@net-mesh/browser 0.37.0

package/dist/store/assembly.js

@@ -0,0 +1,325 @@
+/**
+ * Snapshot assembly, and what it refuses (brief §1.12, §2).
+ *
+ * The rules are short and every one of them is a refusal a partial
+ * snapshot would otherwise slip through:
+ *
+ * - `n ≥ 1`; every `i` in `0..n-1` present **exactly once**;
+ * - all chunks carry the same `(h, g, r, n)`;
+ * - the sum of decoded chunk lengths equals `bytes` **exactly**;
+ * - **the assembled document** — not each chunk envelope — is then
+ *   JSON-parsed under the same depth and duplicate-key rules and
+ *   validated by the definition's `state()` before anything is
+ *   published.
+ *
+ * That last one is the distinction the earlier draft got wrong: the
+ * per-chunk checks validate the *envelopes*, not the snapshot. A
+ * document can be assembled from thirteen individually perfect
+ * envelopes and still be a duplicate-keyed depth bomb.
+ *
+ * Reclamation is equally explicit, because an assembly is the one
+ * place a replica holds a megabyte on a stranger's say-so: **one**
+ * in-flight per `(handle, generation)`, discarded on generation
+ * change, deadline and handle expiry, never merged into a later one,
+ * and bounded in total across handles so a peer cannot open many
+ * cheap assemblies to hold expensive memory.
+ */
+import { fromBase64 } from './chunker.js';
+import { parseStoreJson } from './json.js';
+import { isCanonicalBase64, MAX_SNAPSHOT_BYTES, MAX_SNAPSHOT_CHUNKS, } from './wire.js';
+/** How long an assembly may stay open (brief §2). */
+export const ASSEMBLY_DEADLINE_MS = 10_000;
+/** Total in-flight assembly bytes one owner or replica may hold (§2). */
+export const MAX_ASSEMBLY_BYTES_TOTAL = 8 * 1024 * 1024;
+function reject(reason, fatal, code = 'invalid-data') {
+    return { ok: false, code, reason, fatal };
+}
+/**
+ * One in-flight snapshot assembly.
+ *
+ * Holds the chunks it has admitted and nothing else: no partial
+ * document is exposed, and there is no accessor that would let a
+ * caller read half a world.
+ */
+export class Assembly {
+    manifest;
+    openedAt;
+    pieces;
+    encoded;
+    admitted = 0;
+    held = 0;
+    closed = false;
+    constructor(manifest, 
+    /** When this assembly was opened, for the deadline. */
+    openedAt) {
+        this.manifest = manifest;
+        this.openedAt = openedAt;
+        this.pieces = new Array(manifest.n);
+        this.encoded = new Array(manifest.n);
+    }
+    /** Decoded bytes currently held. */
+    get bytesHeld() {
+        return this.held;
+    }
+    /**
+     * Bytes this assembly is COMMITTED to, for the total-bytes bound.
+     *
+     * The manifest's declared total, not what has arrived: an assembly
+     * that has admitted one chunk of twenty still intends to hold the
+     * whole snapshot, and a bound tested against arrivals lets every
+     * one of them in while each is still nearly empty. A reclaimed
+     * assembly is committed to nothing.
+     */
+    get bytesReserved() {
+        return this.closed ? 0 : Math.max(Number(this.manifest.bytes), this.held);
+    }
+    /** How many distinct `i` have been admitted. */
+    get have() {
+        return this.admitted;
+    }
+    /** Whether this assembly has been reclaimed. */
+    get reclaimed() {
+        return this.closed;
+    }
+    /** Give up every chunk. A reclaimed assembly admits nothing. */
+    reclaim() {
+        this.closed = true;
+        this.pieces.fill(undefined);
+        this.encoded.fill(undefined);
+        this.admitted = 0;
+        this.held = 0;
+    }
+    /** Whether `now` is past this assembly's deadline. */
+    expired(now) {
+        return now - this.openedAt >= ASSEMBLY_DEADLINE_MS;
+    }
+    /**
+     * Admit one chunk.
+     *
+     * Returns the assembled document on the chunk that completes it, and
+     * **only** then: `done: false` carries a count, never a partial
+     * document.
+     */
+    accept(chunk, validate, now) {
+        if (this.closed)
+            return reject('chunk-wrong-assembly', false);
+        if (this.expired(now)) {
+            this.reclaim();
+            return reject('deadline', true, 'timeout');
+        }
+        // All chunks carry the same `(h, g, r, n)`. A chunk from a
+        // restarted attempt at the same revision differs in `g`, which is
+        // what stops it joining this one.
+        const m = this.manifest;
+        if (chunk.h !== m.h || chunk.g !== m.g || chunk.r !== m.r || chunk.n !== m.n) {
+            return reject('chunk-wrong-assembly', false);
+        }
+        if (!Number.isInteger(chunk.i) || chunk.i < 0 || chunk.i >= m.n) {
+            return reject('chunk-index', false);
+        }
+        if (!isCanonicalBase64(chunk.d))
+            return reject('chunk-non-canonical', false);
+        const seen = this.encoded[chunk.i];
+        if (seen !== undefined) {
+            // Byte-identical retransmission is ordinary and idempotent.
+            if (seen === chunk.d)
+                return { ok: true, done: false, have: this.admitted };
+            // Two different payloads for one position: the assembly cannot
+            // decide which is the snapshot, so it is refused and restarted.
+            // Publishing either would publish a document neither peer sent.
+            this.reclaim();
+            return reject('chunk-conflict', true);
+        }
+        const bytes = fromBase64(chunk.d);
+        const declared = Number(m.bytes);
+        if (this.held + bytes.length > declared) {
+            // Overshooting the declared total is a mismatch discoverable
+            // now, before the memory is held.
+            this.reclaim();
+            return reject('byte-total-mismatch', true);
+        }
+        this.encoded[chunk.i] = chunk.d;
+        this.pieces[chunk.i] = bytes;
+        this.admitted += 1;
+        this.held += bytes.length;
+        if (this.admitted < m.n)
+            return { ok: true, done: false, have: this.admitted };
+        // Complete. Every `i` is present exactly once by construction: a
+        // repeat is either idempotent or a conflict, and the count only
+        // advances for a fresh index.
+        if (this.held !== declared) {
+            this.reclaim();
+            return reject('byte-total-mismatch', true);
+        }
+        const joined = new Uint8Array(this.held);
+        let offset = 0;
+        for (const piece of this.pieces) {
+            if (piece === undefined) {
+                // Unreachable while `admitted === n`, and asserted rather than
+                // assumed: publishing a short document would be worse than
+                // refusing one.
+                this.reclaim();
+                return reject('byte-total-mismatch', true);
+            }
+            joined.set(piece, offset);
+            offset += piece.length;
+        }
+        const text = new TextDecoder('utf-8', { fatal: true });
+        let document;
+        try {
+            // THE ASSEMBLED DOCUMENT, under the same rules a single frame
+            // gets: depth, duplicate keys, finite numbers. The per-chunk
+            // checks above validated envelopes, which is a different claim.
+            const parsed = parseStoreJson(text.decode(joined));
+            if (!parsed.ok) {
+                this.reclaim();
+                return reject('assembled-not-json', true);
+            }
+            document = parsed.value;
+        }
+        catch {
+            this.reclaim();
+            return reject('assembled-not-json', true);
+        }
+        try {
+            validate(document);
+        }
+        catch {
+            this.reclaim();
+            return reject('assembled-invalid', true);
+        }
+        this.reclaim();
+        return { ok: true, done: true, document };
+    }
+}
+/**
+ * The assemblies one side holds, with the bounds that keep them from
+ * being a memory lever.
+ *
+ * One in-flight per `(handle, generation)` — a second manifest for the
+ * same pair replaces it rather than accumulating — and a total byte
+ * ceiling across handles, because a count bound alone is not a memory
+ * bound (§2).
+ *
+ * **The deadline is the HOLDER's to drive.** Nothing inside this class
+ * reads a clock: a host holding its own table MUST call {@link
+ * AssemblyTable.sweep} from its own. The store's own replica needs no
+ * such call — it enforces the assembly deadline in its `tick`, where
+ * an expired assembly is abandoned and re-asked for rather than
+ * silently dropped, and clears the table through `reclaimHandle`.
+ */
+export class AssemblyTable {
+    maxTotalBytes;
+    live = new Map();
+    constructor(maxTotalBytes = MAX_ASSEMBLY_BYTES_TOTAL) {
+        this.maxTotalBytes = maxTotalBytes;
+    }
+    static key(h, g) {
+        return `${h}/${g}`;
+    }
+    /** Bytes currently held across every open assembly. */
+    get bytesHeld() {
+        let total = 0;
+        for (const assembly of this.live.values())
+            total += assembly.bytesHeld;
+        return total;
+    }
+    /** Bytes every open assembly is committed to holding. */
+    get bytesReserved() {
+        let total = 0;
+        for (const assembly of this.live.values())
+            total += assembly.bytesReserved;
+        return total;
+    }
+    get size() {
+        return this.live.size;
+    }
+    /** The open assembly for a pair, if any. */
+    get(h, g) {
+        return this.live.get(AssemblyTable.key(h, g));
+    }
+    /**
+     * Open an assembly for a manifest.
+     *
+     * Refuses the **newest** when the total would exceed the ceiling:
+     * the ones already in flight have a replica waiting on them, and
+     * dropping those to admit an arrival is how a peer evicts another's
+     * progress.
+     */
+    open(manifest, now) {
+        if (!Number.isInteger(manifest.n) || manifest.n < 1 || manifest.n > MAX_SNAPSHOT_CHUNKS) {
+            return reject('manifest-chunk-count', true);
+        }
+        const declared = Number(manifest.bytes);
+        if (!Number.isSafeInteger(declared) || declared < 0 || declared > MAX_SNAPSHOT_BYTES) {
+            return reject('manifest-bytes', true, 'capacity');
+        }
+        const key = AssemblyTable.key(manifest.h, manifest.g);
+        // Against RESERVATIONS, not arrivals. Testing the ceiling against
+        // bytes already admitted admitted every concurrent manifest —
+        // each one measured while the others were still empty — and the
+        // table then filled to many times its bound. The reservation is
+        // released when the assembly is reclaimed, completed or swept.
+        //
+        // Checked BEFORE the predecessor is touched, with its reservation
+        // excluded from the sum: a replacement for the same pair counts
+        // without its predecessor, but a refusal must not be destructive —
+        // reclaiming first meant `assembly-too-large` destroyed the very
+        // assembly it then refused to replace.
+        const predecessor = this.live.get(key);
+        const replaced = predecessor?.bytesReserved ?? 0;
+        if (this.bytesReserved - replaced + declared > this.maxTotalBytes) {
+            return reject('assembly-too-large', true, 'capacity');
+        }
+        // One in-flight per pair. A replacement manifest for the same pair
+        // reclaims the predecessor rather than leaving it to a deadline.
+        predecessor?.reclaim();
+        this.live.delete(key);
+        const assembly = new Assembly(manifest, now);
+        this.live.set(key, assembly);
+        return assembly;
+    }
+    /** Reclaim one pair's assembly. */
+    reclaim(h, g) {
+        const key = AssemblyTable.key(h, g);
+        this.live.get(key)?.reclaim();
+        this.live.delete(key);
+    }
+    /**
+     * Reclaim every assembly for a handle — a generation change, a
+     * handle expiry, a session loss.
+     */
+    reclaimHandle(h) {
+        for (const [key, assembly] of [...this.live]) {
+            if (key.startsWith(`${h}/`)) {
+                assembly.reclaim();
+                this.live.delete(key);
+            }
+        }
+    }
+    /**
+     * Reclaim everything past its deadline. Returns how many went.
+     *
+     * The one deadline enforcer for a table this module does not drive:
+     * a host holding its own `AssemblyTable` must call this from its own
+     * clock (see the class note), or its assemblies hold their
+     * reservations for ever.
+     */
+    sweep(now) {
+        let swept = 0;
+        for (const [key, assembly] of [...this.live]) {
+            if (assembly.expired(now)) {
+                assembly.reclaim();
+                this.live.delete(key);
+                swept += 1;
+            }
+        }
+        return swept;
+    }
+    /** Give up everything. */
+    clear() {
+        for (const assembly of this.live.values())
+            assembly.reclaim();
+        this.live.clear();
+    }
+}

package/dist/store/chunker.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Snapshot chunking (brief §1.9).
+ *
+ * The owner serializes the **projected** state to UTF-8 JSON, splits
+ * the **bytes** into `n` pieces, and sends `i = 0..n-1`. Splitting
+ * bytes rather than characters is the whole reason `d` is base64: a
+ * UTF-8 code point can straddle any byte boundary, and a raw-text
+ * chunk containing half of one is not valid JSON string content. The
+ * +33 % base64 cost is accounted for in the budget rather than
+ * discovered by an oversized frame.
+ *
+ * **The budget is derived at runtime, never hardcoded.** It comes from
+ * the wire's own `maxEventBytes()` minus the `snap` envelope's
+ * reserve, so a transport whose cap changes moves the chunk size with
+ * it. A store that guessed this number would be wrong on the first
+ * transport that changed, and would be wrong *silently* — by emitting
+ * a frame the far side refuses.
+ */
+/**
+ * Room left for everything in a `snap` that is not `d`.
+ *
+ * 192, against a **measured worst case of 134 B** with every field at
+ * its maximum spelling: 20-digit `u64` decimals, a 32-hex handle, and
+ * `i`/`n` at 255. So it is a bound, not a sample of one message.
+ */
+export declare const SNAP_ENVELOPE_RESERVE = 192;
+/**
+ * The floor a store refuses to start below (brief §1.9).
+ *
+ * Not an aesthetic minimum: at smaller chunk sizes a snapshot of any
+ * useful size exceeds {@link MAX_SNAPSHOT_CHUNKS}, so the store would
+ * start and then fail on its first projection.
+ */
+export declare const MIN_CHUNK_BYTES = 1024;
+/** The largest `man`/`delta` envelope, for the startup check (§1.9). */
+export declare const LARGEST_FROZEN_ENVELOPE = 197;
+/**
+ * Raw bytes per chunk, for a transport whose event cap is
+ * `maxEventBytes`.
+ *
+ * `/4 * 3` because base64 emits 4 characters per 3 bytes, and the
+ * frame carries the encoded form: the division is on the *encoded*
+ * budget and the multiplication converts it back to raw input.
+ */
+export declare function chunkBytesFor(maxEventBytes: number): number;
+/**
+ * Refuse to start rather than discover the numbers later (§1.9).
+ *
+ * Throws a typed `capacity` error **naming both numbers**, because
+ * "the store would not start" is only actionable if it says what did
+ * not fit.
+ */
+export declare function assertChunkingFits(maxEventBytes: number): number;
+/** One snapshot, split and ready to emit. */
+export interface Chunked {
+    /** The revision-independent byte total the manifest declares. */
+    readonly bytes: number;
+    /** How many pieces; `n` on the wire. */
+    readonly n: number;
+    /** Canonical base64 pieces, in `i` order. */
+    readonly pieces: readonly string[];
+}
+/**
+ * Split a projected state for emission.
+ *
+ * Refuses rather than truncates: a snapshot that does not fit the
+ * declared bounds is a `capacity` error at the owner, before anything
+ * is sent, because half a world is not a smaller world.
+ */
+export declare function chunkSnapshot(state: unknown, chunkBytes: number): Chunked;
+/** Canonical base64: standard alphabet, padded, no line breaks. */
+export declare function base64(bytes: Uint8Array): string;
+/**
+ * The inverse of {@link base64}.
+ *
+ * Canonicality is the CALLER's gate: `isCanonicalBase64` runs in the
+ * wire decoder and again in `Assembly.accept`. This only decodes —
+ * `atob` accepts non-canonical spellings, so a direct caller MUST run
+ * that check first.
+ */
+export declare function fromBase64(text: string): Uint8Array;
+/** The UTF-8 byte length of a JSON document, for a budget check. */
+export declare function jsonByteLength(value: unknown): number;

package/dist/store/chunker.js

@@ -0,0 +1,190 @@
+/**
+ * Snapshot chunking (brief §1.9).
+ *
+ * The owner serializes the **projected** state to UTF-8 JSON, splits
+ * the **bytes** into `n` pieces, and sends `i = 0..n-1`. Splitting
+ * bytes rather than characters is the whole reason `d` is base64: a
+ * UTF-8 code point can straddle any byte boundary, and a raw-text
+ * chunk containing half of one is not valid JSON string content. The
+ * +33 % base64 cost is accounted for in the budget rather than
+ * discovered by an oversized frame.
+ *
+ * **The budget is derived at runtime, never hardcoded.** It comes from
+ * the wire's own `maxEventBytes()` minus the `snap` envelope's
+ * reserve, so a transport whose cap changes moves the chunk size with
+ * it. A store that guessed this number would be wrong on the first
+ * transport that changed, and would be wrong *silently* — by emitting
+ * a frame the far side refuses.
+ */
+import { StoreError } from './errors.js';
+import { inadmissibleValue, MAX_SNAPSHOT_BYTES, MAX_SNAPSHOT_CHUNKS, utf8Length } from './wire.js';
+/**
+ * Room left for everything in a `snap` that is not `d`.
+ *
+ * 192, against a **measured worst case of 134 B** with every field at
+ * its maximum spelling: 20-digit `u64` decimals, a 32-hex handle, and
+ * `i`/`n` at 255. So it is a bound, not a sample of one message.
+ */
+export const SNAP_ENVELOPE_RESERVE = 192;
+/**
+ * The floor a store refuses to start below (brief §1.9).
+ *
+ * Not an aesthetic minimum: at smaller chunk sizes a snapshot of any
+ * useful size exceeds {@link MAX_SNAPSHOT_CHUNKS}, so the store would
+ * start and then fail on its first projection.
+ */
+export const MIN_CHUNK_BYTES = 1024;
+/** The largest `man`/`delta` envelope, for the startup check (§1.9). */
+export const LARGEST_FROZEN_ENVELOPE = 197;
+/**
+ * Raw bytes per chunk, for a transport whose event cap is
+ * `maxEventBytes`.
+ *
+ * `/4 * 3` because base64 emits 4 characters per 3 bytes, and the
+ * frame carries the encoded form: the division is on the *encoded*
+ * budget and the multiplication converts it back to raw input.
+ */
+export function chunkBytesFor(maxEventBytes) {
+    return Math.floor((maxEventBytes - SNAP_ENVELOPE_RESERVE) / 4) * 3;
+}
+/**
+ * Refuse to start rather than discover the numbers later (§1.9).
+ *
+ * Throws a typed `capacity` error **naming both numbers**, because
+ * "the store would not start" is only actionable if it says what did
+ * not fit.
+ */
+export function assertChunkingFits(maxEventBytes) {
+    if (!Number.isFinite(maxEventBytes) || !Number.isInteger(maxEventBytes) || maxEventBytes <= 0) {
+        throw new StoreError('capacity', `the transport reported no usable event size (${String(maxEventBytes)})`);
+    }
+    if (LARGEST_FROZEN_ENVELOPE > maxEventBytes) {
+        throw new StoreError('capacity', `the frozen envelopes need ${LARGEST_FROZEN_ENVELOPE} B and the transport allows ${maxEventBytes} B`);
+    }
+    const chunkBytes = chunkBytesFor(maxEventBytes);
+    if (chunkBytes < MIN_CHUNK_BYTES) {
+        throw new StoreError('capacity', `a ${maxEventBytes} B event leaves ${chunkBytes} B per chunk, below the ${MIN_CHUNK_BYTES} B floor`);
+    }
+    // The product, not just the floor: chunks that meet MIN_CHUNK_BYTES
+    // can still be unable to carry MAX_SNAPSHOT_BYTES within
+    // MAX_SNAPSHOT_CHUNKS, and the store would start and then discover
+    // that on its first large projection — the exact opposite of the
+    // promise above.
+    if (chunkBytes * MAX_SNAPSHOT_CHUNKS < MAX_SNAPSHOT_BYTES) {
+        throw new StoreError('capacity', `a ${maxEventBytes} B event leaves ${chunkBytes} B per chunk: ${MAX_SNAPSHOT_CHUNKS} of them cover ` +
+            `${chunkBytes * MAX_SNAPSHOT_CHUNKS} B, below the ${MAX_SNAPSHOT_BYTES} B snapshot bound`);
+    }
+    return chunkBytes;
+}
+/**
+ * Split a projected state for emission.
+ *
+ * Refuses rather than truncates: a snapshot that does not fit the
+ * declared bounds is a `capacity` error at the owner, before anything
+ * is sent, because half a world is not a smaller world.
+ */
+export function chunkSnapshot(state, chunkBytes) {
+    if (chunkBytes < 1) {
+        throw new StoreError('capacity', `a chunk budget of ${chunkBytes} B cannot carry anything`);
+    }
+    // The admissible-value scan, over the SOURCE values like every
+    // other value-bearing payload — and BEFORE serialization, because
+    // `JSON.stringify` is lossy, silent and throwing: `NaN`/`Infinity`
+    // become `null`, an `undefined`-valued own key disappears, a
+    // `toJSON`/`Map`/symbol-keyed value is transformed or emptied, and
+    // a cycle or a `BigInt` raises a bare `TypeError` out of the
+    // serializer. Running the scan on the wrong side of `stringify`
+    // either saw transformed evidence or never ran at all — and the
+    // delta-overflow fallback is exactly this path.
+    try {
+        const bad = inadmissibleValue(state, 'state');
+        if (bad !== null) {
+            throw new StoreError('invalid-data', `the projected state is not JSON: ${bad}`);
+        }
+    }
+    catch (error) {
+        if (error instanceof StoreError)
+            throw error;
+        // The scan itself can throw — a hostile getter — and an escape
+        // here is `invalid-data` like every other refusal on this path.
+        throw new StoreError('invalid-data', `the projected state is not JSON: ${String(error)}`, {
+            cause: error,
+        });
+    }
+    let json;
+    try {
+        json = JSON.stringify(state);
+    }
+    catch (error) {
+        // Everything named above is refused by the scan first, so what
+        // escapes here is `stringify` throwing on something the scan
+        // cannot see (a getter that throws mid-serialization). Still
+        // invalid data, never a bare `TypeError`.
+        throw new StoreError('invalid-data', 'the projected state is not JSON', { cause: error });
+    }
+    if (json === undefined) {
+        // `JSON.stringify` returns undefined for a function or a symbol.
+        // Serializing that as the string "undefined" would ship a snapshot
+        // the replica cannot parse.
+        throw new StoreError('invalid-data', 'the projected state is not JSON');
+    }
+    const bytes = new TextEncoder().encode(json);
+    if (bytes.length > MAX_SNAPSHOT_BYTES) {
+        throw new StoreError('capacity', `the projection is ${bytes.length} B and the bound is ${MAX_SNAPSHOT_BYTES} B`);
+    }
+    const pieces = [];
+    // `n >= 1` holds because `JSON.stringify` never returns the empty
+    // string — the smallest document is `{}` or `null`, two bytes. That
+    // matters: `n = 0` would make "every `i` in `0..n-1` present exactly
+    // once" vacuously true, so an assembly could complete having
+    // received nothing. It is a consequence here rather than a guard,
+    // and a guard that cannot fire is not a defence.
+    for (let offset = 0; offset < bytes.length; offset += chunkBytes) {
+        pieces.push(base64(bytes.subarray(offset, offset + chunkBytes)));
+    }
+    if (pieces.length > MAX_SNAPSHOT_CHUNKS) {
+        throw new StoreError('capacity', `the projection needs ${pieces.length} chunks and the bound is ${MAX_SNAPSHOT_CHUNKS}`);
+    }
+    return { bytes: bytes.length, n: pieces.length, pieces };
+}
+/**
+ * Chars per bulk conversion step.
+ *
+ * `btoa`/`atob` traffic in binary strings, and building one a byte at
+ * a time is a call per byte over up to a megabyte — against "never
+ * avoidably allocate, copy, or compute". Conversion runs in bounded
+ * pieces; 0x8000 stays under every engine's argument-count bound.
+ */
+const CONVERSION_CHARS = 0x8000;
+/** Canonical base64: standard alphabet, padded, no line breaks. */
+export function base64(bytes) {
+    let binary = '';
+    for (let offset = 0; offset < bytes.length; offset += CONVERSION_CHARS) {
+        binary += String.fromCharCode(...bytes.subarray(offset, offset + CONVERSION_CHARS));
+    }
+    return btoa(binary);
+}
+/**
+ * The inverse of {@link base64}.
+ *
+ * Canonicality is the CALLER's gate: `isCanonicalBase64` runs in the
+ * wire decoder and again in `Assembly.accept`. This only decodes —
+ * `atob` accepts non-canonical spellings, so a direct caller MUST run
+ * that check first.
+ */
+export function fromBase64(text) {
+    const binary = atob(text);
+    // Straight into the destination: there is no bulk binary-string →
+    // bytes primitive to chunk here, and no intermediate is built.
+    const out = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i += 1)
+        out[i] = binary.charCodeAt(i);
+    return out;
+}
+/** The UTF-8 byte length of a JSON document, for a budget check. */
+export function jsonByteLength(value) {
+    const json = JSON.stringify(value);
+    if (json === undefined)
+        throw new StoreError('invalid-data', 'not JSON');
+    return utf8Length(json);
+}