dacument 1.1.0 → 1.2.0

package/README.md

@@ -152,12 +152,34 @@ Snapshots do not include schema or schema ids; callers must supply the schema on
 - `doc.addEventListener("merge", handler)` emits `{ actor, target, method, data }`.
 - `doc.addEventListener("error", handler)` emits signing/verification errors.
 - `doc.addEventListener("revoked", handler)` fires when the current actor is revoked.
+- `doc.addEventListener("reset", handler)` emits `{ oldDocId, newDocId, ts, by, reason }`.
 - `doc.selfRevoke()` emits a signed ACL op that revokes the current actor.
+- `await doc.accessReset({ reason })` creates a new dacument with fresh keys and emits a reset op.
+- `doc.getResetState()` returns reset metadata (or `null`).
 - `await doc.flush()` waits for pending signatures so all local ops are emitted.
 - `doc.snapshot()` returns a loadable op log (`{ docId, roleKeys, ops }`).
 - `await doc.verifyActorIntegrity(...)` verifies per-actor signatures on demand.
 - Revoked actors cannot snapshot; reads are masked to initial values.
 
+## Access reset (key compromise response)
+
+If an owner suspects role key compromise, call `accessReset()` to fork to a new
+doc id and revoke the old one:
+
+```ts
+const { newDoc, oldDocOps, newDocSnapshot, roleKeys } =
+  await doc.accessReset({ reason: "suspected compromise" });
+```
+
+`accessReset()` materializes the current state into a new dacument with fresh
+role keys, emits a signed `reset` op for the old doc, and returns the new
+snapshot + keys. The reset is stored as a CRDT op so all replicas converge. Once
+reset, the old doc rejects any ops after the reset stamp and throws on writes:
+`Dacument is reset/deprecated. Use newDocId: <id>`. Snapshots and verification
+still work so you can archive/inspect history.
+If an attacker already has the owner key, they can also reset; this is a
+response tool for suspected compromise, not a prevention mechanism.
+
 ## Actor identity (cold path)
 
 Every op may include an `actorSig` (detached ES256 signature over the op token).

package/dist/Dacument/class.d.ts

@@ -1,4 +1,10 @@
 import { type AclAssignment, type ActorInfo, type DacumentEventMap, type DocFieldAccess, type DocSnapshot, type RoleKeys, type RolePublicKeys, type SchemaDefinition, type SchemaId, type SignedOp, type VerificationResult, type VerifyActorIntegrityOptions, type Role, array, map, record, register, set, text } from "./types.js";
+type ResetStateInfo = {
+    ts: AclAssignment["stamp"];
+    by: string;
+    newDocId: string;
+    reason?: string;
+};
 export declare class Dacument<S extends SchemaDefinition> {
     private static actorInfo?;
     private static actorSigner?;
@@ -48,6 +54,7 @@ export declare class Dacument<S extends SchemaDefinition> {
     private readonly actorSigByToken;
     private readonly appliedTokens;
     private currentRole;
+    private resetState;
     private readonly revokedCrdtByField;
     private readonly deleteStampsByField;
     private readonly tombstoneStampsByField;
@@ -60,6 +67,10 @@ export declare class Dacument<S extends SchemaDefinition> {
     private actorKeyPublishPending;
     private lastGcBarrier;
     private snapshotFieldValues;
+    private resetError;
+    private assertNotReset;
+    private currentRoleFor;
+    private roleAt;
     private recordActorSig;
     readonly acl: {
         setRole: (actorId: string, role: Role) => void;
@@ -78,7 +89,16 @@ export declare class Dacument<S extends SchemaDefinition> {
     removeEventListener<K extends keyof DacumentEventMap>(type: K, listener: (event: DacumentEventMap[K]) => void): void;
     flush(): Promise<void>;
     snapshot(): DocSnapshot;
+    getResetState(): ResetStateInfo | null;
     selfRevoke(): void;
+    accessReset(options?: {
+        reason?: string;
+    }): Promise<{
+        newDoc: DacumentDoc<S>;
+        oldDocOps: SignedOp[];
+        newDocSnapshot: DocSnapshot;
+        roleKeys: RoleKeys;
+    }>;
     verifyActorIntegrity(options?: VerifyActorIntegrityOptions): Promise<VerificationResult>;
     merge(input: SignedOp | SignedOp[] | string | string[]): Promise<{
         accepted: SignedOp[];
@@ -116,6 +136,7 @@ export declare class Dacument<S extends SchemaDefinition> {
     private capturePatches;
     private queueLocalOp;
     private queueActorOp;
+    private applyResetPayload;
     private applyRemotePayload;
     private applyAclPayload;
     private applyRegisterPayload;
@@ -139,9 +160,11 @@ export declare class Dacument<S extends SchemaDefinition> {
     private recordValue;
     private mapValue;
     private fieldValue;
+    private materializeSchema;
     private emitEvent;
     private emitMerge;
     private emitRevoked;
+    private emitReset;
     private emitError;
     private canWriteField;
     private canWriteAcl;
@@ -154,3 +177,4 @@ export declare class Dacument<S extends SchemaDefinition> {
     private assertSchemaKeys;
 }
 export type DacumentDoc<S extends SchemaDefinition> = Dacument<S> & DocFieldAccess<S>;
+export {};

package/dist/Dacument/class.js

@@ -21,6 +21,17 @@ function isObject(value) {
 function isStringArray(value) {
     return Array.isArray(value) && value.every((entry) => typeof entry === "string");
 }
+function isValidNonceId(value) {
+    if (typeof value !== "string")
+        return false;
+    try {
+        const bytes = Bytes.fromBase64UrlString(value);
+        return bytes.byteLength === 32 && value.length === 43;
+    }
+    catch {
+        return false;
+    }
+}
 function stableKey(value) {
     if (value === null)
         return "null";
@@ -83,6 +94,17 @@ function isAckPatch(value) {
         typeof seen.logical === "number" &&
         typeof seen.clockId === "string");
 }
+function isResetPatch(value) {
+    if (!isObject(value))
+        return false;
+    if (typeof value.newDocId !== "string")
+        return false;
+    if (!isValidNonceId(value.newDocId))
+        return false;
+    if ("reason" in value && value.reason !== undefined && typeof value.reason !== "string")
+        return false;
+    return true;
+}
 function isPatchEnvelope(value) {
     return isObject(value) && Array.isArray(value.nodes);
 }
@@ -174,15 +196,7 @@ export class Dacument {
         return Bytes.toBase64UrlString(signature);
     }
     static isValidActorId(actorId) {
-        if (typeof actorId !== "string")
-            return false;
-        try {
-            const bytes = Bytes.fromBase64UrlString(actorId);
-            return bytes.byteLength === 32 && actorId.length === 43;
-        }
-        catch {
-            return false;
-        }
+        return isValidNonceId(actorId);
     }
     static assertActorKeyJwk(jwk, label) {
         if (!jwk || typeof jwk !== "object")
@@ -472,6 +486,7 @@ export class Dacument {
     actorSigByToken = new Map();
     appliedTokens = new Set();
     currentRole;
+    resetState = null;
     revokedCrdtByField = new Map();
     deleteStampsByField = new Map();
     tombstoneStampsByField = new Map();
@@ -489,6 +504,24 @@ export class Dacument {
             values.set(key, this.fieldValue(key));
         return values;
     }
+    resetError() {
+        const newDocId = this.resetState?.newDocId ?? "unknown";
+        return new Error(`Dacument is reset/deprecated. Use newDocId: ${newDocId}`);
+    }
+    assertNotReset() {
+        if (this.resetState)
+            throw this.resetError();
+    }
+    currentRoleFor(actorId) {
+        if (this.resetState)
+            return "revoked";
+        return this.aclLog.currentRole(actorId);
+    }
+    roleAt(actorId, stamp) {
+        if (this.resetState && compareHLC(stamp, this.resetState.ts) > 0)
+            return "revoked";
+        return this.aclLog.roleAt(actorId, stamp);
+    }
     recordActorSig(token, actorSig) {
         if (!actorSig || this.actorSigByToken.has(token))
             return;
@@ -517,11 +550,11 @@ export class Dacument {
         }
         this.acl = {
             setRole: (actorId, role) => this.setRole(actorId, role),
-            getRole: (actorId) => this.aclLog.currentRole(actorId),
+            getRole: (actorId) => this.currentRoleFor(actorId),
             knownActors: () => this.aclLog.knownActors(),
             snapshot: () => this.aclLog.snapshot(),
         };
-        this.currentRole = this.aclLog.currentRole(this.actorId);
+        this.currentRole = this.currentRoleFor(this.actorId);
         return new Proxy(this, {
             get: (target, property, receiver) => {
                 if (typeof property !== "string")
@@ -588,7 +621,7 @@ export class Dacument {
         await Promise.all([...this.pending]);
     }
     snapshot() {
-        if (this.isRevoked())
+        if (this.isRevoked() && !this.resetState)
             throw new Error("Dacument: revoked actors cannot snapshot");
         const ops = this.opLog.map((op) => {
             const actorSig = this.actorSigByToken.get(op.token);
@@ -600,9 +633,20 @@ export class Dacument {
             ops,
         };
     }
+    getResetState() {
+        return this.resetState
+            ? {
+                ts: this.resetState.ts,
+                by: this.resetState.by,
+                newDocId: this.resetState.newDocId,
+                reason: this.resetState.reason,
+            }
+            : null;
+    }
     selfRevoke() {
+        this.assertNotReset();
         const stamp = this.clock.next();
-        const role = this.aclLog.roleAt(this.actorId, stamp);
+        const role = this.roleAt(this.actorId, stamp);
         if (role === "revoked")
             return;
         const actorInfo = Dacument.requireActorInfo();
@@ -629,6 +673,52 @@ export class Dacument {
         }
         this.queueActorOp(payload);
     }
+    async accessReset(options = {}) {
+        this.assertNotReset();
+        const stamp = this.clock.next();
+        const role = this.roleAt(this.actorId, stamp);
+        if (role !== "owner")
+            throw new Error("Dacument: only owner can accessReset");
+        if (!this.roleKey)
+            throw new Error("Dacument: missing owner private key");
+        const schema = this.materializeSchema();
+        const created = await Dacument.create({ schema });
+        const newDoc = await Dacument.load({
+            schema,
+            roleKey: created.roleKeys.owner.privateKey,
+            snapshot: created.snapshot,
+        });
+        const patch = {
+            newDocId: created.docId,
+        };
+        if (options.reason)
+            patch.reason = options.reason;
+        const payload = {
+            iss: this.actorId,
+            sub: this.docId,
+            iat: nowSeconds(),
+            stamp,
+            kind: "reset",
+            schema: this.schemaId,
+            patch,
+        };
+        const header = {
+            alg: "ES256",
+            typ: TOKEN_TYP,
+            kid: `${this.actorId}:owner`,
+        };
+        const token = await signToken(this.roleKey, header, payload);
+        const actorSig = await Dacument.signActorToken(token);
+        const oldDocOps = [{ token, actorSig }];
+        this.emitEvent("change", { type: "change", ops: oldDocOps });
+        await this.merge(oldDocOps);
+        return {
+            newDoc,
+            oldDocOps,
+            newDocSnapshot: created.snapshot,
+            roleKeys: created.roleKeys,
+        };
+    }
     async verifyActorIntegrity(options = {}) {
         const input = options.token !== undefined
             ? [options.token]
@@ -831,7 +921,7 @@ export class Dacument {
             const entry = this.aclLog.currentEntry(this.actorId);
             this.emitRevoked(prevRole, entry?.by ?? this.actorId, entry?.stamp ?? this.clock.current);
         }
-        if (appliedNonAck)
+        if (appliedNonAck && !this.resetState)
             this.scheduleAck();
         this.maybeGc();
         this.maybePublishActorKey();
@@ -847,6 +937,8 @@ export class Dacument {
         this.tombstoneStampsByField.clear();
         this.deleteNodeStampsByField.clear();
         this.revokedCrdtByField.clear();
+        this.resetState = null;
+        let resetStamp = null;
         for (const state of this.fields.values()) {
             state.crdt = createEmptyField(state.schema);
         }
@@ -864,8 +956,21 @@ export class Dacument {
             return left.token < right.token ? -1 : 1;
         });
         for (const { token, payload, signerRole } of ops) {
+            if (resetStamp && compareHLC(payload.stamp, resetStamp) > 0)
+                continue;
             let allowed = false;
-            if (payload.kind === "acl.set") {
+            const isReset = payload.kind === "reset";
+            if (isReset) {
+                if (this.resetState)
+                    continue;
+                if (!isResetPatch(payload.patch))
+                    continue;
+                const roleAt = this.roleAt(payload.iss, payload.stamp);
+                if (signerRole === "owner" && roleAt === "owner") {
+                    allowed = true;
+                }
+            }
+            else if (payload.kind === "acl.set") {
                 const patch = isAclPatch(payload.patch) ? payload.patch : null;
                 if (!patch)
                     continue;
@@ -876,7 +981,7 @@ export class Dacument {
                     allowed = true;
                 }
                 else {
-                    const roleAt = this.aclLog.roleAt(payload.iss, payload.stamp);
+                    const roleAt = this.roleAt(payload.iss, payload.stamp);
                     const isSelfRevoke = patch.target === payload.iss && patch.role === "revoked";
                     const targetKey = this.aclLog.publicKeyAt(patch.target, payload.stamp);
                     const isSelfKeyUpdate = patch.target === payload.iss &&
@@ -912,7 +1017,7 @@ export class Dacument {
                 }
             }
             else {
-                const roleAt = this.aclLog.roleAt(payload.iss, payload.stamp);
+                const roleAt = this.roleAt(payload.iss, payload.stamp);
                 if (payload.kind === "ack") {
                     if (roleAt === "revoked")
                         continue;
@@ -930,19 +1035,23 @@ export class Dacument {
             const emit = !previousApplied.has(token);
             this.suppressMerge = !emit;
             try {
-                const applied = this.applyRemotePayload(payload, signerRole);
+                const applied = isReset
+                    ? this.applyResetPayload(payload, emit)
+                    : this.applyRemotePayload(payload, signerRole);
                 if (!applied)
                     continue;
             }
             finally {
                 this.suppressMerge = false;
             }
+            if (isReset)
+                resetStamp = payload.stamp;
             this.appliedTokens.add(token);
             invalidated.delete(token);
             if (emit && payload.kind !== "ack")
                 appliedNonAck = true;
         }
-        this.currentRole = this.aclLog.currentRole(this.actorId);
+        this.currentRole = this.currentRoleFor(this.actorId);
         if (invalidated.size > 0 &&
             options?.beforeValues &&
             options.diffActor &&
@@ -952,6 +1061,8 @@ export class Dacument {
         return { appliedNonAck };
     }
     maybePublishActorKey() {
+        if (this.resetState)
+            return;
         const entry = this.aclLog.currentEntry(this.actorId);
         if (entry?.publicKeyJwk) {
             this.actorKeyPublishPending = false;
@@ -985,8 +1096,9 @@ export class Dacument {
         });
     }
     ack() {
+        this.assertNotReset();
         const stamp = this.clock.next();
-        const role = this.aclLog.roleAt(this.actorId, stamp);
+        const role = this.roleAt(this.actorId, stamp);
         if (role === "revoked")
             throw new Error("Dacument: revoked actors cannot acknowledge");
         const seen = this.clock.current;
@@ -1006,6 +1118,8 @@ export class Dacument {
             return;
         if (this.currentRole === "revoked")
             return;
+        if (this.resetState)
+            return;
         this.ackScheduled = true;
         queueMicrotask(() => {
             this.ackScheduled = false;
@@ -1034,6 +1148,8 @@ export class Dacument {
         return barrier;
     }
     maybeGc() {
+        if (this.resetState)
+            return;
         const barrier = this.computeGcBarrier();
         if (!barrier)
             return;
@@ -1160,8 +1276,9 @@ export class Dacument {
             throw new Error(`Dacument: invalid value for '${field}'`);
         if (schema.regex && typeof value === "string" && !schema.regex.test(value))
             throw new Error(`Dacument: '${field}' failed regex`);
+        this.assertNotReset();
         const stamp = this.clock.next();
-        const role = this.aclLog.roleAt(this.actorId, stamp);
+        const role = this.roleAt(this.actorId, stamp);
         if (!this.canWriteField(role))
             throw new Error(`Dacument: role '${role}' cannot write '${field}'`);
         this.queueLocalOp({
@@ -1340,7 +1457,7 @@ export class Dacument {
             insertAt(index, value) {
                 doc.assertValueType(field, value);
                 const stamp = doc.clock.next();
-                const role = doc.aclLog.roleAt(doc.actorId, stamp);
+                const role = doc.roleAt(doc.actorId, stamp);
                 doc.assertWritable(field, role);
                 const shadow = doc.shadowFor(field, state);
                 const { patches, result } = doc.capturePatches((listener) => shadow.onChange(listener), () => shadow.insertAt(index, value));
@@ -1360,7 +1477,7 @@ export class Dacument {
             },
             deleteAt(index) {
                 const stamp = doc.clock.next();
-                const role = doc.aclLog.roleAt(doc.actorId, stamp);
+                const role = doc.roleAt(doc.actorId, stamp);
                 doc.assertWritable(field, role);
                 const shadow = doc.shadowFor(field, state);
                 const { patches, result } = doc.capturePatches((listener) => shadow.onChange(listener), () => shadow.deleteAt(index));
@@ -1568,7 +1685,7 @@ export class Dacument {
     commitArrayMutation(field, mutate) {
         const state = this.fields.get(field);
         const stamp = this.clock.next();
-        const role = this.aclLog.roleAt(this.actorId, stamp);
+        const role = this.roleAt(this.actorId, stamp);
         this.assertWritable(field, role);
         const shadow = this.shadowFor(field, state);
         const { patches, result } = this.capturePatches((listener) => shadow.onChange(listener), () => mutate(shadow));
@@ -1589,7 +1706,7 @@ export class Dacument {
     commitSetMutation(field, mutate) {
         const state = this.fields.get(field);
         const stamp = this.clock.next();
-        const role = this.aclLog.roleAt(this.actorId, stamp);
+        const role = this.roleAt(this.actorId, stamp);
         this.assertWritable(field, role);
         const shadow = this.shadowFor(field, state);
         const { patches, result } = this.capturePatches((listener) => shadow.onChange(listener), () => mutate(shadow));
@@ -1610,7 +1727,7 @@ export class Dacument {
     commitMapMutation(field, mutate) {
         const state = this.fields.get(field);
         const stamp = this.clock.next();
-        const role = this.aclLog.roleAt(this.actorId, stamp);
+        const role = this.roleAt(this.actorId, stamp);
         this.assertWritable(field, role);
         const shadow = this.shadowFor(field, state);
         const { patches, result } = this.capturePatches((listener) => shadow.onChange(listener), () => mutate(shadow));
@@ -1631,7 +1748,7 @@ export class Dacument {
     commitRecordMutation(field, mutate) {
         const state = this.fields.get(field);
         const stamp = this.clock.next();
-        const role = this.aclLog.roleAt(this.actorId, stamp);
+        const role = this.roleAt(this.actorId, stamp);
         this.assertWritable(field, role);
         const shadow = this.shadowFor(field, state);
         const { patches, result } = this.capturePatches((listener) => shadow.onChange(listener), () => mutate(shadow));
@@ -1662,6 +1779,7 @@ export class Dacument {
         return { patches, result };
     }
     queueLocalOp(payload, role) {
+        this.assertNotReset();
         if (payload.kind === "ack") {
             const header = { alg: "none", typ: TOKEN_TYP };
             const token = encodeToken(header, payload);
@@ -1684,6 +1802,7 @@ export class Dacument {
         promise.finally(() => this.pending.delete(promise));
     }
     queueActorOp(payload, onError) {
+        this.assertNotReset();
         const actorInfo = Dacument.requireActorInfo();
         const header = {
             alg: "ES256",
@@ -1703,6 +1822,23 @@ export class Dacument {
         this.pending.add(promise);
         promise.finally(() => this.pending.delete(promise));
     }
+    applyResetPayload(payload, emit) {
+        if (!isResetPatch(payload.patch))
+            return false;
+        if (this.resetState)
+            return false;
+        this.clock.observe(payload.stamp);
+        const patch = payload.patch;
+        this.resetState = {
+            ts: payload.stamp,
+            by: payload.iss,
+            newDocId: patch.newDocId,
+            reason: patch.reason,
+        };
+        if (emit)
+            this.emitReset(this.resetState);
+        return true;
+    }
     applyRemotePayload(payload, signerRole) {
         this.clock.observe(payload.stamp);
         if (payload.kind === "ack") {
@@ -2168,8 +2304,9 @@ export class Dacument {
         return count;
     }
     setRole(actorId, role) {
+        this.assertNotReset();
         const stamp = this.clock.next();
-        const signerRole = this.aclLog.roleAt(this.actorId, stamp);
+        const signerRole = this.roleAt(this.actorId, stamp);
         if (!this.canWriteAclTarget(signerRole, role, actorId, stamp))
             throw new Error(`Dacument: role '${signerRole}' cannot grant '${role}'`);
         const assignmentId = uuidv7();
@@ -2222,6 +2359,62 @@ export class Dacument {
                 return this.recordValue(crdt);
         }
     }
+    materializeSchema() {
+        const output = {};
+        for (const [field, schema] of Object.entries(this.schema)) {
+            const current = this.fieldValue(field);
+            if (schema.crdt === "register") {
+                const next = { ...schema };
+                if (isValueOfType(current, schema.jsType)) {
+                    if (schema.regex &&
+                        typeof current === "string" &&
+                        !schema.regex.test(current))
+                        throw new Error(`Dacument.accessReset: '${field}' failed regex`);
+                    next.initial = current;
+                }
+                else {
+                    delete next.initial;
+                }
+                output[field] = next;
+                continue;
+            }
+            if (schema.crdt === "text") {
+                output[field] = {
+                    ...schema,
+                    initial: typeof current === "string" ? current : "",
+                };
+                continue;
+            }
+            if (schema.crdt === "array") {
+                output[field] = {
+                    ...schema,
+                    initial: Array.isArray(current) ? current : [],
+                };
+                continue;
+            }
+            if (schema.crdt === "set") {
+                output[field] = {
+                    ...schema,
+                    initial: Array.isArray(current) ? current : [],
+                };
+                continue;
+            }
+            if (schema.crdt === "map") {
+                output[field] = {
+                    ...schema,
+                    initial: Array.isArray(current) ? current : [],
+                };
+                continue;
+            }
+            if (schema.crdt === "record") {
+                output[field] =
+                    current && isObject(current) && !Array.isArray(current)
+                        ? { ...schema, initial: current }
+                        : { ...schema, initial: {} };
+            }
+        }
+        return output;
+    }
     emitEvent(type, event) {
         const listeners = this.eventListeners.get(type);
         if (!listeners)
@@ -2245,6 +2438,16 @@ export class Dacument {
             stamp,
         });
     }
+    emitReset(payload) {
+        this.emitEvent("reset", {
+            type: "reset",
+            oldDocId: this.docId,
+            newDocId: payload.newDocId,
+            ts: payload.ts,
+            by: payload.by,
+            reason: payload.reason,
+        });
+    }
     emitError(error) {
         this.emitEvent("error", { type: "error", error });
     }
@@ -2262,13 +2465,14 @@ export class Dacument {
         if (!this.canWriteAcl(role, targetRole))
             return false;
         if (role === "manager") {
-            const targetRoleAt = this.aclLog.roleAt(targetActorId, stamp);
+            const targetRoleAt = this.roleAt(targetActorId, stamp);
             if (targetRoleAt === "owner")
                 return false;
         }
         return true;
     }
     assertWritable(field, role) {
+        this.assertNotReset();
         if (!this.canWriteField(role))
             throw new Error(`Dacument: role '${role}' cannot write '${field}'`);
     }

package/dist/Dacument/types.d.ts

@@ -69,7 +69,7 @@ export type RecordSchema<T extends JsTypeName = JsTypeName> = {
 export type FieldSchema = RegisterSchema | TextSchema | ArraySchema | SetSchema | MapSchema | RecordSchema;
 export type SchemaDefinition = Record<string, FieldSchema>;
 export type SchemaId = string;
-export type OpKind = "acl.set" | "register.set" | "text.patch" | "array.patch" | "map.patch" | "set.patch" | "record.patch" | "ack";
+export type OpKind = "acl.set" | "register.set" | "text.patch" | "array.patch" | "map.patch" | "set.patch" | "record.patch" | "ack" | "reset";
 export type OpPayload = {
     iss: string;
     sub: string;
@@ -84,6 +84,16 @@ export type SignedOp = {
     token: string;
     actorSig?: string;
 };
+export type ResetPatch = {
+    newDocId: string;
+    reason?: string;
+};
+export type ResetState = {
+    ts: HLCStamp;
+    by: string;
+    newDocId: string;
+    reason?: string;
+};
 export type DacumentChangeEvent = {
     type: "change";
     ops: SignedOp[];
@@ -106,11 +116,20 @@ export type DacumentRevokedEvent = {
     by: string;
     stamp: HLCStamp;
 };
+export type DacumentResetEvent = {
+    type: "reset";
+    oldDocId: string;
+    newDocId: string;
+    ts: HLCStamp;
+    by: string;
+    reason?: string;
+};
 export type DacumentEventMap = {
     change: DacumentChangeEvent;
     merge: DacumentMergeEvent;
     error: DacumentErrorEvent;
     revoked: DacumentRevokedEvent;
+    reset: DacumentResetEvent;
 };
 export type AclAssignment = {
     id: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dacument",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Schema-driven CRDT document with signed ops, role-based ACLs, and optional per-actor verification.",
   "keywords": [
     "crdt",