@kubun/plugin-p2p 0.11.0 → 0.12.0

package/lib/groups/catalog-token.d.ts

@@ -0,0 +1,50 @@
+import { type OwnIdentity } from '@kokuin/token';
+import type { CatalogRecord } from '@kubun/protocol';
+type SetPayload = {
+    op: 'set';
+    catalog: CatalogRecord;
+};
+type UpdatePayload = {
+    op: 'update';
+    catalogID: string;
+    update: {
+        name?: string;
+        description?: string;
+        filterCriteria?: CatalogRecord['filterCriteria'];
+    };
+    hlc: string;
+};
+type RemovePayload = {
+    op: 'remove';
+    catalogID: string;
+    hlc: string;
+};
+/**
+ * The verified claim behind a catalog control broadcast. `issuer` is the
+ * authenticated author (the verified token `iss`). Every authoritative field
+ * comes from the signed payload, so a receiver never trusts the surrounding
+ * plaintext frame. Sender-bound: the receiver applies a set only when the
+ * catalog's `ownerDID` equals this issuer, and an update/remove only when the
+ * locally-stored catalog is owned by this issuer.
+ */
+export type VerifiedCatalog = {
+    issuer: string;
+    claim: SetPayload;
+} | {
+    issuer: string;
+    claim: UpdatePayload;
+} | {
+    issuer: string;
+    claim: RemovePayload;
+};
+export declare function signCatalogSet(identity: OwnIdentity, catalog: CatalogRecord): Promise<string>;
+export declare function signCatalogUpdate(identity: OwnIdentity, claim: Omit<UpdatePayload, 'op'>): Promise<string>;
+export declare function signCatalogRemove(identity: OwnIdentity, claim: Omit<RemovePayload, 'op'>): Promise<string>;
+/**
+ * Verify a signed catalog token and extract its claim. Returns `null` (never
+ * throws) when the token is unparseable, unsigned (`alg: 'none'`), or
+ * structurally malformed — an attacker cannot forge an `iss` this way. The
+ * issuer is the normalized verified `iss`.
+ */
+export declare function verifyCatalog(token: string): Promise<VerifiedCatalog | null>;
+export {};

package/lib/groups/catalog-token.js

@@ -0,0 +1,96 @@
+import { isVerifiedToken, normalizeDID, stringifyToken, verifyToken } from '@kokuin/token';
+export async function signCatalogSet(identity, catalog) {
+    const signed = await identity.signToken({
+        op: 'set',
+        catalog
+    }, {
+        embedLongForm: true
+    });
+    return stringifyToken(signed);
+}
+export async function signCatalogUpdate(identity, claim) {
+    const signed = await identity.signToken({
+        op: 'update',
+        ...claim
+    }, {
+        embedLongForm: true
+    });
+    return stringifyToken(signed);
+}
+export async function signCatalogRemove(identity, claim) {
+    const signed = await identity.signToken({
+        op: 'remove',
+        ...claim
+    }, {
+        embedLongForm: true
+    });
+    return stringifyToken(signed);
+}
+function isCatalogRecord(value) {
+    if (value == null || typeof value !== 'object') {
+        return false;
+    }
+    const record = value;
+    return typeof record.id === 'string' && typeof record.ownerDID === 'string' && typeof record.name === 'string' && typeof record.hlc === 'string';
+}
+/**
+ * Verify a signed catalog token and extract its claim. Returns `null` (never
+ * throws) when the token is unparseable, unsigned (`alg: 'none'`), or
+ * structurally malformed — an attacker cannot forge an `iss` this way. The
+ * issuer is the normalized verified `iss`.
+ */ export async function verifyCatalog(token) {
+    let verified;
+    try {
+        verified = await verifyToken(token);
+    } catch  {
+        return null;
+    }
+    if (!isVerifiedToken(verified)) {
+        return null;
+    }
+    const { iss, op } = verified.payload;
+    const issuer = normalizeDID(iss);
+    if (op === 'set') {
+        const { catalog } = verified.payload;
+        if (!isCatalogRecord(catalog)) {
+            return null;
+        }
+        return {
+            issuer,
+            claim: {
+                op: 'set',
+                catalog
+            }
+        };
+    }
+    if (op === 'update') {
+        const { catalogID, update, hlc } = verified.payload;
+        if (typeof catalogID !== 'string' || typeof hlc !== 'string' || update == null) {
+            return null;
+        }
+        return {
+            issuer,
+            claim: {
+                op: 'update',
+                catalogID,
+                update: update,
+                hlc
+            }
+        };
+    }
+    if (op === 'remove') {
+        const { catalogID, hlc } = verified.payload;
+        if (typeof catalogID !== 'string' || typeof hlc !== 'string') {
+            return null;
+        }
+        return {
+            issuer,
+            claim: {
+                op: 'remove',
+                catalogID,
+                hlc
+            }
+        };
+    }
+    return null;
+}

package/lib/groups/circle-projection.d.ts

@@ -1,20 +1,9 @@
 import type { Logger } from '@kubun/logger';
 import type { P2PStoreAPI } from '@kubun/store-p2p';
-import { type CircleDefValue, type CircleMemberValue, type GroupSettingsValue, type IsAdminAtHLC } from './circle-reducers.js';
-import type { GroupAnchor } from './group-anchor.js';
-import { type VerifiedLedgerEntry } from './ledger-entry.js';
-import { type FoldInput } from './ledger-fold.js';
-/**
- * Projection keys, one per entry type — the watermark slot a reproject /
- * incremental advances. Mirrors `ADMIN_ROSTER_PROJECTION`: a single projection
- * per ledger type, so the key is the type itself.
- */
-export declare const CIRCLE_DEF_PROJECTION = "circle.def";
-export declare const CIRCLE_MEMBER_PROJECTION = "circle.member";
-export declare const GROUP_SETTINGS_PROJECTION = "group.settings";
-export declare const loadVerifiedCircleDefEntries: (store: P2PStoreAPI, groupID: string, logger?: Logger) => Promise<FoldInput<CircleDefValue>[]>;
-export declare const loadVerifiedCircleMemberEntries: (store: P2PStoreAPI, groupID: string, logger?: Logger) => Promise<FoldInput<CircleMemberValue>[]>;
-export declare const loadVerifiedGroupSettingsEntries: (store: P2PStoreAPI, groupID: string, logger?: Logger) => Promise<FoldInput<GroupSettingsValue>[]>;
+import type { GroupAnchor, LedgerLogEntry } from '@kumiai/mls';
+import { type CircleDefValue, type CircleMemberValue, type GroupSettingsValue, type IsAdminAtPosition } from './circle-reducers.js';
+import { type PositionedFoldInput } from './ledger.js';
+export declare const selectCircleMemberEntries: (ledger: ReadonlyArray<LedgerLogEntry>) => PositionedFoldInput<CircleMemberValue>[];
 /**
  * One projected circle row as the fold decides it. `hlc` is the winning active
  * entry's HLC (the row's `hlc` column); `removedAtHLC` is the winning tombstone
@@ -33,14 +22,14 @@ export type CircleDefProjectionRow = {
 /**
  * Fold the circle-definition ledger into a per-circle projection covering ALL
  * subjects, active and removed — the active reducer drops removed circles, but a
- * projection must keep a tombstone row for them. Replays in total order under
- * the same admin-authority gate as the reducer: an active entry sets the
+ * projection must keep a tombstone row for them. Replays in the ledger's own
+ * enactment order under the same admin-authority gate as the reducer: an active entry sets the
  * definition and clears any tombstone (re-add), a tombstone marks the row
  * removed while keeping its last active value. A circle whose only entry is a
  * tombstone (no prior active value) produces no row, matching the LWW store's
  * ignore-if-absent removal.
  */
-export declare function projectCircleDefs(entries: Array<FoldInput<CircleDefValue>>, isAdminAtHLC: IsAdminAtHLC): Map<string, CircleDefProjectionRow>;
+export declare function projectCircleDefs(entries: Array<PositionedFoldInput<CircleDefValue>>, isAdmin: IsAdminAtPosition): Map<string, CircleDefProjectionRow>;
 /** One projected circle-member row, keyed by the composite ledger subject. */
 export type CircleMemberProjectionRow = {
     circleID: string;
@@ -54,22 +43,31 @@ export type CircleMemberProjectionRow = {
  * subjects, active and removed. Same structure as {@link projectCircleDefs}: an
  * active entry sets the role and clears any tombstone, a tombstone marks the row
  * removed while keeping its last active role. A malformed subject is skipped, as
- * is a tombstone with no prior active value.
+ * is a tombstone with no prior active value. Gates each entry on the same
+ * admin-authority check as the reducer's fold — an entry from a non-admin issuer
+ * never projects.
  */
-export declare function projectCircleMembers(entries: Array<FoldInput<CircleMemberValue>>, isAdminAtHLC: IsAdminAtHLC): Map<string, CircleMemberProjectionRow>;
+export declare function projectCircleMembers(entries: Array<PositionedFoldInput<CircleMemberValue>>, isAdmin: IsAdminAtPosition): Map<string, CircleMemberProjectionRow>;
 /**
- * Authoritatively rebuild a circle/settings projection from the whole ledger and
- * reset the watermark to the newest folded entry. Used on a first projection, an
- * out-of-order arrival, or drift repair — anywhere the cached projection can no
- * longer be trusted as a fold-through-watermark. Authority is the admin fold
- * (`adminAuthorityFromEntries`), so every projection honors the same admin gate
- * the broadcast path enforces. Each `reconcile*` write is unconditional, so the
- * row converges to exactly the fold's decision regardless of prior contents.
+ * Rebuild a circle/settings projection from the whole ledger.
+ *
+ * The only projection path there is: an entry is judged against the ledger prefix
+ * through its own slot, so folding the whole log is the same answer as folding it
+ * incrementally, and there is no cached-projection-is-stale case to detect.
+ * Authority is the admin fold (`adminAuthorityFromEntries`), so every projection
+ * honors one gate. Each `reconcile*` write is unconditional, so the row converges
+ * to exactly the fold's decision regardless of prior contents.
  */
 export type ReprojectCircleParams = {
     store: P2PStoreAPI;
     groupID: string;
     anchor: GroupAnchor;
+    /**
+     * The group's control ledger, in the handle's enactment order. Passed in rather
+     * than read: these projections run where the handle is already open, and every
+     * entry they fold is one the handle verified on the way in.
+     */
+    ledger: ReadonlyArray<LedgerLogEntry>;
     logger?: Logger;
 };
 export declare function reprojectCircleDefs(params: ReprojectCircleParams): Promise<void>;
@@ -81,42 +79,12 @@ export declare function reprojectCircleMembers(params: ReprojectCircleParams): P
  * unconditional `updateGroup`. A field no entry ever set stays at the group's
  * original value (creation-time name/description).
  */
-export declare function reprojectGroupSettings(params: ReprojectCircleParams): Promise<void>;
 /**
- * Apply one strictly-newer-than-watermark entry onto the current projection
- * without re-folding the whole ledger. The caller guarantees the entry is
- * in-order, so the projection already equals the fold-so-far. Authority is the
- * admin fold at the entry's own HLC: a non-admin issuer is dropped (never
- * thrown). Unlike the admin roster's incremental applier — whose authority reads
- * the projection itself — circle authority lives in the separate admin
- * sub-ledger, so the admin entries are loaded here.
- *
- * The watermark is advanced by the caller (the ingest handler), not here —
- * mirroring the admin roster's split of responsibility — so the projection
- * mutation and the watermark advance stay in the handler's single transaction
- * even when the entry is dropped (it is still durable and accounted for).
+ * Fold the group's settings ledger under the admin gate and return the merged
+ * per-field value, or `undefined` when no authorized settings entry has been
+ * folded. This is the same fold {@link reprojectGroupSettings} materializes,
+ * exposed so a producer can read the CURRENT folded designation before authoring
+ * — what a device projects and what it checks before writing cannot then drift.
  */
-export type ApplyCircleDefEntryIncrementalParams = {
-    store: P2PStoreAPI;
-    groupID: string;
-    anchor: GroupAnchor;
-    verified: VerifiedLedgerEntry<CircleDefValue>;
-    logger?: Logger;
-};
-export declare function applyCircleDefEntryIncremental(params: ApplyCircleDefEntryIncrementalParams): Promise<void>;
-export type ApplyCircleMemberEntryIncrementalParams = {
-    store: P2PStoreAPI;
-    groupID: string;
-    anchor: GroupAnchor;
-    verified: VerifiedLedgerEntry<CircleMemberValue>;
-    logger?: Logger;
-};
-export declare function applyCircleMemberEntryIncremental(params: ApplyCircleMemberEntryIncrementalParams): Promise<void>;
-export type ApplyGroupSettingsEntryIncrementalParams = {
-    store: P2PStoreAPI;
-    groupID: string;
-    anchor: GroupAnchor;
-    verified: VerifiedLedgerEntry<GroupSettingsValue>;
-    logger?: Logger;
-};
-export declare function applyGroupSettingsEntryIncremental(params: ApplyGroupSettingsEntryIncrementalParams): Promise<void>;
+export declare function foldGroupSettings(ledger: ReadonlyArray<LedgerLogEntry>, groupID: string, anchor: GroupAnchor): GroupSettingsValue | undefined;
+export declare function reprojectGroupSettings(params: ReprojectCircleParams): Promise<void>;

package/lib/groups/circle-projection.js

@@ -1,95 +1,63 @@
-import { loadVerifiedAdminEntries } from './admin-roster.js';
-import { adminAuthorityFromEntries, CIRCLE_DEF_ENTRY_TYPE, CIRCLE_MEMBER_ENTRY_TYPE, createGroupSettingsReducer, decodeCircleMemberSubject, GROUP_SETTINGS_ENTRY_TYPE } from './circle-reducers.js';
-import { verifyLedgerEntry } from './ledger-entry.js';
-import { foldLedger } from './ledger-fold.js';
-/**
- * Projection keys, one per entry type — the watermark slot a reproject /
- * incremental advances. Mirrors `ADMIN_ROSTER_PROJECTION`: a single projection
- * per ledger type, so the key is the type itself.
- */ export const CIRCLE_DEF_PROJECTION = CIRCLE_DEF_ENTRY_TYPE;
-export const CIRCLE_MEMBER_PROJECTION = CIRCLE_MEMBER_ENTRY_TYPE;
-export const GROUP_SETTINGS_PROJECTION = GROUP_SETTINGS_ENTRY_TYPE;
+import { selectRoleEntries } from './admin-roster.js';
+import { adminAuthorityFromEntries, authorizedEntries, CIRCLE_DEF_ENTRY_TYPE, CIRCLE_MEMBER_ENTRY_TYPE, createGroupSettingsReducer, decodeCircleMemberSubject, GROUP_SETTINGS_ENTRY_TYPE } from './circle-reducers.js';
+import { entryOrd, foldLedgerEntries } from './ledger.js';
 function isRemovedDef(value) {
     return 'removed' in value && value.removed === true;
 }
 function isRemovedMember(value) {
     return 'removed' in value && value.removed === true;
 }
-/** Total order over the ledger: HLC first, content-addressed id breaks ties. */ function byTotalOrder(a, b) {
-    if (a.verified.entry.hlc !== b.verified.entry.hlc) {
-        return a.verified.entry.hlc < b.verified.entry.hlc ? -1 : 1;
-    }
-    if (a.entryID === b.entryID) return 0;
-    return a.entryID < b.entryID ? -1 : 1;
-}
-function maxHLC(entries) {
-    let max = null;
-    for (const { verified } of entries){
-        if (max == null || verified.entry.hlc > max) max = verified.entry.hlc;
-    }
-    return max;
-}
-// --- Per-type verified-entry loaders ---
 /**
- * Build a verified-entry loader for one ledger type, memoized per group on the
- * stored id set. The stored token is re-verified rather than trusting the
- * decoded `value` column — the ledger is the source of truth and must stay
- * self-verifying, so a token that no longer verifies is dropped and the rest
- * survive. The cache key is derived purely from content-addressed entry ids, so
- * a forged or altered entry yields a different id set, a different key, and a
- * full re-verification; one slot per group self-invalidates on every append.
- * One cache instance per type keeps the slots isolated across ledger types.
- */ function createVerifiedEntryLoader(entryType) {
-    const cache = new Map();
-    return async (store, groupID, logger)=>{
-        const rows = await store.getLedgerEntriesByType(groupID, entryType);
-        const key = rows.map((row)=>row.entry_id).join('\n');
-        const cached = cache.get(groupID);
-        if (cached != null && cached.key === key) {
-            return cached.entries;
-        }
+ * Build a selector for one ledger type, carrying each entry's slot in the WHOLE
+ * ledger so its authority can be judged against the prefix that precedes it.
+ *
+ * Entries come from the handle's own log, and every door into it verifies —
+ * `GroupHandle.applyLedgerEntries`, `bootstrapLedger` and an accepted commit
+ * each re-verify the tokens they admit — so these are pure filters over an
+ * in-memory array: no re-verification, and nothing to memoize. They replaced
+ * loaders that re-verified every stored `signed_token` on each call, which was
+ * needed only because the SQL row they read could not vouch for itself.
+ *
+ * Selecting by `type` is what licenses the cast: the log is typed over an unknown
+ * claim value, and the type is the claim about what that value is.
+ */ function createEntrySelector(entryType) {
+    return (ledger)=>{
         const entries = [];
-        for (const row of rows){
-            const verified = await verifyLedgerEntry(row.signed_token);
-            if (verified == null) {
-                logger?.warn('circle projection: dropped stored entry whose token no longer verifies', {
-                    groupID,
-                    entryType,
-                    entryID: row.entry_id
-                });
+        for (const [position, held] of ledger.entries()){
+            if (held.verified.entry.type !== entryType) {
                 continue;
             }
             entries.push({
-                verified,
-                entryID: row.entry_id
+                verified: held.verified,
+                entryID: held.entryID,
+                position
             });
         }
-        cache.set(groupID, {
-            key,
-            entries
-        });
         return entries;
     };
 }
-export const loadVerifiedCircleDefEntries = createVerifiedEntryLoader(CIRCLE_DEF_ENTRY_TYPE);
-export const loadVerifiedCircleMemberEntries = createVerifiedEntryLoader(CIRCLE_MEMBER_ENTRY_TYPE);
-export const loadVerifiedGroupSettingsEntries = createVerifiedEntryLoader(GROUP_SETTINGS_ENTRY_TYPE);
+const selectCircleDefEntries = createEntrySelector(CIRCLE_DEF_ENTRY_TYPE);
+export const selectCircleMemberEntries = createEntrySelector(CIRCLE_MEMBER_ENTRY_TYPE);
+const selectGroupSettingsEntries = createEntrySelector(GROUP_SETTINGS_ENTRY_TYPE);
 /**
  * Fold the circle-definition ledger into a per-circle projection covering ALL
  * subjects, active and removed — the active reducer drops removed circles, but a
- * projection must keep a tombstone row for them. Replays in total order under
- * the same admin-authority gate as the reducer: an active entry sets the
+ * projection must keep a tombstone row for them. Replays in the ledger's own
+ * enactment order under the same admin-authority gate as the reducer: an active entry sets the
  * definition and clears any tombstone (re-add), a tombstone marks the row
  * removed while keeping its last active value. A circle whose only entry is a
  * tombstone (no prior active value) produces no row, matching the LWW store's
  * ignore-if-absent removal.
- */ export function projectCircleDefs(entries, isAdminAtHLC) {
+ */ export function projectCircleDefs(entries, isAdmin) {
     const rows = new Map();
-    for (const { verified } of [
-        ...entries
-    ].sort(byTotalOrder)){
-        if (!isAdminAtHLC(verified.issuer, verified.entry.hlc)) continue;
-        const { subject, value, hlc } = verified.entry;
+    for (const { verified } of authorizedEntries(entries, isAdmin)){
+        const { subject, value } = verified.entry;
+        const hlc = entryOrd(verified.entry);
+        // Kubun stamps `ord` on every circle entry it signs; one without is foreign
+        // or malformed. Skipping is fail-closed — projecting it would have to invent
+        // an HLC, and on a tombstone a `null` `removed_at_hlc` reads as ACTIVE and
+        // silently revives the row.
+        if (hlc == null) continue;
         if (isRemovedDef(value)) {
             const existing = rows.get(subject);
             if (existing == null) continue;
@@ -114,14 +82,17 @@ export const loadVerifiedGroupSettingsEntries = createVerifiedEntryLoader(GROUP_
  * subjects, active and removed. Same structure as {@link projectCircleDefs}: an
  * active entry sets the role and clears any tombstone, a tombstone marks the row
  * removed while keeping its last active role. A malformed subject is skipped, as
- * is a tombstone with no prior active value.
- */ export function projectCircleMembers(entries, isAdminAtHLC) {
+ * is a tombstone with no prior active value. Gates each entry on the same
+ * admin-authority check as the reducer's fold — an entry from a non-admin issuer
+ * never projects.
+ */ export function projectCircleMembers(entries, isAdmin) {
     const rows = new Map();
-    for (const { verified } of [
-        ...entries
-    ].sort(byTotalOrder)){
-        if (!isAdminAtHLC(verified.issuer, verified.entry.hlc)) continue;
-        const { subject, value, hlc } = verified.entry;
+    for (const { verified } of authorizedEntries(entries, isAdmin)){
+        const { subject, value } = verified.entry;
+        const hlc = entryOrd(verified.entry);
+        // See {@link projectCircleDefs}: no `ord` means foreign or malformed, and a
+        // null tombstone HLC would read as active.
+        if (hlc == null) continue;
         if (isRemovedMember(value)) {
             const existing = rows.get(subject);
             if (existing == null) continue;
@@ -143,16 +114,25 @@ export const loadVerifiedGroupSettingsEntries = createVerifiedEntryLoader(GROUP_
     }
     return rows;
 }
-async function adminAuthorityFor(params) {
-    const adminEntries = await loadVerifiedAdminEntries(params.store, params.groupID, params.logger);
-    return adminAuthorityFromEntries(adminEntries, params.anchor);
+function adminAuthorityFor(params) {
+    return adminAuthorityFromEntries(selectRoleEntries(params.ledger), params.anchor, params.groupID);
+}
+/**
+ * The group's CURRENT open-circle set, folded from the settings ledger under the
+ * supplied admin authority. `open` is a derived cache of this set on each circle
+ * row, so both the settings→circles and circles←settings reprojection paths
+ * derive it from the one authoritative fold and converge regardless of which
+ * entry (the `circle.def` or the `group.settings` opening it) arrives first.
+ */ function foldOpenCircleIDs(ledger, groupID, anchor, isAdmin) {
+    const entries = selectGroupSettingsEntries(ledger);
+    const { settings } = foldLedgerEntries(authorizedEntries(entries, isAdmin), anchor, createGroupSettingsReducer());
+    return new Set(settings.get(groupID)?.openCircleIDs ?? []);
 }
 export async function reprojectCircleDefs(params) {
-    const { store, groupID } = params;
-    const [isAdmin, entries] = await Promise.all([
-        adminAuthorityFor(params),
-        loadVerifiedCircleDefEntries(store, groupID, params.logger)
-    ]);
+    const { store, groupID, anchor, ledger } = params;
+    const isAdmin = adminAuthorityFor(params);
+    const entries = selectCircleDefEntries(ledger);
+    const openIDs = foldOpenCircleIDs(ledger, groupID, anchor, isAdmin);
     const rows = projectCircleDefs(entries, isAdmin);
     for (const [circleID, row] of rows){
         await store.reconcileCircleProjection({
@@ -162,20 +142,15 @@ export async function reprojectCircleDefs(params) {
             description: row.description,
             catalogIDs: row.catalogIDs,
             hlc: row.hlc,
-            removedAtHLC: row.removedAtHLC
+            removedAtHLC: row.removedAtHLC,
+            open: openIDs.has(circleID)
         });
     }
-    const max = maxHLC(entries);
-    if (max != null) {
-        await store.setProjectionWatermark(groupID, CIRCLE_DEF_PROJECTION, max);
-    }
 }
 export async function reprojectCircleMembers(params) {
-    const { store, groupID } = params;
-    const [isAdmin, entries] = await Promise.all([
-        adminAuthorityFor(params),
-        loadVerifiedCircleMemberEntries(store, groupID, params.logger)
-    ]);
+    const { store, ledger } = params;
+    const isAdmin = adminAuthorityFor(params);
+    const entries = selectCircleMemberEntries(ledger);
     const rows = projectCircleMembers(entries, isAdmin);
     for (const row of rows.values()){
         await store.reconcileCircleMemberProjection({
@@ -186,10 +161,6 @@ export async function reprojectCircleMembers(params) {
             removedAtHLC: row.removedAtHLC
         });
     }
-    const max = maxHLC(entries);
-    if (max != null) {
-        await store.setProjectionWatermark(groupID, CIRCLE_MEMBER_PROJECTION, max);
-    }
 }
 /**
  * Reproject group settings onto the group row. Settings are PARTIAL per-field
@@ -197,92 +168,35 @@ export async function reprojectCircleMembers(params) {
  * fold it under the admin gate, then write the merged fields via the
  * unconditional `updateGroup`. A field no entry ever set stays at the group's
  * original value (creation-time name/description).
- */ export async function reprojectGroupSettings(params) {
-    const { store, groupID, anchor } = params;
-    const [isAdmin, entries] = await Promise.all([
-        adminAuthorityFor(params),
-        loadVerifiedGroupSettingsEntries(store, groupID, params.logger)
-    ]);
-    const { settings } = foldLedger(entries, anchor, createGroupSettingsReducer(isAdmin));
-    const merged = settings.get(groupID);
-    if (merged != null) {
-        await store.updateGroup(groupID, merged);
-    }
-    const max = maxHLC(entries);
-    if (max != null) {
-        await store.setProjectionWatermark(groupID, GROUP_SETTINGS_PROJECTION, max);
-    }
+ */ /**
+ * Fold the group's settings ledger under the admin gate and return the merged
+ * per-field value, or `undefined` when no authorized settings entry has been
+ * folded. This is the same fold {@link reprojectGroupSettings} materializes,
+ * exposed so a producer can read the CURRENT folded designation before authoring
+ * — what a device projects and what it checks before writing cannot then drift.
+ */ export function foldGroupSettings(ledger, groupID, anchor) {
+    const isAdmin = adminAuthorityFromEntries(selectRoleEntries(ledger), anchor, groupID);
+    const { settings } = foldLedgerEntries(authorizedEntries(selectGroupSettingsEntries(ledger), isAdmin), anchor, createGroupSettingsReducer());
+    return settings.get(groupID);
 }
-export async function applyCircleDefEntryIncremental(params) {
-    const { store, groupID, anchor, verified, logger } = params;
-    const adminEntries = await loadVerifiedAdminEntries(store, groupID, logger);
-    const isAdmin = adminAuthorityFromEntries(adminEntries, anchor);
-    const { subject, value, hlc } = verified.entry;
-    if (!isAdmin(verified.issuer, hlc)) {
-        logger?.warn('circle projection: dropped incremental circle.def from a non-admin issuer', {
-            groupID,
-            issuer: verified.issuer
-        });
-    } else if (isRemovedDef(value)) {
-        // Tombstone an existing active row, leaving its name/description intact —
-        // the LWW removal write, correct for an in-order entry on the active row.
-        await store.markCircleRemoved(subject, hlc);
-    } else {
-        await store.reconcileCircleProjection({
-            id: subject,
-            groupID,
-            name: value.name,
-            description: value.description,
-            catalogIDs: value.catalogIDs,
-            hlc,
-            removedAtHLC: null
-        });
-    }
-}
-export async function applyCircleMemberEntryIncremental(params) {
-    const { store, groupID, anchor, verified, logger } = params;
-    const adminEntries = await loadVerifiedAdminEntries(store, groupID, logger);
-    const isAdmin = adminAuthorityFromEntries(adminEntries, anchor);
-    const { subject, value, hlc } = verified.entry;
-    if (!isAdmin(verified.issuer, hlc)) {
-        logger?.warn('circle projection: dropped incremental circle.member from a non-admin issuer', {
-            groupID,
-            issuer: verified.issuer
-        });
-    } else if (isRemovedMember(value)) {
-        const decoded = decodeCircleMemberSubject(subject);
-        if (decoded != null) {
-            await store.removeCircleMember(decoded.circleID, decoded.memberDID, hlc);
-        }
-    } else {
-        const decoded = decodeCircleMemberSubject(subject);
-        if (decoded != null) {
-            await store.reconcileCircleMemberProjection({
-                circleID: decoded.circleID,
-                memberDID: decoded.memberDID,
-                role: value.role,
-                hlc,
-                removedAtHLC: null
-            });
-        }
-    }
-}
-export async function applyGroupSettingsEntryIncremental(params) {
-    const { store, groupID, anchor, verified, logger } = params;
-    const adminEntries = await loadVerifiedAdminEntries(store, groupID, logger);
-    const isAdmin = adminAuthorityFromEntries(adminEntries, anchor);
-    const { value, hlc } = verified.entry;
-    if (!isAdmin(verified.issuer, hlc)) {
-        logger?.warn('circle projection: dropped incremental group.settings from a non-admin issuer', {
-            groupID,
-            issuer: verified.issuer
-        });
-    } else {
-        // Per-field merge onto the group row: `updateGroup` sets only the fields the
-        // entry carries (an explicit `''` clears; an omitted field is left alone).
+export async function reprojectGroupSettings(params) {
+    const { store, groupID, anchor, ledger } = params;
+    const merged = foldGroupSettings(ledger, groupID, anchor);
+    if (merged != null) {
+        // name/description live on the group row directly.
         await store.updateGroup(groupID, {
-            name: value.name,
-            description: value.description
+            name: merged.name,
+            description: merged.description
         });
     }
+    // `openCircleIDs` is the authoritative open set; project it onto each circle's
+    // `open` flag (settings → circles). Runs unconditionally so a fold with no open
+    // circles closes every circle in the group.
+    await store.reconcileCircleOpenFlags(groupID, merged?.openCircleIDs ?? []);
+    // `commitHub` is the group's consensus commit-hub designation; materialize it
+    // onto the local `is_commit_hub` flag so the fold, not each device's first
+    // hub-bind, decides which bound hub the group commits through. A fold carrying
+    // no designation is a no-op here, leaving the local auto-designated flag in
+    // place until an admin authors one.
+    await store.reconcileCommitHub(groupID, merged?.commitHub);
 }