,
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-3URQC7EH.js";
+} from "./chunk-CXPOG3ZY.js";
+import {
+  buildRecordEnvelope,
+  buildSealedRecordEnvelope
+} from "./chunk-FX3UIDCS.js";
 import {
   base64ToBuffer,
   bufferToBase64,
   decryptBytesWithAAD,
+  deriveBlobAddressKey,
   encrypt,
   encryptBytesWithAAD,
   generateDEK,
@@ -21,11 +27,9 @@ import {
   sha256Hex,
   unwrapCek,
   wrapCek
-} from "./chunk-VCETL77O.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-YPYHVOXP.js";
+} from "./chunk-ONPVHX2Y.js";
 import {
+  BLOB_ADDRESS_KEY_ID,
   BlobIntentPendingError,
   BlobOfflineError,
   ConflictError,
@@ -35,7 +39,7 @@ import {
   UnsupportedTierCompositionError,
   ValidationError,
   isConflictError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-Z3BZXPRO.js";
 
 // src/with-shape/blobs/blob-pinning.ts
 function memoryBlobPinStore() {
@@ -301,30 +305,28 @@ function parseIntentKey(key) {
   if (idx === -1) return null;
   return { collection: key.slice(0, idx), recordId: key.slice(idx + 2) };
 }
-async function encodeIntentEnvelope(intent, dek, newVersion = 1) {
+async function encodeIntentEnvelope(intent, dek, key, newVersion = 1) {
   const json = JSON.stringify(intent);
-  const body = await writeEnvelopeBody(json, dek);
-  return {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: newVersion,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    ...body
-  };
+  return buildSealedRecordEnvelope(
+    { collection: BLOB_INTENT_COLLECTION, id: key, version: newVersion },
+    (identity) => writeEnvelopeBody(identity, json, dek),
+    {}
+  );
 }
-async function decodeIntentEnvelope(envelope, dek) {
-  const json = await openEnvelopeJson(envelope, dek);
+async function decodeIntentEnvelope(key, envelope, dek) {
+  const json = await openEnvelopeJson({ collection: BLOB_INTENT_COLLECTION, id: key }, envelope, dek);
   return JSON.parse(json);
 }
 async function getIntent(adapter, vault, collection, recordId, getDEK) {
   const envelope = await adapter.get(vault, BLOB_INTENT_COLLECTION, intentKey(collection, recordId));
   if (!envelope) return null;
   const dek = await getDEK(collection);
-  return decodeIntentEnvelope(envelope, dek);
+  return decodeIntentEnvelope(intentKey(collection, recordId), envelope, dek);
 }
 async function createIntent(adapter, vault, collection, recordId, getDEK, intent) {
   const key = intentKey(collection, recordId);
   const dek = await getDEK(collection);
-  const envelope = await encodeIntentEnvelope(intent, dek);
+  const envelope = await encodeIntentEnvelope(intent, dek, key);
   try {
     await adapter.put(vault, BLOB_INTENT_COLLECTION, key, envelope, 0);
   } catch (err) {
@@ -344,10 +346,10 @@ async function recordAppliedStamp(adapter, vault, collection, recordId, getDEK,
   for (let attempt = 0; attempt < MAX_APPLIED_STAMP_RETRIES; attempt++) {
     const envelope = await adapter.get(vault, BLOB_INTENT_COLLECTION, key);
     if (!envelope) return;
-    const intent = await decodeIntentEnvelope(envelope, dek);
+    const intent = await decodeIntentEnvelope(key, envelope, dek);
     if (intent.op !== "rehome" || intent.appliedStamps?.includes(stamp)) return;
     const updated = { ...intent, appliedStamps: [...intent.appliedStamps ?? [], stamp] };
-    const newEnvelope = await encodeIntentEnvelope(updated, dek, envelope._v + 1);
+    const newEnvelope = await encodeIntentEnvelope(updated, dek, key, envelope._v + 1);
     try {
       await adapter.put(vault, BLOB_INTENT_COLLECTION, key, newEnvelope, envelope._v);
       return;
@@ -366,7 +368,7 @@ async function sweepBlobIntents(adapter, vault, getDEK, resume, onResumeError) {
       const envelope = await adapter.get(vault, BLOB_INTENT_COLLECTION, key);
       if (!envelope) continue;
       const dek = await getDEK(parsed.collection);
-      const intent = await decodeIntentEnvelope(envelope, dek);
+      const intent = await decodeIntentEnvelope(key, envelope, dek);
       await resume(parsed.collection, parsed.recordId, intent);
     } catch (err) {
       onResumeError?.(parsed.collection, parsed.recordId, err);
@@ -567,6 +569,26 @@ var BlobSet = class _BlobSet {
    * write throws an AEAD decrypt error rather than silently writing under
    * the wrong key.
    */
+  /**
+   * The content-addressing key for `tier` (#1126).
+   *
+   * Derived from `_blob_addr`, a vault-lifetime keyring slot `rotateKeys`
+   * refuses to touch — so a rotation re-keys chunk BODIES while every stored
+   * eTag, and therefore every chunk AAD and every `_blob_index` /
+   * `_blob_slots_*` / `_blob_versions_*` row, survives it unchanged.
+   *
+   * Before this the address was keyed by the `_blob` DEK itself, so after any
+   * rotation `HMAC(live DEK, plaintext) !== storedETag` permanently, for every
+   * blob written earlier: `decryptResponse()` raised `TamperedError` on the
+   * presigned-URL path forever, and dedup split.
+   *
+   * Still derived PER TIER, because the address is meant to be tier-scoped —
+   * `rehomeForTier` re-addresses on a tier move for exactly that reason. Only
+   * the ROTATION coupling was ever wrong.
+   */
+  async addressKey(tier) {
+    return deriveBlobAddressKey(await this.getDEK(BLOB_ADDRESS_KEY_ID), tier);
+  }
   async ownerTier() {
     if (this.clearedTier !== void 0) return this.clearedTier;
     return liveRecordTier(this.store, this.vault, this.collection, this.recordId);
@@ -654,7 +676,7 @@ var BlobSet = class _BlobSet {
       };
     }
     const dek = await this.getDEK(dekKey(this.collection, tier ?? await this.ownerTier()));
-    const json = await openEnvelopeJson(envelope, dek);
+    const json = await openEnvelopeJson({ collection: this.slotsCollection, id: this.recordId }, envelope, dek);
     return {
       slots: JSON.parse(json),
       version: envelope._v
@@ -678,38 +700,28 @@ var BlobSet = class _BlobSet {
     }
     const fromDek = await this.getDEK(dekKey(this.collection, fromTier));
     try {
-      const json2 = await openEnvelopeJson(envelope, fromDek);
+      const json2 = await openEnvelopeJson({ collection: this.slotsCollection, id: this.recordId }, envelope, fromDek);
       return { slots: JSON.parse(json2), version: envelope._v, atTier: fromTier };
     } catch (err) {
       if (!(err instanceof TamperedError) || fromTier === toTier) throw err;
     }
     const toDek = await this.getDEK(dekKey(this.collection, toTier));
-    const json = await openEnvelopeJson(envelope, toDek);
+    const json = await openEnvelopeJson({ collection: this.slotsCollection, id: this.recordId }, envelope, toDek);
     return { slots: JSON.parse(json), version: envelope._v, atTier: toTier };
   }
   /** @param tier See {@link loadSlots}'s `tier` param — same resolution. */
   async saveSlots(slots, currentVersion, tier) {
     const json = JSON.stringify(slots);
     const now = (/* @__PURE__ */ new Date()).toISOString();
+    const identity = { collection: this.slotsCollection, id: this.recordId, version: currentVersion + 1 };
+    const body = { ts: now };
     let envelope;
     if (this.encrypted) {
       const dek = await this.getDEK(dekKey(this.collection, tier ?? await this.ownerTier()));
-      const { iv, data } = await encrypt(json, dek);
-      envelope = {
-        _noydb: NOYDB_FORMAT_VERSION,
-        _v: currentVersion + 1,
-        _ts: now,
-        _iv: iv,
-        _data: data
-      };
+      const { iv, data } = await encrypt(json, dek, buildRecordAad(identity));
+      envelope = buildRecordEnvelope(identity, { ...body, iv, data });
     } else {
-      envelope = {
-        _noydb: NOYDB_FORMAT_VERSION,
-        _v: currentVersion + 1,
-        _ts: now,
-        _iv: "",
-        _data: json
-      };
+      envelope = buildRecordEnvelope(identity, { ...body, iv: "", data: json });
     }
     await this.store.put(
       this.vault,
@@ -844,14 +856,14 @@ var BlobSet = class _BlobSet {
     const fallbackTier = alsoTryTier ?? (t > 0 ? 0 : void 0);
     const primaryDek = await this.getDEK(dekKey(BLOB_COLLECTION, t));
     try {
-      const json2 = await openEnvelopeJson(envelope, primaryDek);
+      const json2 = await openEnvelopeJson({ collection: BLOB_INDEX_COLLECTION, id: eTag }, envelope, primaryDek);
       return { blob: JSON.parse(json2), version: envelope._v, atTier: t };
     } catch (err) {
       if (!(err instanceof TamperedError)) throw err;
       if (fallbackTier === void 0 || fallbackTier === t) throw err;
     }
     const fallbackDek = await this.getDEK(dekKey(BLOB_COLLECTION, fallbackTier));
-    const json = await openEnvelopeJson(envelope, fallbackDek);
+    const json = await openEnvelopeJson({ collection: BLOB_INDEX_COLLECTION, id: eTag }, envelope, fallbackDek);
     return { blob: JSON.parse(json), version: envelope._v, atTier: fallbackTier };
   }
   /**
@@ -891,12 +903,13 @@ var BlobSet = class _BlobSet {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const newVersion = (expectedVersion ?? 0) + 1;
     let envelope;
+    const identity = { collection: BLOB_INDEX_COLLECTION, id: blob.eTag, version: newVersion };
     if (this.encrypted) {
       const dek = await this.getDEK(dekKey(BLOB_COLLECTION, tier ?? await this.ownerTier()));
-      const { iv, data } = await encrypt(json, dek);
-      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: newVersion, _ts: now, _iv: iv, _data: data };
+      const { iv, data } = await encrypt(json, dek, buildRecordAad(identity));
+      envelope = buildRecordEnvelope(identity, { ts: now, iv, data });
     } else {
-      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: newVersion, _ts: now, _iv: "", _data: json };
+      envelope = buildRecordEnvelope(identity, { ts: now, iv: "", data: json });
     }
     await this.store.put(
       this.vault,
@@ -1021,13 +1034,18 @@ var BlobSet = class _BlobSet {
    *  - not yet stamped → apply via `casUpdateRefCountStamped`, then proceed
    *    exactly like the unstamped path below.
    *
-   * A crash can also land AFTER the index row is deleted but BEFORE every
-   * chunk is — `loadBlobObject` then returns null (indistinguishable from
-   * "never existed") and the object's `chunkCount` is gone with it. A
-   * stamped caller who knows the true count (the journal marker's captured
-   * `holds`, once that plumbing lands) supplies it via `chunkCountHint` so
-   * this call can still finish the chunk deletion; without it, an
-   * already-index-gone eTag is reported `'shredded'` same as today (best
+   * A crash can also land part-way through the deletion itself. Since #1127
+   * that deletion runs CHUNKS FIRST (see `deleteChunksThenIndex`), so what
+   * survives is an index row with some chunks already gone — a reachable,
+   * re-runnable state rather than chunks nothing can ever address again.
+   *
+   * An eTag whose index row is ALREADY absent on entry is therefore either
+   * pre-#1127 residue or a completed deletion. `loadBlobObject` returns null
+   * (indistinguishable from "never existed") and the object's `chunkCount` is
+   * gone with it. A stamped caller who knows the true count (the journal
+   * marker's captured `holds`, once that plumbing lands) supplies it via
+   * `chunkCountHint` so this call can still finish the chunk deletion; without
+   * it, an already-index-gone eTag is reported `'shredded'` same as today (best
    * effort — nothing left to key the cleanup off of).
    */
   async releaseRef(eTag, n, reclaimLegacy, tier, stamp, chunkCountHint) {
@@ -1044,24 +1062,72 @@ var BlobSet = class _BlobSet {
     if (stamp !== void 0 && loaded.blob.lastOps?.includes(stamp)) {
       if (loaded.blob.refCount > 0) return erasable ? "retainedShared" : "residue";
       if (erasable || reclaimLegacy) {
-        await this.store.delete(this.vault, BLOB_INDEX_COLLECTION, eTag);
         const chunkCount = chunkCountHint ?? loaded.blob.chunkCount;
-        for (let i = 0; i < chunkCount; i++) {
-          await this.store.delete(this.vault, BLOB_CHUNKS_COLLECTION, `${eTag}_${i}`);
-        }
+        await this.deleteChunksThenIndex(eTag, chunkCount);
       }
       return erasable ? "shredded" : "residue";
     }
     const remaining = stamp !== void 0 ? (await this.casUpdateRefCountStamped(eTag, -n, tier, stamp)).refCount : await this.casUpdateRefCount(eTag, -n, tier);
     if (remaining > 0) return erasable ? "retainedShared" : "residue";
     if (erasable || reclaimLegacy) {
-      await this.store.delete(this.vault, BLOB_INDEX_COLLECTION, eTag);
-      for (let i = 0; i < loaded.blob.chunkCount; i++) {
-        await this.store.delete(this.vault, BLOB_CHUNKS_COLLECTION, `${eTag}_${i}`);
-      }
+      await this.deleteChunksThenIndex(eTag, loaded.blob.chunkCount);
     }
     return erasable ? "shredded" : "residue";
   }
+  /**
+   * Delete a blob's chunks, THEN its index row. The order is the whole point
+   * (#1127).
+   *
+   * Both deletions used to run index-first, which meant a crash in between
+   * stranded chunks with no index row. Nothing can ever reach those again:
+   * `loadBlobObject` returns null, so no reader addresses them — and
+   * `rekeyBlobSet` derives its chunk ids from each index entry's `chunkCount`,
+   * so a rotation never visits them either. For a LEGACY blob (bytes under the
+   * `_blob` DEK itself rather than a per-blob content CEK) the bodies then stay
+   * openable under the retired `_blob` DEK — precisely the key a revoked member
+   * walked away with. Crash during `forget()`, revoke later, and real blob
+   * content sits readable indefinitely, with no error on either side.
+   *
+   * Reversing it removes the class rather than cleaning up after it: every
+   * chunk that still exists has an index row, so every chunk is reachable by
+   * `rekeyBlobSet` and gets re-keyed. There is no orphan to sweep because none
+   * is produced.
+   *
+   * The residue this ordering leaves instead is an index row whose chunks are
+   * partly gone. That state is better, but it is NOT free — it cost one reader
+   * correction (`resolveRehomedVersionETag`, which read an old blob's bytes
+   * while resuming a rehome and now checks `refCount <= 0` instead of relying
+   * on the row having vanished). An earlier draft of this comment called the
+   * new state "strictly better"; the full suite disproved that, and any future
+   * path that reads a blob by index needs the same care. What is true of it:
+   *   - it is REACHABLE, so a re-run of `releaseRef` completes the deletion
+   *     idempotently (both `store.delete` calls are void on an absent key);
+   *   - `rekeyBlobSet` already tolerates it — a missing chunk hits its
+   *     `if (!chunkEnv || !chunkEnv._iv) continue`, so a rotation still
+   *     succeeds and still re-keys every chunk that remains;
+   *   - it cannot leak, because the bytes that survive are the ones still
+   *     covered by rotation.
+   *
+   * This also makes one ordering rule true across the blob subsystem rather
+   * than two opposite ones: `kernel/enclave/record-keys/rekey-blob.ts` already
+   * re-encrypts chunks before re-sealing their index entry, and documents that
+   * order as its resume property.
+   *
+   * Deliberately NOT paired with a sweep that deletes pre-existing orphans:
+   * such a sweep must decide "orphaned" from `store.list(_blob_index)`, and the
+   * store is untrusted. A store that withholds one index row could make a LIVE
+   * blob's chunks look orphaned and have us destroy them — turning withholding,
+   * which is reversible, into permanent loss. Reporting them is safe; deleting
+   * them on the store's word is not. The report half shipped as
+   * `reportOrphanBlobChunks` (#1133), surfaced through `vault.compact()`; a
+   * reclaim pass remains deliberately unbuilt for the reason above.
+   */
+  async deleteChunksThenIndex(eTag, chunkCount) {
+    for (let i = 0; i < chunkCount; i++) {
+      await this.store.delete(this.vault, BLOB_CHUNKS_COLLECTION, `${eTag}_${i}`);
+    }
+    await this.store.delete(this.vault, BLOB_INDEX_COLLECTION, eTag);
+  }
   /**
    * Crypto-shred this record's blob attachments — called by
    * `vault.forget()`.
@@ -1449,7 +1515,7 @@ var BlobSet = class _BlobSet {
       const envelope = await this.store.get(this.vault, this.versionsCollection, key);
       if (!envelope) continue;
       try {
-        const record = this.encrypted ? JSON.parse(await openEnvelopeJson(envelope, dek)) : JSON.parse(envelope._data);
+        const record = this.encrypted ? JSON.parse(await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, dek)) : JSON.parse(envelope._data);
         holds.set(record.eTag, (holds.get(record.eTag) ?? 0) + 1);
         readable.push(key);
       } catch {
@@ -1623,7 +1689,6 @@ var BlobSet = class _BlobSet {
     if (Object.keys(slots).length > 0) {
       if (slotsAtTier === toTier) {
         const toBlobDEK = await this.getDEK(dekKey(BLOB_COLLECTION, toTier));
-        const fromBlobDEK = await this.getDEK(dekKey(BLOB_COLLECTION, fromTier));
         const doneETags = new Set(Object.values(slots).map((s) => s.eTag).filter((eTag) => eTag !== ""));
         for (const eTag of doneETags) {
           let loaded;
@@ -1635,7 +1700,7 @@ var BlobSet = class _BlobSet {
           }
           if (!loaded || loaded.atTier !== toTier || loaded.blob._cek === void 0) continue;
           const plaintext = await this.fetchAllChunks(loaded.blob, toBlobDEK);
-          const oldETag = await hmacSha256Hex(fromBlobDEK, plaintext);
+          const oldETag = await hmacSha256Hex(await this.addressKey(fromTier), plaintext);
           if (oldETag !== eTag) rehomedETags.set(oldETag, eTag);
         }
       } else {
@@ -1651,7 +1716,7 @@ var BlobSet = class _BlobSet {
             if (blob._cek === void 0) continue;
             if (policy === "dedup" && blob.refCount > 1) continue;
             const plaintext = await this.fetchAllChunks(blob, fromBlobDEK);
-            rehomedETags.set(eTag, await hmacSha256Hex(toBlobDEK, plaintext));
+            rehomedETags.set(eTag, await hmacSha256Hex(await this.addressKey(toTier), plaintext));
             for (const [slotName, slot] of Object.entries(slots)) {
               if (slot.eTag !== eTag) continue;
               await this.putUnderDEK(slotName, plaintext, toBlobDEK, {
@@ -1733,13 +1798,13 @@ var BlobSet = class _BlobSet {
     if (!this.encrypted) return { record: JSON.parse(envelope._data), atTier: fromTier };
     const fromDek = await this.getDEK(dekKey(this.collection, fromTier));
     try {
-      const json2 = await openEnvelopeJson(envelope, fromDek);
+      const json2 = await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, fromDek);
       return { record: JSON.parse(json2), atTier: fromTier };
     } catch (err) {
       if (!(err instanceof TamperedError) || fromTier === toTier) throw err;
     }
     const toDek = await this.getDEK(dekKey(this.collection, toTier));
-    const json = await openEnvelopeJson(envelope, toDek);
+    const json = await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, toDek);
     return { record: JSON.parse(json), atTier: toTier };
   }
   /**
@@ -1793,7 +1858,12 @@ var BlobSet = class _BlobSet {
       return already;
     }
     const loaded = await this.loadBlobObject(record.eTag, fromTier);
-    if (!loaded || loaded.blob._cek === void 0) return record.eTag;
+    if (!loaded) return record.eTag;
+    if (loaded.blob.refCount <= 0) {
+      await this.releaseOldETagAfterMove(record.eTag, fromTier, stamp);
+      return record.eTag;
+    }
+    if (loaded.blob._cek === void 0) return record.eTag;
     if (policy === "dedup" && loaded.blob.refCount > 1) return record.eTag;
     const plaintext = await this.fetchAllChunks(loaded.blob, fromBlobDEK);
     const { eTag: newETag } = await this.writeBlobContent(plaintext, toBlobDEK, {
@@ -1901,18 +1971,13 @@ var BlobSet = class _BlobSet {
     const id = `${eTag}_${index}`;
     const now = (/* @__PURE__ */ new Date()).toISOString();
     let envelope;
+    const identity = { collection: BLOB_CHUNKS_COLLECTION, id, version: 1 };
     if (dek) {
       const aad = chunkAAD(eTag, index, chunkCount);
       const { iv, data } = await encryptBytesWithAAD(chunk, dek, aad);
-      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: now, _iv: iv, _data: data };
+      envelope = buildRecordEnvelope(identity, { ts: now, iv, data });
     } else {
-      envelope = {
-        _noydb: NOYDB_FORMAT_VERSION,
-        _v: 1,
-        _ts: now,
-        _iv: "",
-        _data: bufferToBase64(chunk)
-      };
+      envelope = buildRecordEnvelope(identity, { ts: now, iv: "", data: bufferToBase64(chunk) });
     }
     await this.store.put(this.vault, BLOB_CHUNKS_COLLECTION, id, envelope);
   }
@@ -1962,7 +2027,7 @@ var BlobSet = class _BlobSet {
       return JSON.parse(envelope._data);
     }
     const dek = await this.getDEK(dekKey(this.collection, tier ?? await this.ownerTier()));
-    const json = await openEnvelopeJson(envelope, dek);
+    const json = await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, dek);
     return JSON.parse(json);
   }
   /** @param tier See {@link loadVersionRecord}'s `tier` param — same resolution. */
@@ -1983,12 +2048,13 @@ var BlobSet = class _BlobSet {
     const json = JSON.stringify(record);
     const now = (/* @__PURE__ */ new Date()).toISOString();
     let envelope;
+    const identity = { collection: this.versionsCollection, id: key, version: 1 };
     if (this.encrypted) {
       const dek = await this.getDEK(dekKey(this.collection, tier));
-      const { iv, data } = await encrypt(json, dek);
-      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: now, _iv: iv, _data: data };
+      const { iv, data } = await encrypt(json, dek, buildRecordAad(identity));
+      envelope = buildRecordEnvelope(identity, { ts: now, iv, data });
     } else {
-      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: now, _iv: "", _data: json };
+      envelope = buildRecordEnvelope(identity, { ts: now, iv: "", data: json });
     }
     await this.store.put(this.vault, this.versionsCollection, key, envelope);
   }
@@ -2022,7 +2088,7 @@ var BlobSet = class _BlobSet {
    * attacker-controlled content pulled from the same forged row and would
    * make the check tautological). After assembling the plaintext, we
    * recompute the SAME content address every write path mints
-   * (`hmacSha256Hex(flatBlobDEK, plaintext)` — `writeBlobContent`'s Step 1,
+   * (`hmacSha256Hex(addressKey(tier), plaintext)` — `writeBlobContent`'s Step 1,
    * unconditional on `_cek`) and compare it to that requested eTag. A
    * forged row can produce valid ciphertext under the flat DEK, but can't
    * produce plaintext that re-hashes to an address it doesn't control.
@@ -2050,7 +2116,7 @@ var BlobSet = class _BlobSet {
     const assembled = concatChunks(chunks);
     const plaintext = blob.compression === "gzip" ? await decompressBytes(assembled) : assembled;
     if (verifyFlatETag !== void 0 && blobDEK) {
-      const recomputed = await hmacSha256Hex(blobDEK, plaintext);
+      const recomputed = await hmacSha256Hex(await this.addressKey(0), plaintext);
       if (recomputed !== verifyFlatETag) {
         throw new TamperedError(
           `Blob content for eTag "${verifyFlatETag}" failed content-address verification after a flat-tier fallback open \u2014 the _blob_index/_blob_chunks rows do not match the requested content address (#747/#749 review I1)`
@@ -2134,8 +2200,9 @@ var BlobSet = class _BlobSet {
       return;
     }
     this.assertBlobWritable();
-    const blobDEK = this.encrypted ? await this.getDEK(dekKey(BLOB_COLLECTION, await this.ownerTier())) : null;
-    return this.putUnderDEK(slotName, data, blobDEK, opts);
+    const ownerTier = await this.ownerTier();
+    const blobDEK = this.encrypted ? await this.getDEK(dekKey(BLOB_COLLECTION, ownerTier)) : null;
+    return this.putUnderDEK(slotName, data, blobDEK, opts, void 0, ownerTier);
   }
   /**
    * The slot-attachment core of `put()` (Step 7 — CAS the slot metadata),
@@ -2300,7 +2367,7 @@ var BlobSet = class _BlobSet {
    * dedup-hit branch's behavior exactly.
    */
   async writeBlobContent(data, blobDEK, opts, tier, incrementStamp, knownApplied) {
-    const eTag = blobDEK ? await hmacSha256Hex(blobDEK, data) : await plainSha256Hex(data);
+    const eTag = blobDEK ? await hmacSha256Hex(await this.addressKey(tier ?? 0), data) : await plainSha256Hex(data);
     let mimeType = opts?.mimeType;
     if (!mimeType) {
       const detected = detectMagic(data.subarray(0, 16));
@@ -2887,7 +2954,7 @@ var BlobSet = class _BlobSet {
         versions.push(JSON.parse(envelope._data));
       } else {
         const dek = await this.getDEK(this.collection);
-        const json = await openEnvelopeJson(envelope, dek);
+        const json = await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, dek);
         versions.push(JSON.parse(json));
       }
     }
@@ -2996,7 +3063,7 @@ var BlobSet = class _BlobSet {
     const aad = chunkAAD(slot.eTag, 0, result.blob.chunkCount);
     const decrypted = await decryptBytesWithAAD(envelope._iv, envelope._data, chunkKey, aad);
     const plaintext = result.blob.compression === "gzip" ? await decompressBytes(decrypted) : decrypted;
-    const recomputed = await hmacSha256Hex(blobDEK, plaintext);
+    const recomputed = await hmacSha256Hex(await this.addressKey(await this.ownerTier()), plaintext);
     if (recomputed !== slot.eTag) {
       throw new TamperedError(
         `Blob content for eTag "${slot.eTag}" failed content-address verification in decryptResponse() \u2014 the caller-provided ciphertext does not match the requested content address (#757)`
@@ -3070,4 +3137,4 @@ export {
   DEFAULT_CHUNK_SIZE,
   BlobSet
 };
-//# sourceMappingURL=chunk-PL2GHSCM.js.map
+//# sourceMappingURL=chunk-JMJSCI7U.js.map