@noy-db/hub 0.8.0-pre.0 → 0.9.0-pre.0

package/dist/{chunk-ANWPSTZU.js → chunk-QXJXG7DN.js}

@@ -1,33 +1,30 @@
 import {
   assertTierAccess
-} from "./chunk-SOIQ4MM4.js";
+} from "./chunk-UHFGK6YA.js";
 import {
   dekKey,
   liveRecordIsElevated,
   liveRecordTier
-} from "./chunk-JCN44NCY.js";
-import {
-  buildRecordAad,
-  openEnvelopeJson,
-  writeEnvelopeBody
-} from "./chunk-KJFW62P4.js";
-import {
-  buildRecordEnvelope,
-  buildSealedRecordEnvelope
-} from "./chunk-SEE332EV.js";
+} from "./chunk-RIZTZJX6.js";
 import {
   base64ToBuffer,
   bufferToBase64,
+  buildRecordAad,
+  buildRecordEnvelope,
+  buildSealedRecordEnvelope,
   decryptBytesWithAAD,
   deriveBlobAddressKey,
   encrypt,
   encryptBytesWithAAD,
   generateDEK,
   hmacSha256Hex,
+  openEnvelopeJson,
+  sealedBodyArgs,
   sha256Hex,
   unwrapCek,
-  wrapCek
-} from "./chunk-UYB234ZR.js";
+  wrapCek,
+  writeEnvelopeBody
+} from "./chunk-4J3MNVVX.js";
 import {
   BLOB_ADDRESS_KEY_ID,
   BlobIntentPendingError,
@@ -39,7 +36,7 @@ import {
   UnsupportedTierCompositionError,
   ValidationError,
   isConflictError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-shape/blobs/blob-pinning.ts
 function memoryBlobPinStore() {
@@ -674,7 +671,7 @@ var BlobSet = class _BlobSet {
     if (!envelope) return { slots: {}, version: 0 };
     if (!this.encrypted) {
       return {
-        slots: JSON.parse(envelope._data),
+        slots: JSON.parse(envelope._data ?? ""),
         version: envelope._v
       };
     }
@@ -699,7 +696,7 @@ var BlobSet = class _BlobSet {
     const envelope = await this.store.get(this.vault, this.slotsCollection, this.recordId);
     if (!envelope) return { slots: {}, version: 0, atTier: fromTier };
     if (!this.encrypted) {
-      return { slots: JSON.parse(envelope._data), version: envelope._v, atTier: fromTier };
+      return { slots: JSON.parse(envelope._data ?? ""), version: envelope._v, atTier: fromTier };
     }
     const fromDek = await this.getDEK(dekKey(this.collection, fromTier));
     try {
@@ -853,7 +850,7 @@ var BlobSet = class _BlobSet {
     const envelope = await this.store.get(this.vault, BLOB_INDEX_COLLECTION, eTag);
     if (!envelope) return null;
     if (!this.encrypted) {
-      return { blob: JSON.parse(envelope._data), version: envelope._v, atTier: 0 };
+      return { blob: JSON.parse(envelope._data ?? ""), version: envelope._v, atTier: 0 };
     }
     const t = tier ?? await this.ownerTier();
     const fallbackTier = alsoTryTier ?? (t > 0 ? 0 : void 0);
@@ -1112,7 +1109,7 @@ var BlobSet = class _BlobSet {
    *     covered by rotation.
    *
    * This also makes one ordering rule true across the blob subsystem rather
-   * than two opposite ones: `kernel/enclave/record-keys/rekey-blob.ts` already
+   * than two opposite ones: `capsule/plumbing/rekey-blob.ts` already
    * re-encrypts chunks before re-sealing their index entry, and documents that
    * order as its resume property.
    *
@@ -1295,17 +1292,21 @@ var BlobSet = class _BlobSet {
   async unmarkedShred(tier) {
     const shredded = [];
     const retainedShared = [];
+    const residueETags = [];
     const collected = await this.collectShredHolds(tier);
     const residue = [...collected.residue, `${this.collection}:${this.recordId}:_blob_intent`];
     for (const hold of collected.holds) {
       const outcome = await this.releaseRef(hold.eTag, hold.n, true, tier);
       if (outcome === "shredded") shredded.push(hold.eTag);
       else if (outcome === "retainedShared") retainedShared.push(hold.eTag);
-      else residue.push(hold.eTag);
+      else {
+        residue.push(hold.eTag);
+        residueETags.push(hold.eTag);
+      }
     }
     if (collected.slotsPresent) await this.store.delete(this.vault, this.slotsCollection, this.recordId);
     for (const key of collected.versionKeysToDelete) await this.store.delete(this.vault, this.versionsCollection, key);
-    return { shredded, retainedShared, residue };
+    return { shredded, retainedShared, residue, residueETags };
   }
   /**
    * Collect this record's CURRENT blob holds (slot map + published
@@ -1386,15 +1387,20 @@ var BlobSet = class _BlobSet {
     const shredded = [];
     const retainedShared = [];
     const residue = [...collected.residue];
+    const residueETags = [];
     let allApplied = true;
     for (const hold of intent.holds ?? []) {
       try {
         const outcome = await this.releaseRef(hold.eTag, hold.n, true, tier, intent.opId, hold.chunkCount);
         if (outcome === "shredded") shredded.push(hold.eTag);
         else if (outcome === "retainedShared") retainedShared.push(hold.eTag);
-        else residue.push(hold.eTag);
+        else {
+          residue.push(hold.eTag);
+          residueETags.push(hold.eTag);
+        }
       } catch {
         residue.push(hold.eTag);
+        residueETags.push(hold.eTag);
         allApplied = false;
       }
     }
@@ -1403,7 +1409,7 @@ var BlobSet = class _BlobSet {
       for (const key of collected.versionKeysToDelete) await this.store.delete(this.vault, this.versionsCollection, key);
       await deleteIntent(this.store, this.vault, this.collection, this.recordId);
     }
-    return { shredded, retainedShared, residue };
+    return { shredded, retainedShared, residue, residueETags };
   }
   /**
    * Resume gate (#753/#746 spec §7 C6): every refCount/slot mutator calls
@@ -1518,7 +1524,7 @@ var BlobSet = class _BlobSet {
       const envelope = await this.store.get(this.vault, this.versionsCollection, key);
       if (!envelope) continue;
       try {
-        const record = this.encrypted ? JSON.parse(await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, dek)) : JSON.parse(envelope._data);
+        const record = this.encrypted ? JSON.parse(await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, dek)) : JSON.parse(envelope._data ?? "");
         holds.set(record.eTag, (holds.get(record.eTag) ?? 0) + 1);
         readable.push(key);
       } catch {
@@ -1798,7 +1804,7 @@ var BlobSet = class _BlobSet {
   async loadVersionRecordAtKeyTolerant(key, fromTier, toTier) {
     const envelope = await this.store.get(this.vault, this.versionsCollection, key);
     if (!envelope) return null;
-    if (!this.encrypted) return { record: JSON.parse(envelope._data), atTier: fromTier };
+    if (!this.encrypted) return { record: JSON.parse(envelope._data ?? ""), atTier: fromTier };
     const fromDek = await this.getDEK(dekKey(this.collection, fromTier));
     try {
       const json2 = await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, fromDek);
@@ -1989,9 +1995,9 @@ var BlobSet = class _BlobSet {
     if (!envelope) return null;
     if (dek) {
       const aad = chunkAAD(eTag, index, chunkCount);
-      return await decryptBytesWithAAD(envelope._iv, envelope._data, dek, aad);
+      return await decryptBytesWithAAD(...sealedBodyArgs(envelope, "blobSet"), dek, aad);
     }
-    return base64ToBuffer(envelope._data);
+    return base64ToBuffer(envelope._data ?? "");
   }
   // ─── Version record I/O ───────────────────────────────────────────
   /** #752: '::' is the version-key separator (`versionKey`) — a recordId/slotName/label
@@ -2027,7 +2033,7 @@ var BlobSet = class _BlobSet {
     const envelope = await this.store.get(this.vault, this.versionsCollection, key);
     if (!envelope) return null;
     if (!this.encrypted) {
-      return JSON.parse(envelope._data);
+      return JSON.parse(envelope._data ?? "");
     }
     const dek = await this.getDEK(dekKey(this.collection, tier ?? await this.ownerTier()));
     const json = await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, dek);
@@ -2615,6 +2621,27 @@ var BlobSet = class _BlobSet {
    * and "its attachments are released" are one operation. Ungated: the record
    * delete itself already passed the gate bus. Ref-counted like any release —
    * content another record still holds survives.
+   *
+   * ⛔ RELEASE IS NOT ERASURE, AND THE API CANNOT TELL YOU WHICH YOU GOT
+   * (noy-db/core#28). Releasing the slot is unconditional; when the BYTES
+   * leave the store depends on the collection's key mode:
+   *
+   * - `perRecordKeys: true` — crypto-shredded on the spot at refCount 0.
+   * - legacy (shared DEK) — chunks RETAINED under the collection DEK until
+   *   `vault.compact({ reclaimLegacyBlobs: true })` runs (#1453).
+   *
+   * Both give the caller the same `null` from `blob(id).get(slot)`, and the
+   * record, the slot list and the store listing all agree it is gone — so
+   * every signal a consumer has says "erased" while the ciphertext is still
+   * on disk, recoverable by anyone holding the DEK. pilot-1 measured exactly
+   * this (chunks 2 → 2 on delete) and reasonably read the deferral as a
+   * broken cascade.
+   *
+   * ⭐ So: if a delete is meant to ERASE — a subject-access request, a
+   * retention policy — either put the blobs on a `perRecordKeys` collection
+   * or run the reclaim pass, and assert on `compact()`'s
+   * `unreferencedLegacyBlobs.reclaimed`, never on the null read. The seam is
+   * pinned in `__tests__/1451-delete-releases-blobs.test.ts`.
    */
   async releaseAll() {
     const { slots } = await this.loadSlots();
@@ -2979,7 +3006,7 @@ var BlobSet = class _BlobSet {
       const envelope = await this.store.get(this.vault, this.versionsCollection, key);
       if (!envelope) continue;
       if (!this.encrypted) {
-        versions.push(JSON.parse(envelope._data));
+        versions.push(JSON.parse(envelope._data ?? ""));
       } else {
         const dek = await this.getDEK(this.collection);
         const json = await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, dek);
@@ -3090,7 +3117,7 @@ var BlobSet = class _BlobSet {
       return this.buildResponse(slot, result.blob, { inline: true });
     }
     const aad = chunkAAD(slot.eTag, 0, result.blob.chunkCount);
-    const decrypted = await decryptBytesWithAAD(envelope._iv, envelope._data, chunkKey, aad);
+    const decrypted = await decryptBytesWithAAD(...sealedBodyArgs(envelope, "blobSet"), chunkKey, aad);
     const plaintext = result.blob.compression === "gzip" ? await decompressBytes(decrypted) : decrypted;
     const recomputed = await hmacSha256Hex(await this.addressKey(await this.ownerTier()), plaintext);
     if (recomputed !== slot.eTag) {
@@ -3166,4 +3193,4 @@ export {
   DEFAULT_CHUNK_SIZE,
   BlobSet
 };
-//# sourceMappingURL=chunk-ANWPSTZU.js.map
+//# sourceMappingURL=chunk-QXJXG7DN.js.map