@noy-db/hub 0.6.0-pre.2 → 0.6.0-pre.21

package/dist/{chunk-ERB6NDDW.js → chunk-CAGI4LLJ.js}

@@ -5,7 +5,14 @@ import {
   readDirectoryConfig,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-UIBGXRDD.js";
+} from "./chunk-LX46B56Q.js";
+import {
+  rekeyBlobSet,
+  rekeyEnvelopeIfNeeded
+} from "./chunk-OHOKBMTM.js";
+import {
+  buildRecordEnvelope
+} from "./chunk-PENPHA45.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -20,25 +27,73 @@ import {
   generateSalt,
   unwrapKey,
   wrapKey
-} from "./chunk-VCETL77O.js";
+} from "./chunk-AU3AUJIZ.js";
 import {
-  NOYDB_FORMAT_VERSION,
   NOYDB_KEYRING_VERSION
-} from "./chunk-W5W6KHN2.js";
+} from "./chunk-IGNJOJEP.js";
 import {
   DirectoryDisabledError,
   EchoCeremonyRequiredError,
   InvalidKeyError,
   KeyringCorruptError,
   KeyringExpiredError,
+  KeyringTamperedError,
   NoAccessError,
   NoydbError,
   PermissionDeniedError,
   PrivilegeEscalationError,
+  ROSTER_KEY_ID,
   USER_ENVELOPE_COLLECTION,
   ValidationError,
   WrongPromptError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-CWM4GQD2.js";
+
+// src/with-party/team/roster-tag.ts
+function stable(value) {
+  if (Array.isArray(value)) return `[${value.map(stable).join(",")}]`;
+  if (value !== null && typeof value === "object") {
+    const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${stable(v)}`);
+    return `{${entries.join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "null";
+}
+function rosterCanonical(file) {
+  return stable({
+    user_id: file.user_id,
+    role: file.role,
+    permissions: file.permissions,
+    granted_by: file.granted_by,
+    expires_at: file.expires_at ?? null,
+    export_capability: file.export_capability ?? null,
+    import_capability: file.import_capability ?? null
+  });
+}
+async function mintRosterTag(file, rosterKey) {
+  return encrypt(rosterCanonical(file), rosterKey);
+}
+async function verifyRosterTag(file, tag, rosterKey) {
+  if (tag == null) return false;
+  try {
+    return await decrypt(tag.iv, tag.data, rosterKey) === rosterCanonical(file);
+  } catch {
+    return false;
+  }
+}
+async function assertRosterAuthenticated(file, deks, userId) {
+  const rosterKey = deks.get(ROSTER_KEY_ID);
+  if (rosterKey === void 0) {
+    throw new KeyringTamperedError({ userId, reason: "roster-key-missing" });
+  }
+  await assertRosterTagValid(file, rosterKey, userId);
+}
+async function assertRosterTagValid(file, rosterKey, userId) {
+  if (!await verifyRosterTag(file, file.roster_tag, rosterKey)) {
+    throw new KeyringTamperedError({
+      userId,
+      reason: file.roster_tag == null ? "roster-tag-missing" : "roster-tag-mismatch"
+    });
+  }
+}
 
 // src/kernel/validation.ts
 var WeakSecretError = class extends NoydbError {
@@ -294,6 +349,18 @@ async function verifyKeyringCanary(wrappedCanary, kek) {
     return false;
   }
 }
+function rosterKeyOf(keyring) {
+  return keyring.deks.get(ROSTER_KEY_ID) ?? null;
+}
+function requireRosterKey(keyring, fn) {
+  const rosterKey = rosterKeyOf(keyring);
+  if (!rosterKey) {
+    throw new ValidationError(
+      `${fn}: caller keyring has no vault roster key \u2014 cannot stamp a roster tag. This typically means the keyring was opened via tier-3 PIN resume, session restore, or a wrap-DEKs tier-2 unlock. Re-authenticate at tier 1 (secret) before writing a keyring.`
+    );
+  }
+  return rosterKey;
+}
 async function deriveKekForKeyring(file, secret, salt) {
   if (file.echo !== void 0) {
     if (typeof secret === "string") throw new EchoCeremonyRequiredError();
@@ -327,10 +394,12 @@ async function loadKeyring(store, vault, opts) {
     throw new NoAccessError(`No keyring found for user "${userId}" in vault "${vault}"`);
   }
   const { file: keyringFile } = found;
-  assertKeyringNotExpired(keyringFile);
   const salt = base64ToBuffer(keyringFile.salt);
   const kek = await deriveKekForKeyring(keyringFile, secret, salt);
-  const canaryOk = keyringFile.canary !== void 0 ? await verifyKeyringCanary(keyringFile.canary, kek) : null;
+  if (keyringFile.canary === void 0) {
+    throw new KeyringTamperedError({ userId, reason: "canary-missing" });
+  }
+  const canaryOk = await verifyKeyringCanary(keyringFile.canary, kek);
   const deks = /* @__PURE__ */ new Map();
   const failedCollections = [];
   let firstUnwrapError = null;
@@ -343,11 +412,18 @@ async function loadKeyring(store, vault, opts) {
       if (firstUnwrapError === null) firstUnwrapError = err;
     }
   }
-  if (canaryOk === true) {
+  const pendingDeks = /* @__PURE__ */ new Map();
+  for (const [collName, wrapped] of Object.entries(keyringFile.pending_deks ?? {})) {
+    try {
+      pendingDeks.set(collName, await unwrapKey(wrapped, kek));
+    } catch {
+    }
+  }
+  if (canaryOk) {
     if (failedCollections.length > 0) {
       throw new KeyringCorruptError({ failedCollections, intactCount: deks.size });
     }
-  } else if (canaryOk === false) {
+  } else {
     if (deks.size > 0) {
       throw new KeyringCorruptError({
         failedCollections: [...failedCollections, "_canary"],
@@ -355,20 +431,16 @@ async function loadKeyring(store, vault, opts) {
       });
     }
     throw firstUnwrapError instanceof Error ? firstUnwrapError : new InvalidKeyError();
-  } else {
-    if (failedCollections.length > 0) {
-      if (deks.size > 0) {
-        throw new KeyringCorruptError({ failedCollections, intactCount: deks.size });
-      }
-      throw firstUnwrapError instanceof Error ? firstUnwrapError : new InvalidKeyError();
-    }
   }
+  await assertRosterAuthenticated(keyringFile, deks, userId);
+  assertKeyringNotExpired(keyringFile);
   return {
     userId: keyringFile.user_id,
     displayName: keyringFile.display_name,
     role: keyringFile.role,
     permissions: keyringFile.permissions,
     deks,
+    pendingDeks,
     kek,
     salt,
     authenticators: keyringFile.authenticators ?? [],
@@ -404,18 +476,27 @@ async function createOwnerKeyring(store, vault, opts) {
   const kek = typeof secret === "string" ? await deriveKey(secret, salt) : await deriveEchoKey(secret, salt);
   const userEnvelopeDek = await generateDEK();
   const wrappedUserEnvelopeDek = await wrapKey(userEnvelopeDek, kek);
+  const rosterKey = await generateDEK();
+  const wrappedRosterKey = await wrapKey(rosterKey, kek);
   const canary = await mintKeyringCanary(kek);
-  const keyringFile = {
-    _noydb_keyring: NOYDB_KEYRING_VERSION,
+  const authority = {
     user_id: userId,
     display_name: userId,
     role: "owner",
     permissions: {},
-    deks: { [USER_ENVELOPE_COLLECTION]: wrappedUserEnvelopeDek },
+    granted_by: userId
+  };
+  const keyringFile = {
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    ...authority,
+    deks: {
+      [USER_ENVELOPE_COLLECTION]: wrappedUserEnvelopeDek,
+      [ROSTER_KEY_ID]: wrappedRosterKey
+    },
     salt: bufferToBase64(salt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
-    granted_by: userId,
     canary,
+    roster_tag: await mintRosterTag(authority, rosterKey),
     // The presence of this block is what makes the keyring an echo keyring —
     // `deriveKekForKeyring` reads it to refuse a single-string unlock (AG-1).
     ...typeof secret !== "string" ? {
@@ -432,7 +513,10 @@ async function createOwnerKeyring(store, vault, opts) {
     displayName: userId,
     role: "owner",
     permissions: {},
-    deks: /* @__PURE__ */ new Map([[USER_ENVELOPE_COLLECTION, userEnvelopeDek]]),
+    deks: /* @__PURE__ */ new Map([
+      [USER_ENVELOPE_COLLECTION, userEnvelopeDek],
+      [ROSTER_KEY_ID, rosterKey]
+    ]),
     kek,
     salt,
     authenticators: []
@@ -444,11 +528,18 @@ async function grant(store, vault, callerKeyring, options) {
       "grant: caller keyring has no KEK \u2014 tier-2 wrap-DEKs and tier-3 PIN-resume sessions cannot grant access to other users. Re-authenticate at tier 1 (secret) before granting."
     );
   }
+  const callerRosterKey = requireRosterKey(callerKeyring, "grant");
   if (!canGrant(callerKeyring.role, options.role)) {
     throw new PermissionDeniedError(
       `Role "${callerKeyring.role}" cannot grant role "${options.role}"`
     );
   }
+  const secret = options.secret;
+  if (typeof secret !== "string" || secret.trim() === "") {
+    throw new ValidationError(
+      `grant: \`secret\` is required and must be a non-empty string (got ${secret === void 0 ? "undefined" : typeof secret === "string" ? "an empty string" : typeof secret}). The grantee's key is derived from it, so a missing secret produces a keyring slot nobody can unlock. Note the 0.4.0-pre rename: the option is \`secret\`, not \`passphrase\`.`
+    );
+  }
   if (options.validateSecret && !options.allowWeakSecret) {
     assertStrongSecret(options.secret);
   }
@@ -456,15 +547,26 @@ async function grant(store, vault, callerKeyring, options) {
   const newSalt = generateSalt();
   const newKek = await deriveKey(options.secret, newSalt);
   const granteeMayHoldSecrets = options.role === "owner" || options.role === "admin";
+  let mintedForGrant = false;
+  for (const collName of Object.keys(permissions)) {
+    if (collName === PERMISSION_WILDCARD) continue;
+    if (isSecretBearingReservedCollection(collName) && !granteeMayHoldSecrets) continue;
+    if (callerKeyring.deks.has(collName)) continue;
+    if (await collectionHasRecords(store, vault, collName)) continue;
+    callerKeyring.deks.set(collName, await generateDEK());
+    mintedForGrant = true;
+  }
+  if (mintedForGrant) await persistKeyring(store, vault, callerKeyring);
   const wrappedDeks = {};
   for (const collName of Object.keys(permissions)) {
+    if (collName === PERMISSION_WILDCARD) continue;
     if (isSecretBearingReservedCollection(collName) && !granteeMayHoldSecrets) continue;
     const dek = callerKeyring.deks.get(collName);
     if (dek) {
       wrappedDeks[collName] = await wrapKey(dek, newKek);
     }
   }
-  if (options.role === "owner" || options.role === "admin" || options.role === "custodian" || options.role === "viewer") {
+  if (options.role === "owner" || options.role === "admin" || options.role === "custodian" || options.role === "viewer" || permissionsAreWildcard(options.permissions)) {
     for (const [collName, dek] of callerKeyring.deks) {
       if (collName in wrappedDeks) continue;
       if (isSecretBearingReservedCollection(collName) && !granteeMayHoldSecrets) continue;
@@ -482,19 +584,25 @@ async function grant(store, vault, callerKeyring, options) {
     }
   }
   const canary = await mintKeyringCanary(newKek);
-  const keyringFile = {
-    _noydb_keyring: NOYDB_KEYRING_VERSION,
+  const authority = {
     user_id: options.userId,
     display_name: options.displayName,
     role: options.role,
     permissions,
+    granted_by: callerKeyring.userId,
+    ...options.exportCapability !== void 0 && { export_capability: options.exportCapability },
+    ...options.importCapability !== void 0 && { import_capability: options.importCapability }
+  };
+  const keyringFile = {
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    ...authority,
     deks: wrappedDeks,
     salt: bufferToBase64(newSalt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
-    granted_by: callerKeyring.userId,
     canary,
-    ...options.exportCapability !== void 0 && { export_capability: options.exportCapability },
-    ...options.importCapability !== void 0 && { import_capability: options.importCapability }
+    // The grantee's own copy of the roster key rode in via the `_`-prefix
+    // propagation loop above, so they can verify this tag on first unlock.
+    roster_tag: await mintRosterTag(authority, callerRosterKey)
   };
   await writeKeyringFile(store, vault, options.userId, keyringFile);
   const userEnvelopeDek = callerKeyring.deks.get(USER_ENVELOPE_COLLECTION);
@@ -509,13 +617,14 @@ async function grant(store, vault, callerKeyring, options) {
     );
   }
 }
-async function findAdminDescendants(store, vault, rootUserId) {
+async function findAdminDescendants(store, vault, rootUserId, rosterKey) {
   const allUserIds = await store.list(vault, "_keyring");
   const childrenByParent = /* @__PURE__ */ new Map();
   for (const userId of allUserIds) {
     const found = await readKeyringFile(store, vault, userId);
     if (!found) continue;
     const kf = found.file;
+    await assertRosterTagValid(kf, rosterKey, userId);
     if (kf.role !== "admin") continue;
     if (kf.user_id === rootUserId) continue;
     const list = childrenByParent.get(kf.granted_by) ?? [];
@@ -539,9 +648,16 @@ async function findAdminDescendants(store, vault, rootUserId) {
 async function revoke(store, vault, callerKeyring, options) {
   const targetFound = await readKeyringFile(store, vault, options.userId);
   if (!targetFound) {
+    const pending = [...callerKeyring.pendingDeks?.keys() ?? []];
+    if (pending.length > 0) {
+      await rotateKeys(store, vault, callerKeyring, { collections: pending });
+      return;
+    }
     throw new NoAccessError(`User "${options.userId}" has no keyring in vault "${vault}"`);
   }
   const targetKeyring = targetFound.file;
+  const callerRosterKey = requireRosterKey(callerKeyring, "revoke");
+  await assertRosterTagValid(targetKeyring, callerRosterKey, options.userId);
   if (!canRevoke(callerKeyring.role, targetKeyring.role)) {
     throw new PermissionDeniedError(
       `Role "${callerKeyring.role}" cannot revoke role "${targetKeyring.role}"`
@@ -551,7 +667,7 @@ async function revoke(store, vault, callerKeyring, options) {
   const usersToRevoke = [options.userId];
   const affectedCollections = new Set(Object.keys(targetKeyring.deks));
   if (targetKeyring.role === "admin") {
-    const descendants = await findAdminDescendants(store, vault, options.userId);
+    const descendants = await findAdminDescendants(store, vault, options.userId, callerRosterKey);
     if (descendants.length > 0) {
       if (cascadeMode === "warn") {
         console.warn(
@@ -561,6 +677,7 @@ async function revoke(store, vault, callerKeyring, options) {
         for (const userId of descendants) {
           const descFound = await readKeyringFile(store, vault, userId);
           if (!descFound) continue;
+          await assertRosterTagValid(descFound.file, callerRosterKey, userId);
           usersToRevoke.push(userId);
           for (const c of Object.keys(descFound.file.deks)) affectedCollections.add(c);
         }
@@ -572,9 +689,103 @@ async function revoke(store, vault, callerKeyring, options) {
     await deleteUserEnvelope(store, vault, userId);
     await deleteUserVisibility(store, vault, userId);
   }
-  if (options.rotateKeys !== false && affectedCollections.size > 0) {
-    await rotateKeys(store, vault, callerKeyring, { collections: [...affectedCollections] });
+  affectedCollections.delete(ROSTER_KEY_ID);
+  if (affectedCollections.size > 0) {
+    const { unverified } = await rotateKeys(store, vault, callerKeyring, {
+      collections: [...affectedCollections]
+    });
+    if (unverified.length > 0) {
+      console.warn(
+        `[noy-db] revoke(${options.userId}): ${unverified.length} member(s) were SKIPPED by the rotation because their keyring failed roster authentication: ${unverified.map((u) => `${u.userId} (${u.reason})`).join(", ")}. The revocation itself completed. Those members cannot open the vault and did not receive the rotated keys; their keyring files need repair or removal (noy-db#1114).`
+      );
+    }
+  }
+}
+async function readKeyringForAudit(store, vault, userId) {
+  const envelope = await store.get(vault, "_keyring", userId);
+  if (!envelope) return void 0;
+  try {
+    return { file: parseKeyringEnvelope(envelope) };
+  } catch {
+    return { unparseable: true };
+  }
+}
+async function verifyRoster(store, vault, callerKeyring) {
+  const rosterKey = requireRosterKey(callerKeyring, "verifyRoster");
+  const unverified = [];
+  let checked = 0;
+  for (const userId of await store.list(vault, "_keyring")) {
+    const found = await readKeyringForAudit(store, vault, userId);
+    if (!found) continue;
+    checked += 1;
+    if ("unparseable" in found) {
+      unverified.push({ userId, reason: "unparseable" });
+      continue;
+    }
+    try {
+      await assertRosterTagValid(found.file, rosterKey, userId);
+    } catch (err) {
+      if (!(err instanceof KeyringTamperedError)) throw err;
+      unverified.push({ userId, reason: err.details.reason });
+    }
+  }
+  return { checked, unverified };
+}
+async function quarantineKeyring(store, vault, callerKeyring, userId) {
+  if (callerKeyring.role !== "owner") {
+    throw new PermissionDeniedError(
+      `Role "${callerKeyring.role}" cannot quarantine a keyring \u2014 quarantine is owner-only, because it removes a file whose own authority claims cannot be trusted.`
+    );
+  }
+  if (userId === callerKeyring.userId) {
+    throw new ValidationError(
+      "quarantineKeyring: refusing to quarantine the calling keyring. Removing your own keyring and rotating behind it would leave the vault with no reachable owner."
+    );
+  }
+  const rosterKey = requireRosterKey(callerKeyring, "quarantineKeyring");
+  const found = await readKeyringForAudit(store, vault, userId);
+  if (!found) {
+    const pending = [...callerKeyring.pendingDeks?.keys() ?? []];
+    if (pending.length > 0) {
+      const resumed = await rotateKeys(store, vault, callerKeyring, { collections: pending });
+      return {
+        userId,
+        reason: "roster-tag-mismatch",
+        rotated: pending,
+        needsRegrant: resumed.needsRegrant,
+        alsoUnverified: resumed.unverified
+      };
+    }
+    throw new NoAccessError(`No keyring found for user "${userId}" in vault "${vault}"`);
   }
+  let reason = null;
+  if ("unparseable" in found) {
+    reason = "unparseable";
+  } else {
+    try {
+      await assertRosterTagValid(found.file, rosterKey, userId);
+    } catch (err) {
+      if (!(err instanceof KeyringTamperedError)) throw err;
+      reason = err.details.reason;
+    }
+  }
+  if (reason === null) {
+    throw new ValidationError(
+      `quarantineKeyring: the keyring for "${userId}" authenticates correctly, so it is not a quarantine case \u2014 use revoke() instead. Quarantine bypasses the role checks revoke performs, so it is restricted to files that genuinely fail authentication.`
+    );
+  }
+  await store.delete(vault, "_keyring", userId);
+  await deleteUserEnvelope(store, vault, userId);
+  await deleteUserVisibility(store, vault, userId);
+  const rotated = [...callerKeyring.deks.keys()].filter((c) => c !== ROSTER_KEY_ID);
+  const result = rotated.length > 0 ? await rotateKeys(store, vault, callerKeyring, { collections: rotated }) : { needsRegrant: [], unverified: [] };
+  return {
+    userId,
+    reason,
+    rotated,
+    needsRegrant: result.needsRegrant,
+    alsoUnverified: result.unverified
+  };
 }
 async function updateKeyringIdentity(store, vault, callerKeyring, options) {
   if (options.role === void 0 && options.displayName === void 0 && options.permissions === void 0) {
@@ -589,6 +800,8 @@ async function updateKeyringIdentity(store, vault, callerKeyring, options) {
     );
   }
   const target = found.file;
+  const rosterKey = requireRosterKey(callerKeyring, "updateKeyringIdentity");
+  await assertRosterTagValid(target, rosterKey, options.userId);
   if (!canUpdateRole(callerKeyring.role, target.role)) {
     throw new PermissionDeniedError(
       `Role "${callerKeyring.role}" cannot update a keyring with role "${target.role}"`
@@ -599,7 +812,7 @@ async function updateKeyringIdentity(store, vault, callerKeyring, options) {
       `Role "${callerKeyring.role}" cannot promote target to role "${options.role}"`
     );
   }
-  const next = {
+  const edited = {
     ...target,
     ...options.role !== void 0 && { role: options.role },
     ...options.displayName !== void 0 && {
@@ -608,50 +821,113 @@ async function updateKeyringIdentity(store, vault, callerKeyring, options) {
     },
     ...options.permissions !== void 0 && { permissions: options.permissions }
   };
+  const next = { ...edited, roster_tag: await mintRosterTag(edited, rosterKey) };
   await writeKeyringFile(store, vault, options.userId, next);
 }
+var HISTORY_COLLECTION = "_history";
+var LEDGER_COLLECTION = "_ledger";
+var LEDGER_DELTAS_COLLECTION = "_ledger_deltas";
+var BLOB_COLLECTION = "_blob";
+var BLOB_SLOTS_PREFIX = "_blob_slots_";
+var BLOB_VERSIONS_PREFIX = "_blob_versions_";
+var BLOB_INTENT_COLLECTION = "_blob_intent";
+async function listOrEmpty(store, vault, collection) {
+  try {
+    return await store.list(vault, collection);
+  } catch {
+    return [];
+  }
+}
+async function derivedRefsFor(store, vault, rotated) {
+  const out = [];
+  if (!rotated.startsWith("_")) {
+    for (const id of await listOrEmpty(store, vault, HISTORY_COLLECTION)) {
+      if (id.startsWith(`${rotated}:`)) out.push({ collection: HISTORY_COLLECTION, id });
+    }
+  }
+  if (rotated === LEDGER_COLLECTION) {
+    for (const id of await listOrEmpty(store, vault, LEDGER_DELTAS_COLLECTION)) {
+      out.push({ collection: LEDGER_DELTAS_COLLECTION, id });
+    }
+  }
+  if (!rotated.startsWith("_")) {
+    for (const id of await listOrEmpty(store, vault, `${BLOB_SLOTS_PREFIX}${rotated}`)) {
+      out.push({ collection: `${BLOB_SLOTS_PREFIX}${rotated}`, id });
+    }
+    for (const id of await listOrEmpty(store, vault, `${BLOB_VERSIONS_PREFIX}${rotated}`)) {
+      out.push({ collection: `${BLOB_VERSIONS_PREFIX}${rotated}`, id });
+    }
+    for (const id of await listOrEmpty(store, vault, BLOB_INTENT_COLLECTION)) {
+      if (id.startsWith(`${rotated}::`)) out.push({ collection: BLOB_INTENT_COLLECTION, id });
+    }
+  }
+  return out;
+}
 async function rotateKeys(store, vault, callerKeyring, opts) {
   const { collections } = opts;
+  if (collections.includes(ROSTER_KEY_ID)) {
+    throw new ValidationError(
+      `rotateKeys: "${ROSTER_KEY_ID}" is the vault roster key, not a collection, and cannot be rotated \u2014 doing so would strip it from every other member and leave the vault unopenable. Remove it from \`collections\`.`
+    );
+  }
   if (callerKeyring.role === "custodian") {
     throw new PermissionDeniedError(
       "custodian cannot rotate keys (FR-6: re-key is an owner-only meta-capability; use the Deed owner)"
     );
   }
+  const callerRosterKey = requireRosterKey(callerKeyring, "rotateKeys");
   const newDeks = /* @__PURE__ */ new Map();
   for (const collName of collections) {
-    newDeks.set(collName, await generateDEK());
+    newDeks.set(collName, callerKeyring.pendingDeks?.get(collName) ?? await generateDEK());
   }
+  const pending = callerKeyring.pendingDeks ?? /* @__PURE__ */ new Map();
+  callerKeyring.pendingDeks = pending;
+  for (const [collName, newDek] of newDeks) {
+    pending.set(collName, newDek);
+  }
+  await persistKeyring(store, vault, callerKeyring);
   for (const collName of collections) {
     const oldDek = callerKeyring.deks.get(collName);
     const newDek = newDeks.get(collName);
     if (!oldDek) continue;
-    const ids = await store.list(vault, collName);
-    for (const id of ids) {
-      const envelope = await store.get(vault, collName, id);
+    if (collName === BLOB_COLLECTION || collName.startsWith(`${BLOB_COLLECTION}#`)) {
+      const others = [];
+      for (const [name, dek] of callerKeyring.deks) if (name !== collName) others.push(dek);
+      for (const [name, dek] of newDeks) if (name !== collName) others.push(dek);
+      await rekeyBlobSet(store, vault, oldDek, newDek, others);
+    }
+    const refs = [
+      ...(await store.list(vault, collName)).map((id) => ({ collection: collName, id })),
+      ...await derivedRefsFor(store, vault, collName)
+    ];
+    for (const ref of refs) {
+      const { collection: refColl, id } = ref;
+      const envelope = await store.get(vault, refColl, id);
       if (!envelope || !envelope._iv) continue;
-      const plaintext = await decrypt(envelope._iv, envelope._data, oldDek);
-      const { iv, data } = await encrypt(plaintext, newDek);
-      const newEnvelope = {
-        _noydb: NOYDB_FORMAT_VERSION,
-        _v: envelope._v,
-        _ts: (/* @__PURE__ */ new Date()).toISOString(),
-        _iv: iv,
-        _data: data
-      };
-      await store.put(vault, collName, id, newEnvelope);
+      const newEnvelope = await rekeyEnvelopeIfNeeded({ collection: refColl, id }, envelope, oldDek, newDek);
+      if (newEnvelope !== null) await store.put(vault, refColl, id, newEnvelope);
     }
   }
   for (const [collName, newDek] of newDeks) {
     callerKeyring.deks.set(collName, newDek);
+    callerKeyring.pendingDeks?.delete(collName);
   }
   await persistKeyring(store, vault, callerKeyring);
   const needsRegrant = [];
+  const unverified = [];
   const userIds = await store.list(vault, "_keyring");
   for (const userId of userIds) {
     if (userId === callerKeyring.userId) continue;
     const userFound = await readKeyringFile(store, vault, userId);
     if (!userFound) continue;
     const userKeyringFile = userFound.file;
+    try {
+      await assertRosterTagValid(userKeyringFile, callerRosterKey, userId);
+    } catch (err) {
+      if (!(err instanceof KeyringTamperedError)) throw err;
+      unverified.push({ userId, reason: err.details.reason });
+      continue;
+    }
     const updatedDeks = { ...userKeyringFile.deks };
     const updatedPermissions = { ...userKeyringFile.permissions };
     for (const collName of collections) {
@@ -661,17 +937,24 @@ async function rotateKeys(store, vault, callerKeyring, opts) {
       delete updatedDeks[collName];
       delete updatedPermissions[collName];
     }
-    const updatedKeyring = {
+    const edited = {
       ...userKeyringFile,
       deks: updatedDeks,
       permissions: updatedPermissions
     };
+    const updatedKeyring = {
+      ...edited,
+      roster_tag: await mintRosterTag(edited, callerRosterKey)
+    };
     await writeKeyringFile(store, vault, userId, updatedKeyring);
   }
-  return { needsRegrant };
+  return { needsRegrant, unverified };
 }
 async function changeSecret(store, vault, keyring, opts) {
   const existingFound = await readKeyringFile(store, vault, keyring.userId);
+  if (existingFound) {
+    await assertRosterTagValid(existingFound.file, requireRosterKey(keyring, "changeSecret"), keyring.userId);
+  }
   if (existingFound && existingFound.file.echo !== void 0) throw new EchoCeremonyRequiredError();
   const { newSecret } = opts;
   if (!opts.allowWeakSecret) {
@@ -683,18 +966,28 @@ async function changeSecret(store, vault, keyring, opts) {
   for (const [collName, dek] of keyring.deks) {
     wrappedDeks[collName] = await wrapKey(dek, newKek);
   }
+  const rosterKey = requireRosterKey(keyring, "changeSecret");
   const canary = await mintKeyringCanary(newKek);
-  const keyringFile = {
-    _noydb_keyring: NOYDB_KEYRING_VERSION,
+  const existingAuthority = existingFound?.file;
+  const keptGrantedBy = existingAuthority?.granted_by ?? keyring.userId;
+  const authority = {
     user_id: keyring.userId,
     display_name: keyring.displayName,
     role: keyring.role,
     permissions: keyring.permissions,
+    granted_by: keptGrantedBy,
+    ...existingAuthority?.expires_at !== void 0 && { expires_at: existingAuthority.expires_at },
+    ...existingAuthority?.export_capability !== void 0 && { export_capability: existingAuthority.export_capability },
+    ...existingAuthority?.import_capability !== void 0 && { import_capability: existingAuthority.import_capability }
+  };
+  const keyringFile = {
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    ...authority,
     deks: wrappedDeks,
     salt: bufferToBase64(newSalt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
-    granted_by: keyring.userId,
-    canary
+    canary,
+    roster_tag: await mintRosterTag(authority, rosterKey)
   };
   await writeKeyringFile(store, vault, keyring.userId, keyringFile);
   return {
@@ -721,6 +1014,7 @@ async function buildRecipientKeyringFile(callerKeyring, recipient) {
       "buildRecipientKeyringFile: caller keyring has no KEK \u2014 tier-2 wrap-DEKs and tier-3 PIN-resume sessions cannot create bundle recipients. Re-authenticate at tier 1 (secret) before building a bundle."
     );
   }
+  const rosterKey = requireRosterKey(callerKeyring, "buildRecipientKeyringFile");
   const role = recipient.role ?? "viewer";
   const permissions = resolvePermissions(role, recipient.permissions);
   const newSalt = generateSalt();
@@ -750,20 +1044,26 @@ async function buildRecipientKeyringFile(callerKeyring, recipient) {
     }
   }
   const canary = await mintKeyringCanary(newKek);
-  return {
-    _noydb_keyring: NOYDB_KEYRING_VERSION,
+  const authority = {
     user_id: recipient.id,
     display_name: recipient.displayName ?? recipient.id,
     role,
     permissions,
+    granted_by: callerKeyring.userId,
+    ...recipient.exportCapability !== void 0 ? { export_capability: recipient.exportCapability } : {},
+    ...recipient.importCapability !== void 0 ? { import_capability: recipient.importCapability } : {},
+    ...recipient.expiresAt !== void 0 ? { expires_at: recipient.expiresAt } : {}
+  };
+  return {
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    ...authority,
     deks: wrappedDeks,
     salt: bufferToBase64(newSalt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
-    granted_by: callerKeyring.userId,
     canary,
-    ...recipient.exportCapability !== void 0 ? { export_capability: recipient.exportCapability } : {},
-    ...recipient.importCapability !== void 0 ? { import_capability: recipient.importCapability } : {},
-    ...recipient.expiresAt !== void 0 ? { expires_at: recipient.expiresAt } : {},
+    // The recipient's copy of the roster key rode in via the `_`-prefix
+    // propagation loop above, so the slot verifies on first unlock.
+    roster_tag: await mintRosterTag(authority, rosterKey),
     // The presence of this block is what makes the recipient's slot an
     // echo keyring — mirrors `createOwnerKeyring`'s same dance so the
     // ceremony (prompt → echo → key) travels with the pod, not just a
@@ -817,6 +1117,23 @@ async function listUsersWithEnvelopes(store, vault, userEnvelopeDek, callerRole,
   }
   return out;
 }
+async function collectionHasRecords(store, vault, collectionName) {
+  const ids = await store.list(vault, collectionName);
+  return ids.length > 0;
+}
+async function reloadPersistedDEK(store, vault, keyring, collectionName) {
+  if (!keyring.kek) return null;
+  const found = await readKeyringFile(store, vault, keyring.userId);
+  const wrapped = found?.file.deks[collectionName];
+  if (wrapped === void 0) return null;
+  try {
+    const dek = await unwrapKey(wrapped, keyring.kek);
+    keyring.deks.set(collectionName, dek);
+    return dek;
+  } catch {
+    return null;
+  }
+}
 async function ensureCollectionDEK(store, vault, keyring) {
   const inFlight = /* @__PURE__ */ new Map();
   return async (collectionName) => {
@@ -825,6 +1142,20 @@ async function ensureCollectionDEK(store, vault, keyring) {
     const pending = inFlight.get(collectionName);
     if (pending) return pending;
     const promise = (async () => {
+      if (!collectionName.startsWith("_")) {
+        if (!hasAccess(keyring, collectionName)) {
+          throw new NoAccessError(
+            `No access \u2014 user does not have a key for collection "${collectionName}". Grant them this collection in \`permissions\` to give them one.`
+          );
+        }
+        if (await collectionHasRecords(store, vault, collectionName)) {
+          const refreshed = await reloadPersistedDEK(store, vault, keyring, collectionName);
+          if (refreshed) return refreshed;
+          throw new NoAccessError(
+            `No access \u2014 user "${keyring.userId}" is entitled to collection "${collectionName}" but holds no key for it, because the collection was created AFTER their grant. A collection DEK can only be wrapped at grant time (wrapping needs the grantee's secret, which the vault never stores), so this cannot be back-filled \u2014 re-grant the user to give them the key.`
+          );
+        }
+      }
       const dek = await generateDEK();
       keyring.deks.set(collectionName, dek);
       await persistKeyring(store, vault, keyring);
@@ -838,14 +1169,20 @@ async function ensureCollectionDEK(store, vault, keyring) {
     }
   };
 }
+var PERMISSION_WILDCARD = "*";
+function permissionsAreWildcard(permissions) {
+  return permissions !== void 0 && PERMISSION_WILDCARD in permissions;
+}
 function hasWritePermission(keyring, collectionName) {
   if (keyring.role === "owner" || keyring.role === "admin" || keyring.role === "custodian") return true;
   if (keyring.role === "viewer" || keyring.role === "client") return false;
+  if (keyring.permissions[PERMISSION_WILDCARD] === "rw") return true;
   return keyring.permissions[collectionName] === "rw";
 }
 function hasAccess(keyring, collectionName) {
   if (keyring.role === "owner" || keyring.role === "admin" || keyring.role === "custodian" || keyring.role === "viewer")
     return true;
+  if (PERMISSION_WILDCARD in keyring.permissions) return true;
   return collectionName in keyring.permissions;
 }
 async function persistKeyring(store, vault, keyring) {
@@ -854,26 +1191,41 @@ async function persistKeyring(store, vault, keyring) {
       "persistKeyring: keyring.kek is null \u2014 cannot wrap DEKs without the KEK. This typically means the keyring was opened via tier-3 PIN resume, session restore, or a wrap-DEKs tier-2 unlock. Re-authenticate at tier 1 (secret) before persisting."
     );
   }
+  const rosterKey = requireRosterKey(keyring, "persistKeyring");
   const existingFound = await readKeyringFile(store, vault, keyring.userId);
+  if (existingFound) await assertRosterTagValid(existingFound.file, rosterKey, keyring.userId);
   const existingEcho = existingFound?.file.echo;
+  const existingGrantedBy = existingFound?.file.granted_by;
+  const existingCreatedAt = existingFound?.file.created_at;
+  const existingExpiresAt = existingFound?.file.expires_at;
   const wrappedDeks = {};
   for (const [collName, dek] of keyring.deks) {
     wrappedDeks[collName] = await wrapKey(dek, keyring.kek);
   }
+  const wrappedPending = {};
+  for (const [collName, dek] of keyring.pendingDeks ?? []) {
+    wrappedPending[collName] = await wrapKey(dek, keyring.kek);
+  }
   const canary = await mintKeyringCanary(keyring.kek);
-  const keyringFile = {
-    _noydb_keyring: NOYDB_KEYRING_VERSION,
+  const authority = {
     user_id: keyring.userId,
     display_name: keyring.displayName,
     role: keyring.role,
     permissions: keyring.permissions,
+    granted_by: existingGrantedBy ?? keyring.userId,
+    ...existingExpiresAt !== void 0 && { expires_at: existingExpiresAt },
+    ...keyring.exportCapability !== void 0 && { export_capability: keyring.exportCapability },
+    ...keyring.importCapability !== void 0 && { import_capability: keyring.importCapability }
+  };
+  const keyringFile = {
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    ...authority,
     deks: wrappedDeks,
+    ...Object.keys(wrappedPending).length > 0 ? { pending_deks: wrappedPending } : {},
     salt: bufferToBase64(keyring.salt),
-    created_at: (/* @__PURE__ */ new Date()).toISOString(),
-    granted_by: keyring.userId,
+    created_at: existingCreatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
     canary,
-    ...keyring.exportCapability !== void 0 && { export_capability: keyring.exportCapability },
-    ...keyring.importCapability !== void 0 && { import_capability: keyring.importCapability },
+    roster_tag: await mintRosterTag(authority, rosterKey),
     ...keyring.authenticators.length > 0 && { authenticators: keyring.authenticators },
     ...keyring.policy !== void 0 && { policy: keyring.policy },
     ...existingEcho !== void 0 && { echo: existingEcho }
@@ -918,17 +1270,17 @@ function resolvePermissions(role, explicit) {
   return explicit ?? {};
 }
 async function writeKeyringFile(store, vault, userId, keyringFile) {
-  const envelope = {
-    _noydb: 1,
-    _v: 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: "",
-    _data: JSON.stringify(keyringFile)
-  };
+  const envelope = buildRecordEnvelope(
+    { collection: "_keyring", id: userId, version: 1 },
+    { iv: "", data: JSON.stringify(keyringFile) }
+  );
   await store.put(vault, "_keyring", userId, envelope);
 }
 
 export {
+  mintRosterTag,
+  assertRosterAuthenticated,
+  assertRosterTagValid,
   WeakSecretError,
   validateSecret,
   assertStrongSecret,
@@ -945,6 +1297,7 @@ export {
   BROKER_COLLECTION,
   isSecretBearingReservedCollection,
   mintKeyringCanary,
+  requireRosterKey,
   deriveKekForKeyring,
   readKeyringFile,
   assertKeyringNotExpired,
@@ -953,6 +1306,8 @@ export {
   createOwnerKeyring,
   grant,
   revoke,
+  verifyRoster,
+  quarantineKeyring,
   updateKeyringIdentity,
   rotateKeys,
   changeSecret,
@@ -968,4 +1323,4 @@ export {
   hasImportCapability,
   evaluateImportCapability
 };
-//# sourceMappingURL=chunk-ERB6NDDW.js.map
+//# sourceMappingURL=chunk-CAGI4LLJ.js.map