@noy-db/hub 0.6.0-pre.9 → 0.6.0

package/dist/{chunk-JRKZTEZZ.js → chunk-J6I5VR6P.js}

@@ -5,7 +5,18 @@ import {
   readDirectoryConfig,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-5JY5TSVY.js";
+} from "./chunk-ZJUZOJVW.js";
+import {
+  parseDekKey
+} from "./chunk-D2YFQ7XG.js";
+import {
+  envelopeOpensUnderAny,
+  rekeyBlobSet,
+  rekeyEnvelopeIfNeeded
+} from "./chunk-CXPOG3ZY.js";
+import {
+  buildRecordEnvelope
+} from "./chunk-FX3UIDCS.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -20,25 +31,104 @@ import {
   generateSalt,
   unwrapKey,
   wrapKey
-} from "./chunk-VCETL77O.js";
+} from "./chunk-ONPVHX2Y.js";
 import {
-  NOYDB_FORMAT_VERSION,
   NOYDB_KEYRING_VERSION
-} from "./chunk-YPYHVOXP.js";
+} from "./chunk-UJ4Z67UQ.js";
 import {
+  BLOB_ADDRESS_KEY_ID,
   DirectoryDisabledError,
   EchoCeremonyRequiredError,
   InvalidKeyError,
   KeyringCorruptError,
   KeyringExpiredError,
+  KeyringTamperedError,
   NoAccessError,
   NoydbError,
   PermissionDeniedError,
   PrivilegeEscalationError,
+  ROSTER_KEY_ID,
   USER_ENVELOPE_COLLECTION,
   ValidationError,
   WrongPromptError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-Z3BZXPRO.js";
+
+// src/with-party/team/roster-tag.ts
+function stable(value) {
+  if (Array.isArray(value)) return `[${value.map(stable).join(",")}]`;
+  if (value !== null && typeof value === "object") {
+    const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${stable(v)}`);
+    return `{${entries.join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "null";
+}
+function rosterCanonical(file) {
+  return stable({
+    user_id: file.user_id,
+    role: file.role,
+    permissions: file.permissions,
+    granted_by: file.granted_by,
+    // #1115 — WHICH collections this keyring holds a key for, authenticated.
+    //
+    // `revoke` derives its rotation scope from `Object.keys(target.deks)`, so
+    // while this set was unauthenticated a store could strip entries from the
+    // target's file and have those collections silently skipped by the
+    // rotation — leaving a revoked member, colluding with that store, holding
+    // live DEKs for exactly the collections it removed. That directly
+    // contradicts `SECURITY.md`'s "the rotation cannot be skipped".
+    //
+    // NAMES ONLY, deliberately. The wrapped values are AES-KW, which is
+    // self-authenticating: a tampered wrap fails to unwrap. What was
+    // unprotected is the SHAPE of the map, not its contents.
+    //
+    // `pending_deks` is bound for the same reason one field over: stripping it
+    // makes an interrupted rotation mint a fresh DEK instead of resuming,
+    // permanently orphaning every record already rewritten under the pending
+    // key (#1074). Leaving it out would recreate the identical hole.
+    dek_slots: Object.keys(file.deks ?? {}).sort(),
+    pending_dek_slots: Object.keys(file.pending_deks ?? {}).sort(),
+    expires_at: file.expires_at ?? null,
+    export_capability: file.export_capability ?? null,
+    import_capability: file.import_capability ?? null
+  });
+}
+async function mintRosterTag(file, rosterKey) {
+  return encrypt(rosterCanonical(file), rosterKey);
+}
+async function verifyRosterTag(file, tag, rosterKey) {
+  if (tag == null) return false;
+  try {
+    return await decrypt(tag.iv, tag.data, rosterKey) === rosterCanonical(file);
+  } catch {
+    return false;
+  }
+}
+async function assertRosterAuthenticated(file, deks, userId) {
+  const rosterKey = deks.get(ROSTER_KEY_ID);
+  if (rosterKey === void 0) {
+    throw new KeyringTamperedError({ userId, reason: "roster-key-missing" });
+  }
+  await assertRosterTagValid(file, rosterKey, userId);
+}
+async function assertRosterTagValid(file, rosterKey, userId) {
+  if (!await verifyRosterTag(file, file.roster_tag, rosterKey)) {
+    const reason = mismatchReason(file);
+    throw new KeyringTamperedError({
+      userId,
+      reason,
+      // Only on the format branch: elsewhere the declared version matches, so
+      // reporting a transition would invent one. `from` is what the FILE says
+      // — untrusted, and safe to surface for the same reason `mismatchReason`
+      // is safe to compute from it: it selects wording, never a decision.
+      ...reason === "format-superseded" ? { format: { from: Number(file._noydb_keyring), to: NOYDB_KEYRING_VERSION } } : {}
+    });
+  }
+}
+function mismatchReason(file) {
+  if (file.roster_tag == null) return "roster-tag-missing";
+  if (file._noydb_keyring !== NOYDB_KEYRING_VERSION) return "format-superseded";
+  return "roster-tag-mismatch";
+}
 
 // src/kernel/validation.ts
 var WeakSecretError = class extends NoydbError {
@@ -294,6 +384,18 @@ async function verifyKeyringCanary(wrappedCanary, kek) {
     return false;
   }
 }
+function rosterKeyOf(keyring) {
+  return keyring.deks.get(ROSTER_KEY_ID) ?? null;
+}
+function requireRosterKey(keyring, fn) {
+  const rosterKey = rosterKeyOf(keyring);
+  if (!rosterKey) {
+    throw new ValidationError(
+      `${fn}: caller keyring has no vault roster key \u2014 cannot stamp a roster tag. This typically means the keyring was opened via tier-3 PIN resume, session restore, or a wrap-DEKs tier-2 unlock. Re-authenticate at tier 1 (secret) before writing a keyring.`
+    );
+  }
+  return rosterKey;
+}
 async function deriveKekForKeyring(file, secret, salt) {
   if (file.echo !== void 0) {
     if (typeof secret === "string") throw new EchoCeremonyRequiredError();
@@ -327,10 +429,12 @@ async function loadKeyring(store, vault, opts) {
     throw new NoAccessError(`No keyring found for user "${userId}" in vault "${vault}"`);
   }
   const { file: keyringFile } = found;
-  assertKeyringNotExpired(keyringFile);
   const salt = base64ToBuffer(keyringFile.salt);
   const kek = await deriveKekForKeyring(keyringFile, secret, salt);
-  const canaryOk = keyringFile.canary !== void 0 ? await verifyKeyringCanary(keyringFile.canary, kek) : null;
+  if (keyringFile.canary === void 0) {
+    throw new KeyringTamperedError({ userId, reason: "canary-missing" });
+  }
+  const canaryOk = await verifyKeyringCanary(keyringFile.canary, kek);
   const deks = /* @__PURE__ */ new Map();
   const failedCollections = [];
   let firstUnwrapError = null;
@@ -343,11 +447,18 @@ async function loadKeyring(store, vault, opts) {
       if (firstUnwrapError === null) firstUnwrapError = err;
     }
   }
-  if (canaryOk === true) {
+  const pendingDeks = /* @__PURE__ */ new Map();
+  for (const [collName, wrapped] of Object.entries(keyringFile.pending_deks ?? {})) {
+    try {
+      pendingDeks.set(collName, await unwrapKey(wrapped, kek));
+    } catch {
+    }
+  }
+  if (canaryOk) {
     if (failedCollections.length > 0) {
       throw new KeyringCorruptError({ failedCollections, intactCount: deks.size });
     }
-  } else if (canaryOk === false) {
+  } else {
     if (deks.size > 0) {
       throw new KeyringCorruptError({
         failedCollections: [...failedCollections, "_canary"],
@@ -355,20 +466,16 @@ async function loadKeyring(store, vault, opts) {
       });
     }
     throw firstUnwrapError instanceof Error ? firstUnwrapError : new InvalidKeyError();
-  } else {
-    if (failedCollections.length > 0) {
-      if (deks.size > 0) {
-        throw new KeyringCorruptError({ failedCollections, intactCount: deks.size });
-      }
-      throw firstUnwrapError instanceof Error ? firstUnwrapError : new InvalidKeyError();
-    }
   }
+  await assertRosterAuthenticated(keyringFile, deks, userId);
+  assertKeyringNotExpired(keyringFile);
   return {
     userId: keyringFile.user_id,
     displayName: keyringFile.display_name,
     role: keyringFile.role,
     permissions: keyringFile.permissions,
     deks,
+    pendingDeks,
     kek,
     salt,
     authenticators: keyringFile.authenticators ?? [],
@@ -404,18 +511,33 @@ async function createOwnerKeyring(store, vault, opts) {
   const kek = typeof secret === "string" ? await deriveKey(secret, salt) : await deriveEchoKey(secret, salt);
   const userEnvelopeDek = await generateDEK();
   const wrappedUserEnvelopeDek = await wrapKey(userEnvelopeDek, kek);
+  const rosterKey = await generateDEK();
+  const wrappedRosterKey = await wrapKey(rosterKey, kek);
+  const blobAddressKey = await generateDEK();
+  const wrappedBlobAddressKey = await wrapKey(blobAddressKey, kek);
   const canary = await mintKeyringCanary(kek);
-  const keyringFile = {
-    _noydb_keyring: NOYDB_KEYRING_VERSION,
+  const authority = {
     user_id: userId,
     display_name: userId,
     role: "owner",
     permissions: {},
-    deks: { [USER_ENVELOPE_COLLECTION]: wrappedUserEnvelopeDek },
+    granted_by: userId
+  };
+  const authorityWithDeks = {
+    ...authority,
+    deks: {
+      [USER_ENVELOPE_COLLECTION]: wrappedUserEnvelopeDek,
+      [ROSTER_KEY_ID]: wrappedRosterKey,
+      [BLOB_ADDRESS_KEY_ID]: wrappedBlobAddressKey
+    }
+  };
+  const keyringFile = {
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    ...authorityWithDeks,
     salt: bufferToBase64(salt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
-    granted_by: userId,
     canary,
+    roster_tag: await mintRosterTag(authorityWithDeks, rosterKey),
     // The presence of this block is what makes the keyring an echo keyring —
     // `deriveKekForKeyring` reads it to refuse a single-string unlock (AG-1).
     ...typeof secret !== "string" ? {
@@ -432,7 +554,10 @@ async function createOwnerKeyring(store, vault, opts) {
     displayName: userId,
     role: "owner",
     permissions: {},
-    deks: /* @__PURE__ */ new Map([[USER_ENVELOPE_COLLECTION, userEnvelopeDek]]),
+    deks: /* @__PURE__ */ new Map([
+      [USER_ENVELOPE_COLLECTION, userEnvelopeDek],
+      [ROSTER_KEY_ID, rosterKey]
+    ]),
     kek,
     salt,
     authenticators: []
@@ -444,6 +569,7 @@ async function grant(store, vault, callerKeyring, options) {
       "grant: caller keyring has no KEK \u2014 tier-2 wrap-DEKs and tier-3 PIN-resume sessions cannot grant access to other users. Re-authenticate at tier 1 (secret) before granting."
     );
   }
+  const callerRosterKey = requireRosterKey(callerKeyring, "grant");
   if (!canGrant(callerKeyring.role, options.role)) {
     throw new PermissionDeniedError(
       `Role "${callerKeyring.role}" cannot grant role "${options.role}"`
@@ -472,6 +598,8 @@ async function grant(store, vault, callerKeyring, options) {
     mintedForGrant = true;
   }
   if (mintedForGrant) await persistKeyring(store, vault, callerKeyring);
+  const previousGrantFound = await readKeyringFile(store, vault, options.userId);
+  const previousDekNames = previousGrantFound ? new Set(Object.keys(previousGrantFound.file.deks)) : null;
   const wrappedDeks = {};
   for (const collName of Object.keys(permissions)) {
     if (collName === PERMISSION_WILDCARD) continue;
@@ -499,21 +627,35 @@ async function grant(store, vault, callerKeyring, options) {
     }
   }
   const canary = await mintKeyringCanary(newKek);
-  const keyringFile = {
-    _noydb_keyring: NOYDB_KEYRING_VERSION,
+  const authority = {
     user_id: options.userId,
     display_name: options.displayName,
     role: options.role,
     permissions,
-    deks: wrappedDeks,
-    salt: bufferToBase64(newSalt),
-    created_at: (/* @__PURE__ */ new Date()).toISOString(),
     granted_by: callerKeyring.userId,
-    canary,
     ...options.exportCapability !== void 0 && { export_capability: options.exportCapability },
     ...options.importCapability !== void 0 && { import_capability: options.importCapability }
   };
+  const authorityWithDeks = { ...authority, deks: wrappedDeks };
+  const keyringFile = {
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    ...authorityWithDeks,
+    salt: bufferToBase64(newSalt),
+    created_at: (/* @__PURE__ */ new Date()).toISOString(),
+    canary,
+    // The grantee's own copy of the roster key rode in via the `_`-prefix
+    // propagation loop above, so they can verify this tag on first unlock.
+    roster_tag: await mintRosterTag(authorityWithDeks, callerRosterKey)
+  };
   await writeKeyringFile(store, vault, options.userId, keyringFile);
+  if (previousDekNames !== null && options.userId !== callerKeyring.userId) {
+    const dropped = [...previousDekNames].filter(
+      (name) => !name.startsWith("_") && !(name in wrappedDeks)
+    );
+    if (dropped.length > 0) {
+      await rotateKeys(store, vault, callerKeyring, { collections: dropped });
+    }
+  }
   const userEnvelopeDek = callerKeyring.deks.get(USER_ENVELOPE_COLLECTION);
   if (userEnvelopeDek) {
     const initialPayload = options.initialProfile ?? {};
@@ -526,13 +668,14 @@ async function grant(store, vault, callerKeyring, options) {
     );
   }
 }
-async function findAdminDescendants(store, vault, rootUserId) {
+async function findAdminDescendants(store, vault, rootUserId, rosterKey) {
   const allUserIds = await store.list(vault, "_keyring");
   const childrenByParent = /* @__PURE__ */ new Map();
   for (const userId of allUserIds) {
     const found = await readKeyringFile(store, vault, userId);
     if (!found) continue;
     const kf = found.file;
+    await assertRosterTagValid(kf, rosterKey, userId);
     if (kf.role !== "admin") continue;
     if (kf.user_id === rootUserId) continue;
     const list = childrenByParent.get(kf.granted_by) ?? [];
@@ -556,9 +699,16 @@ async function findAdminDescendants(store, vault, rootUserId) {
 async function revoke(store, vault, callerKeyring, options) {
   const targetFound = await readKeyringFile(store, vault, options.userId);
   if (!targetFound) {
+    const pending = [...callerKeyring.pendingDeks?.keys() ?? []];
+    if (pending.length > 0) {
+      await rotateKeys(store, vault, callerKeyring, { collections: pending });
+      return;
+    }
     throw new NoAccessError(`User "${options.userId}" has no keyring in vault "${vault}"`);
   }
   const targetKeyring = targetFound.file;
+  const callerRosterKey = requireRosterKey(callerKeyring, "revoke");
+  await assertRosterTagValid(targetKeyring, callerRosterKey, options.userId);
   if (!canRevoke(callerKeyring.role, targetKeyring.role)) {
     throw new PermissionDeniedError(
       `Role "${callerKeyring.role}" cannot revoke role "${targetKeyring.role}"`
@@ -568,7 +718,7 @@ async function revoke(store, vault, callerKeyring, options) {
   const usersToRevoke = [options.userId];
   const affectedCollections = new Set(Object.keys(targetKeyring.deks));
   if (targetKeyring.role === "admin") {
-    const descendants = await findAdminDescendants(store, vault, options.userId);
+    const descendants = await findAdminDescendants(store, vault, options.userId, callerRosterKey);
     if (descendants.length > 0) {
       if (cascadeMode === "warn") {
         console.warn(
@@ -578,6 +728,7 @@ async function revoke(store, vault, callerKeyring, options) {
         for (const userId of descendants) {
           const descFound = await readKeyringFile(store, vault, userId);
           if (!descFound) continue;
+          await assertRosterTagValid(descFound.file, callerRosterKey, userId);
           usersToRevoke.push(userId);
           for (const c of Object.keys(descFound.file.deks)) affectedCollections.add(c);
         }
@@ -589,10 +740,105 @@ async function revoke(store, vault, callerKeyring, options) {
     await deleteUserEnvelope(store, vault, userId);
     await deleteUserVisibility(store, vault, userId);
   }
-  if (options.rotateKeys !== false && affectedCollections.size > 0) {
-    await rotateKeys(store, vault, callerKeyring, { collections: [...affectedCollections] });
+  affectedCollections.delete(ROSTER_KEY_ID);
+  affectedCollections.delete(BLOB_ADDRESS_KEY_ID);
+  if (affectedCollections.size > 0) {
+    const { unverified } = await rotateKeys(store, vault, callerKeyring, {
+      collections: [...affectedCollections]
+    });
+    if (unverified.length > 0) {
+      console.warn(
+        `[noy-db] revoke(${options.userId}): ${unverified.length} member(s) were SKIPPED by the rotation because their keyring failed roster authentication: ${unverified.map((u) => `${u.userId} (${u.reason})`).join(", ")}. The revocation itself completed. Those members cannot open the vault and did not receive the rotated keys; their keyring files need repair or removal (noy-db#1114).`
+      );
+    }
   }
 }
+async function readKeyringForAudit(store, vault, userId) {
+  const envelope = await store.get(vault, "_keyring", userId);
+  if (!envelope) return void 0;
+  try {
+    return { file: parseKeyringEnvelope(envelope) };
+  } catch {
+    return { unparseable: true };
+  }
+}
+async function verifyRoster(store, vault, callerKeyring) {
+  const rosterKey = requireRosterKey(callerKeyring, "verifyRoster");
+  const unverified = [];
+  let checked = 0;
+  for (const userId of await store.list(vault, "_keyring")) {
+    const found = await readKeyringForAudit(store, vault, userId);
+    if (!found) continue;
+    checked += 1;
+    if ("unparseable" in found) {
+      unverified.push({ userId, reason: "unparseable" });
+      continue;
+    }
+    try {
+      await assertRosterTagValid(found.file, rosterKey, userId);
+    } catch (err) {
+      if (!(err instanceof KeyringTamperedError)) throw err;
+      unverified.push({ userId, reason: err.details.reason });
+    }
+  }
+  return { checked, unverified };
+}
+async function quarantineKeyring(store, vault, callerKeyring, userId) {
+  if (callerKeyring.role !== "owner") {
+    throw new PermissionDeniedError(
+      `Role "${callerKeyring.role}" cannot quarantine a keyring \u2014 quarantine is owner-only, because it removes a file whose own authority claims cannot be trusted.`
+    );
+  }
+  if (userId === callerKeyring.userId) {
+    throw new ValidationError(
+      "quarantineKeyring: refusing to quarantine the calling keyring. Removing your own keyring and rotating behind it would leave the vault with no reachable owner."
+    );
+  }
+  const rosterKey = requireRosterKey(callerKeyring, "quarantineKeyring");
+  const found = await readKeyringForAudit(store, vault, userId);
+  if (!found) {
+    const pending = [...callerKeyring.pendingDeks?.keys() ?? []];
+    if (pending.length > 0) {
+      const resumed = await rotateKeys(store, vault, callerKeyring, { collections: pending });
+      return {
+        userId,
+        reason: "roster-tag-mismatch",
+        rotated: pending,
+        needsRegrant: resumed.needsRegrant,
+        alsoUnverified: resumed.unverified
+      };
+    }
+    throw new NoAccessError(`No keyring found for user "${userId}" in vault "${vault}"`);
+  }
+  let reason = null;
+  if ("unparseable" in found) {
+    reason = "unparseable";
+  } else {
+    try {
+      await assertRosterTagValid(found.file, rosterKey, userId);
+    } catch (err) {
+      if (!(err instanceof KeyringTamperedError)) throw err;
+      reason = err.details.reason;
+    }
+  }
+  if (reason === null) {
+    throw new ValidationError(
+      `quarantineKeyring: the keyring for "${userId}" authenticates correctly, so it is not a quarantine case \u2014 use revoke() instead. Quarantine bypasses the role checks revoke performs, so it is restricted to files that genuinely fail authentication.`
+    );
+  }
+  await store.delete(vault, "_keyring", userId);
+  await deleteUserEnvelope(store, vault, userId);
+  await deleteUserVisibility(store, vault, userId);
+  const rotated = [...callerKeyring.deks.keys()].filter((c) => c !== ROSTER_KEY_ID);
+  const result = rotated.length > 0 ? await rotateKeys(store, vault, callerKeyring, { collections: rotated }) : { needsRegrant: [], unverified: [] };
+  return {
+    userId,
+    reason,
+    rotated,
+    needsRegrant: result.needsRegrant,
+    alsoUnverified: result.unverified
+  };
+}
 async function updateKeyringIdentity(store, vault, callerKeyring, options) {
   if (options.role === void 0 && options.displayName === void 0 && options.permissions === void 0) {
     throw new ValidationError(
@@ -606,6 +852,8 @@ async function updateKeyringIdentity(store, vault, callerKeyring, options) {
     );
   }
   const target = found.file;
+  const rosterKey = requireRosterKey(callerKeyring, "updateKeyringIdentity");
+  await assertRosterTagValid(target, rosterKey, options.userId);
   if (!canUpdateRole(callerKeyring.role, target.role)) {
     throw new PermissionDeniedError(
       `Role "${callerKeyring.role}" cannot update a keyring with role "${target.role}"`
@@ -616,7 +864,7 @@ async function updateKeyringIdentity(store, vault, callerKeyring, options) {
       `Role "${callerKeyring.role}" cannot promote target to role "${options.role}"`
     );
   }
-  const next = {
+  const edited = {
     ...target,
     ...options.role !== void 0 && { role: options.role },
     ...options.displayName !== void 0 && {
@@ -625,50 +873,130 @@ async function updateKeyringIdentity(store, vault, callerKeyring, options) {
     },
     ...options.permissions !== void 0 && { permissions: options.permissions }
   };
+  const next = { ...edited, roster_tag: await mintRosterTag(edited, rosterKey) };
   await writeKeyringFile(store, vault, options.userId, next);
 }
+var HISTORY_COLLECTION = "_history";
+var LEDGER_COLLECTION = "_ledger";
+var LEDGER_DELTAS_COLLECTION = "_ledger_deltas";
+var BLOB_COLLECTION = "_blob";
+var BLOB_SLOTS_PREFIX = "_blob_slots_";
+var BLOB_VERSIONS_PREFIX = "_blob_versions_";
+var BLOB_INTENT_COLLECTION = "_blob_intent";
+async function listOrEmpty(store, vault, collection) {
+  try {
+    return await store.list(vault, collection);
+  } catch {
+    return [];
+  }
+}
+async function derivedRefsFor(store, vault, rotated) {
+  const out = [];
+  if (!rotated.startsWith("_")) {
+    for (const id of await listOrEmpty(store, vault, HISTORY_COLLECTION)) {
+      if (id.startsWith(`${rotated}:`)) out.push({ collection: HISTORY_COLLECTION, id });
+    }
+  }
+  if (rotated === LEDGER_COLLECTION) {
+    for (const id of await listOrEmpty(store, vault, LEDGER_DELTAS_COLLECTION)) {
+      out.push({ collection: LEDGER_DELTAS_COLLECTION, id });
+    }
+  }
+  if (!rotated.startsWith("_")) {
+    for (const id of await listOrEmpty(store, vault, `${BLOB_SLOTS_PREFIX}${rotated}`)) {
+      out.push({ collection: `${BLOB_SLOTS_PREFIX}${rotated}`, id });
+    }
+    for (const id of await listOrEmpty(store, vault, `${BLOB_VERSIONS_PREFIX}${rotated}`)) {
+      out.push({ collection: `${BLOB_VERSIONS_PREFIX}${rotated}`, id });
+    }
+    for (const id of await listOrEmpty(store, vault, BLOB_INTENT_COLLECTION)) {
+      if (id.startsWith(`${rotated}::`)) out.push({ collection: BLOB_INTENT_COLLECTION, id });
+    }
+  }
+  return out;
+}
 async function rotateKeys(store, vault, callerKeyring, opts) {
   const { collections } = opts;
+  if (collections.includes(BLOB_ADDRESS_KEY_ID)) {
+    throw new ValidationError(
+      `rotateKeys: "${BLOB_ADDRESS_KEY_ID}" is the vault's blob content-addressing root, not a collection, and cannot be rotated \u2014 every blob eTag is derived from it, so rotating it would invalidate every stored address at once. Remove it from \`collections\`.`
+    );
+  }
+  if (collections.includes(ROSTER_KEY_ID)) {
+    throw new ValidationError(
+      `rotateKeys: "${ROSTER_KEY_ID}" is the vault roster key, not a collection, and cannot be rotated \u2014 doing so would strip it from every other member and leave the vault unopenable. Remove it from \`collections\`.`
+    );
+  }
   if (callerKeyring.role === "custodian") {
     throw new PermissionDeniedError(
       "custodian cannot rotate keys (FR-6: re-key is an owner-only meta-capability; use the Deed owner)"
     );
   }
+  const callerRosterKey = requireRosterKey(callerKeyring, "rotateKeys");
   const newDeks = /* @__PURE__ */ new Map();
   for (const collName of collections) {
-    newDeks.set(collName, await generateDEK());
+    newDeks.set(collName, callerKeyring.pendingDeks?.get(collName) ?? await generateDEK());
   }
+  const pending = callerKeyring.pendingDeks ?? /* @__PURE__ */ new Map();
+  callerKeyring.pendingDeks = pending;
+  for (const [collName, newDek] of newDeks) {
+    pending.set(collName, newDek);
+  }
+  await persistKeyring(store, vault, callerKeyring);
   for (const collName of collections) {
     const oldDek = callerKeyring.deks.get(collName);
     const newDek = newDeks.get(collName);
     if (!oldDek) continue;
-    const ids = await store.list(vault, collName);
-    for (const id of ids) {
-      const envelope = await store.get(vault, collName, id);
+    if (collName === BLOB_COLLECTION || collName.startsWith(`${BLOB_COLLECTION}#`)) {
+      const others = [];
+      for (const [name, dek] of callerKeyring.deks) if (name !== collName) others.push(dek);
+      for (const [name, dek] of newDeks) if (name !== collName) others.push(dek);
+      await rekeyBlobSet(store, vault, oldDek, newDek, others);
+    }
+    const { collection: baseColl } = parseDekKey(collName);
+    const siblingSlotDeks = [];
+    for (const [name, dek] of callerKeyring.deks) if (name !== collName) siblingSlotDeks.push(dek);
+    for (const [name, dek] of newDeks) if (name !== collName) siblingSlotDeks.push(dek);
+    const refs = [
+      ...(await store.list(vault, baseColl)).map((id) => ({ collection: baseColl, id })),
+      ...await derivedRefsFor(store, vault, baseColl)
+    ];
+    for (const ref of refs) {
+      const { collection: refColl, id } = ref;
+      const envelope = await store.get(vault, refColl, id);
       if (!envelope || !envelope._iv) continue;
-      const plaintext = await decrypt(envelope._iv, envelope._data, oldDek);
-      const { iv, data } = await encrypt(plaintext, newDek);
-      const newEnvelope = {
-        _noydb: NOYDB_FORMAT_VERSION,
-        _v: envelope._v,
-        _ts: (/* @__PURE__ */ new Date()).toISOString(),
-        _iv: iv,
-        _data: data
-      };
-      await store.put(vault, collName, id, newEnvelope);
+      let newEnvelope;
+      try {
+        newEnvelope = await rekeyEnvelopeIfNeeded({ collection: refColl, id }, envelope, oldDek, newDek);
+      } catch (err) {
+        if (await envelopeOpensUnderAny({ collection: refColl, id }, envelope, siblingSlotDeks)) {
+          continue;
+        }
+        throw err;
+      }
+      if (newEnvelope !== null) await store.put(vault, refColl, id, newEnvelope);
     }
   }
   for (const [collName, newDek] of newDeks) {
     callerKeyring.deks.set(collName, newDek);
+    callerKeyring.pendingDeks?.delete(collName);
   }
   await persistKeyring(store, vault, callerKeyring);
   const needsRegrant = [];
+  const unverified = [];
   const userIds = await store.list(vault, "_keyring");
   for (const userId of userIds) {
     if (userId === callerKeyring.userId) continue;
     const userFound = await readKeyringFile(store, vault, userId);
     if (!userFound) continue;
     const userKeyringFile = userFound.file;
+    try {
+      await assertRosterTagValid(userKeyringFile, callerRosterKey, userId);
+    } catch (err) {
+      if (!(err instanceof KeyringTamperedError)) throw err;
+      unverified.push({ userId, reason: err.details.reason });
+      continue;
+    }
     const updatedDeks = { ...userKeyringFile.deks };
     const updatedPermissions = { ...userKeyringFile.permissions };
     for (const collName of collections) {
@@ -678,17 +1006,24 @@ async function rotateKeys(store, vault, callerKeyring, opts) {
       delete updatedDeks[collName];
       delete updatedPermissions[collName];
     }
-    const updatedKeyring = {
+    const edited = {
       ...userKeyringFile,
       deks: updatedDeks,
       permissions: updatedPermissions
     };
+    const updatedKeyring = {
+      ...edited,
+      roster_tag: await mintRosterTag(edited, callerRosterKey)
+    };
     await writeKeyringFile(store, vault, userId, updatedKeyring);
   }
-  return { needsRegrant };
+  return { needsRegrant, unverified };
 }
 async function changeSecret(store, vault, keyring, opts) {
   const existingFound = await readKeyringFile(store, vault, keyring.userId);
+  if (existingFound) {
+    await assertRosterTagValid(existingFound.file, requireRosterKey(keyring, "changeSecret"), keyring.userId);
+  }
   if (existingFound && existingFound.file.echo !== void 0) throw new EchoCeremonyRequiredError();
   const { newSecret } = opts;
   if (!opts.allowWeakSecret) {
@@ -700,18 +1035,28 @@ async function changeSecret(store, vault, keyring, opts) {
   for (const [collName, dek] of keyring.deks) {
     wrappedDeks[collName] = await wrapKey(dek, newKek);
   }
+  const rosterKey = requireRosterKey(keyring, "changeSecret");
   const canary = await mintKeyringCanary(newKek);
-  const keyringFile = {
-    _noydb_keyring: NOYDB_KEYRING_VERSION,
+  const existingAuthority = existingFound?.file;
+  const keptGrantedBy = existingAuthority?.granted_by ?? keyring.userId;
+  const authority = {
     user_id: keyring.userId,
     display_name: keyring.displayName,
     role: keyring.role,
     permissions: keyring.permissions,
-    deks: wrappedDeks,
+    granted_by: keptGrantedBy,
+    ...existingAuthority?.expires_at !== void 0 && { expires_at: existingAuthority.expires_at },
+    ...existingAuthority?.export_capability !== void 0 && { export_capability: existingAuthority.export_capability },
+    ...existingAuthority?.import_capability !== void 0 && { import_capability: existingAuthority.import_capability }
+  };
+  const authorityWithDeks = { ...authority, deks: wrappedDeks };
+  const keyringFile = {
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    ...authorityWithDeks,
     salt: bufferToBase64(newSalt),
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
-    granted_by: keyring.userId,
-    canary
+    canary,
+    roster_tag: await mintRosterTag(authorityWithDeks, rosterKey)
   };
   await writeKeyringFile(store, vault, keyring.userId, keyringFile);
   return {
@@ -738,6 +1083,7 @@ async function buildRecipientKeyringFile(callerKeyring, recipient) {
       "buildRecipientKeyringFile: caller keyring has no KEK \u2014 tier-2 wrap-DEKs and tier-3 PIN-resume sessions cannot create bundle recipients. Re-authenticate at tier 1 (secret) before building a bundle."
     );
   }
+  const rosterKey = requireRosterKey(callerKeyring, "buildRecipientKeyringFile");
   const role = recipient.role ?? "viewer";
   const permissions = resolvePermissions(role, recipient.permissions);
   const newSalt = generateSalt();
@@ -767,20 +1113,26 @@ async function buildRecipientKeyringFile(callerKeyring, recipient) {
     }
   }
   const canary = await mintKeyringCanary(newKek);
-  return {
-    _noydb_keyring: NOYDB_KEYRING_VERSION,
+  const authority = {
     user_id: recipient.id,
     display_name: recipient.displayName ?? recipient.id,
     role,
     permissions,
-    deks: wrappedDeks,
-    salt: bufferToBase64(newSalt),
-    created_at: (/* @__PURE__ */ new Date()).toISOString(),
     granted_by: callerKeyring.userId,
-    canary,
     ...recipient.exportCapability !== void 0 ? { export_capability: recipient.exportCapability } : {},
     ...recipient.importCapability !== void 0 ? { import_capability: recipient.importCapability } : {},
-    ...recipient.expiresAt !== void 0 ? { expires_at: recipient.expiresAt } : {},
+    ...recipient.expiresAt !== void 0 ? { expires_at: recipient.expiresAt } : {}
+  };
+  const authorityWithDeks = { ...authority, deks: wrappedDeks };
+  return {
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    ...authorityWithDeks,
+    salt: bufferToBase64(newSalt),
+    created_at: (/* @__PURE__ */ new Date()).toISOString(),
+    canary,
+    // The recipient's copy of the roster key rode in via the `_`-prefix
+    // propagation loop above, so the slot verifies on first unlock.
+    roster_tag: await mintRosterTag(authorityWithDeks, rosterKey),
     // The presence of this block is what makes the recipient's slot an
     // echo keyring — mirrors `createOwnerKeyring`'s same dance so the
     // ceremony (prompt → echo → key) travels with the pod, not just a
@@ -908,28 +1260,44 @@ async function persistKeyring(store, vault, keyring) {
       "persistKeyring: keyring.kek is null \u2014 cannot wrap DEKs without the KEK. This typically means the keyring was opened via tier-3 PIN resume, session restore, or a wrap-DEKs tier-2 unlock. Re-authenticate at tier 1 (secret) before persisting."
     );
   }
+  const rosterKey = requireRosterKey(keyring, "persistKeyring");
   const existingFound = await readKeyringFile(store, vault, keyring.userId);
+  if (existingFound) await assertRosterTagValid(existingFound.file, rosterKey, keyring.userId);
   const existingEcho = existingFound?.file.echo;
   const existingGrantedBy = existingFound?.file.granted_by;
   const existingCreatedAt = existingFound?.file.created_at;
+  const existingExpiresAt = existingFound?.file.expires_at;
   const wrappedDeks = {};
   for (const [collName, dek] of keyring.deks) {
     wrappedDeks[collName] = await wrapKey(dek, keyring.kek);
   }
+  const wrappedPending = {};
+  for (const [collName, dek] of keyring.pendingDeks ?? []) {
+    wrappedPending[collName] = await wrapKey(dek, keyring.kek);
+  }
   const canary = await mintKeyringCanary(keyring.kek);
-  const keyringFile = {
-    _noydb_keyring: NOYDB_KEYRING_VERSION,
+  const authority = {
     user_id: keyring.userId,
     display_name: keyring.displayName,
     role: keyring.role,
     permissions: keyring.permissions,
+    granted_by: existingGrantedBy ?? keyring.userId,
+    ...existingExpiresAt !== void 0 && { expires_at: existingExpiresAt },
+    ...keyring.exportCapability !== void 0 && { export_capability: keyring.exportCapability },
+    ...keyring.importCapability !== void 0 && { import_capability: keyring.importCapability }
+  };
+  const authorityWithDeks = {
+    ...authority,
     deks: wrappedDeks,
+    ...Object.keys(wrappedPending).length > 0 ? { pending_deks: wrappedPending } : {}
+  };
+  const keyringFile = {
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    ...authorityWithDeks,
     salt: bufferToBase64(keyring.salt),
     created_at: existingCreatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-    granted_by: existingGrantedBy ?? keyring.userId,
     canary,
-    ...keyring.exportCapability !== void 0 && { export_capability: keyring.exportCapability },
-    ...keyring.importCapability !== void 0 && { import_capability: keyring.importCapability },
+    roster_tag: await mintRosterTag(authorityWithDeks, rosterKey),
     ...keyring.authenticators.length > 0 && { authenticators: keyring.authenticators },
     ...keyring.policy !== void 0 && { policy: keyring.policy },
     ...existingEcho !== void 0 && { echo: existingEcho }
@@ -974,17 +1342,17 @@ function resolvePermissions(role, explicit) {
   return explicit ?? {};
 }
 async function writeKeyringFile(store, vault, userId, keyringFile) {
-  const envelope = {
-    _noydb: 1,
-    _v: 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: "",
-    _data: JSON.stringify(keyringFile)
-  };
+  const envelope = buildRecordEnvelope(
+    { collection: "_keyring", id: userId, version: 1 },
+    { iv: "", data: JSON.stringify(keyringFile) }
+  );
   await store.put(vault, "_keyring", userId, envelope);
 }
 
 export {
+  mintRosterTag,
+  assertRosterAuthenticated,
+  assertRosterTagValid,
   WeakSecretError,
   validateSecret,
   assertStrongSecret,
@@ -1001,6 +1369,7 @@ export {
   BROKER_COLLECTION,
   isSecretBearingReservedCollection,
   mintKeyringCanary,
+  requireRosterKey,
   deriveKekForKeyring,
   readKeyringFile,
   assertKeyringNotExpired,
@@ -1009,6 +1378,8 @@ export {
   createOwnerKeyring,
   grant,
   revoke,
+  verifyRoster,
+  quarantineKeyring,
   updateKeyringIdentity,
   rotateKeys,
   changeSecret,
@@ -1024,4 +1395,4 @@ export {
   hasImportCapability,
   evaluateImportCapability
 };
-//# sourceMappingURL=chunk-JRKZTEZZ.js.map
+//# sourceMappingURL=chunk-J6I5VR6P.js.map