@oxy.so/core 7.23.2 → 7.25.0

package/dist/cjs/api/accounts.js

@@ -1,6 +1,39 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AccountsApi = exports.AccountInvitationsApi = exports.AccountAgentKeysApi = exports.AccountMembersApi = exports.kindAcceptsAccountCategories = exports.isSelectableAccountCategoryId = exports.isOperatorSwitchTargetKind = exports.isDelegatedActAsEligibleKind = exports.SELECTABLE_ACCOUNT_CATEGORY_IDS = exports.MAX_ACCOUNT_CATEGORIES = exports.ACCOUNT_KINDS = exports.ACCOUNT_CATEGORY_IDS = void 0;
+exports.AccountsApi = exports.AccountInvitationsApi = exports.AccountIdentityKeyApi = exports.AccountAgentKeysApi = exports.AccountMembersApi = exports.kindAcceptsAccountCategories = exports.isSelectableAccountCategoryId = exports.isOperatorSwitchTargetKind = exports.isDelegatedActAsEligibleKind = exports.SELECTABLE_ACCOUNT_CATEGORY_IDS = exports.MAX_ACCOUNT_CATEGORIES = exports.ACCOUNT_KINDS = exports.ACCOUNT_CATEGORY_IDS = void 0;
 const client_1 = require("@oxy.so/contracts/client");
 const userIdentity_1 = require("../utils/userIdentity");
 const identityCacheSweep_1 = require("../utils/identityCacheSweep");
@@ -88,6 +121,73 @@ class AccountAgentKeysApi {
     }
 }
 exports.AccountAgentKeysApi = AccountAgentKeysApi;
+/**
+ * `oxy.accounts.identityKey` — an organization's identity key (ADR 0061): its
+ * DID `#key-1`, the key Peable derives its FairCoin receive addresses from.
+ * Only the organization's owners and admins may read or change it; the key is
+ * created and held in Commons and never signs anybody in.
+ *
+ * `get` answers `publicKey: null` for an organization that has no key yet (its
+ * DID lists no `#key-1`): that is when a client shows its owners "Set up the
+ * organization's Peable wallet". A 403 (`ORGANIZATION_KEY_FORBIDDEN`) means the
+ * signed-in person is not an owner or admin of a claimed, active organization.
+ */
+class AccountIdentityKeyApi {
+    constructor(ctx) {
+        this.ctx = ctx;
+    }
+    /** The organization's key (`null` without one) and every key it has had, oldest first. */
+    async get(accountId) {
+        return (0, client_1.parseContract)(client_1.organizationIdentityKeyStateCheck, await this.ctx.request('GET', `/accounts/${enc(accountId)}/identity-key`, undefined, { cache: false }));
+    }
+    /** A one-use challenge for one change, with the claims every signer signs. */
+    async requestChallenge(accountId, request) {
+        return (0, client_1.parseContract)(client_1.organizationKeyChallengeCheck, await this.ctx.request('POST', `/accounts/${enc(accountId)}/identity-key/challenge`, (0, client_1.parseContract)(client_1.organizationKeyChallengeRequestCheck, request), { cache: false }));
+    }
+    /** Apply a change with its signatures (see {@link link} for the whole ceremony). */
+    async apply(accountId, request) {
+        return (0, client_1.parseContract)(client_1.organizationIdentityKeyStateCheck, await this.ctx.request('POST', `/accounts/${enc(accountId)}/identity-key`, (0, client_1.parseContract)(client_1.organizationKeyApplyRequestCheck, request), { cache: false }));
+    }
+    /**
+     * Commons' whole ceremony. NATIVE-ONLY: the actor is THIS device's personal
+     * root (`KeyManager`), which must be the signed-in person's. `key` is the
+     * organization key the device generated (`create`, or `replace` with a new
+     * one); `previousKey` is the current organization key when the device holds
+     * it, so the replacement is recorded as proven by it.
+     */
+    async link(accountId, input) {
+        const { KeyManager, signIdentityProof } = await Promise.resolve().then(() => __importStar(require('../crypto/index')));
+        const [rootPrivateKey, rootPublicKey] = await Promise.all([
+            KeyManager.getPrivateKey(),
+            KeyManager.getPublicKey(),
+        ]);
+        if (!rootPrivateKey || !rootPublicKey) {
+            throw new Error('No identity on this device to sign with');
+        }
+        const challenge = await this.requestChallenge(accountId, {
+            operation: input.operation,
+            publicKey: input.key.publicKey,
+        });
+        const root = rootPublicKey.trim().toLowerCase();
+        if (challenge.actorPublicKey !== root) {
+            throw new Error("This device's identity is not the signed-in account's");
+        }
+        const sign = async (signer, publicKey) => (await signIdentityProof({ privateKey: signer.privateKey, publicKey }, (0, client_1.organizationKeyProofClaims)(challenge, publicKey))).signature;
+        const previousPublicKey = challenge.previousPublicKey;
+        return this.apply(accountId, {
+            operation: input.operation,
+            publicKey: challenge.publicKey,
+            challenge: challenge.challenge,
+            expiresAt: challenge.expiresAt,
+            actorSignature: await sign({ privateKey: rootPrivateKey, publicKey: root }, root),
+            keySignature: await sign(input.key, challenge.publicKey),
+            ...(input.previousKey && previousPublicKey
+                ? { previousKeySignature: await sign(input.previousKey, previousPublicKey) }
+                : {}),
+        });
+    }
+}
+exports.AccountIdentityKeyApi = AccountIdentityKeyApi;
 /** Consent-based invitations; never cached or queued as offline mutations. */
 class AccountInvitationsApi {
     constructor(ctx) {
@@ -123,6 +223,7 @@ class AccountsApi {
         this.members = new AccountMembersApi(ctx);
         this.invitations = new AccountInvitationsApi(ctx);
         this.agentKeys = new AccountAgentKeysApi(ctx);
+        this.identityKey = new AccountIdentityKeyApi(ctx);
     }
     /**
      * List the accounts the caller can access: their own personal (root)

package/dist/cjs/crypto/identitySigner.js

@@ -1,2 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerIdentitySignerStore = registerIdentitySignerStore;
+exports.registeredIdentitySignerStore = registeredIdentitySignerStore;
+/**
+ * The store Commons registered, readable by modules that `KeyManager` itself
+ * imports (`./organizationKeys`), which therefore cannot import `KeyManager`.
+ * Written only by `KeyManager.setIdentitySignerStore`. @internal
+ */
+let registeredSignerStore = null;
+/** @internal */
+function registerIdentitySignerStore(store) {
+    registeredSignerStore = store;
+}
+/** @internal */
+function registeredIdentitySignerStore() {
+    return registeredSignerStore;
+}

package/dist/cjs/crypto/index.js

@@ -12,7 +12,7 @@
  * common chunk, which is the cost the lazy loading exists to avoid.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.verifySignature = exports.signMessage = exports.loadCommonsIdentityBridge = exports.canonicalize = exports.createContentHasher = exports.solveRegistrationPow = exports.deriveIdentityLinkCode = exports.signIdentityProof = exports.digestIdentityPayload = exports.authChallengeDigest = exports.signSocialReceiveDigest = exports.deriveSocialReceiveKey = exports.deriveScopedSeedFromKey = exports.MAX_SOCIAL_RECEIVE_INDEX = exports.SOCIAL_RECEIVE_CHAIN_CODE_KEY = exports.SCOPED_SEED_KDF_SALT = exports.deriveSharedSecret = exports.AEAD_NONCE_LENGTH = exports.AEAD_KEY_LENGTH = exports.decryptAead = exports.encryptAead = exports.hkdfSha256 = exports.BACKUP_KDF_ENCRYPTION_INFO = exports.RecoveryPhraseService = exports.SignatureService = exports.updateIdentityMarker = exports.readIdentityMarker = exports.IdentityUnavailableError = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = void 0;
+exports.verifySignature = exports.signMessage = exports.loadCommonsIdentityBridge = exports.canonicalize = exports.createContentHasher = exports.solveRegistrationPow = exports.deriveIdentityLinkCode = exports.signIdentityProof = exports.digestIdentityPayload = exports.authChallengeDigest = exports.signSocialReceiveDigest = exports.deriveSocialReceiveKey = exports.deriveScopedSeedFromKey = exports.MAX_SOCIAL_RECEIVE_INDEX = exports.SOCIAL_RECEIVE_CHAIN_CODE_KEY = exports.SCOPED_SEED_KDF_SALT = exports.deriveSharedSecret = exports.AEAD_NONCE_LENGTH = exports.AEAD_KEY_LENGTH = exports.decryptAead = exports.encryptAead = exports.hkdfSha256 = exports.BACKUP_KDF_ENCRYPTION_INFO = exports.RecoveryPhraseService = exports.SignatureService = exports.isHealthyOrganizationKeyPair = exports.isOrganizationAccountId = exports.syncOrganizationKeys = exports.deleteOrganizationKey = exports.listOrganizationKeys = exports.getOrganizationRecoveryPhrase = exports.getOrganizationPrivateKey = exports.getOrganizationPublicKey = exports.storeOrganizationKey = exports.organizationKeyFromPhrase = exports.generateOrganizationKey = exports.updateIdentityMarker = exports.readIdentityMarker = exports.IdentityUnavailableError = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = void 0;
 // MUST stay the first import: the shim has to exist before any module below
 // evaluates or draws randomness (see `./polyfill`).
 require("./polyfill");
@@ -24,6 +24,19 @@ Object.defineProperty(exports, "IdentityUnavailableError", { enumerable: true, g
 var identityMarker_1 = require("./identityMarker");
 Object.defineProperty(exports, "readIdentityMarker", { enumerable: true, get: function () { return identityMarker_1.readIdentityMarker; } });
 Object.defineProperty(exports, "updateIdentityMarker", { enumerable: true, get: function () { return identityMarker_1.updateIdentityMarker; } });
+// Organization keys on the device (docs/adr/0061-organization-identity-key.md D6)
+var organizationKeys_1 = require("./organizationKeys");
+Object.defineProperty(exports, "generateOrganizationKey", { enumerable: true, get: function () { return organizationKeys_1.generateOrganizationKey; } });
+Object.defineProperty(exports, "organizationKeyFromPhrase", { enumerable: true, get: function () { return organizationKeys_1.organizationKeyFromPhrase; } });
+Object.defineProperty(exports, "storeOrganizationKey", { enumerable: true, get: function () { return organizationKeys_1.storeOrganizationKey; } });
+Object.defineProperty(exports, "getOrganizationPublicKey", { enumerable: true, get: function () { return organizationKeys_1.getOrganizationPublicKey; } });
+Object.defineProperty(exports, "getOrganizationPrivateKey", { enumerable: true, get: function () { return organizationKeys_1.getOrganizationPrivateKey; } });
+Object.defineProperty(exports, "getOrganizationRecoveryPhrase", { enumerable: true, get: function () { return organizationKeys_1.getOrganizationRecoveryPhrase; } });
+Object.defineProperty(exports, "listOrganizationKeys", { enumerable: true, get: function () { return organizationKeys_1.listOrganizationKeys; } });
+Object.defineProperty(exports, "deleteOrganizationKey", { enumerable: true, get: function () { return organizationKeys_1.deleteOrganizationKey; } });
+Object.defineProperty(exports, "syncOrganizationKeys", { enumerable: true, get: function () { return organizationKeys_1.syncOrganizationKeys; } });
+Object.defineProperty(exports, "isOrganizationAccountId", { enumerable: true, get: function () { return organizationKeys_1.isOrganizationAccountId; } });
+Object.defineProperty(exports, "isHealthyOrganizationKeyPair", { enumerable: true, get: function () { return organizationKeys_1.isHealthyOrganizationKeyPair; } });
 var signatureService_1 = require("./signatureService");
 Object.defineProperty(exports, "SignatureService", { enumerable: true, get: function () { return signatureService_1.SignatureService; } });
 var recoveryPhrase_1 = require("./recoveryPhrase");

package/dist/cjs/crypto/keyManager.js

@@ -45,6 +45,8 @@ const protocol_1 = require("@oxy.so/protocol");
 const secp256k1_1 = require("@oxy.so/protocol/secp256k1");
 const logger_1 = require("../logger");
 const identityDerivations_1 = require("./identityDerivations");
+const identitySigner_1 = require("./identitySigner");
+const organizationKeys_1 = require("./organizationKeys");
 const identityMarker_1 = require("./identityMarker");
 const deviceBackup_1 = require("./deviceBackup");
 /**
@@ -296,6 +298,7 @@ class KeyManager {
      */
     static setIdentitySignerStore(store) {
         KeyManager.identitySignerStore = store;
+        (0, identitySigner_1.registerIdentitySignerStore)(store);
         KeyManager.invalidateSharedCache();
     }
     /** Whether this app registered an identity signer store (Commons on Android). */
@@ -2612,14 +2615,23 @@ class KeyManager {
      * Both reproduce from the user's Oxy recovery phrase, so the seed is
      * recoverable, and the IPC answer is byte-identical to the local one.
      *
+     * With `opts.accountId` the seed is derived from that ORGANIZATION's key
+     * instead (ADR 0061 D6), from the same places: Commons' own copy, the iOS
+     * keychain group, or Commons' identity host. It never falls back to the
+     * personal key.
+     *
      * @param info Context/domain-binding label (distinct labels → independent seeds).
+     * @param opts.accountId An organization's account id, for its key.
      * @returns 32 bytes of derived keying material, or `null` on web / when no
      *          identity key is available to this app.
      */
-    static async deriveScopedSeed(info) {
+    static async deriveScopedSeed(info, opts) {
         if (isWebPlatform()) {
             return null;
         }
+        if (opts?.accountId !== undefined) {
+            return KeyManager._deriveOrganizationScopedSeed(info, opts.accountId);
+        }
         if ((0, platform_1.isAndroid)()) {
             if (KeyManager.identitySignerStore) {
                 // Commons: its own key.
@@ -2636,6 +2648,24 @@ class KeyManager {
         }
         return (0, identityDerivations_1.deriveScopedSeedFromKey)(privateKey, info);
     }
+    /**
+     * {@link deriveScopedSeed} over an ORGANIZATION key (ADR 0061 D6): Commons'
+     * own copy inside Commons and on iOS the keychain group, everywhere else on
+     * Android Commons' identity host. Never falls back to the personal key: an
+     * organization this device cannot reach is `null`.
+     */
+    static async _deriveOrganizationScopedSeed(info, accountId) {
+        if (!(0, organizationKeys_1.isOrganizationAccountId)(accountId)) {
+            return null;
+        }
+        if ((0, platform_1.isAndroid)() && !KeyManager.identitySignerStore) {
+            const bridge = await (0, protocol_1.loadCommonsIdentityBridge)();
+            const seed = (await bridge?.deriveScopedSeed(info, accountId)) ?? null;
+            return seed ? hexToBytes(seed) : null;
+        }
+        const privateKey = await (0, organizationKeys_1.getOrganizationPrivateKey)(accountId);
+        return privateKey ? (0, identityDerivations_1.deriveScopedSeedFromKey)(privateKey, info) : null;
+    }
     /**
      * Sign a 32-byte digest (a transaction sighash, lowercase hex) with the
      * identity's social-receive child key `index`: the non-hardened BIP32 child
@@ -2643,16 +2673,30 @@ class KeyManager {
      * signature is RFC 6979, low-S, DER hex; `publicKey` is the child's
      * compressed public key for the scriptSig.
      *
-     * Key source: as {@link deriveScopedSeed}. On Android outside Commons the
-     * signature comes from Commons, which allows it for the wallet app only.
+     * Key source: as {@link deriveScopedSeed}, including `opts.accountId` for an
+     * organization's key (ADR 0061 D6). On Android outside Commons the signature
+     * comes from Commons, which allows it for the wallet app only.
      *
      * @returns the signature, or `null` on web / when no identity key is
      *          available to this app.
      */
-    static async signSocialReceive(index, digest) {
+    static async signSocialReceive(index, digest, opts) {
         if (isWebPlatform()) {
             return null;
         }
+        const accountId = opts?.accountId;
+        if (accountId !== undefined) {
+            // An organization key (ADR 0061 D6); never the personal one in its place.
+            if (!(0, organizationKeys_1.isOrganizationAccountId)(accountId)) {
+                return null;
+            }
+            if ((0, platform_1.isAndroid)() && !KeyManager.identitySignerStore) {
+                const bridge = await (0, protocol_1.loadCommonsIdentityBridge)();
+                return (await bridge?.signSocialReceive(index, digest, accountId)) ?? null;
+            }
+            const organizationKey = await (0, organizationKeys_1.getOrganizationPrivateKey)(accountId);
+            return organizationKey ? (0, identityDerivations_1.signSocialReceiveDigest)(organizationKey, index, digest) : null;
+        }
         if ((0, platform_1.isAndroid)() && !KeyManager.identitySignerStore) {
             // Every app but Commons: Commons signs.
             const bridge = await (0, protocol_1.loadCommonsIdentityBridge)();

package/dist/cjs/crypto/organizationKeys.js

@@ -0,0 +1,349 @@
+"use strict";
+/**
+ * Organization keys on the device (ADR 0061 D6).
+ *
+ * An organization's identity key is created in Commons by one of its owners or
+ * admins, from a fresh 24-word phrase (`seed[0:32]`, the personal-root
+ * derivation), and is published as the organization's DID `#key-1`. Commons
+ * holds it beside the person's own root, under the organization's account id;
+ * other Oxy apps reach it the way they reach the personal identity, by
+ * derivation and never by the key:
+ *
+ * - iOS: the keychain access group `group.so.oxy.shared`, like the personal
+ *   shared slot. Only Commons writes it.
+ * - Android: Commons' own expo-secure-store slot, mirrored into the identity
+ *   signer store (`./identitySigner`) that Commons' identity host answers
+ *   `accountId` requests from. Every other app asks Commons over IPC
+ *   (`loadCommonsIdentityBridge`), and never gets the key.
+ *
+ * The phrase is kept only in Commons, on the device that created or imported
+ * it, so an owner can show it to another owner (ADR 0061 D5); it never reaches
+ * the keychain group, an IPC answer or a log.
+ *
+ * This module imports nothing from `./keyManager` (which imports it): the
+ * signer store comes from `./identitySigner`'s registry.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isOrganizationAccountId = isOrganizationAccountId;
+exports.isHealthyOrganizationKeyPair = isHealthyOrganizationKeyPair;
+exports.generateOrganizationKey = generateOrganizationKey;
+exports.organizationKeyFromPhrase = organizationKeyFromPhrase;
+exports.storeOrganizationKey = storeOrganizationKey;
+exports.getOrganizationPublicKey = getOrganizationPublicKey;
+exports.getOrganizationPrivateKey = getOrganizationPrivateKey;
+exports.getOrganizationRecoveryPhrase = getOrganizationRecoveryPhrase;
+exports.listOrganizationKeys = listOrganizationKeys;
+exports.deleteOrganizationKey = deleteOrganizationKey;
+exports.syncOrganizationKeys = syncOrganizationKeys;
+const bip39_1 = require("@scure/bip39");
+const english_js_1 = require("@scure/bip39/wordlists/english.js");
+const protocol_1 = require("@oxy.so/protocol");
+const secp256k1_1 = require("@oxy.so/protocol/secp256k1");
+const logger_1 = require("../logger");
+const platform_1 = require("../utils/platform");
+const identitySigner_1 = require("./identitySigner");
+/** Same set the server's account ids come from: a legacy 24-hex id or a lowercase uuid. */
+const ACCOUNT_ID = /^(?:[0-9a-f]{24}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/;
+const IOS_KEYCHAIN_GROUP = 'group.so.oxy.shared';
+/** Android, Commons-local: its own Keystore key, shared with no personal slot. */
+const ANDROID_KEYCHAIN_SERVICE = 'oxy_org_identity';
+const MNEMONIC_KEYCHAIN_SERVICE = 'oxy_org_identity_mnemonic';
+const INDEX_KEYCHAIN_SERVICE = 'oxy_org_identity_index';
+const INDEX_STORAGE_KEY = 'oxy_org_identity_index_v1';
+const ORGANIZATION_PHRASE_WORDS = 24;
+/** Whether `value` is an account id an organization key can be stored under. */
+function isOrganizationAccountId(value) {
+    return ACCOUNT_ID.test(value);
+}
+function assertAccountId(accountId) {
+    if (!isOrganizationAccountId(accountId)) {
+        throw new Error('organization key: accountId must be a 24-hex or uuid account id');
+    }
+}
+const privateKeyName = (accountId) => `oxy_org_identity_private_key.${accountId}`;
+const publicKeyName = (accountId) => `oxy_org_identity_public_key.${accountId}`;
+const mnemonicName = (accountId) => `oxy_org_identity_mnemonic.${accountId}`;
+function toHex(bytes) {
+    return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+}
+/** Lowercase uncompressed public key of `privateKey`. */
+function publicKeyOf(privateKey) {
+    return (0, secp256k1_1.deriveSecp256k1PublicKey)((0, secp256k1_1.normalizeSecp256k1PrivateKey)(privateKey));
+}
+/** True only when both halves are well-formed AND the public key derives from the private one. */
+function isHealthyOrganizationKeyPair(privateKey, publicKey) {
+    if (!privateKey || !publicKey)
+        return false;
+    if (!(0, secp256k1_1.isValidSecp256k1PrivateKey)(privateKey) || !(0, secp256k1_1.isValidSecp256k1PublicKey)(publicKey)) {
+        return false;
+    }
+    try {
+        return publicKeyOf(privateKey) === (0, secp256k1_1.normalizeSecp256k1PublicKey)(publicKey);
+    }
+    catch {
+        return false;
+    }
+}
+function normalizePhrase(phrase) {
+    return phrase.trim().toLowerCase().split(/\s+/).join(' ');
+}
+async function pairFromPhrase(phrase) {
+    const normalized = normalizePhrase(phrase);
+    if (normalized.split(' ').length !== ORGANIZATION_PHRASE_WORDS ||
+        !(0, bip39_1.validateMnemonic)(normalized, english_js_1.wordlist)) {
+        throw new Error('organization key: not a valid 24-word recovery phrase');
+    }
+    const seed = await (0, bip39_1.mnemonicToSeed)(normalized);
+    const privateKey = toHex(seed.subarray(0, 32));
+    return { privateKey, publicKey: publicKeyOf(privateKey) };
+}
+/**
+ * A fresh organization key: a 24-word phrase and the pair derived from it
+ * exactly as a personal root is (`seed[0:32]`). Stores NOTHING: the caller shows
+ * the phrase, links the key (`oxy.accounts.identityKey`), and only then calls
+ * {@link storeOrganizationKey}.
+ */
+async function generateOrganizationKey() {
+    const mnemonic = (0, bip39_1.generateMnemonic)(english_js_1.wordlist, 256);
+    return { mnemonic, ...(await pairFromPhrase(mnemonic)) };
+}
+/**
+ * The pair a 24-word organization phrase derives. Stores nothing; the caller
+ * checks the public key against the organization's DID `#key-1` before keeping
+ * it (ADR 0061 D5).
+ */
+async function organizationKeyFromPhrase(phrase) {
+    return pairFromPhrase(phrase);
+}
+async function secureStore() {
+    return (0, protocol_1.loadSecureStore)();
+}
+async function readIndex(store) {
+    const raw = await store.getItemAsync(INDEX_STORAGE_KEY, {
+        keychainService: INDEX_KEYCHAIN_SERVICE,
+    });
+    if (!raw)
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed)
+            ? parsed.filter((id) => typeof id === 'string' && isOrganizationAccountId(id))
+            : [];
+    }
+    catch (error) {
+        logger_1.logger.warn('Organization key index unreadable; treating as empty', {
+            component: 'OrganizationKeys',
+            error: error instanceof Error ? error.name : 'unknown',
+        });
+        return [];
+    }
+}
+async function writeIndex(store, ids) {
+    await store.setItemAsync(INDEX_STORAGE_KEY, JSON.stringify([...new Set(ids)].sort()), {
+        keychainService: INDEX_KEYCHAIN_SERVICE,
+    });
+}
+/** Where this platform keeps the pair: the iOS keychain group, or Commons' own Android slot. */
+function pairOptions(store, forPrivateWrite) {
+    if ((0, platform_1.isIOS)()) {
+        return forPrivateWrite
+            ? {
+                keychainAccessible: store.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
+                keychainAccessGroup: IOS_KEYCHAIN_GROUP,
+            }
+            : { keychainAccessGroup: IOS_KEYCHAIN_GROUP };
+    }
+    return forPrivateWrite
+        ? {
+            keychainAccessible: store.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
+            keychainService: ANDROID_KEYCHAIN_SERVICE,
+        }
+        : { keychainService: ANDROID_KEYCHAIN_SERVICE };
+}
+/** The pair from this app's own storage (iOS group; Android Commons slot, then signer store). */
+async function readLocalPair(accountId) {
+    if ((0, platform_1.isWeb)())
+        return null;
+    if ((0, platform_1.isAndroid)()) {
+        const signer = (0, identitySigner_1.registeredIdentitySignerStore)();
+        if (!signer)
+            return null; // Only Commons holds organization keys on Android.
+        const store = await secureStore();
+        const options = pairOptions(store, false);
+        const privateKey = await store.getItemAsync(privateKeyName(accountId), options);
+        const publicKey = await store.getItemAsync(publicKeyName(accountId), options);
+        if (privateKey && publicKey && isHealthyOrganizationKeyPair(privateKey, publicKey)) {
+            return {
+                privateKey: (0, secp256k1_1.normalizeSecp256k1PrivateKey)(privateKey),
+                publicKey: (0, secp256k1_1.normalizeSecp256k1PublicKey)(publicKey),
+            };
+        }
+        // The signer store is a rung: a wiped expo-secure-store slot still has it.
+        const mirrored = (await signer.readOrganization?.(accountId)) ?? null;
+        return mirrored && isHealthyOrganizationKeyPair(mirrored.privateKey, mirrored.publicKey)
+            ? mirrored
+            : null;
+    }
+    if (!(0, platform_1.isIOS)())
+        return null;
+    const store = await secureStore();
+    const options = pairOptions(store, false);
+    const privateKey = await store.getItemAsync(privateKeyName(accountId), options);
+    const publicKey = await store.getItemAsync(publicKeyName(accountId), options);
+    return privateKey && publicKey && isHealthyOrganizationKeyPair(privateKey, publicKey)
+        ? {
+            privateKey: (0, secp256k1_1.normalizeSecp256k1PrivateKey)(privateKey),
+            publicKey: (0, secp256k1_1.normalizeSecp256k1PublicKey)(publicKey),
+        }
+        : null;
+}
+/**
+ * Keep an organization key on this device. Commons only: on Android it needs
+ * the identity signer store Commons registers, so the identity host can serve
+ * it; on iOS only Commons calls it (the keychain group is shared).
+ *
+ * Refuses a pair whose public key does not derive from its private key, and a
+ * phrase that does not derive the pair. Overwrites whatever this device held for
+ * the organization (a replaced key is the caller's decision, ADR 0061 D7).
+ */
+async function storeOrganizationKey(accountId, key) {
+    assertAccountId(accountId);
+    if ((0, platform_1.isWeb)())
+        throw new Error('organization key: only a native device holds one');
+    if (!isHealthyOrganizationKeyPair(key.privateKey, key.publicKey)) {
+        throw new Error('organization key: the public key does not derive from the private key');
+    }
+    const privateKey = (0, secp256k1_1.normalizeSecp256k1PrivateKey)(key.privateKey);
+    const publicKey = (0, secp256k1_1.normalizeSecp256k1PublicKey)(key.publicKey);
+    if (key.mnemonic !== undefined) {
+        const fromPhrase = await pairFromPhrase(key.mnemonic);
+        if (fromPhrase.publicKey !== publicKey) {
+            throw new Error('organization key: the phrase derives a different key');
+        }
+    }
+    const signer = (0, platform_1.isAndroid)() ? (0, identitySigner_1.registeredIdentitySignerStore)() : null;
+    if ((0, platform_1.isAndroid)() && !signer?.writeOrganization) {
+        throw new Error('On Android only Commons holds organization keys; this app has no identity signer store for them.');
+    }
+    const store = await secureStore();
+    await store.setItemAsync(privateKeyName(accountId), privateKey, pairOptions(store, true));
+    await store.setItemAsync(publicKeyName(accountId), publicKey, pairOptions(store, false));
+    if (signer?.writeOrganization &&
+        !(await signer.writeOrganization(accountId, privateKey, publicKey))) {
+        throw new Error(`The identity signer store (${signer.name}) did not confirm the organization key.`);
+    }
+    if (key.mnemonic !== undefined) {
+        await store.setItemAsync(mnemonicName(accountId), normalizePhrase(key.mnemonic), {
+            keychainService: MNEMONIC_KEYCHAIN_SERVICE,
+            keychainAccessible: store.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
+        });
+    }
+    else {
+        await store.deleteItemAsync(mnemonicName(accountId), {
+            keychainService: MNEMONIC_KEYCHAIN_SERVICE,
+        });
+    }
+    await writeIndex(store, [...(await readIndex(store)), accountId]);
+}
+/**
+ * The organization's public key as THIS device can reach it, or `null`.
+ * iOS: the keychain group. Android: Commons' own slot inside Commons, and
+ * Commons' identity host (`describe` with `accountId`) everywhere else. Compare
+ * it with the organization's DID `#key-1` before receiving (Peable ADR 0002).
+ */
+async function getOrganizationPublicKey(accountId) {
+    if (!isOrganizationAccountId(accountId) || (0, platform_1.isWeb)())
+        return null;
+    try {
+        if ((0, platform_1.isAndroid)() && !(0, identitySigner_1.registeredIdentitySignerStore)()) {
+            const bridge = await (0, protocol_1.loadCommonsIdentityBridge)();
+            const description = (await bridge?.describe(accountId)) ?? null;
+            return description?.accountId === accountId ? description.publicKey : null;
+        }
+        return (await readLocalPair(accountId))?.publicKey ?? null;
+    }
+    catch (error) {
+        logger_1.logger.warn('Failed to read an organization public key', {
+            component: 'OrganizationKeys',
+            error: error instanceof Error ? error.name : 'unknown',
+        });
+        return null;
+    }
+}
+/**
+ * The organization's private key, where this app may hold it: Commons (both
+ * platforms) and, on iOS, the keychain group. `null` on Android outside
+ * Commons. Use it to sign within the app only; never transmit it.
+ */
+async function getOrganizationPrivateKey(accountId) {
+    if (!isOrganizationAccountId(accountId))
+        return null;
+    try {
+        return (await readLocalPair(accountId))?.privateKey ?? null;
+    }
+    catch (error) {
+        logger_1.logger.warn('Failed to read an organization private key', {
+            component: 'OrganizationKeys',
+            error: error instanceof Error ? error.name : 'unknown',
+        });
+        return null;
+    }
+}
+/** The organization's phrase, if this device created or imported it with one. Commons only. */
+async function getOrganizationRecoveryPhrase(accountId) {
+    if (!isOrganizationAccountId(accountId) || (0, platform_1.isWeb)())
+        return null;
+    const store = await secureStore();
+    return store.getItemAsync(mnemonicName(accountId), {
+        keychainService: MNEMONIC_KEYCHAIN_SERVICE,
+    });
+}
+/** The organizations this device keeps a key for (Commons' own index). */
+async function listOrganizationKeys() {
+    if ((0, platform_1.isWeb)())
+        return [];
+    return readIndex(await secureStore());
+}
+/** Forget an organization key on this device: its pair, its phrase, its signer copy and its index entry. */
+async function deleteOrganizationKey(accountId) {
+    assertAccountId(accountId);
+    if ((0, platform_1.isWeb)())
+        return;
+    const store = await secureStore();
+    const options = pairOptions(store, false);
+    await store.deleteItemAsync(privateKeyName(accountId), options);
+    await store.deleteItemAsync(publicKeyName(accountId), options);
+    await store.deleteItemAsync(mnemonicName(accountId), {
+        keychainService: MNEMONIC_KEYCHAIN_SERVICE,
+    });
+    const signer = (0, platform_1.isAndroid)() ? (0, identitySigner_1.registeredIdentitySignerStore)() : null;
+    await signer?.clearOrganization?.(accountId);
+    await writeIndex(store, (await readIndex(store)).filter((id) => id !== accountId));
+}
+/**
+ * Commons on Android: copy every held organization key into the identity
+ * signer store again, so the identity host answers for it after that file was
+ * rebuilt (its self-heal leaves it empty). Call on every boot, beside
+ * `KeyManager.syncSharedIdentity`. Resolves how many it mirrored. Elsewhere 0.
+ */
+async function syncOrganizationKeys() {
+    const signer = (0, platform_1.isAndroid)() ? (0, identitySigner_1.registeredIdentitySignerStore)() : null;
+    if (!signer?.writeOrganization || !signer.readOrganization)
+        return 0;
+    const store = await secureStore();
+    let mirrored = 0;
+    for (const accountId of await readIndex(store)) {
+        const options = pairOptions(store, false);
+        const privateKey = await store.getItemAsync(privateKeyName(accountId), options);
+        const publicKey = await store.getItemAsync(publicKeyName(accountId), options);
+        if (!privateKey || !publicKey || !isHealthyOrganizationKeyPair(privateKey, publicKey))
+            continue;
+        const current = await signer.readOrganization(accountId);
+        if (current?.publicKey.toLowerCase() === publicKey.toLowerCase())
+            continue;
+        if (await signer.writeOrganization(accountId, (0, secp256k1_1.normalizeSecp256k1PrivateKey)(privateKey), publicKey.toLowerCase())) {
+            mirrored += 1;
+        }
+    }
+    return mirrored;
+}