@noy-db/hub 0.6.0-pre.20 → 0.6.0-pre.21

package/dist/{chunk-RKDH6L53.js → chunk-CAGI4LLJ.js}

@@ -5,43 +5,95 @@ import {
   readDirectoryConfig,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-JHO6FGZX.js";
+} from "./chunk-LX46B56Q.js";
 import {
+  rekeyBlobSet,
   rekeyEnvelopeIfNeeded
-} from "./chunk-D5UDZANO.js";
+} from "./chunk-OHOKBMTM.js";
 import {
   buildRecordEnvelope
-} from "./chunk-ZVAFJQZB.js";
+} from "./chunk-PENPHA45.js";
 import {
   base64ToBuffer,
   bufferToBase64,
+  decrypt,
   deriveEchoKey,
   deriveKey,
   deriveSecretKey,
   encodeEchoParts,
+  encrypt,
   generateDEK,
   generateIV,
   generateSalt,
   unwrapKey,
   wrapKey
-} from "./chunk-VJ4B3ZXY.js";
+} from "./chunk-AU3AUJIZ.js";
 import {
   NOYDB_KEYRING_VERSION
-} from "./chunk-3Y4OFWQJ.js";
+} from "./chunk-IGNJOJEP.js";
 import {
   DirectoryDisabledError,
   EchoCeremonyRequiredError,
   InvalidKeyError,
   KeyringCorruptError,
   KeyringExpiredError,
+  KeyringTamperedError,
   NoAccessError,
   NoydbError,
   PermissionDeniedError,
   PrivilegeEscalationError,
+  ROSTER_KEY_ID,
   USER_ENVELOPE_COLLECTION,
   ValidationError,
   WrongPromptError
-} from "./chunk-P7L3OQLL.js";
+} from "./chunk-CWM4GQD2.js";
+
+// src/with-party/team/roster-tag.ts
+function stable(value) {
+  if (Array.isArray(value)) return `[${value.map(stable).join(",")}]`;
+  if (value !== null && typeof value === "object") {
+    const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${stable(v)}`);
+    return `{${entries.join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "null";
+}
+function rosterCanonical(file) {
+  return stable({
+    user_id: file.user_id,
+    role: file.role,
+    permissions: file.permissions,
+    granted_by: file.granted_by,
+    expires_at: file.expires_at ?? null,
+    export_capability: file.export_capability ?? null,
+    import_capability: file.import_capability ?? null
+  });
+}
+async function mintRosterTag(file, rosterKey) {
+  return encrypt(rosterCanonical(file), rosterKey);
+}
+async function verifyRosterTag(file, tag, rosterKey) {
+  if (tag == null) return false;
+  try {
+    return await decrypt(tag.iv, tag.data, rosterKey) === rosterCanonical(file);
+  } catch {
+    return false;
+  }
+}
+async function assertRosterAuthenticated(file, deks, userId) {
+  const rosterKey = deks.get(ROSTER_KEY_ID);
+  if (rosterKey === void 0) {
+    throw new KeyringTamperedError({ userId, reason: "roster-key-missing" });
+  }
+  await assertRosterTagValid(file, rosterKey, userId);
+}
+async function assertRosterTagValid(file, rosterKey, userId) {
+  if (!await verifyRosterTag(file, file.roster_tag, rosterKey)) {
+    throw new KeyringTamperedError({
+      userId,
+      reason: file.roster_tag == null ? "roster-tag-missing" : "roster-tag-mismatch"
+    });
+  }
+}
 
 // src/kernel/validation.ts
 var WeakSecretError = class extends NoydbError {
@@ -297,6 +349,18 @@ async function verifyKeyringCanary(wrappedCanary, kek) {
     return false;
   }
 }
+function rosterKeyOf(keyring) {
+  return keyring.deks.get(ROSTER_KEY_ID) ?? null;
+}
+function requireRosterKey(keyring, fn) {
+  const rosterKey = rosterKeyOf(keyring);
+  if (!rosterKey) {
+    throw new ValidationError(
+      `${fn}: caller keyring has no vault roster key \u2014 cannot stamp a roster tag. This typically means the keyring was opened via tier-3 PIN resume, session restore, or a wrap-DEKs tier-2 unlock. Re-authenticate at tier 1 (secret) before writing a keyring.`
+    );
+  }
+  return rosterKey;
+}
 async function deriveKekForKeyring(file, secret, salt) {
   if (file.echo !== void 0) {
     if (typeof secret === "string") throw new EchoCeremonyRequiredError();
@@ -330,10 +394,12 @@ async function loadKeyring(store, vault, opts) {
     throw new NoAccessError(`No keyring found for user "${userId}" in vault "${vault}"`);
   }
   const { file: keyringFile } = found;
-  assertKeyringNotExpired(keyringFile);
   const salt = base64ToBuffer(keyringFile.salt);
   const kek = await deriveKekForKeyring(keyringFile, secret, salt);
-  const canaryOk = keyringFile.canary !== void 0 ? await verifyKeyringCanary(keyringFile.canary, kek) : null;
+  if (keyringFile.canary === void 0) {
+    throw new KeyringTamperedError({ userId, reason: "canary-missing" });
+  }
+  const canaryOk = await verifyKeyringCanary(keyringFile.canary, kek);
   const deks = /* @__PURE__ */ new Map();
   const failedCollections = [];
   let firstUnwrapError = null;
@@ -353,11 +419,11 @@ async function loadKeyring(store, vault, opts) {
     } catch {
     }
   }
-  if (canaryOk === true) {
+  if (canaryOk) {
     if (failedCollections.length > 0) {
       throw new KeyringCorruptError({ failedCollections, intactCount: deks.size });
     }
-  } else if (canaryOk === false) {
+  } else {
     if (deks.size > 0) {
       throw new KeyringCorruptError({
         failedCollections: [...failedCollections, "_canary"],
@@ -365,14 +431,9 @@ async function loadKeyring(store, vault, opts) {
       });
     }
     throw firstUnwrapError instanceof Error ? firstUnwrapError : new InvalidKeyError();
-  } else {
-    if (failedCollections.length > 0) {
-      if (deks.size > 0) {
-        throw new KeyringCorruptError({ failedCollections, intactCount: deks.size });
-      }
-      throw firstUnwrapError instanceof Error ? firstUnwrapError : new InvalidKeyError();
-    }
   }
+  await assertRosterAuthenticated(keyringFile, deks, userId);
+  assertKeyringNotExpired(keyringFile);
   return {
     userId: keyringFile.user_id,
     displayName: keyringFile.display_name,
@@ -415,18 +476,27 @@ async function createOwnerKeyring(store, vault, opts) {
   const kek = typeof secret === "string" ? await deriveKey(secret, salt) : await deriveEchoKey(secret, salt);
   const userEnvelopeDek = await generateDEK();
   const wrappedUserEnvelopeDek = await wrapKey(userEnvelopeDek, kek);
+  const rosterKey = await generateDEK();
+  const wrappedRosterKey = await wrapKey(rosterKey, kek);
   const canary = await mintKeyringCanary(kek);
-  const keyringFile = {
-    _noydb_keyring: NOYDB_KEYRING_VERSION,
+  const authority = {
     user_id: userId,
     display_name: userId,
     role: "owner",
     permissions: {},
-    deks: { [USER_ENVELOPE_COLLECTION]: wrappedUserEnvelopeDek },
+    granted_by: userId
+  };
+  const keyringFile = {
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    ...authority,
+    deks: {
+      [USER_ENVELOPE_COLLECTION]: wrappedUserEnvelopeDek,
+      [ROSTER_KEY_ID]: wrappedRosterKey
+    },
     salt: bufferToBase64(salt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
-    granted_by: userId,
     canary,
+    roster_tag: await mintRosterTag(authority, rosterKey),
     // The presence of this block is what makes the keyring an echo keyring —
     // `deriveKekForKeyring` reads it to refuse a single-string unlock (AG-1).
     ...typeof secret !== "string" ? {
@@ -443,7 +513,10 @@ async function createOwnerKeyring(store, vault, opts) {
     displayName: userId,
     role: "owner",
     permissions: {},
-    deks: /* @__PURE__ */ new Map([[USER_ENVELOPE_COLLECTION, userEnvelopeDek]]),
+    deks: /* @__PURE__ */ new Map([
+      [USER_ENVELOPE_COLLECTION, userEnvelopeDek],
+      [ROSTER_KEY_ID, rosterKey]
+    ]),
     kek,
     salt,
     authenticators: []
@@ -455,6 +528,7 @@ async function grant(store, vault, callerKeyring, options) {
       "grant: caller keyring has no KEK \u2014 tier-2 wrap-DEKs and tier-3 PIN-resume sessions cannot grant access to other users. Re-authenticate at tier 1 (secret) before granting."
     );
   }
+  const callerRosterKey = requireRosterKey(callerKeyring, "grant");
   if (!canGrant(callerKeyring.role, options.role)) {
     throw new PermissionDeniedError(
       `Role "${callerKeyring.role}" cannot grant role "${options.role}"`
@@ -510,19 +584,25 @@ async function grant(store, vault, callerKeyring, options) {
     }
   }
   const canary = await mintKeyringCanary(newKek);
-  const keyringFile = {
-    _noydb_keyring: NOYDB_KEYRING_VERSION,
+  const authority = {
     user_id: options.userId,
     display_name: options.displayName,
     role: options.role,
     permissions,
+    granted_by: callerKeyring.userId,
+    ...options.exportCapability !== void 0 && { export_capability: options.exportCapability },
+    ...options.importCapability !== void 0 && { import_capability: options.importCapability }
+  };
+  const keyringFile = {
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    ...authority,
     deks: wrappedDeks,
     salt: bufferToBase64(newSalt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
-    granted_by: callerKeyring.userId,
     canary,
-    ...options.exportCapability !== void 0 && { export_capability: options.exportCapability },
-    ...options.importCapability !== void 0 && { import_capability: options.importCapability }
+    // The grantee's own copy of the roster key rode in via the `_`-prefix
+    // propagation loop above, so they can verify this tag on first unlock.
+    roster_tag: await mintRosterTag(authority, callerRosterKey)
   };
   await writeKeyringFile(store, vault, options.userId, keyringFile);
   const userEnvelopeDek = callerKeyring.deks.get(USER_ENVELOPE_COLLECTION);
@@ -537,13 +617,14 @@ async function grant(store, vault, callerKeyring, options) {
     );
   }
 }
-async function findAdminDescendants(store, vault, rootUserId) {
+async function findAdminDescendants(store, vault, rootUserId, rosterKey) {
   const allUserIds = await store.list(vault, "_keyring");
   const childrenByParent = /* @__PURE__ */ new Map();
   for (const userId of allUserIds) {
     const found = await readKeyringFile(store, vault, userId);
     if (!found) continue;
     const kf = found.file;
+    await assertRosterTagValid(kf, rosterKey, userId);
     if (kf.role !== "admin") continue;
     if (kf.user_id === rootUserId) continue;
     const list = childrenByParent.get(kf.granted_by) ?? [];
@@ -575,6 +656,8 @@ async function revoke(store, vault, callerKeyring, options) {
     throw new NoAccessError(`User "${options.userId}" has no keyring in vault "${vault}"`);
   }
   const targetKeyring = targetFound.file;
+  const callerRosterKey = requireRosterKey(callerKeyring, "revoke");
+  await assertRosterTagValid(targetKeyring, callerRosterKey, options.userId);
   if (!canRevoke(callerKeyring.role, targetKeyring.role)) {
     throw new PermissionDeniedError(
       `Role "${callerKeyring.role}" cannot revoke role "${targetKeyring.role}"`
@@ -584,7 +667,7 @@ async function revoke(store, vault, callerKeyring, options) {
   const usersToRevoke = [options.userId];
   const affectedCollections = new Set(Object.keys(targetKeyring.deks));
   if (targetKeyring.role === "admin") {
-    const descendants = await findAdminDescendants(store, vault, options.userId);
+    const descendants = await findAdminDescendants(store, vault, options.userId, callerRosterKey);
     if (descendants.length > 0) {
       if (cascadeMode === "warn") {
         console.warn(
@@ -594,6 +677,7 @@ async function revoke(store, vault, callerKeyring, options) {
         for (const userId of descendants) {
           const descFound = await readKeyringFile(store, vault, userId);
           if (!descFound) continue;
+          await assertRosterTagValid(descFound.file, callerRosterKey, userId);
           usersToRevoke.push(userId);
           for (const c of Object.keys(descFound.file.deks)) affectedCollections.add(c);
         }
@@ -605,9 +689,103 @@ async function revoke(store, vault, callerKeyring, options) {
     await deleteUserEnvelope(store, vault, userId);
     await deleteUserVisibility(store, vault, userId);
   }
+  affectedCollections.delete(ROSTER_KEY_ID);
   if (affectedCollections.size > 0) {
-    await rotateKeys(store, vault, callerKeyring, { collections: [...affectedCollections] });
+    const { unverified } = await rotateKeys(store, vault, callerKeyring, {
+      collections: [...affectedCollections]
+    });
+    if (unverified.length > 0) {
+      console.warn(
+        `[noy-db] revoke(${options.userId}): ${unverified.length} member(s) were SKIPPED by the rotation because their keyring failed roster authentication: ${unverified.map((u) => `${u.userId} (${u.reason})`).join(", ")}. The revocation itself completed. Those members cannot open the vault and did not receive the rotated keys; their keyring files need repair or removal (noy-db#1114).`
+      );
+    }
+  }
+}
+async function readKeyringForAudit(store, vault, userId) {
+  const envelope = await store.get(vault, "_keyring", userId);
+  if (!envelope) return void 0;
+  try {
+    return { file: parseKeyringEnvelope(envelope) };
+  } catch {
+    return { unparseable: true };
+  }
+}
+async function verifyRoster(store, vault, callerKeyring) {
+  const rosterKey = requireRosterKey(callerKeyring, "verifyRoster");
+  const unverified = [];
+  let checked = 0;
+  for (const userId of await store.list(vault, "_keyring")) {
+    const found = await readKeyringForAudit(store, vault, userId);
+    if (!found) continue;
+    checked += 1;
+    if ("unparseable" in found) {
+      unverified.push({ userId, reason: "unparseable" });
+      continue;
+    }
+    try {
+      await assertRosterTagValid(found.file, rosterKey, userId);
+    } catch (err) {
+      if (!(err instanceof KeyringTamperedError)) throw err;
+      unverified.push({ userId, reason: err.details.reason });
+    }
+  }
+  return { checked, unverified };
+}
+async function quarantineKeyring(store, vault, callerKeyring, userId) {
+  if (callerKeyring.role !== "owner") {
+    throw new PermissionDeniedError(
+      `Role "${callerKeyring.role}" cannot quarantine a keyring \u2014 quarantine is owner-only, because it removes a file whose own authority claims cannot be trusted.`
+    );
+  }
+  if (userId === callerKeyring.userId) {
+    throw new ValidationError(
+      "quarantineKeyring: refusing to quarantine the calling keyring. Removing your own keyring and rotating behind it would leave the vault with no reachable owner."
+    );
+  }
+  const rosterKey = requireRosterKey(callerKeyring, "quarantineKeyring");
+  const found = await readKeyringForAudit(store, vault, userId);
+  if (!found) {
+    const pending = [...callerKeyring.pendingDeks?.keys() ?? []];
+    if (pending.length > 0) {
+      const resumed = await rotateKeys(store, vault, callerKeyring, { collections: pending });
+      return {
+        userId,
+        reason: "roster-tag-mismatch",
+        rotated: pending,
+        needsRegrant: resumed.needsRegrant,
+        alsoUnverified: resumed.unverified
+      };
+    }
+    throw new NoAccessError(`No keyring found for user "${userId}" in vault "${vault}"`);
+  }
+  let reason = null;
+  if ("unparseable" in found) {
+    reason = "unparseable";
+  } else {
+    try {
+      await assertRosterTagValid(found.file, rosterKey, userId);
+    } catch (err) {
+      if (!(err instanceof KeyringTamperedError)) throw err;
+      reason = err.details.reason;
+    }
+  }
+  if (reason === null) {
+    throw new ValidationError(
+      `quarantineKeyring: the keyring for "${userId}" authenticates correctly, so it is not a quarantine case \u2014 use revoke() instead. Quarantine bypasses the role checks revoke performs, so it is restricted to files that genuinely fail authentication.`
+    );
   }
+  await store.delete(vault, "_keyring", userId);
+  await deleteUserEnvelope(store, vault, userId);
+  await deleteUserVisibility(store, vault, userId);
+  const rotated = [...callerKeyring.deks.keys()].filter((c) => c !== ROSTER_KEY_ID);
+  const result = rotated.length > 0 ? await rotateKeys(store, vault, callerKeyring, { collections: rotated }) : { needsRegrant: [], unverified: [] };
+  return {
+    userId,
+    reason,
+    rotated,
+    needsRegrant: result.needsRegrant,
+    alsoUnverified: result.unverified
+  };
 }
 async function updateKeyringIdentity(store, vault, callerKeyring, options) {
   if (options.role === void 0 && options.displayName === void 0 && options.permissions === void 0) {
@@ -622,6 +800,8 @@ async function updateKeyringIdentity(store, vault, callerKeyring, options) {
     );
   }
   const target = found.file;
+  const rosterKey = requireRosterKey(callerKeyring, "updateKeyringIdentity");
+  await assertRosterTagValid(target, rosterKey, options.userId);
   if (!canUpdateRole(callerKeyring.role, target.role)) {
     throw new PermissionDeniedError(
       `Role "${callerKeyring.role}" cannot update a keyring with role "${target.role}"`
@@ -632,7 +812,7 @@ async function updateKeyringIdentity(store, vault, callerKeyring, options) {
       `Role "${callerKeyring.role}" cannot promote target to role "${options.role}"`
     );
   }
-  const next = {
+  const edited = {
     ...target,
     ...options.role !== void 0 && { role: options.role },
     ...options.displayName !== void 0 && {
@@ -641,11 +821,16 @@ async function updateKeyringIdentity(store, vault, callerKeyring, options) {
     },
     ...options.permissions !== void 0 && { permissions: options.permissions }
   };
+  const next = { ...edited, roster_tag: await mintRosterTag(edited, rosterKey) };
   await writeKeyringFile(store, vault, options.userId, next);
 }
 var HISTORY_COLLECTION = "_history";
 var LEDGER_COLLECTION = "_ledger";
 var LEDGER_DELTAS_COLLECTION = "_ledger_deltas";
+var BLOB_COLLECTION = "_blob";
+var BLOB_SLOTS_PREFIX = "_blob_slots_";
+var BLOB_VERSIONS_PREFIX = "_blob_versions_";
+var BLOB_INTENT_COLLECTION = "_blob_intent";
 async function listOrEmpty(store, vault, collection) {
   try {
     return await store.list(vault, collection);
@@ -665,15 +850,32 @@ async function derivedRefsFor(store, vault, rotated) {
       out.push({ collection: LEDGER_DELTAS_COLLECTION, id });
     }
   }
+  if (!rotated.startsWith("_")) {
+    for (const id of await listOrEmpty(store, vault, `${BLOB_SLOTS_PREFIX}${rotated}`)) {
+      out.push({ collection: `${BLOB_SLOTS_PREFIX}${rotated}`, id });
+    }
+    for (const id of await listOrEmpty(store, vault, `${BLOB_VERSIONS_PREFIX}${rotated}`)) {
+      out.push({ collection: `${BLOB_VERSIONS_PREFIX}${rotated}`, id });
+    }
+    for (const id of await listOrEmpty(store, vault, BLOB_INTENT_COLLECTION)) {
+      if (id.startsWith(`${rotated}::`)) out.push({ collection: BLOB_INTENT_COLLECTION, id });
+    }
+  }
   return out;
 }
 async function rotateKeys(store, vault, callerKeyring, opts) {
   const { collections } = opts;
+  if (collections.includes(ROSTER_KEY_ID)) {
+    throw new ValidationError(
+      `rotateKeys: "${ROSTER_KEY_ID}" is the vault roster key, not a collection, and cannot be rotated \u2014 doing so would strip it from every other member and leave the vault unopenable. Remove it from \`collections\`.`
+    );
+  }
   if (callerKeyring.role === "custodian") {
     throw new PermissionDeniedError(
       "custodian cannot rotate keys (FR-6: re-key is an owner-only meta-capability; use the Deed owner)"
     );
   }
+  const callerRosterKey = requireRosterKey(callerKeyring, "rotateKeys");
   const newDeks = /* @__PURE__ */ new Map();
   for (const collName of collections) {
     newDeks.set(collName, callerKeyring.pendingDeks?.get(collName) ?? await generateDEK());
@@ -688,6 +890,12 @@ async function rotateKeys(store, vault, callerKeyring, opts) {
     const oldDek = callerKeyring.deks.get(collName);
     const newDek = newDeks.get(collName);
     if (!oldDek) continue;
+    if (collName === BLOB_COLLECTION || collName.startsWith(`${BLOB_COLLECTION}#`)) {
+      const others = [];
+      for (const [name, dek] of callerKeyring.deks) if (name !== collName) others.push(dek);
+      for (const [name, dek] of newDeks) if (name !== collName) others.push(dek);
+      await rekeyBlobSet(store, vault, oldDek, newDek, others);
+    }
     const refs = [
       ...(await store.list(vault, collName)).map((id) => ({ collection: collName, id })),
       ...await derivedRefsFor(store, vault, collName)
@@ -706,12 +914,20 @@ async function rotateKeys(store, vault, callerKeyring, opts) {
   }
   await persistKeyring(store, vault, callerKeyring);
   const needsRegrant = [];
+  const unverified = [];
   const userIds = await store.list(vault, "_keyring");
   for (const userId of userIds) {
     if (userId === callerKeyring.userId) continue;
     const userFound = await readKeyringFile(store, vault, userId);
     if (!userFound) continue;
     const userKeyringFile = userFound.file;
+    try {
+      await assertRosterTagValid(userKeyringFile, callerRosterKey, userId);
+    } catch (err) {
+      if (!(err instanceof KeyringTamperedError)) throw err;
+      unverified.push({ userId, reason: err.details.reason });
+      continue;
+    }
     const updatedDeks = { ...userKeyringFile.deks };
     const updatedPermissions = { ...userKeyringFile.permissions };
     for (const collName of collections) {
@@ -721,17 +937,24 @@ async function rotateKeys(store, vault, callerKeyring, opts) {
       delete updatedDeks[collName];
       delete updatedPermissions[collName];
     }
-    const updatedKeyring = {
+    const edited = {
       ...userKeyringFile,
       deks: updatedDeks,
       permissions: updatedPermissions
     };
+    const updatedKeyring = {
+      ...edited,
+      roster_tag: await mintRosterTag(edited, callerRosterKey)
+    };
     await writeKeyringFile(store, vault, userId, updatedKeyring);
   }
-  return { needsRegrant };
+  return { needsRegrant, unverified };
 }
 async function changeSecret(store, vault, keyring, opts) {
   const existingFound = await readKeyringFile(store, vault, keyring.userId);
+  if (existingFound) {
+    await assertRosterTagValid(existingFound.file, requireRosterKey(keyring, "changeSecret"), keyring.userId);
+  }
   if (existingFound && existingFound.file.echo !== void 0) throw new EchoCeremonyRequiredError();
   const { newSecret } = opts;
   if (!opts.allowWeakSecret) {
@@ -743,18 +966,28 @@ async function changeSecret(store, vault, keyring, opts) {
   for (const [collName, dek] of keyring.deks) {
     wrappedDeks[collName] = await wrapKey(dek, newKek);
   }
+  const rosterKey = requireRosterKey(keyring, "changeSecret");
   const canary = await mintKeyringCanary(newKek);
-  const keyringFile = {
-    _noydb_keyring: NOYDB_KEYRING_VERSION,
+  const existingAuthority = existingFound?.file;
+  const keptGrantedBy = existingAuthority?.granted_by ?? keyring.userId;
+  const authority = {
     user_id: keyring.userId,
     display_name: keyring.displayName,
     role: keyring.role,
     permissions: keyring.permissions,
+    granted_by: keptGrantedBy,
+    ...existingAuthority?.expires_at !== void 0 && { expires_at: existingAuthority.expires_at },
+    ...existingAuthority?.export_capability !== void 0 && { export_capability: existingAuthority.export_capability },
+    ...existingAuthority?.import_capability !== void 0 && { import_capability: existingAuthority.import_capability }
+  };
+  const keyringFile = {
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    ...authority,
     deks: wrappedDeks,
     salt: bufferToBase64(newSalt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
-    granted_by: keyring.userId,
-    canary
+    canary,
+    roster_tag: await mintRosterTag(authority, rosterKey)
   };
   await writeKeyringFile(store, vault, keyring.userId, keyringFile);
   return {
@@ -781,6 +1014,7 @@ async function buildRecipientKeyringFile(callerKeyring, recipient) {
       "buildRecipientKeyringFile: caller keyring has no KEK \u2014 tier-2 wrap-DEKs and tier-3 PIN-resume sessions cannot create bundle recipients. Re-authenticate at tier 1 (secret) before building a bundle."
     );
   }
+  const rosterKey = requireRosterKey(callerKeyring, "buildRecipientKeyringFile");
   const role = recipient.role ?? "viewer";
   const permissions = resolvePermissions(role, recipient.permissions);
   const newSalt = generateSalt();
@@ -810,20 +1044,26 @@ async function buildRecipientKeyringFile(callerKeyring, recipient) {
     }
   }
   const canary = await mintKeyringCanary(newKek);
-  return {
-    _noydb_keyring: NOYDB_KEYRING_VERSION,
+  const authority = {
     user_id: recipient.id,
     display_name: recipient.displayName ?? recipient.id,
     role,
     permissions,
+    granted_by: callerKeyring.userId,
+    ...recipient.exportCapability !== void 0 ? { export_capability: recipient.exportCapability } : {},
+    ...recipient.importCapability !== void 0 ? { import_capability: recipient.importCapability } : {},
+    ...recipient.expiresAt !== void 0 ? { expires_at: recipient.expiresAt } : {}
+  };
+  return {
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    ...authority,
     deks: wrappedDeks,
     salt: bufferToBase64(newSalt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
-    granted_by: callerKeyring.userId,
     canary,
-    ...recipient.exportCapability !== void 0 ? { export_capability: recipient.exportCapability } : {},
-    ...recipient.importCapability !== void 0 ? { import_capability: recipient.importCapability } : {},
-    ...recipient.expiresAt !== void 0 ? { expires_at: recipient.expiresAt } : {},
+    // The recipient's copy of the roster key rode in via the `_`-prefix
+    // propagation loop above, so the slot verifies on first unlock.
+    roster_tag: await mintRosterTag(authority, rosterKey),
     // The presence of this block is what makes the recipient's slot an
     // echo keyring — mirrors `createOwnerKeyring`'s same dance so the
     // ceremony (prompt → echo → key) travels with the pod, not just a
@@ -951,10 +1191,13 @@ async function persistKeyring(store, vault, keyring) {
       "persistKeyring: keyring.kek is null \u2014 cannot wrap DEKs without the KEK. This typically means the keyring was opened via tier-3 PIN resume, session restore, or a wrap-DEKs tier-2 unlock. Re-authenticate at tier 1 (secret) before persisting."
     );
   }
+  const rosterKey = requireRosterKey(keyring, "persistKeyring");
   const existingFound = await readKeyringFile(store, vault, keyring.userId);
+  if (existingFound) await assertRosterTagValid(existingFound.file, rosterKey, keyring.userId);
   const existingEcho = existingFound?.file.echo;
   const existingGrantedBy = existingFound?.file.granted_by;
   const existingCreatedAt = existingFound?.file.created_at;
+  const existingExpiresAt = existingFound?.file.expires_at;
   const wrappedDeks = {};
   for (const [collName, dek] of keyring.deks) {
     wrappedDeks[collName] = await wrapKey(dek, keyring.kek);
@@ -964,20 +1207,25 @@ async function persistKeyring(store, vault, keyring) {
     wrappedPending[collName] = await wrapKey(dek, keyring.kek);
   }
   const canary = await mintKeyringCanary(keyring.kek);
-  const keyringFile = {
-    _noydb_keyring: NOYDB_KEYRING_VERSION,
+  const authority = {
     user_id: keyring.userId,
     display_name: keyring.displayName,
     role: keyring.role,
     permissions: keyring.permissions,
+    granted_by: existingGrantedBy ?? keyring.userId,
+    ...existingExpiresAt !== void 0 && { expires_at: existingExpiresAt },
+    ...keyring.exportCapability !== void 0 && { export_capability: keyring.exportCapability },
+    ...keyring.importCapability !== void 0 && { import_capability: keyring.importCapability }
+  };
+  const keyringFile = {
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    ...authority,
     deks: wrappedDeks,
     ...Object.keys(wrappedPending).length > 0 ? { pending_deks: wrappedPending } : {},
     salt: bufferToBase64(keyring.salt),
     created_at: existingCreatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-    granted_by: existingGrantedBy ?? keyring.userId,
     canary,
-    ...keyring.exportCapability !== void 0 && { export_capability: keyring.exportCapability },
-    ...keyring.importCapability !== void 0 && { import_capability: keyring.importCapability },
+    roster_tag: await mintRosterTag(authority, rosterKey),
     ...keyring.authenticators.length > 0 && { authenticators: keyring.authenticators },
     ...keyring.policy !== void 0 && { policy: keyring.policy },
     ...existingEcho !== void 0 && { echo: existingEcho }
@@ -1030,6 +1278,9 @@ async function writeKeyringFile(store, vault, userId, keyringFile) {
 }
 
 export {
+  mintRosterTag,
+  assertRosterAuthenticated,
+  assertRosterTagValid,
   WeakSecretError,
   validateSecret,
   assertStrongSecret,
@@ -1046,6 +1297,7 @@ export {
   BROKER_COLLECTION,
   isSecretBearingReservedCollection,
   mintKeyringCanary,
+  requireRosterKey,
   deriveKekForKeyring,
   readKeyringFile,
   assertKeyringNotExpired,
@@ -1054,6 +1306,8 @@ export {
   createOwnerKeyring,
   grant,
   revoke,
+  verifyRoster,
+  quarantineKeyring,
   updateKeyringIdentity,
   rotateKeys,
   changeSecret,
@@ -1069,4 +1323,4 @@ export {
   hasImportCapability,
   evaluateImportCapability
 };
-//# sourceMappingURL=chunk-RKDH6L53.js.map
+//# sourceMappingURL=chunk-CAGI4LLJ.js.map