@noy-db/hub 0.8.0 → 0.9.0-pre.1

package/dist/{chunk-XSPFDUDG.js → chunk-V7AKGAXY.js}

@@ -5,10 +5,13 @@ import {
   readDirectoryConfig,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-LIOVX5TJ.js";
+} from "./chunk-QT5ITL25.js";
+import {
+  keyringClearance
+} from "./chunk-NXQEOC3X.js";
 import {
   parseDekKey
-} from "./chunk-FLPCETP6.js";
+} from "./chunk-2LBS62AC.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -23,26 +26,38 @@ import {
   encrypt,
   encryptBytes,
   envelopeOpensUnderAny,
+  exportDekSet,
+  exportRecipientPrivateKeyPkcs8,
+  exportRecipientPublicKeySpki,
   generateDEK,
+  generateRecipientKeyPair,
   generateSalt,
   hasSealedBody,
+  importDekSet,
+  importRecipientKeyPair,
+  importRecipientPublicKeySpki,
+  importTransferKey,
   mintCanary,
+  recipientUnwrap,
+  recipientWrap,
   rekeyBlobSet,
   rekeyEnvelopeIfNeeded,
   unwrapKey,
   wrapKey
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-WRLWEYHY.js";
 import {
   NOYDB_KEYRING_VERSION
-} from "./chunk-SV2PM2OY.js";
+} from "./chunk-XX4R7TUB.js";
 import {
   BLOB_ADDRESS_KEY_ID,
   DirectoryDisabledError,
   EchoCeremonyRequiredError,
+  INBOX_KEY_ID,
   InvalidKeyError,
   KeyringCorruptError,
   KeyringExpiredError,
   KeyringTamperedError,
+  MemberInboxMissingError,
   NoAccessError,
   NoydbError,
   PermissionDeniedError,
@@ -51,8 +66,9 @@ import {
   TamperedError,
   USER_ENVELOPE_COLLECTION,
   ValidationError,
-  WrongPromptError
-} from "./chunk-37EPTBBR.js";
+  WrongPromptError,
+  isConflictError
+} from "./chunk-IKPQ2GGB.js";
 
 // src/with-party/team/roster-epoch.ts
 function assertRosterEpochCurrent(found, expected, userId) {
@@ -121,7 +137,36 @@ function rosterCanonical(file) {
     // the tag stops verifying, so a store cannot downgrade a file to the
     // no-epoch shape. It can only replay a file that genuinely never had one,
     // which is why absence must read as UNKNOWN rather than as zero.
-    ...file.roster_epoch !== void 0 ? { roster_epoch: file.roster_epoch } : {}
+    ...file.roster_epoch !== void 0 ? { roster_epoch: file.roster_epoch } : {},
+    // core#58 — the advisory clearance, bound ONLY WHEN PRESENT.
+    //
+    // ⛔ The conditional spread is mandatory here for the identical reason
+    // given for `roster_epoch` directly above: `file.clearance ?? null` would
+    // change the canonical string for every keyring written before this field
+    // existed, fail every one of their tags, and render every existing vault
+    // unopenable. Do not "tidy" it into the `?? null` shape the older optional
+    // fields use.
+    //
+    // ⚠️ Why bind it at all, when it is DERIVED from `dek_slots` which is
+    // already bound? Because "derived" is a property of how WE write it, not of
+    // what a store must send back. Binding it costs one conditional and makes a
+    // forged value fail the tag instead of merely disagreeing with the slots —
+    // which is the difference between a caught tamper and a silent one, for a
+    // reader who trusted the cheap number. It is defence in depth for a field
+    // whose whole risk is being read instead of the DEK map.
+    ...file.clearance !== void 0 ? { clearance: file.clearance } : {},
+    // core#96 — the inbox PUBLIC KEY and the PENDING SLOT NAMES, bound ONLY
+    // WHEN PRESENT (same conditional spread, same reason as the two above).
+    //
+    // `inbox_pub`: an amend seals DEKs to this key, so a store that could swap
+    // it for its own would read every DEK delivered afterwards. Bound, a swap
+    // fails the tag before anything is sealed to it.
+    // `inbox_slots`: `revoke` rotates what the target's file NAMES; a pending
+    // delivery is a DEK the target may hold, so its names must be as
+    // unstrippable as `dek_slots`. Contents are self-authenticating (AES-GCM
+    // under a CEK only the private half unwraps) and stay out.
+    ...file.inbox_key !== void 0 ? { inbox_pub: file.inbox_key.pub } : {},
+    ...file.inbox !== void 0 ? { inbox_slots: [...new Set(file.inbox.flatMap((box) => box.slots))].sort() } : {}
   });
 }
 async function mintRosterTag(file, rosterKey) {
@@ -161,6 +206,13 @@ function mismatchReason(file) {
   if (file._noydb_keyring !== NOYDB_KEYRING_VERSION) return "format-superseded";
   return "roster-tag-mismatch";
 }
+function stampAuthority(authority, previousEpoch) {
+  return {
+    ...authority,
+    roster_epoch: nextRosterEpoch(previousEpoch),
+    clearance: keyringClearance(Object.keys(authority.deks ?? {}))
+  };
+}
 
 // src/kernel/validation.ts
 var WeakSecretError = class extends NoydbError {
@@ -366,9 +418,11 @@ async function verifyTypedEcho(block, echo) {
 // src/with-party/team/reserved-secret-collections.ts
 var SYNC_CREDENTIALS_COLLECTION = "_sync_credentials";
 var BROKER_COLLECTION = "_broker";
+var BROKER_MEMBER_COLLECTION = "_broker_member";
 var SECRET_BEARING_RESERVED_COLLECTIONS = /* @__PURE__ */ new Set([
   SYNC_CREDENTIALS_COLLECTION,
-  BROKER_COLLECTION
+  BROKER_COLLECTION,
+  BROKER_MEMBER_COLLECTION
 ]);
 function isSecretBearingReservedCollection(name) {
   return SECRET_BEARING_RESERVED_COLLECTIONS.has(name);
@@ -452,7 +506,10 @@ async function loadKeyring(store, vault, opts) {
   }
   const { file: keyringFile } = found;
   const salt = base64ToBuffer(keyringFile.salt);
-  const kek = await deriveKekForKeyring(keyringFile, secret, salt);
+  if (opts.kek === void 0 && secret === void 0) {
+    throw new ValidationError(`loadKeyring: one of \`secret\` / \`kek\` is required (user "${userId}").`);
+  }
+  const kek = opts.kek ?? await deriveKekForKeyring(keyringFile, secret, salt);
   if (keyringFile.canary === void 0) {
     throw new KeyringTamperedError({ userId, reason: "canary-missing" });
   }
@@ -491,7 +548,13 @@ async function loadKeyring(store, vault, opts) {
   }
   await assertRosterAuthenticated(keyringFile, deks, userId);
   assertKeyringNotExpired(keyringFile);
-  return {
+  let drained = false;
+  const inboxKeyAes = deks.get(INBOX_KEY_ID);
+  if (keyringFile.inbox !== void 0 && keyringFile.inbox.length > 0 && inboxKeyAes !== void 0) {
+    for (const [name, dek] of await openInbox(keyringFile, inboxKeyAes)) deks.set(name, dek);
+    drained = true;
+  }
+  const unlocked = {
     userId: keyringFile.user_id,
     displayName: keyringFile.display_name,
     role: keyringFile.role,
@@ -505,6 +568,8 @@ async function loadKeyring(store, vault, opts) {
     ...keyringFile.import_capability !== void 0 && { importCapability: keyringFile.import_capability },
     ...keyringFile.policy !== void 0 && { policy: keyringFile.policy }
   };
+  if (drained) await persistKeyring(store, vault, unlocked);
+  return unlocked;
 }
 async function assertKeyringOpenAllowed(store, vault, userId, create) {
   const keyringUsers = await store.list(vault, "_keyring");
@@ -537,6 +602,7 @@ async function createOwnerKeyring(store, vault, opts) {
   const wrappedRosterKey = await wrapKey(rosterKey, kek);
   const blobAddressKey = await generateDEK();
   const wrappedBlobAddressKey = await wrapKey(blobAddressKey, kek);
+  const inbox = await mintInboxKey(kek);
   const canary = await mintKeyringCanary(kek);
   const authority = {
     user_id: userId,
@@ -550,10 +616,13 @@ async function createOwnerKeyring(store, vault, opts) {
     deks: {
       [USER_ENVELOPE_COLLECTION]: wrappedUserEnvelopeDek,
       [ROSTER_KEY_ID]: wrappedRosterKey,
-      [BLOB_ADDRESS_KEY_ID]: wrappedBlobAddressKey
-    }
+      [BLOB_ADDRESS_KEY_ID]: wrappedBlobAddressKey,
+      [INBOX_KEY_ID]: inbox.wrappedInboxKey
+    },
+    inbox_key: inbox.inboxKey
+    // core#65 — tag-bound, like every other keyring's
   };
-  const withEpoch = { ...authorityWithDeks, roster_epoch: nextRosterEpoch(void 0) };
+  const withEpoch = stampAuthority(authorityWithDeks, void 0);
   const keyringFile = {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
     ...withEpoch,
@@ -571,7 +640,7 @@ async function createOwnerKeyring(store, vault, opts) {
       )
     } : {}
   };
-  await writeKeyringFile(store, vault, userId, keyringFile);
+  await writeKeyringFile(store, vault, userId, keyringFile, "create");
   return {
     userId,
     displayName: userId,
@@ -579,13 +648,41 @@ async function createOwnerKeyring(store, vault, opts) {
     permissions: {},
     deks: /* @__PURE__ */ new Map([
       [USER_ENVELOPE_COLLECTION, userEnvelopeDek],
-      [ROSTER_KEY_ID, rosterKey]
+      [ROSTER_KEY_ID, rosterKey],
+      [INBOX_KEY_ID, inbox.inboxKeyAes]
+      // core#65 — in the SESSION too, not only the file: it opens this owner's own inbox
     ]),
     kek,
     salt,
     authenticators: []
   };
 }
+function selectGranteeDekNames(role, requested, permissions, callerDeks) {
+  const mayHoldSecrets = role === "owner" || role === "admin";
+  const admits = (name) => name !== INBOX_KEY_ID && name !== BROKER_MEMBER_COLLECTION && !(isSecretBearingReservedCollection(name) && !mayHoldSecrets);
+  const selected = /* @__PURE__ */ new Set();
+  for (const collName of Object.keys(permissions)) {
+    if (collName === PERMISSION_WILDCARD) continue;
+    if (admits(collName) && callerDeks.has(collName)) selected.add(collName);
+  }
+  const wrapAll = role === "owner" || role === "admin" || role === "custodian" || role === "viewer" || permissionsAreWildcard(requested);
+  for (const name of callerDeks.keys()) {
+    if ((wrapAll || name.startsWith("_")) && admits(name)) selected.add(name);
+  }
+  return [...selected];
+}
+async function mintMissingDeksForGrant(store, vault, callerKeyring, permissions, mayHoldSecrets) {
+  let minted = false;
+  for (const collName of Object.keys(permissions)) {
+    if (collName === PERMISSION_WILDCARD) continue;
+    if (isSecretBearingReservedCollection(collName) && !mayHoldSecrets) continue;
+    if (callerKeyring.deks.has(collName)) continue;
+    if (await collectionHasRecords(store, vault, collName)) continue;
+    callerKeyring.deks.set(collName, await generateDEK());
+    minted = true;
+  }
+  return minted;
+}
 async function grant(store, vault, callerKeyring, options) {
   if (!callerKeyring.kek) {
     throw new ValidationError(
@@ -611,44 +708,24 @@ async function grant(store, vault, callerKeyring, options) {
   const newSalt = generateSalt();
   const newKek = await deriveKey(options.secret, newSalt);
   const granteeMayHoldSecrets = options.role === "owner" || options.role === "admin";
-  let mintedForGrant = false;
-  for (const collName of Object.keys(permissions)) {
-    if (collName === PERMISSION_WILDCARD) continue;
-    if (isSecretBearingReservedCollection(collName) && !granteeMayHoldSecrets) continue;
-    if (callerKeyring.deks.has(collName)) continue;
-    if (await collectionHasRecords(store, vault, collName)) continue;
-    callerKeyring.deks.set(collName, await generateDEK());
-    mintedForGrant = true;
-  }
+  const mintedForGrant = await mintMissingDeksForGrant(store, vault, callerKeyring, permissions, granteeMayHoldSecrets);
   if (mintedForGrant) await persistKeyring(store, vault, callerKeyring);
   const previousGrantFound = await readKeyringFile(store, vault, options.userId);
   const previousDekNames = previousGrantFound ? new Set(Object.keys(previousGrantFound.file.deks)) : null;
   const wrappedDeks = {};
-  for (const collName of Object.keys(permissions)) {
-    if (collName === PERMISSION_WILDCARD) continue;
-    if (isSecretBearingReservedCollection(collName) && !granteeMayHoldSecrets) continue;
-    const dek = callerKeyring.deks.get(collName);
-    if (dek) {
-      wrappedDeks[collName] = await wrapKey(dek, newKek);
-    }
-  }
-  if (options.role === "owner" || options.role === "admin" || options.role === "custodian" || options.role === "viewer" || permissionsAreWildcard(options.permissions)) {
-    for (const [collName, dek] of callerKeyring.deks) {
-      if (collName in wrappedDeks) continue;
-      if (isSecretBearingReservedCollection(collName) && !granteeMayHoldSecrets) continue;
-      wrappedDeks[collName] = await wrapKey(dek, newKek);
-    }
-  }
-  for (const [collName, dek] of callerKeyring.deks) {
-    if (!collName.startsWith("_") || collName in wrappedDeks) continue;
-    if (isSecretBearingReservedCollection(collName) && !granteeMayHoldSecrets) continue;
-    wrappedDeks[collName] = await wrapKey(dek, newKek);
+  for (const collName of selectGranteeDekNames(options.role, options.permissions, permissions, callerKeyring.deks)) {
+    wrappedDeks[collName] = await wrapKey(callerKeyring.deks.get(collName), newKek);
   }
   for (const collName of Object.keys(wrappedDeks)) {
     if (!callerKeyring.deks.has(collName)) {
       throw new PrivilegeEscalationError(collName);
     }
   }
+  if (!granteeMayHoldSecrets) {
+    wrappedDeks[BROKER_MEMBER_COLLECTION] = await wrapKey(await generateDEK(), newKek);
+  }
+  const inbox = await mintInboxKey(newKek);
+  wrappedDeks[INBOX_KEY_ID] = inbox.wrappedInboxKey;
   const canary = await mintKeyringCanary(newKek);
   const authority = {
     user_id: options.userId,
@@ -659,8 +736,8 @@ async function grant(store, vault, callerKeyring, options) {
     ...options.exportCapability !== void 0 && { export_capability: options.exportCapability },
     ...options.importCapability !== void 0 && { import_capability: options.importCapability }
   };
-  const authorityWithDeks = { ...authority, deks: wrappedDeks };
-  const withEpoch = { ...authorityWithDeks, roster_epoch: nextRosterEpoch(previousGrantFound?.file.roster_epoch) };
+  const authorityWithDeks = { ...authority, deks: wrappedDeks, inbox_key: inbox.inboxKey };
+  const withEpoch = stampAuthority(authorityWithDeks, previousGrantFound?.file.roster_epoch);
   const keyringFile = {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
     ...withEpoch,
@@ -671,13 +748,13 @@ async function grant(store, vault, callerKeyring, options) {
     // propagation loop above, so they can verify this tag on first unlock.
     roster_tag: await mintRosterTag(withEpoch, callerRosterKey)
   };
-  await writeKeyringFile(store, vault, options.userId, keyringFile);
+  await writeKeyringFile(store, vault, options.userId, keyringFile, basisOf(previousGrantFound));
   if (previousDekNames !== null && options.userId !== callerKeyring.userId) {
     const dropped = [...previousDekNames].filter(
       (name) => !name.startsWith("_") && !(name in wrappedDeks)
     );
     if (dropped.length > 0) {
-      await rotateKeys(store, vault, callerKeyring, { collections: dropped });
+      await rotateKeys(store, vault, callerKeyring, { collections: dropped, exclude: [options.userId] });
     }
   }
   const userEnvelopeDek = callerKeyring.deks.get(USER_ENVELOPE_COLLECTION);
@@ -692,6 +769,12 @@ async function grant(store, vault, callerKeyring, options) {
     );
   }
 }
+var NON_ROTATABLE_SLOTS = /* @__PURE__ */ new Set([
+  ROSTER_KEY_ID,
+  BLOB_ADDRESS_KEY_ID,
+  INBOX_KEY_ID,
+  BROKER_MEMBER_COLLECTION
+]);
 async function findAdminDescendants(store, vault, rootUserId, rosterKey) {
   const allUserIds = await store.list(vault, "_keyring");
   const childrenByParent = /* @__PURE__ */ new Map();
@@ -725,8 +808,8 @@ async function revoke(store, vault, callerKeyring, options) {
   if (!targetFound) {
     const pending = [...callerKeyring.pendingDeks?.keys() ?? []];
     if (pending.length > 0) {
-      await rotateKeys(store, vault, callerKeyring, { collections: pending });
-      return;
+      const resumed = await rotateKeys(store, vault, callerKeyring, { collections: pending });
+      return { rewritten: resumed.rewritten };
     }
     throw new NoAccessError(`User "${options.userId}" has no keyring in vault "${vault}"`);
   }
@@ -764,18 +847,24 @@ async function revoke(store, vault, callerKeyring, options) {
     await deleteUserEnvelope(store, vault, userId);
     await deleteUserVisibility(store, vault, userId);
   }
-  affectedCollections.delete(ROSTER_KEY_ID);
-  affectedCollections.delete(BLOB_ADDRESS_KEY_ID);
+  for (const slot of NON_ROTATABLE_SLOTS) affectedCollections.delete(slot);
+  for (const slot of inboxSlots(targetKeyring)) affectedCollections.add(slot);
+  let rewritten = [];
   if (affectedCollections.size > 0) {
-    const { unverified } = await rotateKeys(store, vault, callerKeyring, {
-      collections: [...affectedCollections]
+    const rotation = await rotateKeys(store, vault, callerKeyring, {
+      collections: [...affectedCollections],
+      exclude: usersToRevoke
+      // core#100 / #1043 — never deliver to the member(s) being revoked
     });
+    const { unverified } = rotation;
+    rewritten = rotation.rewritten;
     if (unverified.length > 0) {
       console.warn(
-        `[noy-db] revoke(${options.userId}): ${unverified.length} member(s) were SKIPPED by the rotation because their keyring failed roster authentication: ${unverified.map((u) => `${u.userId} (${u.reason})`).join(", ")}. The revocation itself completed. Those members cannot open the vault and did not receive the rotated keys; their keyring files need repair or removal (noy-db#1114).`
+        `[noy-db] revoke(${options.userId}): ${unverified.length} member(s) were SKIPPED by the rotation because their keyring failed roster authentication: ${unverified.map((u) => `${u.userId} (${u.reason})`).join(", ")}. The revocation itself completed. Those members cannot open the vault and did not receive the rotated keys; their keyring files need repair or removal (vLannaAi/noy-db#1114).`
       );
     }
   }
+  return { rewritten };
 }
 async function readKeyringForAudit(store, vault, userId) {
   const envelope = await store.get(vault, "_keyring", userId);
@@ -853,8 +942,8 @@ async function quarantineKeyring(store, vault, callerKeyring, userId) {
   await store.delete(vault, "_keyring", userId);
   await deleteUserEnvelope(store, vault, userId);
   await deleteUserVisibility(store, vault, userId);
-  const rotated = [...callerKeyring.deks.keys()].filter((c) => c !== ROSTER_KEY_ID);
-  const result = rotated.length > 0 ? await rotateKeys(store, vault, callerKeyring, { collections: rotated }) : { needsRegrant: [], unverified: [] };
+  const rotated = [...callerKeyring.deks.keys()].filter((c) => !NON_ROTATABLE_SLOTS.has(c));
+  const result = rotated.length > 0 ? await rotateKeys(store, vault, callerKeyring, { collections: rotated, exclude: [userId] }) : { needsRegrant: [], unverified: [], rewritten: [] };
   return {
     userId,
     reason,
@@ -888,7 +977,7 @@ async function updateKeyringIdentity(store, vault, callerKeyring, options) {
       `Role "${callerKeyring.role}" cannot promote target to role "${options.role}"`
     );
   }
-  const edited = {
+  const header = {
     ...target,
     ...options.role !== void 0 && { role: options.role },
     ...options.displayName !== void 0 && {
@@ -897,9 +986,52 @@ async function updateKeyringIdentity(store, vault, callerKeyring, options) {
     },
     ...options.permissions !== void 0 && { permissions: options.permissions }
   };
-  const withEpoch = { ...edited, roster_epoch: nextRosterEpoch(target.roster_epoch) };
+  const roleChanged = header.role !== target.role;
+  const mayHoldSecrets = header.role === "owner" || header.role === "admin";
+  const permissions = resolvePermissions(header.role, header.permissions);
+  const minted = await mintMissingDeksForGrant(store, vault, callerKeyring, permissions, mayHoldSecrets);
+  if (minted) await persistKeyring(store, vault, callerKeyring);
+  const wanted = new Set(selectGranteeDekNames(header.role, header.permissions, permissions, callerKeyring.deks));
+  const held = target.deks;
+  const pending = new Set(inboxSlots(target));
+  const retains = (name) => {
+    if (name === INBOX_KEY_ID) return true;
+    if (name === BROKER_MEMBER_COLLECTION) return !mayHoldSecrets && !roleChanged;
+    if (wanted.has(name)) return true;
+    if (!name.startsWith("_")) return false;
+    return !(isSecretBearingReservedCollection(name) && !mayHoldSecrets);
+  };
+  const deks = {};
+  for (const [name, wrapped] of Object.entries(held)) if (retains(name)) deks[name] = wrapped;
+  const dropped = Object.keys(held).filter((name) => !name.startsWith("_") && !(name in deks));
+  const deliver = /* @__PURE__ */ new Map();
+  for (const name of wanted) {
+    if (name in deks || pending.has(name)) continue;
+    const dek = callerKeyring.deks.get(name);
+    if (!dek) throw new PrivilegeEscalationError(name);
+    deliver.set(name, dek);
+  }
+  for (const name of pending) if (!wanted.has(name) && !name.startsWith("_")) dropped.push(name);
+  let brokerMemberDek;
+  if (roleChanged && !mayHoldSecrets) {
+    brokerMemberDek = await generateDEK();
+    deliver.set(BROKER_MEMBER_COLLECTION, brokerMemberDek);
+  }
+  let inbox = target.inbox;
+  if (deliver.size > 0) {
+    if (target.inbox_key === void 0) throw new MemberInboxMissingError(options.userId);
+    inbox = [...target.inbox ?? [], await sealInbox(target.inbox_key, deliver)];
+  }
+  const { inbox: _previousInbox, ...carried } = header;
+  const edited = { ...carried, deks, ...inbox !== void 0 && inbox.length > 0 && { inbox } };
+  const withEpoch = stampAuthority(edited, target.roster_epoch);
   const next = { ...withEpoch, roster_tag: await mintRosterTag(withEpoch, rosterKey) };
-  await writeKeyringFile(store, vault, options.userId, next);
+  await writeKeyringFile(store, vault, options.userId, next, basisOf(found));
+  const rotate = [...new Set(dropped)].filter((name) => !name.startsWith("_"));
+  if (rotate.length > 0 && options.userId !== callerKeyring.userId) {
+    await rotateKeys(store, vault, callerKeyring, { collections: rotate, exclude: [options.userId] });
+  }
+  return { roleChanged, ...brokerMemberDek !== void 0 && { brokerMemberDek } };
 }
 var HISTORY_COLLECTION = "_history";
 var LEDGER_COLLECTION = "_ledger";
@@ -952,6 +1084,12 @@ async function rotateKeys(store, vault, callerKeyring, opts) {
       `rotateKeys: "${ROSTER_KEY_ID}" is the vault roster key, not a collection, and cannot be rotated \u2014 doing so would strip it from every other member and leave the vault unopenable. Remove it from \`collections\`.`
     );
   }
+  for (const name of [BROKER_MEMBER_COLLECTION, INBOX_KEY_ID]) {
+    if (collections.includes(name)) {
+      throw new ValidationError(`rotateKeys: "${name}" is a per-member key, not a collection, and cannot be rotated. Remove it from \`collections\`.`);
+    }
+  }
+  const rewritten = [];
   if (callerKeyring.role === "custodian") {
     throw new PermissionDeniedError(
       "custodian cannot rotate keys (FR-6: re-key is an owner-only meta-capability; use the Deed owner)"
@@ -977,6 +1115,12 @@ async function rotateKeys(store, vault, callerKeyring, opts) {
       for (const [name, dek] of callerKeyring.deks) if (name !== collName) others.push(dek);
       for (const [name, dek] of newDeks) if (name !== collName) others.push(dek);
       await rekeyBlobSet(store, vault, oldDek, newDek, others);
+      for (const blobColl of ["_blob_index", "_blob_chunks"]) {
+        for (const id of await store.list(vault, blobColl)) {
+          const env = await store.get(vault, blobColl, id);
+          if (env) rewritten.push({ collection: blobColl, id, version: env._v });
+        }
+      }
     }
     const { collection: baseColl } = parseDekKey(collName);
     const siblingSlotDeks = [];
@@ -999,7 +1143,10 @@ async function rotateKeys(store, vault, callerKeyring, opts) {
         }
         throw err;
       }
-      if (newEnvelope !== null) await store.put(vault, refColl, id, newEnvelope);
+      if (newEnvelope !== null) {
+        await store.put(vault, refColl, id, newEnvelope);
+        rewritten.push({ collection: refColl, id, version: newEnvelope._v });
+      }
     }
   }
   for (const [collName, newDek] of newDeks) {
@@ -1024,26 +1171,37 @@ async function rotateKeys(store, vault, callerKeyring, opts) {
     }
     const updatedDeks = { ...userKeyringFile.deks };
     const updatedPermissions = { ...userKeyringFile.permissions };
+    const deliver = /* @__PURE__ */ new Map();
+    const pendingSlots = new Set(inboxSlots(userKeyringFile));
     for (const collName of collections) {
+      const held = collName in updatedDeks || pendingSlots.has(collName);
+      if (held && userKeyringFile.inbox_key !== void 0 && !opts.exclude?.includes(userId)) {
+        deliver.set(collName, newDeks.get(collName));
+        delete updatedDeks[collName];
+        continue;
+      }
       if (collName in updatedDeks || collName in updatedPermissions) {
         needsRegrant.push({ userId, collection: collName });
       }
       delete updatedDeks[collName];
       delete updatedPermissions[collName];
     }
+    const inbox = deliver.size > 0 && userKeyringFile.inbox_key !== void 0 ? [...userKeyringFile.inbox ?? [], await sealInbox(userKeyringFile.inbox_key, deliver)] : userKeyringFile.inbox;
     const edited = {
       ...userKeyringFile,
       deks: updatedDeks,
-      permissions: updatedPermissions
+      permissions: updatedPermissions,
+      ...inbox !== void 0 && inbox.length > 0 ? { inbox } : {}
     };
-    const withEpoch = { ...edited, roster_epoch: nextRosterEpoch(userKeyringFile.roster_epoch) };
+    if (inbox === void 0 || inbox.length === 0) delete edited.inbox;
+    const withEpoch = stampAuthority(edited, userKeyringFile.roster_epoch);
     const updatedKeyring = {
       ...withEpoch,
       roster_tag: await mintRosterTag(withEpoch, callerRosterKey)
     };
-    await writeKeyringFile(store, vault, userId, updatedKeyring);
+    await writeKeyringFile(store, vault, userId, updatedKeyring, basisOf(userFound));
   }
-  return { needsRegrant, unverified };
+  return { needsRegrant, unverified, rewritten };
 }
 async function changeSecret(store, vault, keyring, opts) {
   const existingFound = await readKeyringFile(store, vault, keyring.userId);
@@ -1076,7 +1234,7 @@ async function changeSecret(store, vault, keyring, opts) {
     ...existingAuthority?.import_capability !== void 0 && { import_capability: existingAuthority.import_capability }
   };
   const authorityWithDeks = { ...authority, deks: wrappedDeks };
-  const withEpoch = { ...authorityWithDeks, roster_epoch: nextRosterEpoch(existingAuthority?.roster_epoch) };
+  const withEpoch = stampAuthority(authorityWithDeks, existingAuthority?.roster_epoch);
   const keyringFile = {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
     ...withEpoch,
@@ -1085,7 +1243,7 @@ async function changeSecret(store, vault, keyring, opts) {
     canary,
     roster_tag: await mintRosterTag(withEpoch, rosterKey)
   };
-  await writeKeyringFile(store, vault, keyring.userId, keyringFile);
+  await writeKeyringFile(store, vault, keyring.userId, keyringFile, basisOf(existingFound));
   return {
     userId: keyring.userId,
     displayName: keyring.displayName,
@@ -1151,7 +1309,7 @@ async function buildRecipientKeyringFile(callerKeyring, recipient) {
     ...recipient.expiresAt !== void 0 ? { expires_at: recipient.expiresAt } : {}
   };
   const authorityWithDeks = { ...authority, deks: wrappedDeks };
-  const withEpoch = { ...authorityWithDeks, roster_epoch: nextRosterEpoch(void 0) };
+  const withEpoch = stampAuthority(authorityWithDeks, void 0);
   return {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
     ...withEpoch,
@@ -1269,8 +1427,17 @@ async function ensureCollectionDEK(store, vault, keyring) {
       }
       const dek = await generateDEK();
       keyring.deks.set(collectionName, dek);
-      await persistKeyring(store, vault, keyring);
-      return dek;
+      for (let attempt = 0; ; attempt++) {
+        try {
+          await persistKeyring(store, vault, keyring);
+          return keyring.deks.get(collectionName) ?? dek;
+        } catch (err) {
+          if (!isConflictError(err)) throw err;
+          const winner = await reloadPersistedDEK(store, vault, keyring, collectionName);
+          if (winner) return winner;
+          if (attempt >= 5) throw err;
+        }
+      }
     })();
     inFlight.set(collectionName, promise);
     try {
@@ -1296,6 +1463,58 @@ function hasAccess(keyring, collectionName) {
   if (PERMISSION_WILDCARD in keyring.permissions) return true;
   return collectionName in keyring.permissions;
 }
+async function mintInboxKey(kek) {
+  const inboxKey = await generateDEK();
+  const pair = await generateRecipientKeyPair();
+  const pub = await exportRecipientPublicKeySpki(pair);
+  const priv = await exportRecipientPrivateKeyPkcs8(pair);
+  try {
+    const sealed = await encryptBytes(priv, inboxKey);
+    return { wrappedInboxKey: await wrapKey(inboxKey, kek), inboxKeyAes: inboxKey, inboxKey: { pub: bufferToBase64(pub), priv: sealed } };
+  } finally {
+    priv.fill(0);
+  }
+}
+function inboxSlots(file) {
+  return [...new Set((file.inbox ?? []).flatMap((box) => box.slots))];
+}
+async function sealInbox(inboxKey, deks) {
+  const pub = await importRecipientPublicKeySpki(base64ToBuffer(inboxKey.pub));
+  const cekBytes = globalThis.crypto.getRandomValues(new Uint8Array(32));
+  try {
+    const cek = await importTransferKey(cekBytes);
+    const payload = new TextEncoder().encode(JSON.stringify(await exportDekSet(deks)));
+    const { iv, data } = await encryptBytes(payload, cek);
+    const wrapped = await recipientWrap(pub, cekBytes);
+    return { slots: [...deks.keys()].sort(), cek: bufferToBase64(wrapped), iv, data };
+  } finally {
+    cekBytes.fill(0);
+  }
+}
+async function openInboxKeyPair(inboxKey, inboxKeyAes) {
+  const priv = await decryptBytes(inboxKey.priv.iv, inboxKey.priv.data, inboxKeyAes);
+  try {
+    return await importRecipientKeyPair(priv, base64ToBuffer(inboxKey.pub));
+  } finally {
+    priv.fill(0);
+  }
+}
+async function openInbox(file, inboxKeyAes) {
+  const out = /* @__PURE__ */ new Map();
+  if (!file.inbox || file.inbox.length === 0 || !file.inbox_key) return out;
+  const pair = await openInboxKeyPair(file.inbox_key, inboxKeyAes);
+  for (const box of file.inbox) {
+    const cekBytes = await recipientUnwrap(pair, base64ToBuffer(box.cek));
+    try {
+      const cek = await importTransferKey(cekBytes);
+      const payload = await decryptBytes(box.iv, box.data, cek);
+      for (const [name, dek] of await importDekSet(JSON.parse(new TextDecoder().decode(payload)))) out.set(name, dek);
+    } finally {
+      cekBytes.fill(0);
+    }
+  }
+  return out;
+}
 async function persistKeyring(store, vault, keyring) {
   if (!keyring.kek) {
     throw new ValidationError(
@@ -1309,6 +1528,9 @@ async function persistKeyring(store, vault, keyring) {
   const existingGrantedBy = existingFound?.file.granted_by;
   const existingCreatedAt = existingFound?.file.created_at;
   const existingExpiresAt = existingFound?.file.expires_at;
+  const existingInboxKey = existingFound?.file.inbox_key;
+  const existingInbox = existingFound?.file.inbox;
+  const undrainedInbox = existingInbox !== void 0 && existingInbox.length > 0 && !inboxSlots({ inbox: existingInbox }).every((slot) => keyring.deks.has(slot));
   const wrappedDeks = {};
   for (const [collName, dek] of keyring.deks) {
     wrappedDeks[collName] = await wrapKey(dek, keyring.kek);
@@ -1331,9 +1553,13 @@ async function persistKeyring(store, vault, keyring) {
   const authorityWithDeks = {
     ...authority,
     deks: wrappedDeks,
-    ...Object.keys(wrappedPending).length > 0 ? { pending_deks: wrappedPending } : {}
+    ...Object.keys(wrappedPending).length > 0 ? { pending_deks: wrappedPending } : {},
+    // core#96 — both tag-bound (`inbox_pub`, `inbox_slots`), so they must be
+    // in the object the tag is minted from, not spread in afterwards.
+    ...existingInboxKey !== void 0 && { inbox_key: existingInboxKey },
+    ...undrainedInbox && existingInbox !== void 0 && { inbox: existingInbox }
   };
-  const withEpoch = { ...authorityWithDeks, roster_epoch: nextRosterEpoch(existingFound?.file.roster_epoch) };
+  const withEpoch = stampAuthority(authorityWithDeks, existingFound?.file.roster_epoch);
   const keyringFile = {
     _noydb_keyring: NOYDB_KEYRING_VERSION,
     ...withEpoch,
@@ -1345,7 +1571,7 @@ async function persistKeyring(store, vault, keyring) {
     ...keyring.policy !== void 0 && { policy: keyring.policy },
     ...existingEcho !== void 0 && { echo: existingEcho }
   };
-  await writeKeyringFile(store, vault, keyring.userId, keyringFile);
+  await writeKeyringFile(store, vault, keyring.userId, keyringFile, basisOf(existingFound));
 }
 function defaultBundleCapability(role) {
   return role === "owner" || role === "admin";
@@ -1384,17 +1610,19 @@ function resolvePermissions(role, explicit) {
   if (role === "owner" || role === "admin" || role === "custodian" || role === "viewer") return {};
   return explicit ?? {};
 }
-async function writeKeyringFile(store, vault, userId, keyringFile) {
+var basisOf = (found) => found ? { on: found.envelope } : "create";
+async function writeKeyringFile(store, vault, userId, keyringFile, basis) {
   if (keyringFile.roster_epoch === void 0) {
     throw new Error(
       `writeKeyringFile: refusing to write a keyring for "${userId}" with no roster_epoch (#1097). Stamp it with nextRosterEpoch(previous) onto the authority object BEFORE minting the roster tag, so it is covered by rosterCanonical.`
     );
   }
+  const base = basis === "create" ? 0 : basis.on._v;
   const envelope = buildRecordEnvelope(
-    { collection: "_keyring", id: userId, version: 1 },
+    { collection: "_keyring", id: userId, version: base + 1 },
     { iv: "", data: JSON.stringify(keyringFile) }
   );
-  await store.put(vault, "_keyring", userId, envelope);
+  await store.put(vault, "_keyring", userId, envelope, basis === "create" ? void 0 : base);
 }
 
 export {
@@ -1403,6 +1631,7 @@ export {
   mintRosterTag,
   assertRosterAuthenticated,
   assertRosterTagValid,
+  stampAuthority,
   WeakSecretError,
   validateSecret,
   assertStrongSecret,
@@ -1417,16 +1646,19 @@ export {
   verifyTypedEcho,
   SYNC_CREDENTIALS_COLLECTION,
   BROKER_COLLECTION,
+  BROKER_MEMBER_COLLECTION,
   isSecretBearingReservedCollection,
   mintKeyringCanary,
   requireRosterKey,
   deriveKekForKeyring,
+  parseKeyringEnvelope,
   readKeyringFile,
   assertKeyringNotExpired,
   loadKeyring,
   assertKeyringOpenAllowed,
   createOwnerKeyring,
   grant,
+  NON_ROTATABLE_SLOTS,
   revoke,
   verifyRoster,
   quarantineKeyring,
@@ -1439,10 +1671,15 @@ export {
   ensureCollectionDEK,
   hasWritePermission,
   hasAccess,
+  mintInboxKey,
+  inboxSlots,
+  openInboxKeyPair,
   persistKeyring,
   hasExportCapability,
   evaluateExportCapability,
   hasImportCapability,
-  evaluateImportCapability
+  evaluateImportCapability,
+  basisOf,
+  writeKeyringFile
 };
-//# sourceMappingURL=chunk-XSPFDUDG.js.map
+//# sourceMappingURL=chunk-V7AKGAXY.js.map