@hraness/oh 0.4.1 → 0.4.2

package/dist/sqlite/index.js

@@ -1,7 +1,93 @@
 // @bun
-// src/sync.ts
-import { isProxy } from "util/types";
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+
+// src/sqlite/driver.ts
+import { existsSync } from "fs";
+import { Database } from "bun:sqlite";
+
+// src/sqlite/runtime.ts
+var MACOS_SQLITE_LIBRARY_CANDIDATES = Object.freeze([
+  "/opt/homebrew/opt/sqlite/lib/libsqlite3.dylib",
+  "/usr/local/opt/sqlite/lib/libsqlite3.dylib"
+]);
+function macosSqliteLibraryCandidates() {
+  return MACOS_SQLITE_LIBRARY_CANDIDATES;
+}
+function createOhSqliteRuntime(dependencies) {
+  let customLibrary = null;
+  if (dependencies.platform === "darwin") {
+    for (const candidate of macosSqliteLibraryCandidates()) {
+      if (!dependencies.exists(candidate))
+        continue;
+      try {
+        if (!dependencies.setCustomSQLite(candidate))
+          continue;
+        customLibrary = candidate;
+        break;
+      } catch {}
+    }
+  }
+  return Object.freeze({
+    customLibrary,
+    open: (path) => dependencies.open(path, { create: true, strict: true })
+  });
+}
 
+// src/sqlite/driver.ts
+var SQLITE_RUNTIME = createOhSqliteRuntime({
+  exists: existsSync,
+  open: (path, options) => new Database(path, options),
+  platform: process.platform,
+  setCustomSQLite: (path) => Database.setCustomSQLite(path)
+});
+function openOhSqliteDatabase(path) {
+  const database = SQLITE_RUNTIME.open(path);
+  database.exec("PRAGMA foreign_keys = ON");
+  database.exec("PRAGMA journal_mode = WAL");
+  database.exec("PRAGMA synchronous = NORMAL");
+  database.exec("PRAGMA busy_timeout = 5000");
+  database.exec("PRAGMA trusted_schema = OFF");
+  return database;
+}
+function withImmediateTransaction(database, work) {
+  database.exec("BEGIN IMMEDIATE");
+  try {
+    const result = work();
+    database.exec("COMMIT");
+    return result;
+  } catch (error) {
+    try {
+      database.exec("ROLLBACK");
+    } catch {}
+    throw error;
+  }
+}
+function withReadTransaction(database, work) {
+  database.exec("BEGIN");
+  try {
+    const result = work();
+    database.exec("COMMIT");
+    return result;
+  } catch (error) {
+    try {
+      database.exec("ROLLBACK");
+    } catch {}
+    throw error;
+  }
+}
 // src/canonical.ts
 import { createHash, randomBytes } from "crypto";
 
@@ -192,6 +278,179 @@ function sortUnique(values, key) {
   return sorted;
 }
 
+// src/sqlite/migrations.ts
+var OH_SQLITE_SCHEMA_VERSION = 2;
+var OH_SQLITE_MIGRATIONS = Object.freeze([
+  Object.freeze({
+    name: "0001_oh_core",
+    version: 1,
+    sql: `
+CREATE TABLE oh_contracts (
+  contract_id TEXT PRIMARY KEY,
+  contract_sha256 TEXT NOT NULL CHECK(length(contract_sha256) = 64),
+  manifest_json TEXT NOT NULL CHECK(json_valid(manifest_json)),
+  created_at TEXT NOT NULL
+) STRICT;
+
+CREATE TABLE oh_spaces (
+  space_id TEXT PRIMARY KEY,
+  contract_id TEXT NOT NULL REFERENCES oh_contracts(contract_id),
+  generation INTEGER NOT NULL CHECK(generation >= 0),
+  head_operation_sha256 TEXT CHECK(head_operation_sha256 IS NULL OR length(head_operation_sha256) = 64),
+  graph_revision_sha256 TEXT CHECK(graph_revision_sha256 IS NULL OR length(graph_revision_sha256) = 64),
+  records_sha256 TEXT NOT NULL CHECK(length(records_sha256) = 64),
+  sequence INTEGER NOT NULL CHECK(sequence >= 0),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  CHECK(generation = sequence),
+  CHECK((sequence = 0) = (head_operation_sha256 IS NULL)),
+  CHECK((sequence = 0) = (graph_revision_sha256 IS NULL))
+) STRICT;
+
+CREATE TABLE oh_operations (
+  operation_sha256 TEXT PRIMARY KEY CHECK(length(operation_sha256) = 64),
+  space_id TEXT NOT NULL REFERENCES oh_spaces(space_id),
+  sequence INTEGER NOT NULL CHECK(sequence > 0),
+  operation_id TEXT NOT NULL,
+  parent_operation_sha256 TEXT CHECK(parent_operation_sha256 IS NULL OR length(parent_operation_sha256) = 64),
+  graph_revision_sha256 TEXT NOT NULL CHECK(length(graph_revision_sha256) = 64),
+  records_sha256 TEXT NOT NULL CHECK(length(records_sha256) = 64),
+  operation_json TEXT NOT NULL CHECK(json_valid(operation_json)),
+  instant TEXT NOT NULL,
+  UNIQUE(space_id, sequence),
+  UNIQUE(space_id, operation_id)
+) STRICT;
+
+CREATE TABLE oh_operation_records (
+  operation_sha256 TEXT NOT NULL REFERENCES oh_operations(operation_sha256),
+  ordinal INTEGER NOT NULL CHECK(ordinal >= 0),
+  record_key TEXT NOT NULL,
+  change_kind TEXT NOT NULL CHECK(change_kind IN ('put', 'tombstone')),
+  record_sha256 TEXT CHECK(record_sha256 IS NULL OR length(record_sha256) = 64),
+  PRIMARY KEY(operation_sha256, ordinal),
+  UNIQUE(operation_sha256, record_key)
+) STRICT;
+
+CREATE TABLE oh_records (
+  space_id TEXT NOT NULL REFERENCES oh_spaces(space_id),
+  record_key TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  record_sha256 TEXT NOT NULL CHECK(length(record_sha256) = 64),
+  record_json TEXT NOT NULL CHECK(json_valid(record_json)),
+  operation_sha256 TEXT NOT NULL REFERENCES oh_operations(operation_sha256),
+  sequence INTEGER NOT NULL CHECK(sequence > 0),
+  PRIMARY KEY(space_id, record_key)
+) STRICT;
+
+CREATE TABLE oh_dependencies (
+  space_id TEXT NOT NULL,
+  record_key TEXT NOT NULL,
+  dependency_key TEXT NOT NULL,
+  PRIMARY KEY(space_id, record_key, dependency_key),
+  FOREIGN KEY(space_id, record_key) REFERENCES oh_records(space_id, record_key) ON DELETE CASCADE,
+  FOREIGN KEY(space_id, dependency_key) REFERENCES oh_records(space_id, record_key)
+) STRICT;
+
+CREATE TABLE oh_sync_outbox (
+  space_id TEXT NOT NULL REFERENCES oh_spaces(space_id),
+  sequence INTEGER NOT NULL,
+  operation_sha256 TEXT NOT NULL REFERENCES oh_operations(operation_sha256),
+  PRIMARY KEY(space_id, sequence),
+  UNIQUE(operation_sha256)
+) STRICT;
+
+CREATE TABLE oh_sync_state (
+  remote_id TEXT NOT NULL,
+  space_id TEXT NOT NULL REFERENCES oh_spaces(space_id),
+  pulled_sequence INTEGER NOT NULL CHECK(pulled_sequence >= 0),
+  pushed_sequence INTEGER NOT NULL CHECK(pushed_sequence >= 0),
+  remote_head_sha256 TEXT CHECK(remote_head_sha256 IS NULL OR length(remote_head_sha256) = 64),
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY(remote_id, space_id)
+) STRICT;
+
+CREATE TABLE oh_search_documents (
+  space_id TEXT NOT NULL,
+  record_key TEXT NOT NULL,
+  record_sha256 TEXT NOT NULL CHECK(length(record_sha256) = 64),
+  text TEXT NOT NULL,
+  PRIMARY KEY(space_id, record_key),
+  FOREIGN KEY(space_id, record_key) REFERENCES oh_records(space_id, record_key) ON DELETE CASCADE
+) STRICT;
+
+CREATE VIRTUAL TABLE oh_search_fts USING fts5(
+  space_id UNINDEXED,
+  record_key UNINDEXED,
+  text,
+  tokenize='unicode61 remove_diacritics 2'
+);
+
+CREATE INDEX oh_operations_space_sequence ON oh_operations(space_id, sequence);
+CREATE INDEX oh_records_space_kind ON oh_records(space_id, kind, record_key);
+CREATE INDEX oh_dependencies_dependency ON oh_dependencies(space_id, dependency_key);
+`
+  }),
+  Object.freeze({
+    name: "0002_store_realms",
+    version: 2,
+    sql: `
+CREATE TABLE oh_space_bindings (
+  space_id TEXT PRIMARY KEY REFERENCES oh_spaces(space_id),
+  realm_id TEXT NOT NULL,
+  profile_id TEXT NOT NULL,
+  profile_kind TEXT NOT NULL CHECK(profile_kind IN ('canonical', 'working')),
+  profile_sha256 TEXT NOT NULL CHECK(length(profile_sha256) = 64),
+  binding_sha256 TEXT NOT NULL UNIQUE CHECK(length(binding_sha256) = 64),
+  binding_json TEXT NOT NULL CHECK(json_valid(binding_json)),
+  created_at TEXT NOT NULL
+) STRICT;
+
+CREATE TABLE oh_space_purges (
+  space_id TEXT PRIMARY KEY,
+  binding_sha256 TEXT NOT NULL CHECK(length(binding_sha256) = 64),
+  prior_operation_sha256 TEXT CHECK(prior_operation_sha256 IS NULL OR length(prior_operation_sha256) = 64),
+  prior_sequence INTEGER NOT NULL CHECK(prior_sequence >= 0),
+  purged_at TEXT NOT NULL,
+  receipt_sha256 TEXT NOT NULL UNIQUE CHECK(length(receipt_sha256) = 64),
+  receipt_json TEXT NOT NULL CHECK(json_valid(receipt_json))
+) STRICT;
+`
+  })
+]);
+function applyOhSqliteMigrations(database) {
+  database.exec(`CREATE TABLE IF NOT EXISTS oh_migrations (
+    version INTEGER PRIMARY KEY,
+    name TEXT NOT NULL UNIQUE,
+    migration_sha256 TEXT NOT NULL CHECK(length(migration_sha256) = 64),
+    applied_at TEXT NOT NULL
+  ) STRICT`);
+  const select = database.query("SELECT name, migration_sha256 FROM oh_migrations WHERE version = ?");
+  const insert = database.query("INSERT INTO oh_migrations(version, name, migration_sha256, applied_at) VALUES (?, ?, ?, ?)");
+  for (const migration of OH_SQLITE_MIGRATIONS) {
+    const digest = sha256Hex(migration.sql);
+    database.exec("BEGIN IMMEDIATE");
+    try {
+      const existing = select.get(migration.version);
+      if (existing !== null) {
+        if (existing.name !== migration.name || existing.migration_sha256 !== digest) {
+          throw new Error(`SQLite migration ${migration.version} does not match the applied migration.`);
+        }
+      } else {
+        database.exec(migration.sql);
+        insert.run(migration.version, migration.name, digest, canonicalNow());
+      }
+      database.exec("COMMIT");
+    } catch (error) {
+      try {
+        database.exec("ROLLBACK");
+      } catch {}
+      throw error;
+    }
+  }
+}
+// src/sqlite/port.ts
+import { isProxy as isProxy2 } from "util/types";
+
 // src/graph.ts
 var OH_GRAPH_FORMAT_VERSION_V1 = 1;
 var OH_GRAPH_LIMITS_V1 = Object.freeze({
@@ -1280,7 +1539,6 @@ class OhOperationSizeError extends RangeError {
     });
   }
 }
-
 // src/operation.ts
 var OH_OPERATION_MAX_BYTES_V1 = 64 * 1024 * 1024;
 function parsePayload(value) {
@@ -1352,1461 +1610,973 @@ function parseOhOperationV1(value) {
   return operationSha256 !== null && payload !== null && Buffer.byteLength(canonicalJson({ ...payload, operationSha256 }), "utf8") <= OH_OPERATION_MAX_BYTES_V1 && canonicalSha256(payload) === operationSha256 ? { ...payload, operationSha256 } : null;
 }
 
-// src/sync.ts
-var OH_SYNC_PROTOCOL_V1 = "oh.sync.v1";
-var OH_SYNC_BUNDLE_MAX_OPERATIONS_V1 = 1000;
-var OH_SYNC_BUNDLE_KEYS_V1 = [
-  "bundleSha256",
-  "contractSha256",
-  "operations",
-  "protocol",
-  "spaceId",
-  "v"
-];
-var OH_SYNC_HEAD_KEYS_V1 = ["operationSha256", "sequence", "v"];
-var OH_SYNC_HEAD_REF_KEYS_V1 = ["operationSha256", "sequence"];
-var OH_OPERATION_KEYS_V1 = [
-  "actorId",
-  "changes",
-  "contractId",
-  "graphRevisionSha256",
-  "instant",
-  "operationId",
-  "operationSha256",
-  "parentOperationSha256",
-  "recordsSha256",
-  "sequence",
-  "spaceId",
-  "v"
-];
-var OH_PUT_CHANGE_KEYS_V1 = ["kind", "record", "v"];
-var OH_TOMBSTONE_CHANGE_KEYS_V1 = ["key", "kind", "priorSha256", "v"];
-var OH_RECORD_KEYS_V1 = ["dependencies", "key", "kind", "recordSha256", "v", "value"];
-var OH_SYNC_INGRESS_VALUE_DEPTH_V1 = 128;
-var OH_SYNC_INGRESS_VALUE_NODES_V1 = OH_GRAPH_LIMITS_V1.recordBytes;
-var OH_SYNC_INGRESS_OPERATION_DEPTH_V1 = OH_SYNC_INGRESS_VALUE_DEPTH_V1 + 4;
-var OH_SYNC_INGRESS_OPERATION_NODES_V1 = OH_OPERATION_MAX_BYTES_V1;
-var OH_SYNC_BUNDLE_MAX_BYTES_V1 = OH_OPERATION_MAX_BYTES_V1 + 4 * 1024;
-var OH_SYNC_INGRESS_BUNDLE_NODES_V1 = OH_SYNC_INGRESS_OPERATION_NODES_V1 + 4 * 1024;
-function exactDataRecordV1(value, expectedKeys) {
+// src/store.ts
+var OH_CANONICAL_STORE_PROFILE_V1 = createOhStoreProfileV1({
+  applicationProfileSha256: null,
+  capabilities: {
+    changesSince: true,
+    dependencyClosureExport: true,
+    exactSnapshots: true,
+    operationReplication: true,
+    semanticBundleCommit: true,
+    v: 1,
+    wholeSpacePurge: false
+  },
+  profileId: "oh.store.canonical.v1",
+  profileKind: "canonical",
+  v: 1
+});
+var OH_WORKING_STORE_PROFILE_V1 = createOhStoreProfileV1({
+  applicationProfileSha256: null,
+  capabilities: {
+    changesSince: true,
+    dependencyClosureExport: true,
+    exactSnapshots: true,
+    operationReplication: false,
+    semanticBundleCommit: true,
+    v: 1,
+    wholeSpacePurge: true
+  },
+  profileId: "oh.store.working.v1",
+  profileKind: "working",
+  v: 1
+});
+var OH_DEPENDENCY_CLOSURE_LIMITS_V1 = Object.freeze({
+  bytes: 64 * 1024 * 1024,
+  records: 8192,
+  roots: 1024
+});
+
+class OhPurgedSpaceError extends Error {
+  receipt;
+  constructor(receipt) {
+    super(`Oh space ${receipt.spaceId} was purged at ${receipt.purgedAt}.`);
+    this.name = "OhPurgedSpaceError";
+    this.receipt = receipt;
+  }
+}
+var EMPTY_RECORDS_SHA256 = canonicalSha256([]);
+function emptyOhHeadV1() {
+  return {
+    generation: 0,
+    graphRevisionSha256: null,
+    operationSha256: null,
+    recordsSha256: EMPTY_RECORDS_SHA256,
+    sequence: 0,
+    v: 1
+  };
+}
+function parseOhHeadV1(value) {
+  if (!isPlainRecord(value) || !hasExactKeys(value, [
+    "generation",
+    "graphRevisionSha256",
+    "operationSha256",
+    "recordsSha256",
+    "sequence",
+    "v"
+  ]) || value.v !== 1)
+    return null;
+  const graphRevisionSha256 = value.graphRevisionSha256 === null ? null : parseSha256Hex(value.graphRevisionSha256);
+  const operationSha256 = value.operationSha256 === null ? null : parseSha256Hex(value.operationSha256);
+  const recordsSha256 = parseSha256Hex(value.recordsSha256);
+  const generation = Number.isSafeInteger(value.generation) && value.generation >= 0 ? value.generation : null;
+  const sequence = Number.isSafeInteger(value.sequence) && value.sequence >= 0 ? value.sequence : null;
+  return generation !== null && sequence !== null && generation === sequence && recordsSha256 !== null && (value.graphRevisionSha256 === null || graphRevisionSha256 !== null) && (value.operationSha256 === null || operationSha256 !== null) && sequence === 0 === (operationSha256 === null) && sequence === 0 === (graphRevisionSha256 === null) ? { generation, graphRevisionSha256, operationSha256, recordsSha256, sequence, v: 1 } : null;
+}
+function parseOhHeadRefV1(value) {
+  const complete = parseOhHeadV1(value);
+  if (complete !== null) {
+    return { operationSha256: complete.operationSha256, sequence: complete.sequence };
+  }
+  if (!isPlainRecord(value) || !hasExactKeys(value, ["operationSha256", "sequence"]))
+    return null;
+  const operationSha256 = value.operationSha256 === null ? null : parseSha256Hex(value.operationSha256);
+  const sequence = Number.isSafeInteger(value.sequence) && value.sequence >= 0 ? value.sequence : null;
+  return sequence !== null && (value.operationSha256 === null || operationSha256 !== null) && sequence === 0 === (operationSha256 === null) ? { operationSha256, sequence } : null;
+}
+function parseCapabilities(value) {
+  if (!isPlainRecord(value) || !hasExactKeys(value, [
+    "changesSince",
+    "dependencyClosureExport",
+    "exactSnapshots",
+    "operationReplication",
+    "semanticBundleCommit",
+    "v",
+    "wholeSpacePurge"
+  ]) || value.changesSince !== true || value.dependencyClosureExport !== true || value.exactSnapshots !== true || typeof value.operationReplication !== "boolean" || value.semanticBundleCommit !== true || value.v !== 1 || typeof value.wholeSpacePurge !== "boolean")
+    return null;
+  return {
+    changesSince: true,
+    dependencyClosureExport: true,
+    exactSnapshots: true,
+    operationReplication: value.operationReplication,
+    semanticBundleCommit: true,
+    v: 1,
+    wholeSpacePurge: value.wholeSpacePurge
+  };
+}
+function createOhStoreProfileV1(input) {
+  if (!isPlainRecord(input) || !hasExactKeys(input, [
+    "applicationProfileSha256",
+    "capabilities",
+    "profileId",
+    "profileKind",
+    "v"
+  ]) || input.v !== 1)
+    throw new TypeError("Invalid Oh store profile input.");
+  const profileId = safeCode(input.profileId);
+  const applicationProfileSha256 = input.applicationProfileSha256 === null ? null : parseSha256Hex(input.applicationProfileSha256);
+  const capabilities = parseCapabilities(input.capabilities);
+  if (profileId === null || capabilities === null || input.applicationProfileSha256 !== null && applicationProfileSha256 === null || input.profileKind !== "canonical" && input.profileKind !== "working") {
+    throw new TypeError("Invalid Oh store profile input.");
+  }
+  if (input.profileKind === "working" && (capabilities.operationReplication || !capabilities.wholeSpacePurge)) {
+    throw new OhProfileError("A working profile must disable operation replication and permit whole-space purge.");
+  }
+  if (input.profileKind === "canonical" && capabilities.wholeSpacePurge) {
+    throw new OhProfileError("A canonical profile cannot permit whole-space purge.");
+  }
+  const payload = {
+    applicationProfileSha256,
+    capabilities: Object.freeze(capabilities),
+    profileId,
+    profileKind: input.profileKind,
+    v: 1
+  };
+  return Object.freeze({ ...payload, profileSha256: canonicalSha256(payload) });
+}
+function parseOhStoreProfileV1(value) {
+  if (!isPlainRecord(value) || !Object.hasOwn(value, "profileSha256"))
+    return null;
+  const digest = parseSha256Hex(value.profileSha256);
+  const { profileSha256: _profileSha256, ...input } = value;
   try {
-    if (typeof value !== "object" || value === null || Array.isArray(value) || isProxy(value))
-      return null;
-    const prototype = Object.getPrototypeOf(value);
-    const keys = Reflect.ownKeys(value);
-    if (prototype !== Object.prototype && prototype !== null || keys.length !== expectedKeys.length || keys.some((key) => typeof key !== "string") || expectedKeys.some((key) => !keys.includes(key)))
-      return null;
-    const detached = Object.create(null);
-    for (const key of expectedKeys) {
-      const descriptor = Object.getOwnPropertyDescriptor(value, key);
-      if (descriptor === undefined || !descriptor.enumerable || descriptor.get !== undefined || descriptor.set !== undefined)
-        return null;
-      Object.defineProperty(detached, key, {
-        configurable: false,
-        enumerable: true,
-        value: descriptor.value,
-        writable: false
-      });
-    }
-    return detached;
+    const created = createOhStoreProfileV1(input);
+    return digest !== null && created.profileSha256 === digest ? created : null;
   } catch {
     return null;
   }
 }
-function exactDataArrayV1(value, maximumLength, clone = true) {
+function createOhStoreBindingV1(input) {
+  const profile = parseOhStoreProfileV1(input.profile);
+  const realmId = safeCode(input.realmId);
+  const spaceId = safeCode(input.spaceId);
+  if (input.v !== 1 || profile === null || realmId === null || spaceId === null) {
+    throw new TypeError("Invalid Oh store binding input.");
+  }
+  const payload = {
+    contractSha256: OH_CONTRACT_MANIFEST_V1.contractSha256,
+    profile,
+    realmId,
+    spaceId,
+    v: 1
+  };
+  return Object.freeze({ ...payload, bindingSha256: canonicalSha256(payload) });
+}
+function parseOhStoreBindingV1(value) {
+  if (!isPlainRecord(value) || !hasExactKeys(value, [
+    "bindingSha256",
+    "contractSha256",
+    "profile",
+    "realmId",
+    "spaceId",
+    "v"
+  ]) || value.v !== 1 || value.contractSha256 !== OH_CONTRACT_MANIFEST_V1.contractSha256)
+    return null;
+  const bindingSha256 = parseSha256Hex(value.bindingSha256);
+  const profile = parseOhStoreProfileV1(value.profile);
   try {
-    if (typeof value !== "object" || value === null || isProxy(value) || !Array.isArray(value))
-      return null;
-    const lengthDescriptor = Object.getOwnPropertyDescriptor(value, "length");
-    const length = lengthDescriptor?.value;
-    if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0 || length > maximumLength)
-      return null;
-    const keys = Reflect.ownKeys(value);
-    if (keys.length !== length + 1 || !keys.includes("length") || keys.some((key) => key !== "length" && (typeof key !== "string" || !/^(?:0|[1-9][0-9]*)$/u.test(key) || Number(key) >= length)))
+    if (bindingSha256 === null || profile === null)
       return null;
-    const detached = clone ? [] : null;
-    for (let index = 0;index < length; index += 1) {
-      const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
-      if (descriptor === undefined || !descriptor.enumerable || descriptor.get !== undefined || descriptor.set !== undefined)
-        return null;
-      detached?.push(descriptor.value);
-    }
-    return detached ?? value;
+    const created = createOhStoreBindingV1({
+      profile,
+      realmId: value.realmId,
+      spaceId: value.spaceId,
+      v: 1
+    });
+    return created.bindingSha256 === bindingSha256 ? created : null;
   } catch {
     return null;
   }
 }
-function stagedSyncOperationV1(value, bundleBudget) {
-  const operation = exactDataRecordV1(value, OH_OPERATION_KEYS_V1);
-  if (operation === null || operation.v !== 1 || operation.contractId !== OH_CONTRACT_ID_V1 || safeCode(operation.actorId) === null || safeCode(operation.operationId) === null || safeCode(operation.spaceId) === null || parseCanonicalInstantV1(operation.instant) === null || parseSha256Hex(operation.operationSha256) === null || parseSha256Hex(operation.graphRevisionSha256) === null || parseSha256Hex(operation.recordsSha256) === null)
-    return null;
-  const parentOperationSha256 = operation.parentOperationSha256 === null ? null : parseSha256Hex(operation.parentOperationSha256);
-  const sequence = Number.isSafeInteger(operation.sequence) && operation.sequence > 0 ? operation.sequence : null;
-  if (sequence === null || operation.parentOperationSha256 !== null && parentOperationSha256 === null || sequence === 1 !== (parentOperationSha256 === null))
-    return null;
-  const changes = exactDataArrayV1(operation.changes, OH_GRAPH_LIMITS_V1.changesPerOperation, false);
-  if (changes === null || changes.length === 0)
-    return null;
-  const aggregateDataBudget = {
-    bytes: 0,
-    maximumBytes: OH_OPERATION_MAX_BYTES_V1,
-    maximumNodes: OH_SYNC_INGRESS_OPERATION_NODES_V1,
-    nodes: 0
-  };
-  for (const change of changes) {
-    const put = exactDataRecordV1(change, OH_PUT_CHANGE_KEYS_V1);
-    if (put !== null && put.kind === "put" && put.v === 1) {
-      const record = exactDataRecordV1(put.record, OH_RECORD_KEYS_V1);
-      if (record === null)
-        return null;
-      const valuePreflight = preflightSyncIngressValueV1(record.value, aggregateDataBudget);
-      const dependenciesPreflight = preflightSyncIngressDependenciesV1(record.dependencies, aggregateDataBudget);
-      if (valuePreflight === null || dependenciesPreflight === null)
-        return null;
-      continue;
-    }
-    const tombstone = exactDataRecordV1(change, OH_TOMBSTONE_CHANGE_KEYS_V1);
-    if (tombstone === null || tombstone.kind !== "tombstone" || tombstone.v !== 1)
-      return null;
-  }
-  const detached = boundedSyncIngressV1(operation, {
-    maximumBytes: OH_OPERATION_MAX_BYTES_V1,
-    maximumDepth: OH_SYNC_INGRESS_OPERATION_DEPTH_V1,
-    maximumNodes: OH_SYNC_INGRESS_OPERATION_NODES_V1
-  }, bundleBudget, true);
-  return detached === null ? null : detached.value;
+function sortedRecords(records) {
+  return [...records].sort((left, right) => left.key < right.key ? -1 : left.key > right.key ? 1 : 0);
 }
-function canonicalStringBytesV1(value, maximumBytes) {
-  if (value.length + 2 > maximumBytes)
-    throw new RangeError("String exceeds its canonical byte budget.");
-  let bytes = 2;
-  for (let index = 0;index < value.length; index += 1) {
-    const code = value.charCodeAt(index);
-    if (code >= 55296 && code <= 56319) {
-      const next = value.charCodeAt(index + 1);
-      if (!(next >= 56320 && next <= 57343))
-        throw new TypeError("Invalid Unicode string.");
-      bytes += 4;
-      index += 1;
-    } else if (code >= 56320 && code <= 57343) {
-      throw new TypeError("Invalid Unicode string.");
-    } else if (code === 34 || code === 92 || code === 8 || code === 9 || code === 10 || code === 12 || code === 13) {
-      bytes += 2;
-    } else if (code <= 31) {
-      bytes += 6;
-    } else if (code <= 127) {
-      bytes += 1;
-    } else if (code <= 2047) {
-      bytes += 2;
-    } else {
-      bytes += 3;
+function verifyDependencies(records) {
+  for (const record of records.values()) {
+    for (const dependency of record.dependencies) {
+      if (!records.has(dependency))
+        throw new OhDependencyError(`Missing dependency ${dependency} for ${record.key}.`);
     }
-    if (bytes > maximumBytes)
-      throw new RangeError("String exceeds its canonical byte budget.");
   }
-  return bytes;
 }
-function boundedSyncIngressV1(value, limits, aggregate, clone) {
-  const ancestors = new Set;
-  const budget = {
-    bytes: 0,
-    maximumBytes: limits.maximumBytes,
-    maximumNodes: limits.maximumNodes,
-    nodes: 0
-  };
-  const canSpendBytes = (count) => budget.bytes + count <= budget.maximumBytes && (aggregate === null || aggregate.bytes + count <= aggregate.maximumBytes);
-  const spendBytes = (count) => {
-    if (!canSpendBytes(count))
-      throw new RangeError("Sync ingress exceeds its canonical byte budget.");
-    budget.bytes += count;
-    if (aggregate !== null)
-      aggregate.bytes += count;
-  };
-  const canSpendNodes = (count) => budget.nodes + count <= budget.maximumNodes && (aggregate === null || aggregate.nodes + count <= aggregate.maximumNodes);
-  const spendNode = () => {
-    if (!canSpendNodes(1))
-      throw new RangeError("Sync ingress exceeds its node budget.");
-    budget.nodes += 1;
-    if (aggregate !== null)
-      aggregate.nodes += 1;
-  };
-  const detach = (candidate, depth) => {
-    if (depth > limits.maximumDepth)
-      throw new RangeError("Sync ingress exceeds its depth budget.");
-    spendNode();
-    if (candidate === null) {
-      spendBytes(4);
-      return candidate;
-    }
-    if (typeof candidate === "boolean") {
-      spendBytes(candidate ? 4 : 5);
-      return candidate;
-    }
-    if (typeof candidate === "string") {
-      spendBytes(canonicalStringBytesV1(candidate, Math.min(budget.maximumBytes - budget.bytes, aggregate === null ? Number.MAX_SAFE_INTEGER : aggregate.maximumBytes - aggregate.bytes)));
-      return candidate;
-    }
-    if (typeof candidate === "number") {
-      if (!Number.isFinite(candidate) || Object.is(candidate, -0))
-        throw new TypeError("Invalid number.");
-      spendBytes(utf8ByteLength(canonicalJson(candidate)));
-      return candidate;
+function replayOhOperationsV1(spaceId, values, maximumRecords = OH_GRAPH_LIMITS_V1.recordsPerSnapshot) {
+  const parsedSpaceId = safeCode(spaceId);
+  if (parsedSpaceId === null || !Number.isSafeInteger(maximumRecords) || maximumRecords < 1 || maximumRecords > OH_GRAPH_LIMITS_V1.recordsPerSnapshot) {
+    throw new TypeError("Invalid operation replay input.");
+  }
+  const records = new Map;
+  const operationIds = new Set;
+  let head = emptyOhHeadV1();
+  for (const value of values) {
+    const operation = parseOhOperationV1(value);
+    if (operation === null || operation.spaceId !== parsedSpaceId || operation.sequence !== head.sequence + 1 || operation.parentOperationSha256 !== head.operationSha256 || operationIds.has(operation.operationId)) {
+      throw new OhIntegrityError("Operation replay chain is broken.");
     }
-    if (typeof candidate !== "object" || isProxy(candidate))
-      throw new TypeError("Invalid data value.");
-    if (ancestors.has(candidate))
-      throw new TypeError("Cyclic data value.");
-    ancestors.add(candidate);
-    try {
-      if (Array.isArray(candidate)) {
-        const lengthDescriptor = Object.getOwnPropertyDescriptor(candidate, "length");
-        const length = lengthDescriptor?.value;
-        if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0 || !canSpendNodes(length) || !canSpendBytes(2 + Math.max(0, length - 1) + length)) {
-          throw new TypeError("Invalid or over-budget data array.");
-        }
-        const keys2 = Reflect.ownKeys(candidate);
-        if (keys2.length !== length + 1 || !keys2.includes("length") || keys2.some((key) => key !== "length" && (typeof key !== "string" || !/^(?:0|[1-9][0-9]*)$/u.test(key) || Number(key) >= length))) {
-          throw new TypeError("Invalid data array.");
-        }
-        spendBytes(2 + Math.max(0, length - 1));
-        const detached2 = clone ? [] : null;
-        for (let index = 0;index < length; index += 1) {
-          const descriptor = Object.getOwnPropertyDescriptor(candidate, String(index));
-          if (descriptor === undefined || !descriptor.enumerable || descriptor.get !== undefined || descriptor.set !== undefined) {
-            throw new TypeError("Invalid data array entry.");
-          }
-          const item = detach(descriptor.value, depth + 1);
-          detached2?.push(item);
-        }
-        return detached2 === null ? candidate : Object.freeze(detached2);
-      }
-      const prototype = Object.getPrototypeOf(candidate);
-      if (prototype !== Object.prototype && prototype !== null) {
-        throw new TypeError("Invalid data object.");
-      }
-      let containerBytes = 2;
-      let properties = 0;
-      for (const key in candidate) {
-        if (!Object.hasOwn(candidate, key))
-          continue;
-        properties += 1;
-        if (!canSpendNodes(properties))
-          throw new RangeError("Sync ingress exceeds its node budget.");
-        const remainingBytes = Math.min(budget.maximumBytes - budget.bytes - containerBytes - properties, aggregate === null ? Number.MAX_SAFE_INTEGER : aggregate.maximumBytes - aggregate.bytes - containerBytes - properties);
-        containerBytes += (properties === 1 ? 0 : 1) + canonicalStringBytesV1(key, remainingBytes) + 1;
-        if (!canSpendBytes(containerBytes + properties)) {
-          throw new RangeError("Sync ingress exceeds its canonical byte budget.");
-        }
-      }
-      const keys = Reflect.ownKeys(candidate);
-      if (keys.length !== properties || keys.some((key) => typeof key !== "string")) {
-        throw new TypeError("Invalid data object.");
-      }
-      spendBytes(containerBytes);
-      const detached = clone ? Object.create(null) : null;
-      for (const key of keys) {
-        const descriptor = Object.getOwnPropertyDescriptor(candidate, key);
-        if (descriptor === undefined || !descriptor.enumerable || descriptor.get !== undefined || descriptor.set !== undefined) {
-          throw new TypeError("Invalid data property.");
-        }
-        const item = detach(descriptor.value, depth + 1);
-        if (detached !== null) {
-          Object.defineProperty(detached, key, {
-            configurable: false,
-            enumerable: true,
-            value: item,
-            writable: false
-          });
+    operationIds.add(operation.operationId);
+    for (const change of operation.changes) {
+      if (change.kind === "put")
+        records.set(change.record.key, change.record);
+      else {
+        const prior = records.get(change.key);
+        if (prior?.recordSha256 !== change.priorSha256) {
+          throw new OhIntegrityError("Replay tombstone does not match its prior record.");
         }
+        records.delete(change.key);
       }
-      return detached === null ? candidate : Object.freeze(detached);
-    } finally {
-      ancestors.delete(candidate);
     }
-  };
-  try {
-    return Object.freeze({ value: detach(value, 0) });
-  } catch {
-    return null;
-  }
-}
-function preflightSyncIngressValueV1(value, aggregate) {
-  return boundedSyncIngressV1(value, {
-    maximumBytes: OH_GRAPH_LIMITS_V1.recordBytes,
-    maximumDepth: OH_SYNC_INGRESS_VALUE_DEPTH_V1,
-    maximumNodes: OH_SYNC_INGRESS_VALUE_NODES_V1
-  }, aggregate, false);
-}
-function preflightSyncIngressDependenciesV1(value, aggregate) {
-  try {
-    if (typeof value !== "object" || value === null || isProxy(value) || !Array.isArray(value)) {
-      return null;
+    if (records.size > maximumRecords)
+      throw new RangeError("Operation replay exceeds its record bound.");
+    verifyDependencies(records);
+    const refs = sortedRecords(records.values()).map(knowledgeGraphRecordRefV1);
+    const recordsSha256 = canonicalSha256(refs);
+    const graphRevisionSha256 = graphRevisionSha256V1({
+      changes: operation.changes,
+      operationId: operation.operationId,
+      parentGraphRevisionSha256: head.graphRevisionSha256,
+      recordsSha256,
+      revision: operation.sequence
+    });
+    if (recordsSha256 !== operation.recordsSha256 || graphRevisionSha256 !== operation.graphRevisionSha256) {
+      throw new OhIntegrityError("Replay does not reproduce an operation head.");
     }
-    const length = Object.getOwnPropertyDescriptor(value, "length")?.value;
-    if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0 || length > OH_GRAPH_LIMITS_V1.dependenciesPerRecord)
-      return null;
-    const maximumBytes = length === 0 ? 2 : 1 + length * 515;
-    return boundedSyncIngressV1(value, {
-      maximumBytes,
-      maximumDepth: 1,
-      maximumNodes: length + 1
-    }, aggregate, false);
-  } catch {
-    return null;
+    head = {
+      generation: operation.sequence,
+      graphRevisionSha256,
+      operationSha256: operation.operationSha256,
+      recordsSha256,
+      sequence: operation.sequence,
+      v: 1
+    };
   }
+  return { head, records: sortedRecords(records.values()), v: 1 };
 }
-function syncIngressBundleBudgetV1(spaceId) {
-  const emptyBundle = {
-    bundleSha256: "0".repeat(64),
-    contractSha256: OH_CONTRACT_MANIFEST_V1.contractSha256,
-    operations: [],
-    protocol: OH_SYNC_PROTOCOL_V1,
-    spaceId,
-    v: 1
-  };
-  return {
-    bytes: utf8ByteLength(canonicalJson(emptyBundle)),
-    maximumBytes: OH_SYNC_BUNDLE_MAX_BYTES_V1,
-    maximumNodes: OH_SYNC_INGRESS_BUNDLE_NODES_V1,
-    nodes: 7
-  };
-}
-function spendSyncIngressBudgetV1(budget, bytes, nodes = 0) {
-  if (budget.bytes + bytes > budget.maximumBytes || budget.nodes + nodes > budget.maximumNodes)
-    return false;
-  budget.bytes += bytes;
-  budget.nodes += nodes;
-  return true;
-}
-function measureSyncOperationV1(operation) {
-  const measurement = {
-    bytes: 0,
-    maximumBytes: OH_OPERATION_MAX_BYTES_V1,
-    maximumNodes: OH_SYNC_INGRESS_OPERATION_NODES_V1,
-    nodes: 0
-  };
-  return boundedSyncIngressV1(operation, {
-    maximumBytes: OH_OPERATION_MAX_BYTES_V1,
-    maximumDepth: OH_SYNC_INGRESS_OPERATION_DEPTH_V1,
-    maximumNodes: OH_SYNC_INGRESS_OPERATION_NODES_V1
-  }, measurement, false) === null ? null : measurement;
-}
-function buildOhSyncBundleV1(parsedSpaceId, operations, largestFittingPrefix) {
-  let priorSequence = null;
-  let priorSha256 = null;
-  const parsed = [];
-  const bundleBudget = syncIngressBundleBudgetV1(parsedSpaceId);
-  for (const candidate of operations) {
-    const operation = parseOhOperationV1(candidate);
-    if (operation === null || operation.spaceId !== parsedSpaceId || priorSequence !== null && operation.sequence !== priorSequence + 1 || priorSequence !== null && operation.parentOperationSha256 !== priorSha256) {
-      throw new TypeError("Sync operations must form one ordered chain.");
-    }
-    const measurement = measureSyncOperationV1(operation);
-    if (measurement === null) {
-      throw new RangeError("Sync operation exceeds its canonical byte, node, or depth limit.");
+function transitionOhSnapshotV1(input) {
+  const actorId = safeCode(input.actorId);
+  const operationId = safeCode(input.operationId);
+  const spaceId = safeCode(input.spaceId);
+  const instant = parseCanonicalInstantV1(input.instant);
+  const changes = canonicalKnowledgeGraphChangesV1(input.changes);
+  if (actorId === null || operationId === null || spaceId === null || instant === null || changes.length === 0 || changes.length > OH_GRAPH_LIMITS_V1.changesPerOperation) {
+    throw new TypeError("Invalid graph transition input.");
+  }
+  const head = parseOhHeadV1(input.snapshot.head);
+  if (input.snapshot.v !== 1 || head === null || !Array.isArray(input.snapshot.records)) {
+    throw new OhIntegrityError("The transition snapshot is invalid.");
+  }
+  const records = new Map;
+  for (const value of input.snapshot.records) {
+    const record = parseKnowledgeGraphRecordV1(value);
+    if (record === null || records.has(record.key)) {
+      throw new OhIntegrityError("The transition snapshot contains an invalid record.");
     }
-    if (!spendSyncIngressBudgetV1(bundleBudget, measurement.bytes + (parsed.length === 0 ? 0 : 1), measurement.nodes)) {
-      if (largestFittingPrefix && parsed.length > 0)
-        break;
-      throw new RangeError("Sync bundle exceeds its canonical byte or node limit.");
+    records.set(record.key, record);
+  }
+  verifyDependencies(records);
+  const priorRecordsSha256 = canonicalSha256(sortedRecords(records.values()).map(knowledgeGraphRecordRefV1));
+  if (priorRecordsSha256 !== head.recordsSha256) {
+    throw new OhIntegrityError("The transition snapshot does not reproduce its head.");
+  }
+  for (const change of changes) {
+    if (change.kind === "put")
+      records.set(change.record.key, change.record);
+    else {
+      const prior = records.get(change.key);
+      if (prior === undefined || prior.recordSha256 !== change.priorSha256) {
+        throw new OhConflictError(`The prior digest for ${change.key} does not match the snapshot.`);
+      }
+      records.delete(change.key);
     }
-    parsed.push(operation);
-    priorSequence = operation.sequence;
-    priorSha256 = operation.operationSha256;
   }
-  const payload = {
-    contractSha256: OH_CONTRACT_MANIFEST_V1.contractSha256,
-    operations: parsed,
-    protocol: OH_SYNC_PROTOCOL_V1,
-    spaceId: parsedSpaceId,
+  if (records.size > OH_GRAPH_LIMITS_V1.recordsPerSnapshot) {
+    throw new RangeError("Graph transition exceeds its record snapshot limit.");
+  }
+  verifyDependencies(records);
+  const nextRecords = sortedRecords(records.values());
+  const recordsSha256 = canonicalSha256(nextRecords.map(knowledgeGraphRecordRefV1));
+  const graphRevisionSha256 = graphRevisionSha256V1({
+    changes,
+    operationId,
+    parentGraphRevisionSha256: head.graphRevisionSha256,
+    recordsSha256,
+    revision: head.sequence + 1
+  });
+  const operation = createOhOperationV1({
+    actorId,
+    changes,
+    contractId: OH_CONTRACT_MANIFEST_V1.contractId,
+    graphRevisionSha256,
+    instant,
+    operationId,
+    parentOperationSha256: head.operationSha256,
+    recordsSha256,
+    sequence: head.sequence + 1,
+    spaceId,
+    v: 1
+  }, input.maximumOperationBytes === undefined ? {} : {
+    maximumOperationBytes: input.maximumOperationBytes
+  });
+  const nextHead = {
+    generation: operation.sequence,
+    graphRevisionSha256,
+    operationSha256: operation.operationSha256,
+    recordsSha256,
+    sequence: operation.sequence,
     v: 1
   };
-  return { ...payload, bundleSha256: canonicalSha256(payload) };
-}
-function parseSyncHeadRefEnvelopeV1(value) {
-  const operationSha256 = value.operationSha256 === null ? null : parseSha256Hex(value.operationSha256);
-  const sequence = Number.isSafeInteger(value.sequence) && value.sequence >= 0 && !Object.is(value.sequence, -0) ? value.sequence : null;
-  return sequence !== null && (value.operationSha256 === null || operationSha256 !== null) && sequence === 0 === (operationSha256 === null) ? { operationSha256, sequence } : null;
+  return { operation, snapshot: { head: nextHead, records: nextRecords, v: 1 } };
 }
-function parseOhSyncHeadRefV1(value) {
-  const reference = exactDataRecordV1(value, OH_SYNC_HEAD_REF_KEYS_V1);
-  return reference === null ? null : parseSyncHeadRefEnvelopeV1(reference);
+function normalizeRoots(values) {
+  if (!Array.isArray(values) || values.length < 1 || values.length > OH_DEPENDENCY_CLOSURE_LIMITS_V1.roots) {
+    throw new RangeError(`A dependency closure needs 1 through ${OH_DEPENDENCY_CLOSURE_LIMITS_V1.roots} roots.`);
+  }
+  const roots = values.map((value) => safeCode(value, 512));
+  if (roots.some((value) => value === null))
+    throw new TypeError("Invalid dependency closure root.");
+  const sorted = [...roots].sort();
+  if (sorted.some((value, index) => index > 0 && sorted[index - 1] === value)) {
+    throw new TypeError("Dependency closure roots must be unique.");
+  }
+  return sorted;
 }
-function parseOhSyncHeadV1(value) {
-  const envelope = exactDataRecordV1(value, OH_SYNC_HEAD_KEYS_V1);
-  if (envelope === null || envelope.v !== 1)
-    return null;
-  const reference = parseSyncHeadRefEnvelopeV1(envelope);
-  return reference === null ? null : { ...reference, v: 1 };
+function closureRecords(available, roots, maximumRecords, maximumBytes = OH_DEPENDENCY_CLOSURE_LIMITS_V1.bytes - 64 * 1024) {
+  const selected = new Map;
+  const pending = [...roots];
+  let selectedBytes = 0;
+  while (pending.length > 0) {
+    const key = pending.pop();
+    if (selected.has(key))
+      continue;
+    const record = available.get(key);
+    if (record === undefined)
+      throw new OhDependencyError(`Dependency closure record ${key} is missing.`);
+    selectedBytes += Buffer.byteLength(canonicalJson(record), "utf8") + 1;
+    if (selectedBytes > maximumBytes)
+      throw new RangeError("Dependency closure exceeds its canonical byte bound.");
+    selected.set(key, record);
+    if (selected.size > maximumRecords)
+      throw new RangeError("Dependency closure exceeds its record bound.");
+    pending.push(...record.dependencies);
+  }
+  return sortedRecords(selected.values());
 }
-function createOhSyncBundleV1(spaceId, operations, options = {}) {
-  const parsedSpaceId = safeCode(spaceId);
-  const largestFittingPrefix = options.largestFittingPrefix ?? false;
-  if (parsedSpaceId === null || operations.length > OH_SYNC_BUNDLE_MAX_OPERATIONS_V1 || typeof largestFittingPrefix !== "boolean") {
-    throw new TypeError("Invalid sync bundle.");
+function createOhDependencyClosureV1(input) {
+  const binding = parseOhStoreBindingV1(input.binding);
+  const head = parseOhHeadV1(input.snapshot.head);
+  const maximumRecords = input.maximumRecords ?? OH_DEPENDENCY_CLOSURE_LIMITS_V1.records;
+  if (binding === null || head === null || !Number.isSafeInteger(maximumRecords) || maximumRecords < 1 || maximumRecords > OH_DEPENDENCY_CLOSURE_LIMITS_V1.records) {
+    throw new TypeError("Invalid dependency closure input.");
   }
-  return buildOhSyncBundleV1(parsedSpaceId, operations, largestFittingPrefix);
+  const roots = normalizeRoots(input.roots);
+  const available = new Map;
+  for (const value of input.snapshot.records) {
+    const record = parseKnowledgeGraphRecordV1(value);
+    if (record === null || available.has(record.key))
+      throw new OhIntegrityError("Snapshot contains an invalid record.");
+    available.set(record.key, record);
+  }
+  const recordsSha256 = canonicalSha256(sortedRecords(available.values()).map(knowledgeGraphRecordRefV1));
+  if (recordsSha256 !== head.recordsSha256)
+    throw new OhIntegrityError("Snapshot records do not reproduce its head.");
+  const records = closureRecords(available, roots, maximumRecords);
+  const payload = { binding, head, records, roots, v: 1 };
+  const closure = { ...payload, closureSha256: canonicalSha256(payload) };
+  if (Buffer.byteLength(canonicalJson(closure), "utf8") > OH_DEPENDENCY_CLOSURE_LIMITS_V1.bytes) {
+    throw new RangeError("Dependency closure exceeds its canonical byte bound.");
+  }
+  return Object.freeze(closure);
 }
-function parseOhSyncBundleV1(value) {
-  const envelope = exactDataRecordV1(value, OH_SYNC_BUNDLE_KEYS_V1);
-  if (envelope === null || envelope.protocol !== OH_SYNC_PROTOCOL_V1 || envelope.v !== 1)
-    return null;
-  const bundleSha256 = parseSha256Hex(envelope.bundleSha256);
-  const contractSha256 = parseSha256Hex(envelope.contractSha256);
-  const spaceId = safeCode(envelope.spaceId);
-  if (bundleSha256 === null || contractSha256 !== OH_CONTRACT_MANIFEST_V1.contractSha256 || spaceId === null)
+function parseOhDependencyClosureV1(value) {
+  if (!isPlainRecord(value) || !hasExactKeys(value, [
+    "binding",
+    "closureSha256",
+    "head",
+    "records",
+    "roots",
+    "v"
+  ]) || value.v !== 1 || !Array.isArray(value.records) || !Array.isArray(value.roots) || value.records.length > OH_DEPENDENCY_CLOSURE_LIMITS_V1.records)
     return null;
-  const operations = exactDataArrayV1(envelope.operations, OH_SYNC_BUNDLE_MAX_OPERATIONS_V1);
-  if (operations === null)
+  const binding = parseOhStoreBindingV1(value.binding);
+  const head = parseOhHeadV1(value.head);
+  const closureSha256 = parseSha256Hex(value.closureSha256);
+  if (binding === null || head === null || closureSha256 === null)
     return null;
-  const detachedOperations = [];
-  const bundleBudget = syncIngressBundleBudgetV1(spaceId);
-  for (const operation of operations) {
-    if (detachedOperations.length > 0 && !spendSyncIngressBudgetV1(bundleBudget, 1))
-      return null;
-    const detached = stagedSyncOperationV1(operation, bundleBudget);
-    if (detached === null)
+  const records = new Map;
+  for (const item of value.records) {
+    const record = parseKnowledgeGraphRecordV1(item);
+    if (record === null || records.has(record.key))
       return null;
-    detachedOperations.push(detached);
+    records.set(record.key, record);
   }
   try {
-    const created = createOhSyncBundleV1(spaceId, detachedOperations);
-    if (detachedOperations.some((operation, index) => canonicalJson(operation) !== canonicalJson(created.operations[index])))
+    const roots = normalizeRoots(value.roots);
+    if (canonicalJson(roots) !== canonicalJson(value.roots))
       return null;
-    return created.bundleSha256 === bundleSha256 ? { ...created, bundleSha256 } : null;
+    const exact = closureRecords(records, roots, OH_DEPENDENCY_CLOSURE_LIMITS_V1.records);
+    if (canonicalJson(exact) !== canonicalJson(value.records))
+      return null;
+    const payload = { binding, head, records: exact, roots, v: 1 };
+    const parsed = { ...payload, closureSha256 };
+    return canonicalSha256(payload) === closureSha256 && Buffer.byteLength(canonicalJson(parsed), "utf8") <= OH_DEPENDENCY_CLOSURE_LIMITS_V1.bytes ? Object.freeze(parsed) : null;
   } catch {
     return null;
   }
 }
-async function synchronizeOhStoreV1(store, transport, options = {}) {
-  const batchSize = options.batchSize ?? 100;
-  const maximumRounds = options.maximumRounds ?? 100;
-  const remoteId = safeCode(options.remoteId ?? "default");
-  if (!Number.isSafeInteger(batchSize) || batchSize < 1 || batchSize > 1000 || !Number.isSafeInteger(maximumRounds) || maximumRounds < 1 || maximumRounds > 1e4 || remoteId === null)
-    throw new TypeError("Invalid sync options.");
-  await transport.handshake(OH_CONTRACT_MANIFEST_V1);
-  let pulled = 0;
-  let pushed = 0;
-  const settled = (head, rounds) => {
-    store.updateSyncState(remoteId, {
-      pulledSequence: head.sequence,
-      pushedSequence: head.sequence,
-      remoteHeadSha256: head.operationSha256
-    });
-    return { head, pulled, pushed, rounds, v: 1 };
-  };
-  for (let round = 1;round <= maximumRounds; round += 1) {
-    const remote = parseOhSyncHeadV1(await transport.head(store.spaceId));
-    if (remote === null)
-      throw new Error("The sync transport returned an invalid head.");
-    const local = store.head();
-    if (local.sequence === remote.sequence) {
-      if (local.operationSha256 !== remote.operationSha256) {
-        throw new Error("Sync conflict: equal sequence numbers have different heads.");
-      }
-      return settled(remote, round);
-    }
-    if (local.sequence < remote.sequence) {
-      const bundle = parseOhSyncBundleV1(await transport.pull(store.spaceId, local.sequence, batchSize));
-      const terminal = bundle?.operations.at(-1);
-      if (bundle === null || bundle.operations.length === 0 || bundle.operations.length > batchSize || bundle.spaceId !== store.spaceId || bundle.operations[0]?.sequence !== local.sequence + 1 || bundle.operations[0]?.parentOperationSha256 !== local.operationSha256 || terminal === undefined || terminal.sequence > remote.sequence || terminal.sequence === remote.sequence && terminal.operationSha256 !== remote.operationSha256) {
-        throw new Error("Sync conflict: remote history does not extend the local head.");
-      }
-      store.importOperations({
-        expectedHead: {
-          operationSha256: local.operationSha256,
-          sequence: local.sequence
-        },
-        operations: bundle.operations
-      });
-      pulled += bundle.operations.length;
-      const afterPull = store.head();
-      if (afterPull.sequence === remote.sequence && afterPull.operationSha256 === remote.operationSha256) {
-        const confirmed = parseOhSyncHeadV1(await transport.head(store.spaceId));
-        if (confirmed === null)
-          throw new Error("The sync transport returned an invalid head.");
-        const confirmedLocal = store.head();
-        if (confirmed.sequence === remote.sequence && confirmed.operationSha256 === remote.operationSha256 && confirmedLocal.sequence === confirmed.sequence && confirmedLocal.operationSha256 === confirmed.operationSha256) {
-          return settled(confirmed, round);
-        }
-      }
-    } else {
-      const candidates = store.changesSince({
-        operationSha256: remote.operationSha256,
-        sequence: remote.sequence
-      }, {
-        limit: batchSize,
-        through: {
-          operationSha256: local.operationSha256,
-          sequence: local.sequence
-        }
-      }).operations;
-      if (candidates.length === 0 || candidates[0]?.sequence !== remote.sequence + 1 || candidates[0]?.parentOperationSha256 !== remote.operationSha256) {
-        throw new Error("Sync conflict: local history does not extend the remote head.");
-      }
-      const bundle = createOhSyncBundleV1(store.spaceId, candidates, {
-        largestFittingPrefix: true
-      });
-      const operations = bundle.operations;
-      const head = parseOhSyncHeadV1(await transport.push(bundle));
-      if (head === null)
-        throw new Error("The sync transport returned an invalid push head.");
-      if (head.sequence !== operations.at(-1)?.sequence || head.operationSha256 !== operations.at(-1)?.operationSha256) {
-        throw new Error("The sync transport acknowledged a different head.");
-      }
-      pushed += operations.length;
-      const afterPush = store.head();
-      if (afterPush.sequence === head.sequence && afterPush.operationSha256 === head.operationSha256) {
-        const confirmed = parseOhSyncHeadV1(await transport.head(store.spaceId));
-        if (confirmed === null)
-          throw new Error("The sync transport returned an invalid head.");
-        const confirmedLocal = store.head();
-        if (confirmed.sequence === head.sequence && confirmed.operationSha256 === head.operationSha256 && confirmedLocal.sequence === confirmed.sequence && confirmedLocal.operationSha256 === confirmed.operationSha256) {
-          return settled(confirmed, round);
-        }
-      }
-    }
+function verifyOhDependencyClosureV1(value) {
+  const closure = parseOhDependencyClosureV1(value);
+  return closure === null ? { ok: false, reason: "invalid-closure" } : { closure, ok: true };
+}
+function verifyOhDependencyClosureAgainstV1(value, expected) {
+  const binding = parseOhStoreBindingV1(expected.binding);
+  const head = parseOhHeadV1(expected.head);
+  if (binding === null || head === null)
+    return { ok: false, reason: "invalid-expectation" };
+  const closure = parseOhDependencyClosureV1(value);
+  if (closure === null)
+    return { ok: false, reason: "invalid-closure" };
+  if (closure.binding.bindingSha256 !== binding.bindingSha256)
+    return { ok: false, reason: "binding-mismatch" };
+  if (canonicalJson(closure.head) !== canonicalJson(head))
+    return { ok: false, reason: "head-mismatch" };
+  return { closure, ok: true, verification: "expected-authority-and-head" };
+}
+function createOhSpacePurgeReceiptV1(input) {
+  const binding = parseOhStoreBindingV1(input.binding);
+  const priorHead = parseOhHeadV1(input.priorHead);
+  const purgedAt = parseCanonicalInstantV1(input.purgedAt);
+  if (binding === null || priorHead === null || purgedAt === null || binding.profile.profileKind !== "working" || !binding.profile.capabilities.wholeSpacePurge) {
+    throw new OhProfileError("Only a bound working realm can produce a purge receipt.");
   }
-  throw new Error("Sync did not settle within maximumRounds.");
-}
-function rowValue(row, key, index) {
-  return Array.isArray(row) ? row[index] : row[key];
-}
-function createLibSqlOperationSyncTransportV1(client) {
-  let ready = null;
-  const setup = async (manifest) => {
-    if (parseOhContractManifestV1(manifest) === null)
-      throw new Error("Unsupported contract manifest.");
-    await client.batch([
-      { sql: `CREATE TABLE IF NOT EXISTS oh_sync_contracts (
-        contract_id TEXT PRIMARY KEY, contract_sha256 TEXT NOT NULL, manifest_json TEXT NOT NULL
-      ) STRICT` },
-      { sql: `CREATE TABLE IF NOT EXISTS oh_sync_operations (
-        space_id TEXT NOT NULL, sequence INTEGER NOT NULL, operation_sha256 TEXT NOT NULL UNIQUE,
-        operation_json TEXT NOT NULL, PRIMARY KEY(space_id, sequence)
-      ) STRICT` },
-      {
-        sql: "INSERT INTO oh_sync_contracts(contract_id, contract_sha256, manifest_json) VALUES (?, ?, ?) ON CONFLICT(contract_id) DO NOTHING",
-        args: [manifest.contractId, manifest.contractSha256, canonicalJson(manifest)]
-      }
-    ], "write");
-    const result = await client.execute({
-      sql: "SELECT contract_sha256, manifest_json FROM oh_sync_contracts WHERE contract_id = ?",
-      args: [manifest.contractId]
-    });
-    const row = result.rows[0];
-    if (row === undefined || rowValue(row, "contract_sha256", 0) !== manifest.contractSha256 || rowValue(row, "manifest_json", 1) !== canonicalJson(manifest)) {
-      throw new Error("Remote contract manifest mismatch.");
-    }
-  };
-  const ensure = (manifest = OH_CONTRACT_MANIFEST_V1) => {
-    ready ??= setup(manifest).catch((error) => {
-      ready = null;
-      throw error;
-    });
-    return ready;
-  };
-  const head = async (spaceId) => {
-    await ensure();
-    const result = await client.execute({ sql: `SELECT sequence, operation_sha256 FROM oh_sync_operations
-      WHERE space_id = ? ORDER BY sequence DESC LIMIT 1`, args: [spaceId] });
-    const row = result.rows[0];
-    if (row === undefined)
-      return { operationSha256: null, sequence: 0, v: 1 };
-    const sequence = Number(rowValue(row, "sequence", 0));
-    const operationSha256 = parseSha256Hex(rowValue(row, "operation_sha256", 1));
-    if (!Number.isSafeInteger(sequence) || sequence < 1 || operationSha256 === null)
-      throw new Error("Invalid remote head.");
-    return { operationSha256, sequence, v: 1 };
+  const payload = {
+    bindingSha256: binding.bindingSha256,
+    priorHead,
+    purgedAt,
+    spaceId: binding.spaceId,
+    v: 1
   };
-  return {
-    handshake: async (manifest) => {
-      const parsed = parseOhContractManifestV1(manifest);
-      if (parsed === null)
-        throw new Error("Unsupported contract manifest.");
-      await ensure(parsed);
-    },
-    head,
-    pull: async (spaceId, afterSequence, limit) => {
-      const parsedSpaceId = safeCode(spaceId);
-      if (parsedSpaceId === null || !Number.isSafeInteger(afterSequence) || afterSequence < 0 || Object.is(afterSequence, -0) || !Number.isSafeInteger(limit) || limit < 1 || limit > OH_SYNC_BUNDLE_MAX_OPERATIONS_V1) {
-        throw new TypeError("Invalid sync pull request.");
-      }
-      await ensure();
-      const bundleBudget = syncIngressBundleBudgetV1(parsedSpaceId);
-      const result = await client.execute({
-        sql: `SELECT operation_json FROM (
-          SELECT sequence, operation_json,
-            row_number() OVER (ORDER BY sequence) AS ordinal,
-            sum(length(CAST(operation_json AS BLOB))) OVER (
-              ORDER BY sequence ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW
-            ) AS cumulative_bytes
-          FROM (
-            SELECT sequence, operation_json FROM oh_sync_operations
-            WHERE space_id = ? AND sequence > ? ORDER BY sequence LIMIT ?
-          )
-        ) WHERE ordinal = 1 OR cumulative_bytes + ordinal - 1 <= ? ORDER BY sequence`,
-        args: [
-          parsedSpaceId,
-          afterSequence,
-          limit,
-          bundleBudget.maximumBytes - bundleBudget.bytes
-        ]
-      });
-      const rows = result.rows;
-      if (!Array.isArray(rows) || rows.length > limit) {
-        throw new Error("Remote sync pull exceeded its requested row limit.");
+  return Object.freeze({ ...payload, receiptSha256: canonicalSha256(payload) });
+}
+function parseOhSpacePurgeReceiptV1(value) {
+  if (!isPlainRecord(value) || !hasExactKeys(value, [
+    "bindingSha256",
+    "priorHead",
+    "purgedAt",
+    "receiptSha256",
+    "spaceId",
+    "v"
+  ]) || value.v !== 1)
+    return null;
+  const bindingSha256 = parseSha256Hex(value.bindingSha256);
+  const priorHead = parseOhHeadV1(value.priorHead);
+  const purgedAt = parseCanonicalInstantV1(value.purgedAt);
+  const receiptSha256 = parseSha256Hex(value.receiptSha256);
+  const spaceId = safeCode(value.spaceId);
+  if (bindingSha256 === null || priorHead === null || purgedAt === null || receiptSha256 === null || spaceId === null)
+    return null;
+  const payload = { bindingSha256, priorHead, purgedAt, spaceId, v: 1 };
+  return canonicalSha256(payload) === receiptSha256 ? Object.freeze({ ...payload, receiptSha256 }) : null;
+}
+
+class OhSemanticBundleIngressV1 {
+  #codecs;
+  #store;
+  constructor(store, codecs) {
+    this.#store = store;
+    this.#codecs = codecs.seal();
+  }
+  async commit(value) {
+    if (!isPlainRecord(value) || !hasExactKeys(value, [
+      "actorId",
+      "expectedHead",
+      "instant",
+      "operationId",
+      "puts",
+      "tombstones",
+      "v"
+    ]) || value.v !== 1 || !Array.isArray(value.puts) || !Array.isArray(value.tombstones) || value.puts.length + value.tombstones.length < 1 || value.puts.length + value.tombstones.length > OH_GRAPH_LIMITS_V1.changesPerOperation) {
+      throw new TypeError("Invalid semantic bundle.");
+    }
+    const actorId = safeCode(value.actorId);
+    const operationId = safeCode(value.operationId);
+    const expected = value.expectedHead;
+    const instant = value.instant === null ? undefined : parseCanonicalInstantV1(value.instant);
+    if (actorId === null || operationId === null || !isPlainRecord(expected) || !hasExactKeys(expected, ["generation", "operationSha256"]) || !Number.isSafeInteger(expected.generation) || expected.generation < 0 || expected.operationSha256 !== null && parseSha256Hex(expected.operationSha256) === null || expected.generation === 0 !== (expected.operationSha256 === null) || value.instant !== null && instant === null)
+      throw new TypeError("Invalid semantic bundle identity.");
+    const changes = [];
+    for (const item of value.puts) {
+      if (!isPlainRecord(item) || !hasExactKeys(item, ["dependencies", "key", "kind", "v", "value"]) || item.v !== 1 || !Array.isArray(item.dependencies) || !OH_KNOWLEDGE_GRAPH_RECORD_KINDS_V1.some((kind) => kind === item.kind)) {
+        throw new TypeError("Invalid semantic bundle put.");
       }
-      const operations = rows.map((row) => {
-        const json = rowValue(row, "operation_json", 0);
-        if (typeof json !== "string")
-          throw new Error("Invalid remote operation JSON.");
-        if (utf8ByteLength(json) > OH_OPERATION_MAX_BYTES_V1) {
-          throw new Error("Remote operation JSON exceeds the canonical operation byte limit.");
-        }
-        const operation = parseOhOperationV1(JSON.parse(json));
-        if (operation === null || canonicalJson(operation) !== json)
-          throw new Error("Invalid remote operation.");
-        return operation;
+      const parsed = this.#codecs.parseRequired(item.kind, item.value);
+      if (parsed === null)
+        throw new TypeError(`The ${String(item.kind)} codec rejected a semantic value.`);
+      const record = createKnowledgeGraphRecordV1({
+        dependencies: item.dependencies,
+        key: item.key,
+        kind: item.kind,
+        v: 1,
+        value: parsed
       });
-      return createOhSyncBundleV1(parsedSpaceId, operations);
-    },
-    push: async (value) => {
-      await ensure();
-      const bundle = parseOhSyncBundleV1(value);
-      if (bundle === null)
-        throw new Error("Invalid outgoing sync bundle.");
-      if (bundle.operations.length === 0)
-        return head(bundle.spaceId);
-      const remote = await head(bundle.spaceId);
-      const first = bundle.operations[0];
-      const last = bundle.operations.at(-1);
-      if (remote.sequence >= last.sequence) {
-        const result = await client.execute({ sql: `SELECT sequence, operation_sha256, operation_json
-          FROM oh_sync_operations WHERE space_id = ? AND sequence >= ? AND sequence <= ?
-          ORDER BY sequence LIMIT ?`, args: [
-          bundle.spaceId,
-          first.sequence,
-          last.sequence,
-          bundle.operations.length
-        ] });
-        const rows = result.rows;
-        if (!Array.isArray(rows) || rows.length !== bundle.operations.length) {
-          throw new Error("Sync conflict: remote history does not contain the exact pushed operations.");
-        }
-        for (let index = 0;index < bundle.operations.length; index += 1) {
-          const operation = bundle.operations[index];
-          const row = rows[index];
-          if (row === undefined) {
-            throw new Error("Sync conflict: remote history does not contain the exact pushed operations.");
-          }
-          const sequence = Number(rowValue(row, "sequence", 0));
-          const operationSha256 = parseSha256Hex(rowValue(row, "operation_sha256", 1));
-          const operationJson = rowValue(row, "operation_json", 2);
-          const expectedJson = canonicalJson(operation);
-          if (sequence !== operation.sequence || operationSha256 !== operation.operationSha256 || typeof operationJson !== "string" || utf8ByteLength(operationJson) > OH_OPERATION_MAX_BYTES_V1 || operationJson !== expectedJson) {
-            throw new Error("Sync conflict: remote history differs from the pushed operations.");
-          }
-        }
-        return { operationSha256: last.operationSha256, sequence: last.sequence, v: 1 };
-      }
-      if (first.sequence !== remote.sequence + 1 || first.parentOperationSha256 !== remote.operationSha256) {
-        throw new Error("Sync conflict: pushed history does not extend the remote head.");
+      changes.push({ kind: "put", record, v: 1 });
+    }
+    for (const item of value.tombstones) {
+      if (!isPlainRecord(item) || !hasExactKeys(item, ["key", "priorSha256", "v"]) || item.v !== 1) {
+        throw new TypeError("Invalid semantic bundle tombstone.");
       }
-      await client.batch(bundle.operations.map((operation) => ({
-        sql: "INSERT INTO oh_sync_operations(space_id, sequence, operation_sha256, operation_json) VALUES (?, ?, ?, ?)",
-        args: [bundle.spaceId, operation.sequence, operation.operationSha256, canonicalJson(operation)]
-      })), "write");
-      return { operationSha256: last.operationSha256, sequence: last.sequence, v: 1 };
+      const priorSha256 = parseSha256Hex(item.priorSha256);
+      if (typeof item.key !== "string" || priorSha256 === null)
+        throw new TypeError("Invalid semantic bundle tombstone.");
+      changes.push({ key: item.key, kind: "tombstone", priorSha256, v: 1 });
     }
-  };
+    const canonical = canonicalKnowledgeGraphChangesV1(changes);
+    return await this.#store.commit({
+      actorId,
+      changes: canonical,
+      expectedHead: {
+        generation: expected.generation,
+        operationSha256: expected.operationSha256
+      },
+      ...typeof instant === "string" ? { instant } : {},
+      operationId
+    });
+  }
 }
 
-// src/sqlite/driver.ts
-import { existsSync } from "fs";
-import { Database } from "bun:sqlite";
-
-// src/sqlite/runtime.ts
-var MACOS_SQLITE_LIBRARY_CANDIDATES = Object.freeze([
-  "/opt/homebrew/opt/sqlite/lib/libsqlite3.dylib",
-  "/usr/local/opt/sqlite/lib/libsqlite3.dylib"
-]);
-function macosSqliteLibraryCandidates() {
-  return MACOS_SQLITE_LIBRARY_CANDIDATES;
-}
-function createOhSqliteRuntime(dependencies) {
-  let customLibrary = null;
-  if (dependencies.platform === "darwin") {
-    for (const candidate of macosSqliteLibraryCandidates()) {
-      if (!dependencies.exists(candidate))
-        continue;
-      try {
-        if (!dependencies.setCustomSQLite(candidate))
-          continue;
-        customLibrary = candidate;
-        break;
-      } catch {}
+// src/sync-model.ts
+import { isProxy } from "util/types";
+var OH_SYNC_PROTOCOL_V1 = "oh.sync.v1";
+var OH_SYNC_BUNDLE_MAX_OPERATIONS_V1 = 1000;
+var OH_SYNC_BUNDLE_KEYS_V1 = [
+  "bundleSha256",
+  "contractSha256",
+  "operations",
+  "protocol",
+  "spaceId",
+  "v"
+];
+var OH_SYNC_HEAD_KEYS_V1 = ["operationSha256", "sequence", "v"];
+var OH_SYNC_HEAD_REF_KEYS_V1 = ["operationSha256", "sequence"];
+var OH_OPERATION_KEYS_V1 = [
+  "actorId",
+  "changes",
+  "contractId",
+  "graphRevisionSha256",
+  "instant",
+  "operationId",
+  "operationSha256",
+  "parentOperationSha256",
+  "recordsSha256",
+  "sequence",
+  "spaceId",
+  "v"
+];
+var OH_PUT_CHANGE_KEYS_V1 = ["kind", "record", "v"];
+var OH_TOMBSTONE_CHANGE_KEYS_V1 = ["key", "kind", "priorSha256", "v"];
+var OH_RECORD_KEYS_V1 = ["dependencies", "key", "kind", "recordSha256", "v", "value"];
+var OH_SYNC_INGRESS_VALUE_DEPTH_V1 = 128;
+var OH_SYNC_INGRESS_VALUE_NODES_V1 = OH_GRAPH_LIMITS_V1.recordBytes;
+var OH_SYNC_INGRESS_OPERATION_DEPTH_V1 = OH_SYNC_INGRESS_VALUE_DEPTH_V1 + 4;
+var OH_SYNC_INGRESS_OPERATION_NODES_V1 = OH_OPERATION_MAX_BYTES_V1;
+var OH_SYNC_BUNDLE_MAX_BYTES_V1 = OH_OPERATION_MAX_BYTES_V1 + 4 * 1024;
+var OH_SYNC_INGRESS_BUNDLE_NODES_V1 = OH_SYNC_INGRESS_OPERATION_NODES_V1 + 4 * 1024;
+function exactDataRecordV1(value, expectedKeys) {
+  try {
+    if (typeof value !== "object" || value === null || Array.isArray(value) || isProxy(value))
+      return null;
+    const prototype = Object.getPrototypeOf(value);
+    const keys = Reflect.ownKeys(value);
+    if (prototype !== Object.prototype && prototype !== null || keys.length !== expectedKeys.length || keys.some((key) => typeof key !== "string") || expectedKeys.some((key) => !keys.includes(key)))
+      return null;
+    const detached = Object.create(null);
+    for (const key of expectedKeys) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (descriptor === undefined || !descriptor.enumerable || descriptor.get !== undefined || descriptor.set !== undefined)
+        return null;
+      Object.defineProperty(detached, key, {
+        configurable: false,
+        enumerable: true,
+        value: descriptor.value,
+        writable: false
+      });
     }
+    return detached;
+  } catch {
+    return null;
   }
-  return Object.freeze({
-    customLibrary,
-    open: (path) => dependencies.open(path, { create: true, strict: true })
-  });
-}
-
-// src/sqlite/driver.ts
-var SQLITE_RUNTIME = createOhSqliteRuntime({
-  exists: existsSync,
-  open: (path, options) => new Database(path, options),
-  platform: process.platform,
-  setCustomSQLite: (path) => Database.setCustomSQLite(path)
-});
-function openOhSqliteDatabase(path) {
-  const database = SQLITE_RUNTIME.open(path);
-  database.exec("PRAGMA foreign_keys = ON");
-  database.exec("PRAGMA journal_mode = WAL");
-  database.exec("PRAGMA synchronous = NORMAL");
-  database.exec("PRAGMA busy_timeout = 5000");
-  database.exec("PRAGMA trusted_schema = OFF");
-  return database;
 }
-function withImmediateTransaction(database, work) {
-  database.exec("BEGIN IMMEDIATE");
+function exactDataArrayV1(value, maximumLength, clone = true) {
   try {
-    const result = work();
-    database.exec("COMMIT");
-    return result;
-  } catch (error) {
-    try {
-      database.exec("ROLLBACK");
-    } catch {}
-    throw error;
-  }
-}
-function withReadTransaction(database, work) {
-  database.exec("BEGIN");
-  try {
-    const result = work();
-    database.exec("COMMIT");
-    return result;
-  } catch (error) {
-    try {
-      database.exec("ROLLBACK");
-    } catch {}
-    throw error;
-  }
-}
-// src/sqlite/migrations.ts
-var OH_SQLITE_SCHEMA_VERSION = 2;
-var OH_SQLITE_MIGRATIONS = Object.freeze([
-  Object.freeze({
-    name: "0001_oh_core",
-    version: 1,
-    sql: `
-CREATE TABLE oh_contracts (
-  contract_id TEXT PRIMARY KEY,
-  contract_sha256 TEXT NOT NULL CHECK(length(contract_sha256) = 64),
-  manifest_json TEXT NOT NULL CHECK(json_valid(manifest_json)),
-  created_at TEXT NOT NULL
-) STRICT;
-
-CREATE TABLE oh_spaces (
-  space_id TEXT PRIMARY KEY,
-  contract_id TEXT NOT NULL REFERENCES oh_contracts(contract_id),
-  generation INTEGER NOT NULL CHECK(generation >= 0),
-  head_operation_sha256 TEXT CHECK(head_operation_sha256 IS NULL OR length(head_operation_sha256) = 64),
-  graph_revision_sha256 TEXT CHECK(graph_revision_sha256 IS NULL OR length(graph_revision_sha256) = 64),
-  records_sha256 TEXT NOT NULL CHECK(length(records_sha256) = 64),
-  sequence INTEGER NOT NULL CHECK(sequence >= 0),
-  created_at TEXT NOT NULL,
-  updated_at TEXT NOT NULL,
-  CHECK(generation = sequence),
-  CHECK((sequence = 0) = (head_operation_sha256 IS NULL)),
-  CHECK((sequence = 0) = (graph_revision_sha256 IS NULL))
-) STRICT;
-
-CREATE TABLE oh_operations (
-  operation_sha256 TEXT PRIMARY KEY CHECK(length(operation_sha256) = 64),
-  space_id TEXT NOT NULL REFERENCES oh_spaces(space_id),
-  sequence INTEGER NOT NULL CHECK(sequence > 0),
-  operation_id TEXT NOT NULL,
-  parent_operation_sha256 TEXT CHECK(parent_operation_sha256 IS NULL OR length(parent_operation_sha256) = 64),
-  graph_revision_sha256 TEXT NOT NULL CHECK(length(graph_revision_sha256) = 64),
-  records_sha256 TEXT NOT NULL CHECK(length(records_sha256) = 64),
-  operation_json TEXT NOT NULL CHECK(json_valid(operation_json)),
-  instant TEXT NOT NULL,
-  UNIQUE(space_id, sequence),
-  UNIQUE(space_id, operation_id)
-) STRICT;
-
-CREATE TABLE oh_operation_records (
-  operation_sha256 TEXT NOT NULL REFERENCES oh_operations(operation_sha256),
-  ordinal INTEGER NOT NULL CHECK(ordinal >= 0),
-  record_key TEXT NOT NULL,
-  change_kind TEXT NOT NULL CHECK(change_kind IN ('put', 'tombstone')),
-  record_sha256 TEXT CHECK(record_sha256 IS NULL OR length(record_sha256) = 64),
-  PRIMARY KEY(operation_sha256, ordinal),
-  UNIQUE(operation_sha256, record_key)
-) STRICT;
-
-CREATE TABLE oh_records (
-  space_id TEXT NOT NULL REFERENCES oh_spaces(space_id),
-  record_key TEXT NOT NULL,
-  kind TEXT NOT NULL,
-  record_sha256 TEXT NOT NULL CHECK(length(record_sha256) = 64),
-  record_json TEXT NOT NULL CHECK(json_valid(record_json)),
-  operation_sha256 TEXT NOT NULL REFERENCES oh_operations(operation_sha256),
-  sequence INTEGER NOT NULL CHECK(sequence > 0),
-  PRIMARY KEY(space_id, record_key)
-) STRICT;
-
-CREATE TABLE oh_dependencies (
-  space_id TEXT NOT NULL,
-  record_key TEXT NOT NULL,
-  dependency_key TEXT NOT NULL,
-  PRIMARY KEY(space_id, record_key, dependency_key),
-  FOREIGN KEY(space_id, record_key) REFERENCES oh_records(space_id, record_key) ON DELETE CASCADE,
-  FOREIGN KEY(space_id, dependency_key) REFERENCES oh_records(space_id, record_key)
-) STRICT;
-
-CREATE TABLE oh_sync_outbox (
-  space_id TEXT NOT NULL REFERENCES oh_spaces(space_id),
-  sequence INTEGER NOT NULL,
-  operation_sha256 TEXT NOT NULL REFERENCES oh_operations(operation_sha256),
-  PRIMARY KEY(space_id, sequence),
-  UNIQUE(operation_sha256)
-) STRICT;
-
-CREATE TABLE oh_sync_state (
-  remote_id TEXT NOT NULL,
-  space_id TEXT NOT NULL REFERENCES oh_spaces(space_id),
-  pulled_sequence INTEGER NOT NULL CHECK(pulled_sequence >= 0),
-  pushed_sequence INTEGER NOT NULL CHECK(pushed_sequence >= 0),
-  remote_head_sha256 TEXT CHECK(remote_head_sha256 IS NULL OR length(remote_head_sha256) = 64),
-  updated_at TEXT NOT NULL,
-  PRIMARY KEY(remote_id, space_id)
-) STRICT;
-
-CREATE TABLE oh_search_documents (
-  space_id TEXT NOT NULL,
-  record_key TEXT NOT NULL,
-  record_sha256 TEXT NOT NULL CHECK(length(record_sha256) = 64),
-  text TEXT NOT NULL,
-  PRIMARY KEY(space_id, record_key),
-  FOREIGN KEY(space_id, record_key) REFERENCES oh_records(space_id, record_key) ON DELETE CASCADE
-) STRICT;
-
-CREATE VIRTUAL TABLE oh_search_fts USING fts5(
-  space_id UNINDEXED,
-  record_key UNINDEXED,
-  text,
-  tokenize='unicode61 remove_diacritics 2'
-);
-
-CREATE INDEX oh_operations_space_sequence ON oh_operations(space_id, sequence);
-CREATE INDEX oh_records_space_kind ON oh_records(space_id, kind, record_key);
-CREATE INDEX oh_dependencies_dependency ON oh_dependencies(space_id, dependency_key);
-`
-  }),
-  Object.freeze({
-    name: "0002_store_realms",
-    version: 2,
-    sql: `
-CREATE TABLE oh_space_bindings (
-  space_id TEXT PRIMARY KEY REFERENCES oh_spaces(space_id),
-  realm_id TEXT NOT NULL,
-  profile_id TEXT NOT NULL,
-  profile_kind TEXT NOT NULL CHECK(profile_kind IN ('canonical', 'working')),
-  profile_sha256 TEXT NOT NULL CHECK(length(profile_sha256) = 64),
-  binding_sha256 TEXT NOT NULL UNIQUE CHECK(length(binding_sha256) = 64),
-  binding_json TEXT NOT NULL CHECK(json_valid(binding_json)),
-  created_at TEXT NOT NULL
-) STRICT;
-
-CREATE TABLE oh_space_purges (
-  space_id TEXT PRIMARY KEY,
-  binding_sha256 TEXT NOT NULL CHECK(length(binding_sha256) = 64),
-  prior_operation_sha256 TEXT CHECK(prior_operation_sha256 IS NULL OR length(prior_operation_sha256) = 64),
-  prior_sequence INTEGER NOT NULL CHECK(prior_sequence >= 0),
-  purged_at TEXT NOT NULL,
-  receipt_sha256 TEXT NOT NULL UNIQUE CHECK(length(receipt_sha256) = 64),
-  receipt_json TEXT NOT NULL CHECK(json_valid(receipt_json))
-) STRICT;
-`
-  })
-]);
-function applyOhSqliteMigrations(database) {
-  database.exec(`CREATE TABLE IF NOT EXISTS oh_migrations (
-    version INTEGER PRIMARY KEY,
-    name TEXT NOT NULL UNIQUE,
-    migration_sha256 TEXT NOT NULL CHECK(length(migration_sha256) = 64),
-    applied_at TEXT NOT NULL
-  ) STRICT`);
-  const select = database.query("SELECT name, migration_sha256 FROM oh_migrations WHERE version = ?");
-  const insert = database.query("INSERT INTO oh_migrations(version, name, migration_sha256, applied_at) VALUES (?, ?, ?, ?)");
-  for (const migration of OH_SQLITE_MIGRATIONS) {
-    const digest = sha256Hex(migration.sql);
-    database.exec("BEGIN IMMEDIATE");
-    try {
-      const existing = select.get(migration.version);
-      if (existing !== null) {
-        if (existing.name !== migration.name || existing.migration_sha256 !== digest) {
-          throw new Error(`SQLite migration ${migration.version} does not match the applied migration.`);
-        }
-      } else {
-        database.exec(migration.sql);
-        insert.run(migration.version, migration.name, digest, canonicalNow());
-      }
-      database.exec("COMMIT");
-    } catch (error) {
-      try {
-        database.exec("ROLLBACK");
-      } catch {}
-      throw error;
-    }
-  }
-}
-// src/sqlite/port.ts
-import { isProxy as isProxy2 } from "util/types";
-// src/store.ts
-var OH_CANONICAL_STORE_PROFILE_V1 = createOhStoreProfileV1({
-  applicationProfileSha256: null,
-  capabilities: {
-    changesSince: true,
-    dependencyClosureExport: true,
-    exactSnapshots: true,
-    operationReplication: true,
-    semanticBundleCommit: true,
-    v: 1,
-    wholeSpacePurge: false
-  },
-  profileId: "oh.store.canonical.v1",
-  profileKind: "canonical",
-  v: 1
-});
-var OH_WORKING_STORE_PROFILE_V1 = createOhStoreProfileV1({
-  applicationProfileSha256: null,
-  capabilities: {
-    changesSince: true,
-    dependencyClosureExport: true,
-    exactSnapshots: true,
-    operationReplication: false,
-    semanticBundleCommit: true,
-    v: 1,
-    wholeSpacePurge: true
-  },
-  profileId: "oh.store.working.v1",
-  profileKind: "working",
-  v: 1
-});
-var OH_DEPENDENCY_CLOSURE_LIMITS_V1 = Object.freeze({
-  bytes: 64 * 1024 * 1024,
-  records: 8192,
-  roots: 1024
-});
-
-class OhPurgedSpaceError extends Error {
-  receipt;
-  constructor(receipt) {
-    super(`Oh space ${receipt.spaceId} was purged at ${receipt.purgedAt}.`);
-    this.name = "OhPurgedSpaceError";
-    this.receipt = receipt;
-  }
-}
-var EMPTY_RECORDS_SHA256 = canonicalSha256([]);
-function emptyOhHeadV1() {
-  return {
-    generation: 0,
-    graphRevisionSha256: null,
-    operationSha256: null,
-    recordsSha256: EMPTY_RECORDS_SHA256,
-    sequence: 0,
-    v: 1
-  };
-}
-function parseOhHeadV1(value) {
-  if (!isPlainRecord(value) || !hasExactKeys(value, [
-    "generation",
-    "graphRevisionSha256",
-    "operationSha256",
-    "recordsSha256",
-    "sequence",
-    "v"
-  ]) || value.v !== 1)
-    return null;
-  const graphRevisionSha256 = value.graphRevisionSha256 === null ? null : parseSha256Hex(value.graphRevisionSha256);
-  const operationSha256 = value.operationSha256 === null ? null : parseSha256Hex(value.operationSha256);
-  const recordsSha256 = parseSha256Hex(value.recordsSha256);
-  const generation = Number.isSafeInteger(value.generation) && value.generation >= 0 ? value.generation : null;
-  const sequence = Number.isSafeInteger(value.sequence) && value.sequence >= 0 ? value.sequence : null;
-  return generation !== null && sequence !== null && generation === sequence && recordsSha256 !== null && (value.graphRevisionSha256 === null || graphRevisionSha256 !== null) && (value.operationSha256 === null || operationSha256 !== null) && sequence === 0 === (operationSha256 === null) && sequence === 0 === (graphRevisionSha256 === null) ? { generation, graphRevisionSha256, operationSha256, recordsSha256, sequence, v: 1 } : null;
-}
-function parseOhHeadRefV1(value) {
-  const complete = parseOhHeadV1(value);
-  if (complete !== null) {
-    return { operationSha256: complete.operationSha256, sequence: complete.sequence };
-  }
-  if (!isPlainRecord(value) || !hasExactKeys(value, ["operationSha256", "sequence"]))
-    return null;
-  const operationSha256 = value.operationSha256 === null ? null : parseSha256Hex(value.operationSha256);
-  const sequence = Number.isSafeInteger(value.sequence) && value.sequence >= 0 ? value.sequence : null;
-  return sequence !== null && (value.operationSha256 === null || operationSha256 !== null) && sequence === 0 === (operationSha256 === null) ? { operationSha256, sequence } : null;
-}
-function parseCapabilities(value) {
-  if (!isPlainRecord(value) || !hasExactKeys(value, [
-    "changesSince",
-    "dependencyClosureExport",
-    "exactSnapshots",
-    "operationReplication",
-    "semanticBundleCommit",
-    "v",
-    "wholeSpacePurge"
-  ]) || value.changesSince !== true || value.dependencyClosureExport !== true || value.exactSnapshots !== true || typeof value.operationReplication !== "boolean" || value.semanticBundleCommit !== true || value.v !== 1 || typeof value.wholeSpacePurge !== "boolean")
-    return null;
-  return {
-    changesSince: true,
-    dependencyClosureExport: true,
-    exactSnapshots: true,
-    operationReplication: value.operationReplication,
-    semanticBundleCommit: true,
-    v: 1,
-    wholeSpacePurge: value.wholeSpacePurge
-  };
-}
-function createOhStoreProfileV1(input) {
-  if (!isPlainRecord(input) || !hasExactKeys(input, [
-    "applicationProfileSha256",
-    "capabilities",
-    "profileId",
-    "profileKind",
-    "v"
-  ]) || input.v !== 1)
-    throw new TypeError("Invalid Oh store profile input.");
-  const profileId = safeCode(input.profileId);
-  const applicationProfileSha256 = input.applicationProfileSha256 === null ? null : parseSha256Hex(input.applicationProfileSha256);
-  const capabilities = parseCapabilities(input.capabilities);
-  if (profileId === null || capabilities === null || input.applicationProfileSha256 !== null && applicationProfileSha256 === null || input.profileKind !== "canonical" && input.profileKind !== "working") {
-    throw new TypeError("Invalid Oh store profile input.");
-  }
-  if (input.profileKind === "working" && (capabilities.operationReplication || !capabilities.wholeSpacePurge)) {
-    throw new OhProfileError("A working profile must disable operation replication and permit whole-space purge.");
-  }
-  if (input.profileKind === "canonical" && capabilities.wholeSpacePurge) {
-    throw new OhProfileError("A canonical profile cannot permit whole-space purge.");
-  }
-  const payload = {
-    applicationProfileSha256,
-    capabilities: Object.freeze(capabilities),
-    profileId,
-    profileKind: input.profileKind,
-    v: 1
-  };
-  return Object.freeze({ ...payload, profileSha256: canonicalSha256(payload) });
-}
-function parseOhStoreProfileV1(value) {
-  if (!isPlainRecord(value) || !Object.hasOwn(value, "profileSha256"))
-    return null;
-  const digest = parseSha256Hex(value.profileSha256);
-  const { profileSha256: _profileSha256, ...input } = value;
-  try {
-    const created = createOhStoreProfileV1(input);
-    return digest !== null && created.profileSha256 === digest ? created : null;
-  } catch {
-    return null;
-  }
-}
-function createOhStoreBindingV1(input) {
-  const profile = parseOhStoreProfileV1(input.profile);
-  const realmId = safeCode(input.realmId);
-  const spaceId = safeCode(input.spaceId);
-  if (input.v !== 1 || profile === null || realmId === null || spaceId === null) {
-    throw new TypeError("Invalid Oh store binding input.");
-  }
-  const payload = {
-    contractSha256: OH_CONTRACT_MANIFEST_V1.contractSha256,
-    profile,
-    realmId,
-    spaceId,
-    v: 1
-  };
-  return Object.freeze({ ...payload, bindingSha256: canonicalSha256(payload) });
-}
-function parseOhStoreBindingV1(value) {
-  if (!isPlainRecord(value) || !hasExactKeys(value, [
-    "bindingSha256",
-    "contractSha256",
-    "profile",
-    "realmId",
-    "spaceId",
-    "v"
-  ]) || value.v !== 1 || value.contractSha256 !== OH_CONTRACT_MANIFEST_V1.contractSha256)
-    return null;
-  const bindingSha256 = parseSha256Hex(value.bindingSha256);
-  const profile = parseOhStoreProfileV1(value.profile);
-  try {
-    if (bindingSha256 === null || profile === null)
-      return null;
-    const created = createOhStoreBindingV1({
-      profile,
-      realmId: value.realmId,
-      spaceId: value.spaceId,
-      v: 1
-    });
-    return created.bindingSha256 === bindingSha256 ? created : null;
-  } catch {
-    return null;
-  }
-}
-function sortedRecords(records) {
-  return [...records].sort((left, right) => left.key < right.key ? -1 : left.key > right.key ? 1 : 0);
-}
-function verifyDependencies(records) {
-  for (const record of records.values()) {
-    for (const dependency of record.dependencies) {
-      if (!records.has(dependency))
-        throw new OhDependencyError(`Missing dependency ${dependency} for ${record.key}.`);
-    }
-  }
-}
-function replayOhOperationsV1(spaceId, values, maximumRecords = OH_GRAPH_LIMITS_V1.recordsPerSnapshot) {
-  const parsedSpaceId = safeCode(spaceId);
-  if (parsedSpaceId === null || !Number.isSafeInteger(maximumRecords) || maximumRecords < 1 || maximumRecords > OH_GRAPH_LIMITS_V1.recordsPerSnapshot) {
-    throw new TypeError("Invalid operation replay input.");
-  }
-  const records = new Map;
-  const operationIds = new Set;
-  let head = emptyOhHeadV1();
-  for (const value of values) {
-    const operation = parseOhOperationV1(value);
-    if (operation === null || operation.spaceId !== parsedSpaceId || operation.sequence !== head.sequence + 1 || operation.parentOperationSha256 !== head.operationSha256 || operationIds.has(operation.operationId)) {
-      throw new OhIntegrityError("Operation replay chain is broken.");
-    }
-    operationIds.add(operation.operationId);
-    for (const change of operation.changes) {
-      if (change.kind === "put")
-        records.set(change.record.key, change.record);
-      else {
-        const prior = records.get(change.key);
-        if (prior?.recordSha256 !== change.priorSha256) {
-          throw new OhIntegrityError("Replay tombstone does not match its prior record.");
-        }
-        records.delete(change.key);
-      }
-    }
-    if (records.size > maximumRecords)
-      throw new RangeError("Operation replay exceeds its record bound.");
-    verifyDependencies(records);
-    const refs = sortedRecords(records.values()).map(knowledgeGraphRecordRefV1);
-    const recordsSha256 = canonicalSha256(refs);
-    const graphRevisionSha256 = graphRevisionSha256V1({
-      changes: operation.changes,
-      operationId: operation.operationId,
-      parentGraphRevisionSha256: head.graphRevisionSha256,
-      recordsSha256,
-      revision: operation.sequence
-    });
-    if (recordsSha256 !== operation.recordsSha256 || graphRevisionSha256 !== operation.graphRevisionSha256) {
-      throw new OhIntegrityError("Replay does not reproduce an operation head.");
-    }
-    head = {
-      generation: operation.sequence,
-      graphRevisionSha256,
-      operationSha256: operation.operationSha256,
-      recordsSha256,
-      sequence: operation.sequence,
-      v: 1
-    };
-  }
-  return { head, records: sortedRecords(records.values()), v: 1 };
-}
-function transitionOhSnapshotV1(input) {
-  const actorId = safeCode(input.actorId);
-  const operationId = safeCode(input.operationId);
-  const spaceId = safeCode(input.spaceId);
-  const instant = parseCanonicalInstantV1(input.instant);
-  const changes = canonicalKnowledgeGraphChangesV1(input.changes);
-  if (actorId === null || operationId === null || spaceId === null || instant === null || changes.length === 0 || changes.length > OH_GRAPH_LIMITS_V1.changesPerOperation) {
-    throw new TypeError("Invalid graph transition input.");
-  }
-  const head = parseOhHeadV1(input.snapshot.head);
-  if (input.snapshot.v !== 1 || head === null || !Array.isArray(input.snapshot.records)) {
-    throw new OhIntegrityError("The transition snapshot is invalid.");
-  }
-  const records = new Map;
-  for (const value of input.snapshot.records) {
-    const record = parseKnowledgeGraphRecordV1(value);
-    if (record === null || records.has(record.key)) {
-      throw new OhIntegrityError("The transition snapshot contains an invalid record.");
-    }
-    records.set(record.key, record);
-  }
-  verifyDependencies(records);
-  const priorRecordsSha256 = canonicalSha256(sortedRecords(records.values()).map(knowledgeGraphRecordRefV1));
-  if (priorRecordsSha256 !== head.recordsSha256) {
-    throw new OhIntegrityError("The transition snapshot does not reproduce its head.");
-  }
-  for (const change of changes) {
-    if (change.kind === "put")
-      records.set(change.record.key, change.record);
-    else {
-      const prior = records.get(change.key);
-      if (prior === undefined || prior.recordSha256 !== change.priorSha256) {
-        throw new OhConflictError(`The prior digest for ${change.key} does not match the snapshot.`);
-      }
-      records.delete(change.key);
-    }
-  }
-  if (records.size > OH_GRAPH_LIMITS_V1.recordsPerSnapshot) {
-    throw new RangeError("Graph transition exceeds its record snapshot limit.");
-  }
-  verifyDependencies(records);
-  const nextRecords = sortedRecords(records.values());
-  const recordsSha256 = canonicalSha256(nextRecords.map(knowledgeGraphRecordRefV1));
-  const graphRevisionSha256 = graphRevisionSha256V1({
-    changes,
-    operationId,
-    parentGraphRevisionSha256: head.graphRevisionSha256,
-    recordsSha256,
-    revision: head.sequence + 1
-  });
-  const operation = createOhOperationV1({
-    actorId,
-    changes,
-    contractId: OH_CONTRACT_MANIFEST_V1.contractId,
-    graphRevisionSha256,
-    instant,
-    operationId,
-    parentOperationSha256: head.operationSha256,
-    recordsSha256,
-    sequence: head.sequence + 1,
-    spaceId,
-    v: 1
-  }, input.maximumOperationBytes === undefined ? {} : {
-    maximumOperationBytes: input.maximumOperationBytes
-  });
-  const nextHead = {
-    generation: operation.sequence,
-    graphRevisionSha256,
-    operationSha256: operation.operationSha256,
-    recordsSha256,
-    sequence: operation.sequence,
-    v: 1
-  };
-  return { operation, snapshot: { head: nextHead, records: nextRecords, v: 1 } };
-}
-function normalizeRoots(values) {
-  if (!Array.isArray(values) || values.length < 1 || values.length > OH_DEPENDENCY_CLOSURE_LIMITS_V1.roots) {
-    throw new RangeError(`A dependency closure needs 1 through ${OH_DEPENDENCY_CLOSURE_LIMITS_V1.roots} roots.`);
-  }
-  const roots = values.map((value) => safeCode(value, 512));
-  if (roots.some((value) => value === null))
-    throw new TypeError("Invalid dependency closure root.");
-  const sorted = [...roots].sort();
-  if (sorted.some((value, index) => index > 0 && sorted[index - 1] === value)) {
-    throw new TypeError("Dependency closure roots must be unique.");
+    if (typeof value !== "object" || value === null || isProxy(value) || !Array.isArray(value))
+      return null;
+    const lengthDescriptor = Object.getOwnPropertyDescriptor(value, "length");
+    const length = lengthDescriptor?.value;
+    if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0 || length > maximumLength)
+      return null;
+    const keys = Reflect.ownKeys(value);
+    if (keys.length !== length + 1 || !keys.includes("length") || keys.some((key) => key !== "length" && (typeof key !== "string" || !/^(?:0|[1-9][0-9]*)$/u.test(key) || Number(key) >= length)))
+      return null;
+    const detached = clone ? [] : null;
+    for (let index = 0;index < length; index += 1) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+      if (descriptor === undefined || !descriptor.enumerable || descriptor.get !== undefined || descriptor.set !== undefined)
+        return null;
+      detached?.push(descriptor.value);
+    }
+    return detached ?? value;
+  } catch {
+    return null;
   }
-  return sorted;
 }
-function closureRecords(available, roots, maximumRecords, maximumBytes = OH_DEPENDENCY_CLOSURE_LIMITS_V1.bytes - 64 * 1024) {
-  const selected = new Map;
-  const pending = [...roots];
-  let selectedBytes = 0;
-  while (pending.length > 0) {
-    const key = pending.pop();
-    if (selected.has(key))
+function stagedSyncOperationV1(value, bundleBudget) {
+  const operation = exactDataRecordV1(value, OH_OPERATION_KEYS_V1);
+  if (operation === null || operation.v !== 1 || operation.contractId !== OH_CONTRACT_ID_V1 || safeCode(operation.actorId) === null || safeCode(operation.operationId) === null || safeCode(operation.spaceId) === null || parseCanonicalInstantV1(operation.instant) === null || parseSha256Hex(operation.operationSha256) === null || parseSha256Hex(operation.graphRevisionSha256) === null || parseSha256Hex(operation.recordsSha256) === null)
+    return null;
+  const parentOperationSha256 = operation.parentOperationSha256 === null ? null : parseSha256Hex(operation.parentOperationSha256);
+  const sequence = Number.isSafeInteger(operation.sequence) && operation.sequence > 0 ? operation.sequence : null;
+  if (sequence === null || operation.parentOperationSha256 !== null && parentOperationSha256 === null || sequence === 1 !== (parentOperationSha256 === null))
+    return null;
+  const changes = exactDataArrayV1(operation.changes, OH_GRAPH_LIMITS_V1.changesPerOperation, false);
+  if (changes === null || changes.length === 0)
+    return null;
+  const aggregateDataBudget = {
+    bytes: 0,
+    maximumBytes: OH_OPERATION_MAX_BYTES_V1,
+    maximumNodes: OH_SYNC_INGRESS_OPERATION_NODES_V1,
+    nodes: 0
+  };
+  for (const change of changes) {
+    const put = exactDataRecordV1(change, OH_PUT_CHANGE_KEYS_V1);
+    if (put !== null && put.kind === "put" && put.v === 1) {
+      const record = exactDataRecordV1(put.record, OH_RECORD_KEYS_V1);
+      if (record === null)
+        return null;
+      const valuePreflight = preflightSyncIngressValueV1(record.value, aggregateDataBudget);
+      const dependenciesPreflight = preflightSyncIngressDependenciesV1(record.dependencies, aggregateDataBudget);
+      if (valuePreflight === null || dependenciesPreflight === null)
+        return null;
       continue;
-    const record = available.get(key);
-    if (record === undefined)
-      throw new OhDependencyError(`Dependency closure record ${key} is missing.`);
-    selectedBytes += Buffer.byteLength(canonicalJson(record), "utf8") + 1;
-    if (selectedBytes > maximumBytes)
-      throw new RangeError("Dependency closure exceeds its canonical byte bound.");
-    selected.set(key, record);
-    if (selected.size > maximumRecords)
-      throw new RangeError("Dependency closure exceeds its record bound.");
-    pending.push(...record.dependencies);
+    }
+    const tombstone = exactDataRecordV1(change, OH_TOMBSTONE_CHANGE_KEYS_V1);
+    if (tombstone === null || tombstone.kind !== "tombstone" || tombstone.v !== 1)
+      return null;
   }
-  return sortedRecords(selected.values());
+  const detached = boundedSyncIngressV1(operation, {
+    maximumBytes: OH_OPERATION_MAX_BYTES_V1,
+    maximumDepth: OH_SYNC_INGRESS_OPERATION_DEPTH_V1,
+    maximumNodes: OH_SYNC_INGRESS_OPERATION_NODES_V1
+  }, bundleBudget, true);
+  return detached === null ? null : detached.value;
 }
-function createOhDependencyClosureV1(input) {
-  const binding = parseOhStoreBindingV1(input.binding);
-  const head = parseOhHeadV1(input.snapshot.head);
-  const maximumRecords = input.maximumRecords ?? OH_DEPENDENCY_CLOSURE_LIMITS_V1.records;
-  if (binding === null || head === null || !Number.isSafeInteger(maximumRecords) || maximumRecords < 1 || maximumRecords > OH_DEPENDENCY_CLOSURE_LIMITS_V1.records) {
-    throw new TypeError("Invalid dependency closure input.");
-  }
-  const roots = normalizeRoots(input.roots);
-  const available = new Map;
-  for (const value of input.snapshot.records) {
-    const record = parseKnowledgeGraphRecordV1(value);
-    if (record === null || available.has(record.key))
-      throw new OhIntegrityError("Snapshot contains an invalid record.");
-    available.set(record.key, record);
-  }
-  const recordsSha256 = canonicalSha256(sortedRecords(available.values()).map(knowledgeGraphRecordRefV1));
-  if (recordsSha256 !== head.recordsSha256)
-    throw new OhIntegrityError("Snapshot records do not reproduce its head.");
-  const records = closureRecords(available, roots, maximumRecords);
-  const payload = { binding, head, records, roots, v: 1 };
-  const closure = { ...payload, closureSha256: canonicalSha256(payload) };
-  if (Buffer.byteLength(canonicalJson(closure), "utf8") > OH_DEPENDENCY_CLOSURE_LIMITS_V1.bytes) {
-    throw new RangeError("Dependency closure exceeds its canonical byte bound.");
+function canonicalStringBytesV1(value, maximumBytes) {
+  if (value.length + 2 > maximumBytes)
+    throw new RangeError("String exceeds its canonical byte budget.");
+  let bytes = 2;
+  for (let index = 0;index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code >= 55296 && code <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (!(next >= 56320 && next <= 57343))
+        throw new TypeError("Invalid Unicode string.");
+      bytes += 4;
+      index += 1;
+    } else if (code >= 56320 && code <= 57343) {
+      throw new TypeError("Invalid Unicode string.");
+    } else if (code === 34 || code === 92 || code === 8 || code === 9 || code === 10 || code === 12 || code === 13) {
+      bytes += 2;
+    } else if (code <= 31) {
+      bytes += 6;
+    } else if (code <= 127) {
+      bytes += 1;
+    } else if (code <= 2047) {
+      bytes += 2;
+    } else {
+      bytes += 3;
+    }
+    if (bytes > maximumBytes)
+      throw new RangeError("String exceeds its canonical byte budget.");
   }
-  return Object.freeze(closure);
+  return bytes;
 }
-function parseOhDependencyClosureV1(value) {
-  if (!isPlainRecord(value) || !hasExactKeys(value, [
-    "binding",
-    "closureSha256",
-    "head",
-    "records",
-    "roots",
-    "v"
-  ]) || value.v !== 1 || !Array.isArray(value.records) || !Array.isArray(value.roots) || value.records.length > OH_DEPENDENCY_CLOSURE_LIMITS_V1.records)
-    return null;
-  const binding = parseOhStoreBindingV1(value.binding);
-  const head = parseOhHeadV1(value.head);
-  const closureSha256 = parseSha256Hex(value.closureSha256);
-  if (binding === null || head === null || closureSha256 === null)
+function boundedSyncIngressV1(value, limits, aggregate, clone) {
+  const ancestors = new Set;
+  const budget = {
+    bytes: 0,
+    maximumBytes: limits.maximumBytes,
+    maximumNodes: limits.maximumNodes,
+    nodes: 0
+  };
+  const canSpendBytes = (count) => budget.bytes + count <= budget.maximumBytes && (aggregate === null || aggregate.bytes + count <= aggregate.maximumBytes);
+  const spendBytes = (count) => {
+    if (!canSpendBytes(count))
+      throw new RangeError("Sync ingress exceeds its canonical byte budget.");
+    budget.bytes += count;
+    if (aggregate !== null)
+      aggregate.bytes += count;
+  };
+  const canSpendNodes = (count) => budget.nodes + count <= budget.maximumNodes && (aggregate === null || aggregate.nodes + count <= aggregate.maximumNodes);
+  const spendNode = () => {
+    if (!canSpendNodes(1))
+      throw new RangeError("Sync ingress exceeds its node budget.");
+    budget.nodes += 1;
+    if (aggregate !== null)
+      aggregate.nodes += 1;
+  };
+  const detach = (candidate, depth) => {
+    if (depth > limits.maximumDepth)
+      throw new RangeError("Sync ingress exceeds its depth budget.");
+    spendNode();
+    if (candidate === null) {
+      spendBytes(4);
+      return candidate;
+    }
+    if (typeof candidate === "boolean") {
+      spendBytes(candidate ? 4 : 5);
+      return candidate;
+    }
+    if (typeof candidate === "string") {
+      spendBytes(canonicalStringBytesV1(candidate, Math.min(budget.maximumBytes - budget.bytes, aggregate === null ? Number.MAX_SAFE_INTEGER : aggregate.maximumBytes - aggregate.bytes)));
+      return candidate;
+    }
+    if (typeof candidate === "number") {
+      if (!Number.isFinite(candidate) || Object.is(candidate, -0))
+        throw new TypeError("Invalid number.");
+      spendBytes(utf8ByteLength(canonicalJson(candidate)));
+      return candidate;
+    }
+    if (typeof candidate !== "object" || isProxy(candidate))
+      throw new TypeError("Invalid data value.");
+    if (ancestors.has(candidate))
+      throw new TypeError("Cyclic data value.");
+    ancestors.add(candidate);
+    try {
+      if (Array.isArray(candidate)) {
+        const lengthDescriptor = Object.getOwnPropertyDescriptor(candidate, "length");
+        const length = lengthDescriptor?.value;
+        if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0 || !canSpendNodes(length) || !canSpendBytes(2 + Math.max(0, length - 1) + length)) {
+          throw new TypeError("Invalid or over-budget data array.");
+        }
+        const keys2 = Reflect.ownKeys(candidate);
+        if (keys2.length !== length + 1 || !keys2.includes("length") || keys2.some((key) => key !== "length" && (typeof key !== "string" || !/^(?:0|[1-9][0-9]*)$/u.test(key) || Number(key) >= length))) {
+          throw new TypeError("Invalid data array.");
+        }
+        spendBytes(2 + Math.max(0, length - 1));
+        const detached2 = clone ? [] : null;
+        for (let index = 0;index < length; index += 1) {
+          const descriptor = Object.getOwnPropertyDescriptor(candidate, String(index));
+          if (descriptor === undefined || !descriptor.enumerable || descriptor.get !== undefined || descriptor.set !== undefined) {
+            throw new TypeError("Invalid data array entry.");
+          }
+          const item = detach(descriptor.value, depth + 1);
+          detached2?.push(item);
+        }
+        return detached2 === null ? candidate : Object.freeze(detached2);
+      }
+      const prototype = Object.getPrototypeOf(candidate);
+      if (prototype !== Object.prototype && prototype !== null) {
+        throw new TypeError("Invalid data object.");
+      }
+      let containerBytes = 2;
+      let properties = 0;
+      for (const key in candidate) {
+        if (!Object.hasOwn(candidate, key))
+          continue;
+        properties += 1;
+        if (!canSpendNodes(properties))
+          throw new RangeError("Sync ingress exceeds its node budget.");
+        const remainingBytes = Math.min(budget.maximumBytes - budget.bytes - containerBytes - properties, aggregate === null ? Number.MAX_SAFE_INTEGER : aggregate.maximumBytes - aggregate.bytes - containerBytes - properties);
+        containerBytes += (properties === 1 ? 0 : 1) + canonicalStringBytesV1(key, remainingBytes) + 1;
+        if (!canSpendBytes(containerBytes + properties)) {
+          throw new RangeError("Sync ingress exceeds its canonical byte budget.");
+        }
+      }
+      const keys = Reflect.ownKeys(candidate);
+      if (keys.length !== properties || keys.some((key) => typeof key !== "string")) {
+        throw new TypeError("Invalid data object.");
+      }
+      spendBytes(containerBytes);
+      const detached = clone ? Object.create(null) : null;
+      for (const key of keys) {
+        const descriptor = Object.getOwnPropertyDescriptor(candidate, key);
+        if (descriptor === undefined || !descriptor.enumerable || descriptor.get !== undefined || descriptor.set !== undefined) {
+          throw new TypeError("Invalid data property.");
+        }
+        const item = detach(descriptor.value, depth + 1);
+        if (detached !== null) {
+          Object.defineProperty(detached, key, {
+            configurable: false,
+            enumerable: true,
+            value: item,
+            writable: false
+          });
+        }
+      }
+      return detached === null ? candidate : Object.freeze(detached);
+    } finally {
+      ancestors.delete(candidate);
+    }
+  };
+  try {
+    return Object.freeze({ value: detach(value, 0) });
+  } catch {
     return null;
-  const records = new Map;
-  for (const item of value.records) {
-    const record = parseKnowledgeGraphRecordV1(item);
-    if (record === null || records.has(record.key))
-      return null;
-    records.set(record.key, record);
   }
+}
+function preflightSyncIngressValueV1(value, aggregate) {
+  return boundedSyncIngressV1(value, {
+    maximumBytes: OH_GRAPH_LIMITS_V1.recordBytes,
+    maximumDepth: OH_SYNC_INGRESS_VALUE_DEPTH_V1,
+    maximumNodes: OH_SYNC_INGRESS_VALUE_NODES_V1
+  }, aggregate, false);
+}
+function preflightSyncIngressDependenciesV1(value, aggregate) {
   try {
-    const roots = normalizeRoots(value.roots);
-    if (canonicalJson(roots) !== canonicalJson(value.roots))
+    if (typeof value !== "object" || value === null || isProxy(value) || !Array.isArray(value)) {
       return null;
-    const exact = closureRecords(records, roots, OH_DEPENDENCY_CLOSURE_LIMITS_V1.records);
-    if (canonicalJson(exact) !== canonicalJson(value.records))
+    }
+    const length = Object.getOwnPropertyDescriptor(value, "length")?.value;
+    if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0 || length > OH_GRAPH_LIMITS_V1.dependenciesPerRecord)
       return null;
-    const payload = { binding, head, records: exact, roots, v: 1 };
-    const parsed = { ...payload, closureSha256 };
-    return canonicalSha256(payload) === closureSha256 && Buffer.byteLength(canonicalJson(parsed), "utf8") <= OH_DEPENDENCY_CLOSURE_LIMITS_V1.bytes ? Object.freeze(parsed) : null;
+    const maximumBytes = length === 0 ? 2 : 1 + length * 515;
+    return boundedSyncIngressV1(value, {
+      maximumBytes,
+      maximumDepth: 1,
+      maximumNodes: length + 1
+    }, aggregate, false);
   } catch {
     return null;
   }
 }
-function verifyOhDependencyClosureV1(value) {
-  const closure = parseOhDependencyClosureV1(value);
-  return closure === null ? { ok: false, reason: "invalid-closure" } : { closure, ok: true };
+function syncIngressBundleBudgetV1(spaceId) {
+  const emptyBundle = {
+    bundleSha256: "0".repeat(64),
+    contractSha256: OH_CONTRACT_MANIFEST_V1.contractSha256,
+    operations: [],
+    protocol: OH_SYNC_PROTOCOL_V1,
+    spaceId,
+    v: 1
+  };
+  return {
+    bytes: utf8ByteLength(canonicalJson(emptyBundle)),
+    maximumBytes: OH_SYNC_BUNDLE_MAX_BYTES_V1,
+    maximumNodes: OH_SYNC_INGRESS_BUNDLE_NODES_V1,
+    nodes: 7
+  };
 }
-function verifyOhDependencyClosureAgainstV1(value, expected) {
-  const binding = parseOhStoreBindingV1(expected.binding);
-  const head = parseOhHeadV1(expected.head);
-  if (binding === null || head === null)
-    return { ok: false, reason: "invalid-expectation" };
-  const closure = parseOhDependencyClosureV1(value);
-  if (closure === null)
-    return { ok: false, reason: "invalid-closure" };
-  if (closure.binding.bindingSha256 !== binding.bindingSha256)
-    return { ok: false, reason: "binding-mismatch" };
-  if (canonicalJson(closure.head) !== canonicalJson(head))
-    return { ok: false, reason: "head-mismatch" };
-  return { closure, ok: true, verification: "expected-authority-and-head" };
+function spendSyncIngressBudgetV1(budget, bytes, nodes = 0) {
+  if (budget.bytes + bytes > budget.maximumBytes || budget.nodes + nodes > budget.maximumNodes)
+    return false;
+  budget.bytes += bytes;
+  budget.nodes += nodes;
+  return true;
 }
-function createOhSpacePurgeReceiptV1(input) {
-  const binding = parseOhStoreBindingV1(input.binding);
-  const priorHead = parseOhHeadV1(input.priorHead);
-  const purgedAt = parseCanonicalInstantV1(input.purgedAt);
-  if (binding === null || priorHead === null || purgedAt === null || binding.profile.profileKind !== "working" || !binding.profile.capabilities.wholeSpacePurge) {
-    throw new OhProfileError("Only a bound working realm can produce a purge receipt.");
+function measureSyncOperationV1(operation) {
+  const measurement = {
+    bytes: 0,
+    maximumBytes: OH_OPERATION_MAX_BYTES_V1,
+    maximumNodes: OH_SYNC_INGRESS_OPERATION_NODES_V1,
+    nodes: 0
+  };
+  return boundedSyncIngressV1(operation, {
+    maximumBytes: OH_OPERATION_MAX_BYTES_V1,
+    maximumDepth: OH_SYNC_INGRESS_OPERATION_DEPTH_V1,
+    maximumNodes: OH_SYNC_INGRESS_OPERATION_NODES_V1
+  }, measurement, false) === null ? null : measurement;
+}
+function buildOhSyncBundleV1(parsedSpaceId, operations, largestFittingPrefix) {
+  let priorSequence = null;
+  let priorSha256 = null;
+  const parsed = [];
+  const bundleBudget = syncIngressBundleBudgetV1(parsedSpaceId);
+  for (const candidate of operations) {
+    const operation = parseOhOperationV1(candidate);
+    if (operation === null || operation.spaceId !== parsedSpaceId || priorSequence !== null && operation.sequence !== priorSequence + 1 || priorSequence !== null && operation.parentOperationSha256 !== priorSha256) {
+      throw new TypeError("Sync operations must form one ordered chain.");
+    }
+    const measurement = measureSyncOperationV1(operation);
+    if (measurement === null) {
+      throw new RangeError("Sync operation exceeds its canonical byte, node, or depth limit.");
+    }
+    if (!spendSyncIngressBudgetV1(bundleBudget, measurement.bytes + (parsed.length === 0 ? 0 : 1), measurement.nodes)) {
+      if (largestFittingPrefix && parsed.length > 0)
+        break;
+      throw new RangeError("Sync bundle exceeds its canonical byte or node limit.");
+    }
+    parsed.push(operation);
+    priorSequence = operation.sequence;
+    priorSha256 = operation.operationSha256;
   }
   const payload = {
-    bindingSha256: binding.bindingSha256,
-    priorHead,
-    purgedAt,
-    spaceId: binding.spaceId,
+    contractSha256: OH_CONTRACT_MANIFEST_V1.contractSha256,
+    operations: parsed,
+    protocol: OH_SYNC_PROTOCOL_V1,
+    spaceId: parsedSpaceId,
     v: 1
   };
-  return Object.freeze({ ...payload, receiptSha256: canonicalSha256(payload) });
+  return { ...payload, bundleSha256: canonicalSha256(payload) };
 }
-function parseOhSpacePurgeReceiptV1(value) {
-  if (!isPlainRecord(value) || !hasExactKeys(value, [
-    "bindingSha256",
-    "priorHead",
-    "purgedAt",
-    "receiptSha256",
-    "spaceId",
-    "v"
-  ]) || value.v !== 1)
-    return null;
-  const bindingSha256 = parseSha256Hex(value.bindingSha256);
-  const priorHead = parseOhHeadV1(value.priorHead);
-  const purgedAt = parseCanonicalInstantV1(value.purgedAt);
-  const receiptSha256 = parseSha256Hex(value.receiptSha256);
-  const spaceId = safeCode(value.spaceId);
-  if (bindingSha256 === null || priorHead === null || purgedAt === null || receiptSha256 === null || spaceId === null)
+function parseSyncHeadRefEnvelopeV1(value) {
+  const operationSha256 = value.operationSha256 === null ? null : parseSha256Hex(value.operationSha256);
+  const sequence = Number.isSafeInteger(value.sequence) && value.sequence >= 0 && !Object.is(value.sequence, -0) ? value.sequence : null;
+  return sequence !== null && (value.operationSha256 === null || operationSha256 !== null) && sequence === 0 === (operationSha256 === null) ? { operationSha256, sequence } : null;
+}
+function parseOhSyncHeadRefV1(value) {
+  const reference = exactDataRecordV1(value, OH_SYNC_HEAD_REF_KEYS_V1);
+  return reference === null ? null : parseSyncHeadRefEnvelopeV1(reference);
+}
+function parseOhSyncHeadV1(value) {
+  const envelope = exactDataRecordV1(value, OH_SYNC_HEAD_KEYS_V1);
+  if (envelope === null || envelope.v !== 1)
     return null;
-  const payload = { bindingSha256, priorHead, purgedAt, spaceId, v: 1 };
-  return canonicalSha256(payload) === receiptSha256 ? Object.freeze({ ...payload, receiptSha256 }) : null;
+  const reference = parseSyncHeadRefEnvelopeV1(envelope);
+  return reference === null ? null : { ...reference, v: 1 };
 }
-
-class OhSemanticBundleIngressV1 {
-  #codecs;
-  #store;
-  constructor(store, codecs) {
-    this.#store = store;
-    this.#codecs = codecs.seal();
+function createOhSyncBundleV1(spaceId, operations, options = {}) {
+  const parsedSpaceId = safeCode(spaceId);
+  const largestFittingPrefix = options.largestFittingPrefix ?? false;
+  if (parsedSpaceId === null || operations.length > OH_SYNC_BUNDLE_MAX_OPERATIONS_V1 || typeof largestFittingPrefix !== "boolean") {
+    throw new TypeError("Invalid sync bundle.");
   }
-  async commit(value) {
-    if (!isPlainRecord(value) || !hasExactKeys(value, [
-      "actorId",
-      "expectedHead",
-      "instant",
-      "operationId",
-      "puts",
-      "tombstones",
-      "v"
-    ]) || value.v !== 1 || !Array.isArray(value.puts) || !Array.isArray(value.tombstones) || value.puts.length + value.tombstones.length < 1 || value.puts.length + value.tombstones.length > OH_GRAPH_LIMITS_V1.changesPerOperation) {
-      throw new TypeError("Invalid semantic bundle.");
-    }
-    const actorId = safeCode(value.actorId);
-    const operationId = safeCode(value.operationId);
-    const expected = value.expectedHead;
-    const instant = value.instant === null ? undefined : parseCanonicalInstantV1(value.instant);
-    if (actorId === null || operationId === null || !isPlainRecord(expected) || !hasExactKeys(expected, ["generation", "operationSha256"]) || !Number.isSafeInteger(expected.generation) || expected.generation < 0 || expected.operationSha256 !== null && parseSha256Hex(expected.operationSha256) === null || expected.generation === 0 !== (expected.operationSha256 === null) || value.instant !== null && instant === null)
-      throw new TypeError("Invalid semantic bundle identity.");
-    const changes = [];
-    for (const item of value.puts) {
-      if (!isPlainRecord(item) || !hasExactKeys(item, ["dependencies", "key", "kind", "v", "value"]) || item.v !== 1 || !Array.isArray(item.dependencies) || !OH_KNOWLEDGE_GRAPH_RECORD_KINDS_V1.some((kind) => kind === item.kind)) {
-        throw new TypeError("Invalid semantic bundle put.");
-      }
-      const parsed = this.#codecs.parseRequired(item.kind, item.value);
-      if (parsed === null)
-        throw new TypeError(`The ${String(item.kind)} codec rejected a semantic value.`);
-      const record = createKnowledgeGraphRecordV1({
-        dependencies: item.dependencies,
-        key: item.key,
-        kind: item.kind,
-        v: 1,
-        value: parsed
-      });
-      changes.push({ kind: "put", record, v: 1 });
-    }
-    for (const item of value.tombstones) {
-      if (!isPlainRecord(item) || !hasExactKeys(item, ["key", "priorSha256", "v"]) || item.v !== 1) {
-        throw new TypeError("Invalid semantic bundle tombstone.");
-      }
-      const priorSha256 = parseSha256Hex(item.priorSha256);
-      if (typeof item.key !== "string" || priorSha256 === null)
-        throw new TypeError("Invalid semantic bundle tombstone.");
-      changes.push({ key: item.key, kind: "tombstone", priorSha256, v: 1 });
-    }
-    const canonical = canonicalKnowledgeGraphChangesV1(changes);
-    return await this.#store.commit({
-      actorId,
-      changes: canonical,
-      expectedHead: {
-        generation: expected.generation,
-        operationSha256: expected.operationSha256
-      },
-      ...typeof instant === "string" ? { instant } : {},
-      operationId
-    });
+  return buildOhSyncBundleV1(parsedSpaceId, operations, largestFittingPrefix);
+}
+function parseOhSyncBundleV1(value) {
+  const envelope = exactDataRecordV1(value, OH_SYNC_BUNDLE_KEYS_V1);
+  if (envelope === null || envelope.protocol !== OH_SYNC_PROTOCOL_V1 || envelope.v !== 1)
+    return null;
+  const bundleSha256 = parseSha256Hex(envelope.bundleSha256);
+  const contractSha256 = parseSha256Hex(envelope.contractSha256);
+  const spaceId = safeCode(envelope.spaceId);
+  if (bundleSha256 === null || contractSha256 !== OH_CONTRACT_MANIFEST_V1.contractSha256 || spaceId === null)
+    return null;
+  const operations = exactDataArrayV1(envelope.operations, OH_SYNC_BUNDLE_MAX_OPERATIONS_V1);
+  if (operations === null)
+    return null;
+  const detachedOperations = [];
+  const bundleBudget = syncIngressBundleBudgetV1(spaceId);
+  for (const operation of operations) {
+    if (detachedOperations.length > 0 && !spendSyncIngressBudgetV1(bundleBudget, 1))
+      return null;
+    const detached = stagedSyncOperationV1(operation, bundleBudget);
+    if (detached === null)
+      return null;
+    detachedOperations.push(detached);
+  }
+  try {
+    const created = createOhSyncBundleV1(spaceId, detachedOperations);
+    if (detachedOperations.some((operation, index) => canonicalJson(operation) !== canonicalJson(created.operations[index])))
+      return null;
+    return created.bundleSha256 === bundleSha256 ? { ...created, bundleSha256 } : null;
+  } catch {
+    return null;
   }
 }