mindoodb 0.0.78 → 0.0.80

package/dist/core/BaseMindooDB.js

@@ -7,6 +7,7 @@ exports.BaseMindooDB = exports.CUSTOM_DOC_ID_INITIAL_CHANGE_BYTES = void 0;
 const automerge_adapter_1 = require("./automerge-adapter");
 const values_1 = require("./values");
 const storeEntryTime_1 = require("./storeEntryTime");
+const changeAttribution_1 = require("./changeAttribution");
 const types_1 = require("./types");
 const types_2 = require("./types");
 const types_3 = require("./appendonlystores/types");
@@ -214,6 +215,14 @@ exports.CUSTOM_DOC_ID_INITIAL_CHANGE_BYTES = new Uint8Array([
 function getCustomIdInitialChangeBytes() {
     return exports.CUSTOM_DOC_ID_INITIAL_CHANGE_BYTES;
 }
+/**
+ * Whether a document's entries contain what it starts from: its `doc_create`, or a
+ * snapshot (the only entry a dense sync may transfer). Change entries alone do not
+ * make a document; they wait for their create (docs/accesscontrol.md §10).
+ */
+function hasDocumentOrigin(metadata) {
+    return metadata.some((entry) => entry.entryType === "doc_create" || entry.entryType === "doc_snapshot");
+}
 /**
  * BaseMindooDB is a platform-agnostic implementation of MindooDB
  * that works in both browser and server environments.
@@ -2725,7 +2734,7 @@ class BaseMindooDB {
             entry.entryType === "doc_delete" ||
             entry.entryType === "doc_undelete" ||
             entry.entryType === "doc_snapshot");
-        if (lifecycleEntries.length === 0) {
+        if (lifecycleEntries.length === 0 || !hasDocumentOrigin(lifecycleEntries)) {
             return null;
         }
         lifecycleEntries.sort((left, right) => left.createdAt !== right.createdAt
@@ -3280,7 +3289,24 @@ class BaseMindooDB {
                         // Before indexing, verify the user has the decryption key so that
                         // documents the user cannot access do not appear in getAllDocumentIds.
                         const representativeEntry = docLifecycleEntries[0];
-                        await this.tenant.ingestSealedFromEntries?.(representativeEntry.decryptionKeyId, docLifecycleEntries);
+                        // A sealed doc's wrap list rides only on its create and recipient
+                        // mutation entries, so an incremental batch of plain changes has
+                        // none. With a cold session cache (fresh session, warm start that
+                        // skipped reconcileKeyVisibility) the key must come from the doc's
+                        // full history, or the doc is wrongly flipped to "inaccessible"
+                        // and that state is persisted with the next cache flush.
+                        let fullDocMetadata;
+                        let sealedIngestEntries = docLifecycleEntries;
+                        if (!coldSync &&
+                            (0, sealedTypes_1.isSealedKeyId)(representativeEntry.decryptionKeyId) &&
+                            !(0, recipients_1.newestRecipientBlock)(docLifecycleEntries) &&
+                            !(await this.tenant.hasDecryptionKey(representativeEntry.decryptionKeyId))) {
+                            fullDocMetadata = await this.scanAllMetadata(this.store, {
+                                docId,
+                            });
+                            sealedIngestEntries = fullDocMetadata;
+                        }
+                        await this.tenant.ingestSealedFromEntries?.(representativeEntry.decryptionKeyId, sealedIngestEntries);
                         const keyAvailable = await this.tenant.hasDecryptionKey(representativeEntry.decryptionKeyId);
                         if (!keyAvailable) {
                             this.logger.debug(`Skipping metadata-first index for doc ${docId} — decryption key "${representativeEntry.decryptionKeyId}" not available`);
@@ -3305,7 +3331,16 @@ class BaseMindooDB {
                             // have recent entries, so re-scan that doc for prior lifecycle state.
                             const allDocMetadata = coldSync
                                 ? entryMetadataList
-                                : await this.scanAllMetadata(this.store, { docId });
+                                : (fullDocMetadata ??
+                                    (await this.scanAllMetadata(this.store, { docId })));
+                            if (!hasDocumentOrigin(allDocMetadata)) {
+                                // Changes whose create has not arrived (parallel transfer
+                                // batches) or never will (refused by the server's access
+                                // rules). Indexing them would list an id `getDocument` cannot
+                                // load; the create's arrival indexes the document then.
+                                this.logger.debug(`Skipping metadata-first index for doc ${docId} — no doc_create (or snapshot) yet`);
+                                return;
+                            }
                             const mutationEntries = allDocMetadata.filter((e) => this.isDocumentReplayEntry(e));
                             // Snapshots compact replay history but should not change the user-visible
                             // modification time when the original create/change/delete/undelete entries still exist.
@@ -4020,6 +4055,7 @@ class BaseMindooDB {
             }
             this.validateIdPrefixOption("createDocuments", options);
             this.validateAssumeUniqueIdOption("createDocuments", options);
+            (0, changeAttribution_1.encodeChangeAttribution)(options.attribution);
         }
         const results = new Array(inputs.length).fill(null);
         const prepared = [];
@@ -4046,7 +4082,7 @@ class BaseMindooDB {
                             for (const [key, value] of valueEntries) {
                                 data[key] = value;
                             }
-                        }, options.signingKeyPair, options.signingKeyPassword, options.bypassAccessControlPrecheck);
+                        }, options.signingKeyPair, options.signingKeyPassword, options.bypassAccessControlPrecheck, undefined, undefined, options.attribution);
                     }
                     results[index] = existingDoc;
                     continue;
@@ -4163,6 +4199,9 @@ class BaseMindooDB {
         // of concurrent same-id creates is then not a concern and the create can
         // follow the generated-ID path (initialValues baked into doc_create).
         const useDeterministicSeed = useCustomDocId && !options.assumeUniqueId;
+        // Validated before anything is written. The deterministic seed change of a
+        // convergent custom id is fixed bytes and cannot carry it.
+        const changeMessage = (0, changeAttribution_1.encodeChangeAttribution)(options.attribution);
         // Sanitize caller-provided initial values: internal/reserved fields (those
         // starting with "_", e.g. "_attachments") are managed by MindooDB and must
         // not be seeded by callers. `undefined` values are treated as "not set"
@@ -4210,7 +4249,7 @@ class BaseMindooDB {
             if (existing) {
                 if (existing.isDeleted) {
                     this.logger.debug(`Document ${docId} exists as a tombstone; undeleting existing custom-id document`);
-                    await this.undeleteDocInternal(docId, signingKeyPair, signingKeyPassword);
+                    await this.undeleteDocInternal(docId, signingKeyPair, signingKeyPassword, undefined, options.attribution);
                     const undeleted = await this.loadDocumentInternal(docId);
                     if (!undeleted || undeleted.isDeleted) {
                         throw new Error(`Document ${docId} could not be undeleted`);
@@ -4253,7 +4292,7 @@ class BaseMindooDB {
             this.logger.debug(`Creating initial Automerge change for document ${docId}`);
             const initialDoc = automerge_adapter_1.Automerge.init();
             try {
-                newDoc = automerge_adapter_1.Automerge.change(initialDoc, (doc) => {
+                newDoc = automerge_adapter_1.Automerge.change(initialDoc, changeMessage ? { message: changeMessage } : {}, (doc) => {
                     // Store metadata in the document payload
                     // We need to modify the document to ensure a change is created
                     doc._attachments = [];
@@ -4429,6 +4468,7 @@ class BaseMindooDB {
         // out of the deterministic seed, so initialValues fold into doc_create
         // and the document costs a single store entry.
         const useDeterministicSeed = useCustomDocId && !options.assumeUniqueId;
+        const changeMessage = (0, changeAttribution_1.encodeChangeAttribution)(options.attribution);
         if (useDeterministicSeed && options.recipients !== undefined) {
             throw new Error("createDocuments: recipients is not supported together with a convergent custom id; pass assumeUniqueId");
         }
@@ -4463,7 +4503,7 @@ class BaseMindooDB {
         }
         else {
             const initialDoc = automerge_adapter_1.Automerge.init();
-            seedDoc = automerge_adapter_1.Automerge.change(initialDoc, (doc) => {
+            seedDoc = automerge_adapter_1.Automerge.change(initialDoc, changeMessage ? { message: changeMessage } : {}, (doc) => {
                 doc._attachments = [];
                 if (sealedCreate) {
                     (0, recipients_1.applyEncryptForCreate)(doc, sealedCreate.encryptFor);
@@ -4487,7 +4527,7 @@ class BaseMindooDB {
         let finalDoc = seedDoc;
         let valueChangeBytes = null;
         if (useDeterministicSeed && initialValueEntries.length > 0) {
-            finalDoc = automerge_adapter_1.Automerge.change(seedDoc, { time: now }, (doc) => {
+            finalDoc = automerge_adapter_1.Automerge.change(seedDoc, { time: now, message: changeMessage }, (doc) => {
                 for (const [key, value] of initialValueEntries) {
                     this.assignHydrated(doc, key, value);
                 }
@@ -4923,12 +4963,14 @@ class BaseMindooDB {
                 };
                 // Wrap and yield (including lifecycle terminal entries)
                 const wrappedDoc = this.wrapDocument(internalDoc);
+                const attribution = this.attributionFromChangePayload(entryMetadata.entryType, decryptedPayload);
                 yield {
                     changeEntryId: entryMetadata.id,
                     doc: wrappedDoc,
                     changeCreatedAt: entryMetadata.createdAt,
                     changeCreatedByPublicKey: entryMetadata.createdByPublicKey,
                     changeDependencyIds: [...entryMetadata.dependencyIds],
+                    ...(attribution ? { attribution } : {}),
                 };
             }
         }
@@ -5393,6 +5435,40 @@ class BaseMindooDB {
             this.revisionFeedDocCache.delete(oldest);
         }
     }
+    /**
+     * The agent attribution carried by a document change payload (the Automerge
+     * change message), if any. Snapshots and undecodable payloads yield none.
+     */
+    attributionFromChangePayload(entryType, payload) {
+        if (entryType !== "doc_create" &&
+            entryType !== "doc_change" &&
+            entryType !== "doc_delete" &&
+            entryType !== "doc_undelete") {
+            return undefined;
+        }
+        try {
+            return (0, changeAttribution_1.decodeChangeAttribution)(automerge_adapter_1.Automerge.decodeChange(payload).message);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * Verify, decrypt and read the attribution of one stored entry. Entries with
+     * an invalid signature or a payload this replica cannot decrypt yield none.
+     */
+    async readStoreEntryAttribution(entry) {
+        try {
+            if (!(await this.tenant.verifyEntrySignature(entry, entry.encryptedData))) {
+                return undefined;
+            }
+            const payload = await this.tenant.decryptPayload(entry.encryptedData, entry.decryptionKeyId);
+            return this.attributionFromChangePayload(entry.entryType, payload);
+        }
+        catch {
+            return undefined;
+        }
+    }
     async getDocumentHistoryPage(docId, options) {
         const startedAt = Date.now();
         const limit = Math.max(1, Math.floor(options?.limit ?? 100));
@@ -5422,6 +5498,21 @@ class BaseMindooDB {
             // order for same-millisecond entries.
             isDeleted: this.computeIsDeletedFromMetadata(relevantEntries.slice(0, offset + sliceIndex + 1)),
         }));
+        if (options?.includeAttribution && slice.length > 0) {
+            // Opt-in: costs one load + signature check + decrypt per returned entry,
+            // still bounded by the page size.
+            await this.ingestSealedKeyFromEntries(slice);
+            const loaded = await this.store.getEntries(slice.map((entry) => entry.id));
+            const loadedById = new Map(loaded.map((entry) => [entry.id, entry]));
+            for (const pageEntry of entries) {
+                const stored = loadedById.get(pageEntry.entryId);
+                const attribution = stored
+                    ? await this.readStoreEntryAttribution(stored)
+                    : undefined;
+                if (attribution)
+                    pageEntry.attribution = attribution;
+            }
+        }
         const nextOffset = offset + entries.length;
         const hasMore = nextOffset < relevantEntries.length;
         const result = {
@@ -7112,7 +7203,7 @@ class BaseMindooDB {
         return docIds;
     }
     async deleteDocument(docId, options = {}) {
-        return this.deleteDocInternal(docId, options.signingKeyPair, options.signingKeyPassword, options.bypassAccessControlPrecheck);
+        return this.deleteDocInternal(docId, options.signingKeyPair, options.signingKeyPassword, options.bypassAccessControlPrecheck, options.attribution);
     }
     /**
      * Bulk-delete documents in a single append-only store write.
@@ -7133,6 +7224,7 @@ class BaseMindooDB {
         if (docIds.length === 0) {
             return;
         }
+        const changeMessage = (0, changeAttribution_1.encodeChangeAttribution)(options.attribution);
         // One gate call per document id: inside `userdirectory` the applicable rule
         // depends on the id (personal documents are owned by their creator), so a
         // single batch-wide check would deny an owner deleting their own data.
@@ -7169,7 +7261,7 @@ class BaseMindooDB {
                     this.logger.debug(`Skipping bulk delete for ${docId} — not found or already deleted`);
                     continue;
                 }
-                preparedByIndex[index] = await this.prepareLifecycleEntry(internalDoc, "doc_delete", options.signingKeyPair, options.signingKeyPassword, options.bypassAccessControlPrecheck);
+                preparedByIndex[index] = await this.prepareLifecycleEntry(internalDoc, "doc_delete", options.signingKeyPair, options.signingKeyPassword, options.bypassAccessControlPrecheck, changeMessage);
             }
         }));
         const prepared = preparedByIndex.filter((p) => p !== null);
@@ -7189,7 +7281,7 @@ class BaseMindooDB {
         return this.deleteDocument(docId, { signingKeyPair, signingKeyPassword });
     }
     async undeleteDocument(docId, options = {}) {
-        return this.undeleteDocInternal(docId, options.signingKeyPair, options.signingKeyPassword, options.bypassAccessControlPrecheck);
+        return this.undeleteDocInternal(docId, options.signingKeyPair, options.signingKeyPassword, options.bypassAccessControlPrecheck, options.attribution);
     }
     async assertLifecycleMutationAllowed(op, signingKeyPair, signingKeyPassword, documentUsernameHash, docId) {
         this.assertWritable("document lifecycle mutation");
@@ -7207,8 +7299,8 @@ class BaseMindooDB {
      * change that advances `_lastModified`, wraps it in the requested lifecycle
      * StoreEntry type, signs/encrypts it, and updates local caches/indexes.
      */
-    async writeLifecycleEntry(internalDoc, entryType, signingKeyPair, signingKeyPassword, bypassPrecheck) {
-        const prepared = await this.prepareLifecycleEntry(internalDoc, entryType, signingKeyPair, signingKeyPassword, bypassPrecheck);
+    async writeLifecycleEntry(internalDoc, entryType, signingKeyPair, signingKeyPassword, bypassPrecheck, attribution) {
+        const prepared = await this.prepareLifecycleEntry(internalDoc, entryType, signingKeyPair, signingKeyPassword, bypassPrecheck, (0, changeAttribution_1.encodeChangeAttribution)(attribution));
         await this.putLocalEntries([prepared.fullEntry]);
         await this.applyLifecycleEntryLocally(prepared, { markDirty: true });
     }
@@ -7218,7 +7310,7 @@ class BaseMindooDB {
      * returned `fullEntry` (single or batched `putEntries`) and then call
      * {@link applyLifecycleEntryLocally} to update caches and indexes.
      */
-    async prepareLifecycleEntry(internalDoc, entryType, signingKeyPair, signingKeyPassword, bypassPrecheck) {
+    async prepareLifecycleEntry(internalDoc, entryType, signingKeyPair, signingKeyPassword, bypassPrecheck, changeMessage) {
         // Delete and undelete are encoded as normal Automerge changes so the DAG
         // keeps causal ancestry, while the StoreEntry type carries lifecycle intent.
         const useCustomSigningKey = signingKeyPair !== undefined && signingKeyPassword !== undefined;
@@ -7238,7 +7330,7 @@ class BaseMindooDB {
         // `emptyChange`, which always advances the heads with a fresh hash while
         // keeping causal ancestry intact.
         const headsBefore = automerge_adapter_1.Automerge.getHeads(internalDoc.doc);
-        let newDoc = this.runChangeWithOutdatedDocRecovery(internalDoc, (doc) => automerge_adapter_1.Automerge.change(doc, { time: now }, (mutableDoc) => {
+        let newDoc = this.runChangeWithOutdatedDocRecovery(internalDoc, (doc) => automerge_adapter_1.Automerge.change(doc, { time: now, message: changeMessage }, (mutableDoc) => {
             if (!Array.isArray(mutableDoc._attachments)) {
                 mutableDoc._attachments = [];
             }
@@ -7247,6 +7339,7 @@ class BaseMindooDB {
         if (automerge_adapter_1.Automerge.getHeads(newDoc).every((head) => headsBefore.includes(head))) {
             newDoc = automerge_adapter_1.Automerge.emptyChange(newDoc, {
                 time: now,
+                message: changeMessage,
             });
         }
         const changeBytes = automerge_adapter_1.Automerge.getLastLocalChange(newDoc);
@@ -7373,7 +7466,8 @@ class BaseMindooDB {
      * Handles both regular deletion (signed by current user) and
      * deletion with a custom signing key (e.g., for directory operations).
      */
-    async deleteDocInternal(docId, signingKeyPair, signingKeyPassword, bypassPrecheck) {
+    async deleteDocInternal(docId, signingKeyPair, signingKeyPassword, bypassPrecheck, attribution) {
+        (0, changeAttribution_1.encodeChangeAttribution)(attribution);
         const useCustomSigningKey = signingKeyPair !== undefined && signingKeyPassword !== undefined;
         this.logger.debug(`Deleting document ${docId}${useCustomSigningKey ? " using custom signing key" : ""}`);
         await this.assertLifecycleMutationAllowed("doc_delete", signingKeyPair, signingKeyPassword, undefined, docId);
@@ -7382,10 +7476,11 @@ class BaseMindooDB {
         if (!internalDoc || internalDoc.isDeleted) {
             throw new Error(`Document ${docId} not found or already deleted`);
         }
-        await this.writeLifecycleEntry(internalDoc, "doc_delete", signingKeyPair, signingKeyPassword, bypassPrecheck);
+        await this.writeLifecycleEntry(internalDoc, "doc_delete", signingKeyPair, signingKeyPassword, bypassPrecheck, attribution);
         this.logger.info(`Document ${docId} deleted successfully`);
     }
-    async undeleteDocInternal(docId, signingKeyPair, signingKeyPassword, bypassPrecheck) {
+    async undeleteDocInternal(docId, signingKeyPair, signingKeyPassword, bypassPrecheck, attribution) {
+        (0, changeAttribution_1.encodeChangeAttribution)(attribution);
         const useCustomSigningKey = signingKeyPair !== undefined && signingKeyPassword !== undefined;
         this.logger.debug(`Undeleting document ${docId}${useCustomSigningKey ? " using custom signing key" : ""}`);
         const internalDoc = await this.loadDocumentInternal(docId);
@@ -7397,11 +7492,11 @@ class BaseMindooDB {
             this.logger.debug(`Document ${docId} is already alive; undelete is a no-op`);
             return;
         }
-        await this.writeLifecycleEntry(internalDoc, "doc_undelete", signingKeyPair, signingKeyPassword, bypassPrecheck);
+        await this.writeLifecycleEntry(internalDoc, "doc_undelete", signingKeyPair, signingKeyPassword, bypassPrecheck, attribution);
         this.logger.info(`Document ${docId} undeleted successfully`);
     }
     async changeDoc(doc, changeFunc, options = {}) {
-        return this.changeDocInternal(doc, changeFunc, options.signingKeyPair, options.signingKeyPassword, options.bypassAccessControlPrecheck);
+        return this.changeDocInternal(doc, changeFunc, options.signingKeyPair, options.signingKeyPassword, options.bypassAccessControlPrecheck, undefined, undefined, options.attribution);
     }
     async changeDocWithSigningKey(doc, changeFunc, signingKeyPair, signingKeyPassword) {
         return this.changeDoc(doc, changeFunc, {
@@ -7409,8 +7504,9 @@ class BaseMindooDB {
             signingKeyPassword,
         });
     }
-    async applyTextPatch(doc, patch) {
+    async applyTextPatch(doc, patch, options = {}) {
         this.assertWritable("applyTextPatch");
+        const changeMessage = (0, changeAttribution_1.encodeChangeAttribution)(options.attribution);
         const docId = doc.getId();
         this.logger.debug(`===== applyTextPatch called for document ${docId} =====`);
         let internalDoc = this.getCachedDocument(docId);
@@ -7439,10 +7535,10 @@ class BaseMindooDB {
         try {
             newDoc = this.runChangeWithOutdatedDocRecovery(internalDoc, (doc) => {
                 if (baseHeads && baseHeads.length > 0) {
-                    const result = automerge_adapter_1.Automerge.changeAt(doc, baseHeads, applyEdits);
+                    const result = automerge_adapter_1.Automerge.changeAt(doc, baseHeads, { message: changeMessage }, applyEdits);
                     return result.newDoc;
                 }
-                return automerge_adapter_1.Automerge.change(doc, applyEdits);
+                return automerge_adapter_1.Automerge.change(doc, { message: changeMessage }, applyEdits);
             });
             if (this.isDebugEnabled())
                 this.logger.debug(`Successfully applied text patch, new document heads: ${JSON.stringify(automerge_adapter_1.Automerge.getHeads(newDoc))}`);
@@ -7466,8 +7562,9 @@ class BaseMindooDB {
             data: wrapped.getData(),
         };
     }
-    async applyRichTextPatch(doc, patch) {
+    async applyRichTextPatch(doc, patch, options = {}) {
         this.assertWritable("applyRichTextPatch");
+        const changeMessage = (0, changeAttribution_1.encodeChangeAttribution)(options.attribution);
         const docId = doc.getId();
         this.logger.debug(`===== applyRichTextPatch called for document ${docId} =====`);
         let internalDoc = this.getCachedDocument(docId);
@@ -7507,9 +7604,9 @@ class BaseMindooDB {
         try {
             newDoc = this.runChangeWithOutdatedDocRecovery(internalDoc, (doc) => {
                 if (patch.baseHeads && patch.baseHeads.length > 0) {
-                    return this.changeOnForkAt(doc, patch.baseHeads, applySpans);
+                    return this.changeOnForkAt(doc, patch.baseHeads, applySpans, changeMessage);
                 }
-                return automerge_adapter_1.Automerge.change(doc, applySpans);
+                return automerge_adapter_1.Automerge.change(doc, { message: changeMessage }, applySpans);
             });
             if (this.isDebugEnabled())
                 this.logger.debug(`Successfully applied rich-text patch, new document heads: ${JSON.stringify(automerge_adapter_1.Automerge.getHeads(newDoc))}`);
@@ -7533,8 +7630,9 @@ class BaseMindooDB {
             data: wrapped.getData(),
         };
     }
-    async applyDocumentUpdate(doc, update) {
+    async applyDocumentUpdate(doc, update, options = {}) {
         this.assertWritable("applyDocumentUpdate");
+        const changeMessage = (0, changeAttribution_1.encodeChangeAttribution)(options.attribution);
         const docId = doc.getId();
         let internalDoc = this.getCachedDocument(docId);
         if (!internalDoc) {
@@ -7587,8 +7685,8 @@ class BaseMindooDB {
         let newDoc;
         try {
             newDoc = this.runChangeWithOutdatedDocRecovery(internalDoc, (current) => baseHeads
-                ? this.changeOnForkAt(current, baseHeads, applyAll)
-                : automerge_adapter_1.Automerge.change(current, applyAll));
+                ? this.changeOnForkAt(current, baseHeads, applyAll, changeMessage)
+                : automerge_adapter_1.Automerge.change(current, { message: changeMessage }, applyAll));
         }
         catch (error) {
             this.logger.error(`Error applying document update for document ${docId}:`, error);
@@ -7647,8 +7745,9 @@ class BaseMindooDB {
             }
         }
     }
-    async applyRichTextStepsPatch(doc, patch) {
+    async applyRichTextStepsPatch(doc, patch, options = {}) {
         this.assertWritable("applyRichTextStepsPatch");
+        const changeMessage = (0, changeAttribution_1.encodeChangeAttribution)(options.attribution);
         const docId = doc.getId();
         this.logger.debug(`===== applyRichTextStepsPatch called for document ${docId} =====`);
         let internalDoc = this.getCachedDocument(docId);
@@ -7700,10 +7799,10 @@ class BaseMindooDB {
         try {
             newDoc = this.runChangeWithOutdatedDocRecovery(internalDoc, (doc) => {
                 if (patch.baseHeads && patch.baseHeads.length > 0) {
-                    const result = automerge_adapter_1.Automerge.changeAt(doc, patch.baseHeads, applySteps);
+                    const result = automerge_adapter_1.Automerge.changeAt(doc, patch.baseHeads, { message: changeMessage }, applySteps);
                     return result.newDoc;
                 }
-                return automerge_adapter_1.Automerge.change(doc, applySteps);
+                return automerge_adapter_1.Automerge.change(doc, { message: changeMessage }, applySteps);
             });
             if (this.isDebugEnabled())
                 this.logger.debug(`Successfully applied rich-text steps, new document heads: ${JSON.stringify(automerge_adapter_1.Automerge.getHeads(newDoc))}`);
@@ -7943,8 +8042,9 @@ class BaseMindooDB {
         }
         return internalDoc;
     }
-    async applyJsonPatch(doc, patch) {
+    async applyJsonPatch(doc, patch, options = {}) {
         this.assertWritable("applyJsonPatch");
+        const changeMessage = (0, changeAttribution_1.encodeChangeAttribution)(options.attribution);
         const docId = doc.getId();
         this.logger.debug(`===== applyJsonPatch called for document ${docId} =====`);
         let internalDoc = this.getCachedDocument(docId);
@@ -7969,10 +8069,10 @@ class BaseMindooDB {
         try {
             newDoc = this.runChangeWithOutdatedDocRecovery(internalDoc, (doc) => {
                 if (patch.baseHeads && patch.baseHeads.length > 0) {
-                    const result = automerge_adapter_1.Automerge.changeAt(doc, patch.baseHeads, applyPatch);
+                    const result = automerge_adapter_1.Automerge.changeAt(doc, patch.baseHeads, { message: changeMessage }, applyPatch);
                     return result.newDoc;
                 }
-                return automerge_adapter_1.Automerge.change(doc, applyPatch);
+                return automerge_adapter_1.Automerge.change(doc, { message: changeMessage }, applyPatch);
             });
             if (this.isDebugEnabled())
                 this.logger.debug(`Successfully applied JSON patch, new document heads: ${JSON.stringify(automerge_adapter_1.Automerge.getHeads(newDoc))}`);
@@ -7996,8 +8096,9 @@ class BaseMindooDB {
             data: wrapped.getData(),
         };
     }
-    async changeDocInternal(doc, changeFunc, signingKeyPair, signingKeyPassword, bypassPrecheck, restoredAttachments = [], internalMutation) {
+    async changeDocInternal(doc, changeFunc, signingKeyPair, signingKeyPassword, bypassPrecheck, restoredAttachments = [], internalMutation, attribution) {
         this.assertWritable("changeDoc");
+        const changeMessage = (0, changeAttribution_1.encodeChangeAttribution)(attribution);
         const docId = doc.getId();
         if ((signingKeyPair !== undefined) !== (signingKeyPassword !== undefined)) {
             throw new Error("changeDoc: signingKeyPair and signingKeyPassword must be provided together");
@@ -8292,7 +8393,7 @@ class BaseMindooDB {
         const headsBeforeChange = automerge_adapter_1.Automerge.getHeads(internalDoc.doc);
         let newDoc;
         try {
-            newDoc = this.runChangeWithOutdatedDocRecovery(internalDoc, (doc) => automerge_adapter_1.Automerge.change(doc, (automergeDoc) => {
+            newDoc = this.runChangeWithOutdatedDocRecovery(internalDoc, (doc) => automerge_adapter_1.Automerge.change(doc, { message: changeMessage }, (automergeDoc) => {
                 // Apply all pending changes (sets/updates)
                 for (const [key, value] of pendingChanges) {
                     this.assignHydrated(automergeDoc, key, this.hydrateTypedValues(value));
@@ -9079,17 +9180,17 @@ class BaseMindooDB {
      * after `baseHeads` (its next sequence number is taken then); in that case a
      * fresh actor writes the one change.
      */
-    changeOnForkAt(doc, baseHeads, apply) {
+    changeOnForkAt(doc, baseHeads, apply, changeMessage) {
         const current = automerge_adapter_1.Automerge.getHeads(doc);
         if (current.length === baseHeads.length &&
             current.every((head) => baseHeads.includes(head))) {
-            return automerge_adapter_1.Automerge.change(doc, apply);
+            return automerge_adapter_1.Automerge.change(doc, { message: changeMessage }, apply);
         }
         const base = automerge_adapter_1.Automerge.view(doc, baseHeads);
         const actor = automerge_adapter_1.Automerge.getActorId(doc);
         const ownChangeSince = automerge_adapter_1.Automerge.getChanges(base, doc).some((change) => automerge_adapter_1.Automerge.decodeChange(change).actor === actor);
         const fork = automerge_adapter_1.Automerge.clone(base, ownChangeSince ? undefined : { actor });
-        const changed = automerge_adapter_1.Automerge.change(fork, apply);
+        const changed = automerge_adapter_1.Automerge.change(fork, { message: changeMessage }, apply);
         return automerge_adapter_1.Automerge.merge(doc, changed);
     }
     runChangeWithOutdatedDocRecovery(internalDoc, apply) {
@@ -9840,6 +9941,7 @@ class BaseMindooDB {
             message: typeof decodedChange.message === "string"
                 ? decodedChange.message
                 : null,
+            attribution: (0, changeAttribution_1.decodeChangeAttribution)(typeof decodedChange.message === "string" ? decodedChange.message : null),
             dependencyHashes: Array.isArray(decodedChange.deps)
                 ? decodedChange.deps.filter((dep) => typeof dep === "string")
                 : [],
@@ -11044,6 +11146,7 @@ class BaseMindooDB {
     }
     async mutateRecipients(doc, mode, specs, options) {
         this.assertWritable("changeDoc");
+        const changeMessage = (0, changeAttribution_1.encodeChangeAttribution)(options?.attribution);
         if (!(0, sealedTypes_1.isSealedKeyId)(doc.getDecryptionKeyId())) {
             throw new Error("Recipient mutators require a document created with `recipients`");
         }
@@ -11161,7 +11264,7 @@ class BaseMindooDB {
         });
         tenant.rememberSealedGenerations(internalDoc.decryptionKeyId, generations);
         const headsBeforeChange = automerge_adapter_1.Automerge.getHeads(internalDoc.doc);
-        const newDoc = automerge_adapter_1.Automerge.change(internalDoc.doc, (draft) => {
+        const newDoc = automerge_adapter_1.Automerge.change(internalDoc.doc, { message: changeMessage }, (draft) => {
             if (addedTargets.length > 0) {
                 const addMap = {};
                 for (const target of addedTargets) {
@@ -11201,6 +11304,7 @@ class BaseMindooDB {
                 signingKeyPair: options.signingKeyPair,
                 signingKeyPassword: options.signingKeyPassword,
                 bypassAccessControlPrecheck: options.bypassAccessControlPrecheck,
+                attribution: options.attribution,
             });
         }
         const wrapped = this.wrapDocument(internalDoc);