@hraness/oh 0.3.1 → 0.4.0

package/dist/index.js

@@ -1,4 +1,7 @@
 // @bun
+// src/sync.ts
+import { isProxy } from "util/types";
+
 // src/canonical.ts
 import { createHash, randomBytes } from "crypto";
 
@@ -197,7 +200,7 @@ var OH_GRAPH_LIMITS_V1 = Object.freeze({
   recordBytes: 1024 * 1024,
   recordsPerSnapshot: 65536
 });
-var OH_KNOWLEDGE_GRAPH_RECORD_KINDS_V1 = [
+var OH_KNOWLEDGE_GRAPH_RECORD_KINDS_V1 = Object.freeze([
   "activity",
   "assertion",
   "context",
@@ -216,7 +219,7 @@ var OH_KNOWLEDGE_GRAPH_RECORD_KINDS_V1 = [
   "type-membership",
   "view",
   "vocabulary"
-];
+]);
 var KNOWLEDGE_GRAPH_RECORD_KEYS_V1 = [
   "dependencies",
   "key",
@@ -1142,6 +1145,142 @@ class OhRecordCodecRegistry {
   }
 }
 
+// src/errors.ts
+var OH_OPERATION_SIZE_ERROR_CODE_V1 = "oh.operation-size.v1";
+var OH_CONFLICT_ERROR_BRAND_V1 = Symbol.for("@hraness/oh/OhConflictError/v1");
+var OH_DEPENDENCY_ERROR_BRAND_V1 = Symbol.for("@hraness/oh/OhDependencyError/v1");
+var OH_INTEGRITY_ERROR_BRAND_V1 = Symbol.for("@hraness/oh/OhIntegrityError/v1");
+var OH_OPERATION_SIZE_ERROR_BRAND_V1 = Symbol.for("@hraness/oh/OhOperationSizeError/v1");
+var OH_PROFILE_ERROR_BRAND_V1 = Symbol.for("@hraness/oh/OhProfileError/v1");
+function immutableOwnValue(value, key) {
+  const descriptor = Object.getOwnPropertyDescriptor(value, key);
+  return descriptor !== undefined && descriptor.get === undefined && descriptor.set === undefined && descriptor.configurable === false && descriptor.writable === false ? descriptor.value : undefined;
+}
+function brandNativeError(value, brand) {
+  Object.defineProperty(value, brand, {
+    configurable: false,
+    enumerable: false,
+    value: true,
+    writable: false
+  });
+}
+function hasNativeErrorBrand(value, brand) {
+  try {
+    return Error.isError(value) && immutableOwnValue(value, brand) === true;
+  } catch {
+    return false;
+  }
+}
+function hasNativeSubclassInstance(constructor, value) {
+  return Function.prototype[Symbol.hasInstance].call(constructor, value);
+}
+function isOhConflictError(value) {
+  return hasNativeErrorBrand(value, OH_CONFLICT_ERROR_BRAND_V1);
+}
+
+class OhConflictError extends Error {
+  static [Symbol.hasInstance](value) {
+    return this === OhConflictError ? isOhConflictError(value) : hasNativeSubclassInstance(this, value);
+  }
+  constructor(message) {
+    super(message);
+    this.name = "OhConflictError";
+    brandNativeError(this, OH_CONFLICT_ERROR_BRAND_V1);
+  }
+}
+function isOhIntegrityError(value) {
+  return hasNativeErrorBrand(value, OH_INTEGRITY_ERROR_BRAND_V1);
+}
+
+class OhIntegrityError extends Error {
+  static [Symbol.hasInstance](value) {
+    return this === OhIntegrityError ? isOhIntegrityError(value) : hasNativeSubclassInstance(this, value);
+  }
+  constructor(message) {
+    super(message);
+    this.name = "OhIntegrityError";
+    brandNativeError(this, OH_INTEGRITY_ERROR_BRAND_V1);
+  }
+}
+function isOhDependencyError(value) {
+  return hasNativeErrorBrand(value, OH_DEPENDENCY_ERROR_BRAND_V1);
+}
+
+class OhDependencyError extends Error {
+  static [Symbol.hasInstance](value) {
+    return this === OhDependencyError ? isOhDependencyError(value) : hasNativeSubclassInstance(this, value);
+  }
+  constructor(message) {
+    super(message);
+    this.name = "OhDependencyError";
+    brandNativeError(this, OH_DEPENDENCY_ERROR_BRAND_V1);
+  }
+}
+function isOhProfileError(value) {
+  return hasNativeErrorBrand(value, OH_PROFILE_ERROR_BRAND_V1);
+}
+
+class OhProfileError extends Error {
+  static [Symbol.hasInstance](value) {
+    return this === OhProfileError ? isOhProfileError(value) : hasNativeSubclassInstance(this, value);
+  }
+  constructor(message) {
+    super(message);
+    this.name = "OhProfileError";
+    brandNativeError(this, OH_PROFILE_ERROR_BRAND_V1);
+  }
+}
+function isOhOperationSizeError(value) {
+  try {
+    if (!Error.isError(value) || !(value instanceof RangeError))
+      return false;
+    const operationBytes = immutableOwnValue(value, "operationBytes");
+    const maximumOperationBytes = immutableOwnValue(value, "maximumOperationBytes");
+    return immutableOwnValue(value, OH_OPERATION_SIZE_ERROR_BRAND_V1) === true && immutableOwnValue(value, "code") === OH_OPERATION_SIZE_ERROR_CODE_V1 && Number.isSafeInteger(operationBytes) && operationBytes > 0 && Number.isSafeInteger(maximumOperationBytes) && maximumOperationBytes > 0 && operationBytes > maximumOperationBytes;
+  } catch {
+    return false;
+  }
+}
+
+class OhOperationSizeError extends RangeError {
+  static [Symbol.hasInstance](value) {
+    return this === OhOperationSizeError ? isOhOperationSizeError(value) : hasNativeSubclassInstance(this, value);
+  }
+  constructor(operationBytes, maximumOperationBytes) {
+    if (!Number.isSafeInteger(operationBytes) || operationBytes < 1 || !Number.isSafeInteger(maximumOperationBytes) || maximumOperationBytes < 1 || operationBytes <= maximumOperationBytes) {
+      throw new TypeError("Invalid Oh operation size refusal.");
+    }
+    super(`The ${operationBytes}-byte operation exceeds the host-declared ${maximumOperationBytes}-byte canonical bound.`);
+    this.name = "OhOperationSizeError";
+    Object.defineProperties(this, {
+      [OH_OPERATION_SIZE_ERROR_BRAND_V1]: {
+        configurable: false,
+        enumerable: false,
+        value: true,
+        writable: false
+      },
+      code: {
+        configurable: false,
+        enumerable: true,
+        value: OH_OPERATION_SIZE_ERROR_CODE_V1,
+        writable: false
+      },
+      maximumOperationBytes: {
+        configurable: false,
+        enumerable: true,
+        value: maximumOperationBytes,
+        writable: false
+      },
+      operationBytes: {
+        configurable: false,
+        enumerable: true,
+        value: operationBytes,
+        writable: false
+      }
+    });
+  }
+}
+
 // src/operation.ts
 var OH_OPERATION_MAX_BYTES_V1 = 64 * 1024 * 1024;
 function parsePayload(value) {
@@ -1189,13 +1328,18 @@ function parsePayload(value) {
     v: 1
   } : null;
 }
-function createOhOperationV1(input) {
+function createOhOperationV1(input, options = {}) {
+  const maximumOperationBytes = options.maximumOperationBytes ?? OH_OPERATION_MAX_BYTES_V1;
+  if (!Number.isSafeInteger(maximumOperationBytes) || maximumOperationBytes < 1 || maximumOperationBytes > OH_OPERATION_MAX_BYTES_V1) {
+    throw new TypeError("Invalid Oh operation byte bound.");
+  }
   const payload = parsePayload(input);
   if (payload === null)
     throw new TypeError("Invalid Oh operation payload.");
   const operation = { ...payload, operationSha256: canonicalSha256(payload) };
-  if (Buffer.byteLength(canonicalJson(operation), "utf8") > OH_OPERATION_MAX_BYTES_V1) {
-    throw new RangeError("Oh operation exceeds its canonical byte limit.");
+  const operationBytes = Buffer.byteLength(canonicalJson(operation), "utf8");
+  if (operationBytes > maximumOperationBytes) {
+    throw new OhOperationSizeError(operationBytes, maximumOperationBytes);
   }
   return operation;
 }
@@ -1210,18 +1354,362 @@ function parseOhOperationV1(value) {
 
 // src/sync.ts
 var OH_SYNC_PROTOCOL_V1 = "oh.sync.v1";
-function createOhSyncBundleV1(spaceId, operations) {
-  const parsedSpaceId = safeCode(spaceId);
-  if (parsedSpaceId === null || operations.length > 1000)
-    throw new TypeError("Invalid sync bundle.");
+var OH_SYNC_BUNDLE_MAX_OPERATIONS_V1 = 1000;
+var OH_SYNC_BUNDLE_KEYS_V1 = [
+  "bundleSha256",
+  "contractSha256",
+  "operations",
+  "protocol",
+  "spaceId",
+  "v"
+];
+var OH_SYNC_HEAD_KEYS_V1 = ["operationSha256", "sequence", "v"];
+var OH_SYNC_HEAD_REF_KEYS_V1 = ["operationSha256", "sequence"];
+var OH_OPERATION_KEYS_V1 = [
+  "actorId",
+  "changes",
+  "contractId",
+  "graphRevisionSha256",
+  "instant",
+  "operationId",
+  "operationSha256",
+  "parentOperationSha256",
+  "recordsSha256",
+  "sequence",
+  "spaceId",
+  "v"
+];
+var OH_PUT_CHANGE_KEYS_V1 = ["kind", "record", "v"];
+var OH_TOMBSTONE_CHANGE_KEYS_V1 = ["key", "kind", "priorSha256", "v"];
+var OH_RECORD_KEYS_V1 = ["dependencies", "key", "kind", "recordSha256", "v", "value"];
+var OH_SYNC_INGRESS_VALUE_DEPTH_V1 = 128;
+var OH_SYNC_INGRESS_VALUE_NODES_V1 = OH_GRAPH_LIMITS_V1.recordBytes;
+var OH_SYNC_INGRESS_OPERATION_DEPTH_V1 = OH_SYNC_INGRESS_VALUE_DEPTH_V1 + 4;
+var OH_SYNC_INGRESS_OPERATION_NODES_V1 = OH_OPERATION_MAX_BYTES_V1;
+var OH_SYNC_BUNDLE_MAX_BYTES_V1 = OH_OPERATION_MAX_BYTES_V1 + 4 * 1024;
+var OH_SYNC_INGRESS_BUNDLE_NODES_V1 = OH_SYNC_INGRESS_OPERATION_NODES_V1 + 4 * 1024;
+function exactDataRecordV1(value, expectedKeys) {
+  try {
+    if (typeof value !== "object" || value === null || Array.isArray(value) || isProxy(value))
+      return null;
+    const prototype = Object.getPrototypeOf(value);
+    const keys = Reflect.ownKeys(value);
+    if (prototype !== Object.prototype && prototype !== null || keys.length !== expectedKeys.length || keys.some((key) => typeof key !== "string") || expectedKeys.some((key) => !keys.includes(key)))
+      return null;
+    const detached = Object.create(null);
+    for (const key of expectedKeys) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (descriptor === undefined || !descriptor.enumerable || descriptor.get !== undefined || descriptor.set !== undefined)
+        return null;
+      Object.defineProperty(detached, key, {
+        configurable: false,
+        enumerable: true,
+        value: descriptor.value,
+        writable: false
+      });
+    }
+    return detached;
+  } catch {
+    return null;
+  }
+}
+function exactDataArrayV1(value, maximumLength, clone = true) {
+  try {
+    if (typeof value !== "object" || value === null || isProxy(value) || !Array.isArray(value))
+      return null;
+    const lengthDescriptor = Object.getOwnPropertyDescriptor(value, "length");
+    const length = lengthDescriptor?.value;
+    if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0 || length > maximumLength)
+      return null;
+    const keys = Reflect.ownKeys(value);
+    if (keys.length !== length + 1 || !keys.includes("length") || keys.some((key) => key !== "length" && (typeof key !== "string" || !/^(?:0|[1-9][0-9]*)$/u.test(key) || Number(key) >= length)))
+      return null;
+    const detached = clone ? [] : null;
+    for (let index = 0;index < length; index += 1) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+      if (descriptor === undefined || !descriptor.enumerable || descriptor.get !== undefined || descriptor.set !== undefined)
+        return null;
+      detached?.push(descriptor.value);
+    }
+    return detached ?? value;
+  } catch {
+    return null;
+  }
+}
+function stagedSyncOperationV1(value, bundleBudget) {
+  const operation = exactDataRecordV1(value, OH_OPERATION_KEYS_V1);
+  if (operation === null || operation.v !== 1 || operation.contractId !== OH_CONTRACT_ID_V1 || safeCode(operation.actorId) === null || safeCode(operation.operationId) === null || safeCode(operation.spaceId) === null || parseCanonicalInstantV1(operation.instant) === null || parseSha256Hex(operation.operationSha256) === null || parseSha256Hex(operation.graphRevisionSha256) === null || parseSha256Hex(operation.recordsSha256) === null)
+    return null;
+  const parentOperationSha256 = operation.parentOperationSha256 === null ? null : parseSha256Hex(operation.parentOperationSha256);
+  const sequence = Number.isSafeInteger(operation.sequence) && operation.sequence > 0 ? operation.sequence : null;
+  if (sequence === null || operation.parentOperationSha256 !== null && parentOperationSha256 === null || sequence === 1 !== (parentOperationSha256 === null))
+    return null;
+  const changes = exactDataArrayV1(operation.changes, OH_GRAPH_LIMITS_V1.changesPerOperation, false);
+  if (changes === null || changes.length === 0)
+    return null;
+  const aggregateDataBudget = {
+    bytes: 0,
+    maximumBytes: OH_OPERATION_MAX_BYTES_V1,
+    maximumNodes: OH_SYNC_INGRESS_OPERATION_NODES_V1,
+    nodes: 0
+  };
+  for (const change of changes) {
+    const put = exactDataRecordV1(change, OH_PUT_CHANGE_KEYS_V1);
+    if (put !== null && put.kind === "put" && put.v === 1) {
+      const record = exactDataRecordV1(put.record, OH_RECORD_KEYS_V1);
+      if (record === null)
+        return null;
+      const valuePreflight = preflightSyncIngressValueV1(record.value, aggregateDataBudget);
+      const dependenciesPreflight = preflightSyncIngressDependenciesV1(record.dependencies, aggregateDataBudget);
+      if (valuePreflight === null || dependenciesPreflight === null)
+        return null;
+      continue;
+    }
+    const tombstone = exactDataRecordV1(change, OH_TOMBSTONE_CHANGE_KEYS_V1);
+    if (tombstone === null || tombstone.kind !== "tombstone" || tombstone.v !== 1)
+      return null;
+  }
+  const detached = boundedSyncIngressV1(operation, {
+    maximumBytes: OH_OPERATION_MAX_BYTES_V1,
+    maximumDepth: OH_SYNC_INGRESS_OPERATION_DEPTH_V1,
+    maximumNodes: OH_SYNC_INGRESS_OPERATION_NODES_V1
+  }, bundleBudget, true);
+  return detached === null ? null : detached.value;
+}
+function canonicalStringBytesV1(value, maximumBytes) {
+  if (value.length + 2 > maximumBytes)
+    throw new RangeError("String exceeds its canonical byte budget.");
+  let bytes = 2;
+  for (let index = 0;index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code >= 55296 && code <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (!(next >= 56320 && next <= 57343))
+        throw new TypeError("Invalid Unicode string.");
+      bytes += 4;
+      index += 1;
+    } else if (code >= 56320 && code <= 57343) {
+      throw new TypeError("Invalid Unicode string.");
+    } else if (code === 34 || code === 92 || code === 8 || code === 9 || code === 10 || code === 12 || code === 13) {
+      bytes += 2;
+    } else if (code <= 31) {
+      bytes += 6;
+    } else if (code <= 127) {
+      bytes += 1;
+    } else if (code <= 2047) {
+      bytes += 2;
+    } else {
+      bytes += 3;
+    }
+    if (bytes > maximumBytes)
+      throw new RangeError("String exceeds its canonical byte budget.");
+  }
+  return bytes;
+}
+function boundedSyncIngressV1(value, limits, aggregate, clone) {
+  const ancestors = new Set;
+  const budget = {
+    bytes: 0,
+    maximumBytes: limits.maximumBytes,
+    maximumNodes: limits.maximumNodes,
+    nodes: 0
+  };
+  const canSpendBytes = (count) => budget.bytes + count <= budget.maximumBytes && (aggregate === null || aggregate.bytes + count <= aggregate.maximumBytes);
+  const spendBytes = (count) => {
+    if (!canSpendBytes(count))
+      throw new RangeError("Sync ingress exceeds its canonical byte budget.");
+    budget.bytes += count;
+    if (aggregate !== null)
+      aggregate.bytes += count;
+  };
+  const canSpendNodes = (count) => budget.nodes + count <= budget.maximumNodes && (aggregate === null || aggregate.nodes + count <= aggregate.maximumNodes);
+  const spendNode = () => {
+    if (!canSpendNodes(1))
+      throw new RangeError("Sync ingress exceeds its node budget.");
+    budget.nodes += 1;
+    if (aggregate !== null)
+      aggregate.nodes += 1;
+  };
+  const detach = (candidate, depth) => {
+    if (depth > limits.maximumDepth)
+      throw new RangeError("Sync ingress exceeds its depth budget.");
+    spendNode();
+    if (candidate === null) {
+      spendBytes(4);
+      return candidate;
+    }
+    if (typeof candidate === "boolean") {
+      spendBytes(candidate ? 4 : 5);
+      return candidate;
+    }
+    if (typeof candidate === "string") {
+      spendBytes(canonicalStringBytesV1(candidate, Math.min(budget.maximumBytes - budget.bytes, aggregate === null ? Number.MAX_SAFE_INTEGER : aggregate.maximumBytes - aggregate.bytes)));
+      return candidate;
+    }
+    if (typeof candidate === "number") {
+      if (!Number.isFinite(candidate) || Object.is(candidate, -0))
+        throw new TypeError("Invalid number.");
+      spendBytes(utf8ByteLength(canonicalJson(candidate)));
+      return candidate;
+    }
+    if (typeof candidate !== "object" || isProxy(candidate))
+      throw new TypeError("Invalid data value.");
+    if (ancestors.has(candidate))
+      throw new TypeError("Cyclic data value.");
+    ancestors.add(candidate);
+    try {
+      if (Array.isArray(candidate)) {
+        const lengthDescriptor = Object.getOwnPropertyDescriptor(candidate, "length");
+        const length = lengthDescriptor?.value;
+        if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0 || !canSpendNodes(length) || !canSpendBytes(2 + Math.max(0, length - 1) + length)) {
+          throw new TypeError("Invalid or over-budget data array.");
+        }
+        const keys2 = Reflect.ownKeys(candidate);
+        if (keys2.length !== length + 1 || !keys2.includes("length") || keys2.some((key) => key !== "length" && (typeof key !== "string" || !/^(?:0|[1-9][0-9]*)$/u.test(key) || Number(key) >= length))) {
+          throw new TypeError("Invalid data array.");
+        }
+        spendBytes(2 + Math.max(0, length - 1));
+        const detached2 = clone ? [] : null;
+        for (let index = 0;index < length; index += 1) {
+          const descriptor = Object.getOwnPropertyDescriptor(candidate, String(index));
+          if (descriptor === undefined || !descriptor.enumerable || descriptor.get !== undefined || descriptor.set !== undefined) {
+            throw new TypeError("Invalid data array entry.");
+          }
+          const item = detach(descriptor.value, depth + 1);
+          detached2?.push(item);
+        }
+        return detached2 === null ? candidate : Object.freeze(detached2);
+      }
+      const prototype = Object.getPrototypeOf(candidate);
+      if (prototype !== Object.prototype && prototype !== null) {
+        throw new TypeError("Invalid data object.");
+      }
+      let containerBytes = 2;
+      let properties = 0;
+      for (const key in candidate) {
+        if (!Object.hasOwn(candidate, key))
+          continue;
+        properties += 1;
+        if (!canSpendNodes(properties))
+          throw new RangeError("Sync ingress exceeds its node budget.");
+        const remainingBytes = Math.min(budget.maximumBytes - budget.bytes - containerBytes - properties, aggregate === null ? Number.MAX_SAFE_INTEGER : aggregate.maximumBytes - aggregate.bytes - containerBytes - properties);
+        containerBytes += (properties === 1 ? 0 : 1) + canonicalStringBytesV1(key, remainingBytes) + 1;
+        if (!canSpendBytes(containerBytes + properties)) {
+          throw new RangeError("Sync ingress exceeds its canonical byte budget.");
+        }
+      }
+      const keys = Reflect.ownKeys(candidate);
+      if (keys.length !== properties || keys.some((key) => typeof key !== "string")) {
+        throw new TypeError("Invalid data object.");
+      }
+      spendBytes(containerBytes);
+      const detached = clone ? Object.create(null) : null;
+      for (const key of keys) {
+        const descriptor = Object.getOwnPropertyDescriptor(candidate, key);
+        if (descriptor === undefined || !descriptor.enumerable || descriptor.get !== undefined || descriptor.set !== undefined) {
+          throw new TypeError("Invalid data property.");
+        }
+        const item = detach(descriptor.value, depth + 1);
+        if (detached !== null) {
+          Object.defineProperty(detached, key, {
+            configurable: false,
+            enumerable: true,
+            value: item,
+            writable: false
+          });
+        }
+      }
+      return detached === null ? candidate : Object.freeze(detached);
+    } finally {
+      ancestors.delete(candidate);
+    }
+  };
+  try {
+    return Object.freeze({ value: detach(value, 0) });
+  } catch {
+    return null;
+  }
+}
+function preflightSyncIngressValueV1(value, aggregate) {
+  return boundedSyncIngressV1(value, {
+    maximumBytes: OH_GRAPH_LIMITS_V1.recordBytes,
+    maximumDepth: OH_SYNC_INGRESS_VALUE_DEPTH_V1,
+    maximumNodes: OH_SYNC_INGRESS_VALUE_NODES_V1
+  }, aggregate, false);
+}
+function preflightSyncIngressDependenciesV1(value, aggregate) {
+  try {
+    if (typeof value !== "object" || value === null || isProxy(value) || !Array.isArray(value)) {
+      return null;
+    }
+    const length = Object.getOwnPropertyDescriptor(value, "length")?.value;
+    if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0 || length > OH_GRAPH_LIMITS_V1.dependenciesPerRecord)
+      return null;
+    const maximumBytes = length === 0 ? 2 : 1 + length * 515;
+    return boundedSyncIngressV1(value, {
+      maximumBytes,
+      maximumDepth: 1,
+      maximumNodes: length + 1
+    }, aggregate, false);
+  } catch {
+    return null;
+  }
+}
+function syncIngressBundleBudgetV1(spaceId) {
+  const emptyBundle = {
+    bundleSha256: "0".repeat(64),
+    contractSha256: OH_CONTRACT_MANIFEST_V1.contractSha256,
+    operations: [],
+    protocol: OH_SYNC_PROTOCOL_V1,
+    spaceId,
+    v: 1
+  };
+  return {
+    bytes: utf8ByteLength(canonicalJson(emptyBundle)),
+    maximumBytes: OH_SYNC_BUNDLE_MAX_BYTES_V1,
+    maximumNodes: OH_SYNC_INGRESS_BUNDLE_NODES_V1,
+    nodes: 7
+  };
+}
+function spendSyncIngressBudgetV1(budget, bytes, nodes = 0) {
+  if (budget.bytes + bytes > budget.maximumBytes || budget.nodes + nodes > budget.maximumNodes)
+    return false;
+  budget.bytes += bytes;
+  budget.nodes += nodes;
+  return true;
+}
+function measureSyncOperationV1(operation) {
+  const measurement = {
+    bytes: 0,
+    maximumBytes: OH_OPERATION_MAX_BYTES_V1,
+    maximumNodes: OH_SYNC_INGRESS_OPERATION_NODES_V1,
+    nodes: 0
+  };
+  return boundedSyncIngressV1(operation, {
+    maximumBytes: OH_OPERATION_MAX_BYTES_V1,
+    maximumDepth: OH_SYNC_INGRESS_OPERATION_DEPTH_V1,
+    maximumNodes: OH_SYNC_INGRESS_OPERATION_NODES_V1
+  }, measurement, false) === null ? null : measurement;
+}
+function buildOhSyncBundleV1(parsedSpaceId, operations, largestFittingPrefix) {
   let priorSequence = null;
   let priorSha256 = null;
   const parsed = [];
+  const bundleBudget = syncIngressBundleBudgetV1(parsedSpaceId);
   for (const candidate of operations) {
     const operation = parseOhOperationV1(candidate);
     if (operation === null || operation.spaceId !== parsedSpaceId || priorSequence !== null && operation.sequence !== priorSequence + 1 || priorSequence !== null && operation.parentOperationSha256 !== priorSha256) {
       throw new TypeError("Sync operations must form one ordered chain.");
     }
+    const measurement = measureSyncOperationV1(operation);
+    if (measurement === null) {
+      throw new RangeError("Sync operation exceeds its canonical byte, node, or depth limit.");
+    }
+    if (!spendSyncIngressBudgetV1(bundleBudget, measurement.bytes + (parsed.length === 0 ? 0 : 1), measurement.nodes)) {
+      if (largestFittingPrefix && parsed.length > 0)
+        break;
+      throw new RangeError("Sync bundle exceeds its canonical byte or node limit.");
+    }
     parsed.push(operation);
     priorSequence = operation.sequence;
     priorSha256 = operation.operationSha256;
@@ -1235,15 +1723,56 @@ function createOhSyncBundleV1(spaceId, operations) {
   };
   return { ...payload, bundleSha256: canonicalSha256(payload) };
 }
+function parseSyncHeadRefEnvelopeV1(value) {
+  const operationSha256 = value.operationSha256 === null ? null : parseSha256Hex(value.operationSha256);
+  const sequence = Number.isSafeInteger(value.sequence) && value.sequence >= 0 && !Object.is(value.sequence, -0) ? value.sequence : null;
+  return sequence !== null && (value.operationSha256 === null || operationSha256 !== null) && sequence === 0 === (operationSha256 === null) ? { operationSha256, sequence } : null;
+}
+function parseOhSyncHeadRefV1(value) {
+  const reference = exactDataRecordV1(value, OH_SYNC_HEAD_REF_KEYS_V1);
+  return reference === null ? null : parseSyncHeadRefEnvelopeV1(reference);
+}
+function parseOhSyncHeadV1(value) {
+  const envelope = exactDataRecordV1(value, OH_SYNC_HEAD_KEYS_V1);
+  if (envelope === null || envelope.v !== 1)
+    return null;
+  const reference = parseSyncHeadRefEnvelopeV1(envelope);
+  return reference === null ? null : { ...reference, v: 1 };
+}
+function createOhSyncBundleV1(spaceId, operations, options = {}) {
+  const parsedSpaceId = safeCode(spaceId);
+  const largestFittingPrefix = options.largestFittingPrefix ?? false;
+  if (parsedSpaceId === null || operations.length > OH_SYNC_BUNDLE_MAX_OPERATIONS_V1 || typeof largestFittingPrefix !== "boolean") {
+    throw new TypeError("Invalid sync bundle.");
+  }
+  return buildOhSyncBundleV1(parsedSpaceId, operations, largestFittingPrefix);
+}
 function parseOhSyncBundleV1(value) {
-  if (!isPlainRecord(value) || !hasExactKeys(value, ["bundleSha256", "contractSha256", "operations", "protocol", "spaceId", "v"]) || value.protocol !== OH_SYNC_PROTOCOL_V1 || value.v !== 1 || !Array.isArray(value.operations))
+  const envelope = exactDataRecordV1(value, OH_SYNC_BUNDLE_KEYS_V1);
+  if (envelope === null || envelope.protocol !== OH_SYNC_PROTOCOL_V1 || envelope.v !== 1)
     return null;
-  const bundleSha256 = parseSha256Hex(value.bundleSha256);
-  const contractSha256 = parseSha256Hex(value.contractSha256);
-  if (bundleSha256 === null || contractSha256 !== OH_CONTRACT_MANIFEST_V1.contractSha256)
+  const bundleSha256 = parseSha256Hex(envelope.bundleSha256);
+  const contractSha256 = parseSha256Hex(envelope.contractSha256);
+  const spaceId = safeCode(envelope.spaceId);
+  if (bundleSha256 === null || contractSha256 !== OH_CONTRACT_MANIFEST_V1.contractSha256 || spaceId === null)
     return null;
+  const operations = exactDataArrayV1(envelope.operations, OH_SYNC_BUNDLE_MAX_OPERATIONS_V1);
+  if (operations === null)
+    return null;
+  const detachedOperations = [];
+  const bundleBudget = syncIngressBundleBudgetV1(spaceId);
+  for (const operation of operations) {
+    if (detachedOperations.length > 0 && !spendSyncIngressBudgetV1(bundleBudget, 1))
+      return null;
+    const detached = stagedSyncOperationV1(operation, bundleBudget);
+    if (detached === null)
+      return null;
+    detachedOperations.push(detached);
+  }
   try {
-    const created = createOhSyncBundleV1(value.spaceId, value.operations);
+    const created = createOhSyncBundleV1(spaceId, detachedOperations);
+    if (detachedOperations.some((operation, index) => canonicalJson(operation) !== canonicalJson(created.operations[index])))
+      return null;
     return created.bundleSha256 === bundleSha256 ? { ...created, bundleSha256 } : null;
   } catch {
     return null;
@@ -1258,39 +1787,84 @@ async function synchronizeOhStoreV1(store, transport, options = {}) {
   await transport.handshake(OH_CONTRACT_MANIFEST_V1);
   let pulled = 0;
   let pushed = 0;
+  const settled = (head, rounds) => {
+    store.updateSyncState(remoteId, {
+      pulledSequence: head.sequence,
+      pushedSequence: head.sequence,
+      remoteHeadSha256: head.operationSha256
+    });
+    return { head, pulled, pushed, rounds, v: 1 };
+  };
   for (let round = 1;round <= maximumRounds; round += 1) {
+    const remote = parseOhSyncHeadV1(await transport.head(store.spaceId));
+    if (remote === null)
+      throw new Error("The sync transport returned an invalid head.");
     const local = store.head();
-    const remote = await transport.head(store.spaceId);
     if (local.sequence === remote.sequence) {
       if (local.operationSha256 !== remote.operationSha256) {
         throw new Error("Sync conflict: equal sequence numbers have different heads.");
       }
-      store.updateSyncState(remoteId, {
-        pulledSequence: local.sequence,
-        pushedSequence: local.sequence,
-        remoteHeadSha256: remote.operationSha256
-      });
-      return { head: remote, pulled, pushed, rounds: round, v: 1 };
+      return settled(remote, round);
     }
     if (local.sequence < remote.sequence) {
       const bundle = parseOhSyncBundleV1(await transport.pull(store.spaceId, local.sequence, batchSize));
-      if (bundle === null || bundle.operations.length === 0 || bundle.operations[0]?.sequence !== local.sequence + 1 || bundle.operations[0]?.parentOperationSha256 !== local.operationSha256) {
+      const terminal = bundle?.operations.at(-1);
+      if (bundle === null || bundle.operations.length === 0 || bundle.operations.length > batchSize || bundle.spaceId !== store.spaceId || bundle.operations[0]?.sequence !== local.sequence + 1 || bundle.operations[0]?.parentOperationSha256 !== local.operationSha256 || terminal === undefined || terminal.sequence > remote.sequence || terminal.sequence === remote.sequence && terminal.operationSha256 !== remote.operationSha256) {
         throw new Error("Sync conflict: remote history does not extend the local head.");
       }
-      for (const operation of bundle.operations) {
-        store.importOperation(operation);
-        pulled += 1;
+      store.importOperations({
+        expectedHead: {
+          operationSha256: local.operationSha256,
+          sequence: local.sequence
+        },
+        operations: bundle.operations
+      });
+      pulled += bundle.operations.length;
+      const afterPull = store.head();
+      if (afterPull.sequence === remote.sequence && afterPull.operationSha256 === remote.operationSha256) {
+        const confirmed = parseOhSyncHeadV1(await transport.head(store.spaceId));
+        if (confirmed === null)
+          throw new Error("The sync transport returned an invalid head.");
+        const confirmedLocal = store.head();
+        if (confirmed.sequence === remote.sequence && confirmed.operationSha256 === remote.operationSha256 && confirmedLocal.sequence === confirmed.sequence && confirmedLocal.operationSha256 === confirmed.operationSha256) {
+          return settled(confirmed, round);
+        }
       }
     } else {
-      const operations = store.exportOperations(remote.sequence, batchSize);
-      if (operations.length === 0 || operations[0]?.sequence !== remote.sequence + 1 || operations[0]?.parentOperationSha256 !== remote.operationSha256) {
+      const candidates = store.changesSince({
+        operationSha256: remote.operationSha256,
+        sequence: remote.sequence
+      }, {
+        limit: batchSize,
+        through: {
+          operationSha256: local.operationSha256,
+          sequence: local.sequence
+        }
+      }).operations;
+      if (candidates.length === 0 || candidates[0]?.sequence !== remote.sequence + 1 || candidates[0]?.parentOperationSha256 !== remote.operationSha256) {
         throw new Error("Sync conflict: local history does not extend the remote head.");
       }
-      const head = await transport.push(createOhSyncBundleV1(store.spaceId, operations));
+      const bundle = createOhSyncBundleV1(store.spaceId, candidates, {
+        largestFittingPrefix: true
+      });
+      const operations = bundle.operations;
+      const head = parseOhSyncHeadV1(await transport.push(bundle));
+      if (head === null)
+        throw new Error("The sync transport returned an invalid push head.");
       if (head.sequence !== operations.at(-1)?.sequence || head.operationSha256 !== operations.at(-1)?.operationSha256) {
         throw new Error("The sync transport acknowledged a different head.");
       }
       pushed += operations.length;
+      const afterPush = store.head();
+      if (afterPush.sequence === head.sequence && afterPush.operationSha256 === head.operationSha256) {
+        const confirmed = parseOhSyncHeadV1(await transport.head(store.spaceId));
+        if (confirmed === null)
+          throw new Error("The sync transport returned an invalid head.");
+        const confirmedLocal = store.head();
+        if (confirmed.sequence === head.sequence && confirmed.operationSha256 === head.operationSha256 && confirmedLocal.sequence === confirmed.sequence && confirmedLocal.operationSha256 === confirmed.operationSha256) {
+          return settled(confirmed, round);
+        }
+      }
     }
   }
   throw new Error("Sync did not settle within maximumRounds.");
@@ -1354,19 +1928,48 @@ function createLibSqlOperationSyncTransportV1(client) {
     },
     head,
     pull: async (spaceId, afterSequence, limit) => {
+      const parsedSpaceId = safeCode(spaceId);
+      if (parsedSpaceId === null || !Number.isSafeInteger(afterSequence) || afterSequence < 0 || Object.is(afterSequence, -0) || !Number.isSafeInteger(limit) || limit < 1 || limit > OH_SYNC_BUNDLE_MAX_OPERATIONS_V1) {
+        throw new TypeError("Invalid sync pull request.");
+      }
       await ensure();
-      const result = await client.execute({ sql: `SELECT operation_json FROM oh_sync_operations
-        WHERE space_id = ? AND sequence > ? ORDER BY sequence LIMIT ?`, args: [spaceId, afterSequence, limit] });
-      const operations = result.rows.map((row) => {
+      const bundleBudget = syncIngressBundleBudgetV1(parsedSpaceId);
+      const result = await client.execute({
+        sql: `SELECT operation_json FROM (
+          SELECT sequence, operation_json,
+            row_number() OVER (ORDER BY sequence) AS ordinal,
+            sum(length(CAST(operation_json AS BLOB))) OVER (
+              ORDER BY sequence ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW
+            ) AS cumulative_bytes
+          FROM (
+            SELECT sequence, operation_json FROM oh_sync_operations
+            WHERE space_id = ? AND sequence > ? ORDER BY sequence LIMIT ?
+          )
+        ) WHERE ordinal = 1 OR cumulative_bytes + ordinal - 1 <= ? ORDER BY sequence`,
+        args: [
+          parsedSpaceId,
+          afterSequence,
+          limit,
+          bundleBudget.maximumBytes - bundleBudget.bytes
+        ]
+      });
+      const rows = result.rows;
+      if (!Array.isArray(rows) || rows.length > limit) {
+        throw new Error("Remote sync pull exceeded its requested row limit.");
+      }
+      const operations = rows.map((row) => {
         const json = rowValue(row, "operation_json", 0);
         if (typeof json !== "string")
           throw new Error("Invalid remote operation JSON.");
+        if (utf8ByteLength(json) > OH_OPERATION_MAX_BYTES_V1) {
+          throw new Error("Remote operation JSON exceeds the canonical operation byte limit.");
+        }
         const operation = parseOhOperationV1(JSON.parse(json));
         if (operation === null || canonicalJson(operation) !== json)
           throw new Error("Invalid remote operation.");
         return operation;
       });
-      return createOhSyncBundleV1(spaceId, operations);
+      return createOhSyncBundleV1(parsedSpaceId, operations);
     },
     push: async (value) => {
       await ensure();
@@ -1378,8 +1981,35 @@ function createLibSqlOperationSyncTransportV1(client) {
       const remote = await head(bundle.spaceId);
       const first = bundle.operations[0];
       const last = bundle.operations.at(-1);
-      if (remote.sequence === last.sequence && remote.operationSha256 === last.operationSha256)
-        return remote;
+      if (remote.sequence >= last.sequence) {
+        const result = await client.execute({ sql: `SELECT sequence, operation_sha256, operation_json
+          FROM oh_sync_operations WHERE space_id = ? AND sequence >= ? AND sequence <= ?
+          ORDER BY sequence LIMIT ?`, args: [
+          bundle.spaceId,
+          first.sequence,
+          last.sequence,
+          bundle.operations.length
+        ] });
+        const rows = result.rows;
+        if (!Array.isArray(rows) || rows.length !== bundle.operations.length) {
+          throw new Error("Sync conflict: remote history does not contain the exact pushed operations.");
+        }
+        for (let index = 0;index < bundle.operations.length; index += 1) {
+          const operation = bundle.operations[index];
+          const row = rows[index];
+          if (row === undefined) {
+            throw new Error("Sync conflict: remote history does not contain the exact pushed operations.");
+          }
+          const sequence = Number(rowValue(row, "sequence", 0));
+          const operationSha256 = parseSha256Hex(rowValue(row, "operation_sha256", 1));
+          const operationJson = rowValue(row, "operation_json", 2);
+          const expectedJson = canonicalJson(operation);
+          if (sequence !== operation.sequence || operationSha256 !== operation.operationSha256 || typeof operationJson !== "string" || utf8ByteLength(operationJson) > OH_OPERATION_MAX_BYTES_V1 || operationJson !== expectedJson) {
+            throw new Error("Sync conflict: remote history differs from the pushed operations.");
+          }
+        }
+        return { operationSha256: last.operationSha256, sequence: last.sequence, v: 1 };
+      }
       if (first.sequence !== remote.sequence + 1 || first.parentOperationSha256 !== remote.operationSha256) {
         throw new Error("Sync conflict: pushed history does not extend the remote head.");
       }
@@ -1392,33 +2022,6 @@ function createLibSqlOperationSyncTransportV1(client) {
   };
 }
 // src/store.ts
-class OhConflictError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "OhConflictError";
-  }
-}
-
-class OhIntegrityError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "OhIntegrityError";
-  }
-}
-
-class OhDependencyError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "OhDependencyError";
-  }
-}
-
-class OhProfileError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "OhProfileError";
-  }
-}
 var OH_CANONICAL_STORE_PROFILE_V1 = createOhStoreProfileV1({
   applicationProfileSha256: null,
   capabilities: {
@@ -1731,6 +2334,8 @@ function transitionOhSnapshotV1(input) {
     sequence: head.sequence + 1,
     spaceId,
     v: 1
+  }, input.maximumOperationBytes === undefined ? {} : {
+    maximumOperationBytes: input.maximumOperationBytes
   });
   const nextHead = {
     generation: operation.sequence,
@@ -1971,6 +2576,8 @@ export {
   replayOhOperationsV1,
   reduceKnowledgeGraphRevisionsV1,
   parseSha256Hex,
+  parseOhSyncHeadV1,
+  parseOhSyncHeadRefV1,
   parseOhSyncBundleV1,
   parseOhStoreProfileV1,
   parseOhStoreBindingV1,
@@ -2004,6 +2611,11 @@ export {
   knowledgeSchemaRefV1,
   knowledgeGraphRecordRefV1,
   isPlainRecord,
+  isOhProfileError,
+  isOhOperationSizeError,
+  isOhIntegrityError,
+  isOhDependencyError,
+  isOhConflictError,
   hasExactKeys,
   graphRevisionSha256V1,
   emptyOhHeadV1,
@@ -2034,13 +2646,16 @@ export {
   OhRecordCodecRegistry,
   OhPurgedSpaceError,
   OhProfileError,
+  OhOperationSizeError,
   OhIntegrityError,
   OhDependencyError,
   OhConflictError,
   OH_WORKING_STORE_PROFILE_V1,
   OH_SYNC_PROTOCOL_V1,
+  OH_SYNC_BUNDLE_MAX_BYTES_V1,
   OH_SCHEMA_KINDS_V1,
   OH_SCHEMA_FORMAT_VERSION_V1,
+  OH_OPERATION_SIZE_ERROR_CODE_V1,
   OH_OPERATION_MAX_BYTES_V1,
   OH_ONTOLOGY_VERSION_V1,
   OH_KNOWLEDGE_LIMITS_V1,