@dxos/echo 0.9.0 → 0.9.1-staging.ee54ba693a

package/src/internal/common/proxy/schema-validator.ts

@@ -6,7 +6,6 @@ import * as Schema from 'effect/Schema';
 import * as SchemaAST from 'effect/SchemaAST';
 
 import { invariant } from '@dxos/invariant';
-import { log } from '@dxos/log';
 
 import { SchemaId } from '../types';
 
@@ -68,8 +67,13 @@ export class SchemaValidator {
           getProperty([...propertyPath.slice(0, i), propertyName]),
         );
         if (propertyType == null) {
-          log.warn('unknown property', { path: propertyPath, property: propertyName });
-          continue;
+          const indexSignatureType = getIndexSignatureValueType(schema.ast);
+          if (indexSignatureType != null) {
+            schema = Schema.make(indexSignatureType).annotations(indexSignatureType.annotations);
+            continue;
+          }
+
+          throw new TypeError(`Unknown property: ${formatPropertyPath([...propertyPath.slice(0, i), propertyName])}`);
         }
 
         schema = Schema.make(propertyType).annotations(propertyType.annotations);
@@ -79,9 +83,101 @@ export class SchemaValidator {
     return schema;
   }
 
+  /**
+   * Rejects properties not declared on the schema. Types with index signatures allow extra keys.
+   */
+  public static assertExactProperties(
+    schema: Schema.Schema.AnyNoContext,
+    value: unknown,
+    getProperty: (path: KeyPath) => unknown = () => undefined,
+    path: KeyPath = [],
+  ): void {
+    if (!isPlainRecord(value)) {
+      return;
+    }
+
+    const typeLiteral = resolveTypeLiteral(schema.ast, (propertyName) => getProperty([...path, propertyName]));
+    if (typeLiteral == null) {
+      return;
+    }
+
+    const propertySignatures = SchemaAST.getPropertySignatures(typeLiteral);
+    const allowedKeys = new Set(propertySignatures.map((property) => String(property.name)));
+    const indexSignatureType = typeLiteral.indexSignatures[0]?.type;
+
+    for (const key of Object.keys(value)) {
+      const propertyPath = [...path, key];
+      if (!allowedKeys.has(key)) {
+        if (indexSignatureType == null) {
+          throw new TypeError(`Unknown property: ${formatPropertyPath(propertyPath)}`);
+        }
+
+        const indexSchema = Schema.make(indexSignatureType).annotations(indexSignatureType.annotations);
+        this.assertExactProperties(indexSchema, value[key], getProperty, propertyPath);
+        continue;
+      }
+
+      const propertySignature = propertySignatures.find((property) => String(property.name) === key);
+      invariant(propertySignature, 'Property signature must exist.');
+      const propertySchema = Schema.make(propertySignature.type).annotations(propertySignature.type.annotations);
+      this.assertExactProperties(propertySchema, value[key], getProperty, propertyPath);
+    }
+  }
+
+  public static getIndexedElementSchema(
+    schema: Schema.Schema.AnyNoContext,
+    index: number | string,
+  ): Schema.Schema.AnyNoContext | null {
+    const arrayAst = unwrapArray(schema.ast);
+    if (arrayAst != null) {
+      return getArrayElementSchema(arrayAst, index);
+    }
+
+    const unionAst = unwrapAst(
+      schema.ast,
+      (candidate) => SchemaAST.isUnion(candidate) && candidate.types.some((member) => unwrapArray(member) != null),
+    );
+    if (unionAst != null && SchemaAST.isUnion(unionAst)) {
+      for (const member of unionAst.types) {
+        const memberArrayAst = unwrapArray(member);
+        if (memberArrayAst != null) {
+          return getArrayElementSchema(memberArrayAst, index);
+        }
+      }
+    }
+
+    return null;
+  }
+
   public static getTargetPropertySchema(target: any, prop: string | symbol): Schema.Schema.AnyNoContext {
     const schema: Schema.Schema.AnyNoContext | undefined = (target as any)[SchemaId];
     invariant(schema, 'target has no schema');
+
+    if (Array.isArray(target)) {
+      if (prop === 'length') {
+        return Schema.Number;
+      }
+
+      if (typeof prop !== 'symbol') {
+        const indexedSchema = this.getIndexedElementSchema(schema, prop);
+        if (indexedSchema != null) {
+          return indexedSchema;
+        }
+      }
+
+      // Arrays sometimes carry the element struct as their stamped schema.
+      if (SchemaAST.isTypeLiteral(schema.ast)) {
+        return schema;
+      }
+    }
+
+    if (typeof prop === 'number' || (typeof prop === 'string' && /^\d+$/.test(prop))) {
+      const indexedSchema = this.getIndexedElementSchema(schema, prop);
+      if (indexedSchema != null) {
+        return indexedSchema;
+      }
+    }
+
     const arrayAst = unwrapArray(schema.ast);
     if (arrayAst != null) {
       return getArrayElementSchema(arrayAst, prop);
@@ -89,11 +185,15 @@ export class SchemaValidator {
 
     const propertyType = getPropertyType(schema.ast, prop.toString(), (prop) => target[prop]);
     if (propertyType == null) {
-      return Schema.Any; // TODO(burdon): HACK.
+      const indexSignatureType = getIndexSignatureValueType(schema.ast);
+      if (indexSignatureType != null) {
+        return Schema.make(indexSignatureType).annotations(indexSignatureType.annotations);
+      }
+
+      throw new TypeError(`Unknown property: ${String(prop)}`);
     }
 
-    invariant(propertyType, `invalid property: ${prop.toString()}`);
-    return Schema.make(propertyType);
+    return Schema.make(propertyType).annotations(propertyType.annotations);
   }
 }
 
@@ -106,7 +206,8 @@ const getArrayElementSchema = (
   tupleAst: SchemaAST.TupleType,
   property: string | symbol | number,
 ): Schema.Schema.AnyNoContext => {
-  const elementIndex = typeof property === 'string' ? parseInt(property, 10) : Number.NaN;
+  const elementIndex =
+    typeof property === 'number' ? property : typeof property === 'string' ? parseInt(property, 10) : Number.NaN;
   if (Number.isNaN(elementIndex)) {
     invariant(property === 'length', `invalid array property: ${String(property)}`);
     return Schema.Number;
@@ -150,7 +251,10 @@ const getPropertyType = (
 ): SchemaAST.AST | null => {
   const anyOrObject = unwrapAst(
     ast,
-    (candidate) => SchemaAST.isAnyKeyword(candidate) || SchemaAST.isObjectKeyword(candidate),
+    (candidate) =>
+      SchemaAST.isAnyKeyword(candidate) ||
+      SchemaAST.isUnknownKeyword(candidate) ||
+      SchemaAST.isObjectKeyword(candidate),
   );
   if (anyOrObject != null) {
     return ast;
@@ -232,6 +336,75 @@ const unwrapAst = (rootAst: SchemaAST.AST, predicate?: (ast: SchemaAST.AST) => b
 
 const unwrapArray = (ast: SchemaAST.AST) => unwrapAst(ast, SchemaAST.isTupleType) as SchemaAST.TupleType | null;
 
+const getIndexSignatureValueType = (ast: SchemaAST.AST): SchemaAST.AST | null => {
+  const typeLiteral = unwrapAst(ast, SchemaAST.isTypeLiteral);
+  if (typeLiteral == null || !SchemaAST.isTypeLiteral(typeLiteral) || typeLiteral.indexSignatures.length === 0) {
+    return null;
+  }
+
+  return unwrapAst(typeLiteral.indexSignatures[0].type);
+};
+
+const resolveTypeLiteral = (
+  ast: SchemaAST.AST,
+  getTargetPropertyFn: (propertyName: string) => unknown,
+): SchemaAST.TypeLiteral | null => {
+  const anyOrObject = unwrapAst(
+    ast,
+    (candidate) =>
+      SchemaAST.isAnyKeyword(candidate) ||
+      SchemaAST.isUnknownKeyword(candidate) ||
+      SchemaAST.isObjectKeyword(candidate),
+  );
+  if (anyOrObject != null) {
+    return null;
+  }
+
+  const typeOrDiscriminatedUnion = unwrapAst(ast, (type) => {
+    return (
+      SchemaAST.isTypeLiteral(type) ||
+      (SchemaAST.isUnion(type) && type.types.some((member) => SchemaAST.isTypeLiteral(member)))
+    );
+  });
+  if (typeOrDiscriminatedUnion == null) {
+    return null;
+  }
+
+  if (SchemaAST.isTypeLiteral(typeOrDiscriminatedUnion)) {
+    return typeOrDiscriminatedUnion;
+  }
+
+  if (!SchemaAST.isUnion(typeOrDiscriminatedUnion)) {
+    return null;
+  }
+
+  const typeAstList = typeOrDiscriminatedUnion.types.filter((type) =>
+    SchemaAST.isTypeLiteral(type),
+  ) as SchemaAST.TypeLiteral[];
+  if (typeAstList.length === 1) {
+    return typeAstList[0];
+  }
+
+  const typeDiscriminators = getTypeDiscriminators(typeAstList);
+  const targetPropertyValue = getTargetPropertyFn(String(typeDiscriminators[0].name));
+  const typeIndex = typeDiscriminators.findIndex(
+    (property) => targetPropertyValue === (property.type as SchemaAST.Literal).literal,
+  );
+  invariant(typeIndex !== -1, 'discriminator field not set on target');
+  return typeAstList[typeIndex];
+};
+
+const isPlainRecord = (value: unknown): value is Record<string, unknown> => {
+  if (typeof value !== 'object' || value === null || Array.isArray(value) || value instanceof Uint8Array) {
+    return false;
+  }
+
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+};
+
+const formatPropertyPath = (path: KeyPath): string => path.map(String).join('.');
+
 export const checkIdNotPresentOnSchema = (schema: Schema.Schema<any, any, any>) => {
   invariant(SchemaAST.isTypeLiteral(schema.ast));
   const idProperty = SchemaAST.getPropertySignatures(schema.ast).find((prop) => prop.name === 'id');

package/src/internal/common/proxy/typed-handler.ts

@@ -9,6 +9,7 @@ import { type InspectOptionsStylized } from 'node:util';
 import { Event } from '@dxos/async';
 import { inspectCustom } from '@dxos/debug';
 import { assertArgument, invariant } from '@dxos/invariant';
+import { getDeep, setDeep } from '@dxos/util';
 
 import { getSchemaURI } from '../../Annotation/annotations';
 import { toEffectSchema } from '../../JsonSchema/json-schema';
@@ -27,7 +28,15 @@ import {
   wouldCreateCycle,
 } from './ownership';
 import { type ReactiveHandler, objectData } from './proxy-types';
-import { createProxy, isProxy, isValidProxyTarget, symbolIsProxy } from './proxy-utils';
+import {
+  createProxy,
+  isProxy,
+  isReactiveRecord,
+  isValidProxyTarget,
+  normalizeSpliceRange,
+  symbolIsProxy,
+  symbolReactivePrototype,
+} from './proxy-utils';
 import { ReactiveArray } from './reactive-array';
 import { SchemaValidator } from './schema-validator';
 import { ChangeId, EventId } from './symbols';
@@ -92,9 +101,10 @@ const deepCopy = <T>(value: T, visited = new Map<object, object>()): T => {
     return copy as T;
   }
 
-  // Don't copy other class instances (objects with non-Object prototype).
+  // Don't copy other class instances (objects with non-Object prototype). A reactive record
+  // (its metadata moved onto a behaviour prototype) still counts as a plain data record here.
   const proto = Object.getPrototypeOf(actualValue);
-  if (proto !== Object.prototype && proto !== Array.prototype && proto !== null) {
+  if (proto !== Array.prototype && proto !== null && !isReactiveRecord(actualValue)) {
     return value; // Return as-is, don't copy class instances.
   }
 
@@ -130,6 +140,138 @@ const copyHiddenProperties = (source: any, target: any): void => {
   }
 };
 
+//
+// Object layering for an in-memory typed reactive object (`TypedReactiveHandler`).
+//
+// Unlike the database-backed handler (echo-client/echo-prototypes.ts), here USER DATA lives as
+// real OWN properties on the target — there is no document behind it. Only the per-object metadata
+// is relocated onto a prototype, so swapping handlers doesn't disturb the data shape:
+//
+//   proxy ──Proxy(target, ProxyHandlerSlot → TypedReactiveHandler)
+//     │         get/set/has/... traps run here
+//     ▼
+//   target            the user's object. OWN enumerable props = user data ({ name, age, ... });
+//     │ [[Prototype]] OWN symbol props are removed by `compactMetadataToInstanceState` after init.
+//     ▼
+//   instanceState     `Object.create(TypedObjectPrototype)`. Holds the relocated symbol-keyed
+//     │ [[Prototype]] metadata as hidden props: [EventId] (root only), [ObjectDeletedId], [SchemaId],
+//     │               [TypeId], [TypeEntityId], cached [StaticTypeSchemaSlot], ... (Arrays are
+//     │               exempt — they keep their ReactiveArray chain and are never compacted.)
+//     ▼
+//   TypedObjectPrototype     shared behaviour. Carries [symbolReactivePrototype]=true (so the
+//     │ [[Prototype]] "plain object" gates still treat the record as data) plus the system
+//     │               accessors [objectData], [ChangeId], [StaticTypeSchemaSlot]; the get trap
+//     │               delegates to these via `isBehaviourAccessor` instead of switching.
+//     ▼
+//   Object.prototype ──▶ null     a `getPrototypeOf` trap reports `Object.prototype` so consumers
+//                     see a plain object; the real instanceState prototype stays hidden.
+//
+// Root vs nested: a root object owns an `[EventId]`; nested records share their root's reactivity
+// and have none. That presence is the "is this an initialized root" signal (it replaced an earlier
+// `[ChangeId] === true` marker).
+//
+// `this` in the accessors below: the get trap calls `Reflect.get(target, prop, receiver)`, so
+// `this` is the PROXY (receiver) on the common path, or the raw target when read directly.
+// `getRawTarget(this)` normalizes to the underlying target — needed here because user data and the
+// metadata chain both hang off the raw target, and `executeChange` keys the change context by it.
+//
+/**
+ * Behaviour prototype for typed reactive records. A record's per-object metadata is moved onto an
+ * intermediate instance-state object whose prototype is this, so that swapping the handler that
+ * backs an object (e.g. an in-memory object becoming database-backed) is a prototype re-point that
+ * doesn't perturb the target's own-property shape. Marked as a reactive prototype so the "plain
+ * object" gates (`isValidProxyTarget` / `deepCopy`) still treat such targets as data records.
+ */
+const TypedObjectPrototype: object = Object.create(Object.prototype);
+defineHiddenProperty(TypedObjectPrototype, symbolReactivePrototype, true);
+
+// The ECHO system surface is exposed as accessors on the behaviour prototype rather than as
+// branches in the `get` trap. `this` is the proxy receiver (or the raw target when read directly);
+// `getRawTarget` resolves either to the underlying target.
+Object.defineProperties(TypedObjectPrototype, {
+  // TODO(burdon): Remove?
+  [objectData]: {
+    get(this: ProxyTarget) {
+      return toJSON(getRawTarget(this));
+    },
+  },
+  [ChangeId]: {
+    // A function that runs a mutation inside a controlled change context. Only root objects (which
+    // own an `EventId`) expose one; nested records share their root's reactivity and return undefined.
+    get(this: ProxyTarget) {
+      const target = getRawTarget(this);
+      if (!(EventId in target)) {
+        return undefined;
+      }
+      return (callback: (obj: any) => void) => executeChange(target, target, this, callback);
+    },
+  },
+  [StaticTypeSchemaSlot]: {
+    // Lazily rebuild the source Effect Schema from `jsonSchema` and cache it as an own (hidden)
+    // property so subsequent reads short-circuit this accessor; the set-trap deletes the cache when
+    // `jsonSchema` is mutated.
+    get(this: ProxyTarget) {
+      const target = getRawTarget(this);
+      const jsonSchema = (target as any).jsonSchema;
+      if (jsonSchema == null) {
+        return undefined;
+      }
+      const rebuilt = toEffectSchema(jsonSchema);
+      defineHiddenProperty(target, StaticTypeSchemaSlot, rebuilt);
+      return rebuilt;
+    },
+  },
+});
+
+/** True if `prop` resolves to an accessor on the behaviour-prototype chain (not an own property). */
+const isBehaviourAccessor = (target: object, prop: symbol): boolean => {
+  let proto = Object.getPrototypeOf(target);
+  while (proto != null && proto !== Object.prototype) {
+    const descriptor = Object.getOwnPropertyDescriptor(proto, prop);
+    if (descriptor != null) {
+      return descriptor.get != null;
+    }
+    proto = Object.getPrototypeOf(proto);
+  }
+  return false;
+};
+
+/**
+ * Enforce that user-data mutations only happen inside `Obj.update()`. A root object owns an
+ * `EventId` once initialized; before that (and for non-root records or symbol-keyed system
+ * properties) mutations pass through. Returns whether the root is initialized so callers can gate
+ * change notifications.
+ */
+const assertMutableWithinChange = (echoRoot: object, prop: string | symbol): boolean => {
+  const isInitialized = EventId in echoRoot;
+  if (isInitialized && typeof prop !== 'symbol' && !isInChangeContext(echoRoot)) {
+    throw new Error(
+      `Cannot modify object property "${String(prop)}" outside of Obj.update(). ` +
+        'Use Obj.update(obj, (mutableObj) => { mutableObj.property = value; }) instead.',
+    );
+  }
+  return isInitialized;
+};
+
+/**
+ * Move a record's per-object metadata (symbol-keyed hidden properties) onto a fresh instance-state
+ * object inserted between the target and {@link TypedObjectPrototype}. The target keeps only its
+ * user data as own properties. Arrays are exempt — they keep their own (ReactiveArray) prototype chain.
+ */
+const compactMetadataToInstanceState = (target: ProxyTarget): void => {
+  if (Array.isArray(target) || Object.getPrototypeOf(target) !== Object.prototype) {
+    return;
+  }
+  const state = Object.create(TypedObjectPrototype);
+  for (const symbol of Object.getOwnPropertySymbols(target)) {
+    Object.defineProperty(state, symbol, Object.getOwnPropertyDescriptor(target, symbol)!);
+    // Dynamic delete over arbitrary symbol keys: `ProxyTarget` declares these as required, so the
+    // statically-typed view cannot express deleting them; the symbol set is only known at runtime.
+    delete (target as any)[symbol];
+  }
+  Object.setPrototypeOf(target, state);
+};
+
 /**
  * Typed in-memory reactive store (with Schema).
  * Reactivity is based on Event subscriptions, not signals.
@@ -155,12 +297,6 @@ export class TypedReactiveHandler implements ReactiveHandler<ProxyTarget> {
 
     defineHiddenProperty(target, ObjectDeletedId, false);
 
-    // Mark root objects as having a change handler.
-    // The actual handler is returned dynamically in get() to have access to the proxy.
-    if (!hasOwner && !(ChangeId in target)) {
-      defineHiddenProperty(target, ChangeId, true);
-    }
-
     // Only set owners if this is a root object (no existing owner).
     // Nested objects already have owners set by their root's initialization.
     // If we re-set owners here for nested objects, we'd incorrectly point
@@ -192,47 +328,36 @@ export class TypedReactiveHandler implements ReactiveHandler<ProxyTarget> {
       configurable: true,
       value: this._inspect.bind(target),
     });
+
+    // Relocate per-object metadata onto an instance-state prototype, leaving only user data as own
+    // properties on the target. Done last so all metadata set above (and by `prepareTypedTarget`) moves.
+    compactMetadataToInstanceState(target);
+  }
+
+  /**
+   * Hide the internal instance-state prototype so consumers see a plain object; arrays keep their
+   * real (ReactiveArray) prototype.
+   */
+  getPrototypeOf(target: ProxyTarget): object | null {
+    return Array.isArray(target) ? Reflect.getPrototypeOf(target) : Object.prototype;
   }
 
   get(target: ProxyTarget, prop: string | symbol, receiver: any): any {
-    switch (prop) {
-      // TODO(burdon): Remove?
-      case objectData: {
-        return toJSON(target);
-      }
-      case ChangeId: {
-        // Return change handler only for root objects that have been marked with ChangeId.
-        if ((target as any)[ChangeId] !== true) {
-          return undefined;
-        }
-        // Return a function that allows mutations within a controlled context.
-        // Uses target as both the context key and event target for non-database objects.
-        return (callback: (obj: any) => void) => executeChange(target, target, receiver, callback);
-      }
-      case TypeEntityId: {
-        // The back-reference to the type entity is metadata — return the raw
-        // value so we don't re-wrap an already-reactive `Type.Type` entity in
-        // another proxy (which would fail the SchemaId-in-target invariant).
-        return Reflect.get(target, prop, receiver);
-      }
-      case StaticTypeSchemaSlot: {
-        // Lazily rebuild the source Effect Schema from `jsonSchema` and cache it on
-        // the slot; the set-trap invalidates the cache when `jsonSchema` is mutated.
-        const existing = Reflect.get(target, prop, receiver);
-        if (existing !== undefined) {
-          return existing;
-        }
-        const jsonSchema = (target as any).jsonSchema;
-        if (jsonSchema == null) {
-          return undefined;
-        }
-        const rebuilt = toEffectSchema(jsonSchema);
-        defineHiddenProperty(target, StaticTypeSchemaSlot, rebuilt);
-        return rebuilt;
-      }
+    // The ECHO system surface (objectData, ChangeId, StaticTypeSchemaSlot, ...) lives as accessors
+    // on the behaviour prototype; resolve them via Reflect.get and return as-is — these are not user
+    // data and must never be proxy-wrapped.
+    if (typeof prop === 'symbol' && isBehaviourAccessor(target, prop)) {
+      return Reflect.get(target, prop, receiver);
+    }
+
+    // The back-reference to the type entity is own metadata — return the raw value so we don't
+    // re-wrap an already-reactive `Type.Type` entity in another proxy (which would fail the
+    // SchemaId-in-target invariant).
+    if (prop === TypeEntityId) {
+      return Reflect.get(target, prop, receiver);
     }
 
-    // Handle getter properties.
+    // Own getter properties (e.g. the `SchemaId` slot installed by `setSchemaProperties`).
     if (Object.getOwnPropertyDescriptor(target, prop)?.get) {
       return Reflect.get(target, prop, receiver);
     }
@@ -247,19 +372,7 @@ export class TypedReactiveHandler implements ReactiveHandler<ProxyTarget> {
 
   set(target: ProxyTarget, prop: string | symbol, value: any, receiver: any): boolean {
     const echoRoot = getEchoRoot(target);
-
-    // Check readonly enforcement - mutations only allowed within Obj.update().
-    // Skip check if the object is still being initialized (no ChangeId handler yet).
-    // Also skip for non-initialized root objects (those without EventId).
-    // Skip for symbol properties (internal infrastructure, not user data).
-    const isInitialized = ChangeId in echoRoot || EventId in echoRoot;
-    const isSymbolProp = typeof prop === 'symbol';
-    if (isInitialized && !isSymbolProp && !isInChangeContext(echoRoot)) {
-      throw new Error(
-        `Cannot modify object property "${String(prop)}" outside of Obj.update(). ` +
-          'Use Obj.update(obj, (mutableObj) => { mutableObj.property = value; }) instead.',
-      );
-    }
+    const isInitialized = assertMutableWithinChange(echoRoot, prop);
 
     let result: boolean = false;
     this._inSet = true;
@@ -294,7 +407,7 @@ export class TypedReactiveHandler implements ReactiveHandler<ProxyTarget> {
 
     // Check readonly enforcement - mutations only allowed within Obj.update().
     // Skip for symbol properties (internal infrastructure, not user data).
-    const isInitialized = (echoRoot as any)[ChangeId] === true || EventId in echoRoot;
+    const isInitialized = EventId in echoRoot;
     const isSymbolProp = typeof property === 'symbol';
     if (isInitialized && !isSymbolProp && !isInChangeContext(echoRoot)) {
       throw createPropertyDeleteError(property);
@@ -309,18 +422,7 @@ export class TypedReactiveHandler implements ReactiveHandler<ProxyTarget> {
 
   defineProperty(target: ProxyTarget, property: string | symbol, attributes: PropertyDescriptor): boolean {
     const echoRoot = getEchoRoot(target);
-
-    // Check readonly enforcement - mutations only allowed within Obj.update().
-    // Skip check if the object is still being initialized (no ChangeId handler yet).
-    // Skip for symbol properties (internal infrastructure, not user data).
-    const isInitialized = ChangeId in echoRoot || EventId in echoRoot;
-    const isSymbolProp = typeof property === 'symbol';
-    if (isInitialized && !isSymbolProp && !isInChangeContext(echoRoot)) {
-      throw new Error(
-        `Cannot modify object property "${String(property)}" outside of Obj.update(). ` +
-          'Use Obj.update(obj, (mutableObj) => { mutableObj.property = value; }) instead.',
-      );
-    }
+    const isInitialized = assertMutableWithinChange(echoRoot, property);
 
     const { echoRoot: _, preparedValue } = this._prepareValueForAssignment(target, property, attributes.value);
     const result = Reflect.defineProperty(target, property, {
@@ -334,6 +436,65 @@ export class TypedReactiveHandler implements ReactiveHandler<ProxyTarget> {
     return result;
   }
 
+  textUpdate(target: ProxyTarget, path: readonly (string | number)[], newText: string): void {
+    this._applyTextMutation(target, path, () => newText);
+  }
+
+  textSplice(
+    target: ProxyTarget,
+    path: readonly (string | number)[],
+    start: number,
+    deleteCount: number,
+    insert: string,
+  ): string {
+    let removed = '';
+    this._applyTextMutation(target, path, (current) => {
+      const range = normalizeSpliceRange(current.length, start, deleteCount);
+      removed = current.slice(range.start, range.start + range.deleteCount);
+      return current.slice(0, range.start) + insert + current.slice(range.start + range.deleteCount);
+    });
+    return removed;
+  }
+
+  /**
+   * Shared read-modify-write for the in-memory string CRDT path. Mirrors the `set` trap: enforce the
+   * change context, then mutate and notify through the same batched notification path so reactivity fires.
+   *
+   * Writes via `setDeep` on the raw target, intentionally bypassing `_prepareValueForAssignment` /
+   * `_validateValue`: a string CRDT delta produces a string, and per-delta schema checks (pattern,
+   * maxLength) would reject valid intermediate states during incremental edits. Such constraints are
+   * enforced at the initial assignment or as application-level invariants, mirroring the Automerge path.
+   */
+  private _applyTextMutation(
+    target: ProxyTarget,
+    path: readonly (string | number)[],
+    compute: (current: string) => string,
+  ): void {
+    const echoRoot = getEchoRoot(target);
+    if (!isInChangeContext(echoRoot)) {
+      throw new Error(
+        `Cannot modify text at "${path.join('.')}" outside of Obj.update(). ` +
+          'Use Obj.update(obj, () => { Text.splice(obj, path, ...); }) instead.',
+      );
+    }
+
+    const keyPath = [...path];
+    invariant(keyPath.length > 0, 'Text path must be non-empty');
+    const current = getDeep(target, keyPath);
+    if (typeof current !== 'string') {
+      throw new TypeError(`Text mutation target at "${keyPath.join('.')}" is not a string.`);
+    }
+
+    const next = compute(current);
+    batchEvents(() => {
+      // Write directly on the raw target (not the proxy) and notify through the same batched path
+      // the `set` trap uses, so subscribers fire once per `Obj.update`.
+      setDeep(target, keyPath, next);
+      queueNotification(echoRoot);
+      notifyOwnerChain(target);
+    });
+  }
+
   /**
    * Prepare a value for assignment to a typed object property.
    * Handles cycle detection, copy-on-assign, array conversion, validation, and ownership.
@@ -345,8 +506,8 @@ export class TypedReactiveHandler implements ReactiveHandler<ProxyTarget> {
   ): { echoRoot: object; preparedValue: any } {
     const echoRoot = getEchoRoot(target);
 
-    if (prop === ParentId) {
-      return { echoRoot, preparedValue: value }; // Short-circuit for parent assignment.
+    if (typeof prop === 'symbol') {
+      return { echoRoot, preparedValue: value };
     }
 
     // Check for cycles before assignment.
@@ -397,6 +558,7 @@ export class TypedReactiveHandler implements ReactiveHandler<ProxyTarget> {
     }
     const schema = SchemaValidator.getTargetPropertySchema(target, prop);
     const _ = Schema.asserts(schema)(value);
+    SchemaValidator.assertExactProperties(schema, value, (path) => getDeep(value, path));
     if (isValidProxyTarget(value)) {
       setSchemaProperties(value, schema);
     }
@@ -470,12 +632,27 @@ const setSchemaProperties = (obj: any, schema: Schema.Schema.AnyNoContext, typeS
   } else {
     defineHiddenProperty(obj, SchemaId, schema);
   }
+
+  if (Array.isArray(obj)) {
+    for (let index = 0; index < obj.length; index++) {
+      if (isValidProxyTarget(obj[index])) {
+        const elementSchema = SchemaValidator.getIndexedElementSchema(schema, index) ?? Schema.Any;
+        setSchemaProperties(obj[index], elementSchema);
+      }
+    }
+    return;
+  }
+
   for (const key in obj) {
     if (isValidProxyTarget(obj[key])) {
-      const elementSchema = SchemaValidator.getTargetPropertySchema(obj, key);
-      if (elementSchema != null) {
-        setSchemaProperties(obj[key], elementSchema);
+      let elementSchema: Schema.Schema<any>;
+      try {
+        elementSchema = SchemaValidator.getTargetPropertySchema(obj, key);
+      } catch {
+        // Property not in schema — treat as untyped so the proxy can still wrap it.
+        elementSchema = Schema.Any;
       }
+      setSchemaProperties(obj[key], elementSchema);
     }
   }
 };
@@ -490,6 +667,7 @@ export const prepareTypedTarget = <T>(target: T, schema: Schema.Schema<T, any>,
 
   SchemaValidator.validateSchema(schema);
   const _ = Schema.asserts(schema)(target);
+  SchemaValidator.assertExactProperties(schema, target, (path) => getDeep(target, path));
   makeArraysReactive(target);
   setSchemaProperties(target, schema, typeSource);
 };