dacument 1.2.0 → 1.2.2

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 simple-crdts contributors
+Copyright (c) 2025 dacument contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -51,6 +51,7 @@ doc.body.insertAt(0, "H");
 doc.tags.add("draft");
 doc.items.push("milk");
 
+// Wire ops to your transport.
 doc.addEventListener("change", (event) => channel.send(event.ops));
 channel.onmessage = (ops) => doc.merge(ops);
 
@@ -60,13 +61,13 @@ doc.addEventListener("merge", ({ actor, target, method, data }) => {
 ```
 
 `create()` returns `roleKeys` for owner/manager/editor; store them securely and
-distribute the highest role key per actor as needed.
+distribute the highest role key each actor should hold.
 
 ## Schema and fields
 
 - `register` fields behave like normal properties: `doc.title = "hi"`.
 - Other fields return safe CRDT views: `doc.items.push("x")`.
-- Unknown fields and schema bypasses throw.
+- Unknown fields or schema bypasses throw.
 - UI updates should listen to `merge` events.
 
 Supported CRDT field types:
@@ -78,7 +79,9 @@ Supported CRDT field types:
 - `map` - OR-Map.
 - `record` - OR-Record.
 
-Map keys must be JSON-compatible values (`string`, `number`, `boolean`, `null`, arrays, or objects). For string-keyed data, prefer `record`.
+Map keys must be JSON-compatible values (`string`, `number`, `boolean`, `null`,
+arrays, or objects). For string-keyed data, prefer `record`. For non-JSON or
+identity-based keys, use `CRMap` with a stable `key` function.
 
 ## Roles and ACL
 
@@ -101,14 +104,17 @@ await doc.flush();
 
 Before any schema/load/create, call `await Dacument.setActorInfo(...)` once per
 process. The actor id must be a 256-bit base64url string (e.g.
-`bytecodec` libarys `generateNonce()`), and the actor key pair must be ES256 (P-256).
-Subsequent calls are ignored. On first merge, Dacument auto-attaches the
-actor's `publicKeyJwk` to its own ACL entry (if missing).
-
-Each actor signs with the role key they were given (owner/manager/editor). Load
-with the highest role key you have; viewers load without a key.
-Role keys are generated once at `create()`; public keys are embedded in the
-snapshot and never rotated.
+`bytecodec` library's `generateNonce()`), and the actor key pair must be ES256 (P-256).
+Updating actor info requires providing the current keys. On first merge, Dacument
+auto-attaches the actor's `publicKeyJwk` to its own ACL entry (if missing) and
+pins it for actor-signature verification. To rotate actor keys in-process, call
+`Dacument.setActorInfo` again with the new keys plus
+`currentPrivateKeyJwk`/`currentPublicKeyJwk`.
+
+Write ops are role-signed; acks are actor-signed with the per-actor key set via
+`setActorInfo`. Load with the highest role key you have; viewers load without a
+key. Role keys are generated once at `create()`; role public keys are embedded
+in the snapshot and never rotated.
 
 ## Networking and sync
 
@@ -144,17 +150,19 @@ const bob = await Dacument.load({
 });
 ```
 
-Snapshots do not include schema or schema ids; callers must supply the schema on load.
+Snapshots do not include the schema or schema ids; callers must supply the schema on load.
 
 ## Events and values
 
-- `doc.addEventListener("change", handler)` emits ops for network sync (writer ops are signed; acks are unsigned).
+- `doc.addEventListener("change", handler)` emits ops for network sync
+  (writer ops are role-signed; acks are actor-signed by non-revoked actors and
+  verified against ACL-pinned actor public keys).
 - `doc.addEventListener("merge", handler)` emits `{ actor, target, method, data }`.
 - `doc.addEventListener("error", handler)` emits signing/verification errors.
 - `doc.addEventListener("revoked", handler)` fires when the current actor is revoked.
 - `doc.addEventListener("reset", handler)` emits `{ oldDocId, newDocId, ts, by, reason }`.
 - `doc.selfRevoke()` emits a signed ACL op that revokes the current actor.
-- `await doc.accessReset({ reason })` creates a new dacument with fresh keys and emits a reset op.
+- `await doc.accessReset({ reason })` creates a new Dacument with fresh keys and emits a reset op.
 - `doc.getResetState()` returns reset metadata (or `null`).
 - `await doc.flush()` waits for pending signatures so all local ops are emitted.
 - `doc.snapshot()` returns a loadable op log (`{ docId, roleKeys, ops }`).
@@ -164,14 +172,14 @@ Snapshots do not include schema or schema ids; callers must supply the schema on
 ## Access reset (key compromise response)
 
 If an owner suspects role key compromise, call `accessReset()` to fork to a new
-doc id and revoke the old one:
+docId and revoke the old one:
 
 ```ts
 const { newDoc, oldDocOps, newDocSnapshot, roleKeys } =
   await doc.accessReset({ reason: "suspected compromise" });
 ```
 
-`accessReset()` materializes the current state into a new dacument with fresh
+`accessReset()` materializes the current state into a new Dacument with fresh
 role keys, emits a signed `reset` op for the old doc, and returns the new
 snapshot + keys. The reset is stored as a CRDT op so all replicas converge. Once
 reset, the old doc rejects any ops after the reset stamp and throws on writes:
@@ -192,17 +200,17 @@ from the ACL at the op stamp and returns a summary plus failures.
 
 Dacument tracks per-actor `ack` ops and compacts tombstones once all non-revoked
 actors (including viewers) have acknowledged a given HLC. Acks are emitted
-automatically after merges that apply new non-ack ops. Acks are unsigned
-(`alg: "none"`); signed acks are rejected.
+automatically after merges that apply new non-ack ops. Acks are ES256 actor-signed
+by non-revoked actors and verified against ACL-pinned actor public keys.
 If any non-revoked actor is offline and never acks, tombstones are kept.
 
 ## Guarantees
 
 - Schema enforcement is strict; unknown fields are rejected.
-- Ops are accepted only if the CRDT patch is valid and the signature verifies
-  (acks are unsigned and signed acks are rejected).
+- Ops are accepted only if the CRDT patch is valid and the role signature
+  verifies; acks require a valid actor signature.
 - Role checks are applied at the op stamp time (HLC).
-- IDs are base64url nonces from `bytecodec` librarys `generateNonce()` (32 random bytes).
+- IDs are base64url nonces from `bytecodec` library's `generateNonce()` (32 random bytes).
 - Private keys are returned by `create()` and never stored by Dacument.
 - Snapshots may include ops that are rejected; invalid ops are ignored on load.
 
@@ -211,8 +219,9 @@ replicas. Dacument does not provide transport; use `change` events to wire it up
 
 ## Possible threats and how to handle
 
-- Key compromise: no rotation exists, so migrate by snapshotting into a new
-  dacument with fresh keys.
+- Role key compromise: role keys cannot be rotated; use `accessReset` or
+  snapshot into a new Dacument with fresh keys. Actor keys can be rotated by
+  providing the current keys.
 - Shared role keys: attribution is role-level, not per-user; treat roles as
   trust groups and log merge events if you need auditing.
 - Insider DoS/flooding: rate-limit ops, cap payload sizes, and monitor merge

package/dist/CRArray/class.d.ts

@@ -2,6 +2,8 @@ import { DAGNode } from "../DAGNode/class.js";
 export declare class CRArray<T> {
     private readonly nodes;
     private readonly nodeById;
+    private aliveCount;
+    private lastAliveIndex;
     private readonly listeners;
     constructor(snapshot?: readonly DAGNode<T>[]);
     get length(): number;
@@ -29,6 +31,7 @@ export declare class CRArray<T> {
     sort(compareFn?: (a: DAGNode<T>, b: DAGNode<T>) => number): this;
     private alive;
     private lastAliveId;
+    private recomputeLastAliveIndex;
     private afterIdForAliveInsertAt;
     private emit;
 }

package/dist/CRArray/class.js

@@ -1,11 +1,29 @@
 import { DAGNode } from "../DAGNode/class.js";
 const ROOT = [];
 function afterKey(after) {
-    return after.join(",");
+    return after.length < 2 ? (after[0] ?? "") : after.join(",");
+}
+function isIndexKey(value) {
+    const length = value.length;
+    if (length === 0)
+        return false;
+    const first = value.charCodeAt(0);
+    if (first < 48 || first > 57)
+        return false;
+    if (length > 1 && first === 48)
+        return false;
+    for (let i = 1; i < length; i++) {
+        const code = value.charCodeAt(i);
+        if (code < 48 || code > 57)
+            return false;
+    }
+    return true;
 }
 export class CRArray {
     nodes = [];
     nodeById = new Map();
+    aliveCount = 0;
+    lastAliveIndex = -1;
     listeners = new Set();
     constructor(snapshot) {
         if (snapshot) {
@@ -14,6 +32,8 @@ export class CRArray {
                     continue;
                 this.nodes.push(node);
                 this.nodeById.set(node.id, node);
+                if (!node.deleted)
+                    this.aliveCount++;
             }
         }
         this.sort();
@@ -22,13 +42,13 @@ export class CRArray {
                 if (typeof property === "string") {
                     if (property === "length")
                         return target.length;
-                    if (/^(0|[1-9]\d*)$/.test(property))
+                    if (isIndexKey(property))
                         return target.at(Number(property));
                 }
                 return Reflect.get(target, property, receiver);
             },
             set: (target, property, value, receiver) => {
-                if (typeof property === "string" && /^(0|[1-9]\d*)$/.test(property)) {
+                if (typeof property === "string" && isIndexKey(property)) {
                     const index = Number(property);
                     target.setAt(index, value);
                     return true;
@@ -36,7 +56,7 @@ export class CRArray {
                 return Reflect.set(target, property, value, receiver);
             },
             has: (target, property) => {
-                if (typeof property === "string" && /^(0|[1-9]\d*)$/.test(property)) {
+                if (typeof property === "string" && isIndexKey(property)) {
                     return Number(property) < target.length;
                 }
                 return Reflect.has(target, property);
@@ -49,7 +69,7 @@ export class CRArray {
                 return keys;
             },
             getOwnPropertyDescriptor: (target, property) => {
-                if (typeof property === "string" && /^(0|[1-9]\d*)$/.test(property)) {
+                if (typeof property === "string" && isIndexKey(property)) {
                     if (Number(property) >= target.length)
                         return undefined;
                     return {
@@ -64,11 +84,7 @@ export class CRArray {
         });
     }
     get length() {
-        let count = 0;
-        for (const node of this.nodes)
-            if (!node.deleted)
-                count++;
-        return count;
+        return this.aliveCount;
     }
     // --- public API ---
     onChange(listener) {
@@ -79,9 +95,8 @@ export class CRArray {
         return this.nodes.slice();
     }
     push(...items) {
-        let after = this.lastAliveId()
-            ? [this.lastAliveId()]
-            : ROOT;
+        const lastAliveId = this.lastAliveId();
+        let after = lastAliveId ? [lastAliveId] : ROOT;
         const changed = [];
         for (const item of items) {
             const node = new DAGNode({ value: item, after });
@@ -89,6 +104,7 @@ export class CRArray {
             this.nodeById.set(node.id, node);
             changed.push(node);
             after = [node.id];
+            this.aliveCount++;
         }
         this.sort();
         this.emit(changed);
@@ -103,19 +119,26 @@ export class CRArray {
             this.nodeById.set(node.id, node);
             changed.push(node);
             after = [node.id];
+            this.aliveCount++;
         }
         this.sort();
         this.emit(changed);
         return this.length;
     }
     pop() {
-        for (let index = this.nodes.length - 1; index >= 0; index--) {
+        for (let index = this.lastAliveIndex; index >= 0; index--) {
             const node = this.nodes[index];
-            if (!node.deleted) {
-                node.deleted = true;
-                this.emit([node]);
-                return node.value;
+            if (node.deleted)
+                continue;
+            node.deleted = true;
+            this.aliveCount--;
+            this.lastAliveIndex = index - 1;
+            while (this.lastAliveIndex >= 0 &&
+                this.nodes[this.lastAliveIndex].deleted) {
+                this.lastAliveIndex--;
             }
+            this.emit([node]);
+            return node.value;
         }
         return undefined;
     }
@@ -123,6 +146,9 @@ export class CRArray {
         for (const node of this.nodes) {
             if (!node.deleted) {
                 node.deleted = true;
+                this.aliveCount--;
+                if (this.aliveCount === 0)
+                    this.lastAliveIndex = -1;
                 this.emit([node]);
                 return node.value;
             }
@@ -130,7 +156,23 @@ export class CRArray {
         return undefined;
     }
     at(index) {
-        return this.alive().at(index);
+        const length = this.aliveCount;
+        let target = Math.trunc(Number(index));
+        if (Number.isNaN(target))
+            target = 0;
+        if (target < 0)
+            target = length + target;
+        if (target < 0 || target >= length)
+            return undefined;
+        let aliveIndex = 0;
+        for (const node of this.nodes) {
+            if (node.deleted)
+                continue;
+            if (aliveIndex === target)
+                return node.value;
+            aliveIndex++;
+        }
+        return undefined;
     }
     setAt(index, value) {
         if (!Number.isInteger(index))
@@ -144,6 +186,7 @@ export class CRArray {
                 continue;
             if (aliveIndex === index) {
                 node.deleted = true;
+                this.aliveCount--;
                 deletedNode = node;
                 break;
             }
@@ -155,19 +198,70 @@ export class CRArray {
         const newNode = new DAGNode({ value, after });
         this.nodes.push(newNode);
         this.nodeById.set(newNode.id, newNode);
+        this.aliveCount++;
         this.sort();
         const changed = deletedNode ? [deletedNode, newNode] : [newNode];
         this.emit(changed);
         return this;
     }
     slice(start, end) {
-        return this.alive().slice(start, end);
+        const length = this.aliveCount;
+        let from = start === undefined ? 0 : Math.trunc(Number(start));
+        if (Number.isNaN(from))
+            from = 0;
+        if (from < 0)
+            from = Math.max(length + from, 0);
+        else if (from > length)
+            from = length;
+        let to = end === undefined ? length : Math.trunc(Number(end));
+        if (Number.isNaN(to))
+            to = 0;
+        if (to < 0)
+            to = Math.max(length + to, 0);
+        else if (to > length)
+            to = length;
+        if (to <= from)
+            return [];
+        const resultLength = to - from;
+        const result = new Array(resultLength);
+        let aliveIndex = 0;
+        let resultIndex = 0;
+        for (const node of this.nodes) {
+            if (node.deleted)
+                continue;
+            if (aliveIndex >= to)
+                break;
+            if (aliveIndex >= from)
+                result[resultIndex++] = node.value;
+            aliveIndex++;
+        }
+        if (resultIndex !== resultLength)
+            result.length = resultIndex;
+        return result;
     }
     includes(value) {
-        return this.alive().includes(value);
+        const valueIsNaN = value !== value;
+        for (const node of this.nodes) {
+            if (node.deleted)
+                continue;
+            const nodeValue = node.value;
+            if (nodeValue === value)
+                return true;
+            if (valueIsNaN && nodeValue !== nodeValue)
+                return true;
+        }
+        return false;
     }
     indexOf(value) {
-        return this.alive().indexOf(value);
+        let aliveIndex = 0;
+        for (const node of this.nodes) {
+            if (node.deleted)
+                continue;
+            if (node.value === value)
+                return aliveIndex;
+            aliveIndex++;
+        }
+        return -1;
     }
     find(predicate, thisArg) {
         return this.alive().find(predicate, thisArg);
@@ -207,10 +301,13 @@ export class CRArray {
                 const clone = structuredClone(remote);
                 this.nodes.push(clone);
                 this.nodeById.set(clone.id, clone);
+                if (!clone.deleted)
+                    this.aliveCount++;
                 changed.push(clone);
             }
             else if (!local.deleted && remote.deleted) {
                 local.deleted = true;
+                this.aliveCount--;
                 changed.push(local);
             }
         }
@@ -223,6 +320,7 @@ export class CRArray {
     sort(compareFn) {
         if (compareFn) {
             this.nodes.sort(compareFn);
+            this.recomputeLastAliveIndex();
             return this;
         }
         this.nodes.sort((left, right) => {
@@ -240,23 +338,42 @@ export class CRArray {
                 return left.id > right.id ? -1 : 1;
             return left.id < right.id ? -1 : 1;
         });
+        this.recomputeLastAliveIndex();
         return this;
     }
     // --- internals ---
     alive() {
-        const values = [];
-        for (const node of this.nodes)
-            if (!node.deleted)
-                values.push(node.value);
+        const values = new Array(this.aliveCount);
+        let aliveIndex = 0;
+        for (const node of this.nodes) {
+            if (node.deleted)
+                continue;
+            values[aliveIndex++] = node.value;
+        }
+        if (aliveIndex !== values.length)
+            values.length = aliveIndex;
         return values;
     }
     lastAliveId() {
+        if (this.lastAliveIndex < 0)
+            return null;
+        const node = this.nodes[this.lastAliveIndex];
+        if (!node || node.deleted) {
+            this.recomputeLastAliveIndex();
+            if (this.lastAliveIndex < 0)
+                return null;
+            return this.nodes[this.lastAliveIndex].id;
+        }
+        return node.id;
+    }
+    recomputeLastAliveIndex() {
         for (let index = this.nodes.length - 1; index >= 0; index--) {
-            const node = this.nodes[index];
-            if (!node.deleted)
-                return node.id;
+            if (!this.nodes[index].deleted) {
+                this.lastAliveIndex = index;
+                return;
+            }
         }
-        return null;
+        this.lastAliveIndex = -1;
     }
     afterIdForAliveInsertAt(index) {
         if (index === 0)

package/dist/CRText/class.d.ts

@@ -2,6 +2,8 @@ import { DAGNode } from "../DAGNode/class.js";
 export declare class CRText<CharT extends string = string> {
     private readonly nodes;
     private readonly nodeById;
+    private aliveCount;
+    private lastAliveIndex;
     private readonly listeners;
     constructor(snapshot?: readonly DAGNode<CharT>[]);
     get length(): number;
@@ -13,7 +15,8 @@ export declare class CRText<CharT extends string = string> {
     deleteAt(index: number): CharT | undefined;
     merge(remoteSnapshot: DAGNode<CharT>[] | DAGNode<CharT>): DAGNode<CharT>[];
     sort(compareFn?: (a: DAGNode<CharT>, b: DAGNode<CharT>) => number): this;
-    private alive;
     private afterIdForAliveInsertAt;
+    private lastAliveId;
+    private recomputeLastAliveIndex;
     private emit;
 }

package/dist/CRText/class.js

@@ -1,11 +1,13 @@
 import { DAGNode } from "../DAGNode/class.js";
 const ROOT = [];
 function afterKey(after) {
-    return after.join(",");
+    return after.length < 2 ? (after[0] ?? "") : after.join(",");
 }
 export class CRText {
     nodes = [];
     nodeById = new Map();
+    aliveCount = 0;
+    lastAliveIndex = -1;
     listeners = new Set();
     constructor(snapshot) {
         if (snapshot) {
@@ -14,16 +16,14 @@ export class CRText {
                     continue;
                 this.nodes.push(node);
                 this.nodeById.set(node.id, node);
+                if (!node.deleted)
+                    this.aliveCount++;
             }
         }
         this.sort();
     }
     get length() {
-        let count = 0;
-        for (const node of this.nodes)
-            if (!node.deleted)
-                count++;
-        return count;
+        return this.aliveCount;
     }
     // --- public API ---
     onChange(listener) {
@@ -41,19 +41,41 @@ export class CRText {
         return output;
     }
     at(index) {
-        return this.alive().at(index);
+        let target = Math.trunc(Number(index));
+        if (Number.isNaN(target))
+            target = 0;
+        if (target < 0)
+            target = this.length + target;
+        if (target < 0)
+            return undefined;
+        let aliveIndex = 0;
+        for (const node of this.nodes) {
+            if (node.deleted)
+                continue;
+            if (aliveIndex === target)
+                return node.value;
+            aliveIndex++;
+        }
+        return undefined;
     }
     insertAt(index, char) {
         if (!Number.isInteger(index))
             throw new TypeError("CRText.insertAt: index must be an integer");
         if (index < 0)
             throw new RangeError("CRText.insertAt: negative index not supported");
-        if (index > this.length)
+        const length = this.aliveCount;
+        if (index > length)
             throw new RangeError("CRText.insertAt: index out of bounds");
-        const after = this.afterIdForAliveInsertAt(index);
+        const lastAliveId = this.lastAliveId();
+        const after = index === length
+            ? lastAliveId
+                ? [lastAliveId]
+                : ROOT
+            : this.afterIdForAliveInsertAt(index);
         const node = new DAGNode({ value: char, after });
         this.nodes.push(node);
         this.nodeById.set(node.id, node);
+        this.aliveCount++;
         this.sort();
         this.emit([node]);
         return this;
@@ -64,11 +86,23 @@ export class CRText {
         if (index < 0)
             throw new RangeError("CRText.deleteAt: negative index not supported");
         let aliveIndex = 0;
-        for (const node of this.nodes) {
+        for (let idx = 0; idx < this.nodes.length; idx++) {
+            const node = this.nodes[idx];
             if (node.deleted)
                 continue;
             if (aliveIndex === index) {
                 node.deleted = true;
+                this.aliveCount--;
+                if (this.aliveCount === 0) {
+                    this.lastAliveIndex = -1;
+                }
+                else if (idx === this.lastAliveIndex) {
+                    this.lastAliveIndex = idx - 1;
+                    while (this.lastAliveIndex >= 0 &&
+                        this.nodes[this.lastAliveIndex].deleted) {
+                        this.lastAliveIndex--;
+                    }
+                }
                 this.emit([node]);
                 return node.value;
             }
@@ -87,10 +121,13 @@ export class CRText {
                 const clone = structuredClone(remote);
                 this.nodes.push(clone);
                 this.nodeById.set(clone.id, clone);
+                if (!clone.deleted)
+                    this.aliveCount++;
                 changed.push(clone);
             }
             else if (!local.deleted && remote.deleted) {
                 local.deleted = true;
+                this.aliveCount--;
                 changed.push(local);
             }
         }
@@ -103,6 +140,7 @@ export class CRText {
     sort(compareFn) {
         if (compareFn) {
             this.nodes.sort(compareFn);
+            this.recomputeLastAliveIndex();
             return this;
         }
         this.nodes.sort((left, right) => {
@@ -120,16 +158,10 @@ export class CRText {
                 return left.id > right.id ? -1 : 1;
             return left.id < right.id ? -1 : 1;
         });
+        this.recomputeLastAliveIndex();
         return this;
     }
     // --- internals ---
-    alive() {
-        const values = [];
-        for (const node of this.nodes)
-            if (!node.deleted)
-                values.push(node.value);
-        return values;
-    }
     afterIdForAliveInsertAt(index) {
         if (index === 0)
             return ROOT;
@@ -147,6 +179,27 @@ export class CRText {
             return [previousAliveId];
         return ROOT;
     }
+    lastAliveId() {
+        if (this.lastAliveIndex < 0)
+            return null;
+        const node = this.nodes[this.lastAliveIndex];
+        if (!node || node.deleted) {
+            this.recomputeLastAliveIndex();
+            if (this.lastAliveIndex < 0)
+                return null;
+            return this.nodes[this.lastAliveIndex].id;
+        }
+        return node.id;
+    }
+    recomputeLastAliveIndex() {
+        for (let index = this.nodes.length - 1; index >= 0; index--) {
+            if (!this.nodes[index].deleted) {
+                this.lastAliveIndex = index;
+                return;
+            }
+        }
+        this.lastAliveIndex = -1;
+    }
     emit(nodes) {
         if (nodes.length === 0)
             return;

package/dist/Dacument/class.d.ts

@@ -1,4 +1,4 @@
-import { type AclAssignment, type ActorInfo, type DacumentEventMap, type DocFieldAccess, type DocSnapshot, type RoleKeys, type RolePublicKeys, type SchemaDefinition, type SchemaId, type SignedOp, type VerificationResult, type VerifyActorIntegrityOptions, type Role, array, map, record, register, set, text } from "./types.js";
+import { type AclAssignment, type ActorInfoUpdate, type DacumentEventMap, type DocFieldAccess, type DocSnapshot, type RoleKeys, type RolePublicKeys, type SchemaDefinition, type SchemaId, type SignedOp, type VerificationResult, type VerifyActorIntegrityOptions, type Role, array, map, record, register, set, text } from "./types.js";
 type ResetStateInfo = {
     ts: AclAssignment["stamp"];
     by: string;
@@ -8,11 +8,13 @@ type ResetStateInfo = {
 export declare class Dacument<S extends SchemaDefinition> {
     private static actorInfo?;
     private static actorSigner?;
-    static setActorInfo(info: ActorInfo): Promise<void>;
+    private static actorInfoPrevious?;
+    static setActorInfo(info: ActorInfoUpdate): Promise<void>;
     private static requireActorInfo;
     private static requireActorSigner;
     private static signActorToken;
     private static isValidActorId;
+    private static actorInfoForPublicKey;
     private static assertActorKeyJwk;
     private static assertActorPrivateKey;
     private static assertActorPublicKey;
@@ -23,7 +25,7 @@ export declare class Dacument<S extends SchemaDefinition> {
     static set: typeof set;
     static map: typeof map;
     static record: typeof record;
-    static computeSchemaId(schema: SchemaDefinition): Promise<SchemaId>;
+    private static computeSchemaId;
     static create<Schema extends SchemaDefinition>(params: {
         schema: Schema;
         docId?: string;
@@ -106,6 +108,7 @@ export declare class Dacument<S extends SchemaDefinition> {
     }>;
     private rebuildFromVerified;
     private maybePublishActorKey;
+    private actorSignatureKey;
     private ack;
     private scheduleAck;
     private computeGcBarrier;

package/dist/Dacument/class.js

@@ -9,7 +9,7 @@ import { CRSet } from "../CRSet/class.js";
 import { CRText } from "../CRText/class.js";
 import { AclLog } from "./acl.js";
 import { HLC, compareHLC } from "./clock.js";
-import { decodeToken, encodeToken, signToken, validateActorKeyPair, verifyDetached, verifyToken, } from "./crypto.js";
+import { decodeToken, signToken, validateActorKeyPair, verifyDetached, verifyToken, } from "./crypto.js";
 import { array, map, record, register, set, text, isJsValue, isValueOfType, schemaIdInput, } from "./types.js";
 const TOKEN_TYP = "DACOP";
 function nowSeconds() {
@@ -169,15 +169,34 @@ function toPublicRoleKeys(roleKeys) {
 export class Dacument {
     static actorInfo;
     static actorSigner;
+    static actorInfoPrevious;
     static async setActorInfo(info) {
-        if (Dacument.actorInfo)
-            return;
+        const existing = Dacument.actorInfo;
+        if (existing) {
+            if (info.id !== existing.id)
+                throw new Error("Dacument.setActorInfo: actor id already set");
+            const samePrivate = jwkEquals(info.privateKeyJwk, existing.privateKeyJwk);
+            const samePublic = jwkEquals(info.publicKeyJwk, existing.publicKeyJwk);
+            if (samePrivate && samePublic)
+                return;
+            if (!info.currentPrivateKeyJwk || !info.currentPublicKeyJwk)
+                throw new Error("Dacument.setActorInfo: current keys required to update actor info");
+            if (!jwkEquals(info.currentPrivateKeyJwk, existing.privateKeyJwk) ||
+                !jwkEquals(info.currentPublicKeyJwk, existing.publicKeyJwk))
+                throw new Error("Dacument.setActorInfo: current keys do not match existing actor info");
+        }
         if (!Dacument.isValidActorId(info.id))
             throw new Error("Dacument.setActorInfo: id must be 256-bit base64url");
         Dacument.assertActorPrivateKey(info.privateKeyJwk);
         Dacument.assertActorPublicKey(info.publicKeyJwk);
         await validateActorKeyPair(info.privateKeyJwk, info.publicKeyJwk);
-        Dacument.actorInfo = info;
+        if (existing)
+            Dacument.actorInfoPrevious = existing;
+        Dacument.actorInfo = {
+            id: info.id,
+            privateKeyJwk: info.privateKeyJwk,
+            publicKeyJwk: info.publicKeyJwk,
+        };
         Dacument.actorSigner = new SigningAgent(info.privateKeyJwk);
     }
     static requireActorInfo() {
@@ -190,14 +209,31 @@ export class Dacument {
             throw new Error("Dacument: actor info not set; call Dacument.setActorInfo()");
         return Dacument.actorSigner;
     }
-    static async signActorToken(token) {
-        const signer = Dacument.requireActorSigner();
+    static async signActorToken(token, privateKeyJwk) {
+        const current = Dacument.actorInfo;
+        const signer = privateKeyJwk &&
+            current &&
+            jwkEquals(privateKeyJwk, current.privateKeyJwk)
+            ? Dacument.requireActorSigner()
+            : privateKeyJwk
+                ? new SigningAgent(privateKeyJwk)
+                : Dacument.requireActorSigner();
         const signature = await signer.sign(Bytes.fromString(token));
         return Bytes.toBase64UrlString(signature);
     }
     static isValidActorId(actorId) {
         return isValidNonceId(actorId);
     }
+    static actorInfoForPublicKey(publicKeyJwk) {
+        if (!publicKeyJwk)
+            return null;
+        if (Dacument.actorInfo && jwkEquals(publicKeyJwk, Dacument.actorInfo.publicKeyJwk))
+            return Dacument.actorInfo;
+        if (Dacument.actorInfoPrevious &&
+            jwkEquals(publicKeyJwk, Dacument.actorInfoPrevious.publicKeyJwk))
+            return Dacument.actorInfoPrevious;
+        return null;
+    }
     static assertActorKeyJwk(jwk, label) {
         if (!jwk || typeof jwk !== "object")
             throw new Error(`Dacument.setActorInfo: ${label} must be a JWK object`);
@@ -805,33 +841,32 @@ export class Dacument {
                 rejected++;
                 continue;
             }
-            const isUnsignedAck = decoded.header.alg === "none" &&
-                payload.kind === "ack" &&
-                decoded.header.typ === TOKEN_TYP;
-            if (decoded.header.alg === "none" && !isUnsignedAck) {
-                rejected++;
-                continue;
-            }
-            if (payload.kind === "ack" && decoded.header.alg !== "none") {
+            if (decoded.header.alg === "none") {
                 rejected++;
                 continue;
             }
             let stored = this.verifiedOps.get(token);
             if (!stored) {
-                if (isUnsignedAck) {
-                    stored = { payload, signerRole: null };
+                const signerKind = parseSignerKind(decoded.header.kid, payload.iss);
+                if (!signerKind) {
+                    rejected++;
+                    continue;
                 }
-                else {
-                    const signerKind = parseSignerKind(decoded.header.kid, payload.iss);
-                    if (!signerKind) {
-                        rejected++;
-                        continue;
-                    }
-                    if (signerKind === "actor") {
-                        if (payload.kind !== "acl.set") {
+                if (signerKind === "actor") {
+                    if (payload.kind === "ack") {
+                        const publicKey = this.aclLog.publicKeyAt(payload.iss, payload.stamp);
+                        if (!publicKey) {
                             rejected++;
                             continue;
                         }
+                        const verified = await verifyToken(publicKey, token, TOKEN_TYP);
+                        if (!verified) {
+                            rejected++;
+                            continue;
+                        }
+                        stored = { payload, signerRole: "actor" };
+                    }
+                    else if (payload.kind === "acl.set") {
                         const patch = isAclPatch(payload.patch) ? payload.patch : null;
                         if (!patch || patch.target !== payload.iss) {
                             rejected++;
@@ -844,12 +879,6 @@ export class Dacument {
                             continue;
                         }
                         const existingKey = this.aclLog.publicKeyAt(payload.iss, payload.stamp);
-                        if (existingKey &&
-                            patch.publicKeyJwk &&
-                            !jwkEquals(existingKey, patch.publicKeyJwk)) {
-                            rejected++;
-                            continue;
-                        }
                         const publicKey = existingKey ?? patch.publicKeyJwk;
                         if (!publicKey) {
                             rejected++;
@@ -863,14 +892,22 @@ export class Dacument {
                         stored = { payload, signerRole: "actor" };
                     }
                     else {
-                        const publicKey = this.roleKeys[signerKind];
-                        const verified = await verifyToken(publicKey, token, TOKEN_TYP);
-                        if (!verified) {
-                            rejected++;
-                            continue;
-                        }
-                        stored = { payload, signerRole: signerKind };
+                        rejected++;
+                        continue;
+                    }
+                }
+                else {
+                    if (payload.kind === "ack") {
+                        rejected++;
+                        continue;
+                    }
+                    const publicKey = this.roleKeys[signerKind];
+                    const verified = await verifyToken(publicKey, token, TOKEN_TYP);
+                    if (!verified) {
+                        rejected++;
+                        continue;
                     }
+                    stored = { payload, signerRole: signerKind };
                 }
                 this.verifiedOps.set(token, stored);
                 if (!this.opTokens.has(token)) {
@@ -982,18 +1019,18 @@ export class Dacument {
                 }
                 else {
                     const roleAt = this.roleAt(payload.iss, payload.stamp);
-                    const isSelfRevoke = patch.target === payload.iss && patch.role === "revoked";
+                    const isSelf = patch.target === payload.iss;
+                    const isSelfRevoke = isSelf && patch.role === "revoked";
                     const targetKey = this.aclLog.publicKeyAt(patch.target, payload.stamp);
-                    const isSelfKeyUpdate = patch.target === payload.iss &&
+                    const keyMismatch = Boolean(patch.publicKeyJwk) &&
+                        Boolean(targetKey) &&
+                        !jwkEquals(targetKey, patch.publicKeyJwk);
+                    const isSelfKeyUpdate = isSelf &&
                         patch.publicKeyJwk &&
                         patch.role === roleAt &&
-                        roleAt !== "revoked" &&
-                        (!targetKey || jwkEquals(targetKey, patch.publicKeyJwk));
-                    if (patch.publicKeyJwk &&
-                        targetKey &&
-                        !jwkEquals(targetKey, patch.publicKeyJwk)) {
+                        roleAt !== "revoked";
+                    if (keyMismatch && signerRole !== "actor")
                         continue;
-                    }
                     if (isSelfRevoke) {
                         if (signerRole === "actor") {
                             allowed = true;
@@ -1010,7 +1047,7 @@ export class Dacument {
                         if (this.canWriteAclTarget(signerRole, patch.role, patch.target, payload.stamp)) {
                             allowed = true;
                         }
-                        else if (isSelfKeyUpdate) {
+                        else if (isSelfKeyUpdate && !keyMismatch) {
                             allowed = true;
                         }
                     }
@@ -1021,7 +1058,7 @@ export class Dacument {
                 if (payload.kind === "ack") {
                     if (roleAt === "revoked")
                         continue;
-                    if (signerRole !== null)
+                    if (signerRole !== "actor")
                         continue;
                     allowed = true;
                 }
@@ -1065,8 +1102,11 @@ export class Dacument {
             return;
         const entry = this.aclLog.currentEntry(this.actorId);
         if (entry?.publicKeyJwk) {
-            this.actorKeyPublishPending = false;
-            return;
+            const actorInfo = Dacument.requireActorInfo();
+            if (jwkEquals(entry.publicKeyJwk, actorInfo.publicKeyJwk)) {
+                this.actorKeyPublishPending = false;
+                return;
+            }
         }
         if (this.actorKeyPublishPending)
             return;
@@ -1075,6 +1115,13 @@ export class Dacument {
         if (!entry)
             return;
         const actorInfo = Dacument.requireActorInfo();
+        const signerInfo = entry.publicKeyJwk
+            ? Dacument.actorInfoForPublicKey(entry.publicKeyJwk)
+            : actorInfo;
+        if (entry.publicKeyJwk && !signerInfo) {
+            this.emitError(new Error("Dacument: actor key mismatch; update requires current key material"));
+            return;
+        }
         const stamp = this.clock.next();
         const payload = {
             iss: this.actorId,
@@ -1091,19 +1138,37 @@ export class Dacument {
             },
         };
         this.actorKeyPublishPending = true;
-        this.queueActorOp(payload, () => {
-            this.actorKeyPublishPending = false;
+        this.queueActorOp(payload, {
+            signer: (signerInfo ?? actorInfo).privateKeyJwk,
+            onError: () => {
+                this.actorKeyPublishPending = false;
+            },
         });
     }
+    actorSignatureKey() {
+        const entry = this.aclLog.currentEntry(this.actorId);
+        if (!entry?.publicKeyJwk)
+            return null;
+        const actorInfo = Dacument.actorInfoForPublicKey(entry.publicKeyJwk);
+        return actorInfo?.privateKeyJwk ?? null;
+    }
     ack() {
         this.assertNotReset();
         const stamp = this.clock.next();
         const role = this.roleAt(this.actorId, stamp);
         if (role === "revoked")
             throw new Error("Dacument: revoked actors cannot acknowledge");
+        const entry = this.aclLog.currentEntry(this.actorId);
+        if (!entry?.publicKeyJwk)
+            return;
+        const actorInfo = Dacument.actorInfoForPublicKey(entry.publicKeyJwk);
+        if (!actorInfo) {
+            this.emitError(new Error("Dacument: actor key not available to sign ack"));
+            return;
+        }
         const seen = this.clock.current;
         this.ackByActor.set(this.actorId, seen);
-        this.queueLocalOp({
+        this.queueActorOp({
             iss: this.actorId,
             sub: this.docId,
             iat: nowSeconds(),
@@ -1111,7 +1176,7 @@ export class Dacument {
             kind: "ack",
             schema: this.schemaId,
             patch: { seen },
-        }, role);
+        }, { signer: actorInfo.privateKeyJwk });
     }
     scheduleAck() {
         if (this.ackScheduled)
@@ -1753,7 +1818,7 @@ export class Dacument {
         const shadow = this.shadowFor(field, state);
         const { patches, result } = this.capturePatches((listener) => shadow.onChange(listener), () => mutate(shadow));
         if (patches.length === 0)
-            return;
+            return result;
         this.queueLocalOp({
             iss: this.actorId,
             sub: this.docId,
@@ -1781,10 +1846,7 @@ export class Dacument {
     queueLocalOp(payload, role) {
         this.assertNotReset();
         if (payload.kind === "ack") {
-            const header = { alg: "none", typ: TOKEN_TYP };
-            const token = encodeToken(header, payload);
-            this.emitEvent("change", { type: "change", ops: [{ token }] });
-            return;
+            throw new Error("Dacument: ack ops must be actor-signed");
         }
         if (!roleNeedsKey(role))
             throw new Error(`Dacument: role '${role}' cannot sign ops`);
@@ -1793,30 +1855,34 @@ export class Dacument {
         const header = { alg: "ES256", typ: TOKEN_TYP, kid: `${payload.iss}:${role}` };
         const promise = signToken(this.roleKey, header, payload)
             .then(async (token) => {
-            const actorSig = await Dacument.signActorToken(token);
-            const op = { token, actorSig };
+            const actorSigKey = this.actorSignatureKey();
+            const actorSig = actorSigKey
+                ? await Dacument.signActorToken(token, actorSigKey)
+                : undefined;
+            const op = actorSig ? { token, actorSig } : { token };
             this.emitEvent("change", { type: "change", ops: [op] });
         })
             .catch((error) => this.emitError(error instanceof Error ? error : new Error(String(error))));
         this.pending.add(promise);
         promise.finally(() => this.pending.delete(promise));
     }
-    queueActorOp(payload, onError) {
+    queueActorOp(payload, options) {
         this.assertNotReset();
         const actorInfo = Dacument.requireActorInfo();
+        const signingKey = options?.signer ?? actorInfo.privateKeyJwk;
         const header = {
             alg: "ES256",
             typ: TOKEN_TYP,
             kid: `${payload.iss}:actor`,
         };
-        const promise = signToken(actorInfo.privateKeyJwk, header, payload)
+        const promise = signToken(signingKey, header, payload)
             .then(async (token) => {
-            const actorSig = await Dacument.signActorToken(token);
+            const actorSig = await Dacument.signActorToken(token, signingKey);
             const op = { token, actorSig };
             this.emitEvent("change", { type: "change", ops: [op] });
         })
             .catch((error) => {
-            onError?.();
+            options?.onError?.();
             this.emitError(error instanceof Error ? error : new Error(String(error)));
         });
         this.pending.add(promise);

package/dist/Dacument/types.d.ts

@@ -32,6 +32,10 @@ export type ActorInfo = {
     privateKeyJwk: JsonWebKey;
     publicKeyJwk: JsonWebKey;
 };
+export type ActorInfoUpdate = ActorInfo & {
+    currentPrivateKeyJwk?: JsonWebKey;
+    currentPublicKeyJwk?: JsonWebKey;
+};
 export type RegisterSchema<T extends JsTypeName = JsTypeName> = {
     crdt: "register";
     jsType: T;

package/dist/Dacument/types.js

@@ -2,8 +2,10 @@ export function isJsValue(value) {
     if (value === null)
         return true;
     const valueType = typeof value;
-    if (valueType === "string" || valueType === "number" || valueType === "boolean")
+    if (valueType === "string" || valueType === "boolean")
         return true;
+    if (valueType === "number")
+        return Number.isFinite(value);
     if (Array.isArray(value))
         return value.every(isJsValue);
     if (valueType === "object") {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dacument",
-  "version": "1.2.0",
-  "description": "Schema-driven CRDT document with signed ops, role-based ACLs, and optional per-actor verification.",
+  "version": "1.2.2",
+  "description": "Schema-driven CRDT document with signed ops, role-based ACLs, and per-actor auditability.",
   "keywords": [
     "crdt",
     "document",
@@ -52,7 +52,7 @@
   "dependencies": {
     "bytecodec": "^2.1.0",
     "uuid": "^13.0.0",
-    "zeyra": "^2.1.0"
+    "zeyra": "^2.2.0"
   },
   "devDependencies": {
     "@types/node": "^25.0.3",