playlists: merge rules, sealing, and the key

playlist-merge.js and playlist-crypto.js have no imports and are run by
their tests, which is the only real evidence this feature can have.

Two revision counters per playlist, not one: a rename on one device and
a track added on another both write n+1, and a single counter makes two
edits that do not overlap collide.

One Argon2 run at sign-in, two handles. The AES handle is imported
non-extractably, so nothing can be derived from it — hence a second
import of the same bytes as HKDF rather than a derivation.

Measured: ~270 bytes a track, deflate worth 4.5x on realistic data, so
the 1 MB body cap holds about 17000 tracks.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 1 insertions, 1 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/group-page.js b/packages/meshbay-hub/src/meshbay_hub/static/group-page.js
index 060fd6e..205fce2 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/group-page.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/group-page.js
@@ -242,7 +242,7 @@ function GroupPage({ groupId, group, token, username, userId, userPrefs,
       // that opens node bundles is missing here. Persisted so this browser is
       // set up from now on.
       session.bundleKey = {
-        v2: await window.MeshBayKeys.deriveEncryptionKey(pass, username),
+        ...(await window.MeshBayKeys.bundleKeyPairFields(pass, username)),
         v1: await window.MeshBayKeys.deriveEncryptionKeyV1(pass, username),
       };
       await _storeBundleKey(session.bundleKey);