@kubun/plugin-p2p 0.10.1 → 0.12.0

package/lib/groups/catalog-token.d.ts

@@ -0,0 +1,50 @@
+import { type OwnIdentity } from '@kokuin/token';
+import type { CatalogRecord } from '@kubun/protocol';
+type SetPayload = {
+    op: 'set';
+    catalog: CatalogRecord;
+};
+type UpdatePayload = {
+    op: 'update';
+    catalogID: string;
+    update: {
+        name?: string;
+        description?: string;
+        filterCriteria?: CatalogRecord['filterCriteria'];
+    };
+    hlc: string;
+};
+type RemovePayload = {
+    op: 'remove';
+    catalogID: string;
+    hlc: string;
+};
+/**
+ * The verified claim behind a catalog control broadcast. `issuer` is the
+ * authenticated author (the verified token `iss`). Every authoritative field
+ * comes from the signed payload, so a receiver never trusts the surrounding
+ * plaintext frame. Sender-bound: the receiver applies a set only when the
+ * catalog's `ownerDID` equals this issuer, and an update/remove only when the
+ * locally-stored catalog is owned by this issuer.
+ */
+export type VerifiedCatalog = {
+    issuer: string;
+    claim: SetPayload;
+} | {
+    issuer: string;
+    claim: UpdatePayload;
+} | {
+    issuer: string;
+    claim: RemovePayload;
+};
+export declare function signCatalogSet(identity: OwnIdentity, catalog: CatalogRecord): Promise<string>;
+export declare function signCatalogUpdate(identity: OwnIdentity, claim: Omit<UpdatePayload, 'op'>): Promise<string>;
+export declare function signCatalogRemove(identity: OwnIdentity, claim: Omit<RemovePayload, 'op'>): Promise<string>;
+/**
+ * Verify a signed catalog token and extract its claim. Returns `null` (never
+ * throws) when the token is unparseable, unsigned (`alg: 'none'`), or
+ * structurally malformed — an attacker cannot forge an `iss` this way. The
+ * issuer is the normalized verified `iss`.
+ */
+export declare function verifyCatalog(token: string): Promise<VerifiedCatalog | null>;
+export {};

package/lib/groups/catalog-token.js

@@ -0,0 +1,96 @@
+import { isVerifiedToken, normalizeDID, stringifyToken, verifyToken } from '@kokuin/token';
+export async function signCatalogSet(identity, catalog) {
+    const signed = await identity.signToken({
+        op: 'set',
+        catalog
+    }, {
+        embedLongForm: true
+    });
+    return stringifyToken(signed);
+}
+export async function signCatalogUpdate(identity, claim) {
+    const signed = await identity.signToken({
+        op: 'update',
+        ...claim
+    }, {
+        embedLongForm: true
+    });
+    return stringifyToken(signed);
+}
+export async function signCatalogRemove(identity, claim) {
+    const signed = await identity.signToken({
+        op: 'remove',
+        ...claim
+    }, {
+        embedLongForm: true
+    });
+    return stringifyToken(signed);
+}
+function isCatalogRecord(value) {
+    if (value == null || typeof value !== 'object') {
+        return false;
+    }
+    const record = value;
+    return typeof record.id === 'string' && typeof record.ownerDID === 'string' && typeof record.name === 'string' && typeof record.hlc === 'string';
+}
+/**
+ * Verify a signed catalog token and extract its claim. Returns `null` (never
+ * throws) when the token is unparseable, unsigned (`alg: 'none'`), or
+ * structurally malformed — an attacker cannot forge an `iss` this way. The
+ * issuer is the normalized verified `iss`.
+ */ export async function verifyCatalog(token) {
+    let verified;
+    try {
+        verified = await verifyToken(token);
+    } catch  {
+        return null;
+    }
+    if (!isVerifiedToken(verified)) {
+        return null;
+    }
+    const { iss, op } = verified.payload;
+    const issuer = normalizeDID(iss);
+    if (op === 'set') {
+        const { catalog } = verified.payload;
+        if (!isCatalogRecord(catalog)) {
+            return null;
+        }
+        return {
+            issuer,
+            claim: {
+                op: 'set',
+                catalog
+            }
+        };
+    }
+    if (op === 'update') {
+        const { catalogID, update, hlc } = verified.payload;
+        if (typeof catalogID !== 'string' || typeof hlc !== 'string' || update == null) {
+            return null;
+        }
+        return {
+            issuer,
+            claim: {
+                op: 'update',
+                catalogID,
+                update: update,
+                hlc
+            }
+        };
+    }
+    if (op === 'remove') {
+        const { catalogID, hlc } = verified.payload;
+        if (typeof catalogID !== 'string' || typeof hlc !== 'string') {
+            return null;
+        }
+        return {
+            issuer,
+            claim: {
+                op: 'remove',
+                catalogID,
+                hlc
+            }
+        };
+    }
+    return null;
+}

package/lib/groups/circle-projection.d.ts

@@ -0,0 +1,90 @@
+import type { Logger } from '@kubun/logger';
+import type { P2PStoreAPI } from '@kubun/store-p2p';
+import type { GroupAnchor, LedgerLogEntry } from '@kumiai/mls';
+import { type CircleDefValue, type CircleMemberValue, type GroupSettingsValue, type IsAdminAtPosition } from './circle-reducers.js';
+import { type PositionedFoldInput } from './ledger.js';
+export declare const selectCircleMemberEntries: (ledger: ReadonlyArray<LedgerLogEntry>) => PositionedFoldInput<CircleMemberValue>[];
+/**
+ * One projected circle row as the fold decides it. `hlc` is the winning active
+ * entry's HLC (the row's `hlc` column); `removedAtHLC` is the winning tombstone
+ * HLC, or null when the circle is active. A removed circle retains its last
+ * active definition so the tombstone row carries real columns — mirroring the
+ * LWW store where `markCircleRemoved` only sets `removed_at_hlc` and leaves the
+ * name/description intact.
+ */
+export type CircleDefProjectionRow = {
+    name: string;
+    description: string;
+    catalogIDs: Array<string>;
+    hlc: string;
+    removedAtHLC: string | null;
+};
+/**
+ * Fold the circle-definition ledger into a per-circle projection covering ALL
+ * subjects, active and removed — the active reducer drops removed circles, but a
+ * projection must keep a tombstone row for them. Replays in the ledger's own
+ * enactment order under the same admin-authority gate as the reducer: an active entry sets the
+ * definition and clears any tombstone (re-add), a tombstone marks the row
+ * removed while keeping its last active value. A circle whose only entry is a
+ * tombstone (no prior active value) produces no row, matching the LWW store's
+ * ignore-if-absent removal.
+ */
+export declare function projectCircleDefs(entries: Array<PositionedFoldInput<CircleDefValue>>, isAdmin: IsAdminAtPosition): Map<string, CircleDefProjectionRow>;
+/** One projected circle-member row, keyed by the composite ledger subject. */
+export type CircleMemberProjectionRow = {
+    circleID: string;
+    memberDID: string;
+    role: string;
+    hlc: string;
+    removedAtHLC: string | null;
+};
+/**
+ * Fold the circle-member ledger into a per-subject projection covering ALL
+ * subjects, active and removed. Same structure as {@link projectCircleDefs}: an
+ * active entry sets the role and clears any tombstone, a tombstone marks the row
+ * removed while keeping its last active role. A malformed subject is skipped, as
+ * is a tombstone with no prior active value. Gates each entry on the same
+ * admin-authority check as the reducer's fold — an entry from a non-admin issuer
+ * never projects.
+ */
+export declare function projectCircleMembers(entries: Array<PositionedFoldInput<CircleMemberValue>>, isAdmin: IsAdminAtPosition): Map<string, CircleMemberProjectionRow>;
+/**
+ * Rebuild a circle/settings projection from the whole ledger.
+ *
+ * The only projection path there is: an entry is judged against the ledger prefix
+ * through its own slot, so folding the whole log is the same answer as folding it
+ * incrementally, and there is no cached-projection-is-stale case to detect.
+ * Authority is the admin fold (`adminAuthorityFromEntries`), so every projection
+ * honors one gate. Each `reconcile*` write is unconditional, so the row converges
+ * to exactly the fold's decision regardless of prior contents.
+ */
+export type ReprojectCircleParams = {
+    store: P2PStoreAPI;
+    groupID: string;
+    anchor: GroupAnchor;
+    /**
+     * The group's control ledger, in the handle's enactment order. Passed in rather
+     * than read: these projections run where the handle is already open, and every
+     * entry they fold is one the handle verified on the way in.
+     */
+    ledger: ReadonlyArray<LedgerLogEntry>;
+    logger?: Logger;
+};
+export declare function reprojectCircleDefs(params: ReprojectCircleParams): Promise<void>;
+export declare function reprojectCircleMembers(params: ReprojectCircleParams): Promise<void>;
+/**
+ * Reproject group settings onto the group row. Settings are PARTIAL per-field
+ * (no tombstone), so the committed reducer's active map IS the full projection:
+ * fold it under the admin gate, then write the merged fields via the
+ * unconditional `updateGroup`. A field no entry ever set stays at the group's
+ * original value (creation-time name/description).
+ */
+/**
+ * Fold the group's settings ledger under the admin gate and return the merged
+ * per-field value, or `undefined` when no authorized settings entry has been
+ * folded. This is the same fold {@link reprojectGroupSettings} materializes,
+ * exposed so a producer can read the CURRENT folded designation before authoring
+ * — what a device projects and what it checks before writing cannot then drift.
+ */
+export declare function foldGroupSettings(ledger: ReadonlyArray<LedgerLogEntry>, groupID: string, anchor: GroupAnchor): GroupSettingsValue | undefined;
+export declare function reprojectGroupSettings(params: ReprojectCircleParams): Promise<void>;

package/lib/groups/circle-projection.js

@@ -0,0 +1,202 @@
+import { selectRoleEntries } from './admin-roster.js';
+import { adminAuthorityFromEntries, authorizedEntries, CIRCLE_DEF_ENTRY_TYPE, CIRCLE_MEMBER_ENTRY_TYPE, createGroupSettingsReducer, decodeCircleMemberSubject, GROUP_SETTINGS_ENTRY_TYPE } from './circle-reducers.js';
+import { entryOrd, foldLedgerEntries } from './ledger.js';
+function isRemovedDef(value) {
+    return 'removed' in value && value.removed === true;
+}
+function isRemovedMember(value) {
+    return 'removed' in value && value.removed === true;
+}
+/**
+ * Build a selector for one ledger type, carrying each entry's slot in the WHOLE
+ * ledger so its authority can be judged against the prefix that precedes it.
+ *
+ * Entries come from the handle's own log, and every door into it verifies —
+ * `GroupHandle.applyLedgerEntries`, `bootstrapLedger` and an accepted commit
+ * each re-verify the tokens they admit — so these are pure filters over an
+ * in-memory array: no re-verification, and nothing to memoize. They replaced
+ * loaders that re-verified every stored `signed_token` on each call, which was
+ * needed only because the SQL row they read could not vouch for itself.
+ *
+ * Selecting by `type` is what licenses the cast: the log is typed over an unknown
+ * claim value, and the type is the claim about what that value is.
+ */ function createEntrySelector(entryType) {
+    return (ledger)=>{
+        const entries = [];
+        for (const [position, held] of ledger.entries()){
+            if (held.verified.entry.type !== entryType) {
+                continue;
+            }
+            entries.push({
+                verified: held.verified,
+                entryID: held.entryID,
+                position
+            });
+        }
+        return entries;
+    };
+}
+const selectCircleDefEntries = createEntrySelector(CIRCLE_DEF_ENTRY_TYPE);
+export const selectCircleMemberEntries = createEntrySelector(CIRCLE_MEMBER_ENTRY_TYPE);
+const selectGroupSettingsEntries = createEntrySelector(GROUP_SETTINGS_ENTRY_TYPE);
+/**
+ * Fold the circle-definition ledger into a per-circle projection covering ALL
+ * subjects, active and removed — the active reducer drops removed circles, but a
+ * projection must keep a tombstone row for them. Replays in the ledger's own
+ * enactment order under the same admin-authority gate as the reducer: an active entry sets the
+ * definition and clears any tombstone (re-add), a tombstone marks the row
+ * removed while keeping its last active value. A circle whose only entry is a
+ * tombstone (no prior active value) produces no row, matching the LWW store's
+ * ignore-if-absent removal.
+ */ export function projectCircleDefs(entries, isAdmin) {
+    const rows = new Map();
+    for (const { verified } of authorizedEntries(entries, isAdmin)){
+        const { subject, value } = verified.entry;
+        const hlc = entryOrd(verified.entry);
+        // Kubun stamps `ord` on every circle entry it signs; one without is foreign
+        // or malformed. Skipping is fail-closed — projecting it would have to invent
+        // an HLC, and on a tombstone a `null` `removed_at_hlc` reads as ACTIVE and
+        // silently revives the row.
+        if (hlc == null) continue;
+        if (isRemovedDef(value)) {
+            const existing = rows.get(subject);
+            if (existing == null) continue;
+            rows.set(subject, {
+                ...existing,
+                removedAtHLC: hlc
+            });
+        } else {
+            rows.set(subject, {
+                name: value.name,
+                description: value.description,
+                catalogIDs: value.catalogIDs,
+                hlc,
+                removedAtHLC: null
+            });
+        }
+    }
+    return rows;
+}
+/**
+ * Fold the circle-member ledger into a per-subject projection covering ALL
+ * subjects, active and removed. Same structure as {@link projectCircleDefs}: an
+ * active entry sets the role and clears any tombstone, a tombstone marks the row
+ * removed while keeping its last active role. A malformed subject is skipped, as
+ * is a tombstone with no prior active value. Gates each entry on the same
+ * admin-authority check as the reducer's fold — an entry from a non-admin issuer
+ * never projects.
+ */ export function projectCircleMembers(entries, isAdmin) {
+    const rows = new Map();
+    for (const { verified } of authorizedEntries(entries, isAdmin)){
+        const { subject, value } = verified.entry;
+        const hlc = entryOrd(verified.entry);
+        // See {@link projectCircleDefs}: no `ord` means foreign or malformed, and a
+        // null tombstone HLC would read as active.
+        if (hlc == null) continue;
+        if (isRemovedMember(value)) {
+            const existing = rows.get(subject);
+            if (existing == null) continue;
+            rows.set(subject, {
+                ...existing,
+                removedAtHLC: hlc
+            });
+        } else {
+            const decoded = decodeCircleMemberSubject(subject);
+            if (decoded == null) continue;
+            rows.set(subject, {
+                circleID: decoded.circleID,
+                memberDID: decoded.memberDID,
+                role: value.role,
+                hlc,
+                removedAtHLC: null
+            });
+        }
+    }
+    return rows;
+}
+function adminAuthorityFor(params) {
+    return adminAuthorityFromEntries(selectRoleEntries(params.ledger), params.anchor, params.groupID);
+}
+/**
+ * The group's CURRENT open-circle set, folded from the settings ledger under the
+ * supplied admin authority. `open` is a derived cache of this set on each circle
+ * row, so both the settings→circles and circles←settings reprojection paths
+ * derive it from the one authoritative fold and converge regardless of which
+ * entry (the `circle.def` or the `group.settings` opening it) arrives first.
+ */ function foldOpenCircleIDs(ledger, groupID, anchor, isAdmin) {
+    const entries = selectGroupSettingsEntries(ledger);
+    const { settings } = foldLedgerEntries(authorizedEntries(entries, isAdmin), anchor, createGroupSettingsReducer());
+    return new Set(settings.get(groupID)?.openCircleIDs ?? []);
+}
+export async function reprojectCircleDefs(params) {
+    const { store, groupID, anchor, ledger } = params;
+    const isAdmin = adminAuthorityFor(params);
+    const entries = selectCircleDefEntries(ledger);
+    const openIDs = foldOpenCircleIDs(ledger, groupID, anchor, isAdmin);
+    const rows = projectCircleDefs(entries, isAdmin);
+    for (const [circleID, row] of rows){
+        await store.reconcileCircleProjection({
+            id: circleID,
+            groupID,
+            name: row.name,
+            description: row.description,
+            catalogIDs: row.catalogIDs,
+            hlc: row.hlc,
+            removedAtHLC: row.removedAtHLC,
+            open: openIDs.has(circleID)
+        });
+    }
+}
+export async function reprojectCircleMembers(params) {
+    const { store, ledger } = params;
+    const isAdmin = adminAuthorityFor(params);
+    const entries = selectCircleMemberEntries(ledger);
+    const rows = projectCircleMembers(entries, isAdmin);
+    for (const row of rows.values()){
+        await store.reconcileCircleMemberProjection({
+            circleID: row.circleID,
+            memberDID: row.memberDID,
+            role: row.role,
+            hlc: row.hlc,
+            removedAtHLC: row.removedAtHLC
+        });
+    }
+}
+/**
+ * Reproject group settings onto the group row. Settings are PARTIAL per-field
+ * (no tombstone), so the committed reducer's active map IS the full projection:
+ * fold it under the admin gate, then write the merged fields via the
+ * unconditional `updateGroup`. A field no entry ever set stays at the group's
+ * original value (creation-time name/description).
+ */ /**
+ * Fold the group's settings ledger under the admin gate and return the merged
+ * per-field value, or `undefined` when no authorized settings entry has been
+ * folded. This is the same fold {@link reprojectGroupSettings} materializes,
+ * exposed so a producer can read the CURRENT folded designation before authoring
+ * — what a device projects and what it checks before writing cannot then drift.
+ */ export function foldGroupSettings(ledger, groupID, anchor) {
+    const isAdmin = adminAuthorityFromEntries(selectRoleEntries(ledger), anchor, groupID);
+    const { settings } = foldLedgerEntries(authorizedEntries(selectGroupSettingsEntries(ledger), isAdmin), anchor, createGroupSettingsReducer());
+    return settings.get(groupID);
+}
+export async function reprojectGroupSettings(params) {
+    const { store, groupID, anchor, ledger } = params;
+    const merged = foldGroupSettings(ledger, groupID, anchor);
+    if (merged != null) {
+        // name/description live on the group row directly.
+        await store.updateGroup(groupID, {
+            name: merged.name,
+            description: merged.description
+        });
+    }
+    // `openCircleIDs` is the authoritative open set; project it onto each circle's
+    // `open` flag (settings → circles). Runs unconditionally so a fold with no open
+    // circles closes every circle in the group.
+    await store.reconcileCircleOpenFlags(groupID, merged?.openCircleIDs ?? []);
+    // `commitHub` is the group's consensus commit-hub designation; materialize it
+    // onto the local `is_commit_hub` flag so the fold, not each device's first
+    // hub-bind, decides which bound hub the group commits through. A fold carrying
+    // no designation is a no-op here, leaving the local auto-designated flag in
+    // place until an admin authors one.
+    await store.reconcileCommitHub(groupID, merged?.commitHub);
+}

package/lib/groups/circle-reducers.d.ts

@@ -0,0 +1,139 @@
+import type { GroupAnchor } from '@kumiai/mls';
+import { type AdminRoleValue } from './admin-roster.js';
+import type { LedgerReducer, PositionedFoldInput } from './ledger.js';
+/**
+ * The fold's authority gate: was `issuer` a group admin when the entry at
+ * `position` was enacted?
+ *
+ * The LEDGER admin-fold ONLY — membership and MLS-removal are enforced outside the
+ * projection, never conjoined here, so the fold stays synchronous and every peer
+ * folding the same ledger converges. Applied by {@link authorizedEntries} BEFORE
+ * the fold, not inside a reducer's `verifyAuthority`: that hook sees only the
+ * entry, and the prefix an entry is judged against is a property of its slot.
+ */
+export type IsAdminAtPosition = (issuer: string, position: number) => boolean;
+/**
+ * Drop the entries whose issuer lacked admin authority at their own slot, keeping
+ * the rest in ledger order.
+ *
+ * INCLUSIVE compare against the ledger prefix through the entry's own position: a
+ * grant authorizes from its own slot onward, a demotion stops authorizing from its
+ * own slot onward.
+ */
+export declare function authorizedEntries<TValue>(entries: Array<PositionedFoldInput<TValue>>, isAdmin: IsAdminAtPosition): Array<PositionedFoldInput<TValue>>;
+/**
+ * Ledger entry `type` for a circle-membership claim. Every control-ledger type
+ * kubun mints lives under `kubun.*` — that namespace is kubun's, and the split
+ * between "kubun projects this" and "the MLS library interprets this" is drawn
+ * on it. Namespaces the library reserves for itself are its own to name and
+ * rename, so kubun stays out of them and never restates them.
+ */
+export declare const CIRCLE_MEMBER_ENTRY_TYPE = "kubun.circle.member";
+/**
+ * The claim carried by a circle-member entry. The active form names the
+ * member's role within the circle; the tombstone form removes them. Both are
+ * whole-value: the last entry for a subject in the ledger replaces the projected
+ * state outright, so the value alone decides active-with-role vs removed. `role`
+ * mirrors the store's free-form role column (no fixed enum), so it stays a
+ * string rather than inventing a circle-specific role type.
+ */
+export type CircleMemberValue = {
+    role: string;
+} | {
+    removed: true;
+};
+/**
+ * Deterministic composite subject for a circle member. The signed entry's
+ * `subject` encodes both the circle and the member, so the ledger's `subject`
+ * column uniquely identifies the pair and per-member LWW ordering + dedup work
+ * without consulting the value.
+ *
+ * Unambiguous because the member is a normalized DID (`did:method:...`), which
+ * never contains the `/member:` separator: every reachable separator therefore
+ * sits between the circle id and the DID, and the decoder splits on the last
+ * one. The labeled `circle:` / `/member:` prefixes also keep the encoding
+ * distinct from any other reducer's subject scheme.
+ */
+export declare function encodeCircleMemberSubject(circleID: string, memberDID: string): string;
+/** Tolerant inverse of {@link encodeCircleMemberSubject}: null on a malformed subject. */
+export declare function decodeCircleMemberSubject(subject: string): {
+    circleID: string;
+    memberDID: string;
+} | null;
+/** Ledger entry `type` for a circle definition (create / update / delete). */
+export declare const CIRCLE_DEF_ENTRY_TYPE = "kubun.circle.def";
+/**
+ * The claim carried by a circle-definition entry. The active form is the whole
+ * circle definition; the tombstone form deletes it. Both are whole-value: the
+ * last entry for a circle in the ledger replaces the projected definition outright,
+ * so create and update share one shape and the value alone decides present vs
+ * deleted.
+ */
+export type CircleDefValue = {
+    name: string;
+    description: string;
+    catalogIDs: Array<string>;
+} | {
+    removed: true;
+};
+/**
+ * Ledger entry `type` for a group-settings claim. Namespaced under `kubun.*`
+ * like every kubun control-ledger type — a bare `group.settings` sits in the
+ * namespace the MLS library reserves, so a commit carrying it is refused whole.
+ */
+export declare const GROUP_SETTINGS_ENTRY_TYPE = "kubun.group.settings";
+/**
+ * The claim carried by a group-settings entry. FIELD-WISE LWW, no tombstone: an
+ * omitted field leaves the prior value untouched, while `''` (or an empty list) is
+ * a REAL value that clears it.
+ *
+ * `commitHub` is the group's consensus commit-hub designation — the shared hub
+ * identity, NOT a local hub-row id. Folding it as group state is what stops two
+ * devices forking the group by each committing through their own first-bound hub.
+ */
+export type GroupSettingsValue = {
+    name?: string;
+    description?: string;
+    openCircleIDs?: Array<string>;
+    commitHub?: {
+        url: string;
+        serverDID?: string;
+    };
+};
+/** Folded group settings, keyed by groupID (the entry subject). */
+export type GroupSettingsState = {
+    settings: Map<string, GroupSettingsValue>;
+};
+/**
+ * Per-field last-writer-wins group settings. The signed entry's `subject` is the
+ * groupID directly, so no decode is needed. Replayed in the ledger's own
+ * enactment order, so for each field the LAST entry that SETS that field wins
+ * naturally.
+ *
+ * Merges PER FIELD rather than replacing the whole value the way `circle.def` /
+ * `circle.member` do, because these fields are touched in isolation: a name-only
+ * update must not clobber a previously-set description. Presence is
+ * `value.field !== undefined`, not `'field' in value`, so an explicit `undefined`
+ * means no change while `''` or an empty list CLEARS the field.
+ *
+ * Unauthorized entries never reach here — see {@link authorizedEntries}.
+ */
+export declare function createGroupSettingsReducer(): LedgerReducer<GroupSettingsValue, GroupSettingsState>;
+/**
+ * Build an {@link IsAdminAtPosition} predicate from the group's admin-role ledger
+ * entries. It re-folds the admin sub-ledger through each queried slot, so the
+ * answer is rotation-aware (was-admin-then, not is-admin-now): a key granted
+ * admin at slot n authorizes entries from slot n onward, and a later demotion
+ * stops authorizing from its own slot onward. The compare is inclusive
+ * (`position <= throughPosition`), which matters only for a role entry judging
+ * itself — a circle entry never shares a slot with the grant that authorizes it.
+ *
+ * Callers select the role entries once (via `selectRoleEntries`) and reuse the
+ * returned predicate across the circle / def / settings folds.
+ *
+ * LEDGER-ADMIN ONLY — it does not check the issuer's MLS membership, so an admin
+ * removed from the MLS group whose admin role was never revoked on the ledger still
+ * has its entries folded in. Closing that needs removal to write a ledger
+ * revocation atomically with the roster delta; out of scope here.
+ */
+export declare function adminAuthorityFromEntries(adminEntries: Array<PositionedFoldInput<AdminRoleValue>>, anchor: GroupAnchor, groupID: string): IsAdminAtPosition;