@xnetjs/sync 2.4.0 → 3.0.0

package/README.md

@@ -2,6 +2,11 @@
 
 Unified sync primitives for xNet -- Change\<T\>, Lamport clocks, hash chains, and a comprehensive Yjs security layer.
 
+> **Alpha software.** xNet is released but early: this package is on npm and
+> usable today, but its API can change between releases, sometimes without a
+> migration path. Pin your version. See the
+> [project README](https://github.com/crs48/xNet#readme) for what alpha means here.
+
 ## Installation
 
 ```bash

package/dist/index.d.ts

@@ -172,6 +172,28 @@ declare function createWebCryptoChangeSigner(signingKey: Uint8Array): ChangeSign
  * @returns true if the signature is valid
  */
 declare function verifyChange<T>(change: Change<T>, publicKey: Uint8Array): boolean;
+/**
+ * Verify a change's signature using the native (WebCrypto) verifier when the
+ * runtime has it — ~13x faster than the pure-JS path (exploration 0350/0357).
+ *
+ * Semantically identical to {@link verifyChange}; use this on bulk paths
+ * (hub relay, `.xnetpack` import, NDJSON restore, resync) where per-change
+ * verification is the bottleneck. Single interactive writes can keep using
+ * the synchronous {@link verifyChange}.
+ */
+declare function verifyChangeFast<T>(change: Change<T>, publicKey: Uint8Array): Promise<boolean>;
+/**
+ * Verify many changes at once. Results are positional — `result[i]`
+ * corresponds to `entries[i]` — and a failure never short-circuits the rest,
+ * so callers can report exactly which change was rejected.
+ *
+ * This shares one native-support probe and one key import per distinct author
+ * across the whole set, which is the common shape for a bulk import.
+ */
+declare function verifyChangesFast<T>(entries: readonly {
+    change: Change<T>;
+    publicKey: Uint8Array;
+}[]): Promise<boolean[]>;
 /**
  * Recompute the content hash of a signed change from its own fields.
  *
@@ -195,6 +217,156 @@ declare function verifyChangeHash<T>(change: Change<T>): boolean;
  */
 declare function createChangeId(): string;
 
+/**
+ * Batch commits: one signature over many changes (exploration 0357 Tier 2).
+ *
+ * A bulk operation in xNet is N changes, one per node — that is deliberate,
+ * and it is what makes per-node parent chains, per-property LWW, and selective
+ * sync work. But it means a 10,000-node import pays 10,000 Ed25519 signatures
+ * on write and 10,000 verifications on read, plus 88 bytes of base64 signature
+ * per change on the wire and on disk.
+ *
+ * Every mature system in this space solved that the same way: hash every unit,
+ * sign only at a batch boundary, and prove membership under the signed root.
+ * Hypercore signs one Merkle root per append; Certificate Transparency signs
+ * one tree head per interval; AT Protocol signs one commit over an MST no
+ * matter how many records changed. Per-message signing (Scuttlebutt, Nostr) is
+ * the pattern their successors moved away from.
+ *
+ * A `BatchCommit` is that boundary. It carries the ordered hashes of the
+ * changes it covers plus a BLAKE3 root over them, and is signed ONCE. A
+ * verifier then does N cheap hash recomputations (which it must do anyway, to
+ * confirm each change matches its own content address) plus ONE signature
+ * verification, instead of N signature verifications.
+ *
+ * ## What this does NOT change
+ *
+ * - The `Change` record, its canonical bytes, its hash recipe, and the LWW
+ *   ordering rules are untouched. This is an ADDITIVE record, so the four
+ *   conformance kernels gain vectors rather than a re-derivation.
+ * - Authorization, ledger enforcement, quota, and LWW still run per change. A
+ *   commit amortizes *authentication*, nothing else.
+ *
+ * ## Where it is valid
+ *
+ * Only in lanes where the batch travels as a unit — `.xnetpack` import/export,
+ * hub NDJSON restore, initial-sync snapshots, migrations. Interactive single
+ * edits keep their per-change signature, because live relay fans a change out
+ * to peers who may never receive its siblings, and a change whose validity
+ * depends on a sibling would break that.
+ *
+ * Chain-head signing (ATProto's `prev`, Scuttlebutt's feed) is deliberately
+ * NOT used here: xNet's parent-hash chains are per-NODE, so a bulk import of N
+ * distinct nodes is N chains of depth 1 and a chain head amortizes nothing.
+ * The root must span nodes, hence a list/tree over change hashes.
+ */
+
+/**
+ * Maximum changes one commit may cover.
+ *
+ * Matches the wire batch cap: a commit is verified by recomputing every member
+ * hash, so an unbounded commit would be an unbounded unit of work for the
+ * verifier. Larger imports emit several commits.
+ */
+declare const MAX_COMMIT_CHANGES = 1000;
+/** A batch commit before it has been hashed and signed. */
+interface UnsignedBatchCommit {
+    id: string;
+    type: 'batch-commit';
+    protocolVersion: number;
+    authorDID: DID;
+    /** Room/scope the covered changes belong to, when the lane has one. */
+    room?: string;
+    /** Ordered hashes of the covered changes. Order is part of the root. */
+    changeHashes: ContentId[];
+    /** BLAKE3 over the ordered change hashes — see {@link computeBatchRoot}. */
+    root: ContentId;
+    lamport: number;
+    wallTime: number;
+}
+/** A signed batch commit. One signature covers every change it names. */
+interface BatchCommit extends UnsignedBatchCommit {
+    hash: ContentId;
+    signature: Uint8Array;
+}
+/**
+ * Compute the root over an ordered list of change hashes.
+ *
+ * This is a flat digest, not a Merkle tree: a commit's members always travel
+ * together in the lanes where commits are valid, so no member ever needs an
+ * O(log n) inclusion proof against the root. If a lane later needs to
+ * redistribute covered changes individually, this is the function that becomes
+ * a Merkle root (and members gain proofs) — the commit shape does not change.
+ *
+ * Hashes are joined with a separator that cannot appear in a `cid:blake3:`
+ * string, so no concatenation of two hash lists can collide with another.
+ */
+declare function computeBatchRoot(changeHashes: readonly ContentId[]): ContentId;
+/**
+ * Hash a commit for signing. Same recipe as a change: recursively key-sorted
+ * canonical JSON, BLAKE3, `cid:blake3:` prefix.
+ */
+declare function computeBatchCommitHash(unsigned: UnsignedBatchCommit): ContentId;
+interface CreateBatchCommitOptions {
+    id: string;
+    authorDID: DID;
+    changeHashes: readonly ContentId[];
+    lamport: number;
+    wallTime: number;
+    room?: string;
+    protocolVersion?: number;
+}
+/** Build an unsigned commit, computing its root. */
+declare function createUnsignedBatchCommit(options: CreateBatchCommitOptions): UnsignedBatchCommit;
+/** Hash and sign a commit — the ONE signature that covers the whole batch. */
+declare function signBatchCommit(unsigned: UnsignedBatchCommit, signingKey: Uint8Array): BatchCommit;
+/** Recompute a commit's hash from its own fields (the tamper check). */
+declare function recomputeBatchCommitHash(commit: BatchCommit): ContentId;
+/**
+ * Verify a commit in isolation: its hash matches its fields, its root matches
+ * its change-hash list, and its signature matches its author.
+ *
+ * This says nothing about whether any particular change belongs to it — use
+ * {@link verifyBatch} for that.
+ */
+declare function verifyBatchCommit(commit: BatchCommit, publicKey: Uint8Array): boolean;
+/** Async form of {@link verifyBatchCommit}, using native Ed25519 when present. */
+declare function verifyBatchCommitFast(commit: BatchCommit, publicKey: Uint8Array): Promise<boolean>;
+interface BatchVerificationResult {
+    /** True only if the commit is valid AND every supplied change is covered by it. */
+    ok: boolean;
+    /** Per-change verdicts, positional with the input. */
+    members: boolean[];
+    reason?: string;
+}
+/**
+ * Verify a whole batch: ONE signature check plus N hash recomputations.
+ *
+ * The membership rules are what keep this from being weaker than per-change
+ * signatures:
+ *
+ * - each change must recompute to its own claimed hash (so payload tampering
+ *   is caught exactly as it would be for a signed change);
+ * - that hash must appear in the commit's list (so a change cannot be smuggled
+ *   into a batch it was not signed over);
+ * - the change's author must equal the commit's author (so a commit cannot
+ *   launder someone else's authorship — the signer vouches only for their own
+ *   changes);
+ * - the commit's own hash/root/signature must be valid (so the list itself
+ *   cannot be edited).
+ *
+ * `recomputeChangeHash` is injected rather than imported to keep this module
+ * free of a cycle with `change.ts`.
+ */
+declare function verifyBatch<T>(commit: BatchCommit, changes: readonly Change<T>[], publicKey: Uint8Array, recomputeChangeHash: (change: Change<T>) => ContentId): Promise<BatchVerificationResult>;
+/**
+ * Split an ordered change list into commit-sized groups.
+ *
+ * Order is preserved, so the caller can emit commits and their member changes
+ * in causal order.
+ */
+declare function chunkForCommits<T>(changes: readonly T[], size?: number): T[][];
+
 /**
  * Lamport clock utilities for total ordering in distributed systems.
  *
@@ -3488,4 +3660,4 @@ declare function createSecurityPolicy(options?: Partial<SecurityPolicy>): Securi
  */
 declare function mergeSecurityPolicies(...policies: Partial<SecurityPolicy>[]): SecurityPolicy;
 
-export { ALL_FEATURES, type AttestationVerificationResult, type AttestationVerifyResult, type AuthorizedDoc, type AuthorizedRoom, type AuthorizedStateAdapter, AuthorizedSyncManager, type AuthorizedSyncManagerOptions, AuthorizedYjsError, AuthorizedYjsSyncProvider, type AuthorizedYjsSyncProviderOptions, BaseSyncProvider, type BatchFlushCallback, COMPACTION_TIME_THRESHOLD, COMPACTION_UPDATE_THRESHOLD, CURRENT_PROTOCOL_VERSION, type ChainValidationResult, type Change, type ChangeHandler, ChangeHandlerRegistry, type ChangeSerializer, type ChangeSigner, type ClientIdAttestation, type ClientIdAttestationV1, type ClientIdAttestationV2, type ClientIdAttestationWire, type ClientIdMap, ClientIdMapImpl, type ContentKeyProvider, type CreateAttestationOptions, type CreateChangeOptions, type CreateEnvelopeOptions, type CreateYjsChangeOptions, DEFAULT_BATCHER_CONFIG, DEFAULT_RATE_LIMITER_CONFIG, DEFAULT_SECURITY_POLICY, DEFAULT_YJS_SCORING_CONFIG, DEPRECATIONS, DEPRECATION_POLICY, type DeprecationCallback, type DeprecationContext, DeprecationError, type DeprecationNotice, type DeprecationType, type DeprecationWarning, type DeserializeError, type DeserializeOutcome, type DeserializeResult, type EncryptedYjsState, type EnvelopeVerificationResult, type EnvelopeVerifyResult, FEATURES, type FeatureConfig, type FeatureFlag, type FeatureValidationError, type FeatureValidationResult, type FeatureValidationWarning, type Fork, type GrantEventStore, HYBRID_SECURITY_POLICY, type HandlerContext, type HandlerEvent, type IntegrityIssue, type IntegrityIssueType, type IntegrityMonitor, type IntegrityMonitorConfig, type IntegrityMonitorStats, type IntegrityReport, type LamportClock, type LamportTimestamp, MAX_SECURITY_POLICY, MAX_YJS_AWARENESS_UPDATE_SIZE, MAX_YJS_DOC_SIZE, MAX_YJS_STATE_VECTOR_SIZE, MAX_YJS_UPDATES_PER_MINUTE, MAX_YJS_UPDATES_PER_SECOND, MAX_YJS_UPDATE_SIZE, type MergeUpdatesFn, type NegotiatedSession, type NegotiationFailure, type NegotiationResult, type NegotiationWarning, type OperationType, type PeerAction, type PeerCapabilities, type PeerInfo, type PersistedDocState, type PolicyRevisionSimulation, type ProcessResult, type RateLimiterConfig, type ReactIntegrityMonitorOptions, type RecipientKeyResolver, type RegistryStats, type RepairAction, type RepairActionType, type ReplicationNamespaceKind, type ReplicationPlan, type ReplicationPlanDestination, type ReplicationPlanDiagnostic, type ReplicationPlanTraceStep, type ResolvedSyncReplicationPolicy, type SecurityPolicy, type SerializeOptions, type SerializedChange, type SerializerRegistry, type SignedYjsEnvelope, type SignedYjsEnvelopeV1, type SignedYjsEnvelopeV2, type SignedYjsEnvelopeWire, type SyncCompatibilityConfig, type SyncConnectionStatus, type SyncEventListener, type SyncFederationConfig, type SyncFederationHub, type SyncFederationNamespacePolicy, type SyncLifecycleInput, type SyncLifecyclePhase, type SyncLifecycleState, type SyncProvider, type SyncProviderEvents, type SyncProviderOptions, type SyncReplicationConfig, type SyncStatus, type UnsignedChange, type UnsignedYjsChange, V1Serializer, V2Serializer, type ValidationError, type ValidationResult, type ValidationWarning, type VerifyAttestationOptions, type VerifyEnvelopeOptions, type VerifyOptions, VersionNegotiator, type YDocCodec, type YDocLike, YJS_CHANGE_TYPE, YJS_RATE_BURST_ALLOWANCE, YJS_SYNC_CHUNK_SIZE, type YjsAuthDecision, YjsAuthGate, type YjsAuthGateOptions, YjsBatcher, type YjsBatcherConfig, type YjsChange, YjsCheckpointer, type YjsCheckpointerOptions, YjsIntegrityError, type YjsPeerActionEvent, type YjsPeerActionListener, type YjsPeerMetrics, YjsPeerScorer, YjsRateLimiter, type YjsRateLimiterOptions, type YjsScoringConfig, YjsStateIntegrityError, type YjsUpdatePayload, type YjsViolationType, addDependencies, attemptRepair, autoDeserialize, autoSerialize, calculateChunkCount, changeHandlerRegistry, checkAndLogDeprecations, checkDeprecations, chunkUpdate, clearLoggedDeprecations, compareLamportTimestamps, computeChangeHash, configureDeprecationPolicy, createBatchId, createChangeId, createClientIdAttestation, createClientIdAttestationV1, createClientIdAttestationV2, createHandler, createIntegrityMonitor, createLamportClock, createLocalCapabilities, createPersistedDocState, createReactIntegrityMonitor, createSecurityPolicy, createSerializerRegistry, createSyncLifecycleState, createTestContext, createUnsignedChange, createUnsignedYjsChange, createVersionedHandler, createWebCryptoChangeSigner, createYjsChange, decryptYjsState, defaultNegotiator, deriveClientIdFromDid, deriveSyncLifecyclePhase, deserializeClientIdAttestation, deserializeEncryptedYjsState, deserializeYjsEnvelope, detectFork, diffFeatures, encryptYjsState, envelopeSize, estimateBase64DecodedLength, findCommonAncestor, findHeads, findOrphans, findRoots, formatDeprecationReport, formatIntegrityReport, getAllDependencies, getAncestry, getChainDepth, getChainHeads, getChainRoots, getChangeNodeId, getDefaultSerializer, getDeprecation, getDeprecationsByType, getEnabledFeatures, getFeatureConflicts, getFeatureDependencies, getFeatureVersion, getForks, getOptionalFeatures, getRequiredFeatures, getSecurityLevel, getSerializer, hasSignedEnvelope, hashYjsState, inferReplicationNamespaceKind, intersectFeatures, isAfter, isAwarenessUpdateTooLarge, isBase64PayloadTooLarge, isBefore, isCriticalOperation, isDeprecated, isDerivedClientId, isDocumentTooLarge, isEphemeralOperation, isFeatureAvailable, isFeatureEnabled, isLegacyUpdate, isNodeChange, isRemoved, isStateVectorTooLarge, isUpdateTooLarge, isV1Attestation, isV1Envelope, isV2Attestation, isV2Envelope, isYjsChange, loadVerifiedState, logDeprecation, maxTime, mergeSecurityPolicies, normalizeSyncFederationHubs, parseCapabilities, parseTimestamp, planReplicationDestinations, quickIntegrityCheck, reassembleChunks, receive, recomputeChangeHash, registerDeprecation, resolveSyncReplicationPolicy, serializeClientIdAttestation, serializeEncryptedYjsState, serializeTimestamp, serializeYjsEnvelope, serializerRegistry, shouldCompact, signChange, signYjsUpdate, signYjsUpdateBatch, signYjsUpdateV1, signYjsUpdateV2, simulateSyncPolicyRevision, tick, toEncryptedData, topologicalSort, v1Serializer, v2Serializer, validateChain, validateClientIdOwnership, validateFeatureSet, verifyChange, verifyChangeHash, verifyClientIdAttestation, verifyClientIdAttestationV1, verifyClientIdAttestationV2, verifyIntegrity, verifyPersistedDocState, verifySingleChange, verifyYjsEnvelope, verifyYjsEnvelopeQuick, verifyYjsEnvelopeV1, verifyYjsEnvelopeV2, verifyYjsStateIntegrity };
+export { ALL_FEATURES, type AttestationVerificationResult, type AttestationVerifyResult, type AuthorizedDoc, type AuthorizedRoom, type AuthorizedStateAdapter, AuthorizedSyncManager, type AuthorizedSyncManagerOptions, AuthorizedYjsError, AuthorizedYjsSyncProvider, type AuthorizedYjsSyncProviderOptions, BaseSyncProvider, type BatchCommit, type BatchFlushCallback, type BatchVerificationResult, COMPACTION_TIME_THRESHOLD, COMPACTION_UPDATE_THRESHOLD, CURRENT_PROTOCOL_VERSION, type ChainValidationResult, type Change, type ChangeHandler, ChangeHandlerRegistry, type ChangeSerializer, type ChangeSigner, type ClientIdAttestation, type ClientIdAttestationV1, type ClientIdAttestationV2, type ClientIdAttestationWire, type ClientIdMap, ClientIdMapImpl, type ContentKeyProvider, type CreateAttestationOptions, type CreateBatchCommitOptions, type CreateChangeOptions, type CreateEnvelopeOptions, type CreateYjsChangeOptions, DEFAULT_BATCHER_CONFIG, DEFAULT_RATE_LIMITER_CONFIG, DEFAULT_SECURITY_POLICY, DEFAULT_YJS_SCORING_CONFIG, DEPRECATIONS, DEPRECATION_POLICY, type DeprecationCallback, type DeprecationContext, DeprecationError, type DeprecationNotice, type DeprecationType, type DeprecationWarning, type DeserializeError, type DeserializeOutcome, type DeserializeResult, type EncryptedYjsState, type EnvelopeVerificationResult, type EnvelopeVerifyResult, FEATURES, type FeatureConfig, type FeatureFlag, type FeatureValidationError, type FeatureValidationResult, type FeatureValidationWarning, type Fork, type GrantEventStore, HYBRID_SECURITY_POLICY, type HandlerContext, type HandlerEvent, type IntegrityIssue, type IntegrityIssueType, type IntegrityMonitor, type IntegrityMonitorConfig, type IntegrityMonitorStats, type IntegrityReport, type LamportClock, type LamportTimestamp, MAX_COMMIT_CHANGES, MAX_SECURITY_POLICY, MAX_YJS_AWARENESS_UPDATE_SIZE, MAX_YJS_DOC_SIZE, MAX_YJS_STATE_VECTOR_SIZE, MAX_YJS_UPDATES_PER_MINUTE, MAX_YJS_UPDATES_PER_SECOND, MAX_YJS_UPDATE_SIZE, type MergeUpdatesFn, type NegotiatedSession, type NegotiationFailure, type NegotiationResult, type NegotiationWarning, type OperationType, type PeerAction, type PeerCapabilities, type PeerInfo, type PersistedDocState, type PolicyRevisionSimulation, type ProcessResult, type RateLimiterConfig, type ReactIntegrityMonitorOptions, type RecipientKeyResolver, type RegistryStats, type RepairAction, type RepairActionType, type ReplicationNamespaceKind, type ReplicationPlan, type ReplicationPlanDestination, type ReplicationPlanDiagnostic, type ReplicationPlanTraceStep, type ResolvedSyncReplicationPolicy, type SecurityPolicy, type SerializeOptions, type SerializedChange, type SerializerRegistry, type SignedYjsEnvelope, type SignedYjsEnvelopeV1, type SignedYjsEnvelopeV2, type SignedYjsEnvelopeWire, type SyncCompatibilityConfig, type SyncConnectionStatus, type SyncEventListener, type SyncFederationConfig, type SyncFederationHub, type SyncFederationNamespacePolicy, type SyncLifecycleInput, type SyncLifecyclePhase, type SyncLifecycleState, type SyncProvider, type SyncProviderEvents, type SyncProviderOptions, type SyncReplicationConfig, type SyncStatus, type UnsignedBatchCommit, type UnsignedChange, type UnsignedYjsChange, V1Serializer, V2Serializer, type ValidationError, type ValidationResult, type ValidationWarning, type VerifyAttestationOptions, type VerifyEnvelopeOptions, type VerifyOptions, VersionNegotiator, type YDocCodec, type YDocLike, YJS_CHANGE_TYPE, YJS_RATE_BURST_ALLOWANCE, YJS_SYNC_CHUNK_SIZE, type YjsAuthDecision, YjsAuthGate, type YjsAuthGateOptions, YjsBatcher, type YjsBatcherConfig, type YjsChange, YjsCheckpointer, type YjsCheckpointerOptions, YjsIntegrityError, type YjsPeerActionEvent, type YjsPeerActionListener, type YjsPeerMetrics, YjsPeerScorer, YjsRateLimiter, type YjsRateLimiterOptions, type YjsScoringConfig, YjsStateIntegrityError, type YjsUpdatePayload, type YjsViolationType, addDependencies, attemptRepair, autoDeserialize, autoSerialize, calculateChunkCount, changeHandlerRegistry, checkAndLogDeprecations, checkDeprecations, chunkForCommits, chunkUpdate, clearLoggedDeprecations, compareLamportTimestamps, computeBatchCommitHash, computeBatchRoot, computeChangeHash, configureDeprecationPolicy, createBatchId, createChangeId, createClientIdAttestation, createClientIdAttestationV1, createClientIdAttestationV2, createHandler, createIntegrityMonitor, createLamportClock, createLocalCapabilities, createPersistedDocState, createReactIntegrityMonitor, createSecurityPolicy, createSerializerRegistry, createSyncLifecycleState, createTestContext, createUnsignedBatchCommit, createUnsignedChange, createUnsignedYjsChange, createVersionedHandler, createWebCryptoChangeSigner, createYjsChange, decryptYjsState, defaultNegotiator, deriveClientIdFromDid, deriveSyncLifecyclePhase, deserializeClientIdAttestation, deserializeEncryptedYjsState, deserializeYjsEnvelope, detectFork, diffFeatures, encryptYjsState, envelopeSize, estimateBase64DecodedLength, findCommonAncestor, findHeads, findOrphans, findRoots, formatDeprecationReport, formatIntegrityReport, getAllDependencies, getAncestry, getChainDepth, getChainHeads, getChainRoots, getChangeNodeId, getDefaultSerializer, getDeprecation, getDeprecationsByType, getEnabledFeatures, getFeatureConflicts, getFeatureDependencies, getFeatureVersion, getForks, getOptionalFeatures, getRequiredFeatures, getSecurityLevel, getSerializer, hasSignedEnvelope, hashYjsState, inferReplicationNamespaceKind, intersectFeatures, isAfter, isAwarenessUpdateTooLarge, isBase64PayloadTooLarge, isBefore, isCriticalOperation, isDeprecated, isDerivedClientId, isDocumentTooLarge, isEphemeralOperation, isFeatureAvailable, isFeatureEnabled, isLegacyUpdate, isNodeChange, isRemoved, isStateVectorTooLarge, isUpdateTooLarge, isV1Attestation, isV1Envelope, isV2Attestation, isV2Envelope, isYjsChange, loadVerifiedState, logDeprecation, maxTime, mergeSecurityPolicies, normalizeSyncFederationHubs, parseCapabilities, parseTimestamp, planReplicationDestinations, quickIntegrityCheck, reassembleChunks, receive, recomputeBatchCommitHash, recomputeChangeHash, registerDeprecation, resolveSyncReplicationPolicy, serializeClientIdAttestation, serializeEncryptedYjsState, serializeTimestamp, serializeYjsEnvelope, serializerRegistry, shouldCompact, signBatchCommit, signChange, signYjsUpdate, signYjsUpdateBatch, signYjsUpdateV1, signYjsUpdateV2, simulateSyncPolicyRevision, tick, toEncryptedData, topologicalSort, v1Serializer, v2Serializer, validateChain, validateClientIdOwnership, validateFeatureSet, verifyBatch, verifyBatchCommit, verifyBatchCommitFast, verifyChange, verifyChangeFast, verifyChangeHash, verifyChangesFast, verifyClientIdAttestation, verifyClientIdAttestationV1, verifyClientIdAttestationV2, verifyIntegrity, verifyPersistedDocState, verifySingleChange, verifyYjsEnvelope, verifyYjsEnvelopeQuick, verifyYjsEnvelopeV1, verifyYjsEnvelopeV2, verifyYjsStateIntegrity };

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/change.ts
-import { hashHex, sign, verify } from "@xnetjs/crypto";
+import { hashHex, sign, verify, verifyFast, verifyMany } from "@xnetjs/crypto";
 var CURRENT_PROTOCOL_VERSION = 4;
 function createUnsignedChange(options) {
   const unsigned = {
@@ -112,14 +112,33 @@ function createWebCryptoChangeSigner(signingKey) {
   };
 }
 function verifyChange(change, publicKey) {
+  warnOnFutureProtocolVersion(change);
+  const hashBytes = new TextEncoder().encode(change.hash);
+  return verify(hashBytes, change.signature, publicKey);
+}
+function warnOnFutureProtocolVersion(change) {
   const version = change.protocolVersion ?? 0;
   if (version > CURRENT_PROTOCOL_VERSION) {
     console.warn(
       `[xnet/sync] Change ${change.id} uses protocol version ${version}, but current version is ${CURRENT_PROTOCOL_VERSION}. Consider upgrading xNet for full compatibility.`
     );
   }
+}
+async function verifyChangeFast(change, publicKey) {
+  warnOnFutureProtocolVersion(change);
   const hashBytes = new TextEncoder().encode(change.hash);
-  return verify(hashBytes, change.signature, publicKey);
+  return verifyFast(hashBytes, change.signature, publicKey);
+}
+async function verifyChangesFast(entries) {
+  const encoder = new TextEncoder();
+  for (const entry of entries) warnOnFutureProtocolVersion(entry.change);
+  return verifyMany(
+    entries.map((entry) => ({
+      message: encoder.encode(entry.change.hash),
+      signature: entry.change.signature,
+      publicKey: entry.publicKey
+    }))
+  );
 }
 function recomputeChangeHash(change) {
   const unsigned = {
@@ -148,6 +167,95 @@ function createChangeId() {
   return crypto.randomUUID();
 }
 
+// src/batch-commit.ts
+import { hashHex as hashHex2, sign as sign2, verify as verify2, verifyFast as verifyFast2 } from "@xnetjs/crypto";
+var MAX_COMMIT_CHANGES = 1e3;
+function computeBatchRoot(changeHashes) {
+  const canonical = changeHashes.join("\n");
+  return `cid:blake3:${hashHex2(new TextEncoder().encode(canonical))}`;
+}
+function computeBatchCommitHash(unsigned) {
+  const canonical = JSON.stringify(sortObjectKeys(unsigned));
+  return `cid:blake3:${hashHex2(new TextEncoder().encode(canonical))}`;
+}
+function createUnsignedBatchCommit(options) {
+  if (options.changeHashes.length === 0) {
+    throw new Error("[xnet/sync] a batch commit must cover at least one change");
+  }
+  if (options.changeHashes.length > MAX_COMMIT_CHANGES) {
+    throw new Error(
+      `[xnet/sync] a batch commit may cover at most ${MAX_COMMIT_CHANGES} changes (got ${options.changeHashes.length}); split the batch`
+    );
+  }
+  const changeHashes = [...options.changeHashes];
+  const unsigned = {
+    id: options.id,
+    type: "batch-commit",
+    protocolVersion: options.protocolVersion ?? CURRENT_PROTOCOL_VERSION,
+    authorDID: options.authorDID,
+    changeHashes,
+    root: computeBatchRoot(changeHashes),
+    lamport: options.lamport,
+    wallTime: options.wallTime
+  };
+  if (options.room !== void 0) unsigned.room = options.room;
+  return unsigned;
+}
+function signBatchCommit(unsigned, signingKey) {
+  const hash4 = computeBatchCommitHash(unsigned);
+  return {
+    ...unsigned,
+    hash: hash4,
+    signature: sign2(new TextEncoder().encode(hash4), signingKey)
+  };
+}
+function recomputeBatchCommitHash(commit) {
+  const unsigned = {
+    id: commit.id,
+    type: commit.type,
+    protocolVersion: commit.protocolVersion,
+    authorDID: commit.authorDID,
+    changeHashes: commit.changeHashes,
+    root: commit.root,
+    lamport: commit.lamport,
+    wallTime: commit.wallTime
+  };
+  if (commit.room !== void 0) unsigned.room = commit.room;
+  return computeBatchCommitHash(unsigned);
+}
+function verifyBatchCommit(commit, publicKey) {
+  if (recomputeBatchCommitHash(commit) !== commit.hash) return false;
+  if (computeBatchRoot(commit.changeHashes) !== commit.root) return false;
+  return verify2(new TextEncoder().encode(commit.hash), commit.signature, publicKey);
+}
+async function verifyBatchCommitFast(commit, publicKey) {
+  if (recomputeBatchCommitHash(commit) !== commit.hash) return false;
+  if (computeBatchRoot(commit.changeHashes) !== commit.root) return false;
+  return verifyFast2(new TextEncoder().encode(commit.hash), commit.signature, publicKey);
+}
+async function verifyBatch(commit, changes, publicKey, recomputeChangeHash2) {
+  if (!await verifyBatchCommitFast(commit, publicKey)) {
+    return { ok: false, members: changes.map(() => false), reason: "commit is invalid" };
+  }
+  const covered = new Set(commit.changeHashes);
+  const members = changes.map((change) => {
+    if (recomputeChangeHash2(change) !== change.hash) return false;
+    if (!covered.has(change.hash)) return false;
+    if (change.authorDID !== commit.authorDID) return false;
+    return true;
+  });
+  const failed = members.filter((ok) => !ok).length;
+  return failed === 0 ? { ok: true, members } : { ok: false, members, reason: `${failed} change(s) are not covered by this commit` };
+}
+function chunkForCommits(changes, size = MAX_COMMIT_CHANGES) {
+  const limit = Math.max(1, Math.min(size, MAX_COMMIT_CHANGES));
+  const chunks = [];
+  for (let index = 0; index < changes.length; index += limit) {
+    chunks.push(changes.slice(index, index + limit));
+  }
+  return chunks;
+}
+
 // src/clock.ts
 function createLamportClock(author) {
   return { time: 0, author };
@@ -1125,8 +1233,8 @@ function compareText(left, right) {
 // src/yjs-envelope.ts
 import {
   hash,
-  sign as sign2,
-  verify as verify2,
+  sign as sign3,
+  verify as verify3,
   hybridSign,
   hybridVerify,
   encodeSignature,
@@ -1144,7 +1252,7 @@ function isV1Envelope(envelope) {
 }
 function signYjsUpdateV1(update, authorDID, privateKey, clientId) {
   const updateHash = hash(update, "blake3");
-  const signature = sign2(updateHash, privateKey);
+  const signature = sign3(updateHash, privateKey);
   return {
     update,
     authorDID,
@@ -1157,7 +1265,7 @@ function verifyYjsEnvelopeV1(envelope) {
   try {
     const publicKey = parseDID(envelope.authorDID);
     const updateHash = hash(envelope.update, "blake3");
-    const valid = verify2(updateHash, envelope.signature, publicKey);
+    const valid = verify3(updateHash, envelope.signature, publicKey);
     if (!valid) {
       return { valid: false, reason: "invalid_signature" };
     }
@@ -1502,9 +1610,9 @@ function reassembleChunks(chunks) {
 }
 
 // src/yjs-integrity.ts
-import { hashHex as hashHex2 } from "@xnetjs/crypto";
+import { hashHex as hashHex3 } from "@xnetjs/crypto";
 function hashYjsState(state) {
-  return hashHex2(state, "blake3");
+  return hashHex3(state, "blake3");
 }
 function verifyYjsStateIntegrity(state, expectedHash) {
   return hashYjsState(state) === expectedHash;
@@ -2113,8 +2221,8 @@ function isDid(value) {
 // src/clientid-attestation.ts
 import {
   hash as hash3,
-  sign as sign3,
-  verify as verify3,
+  sign as sign4,
+  verify as verify4,
   hybridSign as hybridSign2,
   hybridVerify as hybridVerify2,
   encodeSignature as encodeSignature2,
@@ -2145,7 +2253,7 @@ function createClientIdAttestationV1(clientId, did, privateKey, room, ttlSeconds
   const expiresAt = Math.floor(Date.now() / 1e3) + ttlSeconds;
   const payload = attestationPayloadV1(clientId, did, room, expiresAt);
   const payloadHash = hash3(payload, "blake3");
-  const signature = sign3(payloadHash, privateKey);
+  const signature = sign4(payloadHash, privateKey);
   return { clientId, did, signature, expiresAt, room };
 }
 function verifyClientIdAttestationV1(attestation) {
@@ -2162,7 +2270,7 @@ function verifyClientIdAttestationV1(attestation) {
       attestation.expiresAt
     );
     const payloadHash = hash3(payload, "blake3");
-    const valid = verify3(payloadHash, attestation.signature, publicKey);
+    const valid = verify4(payloadHash, attestation.signature, publicKey);
     if (!valid) {
       return { valid: false, reason: "invalid_signature" };
     }
@@ -3923,6 +4031,7 @@ export {
   DeprecationError,
   FEATURES,
   HYBRID_SECURITY_POLICY,
+  MAX_COMMIT_CHANGES,
   MAX_SECURITY_POLICY,
   MAX_YJS_AWARENESS_UPDATE_SIZE,
   MAX_YJS_DOC_SIZE,
@@ -3951,9 +4060,12 @@ export {
   changeHandlerRegistry,
   checkAndLogDeprecations,
   checkDeprecations,
+  chunkForCommits,
   chunkUpdate,
   clearLoggedDeprecations,
   compareLamportTimestamps,
+  computeBatchCommitHash,
+  computeBatchRoot,
   computeChangeHash,
   configureDeprecationPolicy,
   createBatchId,
@@ -3971,6 +4083,7 @@ export {
   createSerializerRegistry,
   createSyncLifecycleState,
   createTestContext,
+  createUnsignedBatchCommit,
   createUnsignedChange,
   createUnsignedYjsChange,
   createVersionedHandler,
@@ -4048,6 +4161,7 @@ export {
   quickIntegrityCheck,
   reassembleChunks,
   receive,
+  recomputeBatchCommitHash,
   recomputeChangeHash,
   registerDeprecation,
   resolveSyncReplicationPolicy,
@@ -4057,6 +4171,7 @@ export {
   serializeYjsEnvelope,
   serializerRegistry,
   shouldCompact,
+  signBatchCommit,
   signChange,
   signYjsUpdate,
   signYjsUpdateBatch,
@@ -4071,8 +4186,13 @@ export {
   validateChain,
   validateClientIdOwnership,
   validateFeatureSet,
+  verifyBatch,
+  verifyBatchCommit,
+  verifyBatchCommitFast,
   verifyChange,
+  verifyChangeFast,
   verifyChangeHash,
+  verifyChangesFast,
   verifyClientIdAttestation,
   verifyClientIdAttestationV1,
   verifyClientIdAttestationV2,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xnetjs/sync",
-  "version": "2.4.0",
+  "version": "3.0.0",
   "description": "Unified sync primitives for xNet (Change<T>, vector clocks, hash chains)",
   "license": "MIT",
   "repository": {
@@ -12,8 +12,8 @@
   "types": "./dist/index.d.ts",
   "exports": {
     ".": {
-      "import": "./dist/index.js",
-      "types": "./dist/index.d.ts"
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
     }
   },
   "files": [
@@ -26,9 +26,9 @@
     "provenance": true
   },
   "dependencies": {
-    "@xnetjs/crypto": "2.4.0",
-    "@xnetjs/identity": "2.4.0",
-    "@xnetjs/core": "2.4.0"
+    "@xnetjs/core": "3.0.0",
+    "@xnetjs/crypto": "3.0.0",
+    "@xnetjs/identity": "3.0.0"
   },
   "devDependencies": {
     "fast-check": "^4.8.0",
@@ -41,6 +41,8 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit",
-    "clean": "rm -rf dist"
+    "clean": "rm -rf dist",
+    "api:check": "api-extractor run",
+    "api:update": "api-extractor run --local"
   }
 }