@noy-db/hub 0.8.0-pre.0 → 0.8.0

package/dist/{chunk-ANWPSTZU.js → chunk-G2MVBDFP.js}

@@ -1,33 +1,30 @@
 import {
   assertTierAccess
-} from "./chunk-SOIQ4MM4.js";
+} from "./chunk-7XMHMVTS.js";
 import {
   dekKey,
   liveRecordIsElevated,
   liveRecordTier
-} from "./chunk-JCN44NCY.js";
-import {
-  buildRecordAad,
-  openEnvelopeJson,
-  writeEnvelopeBody
-} from "./chunk-KJFW62P4.js";
-import {
-  buildRecordEnvelope,
-  buildSealedRecordEnvelope
-} from "./chunk-SEE332EV.js";
+} from "./chunk-FLPCETP6.js";
 import {
   base64ToBuffer,
   bufferToBase64,
+  buildRecordAad,
+  buildRecordEnvelope,
+  buildSealedRecordEnvelope,
   decryptBytesWithAAD,
   deriveBlobAddressKey,
   encrypt,
   encryptBytesWithAAD,
   generateDEK,
   hmacSha256Hex,
+  openEnvelopeJson,
+  sealedBodyArgs,
   sha256Hex,
   unwrapCek,
-  wrapCek
-} from "./chunk-UYB234ZR.js";
+  wrapCek,
+  writeEnvelopeBody
+} from "./chunk-EZGV6F47.js";
 import {
   BLOB_ADDRESS_KEY_ID,
   BlobIntentPendingError,
@@ -39,7 +36,7 @@ import {
   UnsupportedTierCompositionError,
   ValidationError,
   isConflictError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-shape/blobs/blob-pinning.ts
 function memoryBlobPinStore() {
@@ -674,7 +671,7 @@ var BlobSet = class _BlobSet {
     if (!envelope) return { slots: {}, version: 0 };
     if (!this.encrypted) {
       return {
-        slots: JSON.parse(envelope._data),
+        slots: JSON.parse(envelope._data ?? ""),
         version: envelope._v
       };
     }
@@ -699,7 +696,7 @@ var BlobSet = class _BlobSet {
     const envelope = await this.store.get(this.vault, this.slotsCollection, this.recordId);
     if (!envelope) return { slots: {}, version: 0, atTier: fromTier };
     if (!this.encrypted) {
-      return { slots: JSON.parse(envelope._data), version: envelope._v, atTier: fromTier };
+      return { slots: JSON.parse(envelope._data ?? ""), version: envelope._v, atTier: fromTier };
     }
     const fromDek = await this.getDEK(dekKey(this.collection, fromTier));
     try {
@@ -853,7 +850,7 @@ var BlobSet = class _BlobSet {
     const envelope = await this.store.get(this.vault, BLOB_INDEX_COLLECTION, eTag);
     if (!envelope) return null;
     if (!this.encrypted) {
-      return { blob: JSON.parse(envelope._data), version: envelope._v, atTier: 0 };
+      return { blob: JSON.parse(envelope._data ?? ""), version: envelope._v, atTier: 0 };
     }
     const t = tier ?? await this.ownerTier();
     const fallbackTier = alsoTryTier ?? (t > 0 ? 0 : void 0);
@@ -1112,7 +1109,7 @@ var BlobSet = class _BlobSet {
    *     covered by rotation.
    *
    * This also makes one ordering rule true across the blob subsystem rather
-   * than two opposite ones: `kernel/enclave/record-keys/rekey-blob.ts` already
+   * than two opposite ones: `capsule/plumbing/rekey-blob.ts` already
    * re-encrypts chunks before re-sealing their index entry, and documents that
    * order as its resume property.
    *
@@ -1518,7 +1515,7 @@ var BlobSet = class _BlobSet {
       const envelope = await this.store.get(this.vault, this.versionsCollection, key);
       if (!envelope) continue;
       try {
-        const record = this.encrypted ? JSON.parse(await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, dek)) : JSON.parse(envelope._data);
+        const record = this.encrypted ? JSON.parse(await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, dek)) : JSON.parse(envelope._data ?? "");
         holds.set(record.eTag, (holds.get(record.eTag) ?? 0) + 1);
         readable.push(key);
       } catch {
@@ -1798,7 +1795,7 @@ var BlobSet = class _BlobSet {
   async loadVersionRecordAtKeyTolerant(key, fromTier, toTier) {
     const envelope = await this.store.get(this.vault, this.versionsCollection, key);
     if (!envelope) return null;
-    if (!this.encrypted) return { record: JSON.parse(envelope._data), atTier: fromTier };
+    if (!this.encrypted) return { record: JSON.parse(envelope._data ?? ""), atTier: fromTier };
     const fromDek = await this.getDEK(dekKey(this.collection, fromTier));
     try {
       const json2 = await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, fromDek);
@@ -1989,9 +1986,9 @@ var BlobSet = class _BlobSet {
     if (!envelope) return null;
     if (dek) {
       const aad = chunkAAD(eTag, index, chunkCount);
-      return await decryptBytesWithAAD(envelope._iv, envelope._data, dek, aad);
+      return await decryptBytesWithAAD(...sealedBodyArgs(envelope, "blobSet"), dek, aad);
     }
-    return base64ToBuffer(envelope._data);
+    return base64ToBuffer(envelope._data ?? "");
   }
   // ─── Version record I/O ───────────────────────────────────────────
   /** #752: '::' is the version-key separator (`versionKey`) — a recordId/slotName/label
@@ -2027,7 +2024,7 @@ var BlobSet = class _BlobSet {
     const envelope = await this.store.get(this.vault, this.versionsCollection, key);
     if (!envelope) return null;
     if (!this.encrypted) {
-      return JSON.parse(envelope._data);
+      return JSON.parse(envelope._data ?? "");
     }
     const dek = await this.getDEK(dekKey(this.collection, tier ?? await this.ownerTier()));
     const json = await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, dek);
@@ -2979,7 +2976,7 @@ var BlobSet = class _BlobSet {
       const envelope = await this.store.get(this.vault, this.versionsCollection, key);
       if (!envelope) continue;
       if (!this.encrypted) {
-        versions.push(JSON.parse(envelope._data));
+        versions.push(JSON.parse(envelope._data ?? ""));
       } else {
         const dek = await this.getDEK(this.collection);
         const json = await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, dek);
@@ -3090,7 +3087,7 @@ var BlobSet = class _BlobSet {
       return this.buildResponse(slot, result.blob, { inline: true });
     }
     const aad = chunkAAD(slot.eTag, 0, result.blob.chunkCount);
-    const decrypted = await decryptBytesWithAAD(envelope._iv, envelope._data, chunkKey, aad);
+    const decrypted = await decryptBytesWithAAD(...sealedBodyArgs(envelope, "blobSet"), chunkKey, aad);
     const plaintext = result.blob.compression === "gzip" ? await decompressBytes(decrypted) : decrypted;
     const recomputed = await hmacSha256Hex(await this.addressKey(await this.ownerTier()), plaintext);
     if (recomputed !== slot.eTag) {
@@ -3166,4 +3163,4 @@ export {
   DEFAULT_CHUNK_SIZE,
   BlobSet
 };
-//# sourceMappingURL=chunk-ANWPSTZU.js.map
+//# sourceMappingURL=chunk-G2MVBDFP.js.map