1 files changed, 5 insertions, 5 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
index edfa109..879f56f 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
@@ -191,7 +191,7 @@ async function deriveBundleKeys(password, username) {
 
 // ── Account recovery key ─────────────────────────────────────────────────────
 //
-// docs/auth-confirm.md §4.3. A full-entropy secret the user keeps outside the
+// docs/MESHBAY_DESIGN.md §3.6. A full-entropy secret the user keeps outside the
 // passphrase — in their password manager, or (step 3) e-mailed to them. It
 // wraps a *second* copy of every per-node identity bundle, so a forgotten
 // passphrase does not strand the account's group identities.
@@ -323,7 +323,7 @@ async function registerUser(username, email, password, recoveryMnemonic, captcha
   const payload = { username, email, auth_key: authKey };
   // The recovery mnemonic, when the user opted to have it e-mailed: the hub
   // appends it to the verification e-mail and stores it nowhere
-  // (docs/auth-confirm.md §4.4). Omitted when they chose to save it themselves.
+  // (docs/MESHBAY_DESIGN.md §3.6). Omitted when they chose to save it themselves.
   if (recoveryMnemonic) payload.recovery_key = recoveryMnemonic;
   // reCAPTCHA response, when the hub has a captcha configured. The widget lives
   // in RegisterPage (auth-page.js); this function just forwards its token. A
@@ -347,7 +347,7 @@ async function registerUser(username, email, password, recoveryMnemonic, captcha
  * bundle goes to that node and nowhere else, and is what any other browser
  * fetches to become the same person there. When `recoveryKey` is supplied a
  * second copy wrapped under it rides along, so a forgotten passphrase does not
- * strand this identity (docs/auth-confirm.md §4.3).
+ * strand this identity (docs/MESHBAY_DESIGN.md §3.6).
  */
 async function generateNodeIdentity(bundleKey, recoveryKey) {
   const { skEdRaw, pkEdRaw, skXRaw, pkXRaw } = await generateKeypairs();
@@ -465,7 +465,7 @@ async function _bundleKeyPairFields(password, username) {
 window.MeshBayKeys = {
   registerUser, loginAndRecover, generateNodeIdentity, generateKeypairs, signBytes,
   deriveAuthKey, decryptBundleWithKey, encryptBundleWithKey, bundleVersion,
-  // Exposed for the passphrase change (docs/auth-confirm.md §3): re-wrapping a
+  // Exposed for the passphrase change (docs/MESHBAY_DESIGN.md §3.6): re-wrapping a
   // node's identity bundle needs the old key (a {v2,v1} pair, since an old
   // bundle may be v1) to read it and the new v2 key to write it back.
   deriveEncryptionKey, deriveEncryptionKeyV1,
@@ -473,6 +473,6 @@ window.MeshBayKeys = {
   // `session.bundleKey` uses this, so `v2hkdf` is never the field one sign-in
   // path forgot (docs/playlists.md §3.4).
   deriveBundleKeys, bundleKeyPairFields: _bundleKeyPairFields,
-  // Account recovery key (docs/auth-confirm.md §4.3).
+  // Account recovery key (docs/MESHBAY_DESIGN.md §3.6).
   generateRecoveryKey, deriveRecoveryKey,
 };