feat: bundles sealed per node under the passphrase and the hub's pepper

The session key is M = HKDF(Argon2(passphrase) || pepper, account id); each
node's bundle key and the playlist key derive from it. Bundles are MBK3, bound
to account and node; MBK1/MBK2 are refused by name, never replaced silently.
Playlists move to key v2 and are re-sealed over unreadable node copies.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 17 insertions, 24 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport-rewrap.js b/packages/meshbay-hub/src/meshbay_hub/static/transport-rewrap.js
index 18ad9d4..a9229dc 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport-rewrap.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport-rewrap.js
@@ -43,8 +43,11 @@ function _acWithTimeout(promise, ms, label) {
  * @param {string} o.token         a fresh access token
  * @param {string} o.username
  * @param {string} o.userId
- * @param {string} [o.oldPassphrase]  omit in Flow B — connect falls back to the recovery copy
- * @param {string} o.newPassphrase
+ * @param {object} o.bundleKey      the session key that opens the bundles as they are
+ *                                  (keyderive.js `deriveBundleSessionKey`). In Flow B it
+ *                                  opens nothing and connect falls back to the recovery copy.
+ * @param {object} [o.newBundleKey] the key to seal them under; defaults to `bundleKey`
+ *                                  (the Profile backfill: same key, a recovery copy added)
  * @param {string} [o.recoveryKey]   the recovery mnemonic (Flow B,
  *                                   docs/MESHBAY_DESIGN.md §3.6).
  *                                   When given, the recovery-wrapped copy is read where the
@@ -54,28 +57,14 @@ function _acWithTimeout(promise, ms, label) {
  */
 async function rewrapAllNodes(o) {
   const K = window.MeshBayKeys;
-  if (!K || !K.deriveEncryptionKey) {
+  if (!K || !K.encryptBundle) {
     throw new Error('key module unavailable');
   }
-  let oldKey, newKey;
-  if (o.bundleKey) {
-    // "Keep the current passphrase key, just add / refresh the recovery copy"
-    // — the Profile backfill (docs/MESHBAY_DESIGN.md §3.6). `o.bundleKey` is the
-    // live {v2,v1} session key, so no passphrase is needed.
-    oldKey = newKey = o.bundleKey;
-  } else {
-    // Flow B has no old passphrase; connect will fail the passphrase decrypt and
-    // fall back to the recovery copy, so a placeholder key is fine for `oldKey`.
-    const oldPass = o.oldPassphrase || o.newPassphrase;
-    oldKey = {
-      v2: await K.deriveEncryptionKey(oldPass, o.username),
-      v1: await K.deriveEncryptionKeyV1(oldPass, o.username),
-    };
-    newKey = {
-      v2: await K.deriveEncryptionKey(o.newPassphrase, o.username),
-      v1: await K.deriveEncryptionKeyV1(o.newPassphrase, o.username),
-    };
-  }
+  if (!o.bundleKey) throw new Error('no bundle key in this session');
+  // Keys, never passphrases: each caller has derived them already, with the
+  // pepper only the hub holds (docs/MESHBAY_DESIGN.md §3.7).
+  const oldKey = o.bundleKey;
+  const newKey = o.newBundleKey || o.bundleKey;
   const recoveryKey = o.recoveryKey
     ? await K.deriveRecoveryKey(o.recoveryKey, o.username)
     : null;
@@ -125,11 +114,15 @@ async function rewrapAllNodes(o) {
         if (!sk) { lastErr = new Error('identity not recovered'); continue; }
         const skEd = Uint8Array.from(atob(sk.skEdB64), c => c.charCodeAt(0));
         const skX = Uint8Array.from(atob(sk.skXB64), c => c.charCodeAt(0));
-        const reEnc = await K.encryptBundleWithKey(skEd, skX, newKey.v2);
+        // Sealed for this account on the node just connected to — the key
+        // that node proved during the handshake.
+        const sealedFor = { userId: o.userId, nodePk: tp.nodePk };
+        const reEnc = await K.encryptBundle(skEd, skX, await K.nodeBundleKey(newKey, tp.nodePk),
+                                            { ...sealedFor, pepperVersion: newKey.pepperVersion });
         // In Flow B, refresh the recovery copy too (same R) so the node's
         // passphrase copy and recovery copy stay in step.
         const reRecovery = recoveryKey
-          ? await K.encryptBundleWithKey(skEd, skX, recoveryKey)
+          ? await K.encryptBundle(skEd, skX, recoveryKey, { ...sealedFor, pepperVersion: 0 })
           : null;
         await tp.storeKeypairBundle(reEnc, reRecovery);
         anyOk = true;