dacument 1.1.0 → 1.2.1

package/README.md

@@ -51,6 +51,7 @@ doc.body.insertAt(0, "H");
 doc.tags.add("draft");
 doc.items.push("milk");
 
+// Wire ops to your transport.
 doc.addEventListener("change", (event) => channel.send(event.ops));
 channel.onmessage = (ops) => doc.merge(ops);
 
@@ -60,13 +61,13 @@ doc.addEventListener("merge", ({ actor, target, method, data }) => {
 ```
 
 `create()` returns `roleKeys` for owner/manager/editor; store them securely and
-distribute the highest role key per actor as needed.
+distribute the highest role key each actor should hold.
 
 ## Schema and fields
 
 - `register` fields behave like normal properties: `doc.title = "hi"`.
 - Other fields return safe CRDT views: `doc.items.push("x")`.
-- Unknown fields and schema bypasses throw.
+- Unknown fields or schema bypasses throw.
 - UI updates should listen to `merge` events.
 
 Supported CRDT field types:
@@ -78,7 +79,9 @@ Supported CRDT field types:
 - `map` - OR-Map.
 - `record` - OR-Record.
 
-Map keys must be JSON-compatible values (`string`, `number`, `boolean`, `null`, arrays, or objects). For string-keyed data, prefer `record`.
+Map keys must be JSON-compatible values (`string`, `number`, `boolean`, `null`,
+arrays, or objects). For string-keyed data, prefer `record`. For non-JSON or
+identity-based keys, use `CRMap` with a stable `key` function.
 
 ## Roles and ACL
 
@@ -101,14 +104,17 @@ await doc.flush();
 
 Before any schema/load/create, call `await Dacument.setActorInfo(...)` once per
 process. The actor id must be a 256-bit base64url string (e.g.
-`bytecodec` libarys `generateNonce()`), and the actor key pair must be ES256 (P-256).
-Subsequent calls are ignored. On first merge, Dacument auto-attaches the
-actor's `publicKeyJwk` to its own ACL entry (if missing).
-
-Each actor signs with the role key they were given (owner/manager/editor). Load
-with the highest role key you have; viewers load without a key.
-Role keys are generated once at `create()`; public keys are embedded in the
-snapshot and never rotated.
+`bytecodec` library's `generateNonce()`), and the actor key pair must be ES256 (P-256).
+Updating actor info requires providing the current keys. On first merge, Dacument
+auto-attaches the actor's `publicKeyJwk` to its own ACL entry (if missing) and
+pins it for actor-signature verification. To rotate actor keys in-process, call
+`Dacument.setActorInfo` again with the new keys plus
+`currentPrivateKeyJwk`/`currentPublicKeyJwk`.
+
+Write ops are role-signed; acks are actor-signed with the per-actor key set via
+`setActorInfo`. Load with the highest role key you have; viewers load without a
+key. Role keys are generated once at `create()`; role public keys are embedded
+in the snapshot and never rotated.
 
 ## Networking and sync
 
@@ -144,20 +150,44 @@ const bob = await Dacument.load({
 });
 ```
 
-Snapshots do not include schema or schema ids; callers must supply the schema on load.
+Snapshots do not include the schema or schema ids; callers must supply the schema on load.
 
 ## Events and values
 
-- `doc.addEventListener("change", handler)` emits ops for network sync (writer ops are signed; acks are unsigned).
+- `doc.addEventListener("change", handler)` emits ops for network sync
+  (writer ops are role-signed; acks are actor-signed by non-revoked actors and
+  verified against ACL-pinned actor public keys).
 - `doc.addEventListener("merge", handler)` emits `{ actor, target, method, data }`.
 - `doc.addEventListener("error", handler)` emits signing/verification errors.
 - `doc.addEventListener("revoked", handler)` fires when the current actor is revoked.
+- `doc.addEventListener("reset", handler)` emits `{ oldDocId, newDocId, ts, by, reason }`.
 - `doc.selfRevoke()` emits a signed ACL op that revokes the current actor.
+- `await doc.accessReset({ reason })` creates a new Dacument with fresh keys and emits a reset op.
+- `doc.getResetState()` returns reset metadata (or `null`).
 - `await doc.flush()` waits for pending signatures so all local ops are emitted.
 - `doc.snapshot()` returns a loadable op log (`{ docId, roleKeys, ops }`).
 - `await doc.verifyActorIntegrity(...)` verifies per-actor signatures on demand.
 - Revoked actors cannot snapshot; reads are masked to initial values.
 
+## Access reset (key compromise response)
+
+If an owner suspects role key compromise, call `accessReset()` to fork to a new
+docId and revoke the old one:
+
+```ts
+const { newDoc, oldDocOps, newDocSnapshot, roleKeys } =
+  await doc.accessReset({ reason: "suspected compromise" });
+```
+
+`accessReset()` materializes the current state into a new Dacument with fresh
+role keys, emits a signed `reset` op for the old doc, and returns the new
+snapshot + keys. The reset is stored as a CRDT op so all replicas converge. Once
+reset, the old doc rejects any ops after the reset stamp and throws on writes:
+`Dacument is reset/deprecated. Use newDocId: <id>`. Snapshots and verification
+still work so you can archive/inspect history.
+If an attacker already has the owner key, they can also reset; this is a
+response tool for suspected compromise, not a prevention mechanism.
+
 ## Actor identity (cold path)
 
 Every op may include an `actorSig` (detached ES256 signature over the op token).
@@ -170,17 +200,17 @@ from the ACL at the op stamp and returns a summary plus failures.
 
 Dacument tracks per-actor `ack` ops and compacts tombstones once all non-revoked
 actors (including viewers) have acknowledged a given HLC. Acks are emitted
-automatically after merges that apply new non-ack ops. Acks are unsigned
-(`alg: "none"`); signed acks are rejected.
+automatically after merges that apply new non-ack ops. Acks are ES256 actor-signed
+by non-revoked actors and verified against ACL-pinned actor public keys.
 If any non-revoked actor is offline and never acks, tombstones are kept.
 
 ## Guarantees
 
 - Schema enforcement is strict; unknown fields are rejected.
-- Ops are accepted only if the CRDT patch is valid and the signature verifies
-  (acks are unsigned and signed acks are rejected).
+- Ops are accepted only if the CRDT patch is valid and the role signature
+  verifies; acks require a valid actor signature.
 - Role checks are applied at the op stamp time (HLC).
-- IDs are base64url nonces from `bytecodec` librarys `generateNonce()` (32 random bytes).
+- IDs are base64url nonces from `bytecodec` library's `generateNonce()` (32 random bytes).
 - Private keys are returned by `create()` and never stored by Dacument.
 - Snapshots may include ops that are rejected; invalid ops are ignored on load.
 
@@ -189,8 +219,9 @@ replicas. Dacument does not provide transport; use `change` events to wire it up
 
 ## Possible threats and how to handle
 
-- Key compromise: no rotation exists, so migrate by snapshotting into a new
-  dacument with fresh keys.
+- Role key compromise: role keys cannot be rotated; use `accessReset` or
+  snapshot into a new Dacument with fresh keys. Actor keys can be rotated by
+  providing the current keys.
 - Shared role keys: attribution is role-level, not per-user; treat roles as
   trust groups and log merge events if you need auditing.
 - Insider DoS/flooding: rate-limit ops, cap payload sizes, and monitor merge

package/dist/CRArray/class.d.ts

@@ -2,6 +2,8 @@ import { DAGNode } from "../DAGNode/class.js";
 export declare class CRArray<T> {
     private readonly nodes;
     private readonly nodeById;
+    private aliveCount;
+    private lastAliveIndex;
     private readonly listeners;
     constructor(snapshot?: readonly DAGNode<T>[]);
     get length(): number;
@@ -29,6 +31,7 @@ export declare class CRArray<T> {
     sort(compareFn?: (a: DAGNode<T>, b: DAGNode<T>) => number): this;
     private alive;
     private lastAliveId;
+    private recomputeLastAliveIndex;
     private afterIdForAliveInsertAt;
     private emit;
 }

package/dist/CRArray/class.js

@@ -1,11 +1,29 @@
 import { DAGNode } from "../DAGNode/class.js";
 const ROOT = [];
 function afterKey(after) {
-    return after.join(",");
+    return after.length < 2 ? (after[0] ?? "") : after.join(",");
+}
+function isIndexKey(value) {
+    const length = value.length;
+    if (length === 0)
+        return false;
+    const first = value.charCodeAt(0);
+    if (first < 48 || first > 57)
+        return false;
+    if (length > 1 && first === 48)
+        return false;
+    for (let i = 1; i < length; i++) {
+        const code = value.charCodeAt(i);
+        if (code < 48 || code > 57)
+            return false;
+    }
+    return true;
 }
 export class CRArray {
     nodes = [];
     nodeById = new Map();
+    aliveCount = 0;
+    lastAliveIndex = -1;
     listeners = new Set();
     constructor(snapshot) {
         if (snapshot) {
@@ -14,6 +32,8 @@ export class CRArray {
                     continue;
                 this.nodes.push(node);
                 this.nodeById.set(node.id, node);
+                if (!node.deleted)
+                    this.aliveCount++;
             }
         }
         this.sort();
@@ -22,13 +42,13 @@ export class CRArray {
                 if (typeof property === "string") {
                     if (property === "length")
                         return target.length;
-                    if (/^(0|[1-9]\d*)$/.test(property))
+                    if (isIndexKey(property))
                         return target.at(Number(property));
                 }
                 return Reflect.get(target, property, receiver);
             },
             set: (target, property, value, receiver) => {
-                if (typeof property === "string" && /^(0|[1-9]\d*)$/.test(property)) {
+                if (typeof property === "string" && isIndexKey(property)) {
                     const index = Number(property);
                     target.setAt(index, value);
                     return true;
@@ -36,7 +56,7 @@ export class CRArray {
                 return Reflect.set(target, property, value, receiver);
             },
             has: (target, property) => {
-                if (typeof property === "string" && /^(0|[1-9]\d*)$/.test(property)) {
+                if (typeof property === "string" && isIndexKey(property)) {
                     return Number(property) < target.length;
                 }
                 return Reflect.has(target, property);
@@ -49,7 +69,7 @@ export class CRArray {
                 return keys;
             },
             getOwnPropertyDescriptor: (target, property) => {
-                if (typeof property === "string" && /^(0|[1-9]\d*)$/.test(property)) {
+                if (typeof property === "string" && isIndexKey(property)) {
                     if (Number(property) >= target.length)
                         return undefined;
                     return {
@@ -64,11 +84,7 @@ export class CRArray {
         });
     }
     get length() {
-        let count = 0;
-        for (const node of this.nodes)
-            if (!node.deleted)
-                count++;
-        return count;
+        return this.aliveCount;
     }
     // --- public API ---
     onChange(listener) {
@@ -79,9 +95,8 @@ export class CRArray {
         return this.nodes.slice();
     }
     push(...items) {
-        let after = this.lastAliveId()
-            ? [this.lastAliveId()]
-            : ROOT;
+        const lastAliveId = this.lastAliveId();
+        let after = lastAliveId ? [lastAliveId] : ROOT;
         const changed = [];
         for (const item of items) {
             const node = new DAGNode({ value: item, after });
@@ -89,6 +104,7 @@ export class CRArray {
             this.nodeById.set(node.id, node);
             changed.push(node);
             after = [node.id];
+            this.aliveCount++;
         }
         this.sort();
         this.emit(changed);
@@ -103,19 +119,26 @@ export class CRArray {
             this.nodeById.set(node.id, node);
             changed.push(node);
             after = [node.id];
+            this.aliveCount++;
         }
         this.sort();
         this.emit(changed);
         return this.length;
     }
     pop() {
-        for (let index = this.nodes.length - 1; index >= 0; index--) {
+        for (let index = this.lastAliveIndex; index >= 0; index--) {
             const node = this.nodes[index];
-            if (!node.deleted) {
-                node.deleted = true;
-                this.emit([node]);
-                return node.value;
+            if (node.deleted)
+                continue;
+            node.deleted = true;
+            this.aliveCount--;
+            this.lastAliveIndex = index - 1;
+            while (this.lastAliveIndex >= 0 &&
+                this.nodes[this.lastAliveIndex].deleted) {
+                this.lastAliveIndex--;
             }
+            this.emit([node]);
+            return node.value;
         }
         return undefined;
     }
@@ -123,6 +146,9 @@ export class CRArray {
         for (const node of this.nodes) {
             if (!node.deleted) {
                 node.deleted = true;
+                this.aliveCount--;
+                if (this.aliveCount === 0)
+                    this.lastAliveIndex = -1;
                 this.emit([node]);
                 return node.value;
             }
@@ -130,7 +156,23 @@ export class CRArray {
         return undefined;
     }
     at(index) {
-        return this.alive().at(index);
+        const length = this.aliveCount;
+        let target = Math.trunc(Number(index));
+        if (Number.isNaN(target))
+            target = 0;
+        if (target < 0)
+            target = length + target;
+        if (target < 0 || target >= length)
+            return undefined;
+        let aliveIndex = 0;
+        for (const node of this.nodes) {
+            if (node.deleted)
+                continue;
+            if (aliveIndex === target)
+                return node.value;
+            aliveIndex++;
+        }
+        return undefined;
     }
     setAt(index, value) {
         if (!Number.isInteger(index))
@@ -144,6 +186,7 @@ export class CRArray {
                 continue;
             if (aliveIndex === index) {
                 node.deleted = true;
+                this.aliveCount--;
                 deletedNode = node;
                 break;
             }
@@ -155,19 +198,70 @@ export class CRArray {
         const newNode = new DAGNode({ value, after });
         this.nodes.push(newNode);
         this.nodeById.set(newNode.id, newNode);
+        this.aliveCount++;
         this.sort();
         const changed = deletedNode ? [deletedNode, newNode] : [newNode];
         this.emit(changed);
         return this;
     }
     slice(start, end) {
-        return this.alive().slice(start, end);
+        const length = this.aliveCount;
+        let from = start === undefined ? 0 : Math.trunc(Number(start));
+        if (Number.isNaN(from))
+            from = 0;
+        if (from < 0)
+            from = Math.max(length + from, 0);
+        else if (from > length)
+            from = length;
+        let to = end === undefined ? length : Math.trunc(Number(end));
+        if (Number.isNaN(to))
+            to = 0;
+        if (to < 0)
+            to = Math.max(length + to, 0);
+        else if (to > length)
+            to = length;
+        if (to <= from)
+            return [];
+        const resultLength = to - from;
+        const result = new Array(resultLength);
+        let aliveIndex = 0;
+        let resultIndex = 0;
+        for (const node of this.nodes) {
+            if (node.deleted)
+                continue;
+            if (aliveIndex >= to)
+                break;
+            if (aliveIndex >= from)
+                result[resultIndex++] = node.value;
+            aliveIndex++;
+        }
+        if (resultIndex !== resultLength)
+            result.length = resultIndex;
+        return result;
     }
     includes(value) {
-        return this.alive().includes(value);
+        const valueIsNaN = value !== value;
+        for (const node of this.nodes) {
+            if (node.deleted)
+                continue;
+            const nodeValue = node.value;
+            if (nodeValue === value)
+                return true;
+            if (valueIsNaN && nodeValue !== nodeValue)
+                return true;
+        }
+        return false;
     }
     indexOf(value) {
-        return this.alive().indexOf(value);
+        let aliveIndex = 0;
+        for (const node of this.nodes) {
+            if (node.deleted)
+                continue;
+            if (node.value === value)
+                return aliveIndex;
+            aliveIndex++;
+        }
+        return -1;
     }
     find(predicate, thisArg) {
         return this.alive().find(predicate, thisArg);
@@ -207,10 +301,13 @@ export class CRArray {
                 const clone = structuredClone(remote);
                 this.nodes.push(clone);
                 this.nodeById.set(clone.id, clone);
+                if (!clone.deleted)
+                    this.aliveCount++;
                 changed.push(clone);
             }
             else if (!local.deleted && remote.deleted) {
                 local.deleted = true;
+                this.aliveCount--;
                 changed.push(local);
             }
         }
@@ -223,6 +320,7 @@ export class CRArray {
     sort(compareFn) {
         if (compareFn) {
             this.nodes.sort(compareFn);
+            this.recomputeLastAliveIndex();
             return this;
         }
         this.nodes.sort((left, right) => {
@@ -240,23 +338,42 @@ export class CRArray {
                 return left.id > right.id ? -1 : 1;
             return left.id < right.id ? -1 : 1;
         });
+        this.recomputeLastAliveIndex();
         return this;
     }
     // --- internals ---
     alive() {
-        const values = [];
-        for (const node of this.nodes)
-            if (!node.deleted)
-                values.push(node.value);
+        const values = new Array(this.aliveCount);
+        let aliveIndex = 0;
+        for (const node of this.nodes) {
+            if (node.deleted)
+                continue;
+            values[aliveIndex++] = node.value;
+        }
+        if (aliveIndex !== values.length)
+            values.length = aliveIndex;
         return values;
     }
     lastAliveId() {
+        if (this.lastAliveIndex < 0)
+            return null;
+        const node = this.nodes[this.lastAliveIndex];
+        if (!node || node.deleted) {
+            this.recomputeLastAliveIndex();
+            if (this.lastAliveIndex < 0)
+                return null;
+            return this.nodes[this.lastAliveIndex].id;
+        }
+        return node.id;
+    }
+    recomputeLastAliveIndex() {
         for (let index = this.nodes.length - 1; index >= 0; index--) {
-            const node = this.nodes[index];
-            if (!node.deleted)
-                return node.id;
+            if (!this.nodes[index].deleted) {
+                this.lastAliveIndex = index;
+                return;
+            }
         }
-        return null;
+        this.lastAliveIndex = -1;
     }
     afterIdForAliveInsertAt(index) {
         if (index === 0)

package/dist/CRText/class.d.ts

@@ -2,6 +2,8 @@ import { DAGNode } from "../DAGNode/class.js";
 export declare class CRText<CharT extends string = string> {
     private readonly nodes;
     private readonly nodeById;
+    private aliveCount;
+    private lastAliveIndex;
     private readonly listeners;
     constructor(snapshot?: readonly DAGNode<CharT>[]);
     get length(): number;
@@ -13,7 +15,8 @@ export declare class CRText<CharT extends string = string> {
     deleteAt(index: number): CharT | undefined;
     merge(remoteSnapshot: DAGNode<CharT>[] | DAGNode<CharT>): DAGNode<CharT>[];
     sort(compareFn?: (a: DAGNode<CharT>, b: DAGNode<CharT>) => number): this;
-    private alive;
     private afterIdForAliveInsertAt;
+    private lastAliveId;
+    private recomputeLastAliveIndex;
     private emit;
 }

package/dist/CRText/class.js

@@ -1,11 +1,13 @@
 import { DAGNode } from "../DAGNode/class.js";
 const ROOT = [];
 function afterKey(after) {
-    return after.join(",");
+    return after.length < 2 ? (after[0] ?? "") : after.join(",");
 }
 export class CRText {
     nodes = [];
     nodeById = new Map();
+    aliveCount = 0;
+    lastAliveIndex = -1;
     listeners = new Set();
     constructor(snapshot) {
         if (snapshot) {
@@ -14,16 +16,14 @@ export class CRText {
                     continue;
                 this.nodes.push(node);
                 this.nodeById.set(node.id, node);
+                if (!node.deleted)
+                    this.aliveCount++;
             }
         }
         this.sort();
     }
     get length() {
-        let count = 0;
-        for (const node of this.nodes)
-            if (!node.deleted)
-                count++;
-        return count;
+        return this.aliveCount;
     }
     // --- public API ---
     onChange(listener) {
@@ -41,19 +41,41 @@ export class CRText {
         return output;
     }
     at(index) {
-        return this.alive().at(index);
+        let target = Math.trunc(Number(index));
+        if (Number.isNaN(target))
+            target = 0;
+        if (target < 0)
+            target = this.length + target;
+        if (target < 0)
+            return undefined;
+        let aliveIndex = 0;
+        for (const node of this.nodes) {
+            if (node.deleted)
+                continue;
+            if (aliveIndex === target)
+                return node.value;
+            aliveIndex++;
+        }
+        return undefined;
     }
     insertAt(index, char) {
         if (!Number.isInteger(index))
             throw new TypeError("CRText.insertAt: index must be an integer");
         if (index < 0)
             throw new RangeError("CRText.insertAt: negative index not supported");
-        if (index > this.length)
+        const length = this.aliveCount;
+        if (index > length)
             throw new RangeError("CRText.insertAt: index out of bounds");
-        const after = this.afterIdForAliveInsertAt(index);
+        const lastAliveId = this.lastAliveId();
+        const after = index === length
+            ? lastAliveId
+                ? [lastAliveId]
+                : ROOT
+            : this.afterIdForAliveInsertAt(index);
         const node = new DAGNode({ value: char, after });
         this.nodes.push(node);
         this.nodeById.set(node.id, node);
+        this.aliveCount++;
         this.sort();
         this.emit([node]);
         return this;
@@ -64,11 +86,23 @@ export class CRText {
         if (index < 0)
             throw new RangeError("CRText.deleteAt: negative index not supported");
         let aliveIndex = 0;
-        for (const node of this.nodes) {
+        for (let idx = 0; idx < this.nodes.length; idx++) {
+            const node = this.nodes[idx];
             if (node.deleted)
                 continue;
             if (aliveIndex === index) {
                 node.deleted = true;
+                this.aliveCount--;
+                if (this.aliveCount === 0) {
+                    this.lastAliveIndex = -1;
+                }
+                else if (idx === this.lastAliveIndex) {
+                    this.lastAliveIndex = idx - 1;
+                    while (this.lastAliveIndex >= 0 &&
+                        this.nodes[this.lastAliveIndex].deleted) {
+                        this.lastAliveIndex--;
+                    }
+                }
                 this.emit([node]);
                 return node.value;
             }
@@ -87,10 +121,13 @@ export class CRText {
                 const clone = structuredClone(remote);
                 this.nodes.push(clone);
                 this.nodeById.set(clone.id, clone);
+                if (!clone.deleted)
+                    this.aliveCount++;
                 changed.push(clone);
             }
             else if (!local.deleted && remote.deleted) {
                 local.deleted = true;
+                this.aliveCount--;
                 changed.push(local);
             }
         }
@@ -103,6 +140,7 @@ export class CRText {
     sort(compareFn) {
         if (compareFn) {
             this.nodes.sort(compareFn);
+            this.recomputeLastAliveIndex();
             return this;
         }
         this.nodes.sort((left, right) => {
@@ -120,16 +158,10 @@ export class CRText {
                 return left.id > right.id ? -1 : 1;
             return left.id < right.id ? -1 : 1;
         });
+        this.recomputeLastAliveIndex();
         return this;
     }
     // --- internals ---
-    alive() {
-        const values = [];
-        for (const node of this.nodes)
-            if (!node.deleted)
-                values.push(node.value);
-        return values;
-    }
     afterIdForAliveInsertAt(index) {
         if (index === 0)
             return ROOT;
@@ -147,6 +179,27 @@ export class CRText {
             return [previousAliveId];
         return ROOT;
     }
+    lastAliveId() {
+        if (this.lastAliveIndex < 0)
+            return null;
+        const node = this.nodes[this.lastAliveIndex];
+        if (!node || node.deleted) {
+            this.recomputeLastAliveIndex();
+            if (this.lastAliveIndex < 0)
+                return null;
+            return this.nodes[this.lastAliveIndex].id;
+        }
+        return node.id;
+    }
+    recomputeLastAliveIndex() {
+        for (let index = this.nodes.length - 1; index >= 0; index--) {
+            if (!this.nodes[index].deleted) {
+                this.lastAliveIndex = index;
+                return;
+            }
+        }
+        this.lastAliveIndex = -1;
+    }
     emit(nodes) {
         if (nodes.length === 0)
             return;