fix: an MBK2 bundle is opened once and stored again as MBK3

Transitional. The Argon2 run that makes M makes A, the key MBK2 bundles were
sealed under; a session keeps it as a decrypt-only key (IndexedDB in a browser,
the key storage in the desktop app). A client meeting an MBK2 bundle opens it —
or its recovery copy — and stores the same identity as MBK3 once connected; the
desktop app reseals or withdraws it as browser access says. A session without
A asks for the passphrase once. Older formats stay refused by name. Replaces
the unpin-and-reinvite step the 0.17 flag day required on every node.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 48 insertions, 3 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
index b1770a7..7bbcac5 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
@@ -161,6 +161,12 @@ async function deriveBundleSessionKey(password, username, userId, pepperB64, pep
     // HKDF keys are non-extractable by specification.
     v3: await crypto.subtle.importKey('raw', m, 'HKDF', false, ['deriveKey', 'deriveBits']),
     pepperVersion: pepperVersion || 1,
+    // TRANSITIONAL — the key MBK2 bundles were sealed under, which this same
+    // Argon2 run produces anyway. Kept for the session so a node still holding
+    // one has it opened and replaced by MBK3 on the account's next visit,
+    // rather than the member being re-invited. Decrypt only; nothing is sealed
+    // under it. Remove once no MBK2 bundle is left on any node.
+    legacy: await crypto.subtle.importKey('raw', a, { name: 'AES-GCM' }, false, ['decrypt']),
   };
 }
 
@@ -321,13 +327,52 @@ async function encryptBundle(skEdRaw, skXRaw, aesKey, { userId, nodePk, pepperVe
   return btoa(String.fromCharCode(...out));
 }
 
-/** 'current', or 'retired' for anything written before MBK3. */
+// TRANSITIONAL — the format before MBK3: "MBK2" ‖ nonce (12) ‖ AES-GCM under
+// the passphrase's Argon2 key alone, no associated data. Read once to be
+// replaced; never written.
+const LEGACY_MAGIC = 'MBK2';
+
+/**
+ * 'current'; 'legacy' for MBK2, opened once with the session's legacy key and
+ * replaced; 'retired' for anything older, which is not read at all.
+ */
 function bundleFormat(bundleB64) {
   try {
-    return atob(bundleB64).startsWith(BUNDLE_MAGIC) ? 'current' : 'retired';
+    const head = atob(bundleB64).slice(0, 4);
+    if (head === BUNDLE_MAGIC) return 'current';
+    return head === LEGACY_MAGIC ? 'legacy' : 'retired';
   } catch { return 'retired'; }
 }
 
+/** TRANSITIONAL — open an MBK2 bundle (passphrase or recovery copy). */
+async function decryptLegacyBundle(bundleB64, aesKey) {
+  if (bundleFormat(bundleB64) !== 'legacy') throw new Error('not an MBK2 bundle');
+  const raw = _b64bytes(bundleB64);
+  const off = LEGACY_MAGIC.length;
+  const plain = await crypto.subtle.decrypt(
+    { name: 'AES-GCM', iv: raw.slice(off, off + 12) }, aesKey, raw.slice(off + 12));
+  return JSON.parse(new TextDecoder().decode(plain));
+}
+
+/**
+ * TRANSITIONAL — an identity read from an MBK2 bundle, sealed again as MBK3
+ * for the same node (and the recovery copy too, when a recovery key is in
+ * hand), for the caller to store in place of the old one.
+ */
+async function resealLegacyIdentity(keys, sessionKey, recoveryKey, { userId, nodePk }) {
+  const skEd = _b64bytes(keys.skEd);
+  const skX = _b64bytes(keys.skX);
+  const out = {
+    bundleEnc: await encryptBundle(skEd, skX, await nodeBundleKey(sessionKey, nodePk),
+                                   { userId, nodePk, pepperVersion: sessionKey.pepperVersion }),
+  };
+  if (recoveryKey) {
+    out.bundleEncRecovery = await encryptBundle(skEd, skX, recoveryKey,
+                                                { userId, nodePk, pepperVersion: 0 });
+  }
+  return out;
+}
+
 // ── Registration ──────────────────────────────────────────────────────────────
 
 /**
@@ -516,7 +561,7 @@ window.MeshBayKeys = {
   // The bundle key (docs/MESHBAY_DESIGN.md §3.1, §3.7): one session key per
   // sign-in, one derived key per node, one format.
   deriveBundleSessionKey, sessionBundleKey, nodeBundleKey, fetchBundlePepper,
-  encryptBundle, decryptBundle, bundleFormat,
+  encryptBundle, decryptBundle, bundleFormat, decryptLegacyBundle, resealLegacyIdentity,
   // Account recovery key (docs/MESHBAY_DESIGN.md §3.6).
   generateRecoveryKey, deriveRecoveryKey,
 };