dacument 1.0.1 → 1.2.0

package/dist/Dacument/class.js

@@ -1,5 +1,5 @@
 import { Bytes, generateNonce } from "bytecodec";
-import { generateSignPair } from "zeyra";
+import { SigningAgent, generateSignPair } from "zeyra";
 import { v7 as uuidv7 } from "uuid";
 import { CRArray } from "../CRArray/class.js";
 import { CRMap } from "../CRMap/class.js";
@@ -9,7 +9,7 @@ import { CRSet } from "../CRSet/class.js";
 import { CRText } from "../CRText/class.js";
 import { AclLog } from "./acl.js";
 import { HLC, compareHLC } from "./clock.js";
-import { decodeToken, encodeToken, signToken, verifyToken } from "./crypto.js";
+import { decodeToken, encodeToken, signToken, validateActorKeyPair, verifyDetached, verifyToken, } from "./crypto.js";
 import { array, map, record, register, set, text, isJsValue, isValueOfType, schemaIdInput, } from "./types.js";
 const TOKEN_TYP = "DACOP";
 function nowSeconds() {
@@ -21,6 +21,17 @@ function isObject(value) {
 function isStringArray(value) {
     return Array.isArray(value) && value.every((entry) => typeof entry === "string");
 }
+function isValidNonceId(value) {
+    if (typeof value !== "string")
+        return false;
+    try {
+        const bytes = Bytes.fromBase64UrlString(value);
+        return bytes.byteLength === 32 && value.length === 43;
+    }
+    catch {
+        return false;
+    }
+}
 function stableKey(value) {
     if (value === null)
         return "null";
@@ -35,6 +46,15 @@ function stableKey(value) {
     }
     return JSON.stringify(value);
 }
+function normalizeJwk(jwk) {
+    const entries = Object.entries(jwk).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    return JSON.stringify(Object.fromEntries(entries));
+}
+function jwkEquals(left, right) {
+    if (!left || !right)
+        return false;
+    return normalizeJwk(left) === normalizeJwk(right);
+}
 function isDagNode(node) {
     if (!isObject(node))
         return false;
@@ -55,6 +75,13 @@ function isAclPatch(value) {
         return false;
     if (typeof value.role !== "string")
         return false;
+    if ("publicKeyJwk" in value && value.publicKeyJwk !== undefined) {
+        if (!isObject(value.publicKeyJwk))
+            return false;
+        const jwk = value.publicKeyJwk;
+        if (jwk.kty && jwk.kty !== "EC")
+            return false;
+    }
     return true;
 }
 function isAckPatch(value) {
@@ -67,6 +94,17 @@ function isAckPatch(value) {
         typeof seen.logical === "number" &&
         typeof seen.clockId === "string");
 }
+function isResetPatch(value) {
+    if (!isObject(value))
+        return false;
+    if (typeof value.newDocId !== "string")
+        return false;
+    if (!isValidNonceId(value.newDocId))
+        return false;
+    if ("reason" in value && value.reason !== undefined && typeof value.reason !== "string")
+        return false;
+    return true;
+}
 function isPatchEnvelope(value) {
     return isObject(value) && Array.isArray(value.nodes);
 }
@@ -99,7 +137,7 @@ function createEmptyField(crdt) {
 function roleNeedsKey(role) {
     return role === "owner" || role === "manager" || role === "editor";
 }
-function parseSignerRole(kid, issuer) {
+function parseSignerKind(kid, issuer) {
     if (!kid)
         return null;
     const [kidIssuer, role] = kid.split(":");
@@ -107,6 +145,8 @@ function parseSignerRole(kid, issuer) {
         return null;
     if (role === "owner" || role === "manager" || role === "editor")
         return role;
+    if (role === "actor")
+        return "actor";
     return null;
 }
 async function generateRoleKeys() {
@@ -127,32 +167,57 @@ function toPublicRoleKeys(roleKeys) {
     };
 }
 export class Dacument {
-    static actorId;
-    static setActorId(actorId) {
-        if (Dacument.actorId)
+    static actorInfo;
+    static actorSigner;
+    static async setActorInfo(info) {
+        if (Dacument.actorInfo)
             return;
-        if (!Dacument.isValidActorId(actorId))
-            throw new Error("Dacument.setActorId: actorId must be 256-bit base64url");
-        Dacument.actorId = actorId;
-    }
-    static requireActorId() {
-        if (!Dacument.actorId)
-            throw new Error("Dacument: actorId not set; call Dacument.setActorId()");
-        return Dacument.actorId;
+        if (!Dacument.isValidActorId(info.id))
+            throw new Error("Dacument.setActorInfo: id must be 256-bit base64url");
+        Dacument.assertActorPrivateKey(info.privateKeyJwk);
+        Dacument.assertActorPublicKey(info.publicKeyJwk);
+        await validateActorKeyPair(info.privateKeyJwk, info.publicKeyJwk);
+        Dacument.actorInfo = info;
+        Dacument.actorSigner = new SigningAgent(info.privateKeyJwk);
+    }
+    static requireActorInfo() {
+        if (!Dacument.actorInfo)
+            throw new Error("Dacument: actor info not set; call Dacument.setActorInfo()");
+        return Dacument.actorInfo;
+    }
+    static requireActorSigner() {
+        if (!Dacument.actorSigner)
+            throw new Error("Dacument: actor info not set; call Dacument.setActorInfo()");
+        return Dacument.actorSigner;
+    }
+    static async signActorToken(token) {
+        const signer = Dacument.requireActorSigner();
+        const signature = await signer.sign(Bytes.fromString(token));
+        return Bytes.toBase64UrlString(signature);
     }
     static isValidActorId(actorId) {
-        if (typeof actorId !== "string")
-            return false;
-        try {
-            const bytes = Bytes.fromBase64UrlString(actorId);
-            return bytes.byteLength === 32 && actorId.length === 43;
-        }
-        catch {
-            return false;
-        }
+        return isValidNonceId(actorId);
+    }
+    static assertActorKeyJwk(jwk, label) {
+        if (!jwk || typeof jwk !== "object")
+            throw new Error(`Dacument.setActorInfo: ${label} must be a JWK object`);
+        if (jwk.kty !== "EC")
+            throw new Error(`Dacument.setActorInfo: ${label} must be EC (P-256)`);
+        if (jwk.crv && jwk.crv !== "P-256")
+            throw new Error(`Dacument.setActorInfo: ${label} must use P-256`);
+        if (jwk.alg && jwk.alg !== "ES256")
+            throw new Error(`Dacument.setActorInfo: ${label} must use ES256`);
+    }
+    static assertActorPrivateKey(jwk) {
+        Dacument.assertActorKeyJwk(jwk, "privateKeyJwk");
+        if (!jwk.d)
+            throw new Error("Dacument.setActorInfo: privateKeyJwk must include 'd'");
+    }
+    static assertActorPublicKey(jwk) {
+        Dacument.assertActorKeyJwk(jwk, "publicKeyJwk");
     }
     static schema = (schema) => {
-        Dacument.requireActorId();
+        Dacument.requireActorInfo();
         return schema;
     };
     static register = register;
@@ -173,7 +238,8 @@ export class Dacument {
         return Bytes.toBase64UrlString(new Uint8Array(digest));
     }
     static async create(params) {
-        const ownerId = Dacument.requireActorId();
+        const ownerInfo = Dacument.requireActorInfo();
+        const ownerId = ownerInfo.id;
         const docId = params.docId ?? generateNonce();
         const schemaId = await Dacument.computeSchemaId(params.schema);
         const roleKeys = await generateRoleKeys();
@@ -198,7 +264,8 @@ export class Dacument {
         };
         const sign = async (payload) => {
             const token = await signToken(roleKeys.owner.privateKey, header, payload);
-            ops.push({ token });
+            const actorSig = await Dacument.signActorToken(token);
+            ops.push({ token, actorSig });
         };
         await sign({
             iss: ownerId,
@@ -211,6 +278,7 @@ export class Dacument {
                 id: uuidv7(),
                 target: ownerId,
                 role: "owner",
+                publicKeyJwk: ownerInfo.publicKeyJwk,
             },
         });
         for (const [field, schema] of Object.entries(params.schema)) {
@@ -390,7 +458,7 @@ export class Dacument {
         return { docId, schemaId, roleKeys, snapshot };
     }
     static async load(params) {
-        const actorId = Dacument.requireActorId();
+        const actorId = Dacument.requireActorInfo().id;
         const schemaId = await Dacument.computeSchemaId(params.schema);
         const doc = new Dacument({
             schema: params.schema,
@@ -414,8 +482,11 @@ export class Dacument {
     opLog = [];
     opTokens = new Set();
     verifiedOps = new Map();
+    opIndexByToken = new Map();
+    actorSigByToken = new Map();
     appliedTokens = new Set();
     currentRole;
+    resetState = null;
     revokedCrdtByField = new Map();
     deleteStampsByField = new Map();
     tombstoneStampsByField = new Map();
@@ -425,6 +496,7 @@ export class Dacument {
     ackByActor = new Map();
     suppressMerge = false;
     ackScheduled = false;
+    actorKeyPublishPending = false;
     lastGcBarrier = null;
     snapshotFieldValues() {
         const values = new Map();
@@ -432,9 +504,38 @@ export class Dacument {
             values.set(key, this.fieldValue(key));
         return values;
     }
+    resetError() {
+        const newDocId = this.resetState?.newDocId ?? "unknown";
+        return new Error(`Dacument is reset/deprecated. Use newDocId: ${newDocId}`);
+    }
+    assertNotReset() {
+        if (this.resetState)
+            throw this.resetError();
+    }
+    currentRoleFor(actorId) {
+        if (this.resetState)
+            return "revoked";
+        return this.aclLog.currentRole(actorId);
+    }
+    roleAt(actorId, stamp) {
+        if (this.resetState && compareHLC(stamp, this.resetState.ts) > 0)
+            return "revoked";
+        return this.aclLog.roleAt(actorId, stamp);
+    }
+    recordActorSig(token, actorSig) {
+        if (!actorSig || this.actorSigByToken.has(token))
+            return;
+        this.actorSigByToken.set(token, actorSig);
+        const index = this.opIndexByToken.get(token);
+        if (index === undefined)
+            return;
+        const entry = this.opLog[index];
+        if (!entry.actorSig)
+            entry.actorSig = actorSig;
+    }
     acl;
     constructor(params) {
-        const actorId = Dacument.requireActorId();
+        const actorId = Dacument.requireActorInfo().id;
         this.schema = params.schema;
         this.schemaId = params.schemaId;
         this.docId = params.docId;
@@ -449,11 +550,11 @@ export class Dacument {
         }
         this.acl = {
             setRole: (actorId, role) => this.setRole(actorId, role),
-            getRole: (actorId) => this.aclLog.currentRole(actorId),
+            getRole: (actorId) => this.currentRoleFor(actorId),
             knownActors: () => this.aclLog.knownActors(),
             snapshot: () => this.aclLog.snapshot(),
         };
-        this.currentRole = this.aclLog.currentRole(this.actorId);
+        this.currentRole = this.currentRoleFor(this.actorId);
         return new Proxy(this, {
             get: (target, property, receiver) => {
                 if (typeof property !== "string")
@@ -520,12 +621,163 @@ export class Dacument {
         await Promise.all([...this.pending]);
     }
     snapshot() {
-        if (this.isRevoked())
+        if (this.isRevoked() && !this.resetState)
             throw new Error("Dacument: revoked actors cannot snapshot");
+        const ops = this.opLog.map((op) => {
+            const actorSig = this.actorSigByToken.get(op.token);
+            return actorSig ? { token: op.token, actorSig } : { token: op.token };
+        });
         return {
             docId: this.docId,
             roleKeys: this.roleKeys,
-            ops: this.opLog.slice(),
+            ops,
+        };
+    }
+    getResetState() {
+        return this.resetState
+            ? {
+                ts: this.resetState.ts,
+                by: this.resetState.by,
+                newDocId: this.resetState.newDocId,
+                reason: this.resetState.reason,
+            }
+            : null;
+    }
+    selfRevoke() {
+        this.assertNotReset();
+        const stamp = this.clock.next();
+        const role = this.roleAt(this.actorId, stamp);
+        if (role === "revoked")
+            return;
+        const actorInfo = Dacument.requireActorInfo();
+        const entry = this.aclLog.currentEntry(this.actorId);
+        const patch = {
+            id: uuidv7(),
+            target: this.actorId,
+            role: "revoked",
+        };
+        if (!entry?.publicKeyJwk)
+            patch.publicKeyJwk = actorInfo.publicKeyJwk;
+        const payload = {
+            iss: this.actorId,
+            sub: this.docId,
+            iat: nowSeconds(),
+            stamp,
+            kind: "acl.set",
+            schema: this.schemaId,
+            patch,
+        };
+        if (roleNeedsKey(role) && this.roleKey) {
+            this.queueLocalOp(payload, role);
+            return;
+        }
+        this.queueActorOp(payload);
+    }
+    async accessReset(options = {}) {
+        this.assertNotReset();
+        const stamp = this.clock.next();
+        const role = this.roleAt(this.actorId, stamp);
+        if (role !== "owner")
+            throw new Error("Dacument: only owner can accessReset");
+        if (!this.roleKey)
+            throw new Error("Dacument: missing owner private key");
+        const schema = this.materializeSchema();
+        const created = await Dacument.create({ schema });
+        const newDoc = await Dacument.load({
+            schema,
+            roleKey: created.roleKeys.owner.privateKey,
+            snapshot: created.snapshot,
+        });
+        const patch = {
+            newDocId: created.docId,
+        };
+        if (options.reason)
+            patch.reason = options.reason;
+        const payload = {
+            iss: this.actorId,
+            sub: this.docId,
+            iat: nowSeconds(),
+            stamp,
+            kind: "reset",
+            schema: this.schemaId,
+            patch,
+        };
+        const header = {
+            alg: "ES256",
+            typ: TOKEN_TYP,
+            kid: `${this.actorId}:owner`,
+        };
+        const token = await signToken(this.roleKey, header, payload);
+        const actorSig = await Dacument.signActorToken(token);
+        const oldDocOps = [{ token, actorSig }];
+        this.emitEvent("change", { type: "change", ops: oldDocOps });
+        await this.merge(oldDocOps);
+        return {
+            newDoc,
+            oldDocOps,
+            newDocSnapshot: created.snapshot,
+            roleKeys: created.roleKeys,
+        };
+    }
+    async verifyActorIntegrity(options = {}) {
+        const input = options.token !== undefined
+            ? [options.token]
+            : options.ops ?? options.snapshot?.ops ?? this.opLog;
+        let verified = 0;
+        let failed = 0;
+        let missing = 0;
+        const failures = [];
+        for (let index = 0; index < input.length; index++) {
+            const item = input[index];
+            const token = typeof item === "string" ? item : item.token;
+            const actorSig = typeof item === "string"
+                ? this.actorSigByToken.get(token)
+                : item.actorSig ?? this.actorSigByToken.get(token);
+            const decoded = decodeToken(token);
+            if (!decoded) {
+                failed++;
+                failures.push({ index, reason: "invalid token" });
+                continue;
+            }
+            const payload = decoded.payload;
+            if (!this.isValidPayload(payload)) {
+                failed++;
+                failures.push({ index, reason: "invalid payload" });
+                continue;
+            }
+            if (!actorSig) {
+                missing++;
+                continue;
+            }
+            const publicKey = this.aclLog.publicKeyAt(payload.iss, payload.stamp);
+            if (!publicKey) {
+                missing++;
+                continue;
+            }
+            try {
+                const ok = await verifyDetached(publicKey, token, actorSig);
+                if (!ok) {
+                    failed++;
+                    failures.push({ index, reason: "actor signature mismatch" });
+                    continue;
+                }
+            }
+            catch (error) {
+                failed++;
+                failures.push({
+                    index,
+                    reason: error instanceof Error ? error.message : "actor signature error",
+                });
+                continue;
+            }
+            verified++;
+        }
+        return {
+            ok: failed === 0,
+            verified,
+            failed,
+            missing,
+            failures,
         };
     }
     async merge(input) {
@@ -538,6 +790,7 @@ export class Dacument {
         let diffStamp = null;
         for (const item of tokens) {
             const token = typeof item === "string" ? item : item.token;
+            const actorSig = typeof item === "string" ? undefined : item.actorSig;
             const decoded = decodeToken(token);
             if (!decoded) {
                 rejected++;
@@ -569,23 +822,66 @@ export class Dacument {
                     stored = { payload, signerRole: null };
                 }
                 else {
-                    const signerRole = parseSignerRole(decoded.header.kid, payload.iss);
-                    if (!signerRole) {
+                    const signerKind = parseSignerKind(decoded.header.kid, payload.iss);
+                    if (!signerKind) {
                         rejected++;
                         continue;
                     }
-                    const publicKey = this.roleKeys[signerRole];
-                    const verified = await verifyToken(publicKey, token, TOKEN_TYP);
-                    if (!verified) {
-                        rejected++;
-                        continue;
+                    if (signerKind === "actor") {
+                        if (payload.kind !== "acl.set") {
+                            rejected++;
+                            continue;
+                        }
+                        const patch = isAclPatch(payload.patch) ? payload.patch : null;
+                        if (!patch || patch.target !== payload.iss) {
+                            rejected++;
+                            continue;
+                        }
+                        const wantsSelfRevoke = patch.role === "revoked";
+                        const wantsKeyAttach = Boolean(patch.publicKeyJwk);
+                        if (!wantsSelfRevoke && !wantsKeyAttach) {
+                            rejected++;
+                            continue;
+                        }
+                        const existingKey = this.aclLog.publicKeyAt(payload.iss, payload.stamp);
+                        if (existingKey &&
+                            patch.publicKeyJwk &&
+                            !jwkEquals(existingKey, patch.publicKeyJwk)) {
+                            rejected++;
+                            continue;
+                        }
+                        const publicKey = existingKey ?? patch.publicKeyJwk;
+                        if (!publicKey) {
+                            rejected++;
+                            continue;
+                        }
+                        const verified = await verifyToken(publicKey, token, TOKEN_TYP);
+                        if (!verified) {
+                            rejected++;
+                            continue;
+                        }
+                        stored = { payload, signerRole: "actor" };
+                    }
+                    else {
+                        const publicKey = this.roleKeys[signerKind];
+                        const verified = await verifyToken(publicKey, token, TOKEN_TYP);
+                        if (!verified) {
+                            rejected++;
+                            continue;
+                        }
+                        stored = { payload, signerRole: signerKind };
                     }
-                    stored = { payload, signerRole };
                 }
                 this.verifiedOps.set(token, stored);
                 if (!this.opTokens.has(token)) {
                     this.opTokens.add(token);
-                    this.opLog.push({ token });
+                    const opEntry = { token };
+                    if (typeof actorSig === "string") {
+                        opEntry.actorSig = actorSig;
+                        this.actorSigByToken.set(token, actorSig);
+                    }
+                    this.opLog.push(opEntry);
+                    this.opIndexByToken.set(token, this.opLog.length - 1);
                 }
                 sawNewToken = true;
                 if (payload.kind === "acl.set") {
@@ -595,6 +891,7 @@ export class Dacument {
                     }
                 }
             }
+            this.recordActorSig(token, actorSig);
             decodedOps.push({
                 token,
                 payload: stored.payload,
@@ -605,7 +902,7 @@ export class Dacument {
         let appliedNonAck = false;
         if (sawNewToken) {
             const beforeValues = this.isRevoked() ? undefined : this.snapshotFieldValues();
-            const result = this.rebuildFromVerified(new Set(this.appliedTokens), {
+            const result = await this.rebuildFromVerified(new Set(this.appliedTokens), {
                 beforeValues,
                 diffActor: diffActor ?? this.actorId,
             });
@@ -624,12 +921,13 @@ export class Dacument {
             const entry = this.aclLog.currentEntry(this.actorId);
             this.emitRevoked(prevRole, entry?.by ?? this.actorId, entry?.stamp ?? this.clock.current);
         }
-        if (appliedNonAck)
+        if (appliedNonAck && !this.resetState)
             this.scheduleAck();
         this.maybeGc();
+        this.maybePublishActorKey();
         return { accepted, rejected };
     }
-    rebuildFromVerified(previousApplied, options) {
+    async rebuildFromVerified(previousApplied, options) {
         const invalidated = new Set(previousApplied);
         let appliedNonAck = false;
         this.aclLog.reset();
@@ -639,6 +937,8 @@ export class Dacument {
         this.tombstoneStampsByField.clear();
         this.deleteNodeStampsByField.clear();
         this.revokedCrdtByField.clear();
+        this.resetState = null;
+        let resetStamp = null;
         for (const state of this.fields.values()) {
             state.crdt = createEmptyField(state.schema);
         }
@@ -656,27 +956,68 @@ export class Dacument {
             return left.token < right.token ? -1 : 1;
         });
         for (const { token, payload, signerRole } of ops) {
+            if (resetStamp && compareHLC(payload.stamp, resetStamp) > 0)
+                continue;
             let allowed = false;
-            if (payload.kind === "acl.set") {
-                if (!signerRole)
+            const isReset = payload.kind === "reset";
+            if (isReset) {
+                if (this.resetState)
+                    continue;
+                if (!isResetPatch(payload.patch))
+                    continue;
+                const roleAt = this.roleAt(payload.iss, payload.stamp);
+                if (signerRole === "owner" && roleAt === "owner") {
+                    allowed = true;
+                }
+            }
+            else if (payload.kind === "acl.set") {
+                const patch = isAclPatch(payload.patch) ? payload.patch : null;
+                if (!patch)
                     continue;
                 if (this.aclLog.isEmpty() &&
-                    isAclPatch(payload.patch) &&
-                    payload.patch.role === "owner" &&
-                    payload.patch.target === payload.iss &&
+                    patch.role === "owner" &&
+                    patch.target === payload.iss &&
                     signerRole === "owner") {
                     allowed = true;
                 }
                 else {
-                    const roleAt = this.aclLog.roleAt(payload.iss, payload.stamp);
-                    if (roleAt === signerRole &&
-                        isAclPatch(payload.patch) &&
-                        this.canWriteAclTarget(signerRole, payload.patch.role, payload.patch.target, payload.stamp))
-                        allowed = true;
+                    const roleAt = this.roleAt(payload.iss, payload.stamp);
+                    const isSelfRevoke = patch.target === payload.iss && patch.role === "revoked";
+                    const targetKey = this.aclLog.publicKeyAt(patch.target, payload.stamp);
+                    const isSelfKeyUpdate = patch.target === payload.iss &&
+                        patch.publicKeyJwk &&
+                        patch.role === roleAt &&
+                        roleAt !== "revoked" &&
+                        (!targetKey || jwkEquals(targetKey, patch.publicKeyJwk));
+                    if (patch.publicKeyJwk &&
+                        targetKey &&
+                        !jwkEquals(targetKey, patch.publicKeyJwk)) {
+                        continue;
+                    }
+                    if (isSelfRevoke) {
+                        if (signerRole === "actor") {
+                            allowed = true;
+                        }
+                        else if (signerRole && roleAt === signerRole) {
+                            allowed = true;
+                        }
+                    }
+                    else if (signerRole === "actor") {
+                        if (isSelfKeyUpdate)
+                            allowed = true;
+                    }
+                    else if (signerRole && roleAt === signerRole) {
+                        if (this.canWriteAclTarget(signerRole, patch.role, patch.target, payload.stamp)) {
+                            allowed = true;
+                        }
+                        else if (isSelfKeyUpdate) {
+                            allowed = true;
+                        }
+                    }
                 }
             }
             else {
-                const roleAt = this.aclLog.roleAt(payload.iss, payload.stamp);
+                const roleAt = this.roleAt(payload.iss, payload.stamp);
                 if (payload.kind === "ack") {
                     if (roleAt === "revoked")
                         continue;
@@ -694,19 +1035,23 @@ export class Dacument {
             const emit = !previousApplied.has(token);
             this.suppressMerge = !emit;
             try {
-                const applied = this.applyRemotePayload(payload, signerRole);
+                const applied = isReset
+                    ? this.applyResetPayload(payload, emit)
+                    : this.applyRemotePayload(payload, signerRole);
                 if (!applied)
                     continue;
             }
             finally {
                 this.suppressMerge = false;
             }
+            if (isReset)
+                resetStamp = payload.stamp;
             this.appliedTokens.add(token);
             invalidated.delete(token);
             if (emit && payload.kind !== "ack")
                 appliedNonAck = true;
         }
-        this.currentRole = this.aclLog.currentRole(this.actorId);
+        this.currentRole = this.currentRoleFor(this.actorId);
         if (invalidated.size > 0 &&
             options?.beforeValues &&
             options.diffActor &&
@@ -715,9 +1060,45 @@ export class Dacument {
         }
         return { appliedNonAck };
     }
+    maybePublishActorKey() {
+        if (this.resetState)
+            return;
+        const entry = this.aclLog.currentEntry(this.actorId);
+        if (entry?.publicKeyJwk) {
+            this.actorKeyPublishPending = false;
+            return;
+        }
+        if (this.actorKeyPublishPending)
+            return;
+        if (this.isRevoked())
+            return;
+        if (!entry)
+            return;
+        const actorInfo = Dacument.requireActorInfo();
+        const stamp = this.clock.next();
+        const payload = {
+            iss: this.actorId,
+            sub: this.docId,
+            iat: nowSeconds(),
+            stamp,
+            kind: "acl.set",
+            schema: this.schemaId,
+            patch: {
+                id: uuidv7(),
+                target: this.actorId,
+                role: entry.role,
+                publicKeyJwk: actorInfo.publicKeyJwk,
+            },
+        };
+        this.actorKeyPublishPending = true;
+        this.queueActorOp(payload, () => {
+            this.actorKeyPublishPending = false;
+        });
+    }
     ack() {
+        this.assertNotReset();
         const stamp = this.clock.next();
-        const role = this.aclLog.roleAt(this.actorId, stamp);
+        const role = this.roleAt(this.actorId, stamp);
         if (role === "revoked")
             throw new Error("Dacument: revoked actors cannot acknowledge");
         const seen = this.clock.current;
@@ -737,6 +1118,8 @@ export class Dacument {
             return;
         if (this.currentRole === "revoked")
             return;
+        if (this.resetState)
+            return;
         this.ackScheduled = true;
         queueMicrotask(() => {
             this.ackScheduled = false;
@@ -765,6 +1148,8 @@ export class Dacument {
         return barrier;
     }
     maybeGc() {
+        if (this.resetState)
+            return;
         const barrier = this.computeGcBarrier();
         if (!barrier)
             return;
@@ -891,8 +1276,9 @@ export class Dacument {
             throw new Error(`Dacument: invalid value for '${field}'`);
         if (schema.regex && typeof value === "string" && !schema.regex.test(value))
             throw new Error(`Dacument: '${field}' failed regex`);
+        this.assertNotReset();
         const stamp = this.clock.next();
-        const role = this.aclLog.roleAt(this.actorId, stamp);
+        const role = this.roleAt(this.actorId, stamp);
         if (!this.canWriteField(role))
             throw new Error(`Dacument: role '${role}' cannot write '${field}'`);
         this.queueLocalOp({
@@ -1071,7 +1457,7 @@ export class Dacument {
             insertAt(index, value) {
                 doc.assertValueType(field, value);
                 const stamp = doc.clock.next();
-                const role = doc.aclLog.roleAt(doc.actorId, stamp);
+                const role = doc.roleAt(doc.actorId, stamp);
                 doc.assertWritable(field, role);
                 const shadow = doc.shadowFor(field, state);
                 const { patches, result } = doc.capturePatches((listener) => shadow.onChange(listener), () => shadow.insertAt(index, value));
@@ -1091,7 +1477,7 @@ export class Dacument {
             },
             deleteAt(index) {
                 const stamp = doc.clock.next();
-                const role = doc.aclLog.roleAt(doc.actorId, stamp);
+                const role = doc.roleAt(doc.actorId, stamp);
                 doc.assertWritable(field, role);
                 const shadow = doc.shadowFor(field, state);
                 const { patches, result } = doc.capturePatches((listener) => shadow.onChange(listener), () => shadow.deleteAt(index));
@@ -1299,7 +1685,7 @@ export class Dacument {
     commitArrayMutation(field, mutate) {
         const state = this.fields.get(field);
         const stamp = this.clock.next();
-        const role = this.aclLog.roleAt(this.actorId, stamp);
+        const role = this.roleAt(this.actorId, stamp);
         this.assertWritable(field, role);
         const shadow = this.shadowFor(field, state);
         const { patches, result } = this.capturePatches((listener) => shadow.onChange(listener), () => mutate(shadow));
@@ -1320,7 +1706,7 @@ export class Dacument {
     commitSetMutation(field, mutate) {
         const state = this.fields.get(field);
         const stamp = this.clock.next();
-        const role = this.aclLog.roleAt(this.actorId, stamp);
+        const role = this.roleAt(this.actorId, stamp);
         this.assertWritable(field, role);
         const shadow = this.shadowFor(field, state);
         const { patches, result } = this.capturePatches((listener) => shadow.onChange(listener), () => mutate(shadow));
@@ -1341,7 +1727,7 @@ export class Dacument {
     commitMapMutation(field, mutate) {
         const state = this.fields.get(field);
         const stamp = this.clock.next();
-        const role = this.aclLog.roleAt(this.actorId, stamp);
+        const role = this.roleAt(this.actorId, stamp);
         this.assertWritable(field, role);
         const shadow = this.shadowFor(field, state);
         const { patches, result } = this.capturePatches((listener) => shadow.onChange(listener), () => mutate(shadow));
@@ -1362,7 +1748,7 @@ export class Dacument {
     commitRecordMutation(field, mutate) {
         const state = this.fields.get(field);
         const stamp = this.clock.next();
-        const role = this.aclLog.roleAt(this.actorId, stamp);
+        const role = this.roleAt(this.actorId, stamp);
         this.assertWritable(field, role);
         const shadow = this.shadowFor(field, state);
         const { patches, result } = this.capturePatches((listener) => shadow.onChange(listener), () => mutate(shadow));
@@ -1393,6 +1779,7 @@ export class Dacument {
         return { patches, result };
     }
     queueLocalOp(payload, role) {
+        this.assertNotReset();
         if (payload.kind === "ack") {
             const header = { alg: "none", typ: TOKEN_TYP };
             const token = encodeToken(header, payload);
@@ -1405,14 +1792,53 @@ export class Dacument {
             throw new Error("Dacument: missing role private key");
         const header = { alg: "ES256", typ: TOKEN_TYP, kid: `${payload.iss}:${role}` };
         const promise = signToken(this.roleKey, header, payload)
-            .then((token) => {
-            const op = { token };
+            .then(async (token) => {
+            const actorSig = await Dacument.signActorToken(token);
+            const op = { token, actorSig };
             this.emitEvent("change", { type: "change", ops: [op] });
         })
             .catch((error) => this.emitError(error instanceof Error ? error : new Error(String(error))));
         this.pending.add(promise);
         promise.finally(() => this.pending.delete(promise));
     }
+    queueActorOp(payload, onError) {
+        this.assertNotReset();
+        const actorInfo = Dacument.requireActorInfo();
+        const header = {
+            alg: "ES256",
+            typ: TOKEN_TYP,
+            kid: `${payload.iss}:actor`,
+        };
+        const promise = signToken(actorInfo.privateKeyJwk, header, payload)
+            .then(async (token) => {
+            const actorSig = await Dacument.signActorToken(token);
+            const op = { token, actorSig };
+            this.emitEvent("change", { type: "change", ops: [op] });
+        })
+            .catch((error) => {
+            onError?.();
+            this.emitError(error instanceof Error ? error : new Error(String(error)));
+        });
+        this.pending.add(promise);
+        promise.finally(() => this.pending.delete(promise));
+    }
+    applyResetPayload(payload, emit) {
+        if (!isResetPatch(payload.patch))
+            return false;
+        if (this.resetState)
+            return false;
+        this.clock.observe(payload.stamp);
+        const patch = payload.patch;
+        this.resetState = {
+            ts: payload.stamp,
+            by: payload.iss,
+            newDocId: patch.newDocId,
+            reason: patch.reason,
+        };
+        if (emit)
+            this.emitReset(this.resetState);
+        return true;
+    }
     applyRemotePayload(payload, signerRole) {
         this.clock.observe(payload.stamp);
         if (payload.kind === "ack") {
@@ -1421,11 +1847,15 @@ export class Dacument {
             this.ackByActor.set(payload.iss, payload.patch.seen);
             return true;
         }
-        if (!signerRole)
-            return false;
         if (payload.kind === "acl.set") {
+            if (!signerRole)
+                return false;
+            if (signerRole === "actor")
+                return this.applyAclPayload(payload, null, { skipAuth: true });
             return this.applyAclPayload(payload, signerRole);
         }
+        if (!signerRole || signerRole === "actor")
+            return false;
         if (!payload.field)
             return false;
         const state = this.fields.get(payload.field);
@@ -1444,18 +1874,23 @@ export class Dacument {
                 return false;
         }
     }
-    applyAclPayload(payload, signerRole) {
+    applyAclPayload(payload, signerRole, options) {
         if (!isAclPatch(payload.patch))
             return false;
         const patch = payload.patch;
-        if (!this.canWriteAclTarget(signerRole, patch.role, patch.target, payload.stamp))
-            return false;
+        if (!options?.skipAuth) {
+            if (!signerRole)
+                return false;
+            if (!this.canWriteAclTarget(signerRole, patch.role, patch.target, payload.stamp))
+                return false;
+        }
         const assignment = {
             id: patch.id,
             actorId: patch.target,
             role: patch.role,
             stamp: payload.stamp,
             by: payload.iss,
+            publicKeyJwk: patch.publicKeyJwk,
         };
         const accepted = this.aclLog.merge(assignment);
         if (accepted.length)
@@ -1869,8 +2304,9 @@ export class Dacument {
         return count;
     }
     setRole(actorId, role) {
+        this.assertNotReset();
         const stamp = this.clock.next();
-        const signerRole = this.aclLog.roleAt(this.actorId, stamp);
+        const signerRole = this.roleAt(this.actorId, stamp);
         if (!this.canWriteAclTarget(signerRole, role, actorId, stamp))
             throw new Error(`Dacument: role '${signerRole}' cannot grant '${role}'`);
         const assignmentId = uuidv7();
@@ -1923,6 +2359,62 @@ export class Dacument {
                 return this.recordValue(crdt);
         }
     }
+    materializeSchema() {
+        const output = {};
+        for (const [field, schema] of Object.entries(this.schema)) {
+            const current = this.fieldValue(field);
+            if (schema.crdt === "register") {
+                const next = { ...schema };
+                if (isValueOfType(current, schema.jsType)) {
+                    if (schema.regex &&
+                        typeof current === "string" &&
+                        !schema.regex.test(current))
+                        throw new Error(`Dacument.accessReset: '${field}' failed regex`);
+                    next.initial = current;
+                }
+                else {
+                    delete next.initial;
+                }
+                output[field] = next;
+                continue;
+            }
+            if (schema.crdt === "text") {
+                output[field] = {
+                    ...schema,
+                    initial: typeof current === "string" ? current : "",
+                };
+                continue;
+            }
+            if (schema.crdt === "array") {
+                output[field] = {
+                    ...schema,
+                    initial: Array.isArray(current) ? current : [],
+                };
+                continue;
+            }
+            if (schema.crdt === "set") {
+                output[field] = {
+                    ...schema,
+                    initial: Array.isArray(current) ? current : [],
+                };
+                continue;
+            }
+            if (schema.crdt === "map") {
+                output[field] = {
+                    ...schema,
+                    initial: Array.isArray(current) ? current : [],
+                };
+                continue;
+            }
+            if (schema.crdt === "record") {
+                output[field] =
+                    current && isObject(current) && !Array.isArray(current)
+                        ? { ...schema, initial: current }
+                        : { ...schema, initial: {} };
+            }
+        }
+        return output;
+    }
     emitEvent(type, event) {
         const listeners = this.eventListeners.get(type);
         if (!listeners)
@@ -1946,6 +2438,16 @@ export class Dacument {
             stamp,
         });
     }
+    emitReset(payload) {
+        this.emitEvent("reset", {
+            type: "reset",
+            oldDocId: this.docId,
+            newDocId: payload.newDocId,
+            ts: payload.ts,
+            by: payload.by,
+            reason: payload.reason,
+        });
+    }
     emitError(error) {
         this.emitEvent("error", { type: "error", error });
     }
@@ -1963,13 +2465,14 @@ export class Dacument {
         if (!this.canWriteAcl(role, targetRole))
             return false;
         if (role === "manager") {
-            const targetRoleAt = this.aclLog.roleAt(targetActorId, stamp);
+            const targetRoleAt = this.roleAt(targetActorId, stamp);
             if (targetRoleAt === "owner")
                 return false;
         }
         return true;
     }
     assertWritable(field, role) {
+        this.assertNotReset();
         if (!this.canWriteField(role))
             throw new Error(`Dacument: role '${role}' cannot write '${field}'`);
     }