dacument 1.1.0 → 1.2.1

package/dist/Dacument/class.js

@@ -9,7 +9,7 @@ import { CRSet } from "../CRSet/class.js";
 import { CRText } from "../CRText/class.js";
 import { AclLog } from "./acl.js";
 import { HLC, compareHLC } from "./clock.js";
-import { decodeToken, encodeToken, signToken, validateActorKeyPair, verifyDetached, verifyToken, } from "./crypto.js";
+import { decodeToken, signToken, validateActorKeyPair, verifyDetached, verifyToken, } from "./crypto.js";
 import { array, map, record, register, set, text, isJsValue, isValueOfType, schemaIdInput, } from "./types.js";
 const TOKEN_TYP = "DACOP";
 function nowSeconds() {
@@ -21,6 +21,17 @@ function isObject(value) {
 function isStringArray(value) {
     return Array.isArray(value) && value.every((entry) => typeof entry === "string");
 }
+function isValidNonceId(value) {
+    if (typeof value !== "string")
+        return false;
+    try {
+        const bytes = Bytes.fromBase64UrlString(value);
+        return bytes.byteLength === 32 && value.length === 43;
+    }
+    catch {
+        return false;
+    }
+}
 function stableKey(value) {
     if (value === null)
         return "null";
@@ -83,6 +94,17 @@ function isAckPatch(value) {
         typeof seen.logical === "number" &&
         typeof seen.clockId === "string");
 }
+function isResetPatch(value) {
+    if (!isObject(value))
+        return false;
+    if (typeof value.newDocId !== "string")
+        return false;
+    if (!isValidNonceId(value.newDocId))
+        return false;
+    if ("reason" in value && value.reason !== undefined && typeof value.reason !== "string")
+        return false;
+    return true;
+}
 function isPatchEnvelope(value) {
     return isObject(value) && Array.isArray(value.nodes);
 }
@@ -147,15 +169,34 @@ function toPublicRoleKeys(roleKeys) {
 export class Dacument {
     static actorInfo;
     static actorSigner;
+    static actorInfoPrevious;
     static async setActorInfo(info) {
-        if (Dacument.actorInfo)
-            return;
+        const existing = Dacument.actorInfo;
+        if (existing) {
+            if (info.id !== existing.id)
+                throw new Error("Dacument.setActorInfo: actor id already set");
+            const samePrivate = jwkEquals(info.privateKeyJwk, existing.privateKeyJwk);
+            const samePublic = jwkEquals(info.publicKeyJwk, existing.publicKeyJwk);
+            if (samePrivate && samePublic)
+                return;
+            if (!info.currentPrivateKeyJwk || !info.currentPublicKeyJwk)
+                throw new Error("Dacument.setActorInfo: current keys required to update actor info");
+            if (!jwkEquals(info.currentPrivateKeyJwk, existing.privateKeyJwk) ||
+                !jwkEquals(info.currentPublicKeyJwk, existing.publicKeyJwk))
+                throw new Error("Dacument.setActorInfo: current keys do not match existing actor info");
+        }
         if (!Dacument.isValidActorId(info.id))
             throw new Error("Dacument.setActorInfo: id must be 256-bit base64url");
         Dacument.assertActorPrivateKey(info.privateKeyJwk);
         Dacument.assertActorPublicKey(info.publicKeyJwk);
         await validateActorKeyPair(info.privateKeyJwk, info.publicKeyJwk);
-        Dacument.actorInfo = info;
+        if (existing)
+            Dacument.actorInfoPrevious = existing;
+        Dacument.actorInfo = {
+            id: info.id,
+            privateKeyJwk: info.privateKeyJwk,
+            publicKeyJwk: info.publicKeyJwk,
+        };
         Dacument.actorSigner = new SigningAgent(info.privateKeyJwk);
     }
     static requireActorInfo() {
@@ -168,21 +209,30 @@ export class Dacument {
             throw new Error("Dacument: actor info not set; call Dacument.setActorInfo()");
         return Dacument.actorSigner;
     }
-    static async signActorToken(token) {
-        const signer = Dacument.requireActorSigner();
+    static async signActorToken(token, privateKeyJwk) {
+        const current = Dacument.actorInfo;
+        const signer = privateKeyJwk &&
+            current &&
+            jwkEquals(privateKeyJwk, current.privateKeyJwk)
+            ? Dacument.requireActorSigner()
+            : privateKeyJwk
+                ? new SigningAgent(privateKeyJwk)
+                : Dacument.requireActorSigner();
         const signature = await signer.sign(Bytes.fromString(token));
         return Bytes.toBase64UrlString(signature);
     }
     static isValidActorId(actorId) {
-        if (typeof actorId !== "string")
-            return false;
-        try {
-            const bytes = Bytes.fromBase64UrlString(actorId);
-            return bytes.byteLength === 32 && actorId.length === 43;
-        }
-        catch {
-            return false;
-        }
+        return isValidNonceId(actorId);
+    }
+    static actorInfoForPublicKey(publicKeyJwk) {
+        if (!publicKeyJwk)
+            return null;
+        if (Dacument.actorInfo && jwkEquals(publicKeyJwk, Dacument.actorInfo.publicKeyJwk))
+            return Dacument.actorInfo;
+        if (Dacument.actorInfoPrevious &&
+            jwkEquals(publicKeyJwk, Dacument.actorInfoPrevious.publicKeyJwk))
+            return Dacument.actorInfoPrevious;
+        return null;
     }
     static assertActorKeyJwk(jwk, label) {
         if (!jwk || typeof jwk !== "object")
@@ -472,6 +522,7 @@ export class Dacument {
     actorSigByToken = new Map();
     appliedTokens = new Set();
     currentRole;
+    resetState = null;
     revokedCrdtByField = new Map();
     deleteStampsByField = new Map();
     tombstoneStampsByField = new Map();
@@ -489,6 +540,24 @@ export class Dacument {
             values.set(key, this.fieldValue(key));
         return values;
     }
+    resetError() {
+        const newDocId = this.resetState?.newDocId ?? "unknown";
+        return new Error(`Dacument is reset/deprecated. Use newDocId: ${newDocId}`);
+    }
+    assertNotReset() {
+        if (this.resetState)
+            throw this.resetError();
+    }
+    currentRoleFor(actorId) {
+        if (this.resetState)
+            return "revoked";
+        return this.aclLog.currentRole(actorId);
+    }
+    roleAt(actorId, stamp) {
+        if (this.resetState && compareHLC(stamp, this.resetState.ts) > 0)
+            return "revoked";
+        return this.aclLog.roleAt(actorId, stamp);
+    }
     recordActorSig(token, actorSig) {
         if (!actorSig || this.actorSigByToken.has(token))
             return;
@@ -517,11 +586,11 @@ export class Dacument {
         }
         this.acl = {
             setRole: (actorId, role) => this.setRole(actorId, role),
-            getRole: (actorId) => this.aclLog.currentRole(actorId),
+            getRole: (actorId) => this.currentRoleFor(actorId),
             knownActors: () => this.aclLog.knownActors(),
             snapshot: () => this.aclLog.snapshot(),
         };
-        this.currentRole = this.aclLog.currentRole(this.actorId);
+        this.currentRole = this.currentRoleFor(this.actorId);
         return new Proxy(this, {
             get: (target, property, receiver) => {
                 if (typeof property !== "string")
@@ -588,7 +657,7 @@ export class Dacument {
         await Promise.all([...this.pending]);
     }
     snapshot() {
-        if (this.isRevoked())
+        if (this.isRevoked() && !this.resetState)
             throw new Error("Dacument: revoked actors cannot snapshot");
         const ops = this.opLog.map((op) => {
             const actorSig = this.actorSigByToken.get(op.token);
@@ -600,9 +669,20 @@ export class Dacument {
             ops,
         };
     }
+    getResetState() {
+        return this.resetState
+            ? {
+                ts: this.resetState.ts,
+                by: this.resetState.by,
+                newDocId: this.resetState.newDocId,
+                reason: this.resetState.reason,
+            }
+            : null;
+    }
     selfRevoke() {
+        this.assertNotReset();
         const stamp = this.clock.next();
-        const role = this.aclLog.roleAt(this.actorId, stamp);
+        const role = this.roleAt(this.actorId, stamp);
         if (role === "revoked")
             return;
         const actorInfo = Dacument.requireActorInfo();
@@ -629,6 +709,52 @@ export class Dacument {
         }
         this.queueActorOp(payload);
     }
+    async accessReset(options = {}) {
+        this.assertNotReset();
+        const stamp = this.clock.next();
+        const role = this.roleAt(this.actorId, stamp);
+        if (role !== "owner")
+            throw new Error("Dacument: only owner can accessReset");
+        if (!this.roleKey)
+            throw new Error("Dacument: missing owner private key");
+        const schema = this.materializeSchema();
+        const created = await Dacument.create({ schema });
+        const newDoc = await Dacument.load({
+            schema,
+            roleKey: created.roleKeys.owner.privateKey,
+            snapshot: created.snapshot,
+        });
+        const patch = {
+            newDocId: created.docId,
+        };
+        if (options.reason)
+            patch.reason = options.reason;
+        const payload = {
+            iss: this.actorId,
+            sub: this.docId,
+            iat: nowSeconds(),
+            stamp,
+            kind: "reset",
+            schema: this.schemaId,
+            patch,
+        };
+        const header = {
+            alg: "ES256",
+            typ: TOKEN_TYP,
+            kid: `${this.actorId}:owner`,
+        };
+        const token = await signToken(this.roleKey, header, payload);
+        const actorSig = await Dacument.signActorToken(token);
+        const oldDocOps = [{ token, actorSig }];
+        this.emitEvent("change", { type: "change", ops: oldDocOps });
+        await this.merge(oldDocOps);
+        return {
+            newDoc,
+            oldDocOps,
+            newDocSnapshot: created.snapshot,
+            roleKeys: created.roleKeys,
+        };
+    }
     async verifyActorIntegrity(options = {}) {
         const input = options.token !== undefined
             ? [options.token]
@@ -715,33 +841,32 @@ export class Dacument {
                 rejected++;
                 continue;
             }
-            const isUnsignedAck = decoded.header.alg === "none" &&
-                payload.kind === "ack" &&
-                decoded.header.typ === TOKEN_TYP;
-            if (decoded.header.alg === "none" && !isUnsignedAck) {
-                rejected++;
-                continue;
-            }
-            if (payload.kind === "ack" && decoded.header.alg !== "none") {
+            if (decoded.header.alg === "none") {
                 rejected++;
                 continue;
             }
             let stored = this.verifiedOps.get(token);
             if (!stored) {
-                if (isUnsignedAck) {
-                    stored = { payload, signerRole: null };
+                const signerKind = parseSignerKind(decoded.header.kid, payload.iss);
+                if (!signerKind) {
+                    rejected++;
+                    continue;
                 }
-                else {
-                    const signerKind = parseSignerKind(decoded.header.kid, payload.iss);
-                    if (!signerKind) {
-                        rejected++;
-                        continue;
-                    }
-                    if (signerKind === "actor") {
-                        if (payload.kind !== "acl.set") {
+                if (signerKind === "actor") {
+                    if (payload.kind === "ack") {
+                        const publicKey = this.aclLog.publicKeyAt(payload.iss, payload.stamp);
+                        if (!publicKey) {
+                            rejected++;
+                            continue;
+                        }
+                        const verified = await verifyToken(publicKey, token, TOKEN_TYP);
+                        if (!verified) {
                             rejected++;
                             continue;
                         }
+                        stored = { payload, signerRole: "actor" };
+                    }
+                    else if (payload.kind === "acl.set") {
                         const patch = isAclPatch(payload.patch) ? payload.patch : null;
                         if (!patch || patch.target !== payload.iss) {
                             rejected++;
@@ -754,12 +879,6 @@ export class Dacument {
                             continue;
                         }
                         const existingKey = this.aclLog.publicKeyAt(payload.iss, payload.stamp);
-                        if (existingKey &&
-                            patch.publicKeyJwk &&
-                            !jwkEquals(existingKey, patch.publicKeyJwk)) {
-                            rejected++;
-                            continue;
-                        }
                         const publicKey = existingKey ?? patch.publicKeyJwk;
                         if (!publicKey) {
                             rejected++;
@@ -773,14 +892,22 @@ export class Dacument {
                         stored = { payload, signerRole: "actor" };
                     }
                     else {
-                        const publicKey = this.roleKeys[signerKind];
-                        const verified = await verifyToken(publicKey, token, TOKEN_TYP);
-                        if (!verified) {
-                            rejected++;
-                            continue;
-                        }
-                        stored = { payload, signerRole: signerKind };
+                        rejected++;
+                        continue;
+                    }
+                }
+                else {
+                    if (payload.kind === "ack") {
+                        rejected++;
+                        continue;
+                    }
+                    const publicKey = this.roleKeys[signerKind];
+                    const verified = await verifyToken(publicKey, token, TOKEN_TYP);
+                    if (!verified) {
+                        rejected++;
+                        continue;
                     }
+                    stored = { payload, signerRole: signerKind };
                 }
                 this.verifiedOps.set(token, stored);
                 if (!this.opTokens.has(token)) {
@@ -831,7 +958,7 @@ export class Dacument {
             const entry = this.aclLog.currentEntry(this.actorId);
             this.emitRevoked(prevRole, entry?.by ?? this.actorId, entry?.stamp ?? this.clock.current);
         }
-        if (appliedNonAck)
+        if (appliedNonAck && !this.resetState)
             this.scheduleAck();
         this.maybeGc();
         this.maybePublishActorKey();
@@ -847,6 +974,8 @@ export class Dacument {
         this.tombstoneStampsByField.clear();
         this.deleteNodeStampsByField.clear();
         this.revokedCrdtByField.clear();
+        this.resetState = null;
+        let resetStamp = null;
         for (const state of this.fields.values()) {
             state.crdt = createEmptyField(state.schema);
         }
@@ -864,8 +993,21 @@ export class Dacument {
             return left.token < right.token ? -1 : 1;
         });
         for (const { token, payload, signerRole } of ops) {
+            if (resetStamp && compareHLC(payload.stamp, resetStamp) > 0)
+                continue;
             let allowed = false;
-            if (payload.kind === "acl.set") {
+            const isReset = payload.kind === "reset";
+            if (isReset) {
+                if (this.resetState)
+                    continue;
+                if (!isResetPatch(payload.patch))
+                    continue;
+                const roleAt = this.roleAt(payload.iss, payload.stamp);
+                if (signerRole === "owner" && roleAt === "owner") {
+                    allowed = true;
+                }
+            }
+            else if (payload.kind === "acl.set") {
                 const patch = isAclPatch(payload.patch) ? payload.patch : null;
                 if (!patch)
                     continue;
@@ -876,19 +1018,19 @@ export class Dacument {
                     allowed = true;
                 }
                 else {
-                    const roleAt = this.aclLog.roleAt(payload.iss, payload.stamp);
-                    const isSelfRevoke = patch.target === payload.iss && patch.role === "revoked";
+                    const roleAt = this.roleAt(payload.iss, payload.stamp);
+                    const isSelf = patch.target === payload.iss;
+                    const isSelfRevoke = isSelf && patch.role === "revoked";
                     const targetKey = this.aclLog.publicKeyAt(patch.target, payload.stamp);
-                    const isSelfKeyUpdate = patch.target === payload.iss &&
+                    const keyMismatch = Boolean(patch.publicKeyJwk) &&
+                        Boolean(targetKey) &&
+                        !jwkEquals(targetKey, patch.publicKeyJwk);
+                    const isSelfKeyUpdate = isSelf &&
                         patch.publicKeyJwk &&
                         patch.role === roleAt &&
-                        roleAt !== "revoked" &&
-                        (!targetKey || jwkEquals(targetKey, patch.publicKeyJwk));
-                    if (patch.publicKeyJwk &&
-                        targetKey &&
-                        !jwkEquals(targetKey, patch.publicKeyJwk)) {
+                        roleAt !== "revoked";
+                    if (keyMismatch && signerRole !== "actor")
                         continue;
-                    }
                     if (isSelfRevoke) {
                         if (signerRole === "actor") {
                             allowed = true;
@@ -905,18 +1047,18 @@ export class Dacument {
                         if (this.canWriteAclTarget(signerRole, patch.role, patch.target, payload.stamp)) {
                             allowed = true;
                         }
-                        else if (isSelfKeyUpdate) {
+                        else if (isSelfKeyUpdate && !keyMismatch) {
                             allowed = true;
                         }
                     }
                 }
             }
             else {
-                const roleAt = this.aclLog.roleAt(payload.iss, payload.stamp);
+                const roleAt = this.roleAt(payload.iss, payload.stamp);
                 if (payload.kind === "ack") {
                     if (roleAt === "revoked")
                         continue;
-                    if (signerRole !== null)
+                    if (signerRole !== "actor")
                         continue;
                     allowed = true;
                 }
@@ -930,19 +1072,23 @@ export class Dacument {
             const emit = !previousApplied.has(token);
             this.suppressMerge = !emit;
             try {
-                const applied = this.applyRemotePayload(payload, signerRole);
+                const applied = isReset
+                    ? this.applyResetPayload(payload, emit)
+                    : this.applyRemotePayload(payload, signerRole);
                 if (!applied)
                     continue;
             }
             finally {
                 this.suppressMerge = false;
             }
+            if (isReset)
+                resetStamp = payload.stamp;
             this.appliedTokens.add(token);
             invalidated.delete(token);
             if (emit && payload.kind !== "ack")
                 appliedNonAck = true;
         }
-        this.currentRole = this.aclLog.currentRole(this.actorId);
+        this.currentRole = this.currentRoleFor(this.actorId);
         if (invalidated.size > 0 &&
             options?.beforeValues &&
             options.diffActor &&
@@ -952,10 +1098,15 @@ export class Dacument {
         return { appliedNonAck };
     }
     maybePublishActorKey() {
+        if (this.resetState)
+            return;
         const entry = this.aclLog.currentEntry(this.actorId);
         if (entry?.publicKeyJwk) {
-            this.actorKeyPublishPending = false;
-            return;
+            const actorInfo = Dacument.requireActorInfo();
+            if (jwkEquals(entry.publicKeyJwk, actorInfo.publicKeyJwk)) {
+                this.actorKeyPublishPending = false;
+                return;
+            }
         }
         if (this.actorKeyPublishPending)
             return;
@@ -964,6 +1115,13 @@ export class Dacument {
         if (!entry)
             return;
         const actorInfo = Dacument.requireActorInfo();
+        const signerInfo = entry.publicKeyJwk
+            ? Dacument.actorInfoForPublicKey(entry.publicKeyJwk)
+            : actorInfo;
+        if (entry.publicKeyJwk && !signerInfo) {
+            this.emitError(new Error("Dacument: actor key mismatch; update requires current key material"));
+            return;
+        }
         const stamp = this.clock.next();
         const payload = {
             iss: this.actorId,
@@ -980,18 +1138,37 @@ export class Dacument {
             },
         };
         this.actorKeyPublishPending = true;
-        this.queueActorOp(payload, () => {
-            this.actorKeyPublishPending = false;
+        this.queueActorOp(payload, {
+            signer: (signerInfo ?? actorInfo).privateKeyJwk,
+            onError: () => {
+                this.actorKeyPublishPending = false;
+            },
         });
     }
+    actorSignatureKey() {
+        const entry = this.aclLog.currentEntry(this.actorId);
+        if (!entry?.publicKeyJwk)
+            return null;
+        const actorInfo = Dacument.actorInfoForPublicKey(entry.publicKeyJwk);
+        return actorInfo?.privateKeyJwk ?? null;
+    }
     ack() {
+        this.assertNotReset();
         const stamp = this.clock.next();
-        const role = this.aclLog.roleAt(this.actorId, stamp);
+        const role = this.roleAt(this.actorId, stamp);
         if (role === "revoked")
             throw new Error("Dacument: revoked actors cannot acknowledge");
+        const entry = this.aclLog.currentEntry(this.actorId);
+        if (!entry?.publicKeyJwk)
+            return;
+        const actorInfo = Dacument.actorInfoForPublicKey(entry.publicKeyJwk);
+        if (!actorInfo) {
+            this.emitError(new Error("Dacument: actor key not available to sign ack"));
+            return;
+        }
         const seen = this.clock.current;
         this.ackByActor.set(this.actorId, seen);
-        this.queueLocalOp({
+        this.queueActorOp({
             iss: this.actorId,
             sub: this.docId,
             iat: nowSeconds(),
@@ -999,13 +1176,15 @@ export class Dacument {
             kind: "ack",
             schema: this.schemaId,
             patch: { seen },
-        }, role);
+        }, { signer: actorInfo.privateKeyJwk });
     }
     scheduleAck() {
         if (this.ackScheduled)
             return;
         if (this.currentRole === "revoked")
             return;
+        if (this.resetState)
+            return;
         this.ackScheduled = true;
         queueMicrotask(() => {
             this.ackScheduled = false;
@@ -1034,6 +1213,8 @@ export class Dacument {
         return barrier;
     }
     maybeGc() {
+        if (this.resetState)
+            return;
         const barrier = this.computeGcBarrier();
         if (!barrier)
             return;
@@ -1160,8 +1341,9 @@ export class Dacument {
             throw new Error(`Dacument: invalid value for '${field}'`);
         if (schema.regex && typeof value === "string" && !schema.regex.test(value))
             throw new Error(`Dacument: '${field}' failed regex`);
+        this.assertNotReset();
         const stamp = this.clock.next();
-        const role = this.aclLog.roleAt(this.actorId, stamp);
+        const role = this.roleAt(this.actorId, stamp);
         if (!this.canWriteField(role))
             throw new Error(`Dacument: role '${role}' cannot write '${field}'`);
         this.queueLocalOp({
@@ -1340,7 +1522,7 @@ export class Dacument {
             insertAt(index, value) {
                 doc.assertValueType(field, value);
                 const stamp = doc.clock.next();
-                const role = doc.aclLog.roleAt(doc.actorId, stamp);
+                const role = doc.roleAt(doc.actorId, stamp);
                 doc.assertWritable(field, role);
                 const shadow = doc.shadowFor(field, state);
                 const { patches, result } = doc.capturePatches((listener) => shadow.onChange(listener), () => shadow.insertAt(index, value));
@@ -1360,7 +1542,7 @@ export class Dacument {
             },
             deleteAt(index) {
                 const stamp = doc.clock.next();
-                const role = doc.aclLog.roleAt(doc.actorId, stamp);
+                const role = doc.roleAt(doc.actorId, stamp);
                 doc.assertWritable(field, role);
                 const shadow = doc.shadowFor(field, state);
                 const { patches, result } = doc.capturePatches((listener) => shadow.onChange(listener), () => shadow.deleteAt(index));
@@ -1568,7 +1750,7 @@ export class Dacument {
     commitArrayMutation(field, mutate) {
         const state = this.fields.get(field);
         const stamp = this.clock.next();
-        const role = this.aclLog.roleAt(this.actorId, stamp);
+        const role = this.roleAt(this.actorId, stamp);
         this.assertWritable(field, role);
         const shadow = this.shadowFor(field, state);
         const { patches, result } = this.capturePatches((listener) => shadow.onChange(listener), () => mutate(shadow));
@@ -1589,7 +1771,7 @@ export class Dacument {
     commitSetMutation(field, mutate) {
         const state = this.fields.get(field);
         const stamp = this.clock.next();
-        const role = this.aclLog.roleAt(this.actorId, stamp);
+        const role = this.roleAt(this.actorId, stamp);
         this.assertWritable(field, role);
         const shadow = this.shadowFor(field, state);
         const { patches, result } = this.capturePatches((listener) => shadow.onChange(listener), () => mutate(shadow));
@@ -1610,7 +1792,7 @@ export class Dacument {
     commitMapMutation(field, mutate) {
         const state = this.fields.get(field);
         const stamp = this.clock.next();
-        const role = this.aclLog.roleAt(this.actorId, stamp);
+        const role = this.roleAt(this.actorId, stamp);
         this.assertWritable(field, role);
         const shadow = this.shadowFor(field, state);
         const { patches, result } = this.capturePatches((listener) => shadow.onChange(listener), () => mutate(shadow));
@@ -1631,7 +1813,7 @@ export class Dacument {
     commitRecordMutation(field, mutate) {
         const state = this.fields.get(field);
         const stamp = this.clock.next();
-        const role = this.aclLog.roleAt(this.actorId, stamp);
+        const role = this.roleAt(this.actorId, stamp);
         this.assertWritable(field, role);
         const shadow = this.shadowFor(field, state);
         const { patches, result } = this.capturePatches((listener) => shadow.onChange(listener), () => mutate(shadow));
@@ -1662,11 +1844,9 @@ export class Dacument {
         return { patches, result };
     }
     queueLocalOp(payload, role) {
+        this.assertNotReset();
         if (payload.kind === "ack") {
-            const header = { alg: "none", typ: TOKEN_TYP };
-            const token = encodeToken(header, payload);
-            this.emitEvent("change", { type: "change", ops: [{ token }] });
-            return;
+            throw new Error("Dacument: ack ops must be actor-signed");
         }
         if (!roleNeedsKey(role))
             throw new Error(`Dacument: role '${role}' cannot sign ops`);
@@ -1675,34 +1855,56 @@ export class Dacument {
         const header = { alg: "ES256", typ: TOKEN_TYP, kid: `${payload.iss}:${role}` };
         const promise = signToken(this.roleKey, header, payload)
             .then(async (token) => {
-            const actorSig = await Dacument.signActorToken(token);
-            const op = { token, actorSig };
+            const actorSigKey = this.actorSignatureKey();
+            const actorSig = actorSigKey
+                ? await Dacument.signActorToken(token, actorSigKey)
+                : undefined;
+            const op = actorSig ? { token, actorSig } : { token };
             this.emitEvent("change", { type: "change", ops: [op] });
         })
             .catch((error) => this.emitError(error instanceof Error ? error : new Error(String(error))));
         this.pending.add(promise);
         promise.finally(() => this.pending.delete(promise));
     }
-    queueActorOp(payload, onError) {
+    queueActorOp(payload, options) {
+        this.assertNotReset();
         const actorInfo = Dacument.requireActorInfo();
+        const signingKey = options?.signer ?? actorInfo.privateKeyJwk;
         const header = {
             alg: "ES256",
             typ: TOKEN_TYP,
             kid: `${payload.iss}:actor`,
         };
-        const promise = signToken(actorInfo.privateKeyJwk, header, payload)
+        const promise = signToken(signingKey, header, payload)
             .then(async (token) => {
-            const actorSig = await Dacument.signActorToken(token);
+            const actorSig = await Dacument.signActorToken(token, signingKey);
             const op = { token, actorSig };
             this.emitEvent("change", { type: "change", ops: [op] });
         })
             .catch((error) => {
-            onError?.();
+            options?.onError?.();
             this.emitError(error instanceof Error ? error : new Error(String(error)));
         });
         this.pending.add(promise);
         promise.finally(() => this.pending.delete(promise));
     }
+    applyResetPayload(payload, emit) {
+        if (!isResetPatch(payload.patch))
+            return false;
+        if (this.resetState)
+            return false;
+        this.clock.observe(payload.stamp);
+        const patch = payload.patch;
+        this.resetState = {
+            ts: payload.stamp,
+            by: payload.iss,
+            newDocId: patch.newDocId,
+            reason: patch.reason,
+        };
+        if (emit)
+            this.emitReset(this.resetState);
+        return true;
+    }
     applyRemotePayload(payload, signerRole) {
         this.clock.observe(payload.stamp);
         if (payload.kind === "ack") {
@@ -2168,8 +2370,9 @@ export class Dacument {
         return count;
     }
     setRole(actorId, role) {
+        this.assertNotReset();
         const stamp = this.clock.next();
-        const signerRole = this.aclLog.roleAt(this.actorId, stamp);
+        const signerRole = this.roleAt(this.actorId, stamp);
         if (!this.canWriteAclTarget(signerRole, role, actorId, stamp))
             throw new Error(`Dacument: role '${signerRole}' cannot grant '${role}'`);
         const assignmentId = uuidv7();
@@ -2222,6 +2425,62 @@ export class Dacument {
                 return this.recordValue(crdt);
         }
     }
+    materializeSchema() {
+        const output = {};
+        for (const [field, schema] of Object.entries(this.schema)) {
+            const current = this.fieldValue(field);
+            if (schema.crdt === "register") {
+                const next = { ...schema };
+                if (isValueOfType(current, schema.jsType)) {
+                    if (schema.regex &&
+                        typeof current === "string" &&
+                        !schema.regex.test(current))
+                        throw new Error(`Dacument.accessReset: '${field}' failed regex`);
+                    next.initial = current;
+                }
+                else {
+                    delete next.initial;
+                }
+                output[field] = next;
+                continue;
+            }
+            if (schema.crdt === "text") {
+                output[field] = {
+                    ...schema,
+                    initial: typeof current === "string" ? current : "",
+                };
+                continue;
+            }
+            if (schema.crdt === "array") {
+                output[field] = {
+                    ...schema,
+                    initial: Array.isArray(current) ? current : [],
+                };
+                continue;
+            }
+            if (schema.crdt === "set") {
+                output[field] = {
+                    ...schema,
+                    initial: Array.isArray(current) ? current : [],
+                };
+                continue;
+            }
+            if (schema.crdt === "map") {
+                output[field] = {
+                    ...schema,
+                    initial: Array.isArray(current) ? current : [],
+                };
+                continue;
+            }
+            if (schema.crdt === "record") {
+                output[field] =
+                    current && isObject(current) && !Array.isArray(current)
+                        ? { ...schema, initial: current }
+                        : { ...schema, initial: {} };
+            }
+        }
+        return output;
+    }
     emitEvent(type, event) {
         const listeners = this.eventListeners.get(type);
         if (!listeners)
@@ -2245,6 +2504,16 @@ export class Dacument {
             stamp,
         });
     }
+    emitReset(payload) {
+        this.emitEvent("reset", {
+            type: "reset",
+            oldDocId: this.docId,
+            newDocId: payload.newDocId,
+            ts: payload.ts,
+            by: payload.by,
+            reason: payload.reason,
+        });
+    }
     emitError(error) {
         this.emitEvent("error", { type: "error", error });
     }
@@ -2262,13 +2531,14 @@ export class Dacument {
         if (!this.canWriteAcl(role, targetRole))
             return false;
         if (role === "manager") {
-            const targetRoleAt = this.aclLog.roleAt(targetActorId, stamp);
+            const targetRoleAt = this.roleAt(targetActorId, stamp);
             if (targetRoleAt === "owner")
                 return false;
         }
         return true;
     }
     assertWritable(field, role) {
+        this.assertNotReset();
         if (!this.canWriteField(role))
             throw new Error(`Dacument: role '${role}' cannot write '${field}'`);
     }