@1agh/maude 0.47.0 → 0.49.0

package/apps/studio/test/workspace-containment.test.ts

@@ -0,0 +1,258 @@
+// Cloud Phase 3 — the containment invariant's boot-assert (DDR-193 §2).
+//
+//   > No tenant-authored TSX is ever evaluated by vendor-operated compute.
+//
+// The thing being tested is a REFUSAL. So the tests that matter are the ones
+// that prove the gate fires: a cell exposing an export route, a canvas shell, a
+// runtime bundle, or shipping Playwright must not be able to start.
+//
+// The negative case matters just as much: none of this may fire outside
+// workspace mode, or every local dev-server stops booting.
+
+import { describe, expect, test } from 'bun:test';
+
+import {
+  assertContainment,
+  checkContainment,
+  FORBIDDEN_MODULES,
+  FORBIDDEN_ROUTE_PREFIXES,
+  formatContainmentFailure,
+  isForbiddenRoute,
+  isWorkspaceMode,
+  pruneForWorkspace,
+} from '../workspace-mode.ts';
+
+const CELL = { MAUDE_WORKSPACE_MODE: '1' } as NodeJS.ProcessEnv;
+const LAPTOP = {} as NodeJS.ProcessEnv;
+
+/** The routes a cell legitimately serves: sync + git + assets, nothing else. */
+const ALLOWED_ROUTES = [
+  '/_health',
+  '/_api/asset',
+  '/_api/comments',
+  '/_api/annotations',
+  '/_api/git-committers',
+  '/_config',
+  '/_ws',
+];
+
+describe('workspace mode detection', () => {
+  test('only MAUDE_WORKSPACE_MODE=1 turns it on', () => {
+    expect(isWorkspaceMode(CELL)).toBe(true);
+    expect(isWorkspaceMode(LAPTOP)).toBe(false);
+    expect(isWorkspaceMode({ MAUDE_WORKSPACE_MODE: 'true' })).toBe(false);
+    expect(isWorkspaceMode({ MAUDE_WORKSPACE_MODE: '0' })).toBe(false);
+    expect(isWorkspaceMode({ MAUDE_WORKSPACE_MODE: '' })).toBe(false);
+  });
+});
+
+describe('checkContainment — what a cell may serve', () => {
+  test('sync + git + asset routes pass', () => {
+    const report = checkContainment(ALLOWED_ROUTES);
+    expect(report.ok).toBe(true);
+    expect(report.routes).toEqual([]);
+    expect(report.modules).toEqual([]);
+  });
+
+  test('every forbidden prefix is caught, and the reason travels with it', () => {
+    for (const { prefix, why } of FORBIDDEN_ROUTE_PREFIXES) {
+      const report = checkContainment([...ALLOWED_ROUTES, prefix]);
+      expect(report.ok).toBe(false);
+      expect(report.routes).toHaveLength(1);
+      expect(report.routes[0]?.prefix).toBe(prefix);
+      // The message has to teach, not just refuse — this is read by someone who
+      // added a route in 2027 and has never heard of this invariant.
+      expect(report.routes[0]?.why).toBe(why);
+      expect(why.length).toBeGreaterThan(20);
+    }
+  });
+
+  test('a VARIANT of a forbidden route is still forbidden', () => {
+    // The realistic way this gets reintroduced: not `/_api/export` verbatim, but
+    // a sibling that does the same thing under a new name.
+    for (const route of [
+      '/_api/export-jobs',
+      '/_api/export/png',
+      '/_canvas-shell.html',
+      '/_canvas-runtime/react.js',
+      '/_ws/acp',
+    ]) {
+      const report = checkContainment([...ALLOWED_ROUTES, route]);
+      expect(report.ok).toBe(false);
+      expect(report.routes[0]?.route).toBe(route);
+    }
+  });
+
+  test('a route that merely CONTAINS a forbidden word is not a false positive', () => {
+    // Prefix matching, not substring — `/_api/asset` must not trip on nothing,
+    // and a route about exports in its docs must not be blocked by name alone.
+    const report = checkContainment([
+      '/_api/asset',
+      '/_api/export-history-docs-link',
+      '/_api/no-export',
+      '/_api/git-export-status',
+    ]);
+    expect(report.routes.map((r) => r.route)).toEqual(['/_api/export-history-docs-link']);
+    // ...that one DOES start with /_api/export, and being caught is correct:
+    // a surface named "export-*" is exactly what needs a human to look at it.
+  });
+
+  test('a resolvable browser automation module fails the check', () => {
+    const report = checkContainment(ALLOWED_ROUTES, {
+      resolveModule: (s) => s === 'playwright',
+    });
+    expect(report.ok).toBe(false);
+    expect(report.modules).toEqual(['playwright']);
+    // All four are checked, not just the popular one.
+    const all = checkContainment(ALLOWED_ROUTES, { resolveModule: () => true });
+    expect(all.modules).toEqual([...FORBIDDEN_MODULES]);
+  });
+
+  test('no resolver supplied ⇒ modules are simply not checked (not silently passed)', () => {
+    const report = checkContainment(ALLOWED_ROUTES);
+    expect(report.modules).toEqual([]);
+  });
+});
+
+describe('assertContainment — the boot gate', () => {
+  test('OUTSIDE workspace mode it never fires, whatever is exposed', () => {
+    // A developer's laptop serves every one of these. If the gate fired here,
+    // the entire local product would stop booting.
+    expect(() =>
+      assertContainment([...ALLOWED_ROUTES, ...FORBIDDEN_ROUTE_PREFIXES.map((f) => f.prefix)], {
+        env: LAPTOP,
+        resolveModule: () => true,
+      })
+    ).not.toThrow();
+  });
+
+  test('in a cell, a clean route table starts', () => {
+    expect(() => assertContainment(ALLOWED_ROUTES, { env: CELL })).not.toThrow();
+  });
+
+  test('in a cell, an export route REFUSES TO START', () => {
+    expect(() => assertContainment([...ALLOWED_ROUTES, '/_api/export'], { env: CELL })).toThrow(
+      /REFUSING TO START/
+    );
+  });
+
+  test('in a cell, shipping Playwright REFUSES TO START even with clean routes', () => {
+    expect(() =>
+      assertContainment(ALLOWED_ROUTES, { env: CELL, resolveModule: (s) => s === 'playwright' })
+    ).toThrow(/playwright/);
+  });
+
+  test('the failure message names the surface, the reason, and the way out', () => {
+    let message = '';
+    try {
+      assertContainment([...ALLOWED_ROUTES, '/_canvas-shell.html'], { env: CELL });
+    } catch (err) {
+      message = (err as Error).message;
+    }
+    expect(message).toContain('/_canvas-shell.html');
+    expect(message).toContain('DDR-193');
+    expect(message).toContain('executes a canvas module');
+    // The escape hatch is named so the next engineer doesn't invent a flag.
+    expect(message).toContain('Direction B');
+    expect(message).toContain('HARD PREREQUISITE');
+  });
+
+  test('formatContainmentFailure reports routes and modules together', () => {
+    const report = checkContainment([...ALLOWED_ROUTES, '/_api/export'], {
+      resolveModule: (s) => s === 'puppeteer',
+    });
+    const message = formatContainmentFailure(report);
+    expect(message).toContain('/_api/export');
+    expect(message).toContain('puppeteer');
+    expect(message).toContain('Reachable routes');
+    expect(message).toContain('Modules that resolve');
+  });
+});
+
+describe('the vocabulary itself', () => {
+  test('the forbidden set covers every way a cell could evaluate tenant code', () => {
+    // Pinned deliberately: the realistic loss of this invariant is a refactor
+    // quietly dropping an entry while every other test stays green. Changing
+    // this list should require changing this test, on purpose.
+    expect(FORBIDDEN_ROUTE_PREFIXES.map((f) => f.prefix).sort()).toEqual([
+      '/_api/export',
+      '/_api/generate',
+      '/_api/photo-edit',
+      '/_canvas-runtime',
+      '/_canvas-shell',
+      '/_ws/acp',
+    ]);
+    expect([...FORBIDDEN_MODULES].sort()).toEqual([
+      'playwright',
+      'playwright-core',
+      'puppeteer',
+      'puppeteer-core',
+    ]);
+  });
+});
+
+describe('pruneForWorkspace — how a cell can boot at all', () => {
+  test('keeps the sync/git/asset surface and removes exactly the forbidden one', () => {
+    const table = {
+      '/_health': 'h',
+      '/_api/asset': 'a',
+      '/_api/comments': 'c',
+      '/_api/git-committers': 'g',
+      '/_api/export': 'x',
+      '/_api/export-jobs': 'x2',
+      '/_api/photo-edit': 'p',
+      '/_api/generate/keys': 'k',
+    };
+    const { routes, removed } = pruneForWorkspace(table);
+
+    expect(Object.keys(routes).sort()).toEqual([
+      '/_api/asset',
+      '/_api/comments',
+      '/_api/git-committers',
+      '/_health',
+    ]);
+    expect(removed).toEqual([
+      '/_api/export',
+      '/_api/export-jobs',
+      '/_api/generate/keys',
+      '/_api/photo-edit',
+    ]);
+    // Handlers are carried through by reference — pruning must not rebuild them.
+    expect(routes['/_api/asset']).toBe('a');
+  });
+
+  test('the pruned table then PASSES the boot assert — prune and assert agree', () => {
+    // This is the whole design: the assert is a post-condition on the pruning,
+    // so a prefix added to the vocabulary both prunes and is verified, and the
+    // two can never drift into disagreeing.
+    const table = Object.fromEntries(
+      [...FORBIDDEN_ROUTE_PREFIXES.map((f) => f.prefix), '/_health', '/_api/asset'].map((r) => [
+        r,
+        () => {},
+      ])
+    );
+    const { routes } = pruneForWorkspace(table);
+    expect(() => assertContainment(Object.keys(routes), { env: CELL })).not.toThrow();
+    // ...and the unpruned table would have refused.
+    expect(() => assertContainment(Object.keys(table), { env: CELL })).toThrow(/REFUSING TO START/);
+  });
+
+  test('pruning an already-clean table is a no-op', () => {
+    const table = Object.fromEntries(ALLOWED_ROUTES.map((r) => [r, () => {}]));
+    const { routes, removed } = pruneForWorkspace(table);
+    expect(removed).toEqual([]);
+    expect(Object.keys(routes).sort()).toEqual([...ALLOWED_ROUTES].sort());
+  });
+
+  test('isForbiddenRoute is the single predicate both the table and fetch use', () => {
+    // The `fetch` fall-through owns paths that are not in the route table
+    // (/_ws/acp, /_canvas-shell.html, /_canvas-runtime/*), so it gates on this
+    // same function. One predicate, so the two gates cannot disagree.
+    expect(isForbiddenRoute('/_canvas-shell.html')).toBe(true);
+    expect(isForbiddenRoute('/_canvas-runtime/react.js')).toBe(true);
+    expect(isForbiddenRoute('/_ws/acp')).toBe(true);
+    expect(isForbiddenRoute('/_ws')).toBe(false);
+    expect(isForbiddenRoute('/_health')).toBe(false);
+    expect(isForbiddenRoute('/_api/asset')).toBe(false);
+  });
+});

package/apps/studio/test/workspace-signin.test.ts

@@ -0,0 +1,270 @@
+// Cloud Phase 3 Task 3 — "Sign in to workspace".
+//
+// The persona is the invited teammate who has never used git. So alongside the
+// mechanics (probe, login, credential custody) these tests assert the WORDS:
+// a flow that says "paste your bearer token" has already told that person the
+// product isn't for them (DDR-193 §5).
+
+import { describe, expect, test } from 'bun:test';
+
+import {
+  type DisclosureItem,
+  signInToWorkspace,
+  workspaceDisclosure,
+} from '../sync/workspace-signin.ts';
+
+/** A fetch stand-in scripted per URL suffix, recording what it was called with. */
+function scriptedFetch(routes: Record<string, () => Response>) {
+  const calls: Array<{ url: string; init?: RequestInit }> = [];
+  const impl = (async (url: string | URL | Request, init?: RequestInit) => {
+    const href = String(url);
+    calls.push({ url: href, init });
+    for (const [suffix, make] of Object.entries(routes)) {
+      if (href.endsWith(suffix)) return make();
+    }
+    throw new Error(`unrouted ${href}`);
+  }) as unknown as typeof fetch;
+  return { impl, calls };
+}
+
+const json = (body: unknown, status = 200) =>
+  new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
+
+const HEALTHY = () => json({ ok: true, version: '0.48.0' });
+const LOGGED_IN = () =>
+  json({
+    token: 'mau_0123456789abcdef0123456789abcdef',
+    label: 'u-abcdef012345',
+    expiresAt: 1_800_000_000_000,
+    user: { email: 'alice@example.com', role: 'member' },
+  });
+
+const CREDS = {
+  url: 'https://team.example.com',
+  email: 'alice@example.com',
+  password: 'hunter2222222',
+};
+
+describe('input validation speaks to a person, not a developer', () => {
+  test('each missing field names what to do next', async () => {
+    const saved: string[] = [];
+    const save = (u: string) => void saved.push(u);
+    for (const [input, expected] of [
+      [{}, /address your team sent you/i],
+      [{ url: 'https://x.example.com' }, /email address/i],
+      [{ url: 'https://x.example.com', email: 'a@b.com' }, /password/i],
+    ] as const) {
+      const res = await signInToWorkspace(input, { save, fetchImpl: scriptedFetch({}).impl });
+      expect(res.status).toBe(400);
+      expect(res.json.ok).toBe(false);
+      expect((res.json as { error: string }).error).toMatch(expected);
+    }
+    expect(saved).toEqual([]);
+  });
+
+  test('a non-http address is refused before anything is sent', async () => {
+    const { impl, calls } = scriptedFetch({});
+    const res = await signInToWorkspace(
+      { ...CREDS, url: 'file:///etc/passwd' },
+      { fetchImpl: impl, save: () => {} }
+    );
+    expect(res.status).toBe(400);
+    expect(calls).toEqual([]);
+  });
+});
+
+describe('credential custody', () => {
+  test('the health probe is TOKENLESS and carries no password', async () => {
+    // A lookalike address must never receive a credential (phase-29 A2).
+    const { impl, calls } = scriptedFetch({ '/health': HEALTHY, '/auth/login': LOGGED_IN });
+    await signInToWorkspace(CREDS, { fetchImpl: impl, save: () => {} });
+
+    const probe = calls.find((c) => c.url.endsWith('/health'));
+    expect(probe).toBeDefined();
+    expect(probe?.init?.body).toBeUndefined();
+    expect(JSON.stringify(probe?.init?.headers ?? {})).not.toContain('Authorization');
+  });
+
+  test('the password goes ONLY to the typed address, once, and is never stored', async () => {
+    const stored: Array<{ url: string; token: string }> = [];
+    const { impl, calls } = scriptedFetch({ '/health': HEALTHY, '/auth/login': LOGGED_IN });
+    await signInToWorkspace(CREDS, {
+      fetchImpl: impl,
+      save: (url, token) => void stored.push({ url, token }),
+    });
+
+    const withPassword = calls.filter((c) => String(c.init?.body ?? '').includes('hunter2222222'));
+    expect(withPassword).toHaveLength(1);
+    expect(withPassword[0]?.url).toBe('https://team.example.com/auth/login');
+
+    // What is persisted is the minted TOKEN — never the password.
+    expect(stored).toHaveLength(1);
+    expect(stored[0]?.token).toBe('mau_0123456789abcdef0123456789abcdef');
+    expect(JSON.stringify(stored)).not.toContain('hunter2222222');
+  });
+
+  test('nothing is saved when sign-in fails', async () => {
+    const stored: string[] = [];
+    const { impl } = scriptedFetch({
+      '/health': HEALTHY,
+      '/auth/login': () => json({ error: 'invalid email or password' }, 401),
+    });
+    const res = await signInToWorkspace(CREDS, {
+      fetchImpl: impl,
+      save: (u) => void stored.push(u),
+    });
+    expect(res.status).toBe(401);
+    expect(stored).toEqual([]);
+  });
+});
+
+describe('failure modes are distinguishable and actionable', () => {
+  test('an unreachable address says so, and never reaches login', async () => {
+    const { impl, calls } = scriptedFetch({
+      '/health': () => {
+        throw new Error('ECONNREFUSED');
+      },
+    });
+    const res = await signInToWorkspace(CREDS, { fetchImpl: impl, save: () => {} });
+    expect((res.json as { reason: string }).reason).toBe('unreachable');
+    expect((res.json as { error: string }).error).toMatch(/couldn't reach/i);
+    expect(calls.some((c) => c.url.includes('/auth/login'))).toBe(false);
+  });
+
+  test('an address that answers but is not a Maude workspace is named as such', async () => {
+    // A typo'd address that lands on someone else's server would otherwise fail
+    // later as a mysterious auth error.
+    const { impl } = scriptedFetch({ '/health': () => json({ status: 'ok, but not maude' }) });
+    const res = await signInToWorkspace(CREDS, { fetchImpl: impl, save: () => {} });
+    expect((res.json as { reason: string }).reason).toBe('not-a-maude-workspace');
+    expect((res.json as { error: string }).error).toMatch(/isn't a Maude workspace/i);
+  });
+
+  test('bad credentials do not guess WHICH half was wrong', async () => {
+    // The hub refuses to be a user-existence oracle, so the client must not
+    // invent one by saying "wrong password" when the account may not exist.
+    const { impl } = scriptedFetch({
+      '/health': HEALTHY,
+      '/auth/login': () => json({ error: 'invalid email or password' }, 401),
+    });
+    const res = await signInToWorkspace(CREDS, { fetchImpl: impl, save: () => {} });
+    const error = (res.json as { error: string }).error;
+    expect(error).not.toMatch(/no such (user|account)/i);
+    expect(error).not.toMatch(/wrong password/i);
+    expect(error).toMatch(/not accepted/i);
+  });
+
+  test('rate limiting says to wait rather than to retry', async () => {
+    const { impl } = scriptedFetch({
+      '/health': HEALTHY,
+      '/auth/login': () => json({ error: 'rate limit exceeded' }, 429),
+    });
+    const res = await signInToWorkspace(CREDS, { fetchImpl: impl, save: () => {} });
+    expect((res.json as { reason: string }).reason).toBe('rate-limited');
+    expect((res.json as { error: string }).error).toMatch(/wait a minute/i);
+  });
+
+  test('a failed save is reported instead of pretending success', async () => {
+    const { impl } = scriptedFetch({ '/health': HEALTHY, '/auth/login': LOGGED_IN });
+    const res = await signInToWorkspace(CREDS, {
+      fetchImpl: impl,
+      save: () => {
+        throw new Error('read-only fs');
+      },
+    });
+    expect((res.json as { reason: string }).reason).toBe('save-failed');
+  });
+});
+
+describe('success', () => {
+  test('returns the person and their session, never the token', async () => {
+    const { impl } = scriptedFetch({ '/health': HEALTHY, '/auth/login': LOGGED_IN });
+    const res = await signInToWorkspace(CREDS, { fetchImpl: impl, save: () => {} });
+
+    expect(res.status).toBe(200);
+    expect(res.json).toEqual({
+      ok: true,
+      url: 'https://team.example.com',
+      user: { email: 'alice@example.com', role: 'member' },
+      expiresAt: 1_800_000_000_000,
+      version: '0.48.0',
+    });
+    // The token must not travel back to the UI layer — it has no use for it and
+    // every surface that holds one is a surface that can leak one.
+    expect(JSON.stringify(res.json)).not.toContain('mau_');
+  });
+
+  test('a trailing slash or bare host normalizes to the same workspace', async () => {
+    const stored: string[] = [];
+    for (const url of ['https://team.example.com/', 'https://team.example.com']) {
+      const { impl } = scriptedFetch({ '/health': HEALTHY, '/auth/login': LOGGED_IN });
+      await signInToWorkspace(
+        { ...CREDS, url },
+        { fetchImpl: impl, save: (u) => void stored.push(u) }
+      );
+    }
+    expect(new Set(stored).size).toBe(1);
+  });
+});
+
+describe('the disclosure panel — DDR-054 made visible (DDR-192 §6)', () => {
+  const text = (items: DisclosureItem[]) => items.map((i) => `${i.title} ${i.detail}`).join(' ');
+
+  test('it says what the operator CAN see, not only what they cannot', () => {
+    // A disclosure that only lists reassurances is marketing. The point is that
+    // the person can decide, which requires the uncomfortable half.
+    const items = workspaceDisclosure({ operator: 'your team', aiAvailable: true });
+    const sees = items.filter((i) => i.kind === 'sees');
+    expect(sees.length).toBeGreaterThanOrEqual(3);
+    expect(text(sees)).toMatch(/edit history/i);
+    expect(text(sees)).toMatch(/when you are editing/i);
+    expect(text(sees)).toMatch(/comments/i);
+  });
+
+  test('it names the containment invariant in words a person understands', () => {
+    const items = workspaceDisclosure({ operator: 'Maude Cloud', aiAvailable: true });
+    expect(text(items)).toMatch(/never executes them/i);
+    expect(text(items)).toMatch(/render here, on your machine/i);
+  });
+
+  test('it names the operator, so "who can see this" has an answer', () => {
+    const items = workspaceDisclosure({ operator: 'Acme Design Ltd', aiAvailable: true });
+    expect(text(items)).toContain('Acme Design Ltd');
+  });
+
+  test('the AI-less state is stated as a fact, not an error', () => {
+    // Phase 6's persona: an invitee without a Claude subscription gets a
+    // first-class product, not a broken one.
+    const off = workspaceDisclosure({ operator: 'your team', aiAvailable: false });
+    const ai = off.find((i) => i.title.includes('AI'));
+    expect(ai?.detail).toMatch(/Everything else works normally/i);
+    expect(ai?.detail).not.toMatch(/error|unavailable|failed|missing/i);
+
+    const on = workspaceDisclosure({ operator: 'your team', aiAvailable: true });
+    expect(on.find((i) => i.title.includes('AI'))?.detail).toMatch(/your own subscription/i);
+  });
+
+  test('it promises the exit, because that is what makes the rest believable', () => {
+    const items = workspaceDisclosure({ operator: 'Maude Cloud', aiAvailable: true });
+    expect(text(items)).toMatch(/opens without Maude/i);
+  });
+
+  test('no jargon reaches the person', () => {
+    // DDR-193 §5 — the product word is "project"/"workspace". These words on an
+    // invite path tell a non-developer the product is not for them.
+    const items = workspaceDisclosure({ operator: 'your team', aiAvailable: false });
+    const all = text(items).toLowerCase();
+    for (const word of [
+      'token',
+      'repository',
+      'repo ',
+      'oauth',
+      'bearer',
+      'crdt',
+      'yjs',
+      'commit',
+    ]) {
+      expect(all).not.toContain(word);
+    }
+  });
+});

package/apps/studio/use-collab.tsx

@@ -33,6 +33,8 @@ import { Awareness, applyAwarenessUpdate, encodeAwarenessUpdate } from 'y-protoc
 import { readSyncMessage, writeSyncStep1, writeUpdate } from 'y-protocols/sync';
 import * as Y from 'yjs';
 
+import { isTrustedOrigin, touchesBodyLane } from './collab/origins.ts';
+
 const MESSAGE_SYNC = 0;
 const MESSAGE_AWARENESS = 1;
 
@@ -677,10 +679,35 @@ function createSession(slug: string): CollabSession {
 
   // Wire doc updates → broadcast to server. Origin tagged with the ws so
   // server-side updates we receive don't echo back.
-  const onDocUpdate = (update: Uint8Array, origin: unknown) => {
+  //
+  // ORIGIN GATE, lock 1 (DDR-122 follow-up — see collab/origins.ts). This file
+  // runs in the UNTRUSTED canvas realm, so any script sharing the realm can
+  // reach this doc through `useCollab().doc` and write the body lanes — the
+  // canvas's own source. Refuse to broadcast such an op unless it carries a
+  // trusted origin sentinel, which canvas script cannot obtain. Comments,
+  // annotations, and presentation are untouched: the canvas realm co-authors
+  // those by design, and same-machine boards must keep working.
+  let bodyLaneWarned = false;
+  const onDocUpdate = (
+    update: Uint8Array,
+    origin: unknown,
+    _doc: Y.Doc,
+    transaction: Y.Transaction
+  ) => {
     const ws = wsRef;
     if (!ws || ws.readyState !== WebSocket.OPEN) return;
     if (origin === ws) return; // came from server, don't echo
+    if (touchesBodyLane(transaction) && !isTrustedOrigin(origin)) {
+      if (!bodyLaneWarned) {
+        bodyLaneWarned = true;
+        console.warn(
+          '[collab] refused to broadcast a canvas-realm write to the canvas source ' +
+            '(html/css/meta). Untrusted canvas script may not edit the document body — ' +
+            'DDR-122 follow-up.'
+        );
+      }
+      return;
+    }
     broadcastSyncUpdate(ws, update);
   };
   doc.on('update', onDocUpdate);