mindoodb 0.0.72 → 0.0.74

package/dist/core/BaseMindooTenantDirectory.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.BaseMindooTenantDirectory = void 0;
 const types_1 = require("./types");
 const timeSource_1 = require("./utils/timeSource");
+const singleFlight_1 = require("./utils/singleFlight");
 const logging_1 = require("./logging");
 const grantKeys_1 = require("./accesscontrol/grantKeys");
 const types_2 = require("./accesscontrol/types");
@@ -14,10 +15,7 @@ const evaluate_1 = require("./accesscontrol/evaluate");
 const RSAEncryption_1 = require("./crypto/RSAEncryption");
 const encryptedFields_1 = require("./crypto/encryptedFields");
 const DIRECTORY_SYNC_INTERVAL_MS = 5 * 60 * 1000;
-// How long the resolved storage-format floor (`requireMetadataSignatureSince`)
-// is reused before re-reading the directory head. Short, because it is consulted
-// on the entry-verification hot path; the cutoff itself changes very rarely.
-const METADATA_SIGNATURE_CUTOFF_TTL_MS = 30 * 1000;
+const MAX_UNKNOWN_KEYS_TRACKED = 1000;
 /** De-duplicated union of two string lists, preserving first-seen order. */
 function unionStrings(existing, added) {
     return Array.from(new Set([...existing, ...added]));
@@ -49,6 +47,13 @@ class BaseMindooTenantDirectory {
         // Cache for groups: key -> merged group data (key: lowercase groupName)
         // We store merged data separately to avoid mutating MindooDoc objects.
         this.groupsCache = new Map();
+        // Every group document seen, by doc id. Several documents can carry the same
+        // group name (offline creation on two devices); groupsCache is their merge,
+        // recomputed per name from this map so an incremental pass that sees only
+        // one of them does not drop the others' members.
+        this.groupDocsById = new Map();
+        // Monotonic counter giving group documents their "latest seen" order.
+        this.groupDocSeenCounter = 0;
         // Cache for key-distribution documents (acl_keydistribution_<keyId>), keyed by
         // keyId. Folded incrementally in updateUnifiedCache (singleton per keyId,
         // last-seen-wins; a deleted doc removes its entry). Powers the revoked-key
@@ -81,11 +86,33 @@ class BaseMindooTenantDirectory {
         this.lastTimeTravelChangeSeq = null;
         // Unified cache cursor for all document types
         this.unifiedCacheLastCursor = null;
+        // Directory index `changeSeq` the last completed updateUnifiedCache pass
+        // covered. Compared against the live index instead of the cursor, because
+        // the cursor can lag behind entries that iterateChangesSince skips.
+        this.unifiedCacheIndexChangeSeq = null;
+        this.unifiedCachePass = new singleFlight_1.SingleFlight(() => this.runUnifiedCachePass());
+        this.timeTravelPass = new singleFlight_1.SingleFlight(() => this.runTimeTravelPass());
+        // Set when the feed changed stored revisions; cleared only once the chain
+        // was rebuilt from them, so a pass that fails in between is redone.
+        this.timeTravelNeedsRebuild = false;
+        // Set by invalidateUnifiedCache; the next pass starts from scratch. A flag
+        // rather than resetting the cursor directly, which a running pass would
+        // overwrite with its own progress.
+        this.unifiedCacheResetRequested = false;
+        // Last store poll (syncStoreChanges) for trust validation. Polling only
+        // discovers entries this process has not seen yet; entries already in the
+        // directory index are applied via the changeSeq check, independent of time.
         this.lastDirectorySyncTimestamp = 0;
-        // Cached storage-format floor (`requireMetadataSignatureSince`) with re-entrancy
-        // guard; see getRequireMetadataSignatureSince.
+        // Unknown signing keys -> time their cache miss last polled the store. Keeps
+        // repeated lookups of a key that is not granted from polling the store (and,
+        // for remote stores, the server) on every call.
+        this.unknownKeyPolledAt = new Map();
+        // Cached storage-format floor (`requireMetadataSignatureSince`), keyed by the
+        // directory changefeed `changeSeq` it was resolved at, with re-entrancy guard;
+        // see getRequireMetadataSignatureSince.
         this.metadataSignatureCutoffCache = undefined;
-        this.metadataSignatureCutoffCachedAt = 0;
+        this.metadataSignatureCutoffResolved = false;
+        this.metadataSignatureCutoffChangeSeq = null;
         this.resolvingMetadataSignatureCutoff = false;
         this.tenant = tenant;
         // Create logger if not provided (for backward compatibility)
@@ -110,7 +137,7 @@ class BaseMindooTenantDirectory {
             // would otherwise go un-reconciled until the next network sync. Runs only
             // once per directory object (the creation branch); the driver's own
             // getDirectoryDB calls reuse the now-set instance and do not re-trigger.
-            void this.tenant.reconcileKeyDistributionsForCurrentUserSafe();
+            this.tenant.trackBackgroundTask(this.tenant.reconcileKeyDistributionsForCurrentUserSafe());
         }
         return this.directoryDB;
     }
@@ -436,31 +463,35 @@ class BaseMindooTenantDirectory {
                 return additionalResult;
             }
         }
-        // Refresh directory state at most once per interval — unless the caller
-        // forces a refresh (audit #4): the server push path must observe a freshly
-        // pushed revocation immediately rather than lagging by up to
-        // DIRECTORY_SYNC_INTERVAL_MS, which would let a just-revoked key keep
-        // pushing entries.
+        // Store poll: discovers entries this process has not seen yet, so it is
+        // throttled to once per interval — unless the caller forces it (audit #4):
+        // the server push path must observe a freshly pushed revocation
+        // immediately, which would otherwise let a just-revoked key keep pushing.
         const now = Date.now();
-        let didSync = false;
+        let didPoll = false;
         if (opts?.forceRefresh ||
             now - this.lastDirectorySyncTimestamp >= DIRECTORY_SYNC_INTERVAL_MS) {
-            const directoryDB = await this.getDirectoryDB();
-            await directoryDB.syncStoreChanges();
-            await this.updateUnifiedCache();
-            this.lastDirectorySyncTimestamp = now;
-            didSync = true;
+            await this.pollDirectoryStore();
+            didPoll = true;
         }
+        // Apply whatever the directory index already holds (local writes, pulls,
+        // the poll above). Cheap and time-independent: a grant or revocation this
+        // process knows about takes effect on the next validation.
+        await this.applyDirectoryIndexChanges();
         let cachedResult = this.trustedKeysCache.get(publicKey);
-        if (cachedResult === undefined && !didSync) {
-            // Cache miss and not synced yet - sync once and re-check immediately.
-            const directoryDB = await this.getDirectoryDB();
-            await directoryDB.syncStoreChanges();
-            await this.updateUnifiedCache();
-            this.lastDirectorySyncTimestamp = Date.now();
+        if (cachedResult === undefined && !didPoll && this.mayPollForUnknownKey(publicKey, now)) {
+            // Cache miss: the grant may sit in the store without this process
+            // having seen it yet, so poll once and re-check.
+            await this.pollDirectoryStore();
+            await this.applyDirectoryIndexChanges();
             cachedResult = this.trustedKeysCache.get(publicKey);
+            didPoll = true;
+        }
+        if (cachedResult === undefined && didPoll) {
+            this.recordUnknownKeyPoll(publicKey, now);
         }
         if (cachedResult !== undefined) {
+            this.unknownKeyPolledAt.delete(publicKey);
             this.logger.debug(`Public key validation result (from cache): ${cachedResult}`);
             return cachedResult;
         }
@@ -469,26 +500,84 @@ class BaseMindooTenantDirectory {
         return false;
     }
     /**
-     * Force-refresh the directory trust caches from the (already synced local)
-     * directory store, bypassing the TTL used by
-     * {@link validatePublicSigningKey}. Called right after a directory pull so
-     * newly arrived grantaccess documents are diffed immediately and the
-     * author-trust reconcile of open databases fires without waiting up to
-     * DIRECTORY_SYNC_INTERVAL_MS for the next cache-miss validation.
+     * Whether a cache miss for `publicKey` may poll the store. A key that missed
+     * within the last DIRECTORY_SYNC_INTERVAL_MS does not poll again; it still
+     * becomes trusted as soon as its grant reaches the directory index.
      */
-    async refreshTrustCaches() {
+    mayPollForUnknownKey(publicKey, now) {
+        const polledAt = this.unknownKeyPolledAt.get(publicKey);
+        return polledAt === undefined || now - polledAt >= DIRECTORY_SYNC_INTERVAL_MS;
+    }
+    /** Remember that the store was polled and `publicKey` was still unknown. */
+    recordUnknownKeyPoll(publicKey, now) {
+        this.unknownKeyPolledAt.delete(publicKey);
+        if (this.unknownKeyPolledAt.size >= MAX_UNKNOWN_KEYS_TRACKED) {
+            const oldest = this.unknownKeyPolledAt.keys().next().value;
+            if (oldest !== undefined)
+                this.unknownKeyPolledAt.delete(oldest);
+        }
+        this.unknownKeyPolledAt.set(publicKey, now);
+    }
+    /** Read new directory entries from the store into the directory index. */
+    async pollDirectoryStore() {
         const directoryDB = await this.getDirectoryDB();
         await directoryDB.syncStoreChanges();
-        await this.updateUnifiedCache();
         this.lastDirectorySyncTimestamp = Date.now();
     }
     /**
-     * Update all caches (trusted keys, groups, settings) by processing new changes since the last cursor.
-     * This unified method processes all document types in a single loop for efficiency.
-     * No signature verification is needed since the DB already enforces admin-only access.
+     * Bring the unified cache up to the directory index when the index has
+     * advanced since the last pass. No store access.
+     */
+    async applyDirectoryIndexChanges() {
+        const directoryDB = await this.getDirectoryDB();
+        const latestSeq = directoryDB.getLatestChangeCursor?.()?.changeSeq ?? null;
+        if (this.unifiedCacheLastCursor === null ||
+            this.unifiedCacheResetRequested ||
+            latestSeq !== this.unifiedCacheIndexChangeSeq) {
+            await this.updateUnifiedCache();
+        }
+    }
+    /**
+     * Refresh the directory trust caches from the directory index right after a
+     * directory pull (which already read the pulled entries into the index), so
+     * newly arrived grantaccess documents are diffed immediately and the
+     * author-trust reconcile of open databases fires.
+     */
+    async refreshTrustCaches() {
+        await this.applyDirectoryIndexChanges();
+    }
+    /**
+     * Bring all caches (trusted keys, groups, settings) up to date with the
+     * directory index.
+     *
+     * Single-flight: passes mutate shared caches across awaits, so overlapping
+     * passes would read each other's half-built state and multiply the work
+     * under load. A caller arriving while a pass runs waits for one follow-up
+     * pass that starts after it arrived (so it observes its own preceding
+     * writes); all such callers share that follow-up.
+     */
+    updateUnifiedCache() {
+        return this.unifiedCachePass.run();
+    }
+    /** Make the next unified-cache pass rebuild every cache from scratch. */
+    invalidateUnifiedCache() {
+        this.unifiedCacheResetRequested = true;
+    }
+    /**
+     * One pass over the directory changes since the last cursor. Processes all
+     * document types in a single loop. No signature verification is needed
+     * since the DB already enforces admin-only access. Only called through
+     * {@link updateUnifiedCache}.
      */
-    async updateUnifiedCache() {
+    async runUnifiedCachePass() {
         const directoryDB = await this.getDirectoryDB();
+        // Captured before iterating: entries added during the pass carry a higher
+        // changeSeq, so the next applyDirectoryIndexChanges picks them up.
+        const indexChangeSeqAtStart = directoryDB.getLatestChangeCursor?.()?.changeSeq ?? null;
+        if (this.unifiedCacheResetRequested) {
+            this.unifiedCacheResetRequested = false;
+            this.unifiedCacheLastCursor = null;
+        }
         // Determine starting cursor (null = process all, otherwise incremental)
         const startCursor = this.unifiedCacheLastCursor;
         // Snapshot the trusted signing keys BEFORE any rebuild so newly granted
@@ -496,19 +585,33 @@ class BaseMindooTenantDirectory {
         // author-trust reconcile of open databases (entries previously skipped
         // because their author was unknown get re-materialized).
         const previouslyTrustedKeys = new Set(this.trustedKeysCache.keys());
-        // If processing from the beginning, clear all caches first
-        if (startCursor === null) {
-            this.trustedKeysCache.clear();
-            this.grantDocIdToSigningKeys.clear();
-            this.userLookupCache.clear();
-            this.wipeKeyToGrantDocId.clear();
-            this.tenantSettingsCache = null;
-            this.dbSettingsCache.clear();
-            this.groupsCache.clear();
-            this.keyDistributionCache.clear();
-        }
-        // Track group documents by name for merging (handles offline sync scenarios)
-        const groupDocsByName = new Map();
+        // Build and swap. The pass awaits between documents, and readers (also
+        // ones iterating a cache across their own awaits) must never see a cache
+        // that a full rebuild has cleared but not refilled. A full rebuild fills
+        // fresh maps and installs them at the end, synchronously; an incremental
+        // pass only adds/overwrites entries in place. The cursor is committed at
+        // the end too, so a pass that throws midway is simply redone (all updates
+        // are idempotent) instead of leaving its documents half-applied.
+        const fullRebuild = startCursor === null;
+        const grantDocIdToSigningKeys = fullRebuild ? new Map() : this.grantDocIdToSigningKeys;
+        const userLookupCache = fullRebuild ? new Map() : this.userLookupCache;
+        const wipeKeyToGrantDocId = fullRebuild ? new Map() : this.wipeKeyToGrantDocId;
+        let tenantSettingsCache = fullRebuild ? null : this.tenantSettingsCache;
+        const dbSettingsCache = fullRebuild ? new Map() : this.dbSettingsCache;
+        const groupDocsById = fullRebuild ? new Map() : this.groupDocsById;
+        const groupsCache = fullRebuild ? new Map() : this.groupsCache;
+        const keyDistributionCache = fullRebuild
+            ? new Map()
+            : this.keyDistributionCache;
+        const appDistributionCache = fullRebuild
+            ? new Map()
+            : this.appDistributionCache;
+        const syncSetupPolicyCache = fullRebuild
+            ? new Map()
+            : this.syncSetupPolicyCache;
+        let lastCursor = startCursor;
+        // Group names whose merged entry must be recomputed at the end of the pass.
+        const dirtyGroupNames = new Set();
         let sawGrantAccessChange = false;
         // Process changes (documents are returned in order by lastModified, oldest to newest)
         for await (const { doc, cursor } of directoryDB.iterateChangesSince(startCursor)) {
@@ -525,7 +628,7 @@ class BaseMindooTenantDirectory {
                 // to wipe. Maps each wipe-targeted signing key to this grant doc's id.
                 if (data.type === "grantaccess") {
                     for (const wipeKey of (0, grantKeys_1.extractWipeRequestedSigningKeys)(data)) {
-                        this.wipeKeyToGrantDocId.set(wipeKey, doc.getId());
+                        wipeKeyToGrantDocId.set(wipeKey, doc.getId());
                     }
                 }
                 if (data.type === "grantaccess") {
@@ -537,7 +640,7 @@ class BaseMindooTenantDirectory {
                     // all grant documents once the change loop completes, so a key
                     // dropped from this document is no longer trusted unless another
                     // grant still lists it.
-                    this.grantDocIdToSigningKeys.set(doc.getId(), grantedSigningKeys);
+                    grantDocIdToSigningKeys.set(doc.getId(), grantedSigningKeys);
                     if (grantedSigningKeys.length > 0) {
                         // One cache entry per device key pair (§6.5). Reusing a single
                         // lookup built from keys[0] for every signing key would make the
@@ -546,32 +649,45 @@ class BaseMindooTenantDirectory {
                         // then fails with a WebCrypto OperationError on the iPad.
                         const lookups = await this.buildUserLookups(data);
                         for (const lookup of lookups) {
-                            this.userLookupCache.set(lookup.signingPublicKey, lookup);
+                            userLookupCache.set(lookup.signingPublicKey, lookup);
                         }
                     }
                 }
             }
-            // Process group documents
+            // Process group documents. The previous name of a re-seen doc is marked
+            // dirty too, so a renamed or no-longer-group doc leaves its old merge.
+            const previousGroupEntry = groupDocsById.get(doc.getId());
+            if (previousGroupEntry) {
+                dirtyGroupNames.add(previousGroupEntry.normalizedName);
+            }
             if (data.form === "group" &&
                 data.type === "group" &&
                 data.groupName &&
                 typeof data.groupName === "string") {
                 const normalizedGroupName = this.normalizeGroupName(data.groupName);
-                if (!groupDocsByName.has(normalizedGroupName)) {
-                    groupDocsByName.set(normalizedGroupName, []);
-                }
-                groupDocsByName.get(normalizedGroupName).push(doc);
+                const stringArray = (value) => Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
+                groupDocsById.set(doc.getId(), {
+                    normalizedName: normalizedGroupName,
+                    membersHashes: stringArray(data.members_hashes),
+                    membersEncrypted: stringArray(data.members_encrypted),
+                    deleted: doc.isDeleted(),
+                    seenOrder: ++this.groupDocSeenCounter,
+                });
+                dirtyGroupNames.add(normalizedGroupName);
+            }
+            else if (previousGroupEntry) {
+                groupDocsById.delete(doc.getId());
             }
             // Process tenant settings (no signature verification needed - Automerge handles merging)
             if (data.form === "tenantsettings") {
                 // Just overwrite - last one seen will be the latest
-                this.tenantSettingsCache = doc;
+                tenantSettingsCache = doc;
             }
             // Process DB settings (no signature verification needed - Automerge handles merging)
             if (data.form === "dbsettings" && data.dbid && typeof data.dbid === "string") {
                 const dbId = data.dbid;
                 // Just overwrite - last one seen will be the latest
-                this.dbSettingsCache.set(dbId, doc);
+                dbSettingsCache.set(dbId, doc);
             }
             // Process key-distribution documents (acl_keydistribution_<keyId>); a
             // singleton per keyId. Cache head state here so the revoked-key resolver
@@ -580,10 +696,10 @@ class BaseMindooTenantDirectory {
             if (data.type === types_3.KEY_DISTRIBUTION_TYPE && typeof data.keyId === "string") {
                 const keyId = data.keyId;
                 if (doc.isDeleted()) {
-                    this.keyDistributionCache.delete(keyId);
+                    keyDistributionCache.delete(keyId);
                 }
                 else {
-                    this.keyDistributionCache.set(keyId, {
+                    keyDistributionCache.set(keyId, {
                         keyVersions: Array.isArray(data.keyVersions)
                             ? data.keyVersions
                                 .filter((v) => !!v && typeof v.fingerprint === "string")
@@ -608,11 +724,11 @@ class BaseMindooTenantDirectory {
             if (data.type === types_3.APP_DISTRIBUTION_TYPE && typeof data.appId === "string") {
                 const appId = data.appId;
                 if (doc.isDeleted()) {
-                    this.appDistributionCache.delete(appId);
+                    appDistributionCache.delete(appId);
                 }
                 else {
                     const stringArray = (value) => Array.isArray(value) ? value.filter((h) => typeof h === "string") : [];
-                    this.appDistributionCache.set(appId, {
+                    appDistributionCache.set(appId, {
                         pushto_users_hashes: stringArray(data.pushto_users_hashes),
                         pushto_groups_hashes: stringArray(data.pushto_groups_hashes),
                         pullfrom_users_hashes: stringArray(data.pullfrom_users_hashes),
@@ -627,11 +743,11 @@ class BaseMindooTenantDirectory {
             if (data.type === types_3.SYNC_SETUP_POLICY_TYPE && typeof data.policyId === "string") {
                 const policyId = data.policyId;
                 if (doc.isDeleted()) {
-                    this.syncSetupPolicyCache.delete(policyId);
+                    syncSetupPolicyCache.delete(policyId);
                 }
                 else {
                     const stringArray = (value) => Array.isArray(value) ? value.filter((h) => typeof h === "string") : [];
-                    this.syncSetupPolicyCache.set(policyId, {
+                    syncSetupPolicyCache.set(policyId, {
                         mode: data.mode === "permanent" ? "permanent" : "initial",
                         pushto_users_hashes: stringArray(data.pushto_users_hashes),
                         pushto_groups_hashes: stringArray(data.pushto_groups_hashes),
@@ -640,21 +756,74 @@ class BaseMindooTenantDirectory {
                     });
                 }
             }
-            // Update cursor after each document
-            this.unifiedCacheLastCursor = cursor;
+            lastCursor = cursor;
         }
+        // From here to the end of the method there is no await: readers see
+        // either the previous state or this pass's complete state.
         // Rebuild the trusted signing-key set as the union of every grant
         // document's current keys (docs/accesscontrol.md §6.5). Revocation removes
         // keys from a grant, so a key absent from this union is no longer trusted;
         // validatePublicSigningKey treats "not present" as untrusted. This is
         // recomputed on every pass (full or incremental) because the per-grant map
         // is the source of truth and persists across incremental updates.
-        this.trustedKeysCache.clear();
-        for (const signingKeys of this.grantDocIdToSigningKeys.values()) {
+        const trustedKeysCache = new Map();
+        for (const signingKeys of grantDocIdToSigningKeys.values()) {
             for (const key of signingKeys) {
-                this.trustedKeysCache.set(key, true);
+                trustedKeysCache.set(key, true);
             }
         }
+        // Merge the group documents of every touched name (handles the same group
+        // created offline on several devices). A name is deleted as soon as any of
+        // its documents is deleted; docId points at the latest-seen document.
+        if (dirtyGroupNames.size > 0) {
+            const entriesByName = new Map();
+            for (const [docId, entry] of groupDocsById) {
+                if (!dirtyGroupNames.has(entry.normalizedName))
+                    continue;
+                let list = entriesByName.get(entry.normalizedName);
+                if (!list) {
+                    list = [];
+                    entriesByName.set(entry.normalizedName, list);
+                }
+                list.push([docId, entry]);
+            }
+            for (const normalizedGroupName of dirtyGroupNames) {
+                const entries = entriesByName.get(normalizedGroupName);
+                if (!entries || entries.some(([, entry]) => entry.deleted)) {
+                    groupsCache.delete(normalizedGroupName);
+                    continue;
+                }
+                let latest = entries[0];
+                const allMembersHashes = new Set();
+                const allMembersEncrypted = new Set();
+                for (const item of entries) {
+                    if (item[1].seenOrder > latest[1].seenOrder)
+                        latest = item;
+                    for (const h of item[1].membersHashes)
+                        allMembersHashes.add(h);
+                    for (const e of item[1].membersEncrypted)
+                        allMembersEncrypted.add(e);
+                }
+                groupsCache.set(normalizedGroupName, {
+                    docId: latest[0],
+                    members_hashes: Array.from(allMembersHashes),
+                    members_encrypted: Array.from(allMembersEncrypted),
+                });
+            }
+        }
+        this.trustedKeysCache = trustedKeysCache;
+        this.grantDocIdToSigningKeys = grantDocIdToSigningKeys;
+        this.userLookupCache = userLookupCache;
+        this.wipeKeyToGrantDocId = wipeKeyToGrantDocId;
+        this.tenantSettingsCache = tenantSettingsCache;
+        this.dbSettingsCache = dbSettingsCache;
+        this.groupDocsById = groupDocsById;
+        this.groupsCache = groupsCache;
+        this.keyDistributionCache = keyDistributionCache;
+        this.appDistributionCache = appDistributionCache;
+        this.syncSetupPolicyCache = syncSetupPolicyCache;
+        this.unifiedCacheLastCursor = lastCursor;
+        this.unifiedCacheIndexChangeSeq = indexChangeSeqAtStart;
         // Author-trust hook: keys that just became trusted (new grantaccess docs)
         // may unblock entries that open databases skipped earlier because the
         // author was unknown. Notify the tenant so those documents get purged and
@@ -668,56 +837,11 @@ class BaseMindooTenantDirectory {
             }
         }
         if (newlyTrustedKeys.size > 0) {
-            void this.tenant.reconcileAuthorTrustChangesSafe(newlyTrustedKeys);
+            this.tenant.trackBackgroundTask(this.tenant.reconcileAuthorTrustChangesSafe(newlyTrustedKeys));
         }
         if (sawGrantAccessChange) {
             this.tenant.scheduleUserKeyReconcile?.();
         }
-        // Merge group documents with the same name
-        for (const [normalizedGroupName, docs] of groupDocsByName.entries()) {
-            // Collect all member hashes and encrypted values from all documents with this group name
-            const allMembersHashes = new Set();
-            const allMembersEncrypted = new Set();
-            let latestDoc = null;
-            let isDeleted = false;
-            for (const doc of docs) {
-                const data = doc.getData();
-                // Track the latest document (by iteration order, which is by lastModified)
-                latestDoc = doc;
-                // Check if document is deleted via lifecycle metadata.
-                if (doc.isDeleted()) {
-                    isDeleted = true;
-                }
-                // Use members_hashes for membership lookups.
-                if (data.members_hashes && Array.isArray(data.members_hashes)) {
-                    for (const memberHash of data.members_hashes) {
-                        if (typeof memberHash === "string") {
-                            allMembersHashes.add(memberHash);
-                        }
-                    }
-                }
-                if (data.members_encrypted && Array.isArray(data.members_encrypted)) {
-                    for (const encryptedMember of data.members_encrypted) {
-                        if (typeof encryptedMember === "string") {
-                            allMembersEncrypted.add(encryptedMember);
-                        }
-                    }
-                }
-            }
-            // If latest version is deleted, remove from cache
-            if (isDeleted) {
-                this.groupsCache.delete(normalizedGroupName);
-                continue;
-            }
-            // Store merged group data in cache (without mutating the MindooDoc)
-            if (latestDoc) {
-                this.groupsCache.set(normalizedGroupName, {
-                    docId: latestDoc.getId(),
-                    members_hashes: Array.from(allMembersHashes),
-                    members_encrypted: Array.from(allMembersEncrypted),
-                });
-            }
-        }
     }
     /**
      * The head time-travel directory-state node ("now"), after ensuring the chain
@@ -745,8 +869,15 @@ class BaseMindooTenantDirectory {
      * The (potentially expensive) feed rebuild is skipped when the directory's
      * changefeed cursor has not advanced since the previous build and no
      * un-witnessed revisions are pending a possible trusted-time re-stamp.
+     *
+     * Single-flight: the pass creates the index across an await and advances
+     * the shared index cursor per revision, so overlapping passes would create
+     * and register two indexes or interleave their feed reads.
      */
-    async ensureTimeTravelCurrent() {
+    ensureTimeTravelCurrent() {
+        return this.timeTravelPass.run();
+    }
+    async runTimeTravelPass() {
         const directoryDB = await this.getDirectoryDB();
         // Projection used to (re)build the chain from stored revisions in
         // trusted-time order. Captures this directory's group-name normalization.
@@ -789,13 +920,14 @@ class BaseMindooTenantDirectory {
         // (notably when a re-stamped entry is re-discovered with a `receivedAt`), so
         // we do not need to re-run the feed on every call just to refresh the
         // provisional `now` of un-witnessed entries.
-        if (this.lastTimeTravelChangeSeq !== null && latestSeq === this.lastTimeTravelChangeSeq) {
+        if (!this.timeTravelNeedsRebuild &&
+            this.lastTimeTravelChangeSeq !== null &&
+            latestSeq === this.lastTimeTravelChangeSeq) {
             return index;
         }
         // Incrementally advance the feed from the persisted cursor; the feed parks
         // the cursor before the earliest un-witnessed entry so those revisions are
         // re-discovered (and re-stamped/superseded as needed) on this resume.
-        let changed = false;
         for await (const rev of directoryDB.iterateChangeRevisionsSince(index.cursor)) {
             const revChanged = index.upsertRevision({
                 entryId: rev.entryId,
@@ -805,13 +937,16 @@ class BaseMindooTenantDirectory {
                 trustedTime: rev.trustedTime,
                 witnessed: rev.witnessed,
             }, rev.cursor);
-            changed = changed || revChanged;
+            if (revChanged) {
+                this.timeTravelNeedsRebuild = true;
+            }
         }
         // Replay all revisions into the chain in trusted-time order. This absorbs
         // out-of-order arrivals and supersessions (a re-emitted revision replaced its
         // prior record above) without any special-casing in the chain builder.
-        if (changed) {
+        if (this.timeTravelNeedsRebuild) {
             index.rebuild(project);
+            this.timeTravelNeedsRebuild = false;
         }
         this.lastTimeTravelChangeSeq = latestSeq;
         // Persist the observed changeSeq with the chain so the gate survives restart.
@@ -1002,28 +1137,34 @@ class BaseMindooTenantDirectory {
      * signature, or `undefined` when no floor is configured (fully backward
      * compatible). Tenant-level only, read from the `acl_defaultpolicy` head.
      *
-     * Cached with a short TTL and guarded against re-entrancy: resolving the
-     * cutoff loads the directory head, and directory materialization itself runs
-     * signature verification — without the guard a verify→resolve→materialize→
-     * verify cycle could recurse. During such re-entry we return the last known
-     * value (the directory store is anyway exempt from the floor by its callers).
+     * Cached until the directory changefeed `changeSeq` advances, so a newly set
+     * floor applies to the very next verification, and guarded against
+     * re-entrancy: resolving the cutoff loads the directory head, and directory
+     * materialization itself runs signature verification — without the guard a
+     * verify→resolve→materialize→verify cycle could recurse. During such re-entry
+     * we return the last known value (the directory store is anyway exempt from
+     * the floor by its callers).
      */
     async getRequireMetadataSignatureSince() {
-        const now = Date.now();
         if (this.resolvingMetadataSignatureCutoff) {
             return this.metadataSignatureCutoffCache;
         }
-        if (this.metadataSignatureCutoffCachedAt !== 0 &&
-            now - this.metadataSignatureCutoffCachedAt < METADATA_SIGNATURE_CUTOFF_TTL_MS) {
+        if (this.metadataSignatureCutoffResolved &&
+            this.directoryDB &&
+            (this.directoryDB.getLatestChangeCursor?.()?.changeSeq ?? null) ===
+                this.metadataSignatureCutoffChangeSeq) {
             return this.metadataSignatureCutoffCache;
         }
         this.resolvingMetadataSignatureCutoff = true;
         try {
+            const directoryDB = await this.getDirectoryDB();
+            const changeSeq = directoryDB.getLatestChangeCursor?.()?.changeSeq ?? null;
             const head = await this.getDirectoryStateHead();
             const since = head.defaultPolicy?.requireMetadataSignatureSince;
             this.metadataSignatureCutoffCache =
                 typeof since === "number" && Number.isFinite(since) ? since : undefined;
-            this.metadataSignatureCutoffCachedAt = now;
+            this.metadataSignatureCutoffChangeSeq = changeSeq;
+            this.metadataSignatureCutoffResolved = true;
         }
         finally {
             this.resolvingMetadataSignatureCutoff = false;
@@ -3237,7 +3378,7 @@ class BaseMindooTenantDirectory {
         });
         // Invalidate cache
         this.tenantSettingsCache = null;
-        this.unifiedCacheLastCursor = null;
+        this.invalidateUnifiedCache();
     }
     async changeDBSettings(dbId, changeFunc, administrationPrivateKey, administrationPrivateKeyPassword) {
         const baseTenant = this.tenant;
@@ -3266,7 +3407,7 @@ class BaseMindooTenantDirectory {
         });
         // Invalidate cache for this dbId
         this.dbSettingsCache.delete(dbId);
-        this.unifiedCacheLastCursor = null;
+        this.invalidateUnifiedCache();
     }
     async getGroups() {
         const directoryDB = await this.getDirectoryDB();
@@ -3308,6 +3449,11 @@ class BaseMindooTenantDirectory {
         // new usernames. Reads match both v1 and v2 forms (docs/accesscontrol.md §6.5).
         const newMembersHashes = await Promise.all(username.map(u => this.hashUsernameForWrite(u)));
         const newMembersEncrypted = await Promise.all(username.map(u => this.encryptGroupMemberForTenant(u)));
+        // Bring the cache up to date first: a stale miss (e.g. right after the
+        // previous call invalidated it) would create a second document for an
+        // existing group name.
+        await directoryDB.syncStoreChanges();
+        await this.updateUnifiedCache();
         // Get the actual document from the database (using cached docId if available)
         const cachedGroup = this.groupsCache.get(normalizedGroupName);
         let groupDoc;
@@ -3353,7 +3499,7 @@ class BaseMindooTenantDirectory {
         });
         // Invalidate cache for this group
         this.groupsCache.delete(normalizedGroupName);
-        this.unifiedCacheLastCursor = null;
+        this.invalidateUnifiedCache();
     }
     async removeUsersFromGroup(groupName, username, administrationPrivateKey, administrationPrivateKeyPassword) {
         const normalizedGroupName = this.normalizeGroupName(groupName);
@@ -3368,8 +3514,6 @@ class BaseMindooTenantDirectory {
             // Group doesn't exist, nothing to do
             return;
         }
-        // Load the actual document from the database
-        const groupDoc = await directoryDB.getDocument(cachedGroup.docId);
         const adminSigningKeyPair = {
             publicKey: baseTenant.getAdministrationPublicKey(),
             privateKey: administrationPrivateKey,
@@ -3377,36 +3521,47 @@ class BaseMindooTenantDirectory {
         // Compute hashes of usernames to remove. Include both legacy (v1) and
         // salted (v2) forms so members stored under either scheme are removed.
         const hashesToRemove = new Set((await Promise.all(username.map(u => this.usernameHashCandidates(u)))).flat());
-        // Remove users from members arrays
-        await directoryDB.changeDoc(groupDoc, async (d) => {
-            const data = d.getData();
-            if (!data.members_hashes || !Array.isArray(data.members_hashes) ||
-                !data.members_encrypted || !Array.isArray(data.members_encrypted)) {
-                return;
-            }
-            // Filter out members whose hashes match the ones to remove
-            // Keep arrays in sync by filtering indices
-            const indicesToKeep = [];
-            const hashesArray = data.members_hashes;
-            for (let i = 0; i < hashesArray.length; i++) {
-                if (!hashesToRemove.has(hashesArray[i])) {
-                    indicesToKeep.push(i);
+        // Membership is the union over every document carrying this group name,
+        // so the users must be removed from all of them, not only the latest.
+        const groupDocIds = new Set([cachedGroup.docId]);
+        for (const [docId, entry] of this.groupDocsById) {
+            if (entry.normalizedName === normalizedGroupName && !entry.deleted) {
+                groupDocIds.add(docId);
+            }
+        }
+        for (const groupDocId of groupDocIds) {
+            const groupDoc = await directoryDB.getDocument(groupDocId);
+            // Remove users from members arrays
+            await directoryDB.changeDoc(groupDoc, async (d) => {
+                const data = d.getData();
+                if (!data.members_hashes || !Array.isArray(data.members_hashes) ||
+                    !data.members_encrypted || !Array.isArray(data.members_encrypted)) {
+                    return;
                 }
-            }
-            const encryptedArray = data.members_encrypted;
-            data.members_hashes = indicesToKeep.map(i => hashesArray[i]);
-            data.members_encrypted = indicesToKeep.map(i => encryptedArray[i]);
-            // Ensure form, type, and groupName fields are always correct
-            data.form = "group";
-            data.type = "group";
-            data.groupName = normalizedGroupName;
-        }, {
-            signingKeyPair: adminSigningKeyPair,
-            signingKeyPassword: administrationPrivateKeyPassword,
-        });
+                // Filter out members whose hashes match the ones to remove
+                // Keep arrays in sync by filtering indices
+                const indicesToKeep = [];
+                const hashesArray = data.members_hashes;
+                for (let i = 0; i < hashesArray.length; i++) {
+                    if (!hashesToRemove.has(hashesArray[i])) {
+                        indicesToKeep.push(i);
+                    }
+                }
+                const encryptedArray = data.members_encrypted;
+                data.members_hashes = indicesToKeep.map(i => hashesArray[i]);
+                data.members_encrypted = indicesToKeep.map(i => encryptedArray[i]);
+                // Ensure form, type, and groupName fields are always correct
+                data.form = "group";
+                data.type = "group";
+                data.groupName = normalizedGroupName;
+            }, {
+                signingKeyPair: adminSigningKeyPair,
+                signingKeyPassword: administrationPrivateKeyPassword,
+            });
+        }
         // Invalidate cache for this group
         this.groupsCache.delete(normalizedGroupName);
-        this.unifiedCacheLastCursor = null;
+        this.invalidateUnifiedCache();
     }
     async deleteGroup(groupName, administrationPrivateKey, administrationPrivateKeyPassword) {
         const normalizedGroupName = this.normalizeGroupName(groupName);
@@ -3432,7 +3587,7 @@ class BaseMindooTenantDirectory {
         });
         // Remove from cache
         this.groupsCache.delete(normalizedGroupName);
-        this.unifiedCacheLastCursor = null;
+        this.invalidateUnifiedCache();
     }
     async getUserNamesList(username) {
         // Generate username variants (wildcards)