@openlfcp/shared-objects 0.1.0-rc.1

package/dist/chunk-limits.js

@@ -0,0 +1,457 @@
+// Expansion limits for Automerge chunks (SHARED-OBJECTS-PROFILE-01 §11.1,
+// §13.1; SPEC-PATCH-07). Automerge's columnar format run-length encodes its
+// columns, and a Snapshot's columns may also be deflated, so a few bytes can
+// declare millions of operations or gigabytes of data: a 112-byte change
+// expanded to 1,000,000 operations and 1.2 GiB in Automerge JS 3.5.0. This
+// walker reads a chunk's structure and the run headers of every column,
+// without materialising any value, and refuses a chunk over the limits
+// BEFORE the Automerge engine sees it. It runs in time linear in the input
+// (plus the capped inflation of a Snapshot's deflated columns).
+//
+// Counting rules (the profile states them; both SDKs count the same way):
+// - every column's value count (its rows): an RLE run of n adds n, a
+//   literal run of n adds n, a null run of n adds n; a boolean column adds
+//   each run length; a raw value column adds nothing;
+// - every group column's sum (the total of its values: pred and succ
+//   entries);
+// - expanded string bytes: each string value counted once per row it
+//   occupies (an RLE run of n copies of a k-byte string adds n * k);
+// - structure: no two columns with one specification, every actor index
+//   below the number of actors, and (a change) no group value above one
+//   plus the number of other actors (an op's predecessors have distinct
+//   actors);
+// - for a Snapshot, the bytes of all column data after inflation.
+import { Inflate } from "fflate";
+import { ProfileInvalidError } from "./profile-invalid.js";
+/** The exact limits of a change (§11.1): writers stay within them, receivers reject above. */
+export const CHANGE_LIMITS = Object.freeze({
+    maxRows: 16_384,
+    maxGroupSum: 262_144,
+    maxStringBytes: 4 * 1024 * 1024,
+    maxDeps: 1_024,
+    maxActors: 1_024,
+});
+/**
+ * The floor of a Snapshot's limits (§13.1): every receiver accepts at least
+ * these. A receiver MAY configure higher limits; above its own it rejects
+ * the Snapshot before the engine and falls back to the data round.
+ */
+export const SNAPSHOT_LIMITS_FLOOR = Object.freeze({
+    maxRows: 262_144,
+    maxGroupSum: 262_144,
+    maxStringBytes: 32 * 1024 * 1024,
+    maxInflatedBytes: 32 * 1024 * 1024,
+    maxDeps: 1_024,
+    maxActors: 1_024,
+});
+/** §11.2: no object of a document is deeper than this (the root is depth 0). */
+export const MAX_DOCUMENT_DEPTH = 256;
+/** The operation actions that create an object (§11.2): makeMap, makeList, makeText, makeTable. */
+export const OBJECT_ACTIONS = new Set([0, 2, 4, 6]);
+const MAGIC = [0x85, 0x6f, 0x4a, 0x83];
+const CHUNK_DOCUMENT = 0;
+const CHUNK_CHANGE = 1;
+const DEFLATE_BIT = 0x08;
+const TYPE_GROUP = 0;
+const TYPE_ACTOR = 1;
+const TYPE_DELTA = 3;
+const TYPE_BOOLEAN = 4;
+const TYPE_STRING = 5;
+const TYPE_RAW = 7;
+/** Input fed to the inflater per push: each push yields at most ~1,032x its size. */
+const INFLATE_SLICE = 1024;
+const refuse = (why) => {
+    throw new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", `Automerge chunk refused (§11.1): ${why}`);
+};
+class Cursor {
+    bytes;
+    end;
+    pos = 0;
+    constructor(bytes, end = bytes.length) {
+        this.bytes = bytes;
+        this.end = end;
+    }
+    get done() {
+        return this.pos >= this.end;
+    }
+    take(n) {
+        if (n > this.end - this.pos)
+            refuse("a length runs past the end");
+        const out = this.bytes.subarray(this.pos, this.pos + n);
+        this.pos += n;
+        return out;
+    }
+    /** Unsigned LEB128 as a number; values at or above 2^53 come back as Infinity (over every limit). */
+    uleb() {
+        let value = 0;
+        let scale = 1;
+        for (let i = 0; i < 10; i++) {
+            if (this.pos >= this.end)
+                refuse("a LEB128 number runs past the end");
+            const b = this.bytes[this.pos++];
+            value += (b & 0x7f) * scale;
+            if ((b & 0x80) === 0)
+                return value >= 2 ** 53 ? Number.POSITIVE_INFINITY : value;
+            scale *= 128;
+        }
+        return refuse("a LEB128 number is longer than 10 bytes");
+    }
+    /** Signed LEB128 as a number; magnitudes at or above 2^53 come back as +/-Infinity. */
+    sleb() {
+        let value = 0;
+        let scale = 1;
+        for (let i = 0; i < 10; i++) {
+            if (this.pos >= this.end)
+                refuse("a LEB128 number runs past the end");
+            const b = this.bytes[this.pos++];
+            value += (b & 0x7f) * scale;
+            scale *= 128;
+            if ((b & 0x80) === 0) {
+                if (b & 0x40)
+                    value -= scale;
+                return Math.abs(value) >= 2 ** 53 ? Math.sign(value) * Number.POSITIVE_INFINITY : value;
+            }
+        }
+        return refuse("a LEB128 number is longer than 10 bytes");
+    }
+}
+class Tally {
+    limits;
+    maxRows = 0;
+    groupSum = 0;
+    stringBytes = 0;
+    columnBytes = 0;
+    constructor(limits) {
+        this.limits = limits;
+    }
+    rows(column, limit) {
+        if (column > limit)
+            refuse(`a column has more than ${limit} values`);
+        if (column > this.maxRows)
+            this.maxRows = column;
+    }
+    group(add) {
+        this.groupSum += add;
+        if (!(this.groupSum <= this.limits.maxGroupSum))
+            refuse(`group columns sum to more than ${this.limits.maxGroupSum}`);
+    }
+    strings(add) {
+        this.stringBytes += add;
+        if (!(this.stringBytes <= this.limits.maxStringBytes))
+            refuse(`strings expand to more than ${this.limits.maxStringBytes} bytes`);
+    }
+}
+/** Counts one column's values (and group sums, string bytes) from its run headers. */
+function countColumn(type, data, tally, bounds) {
+    if (type === TYPE_RAW)
+        return 0;
+    const c = new Cursor(data);
+    let rows = 0;
+    const add = (n) => {
+        rows += n;
+        tally.rows(rows, bounds.rows);
+    };
+    if (type === TYPE_BOOLEAN) {
+        while (!c.done)
+            add(c.uleb());
+        return rows;
+    }
+    // One value of an RLE column: its group count, its string length, or skipped.
+    const value = () => {
+        if (type === TYPE_STRING) {
+            const len = c.uleb();
+            c.take(len);
+            return len;
+        }
+        if (type === TYPE_DELTA)
+            return c.sleb();
+        return c.uleb();
+    };
+    const account = (v, times) => {
+        if (type === TYPE_GROUP) {
+            if (v > bounds.group)
+                refuse("an operation has more predecessors than the change has actors");
+            tally.group(v * times);
+        }
+        else if (type === TYPE_STRING)
+            tally.strings(v * times);
+        else if (type === TYPE_ACTOR && !(v < bounds.actors))
+            refuse("an actor index is out of range");
+    };
+    while (!c.done) {
+        const header = c.sleb();
+        if (header > 0) {
+            add(header);
+            account(value(), header);
+        }
+        else if (header < 0) {
+            const n = -header;
+            add(n); // refuses before reading an oversized literal run
+            for (let i = 0; i < n; i++)
+                account(value(), 1);
+        }
+        else
+            add(c.uleb());
+    }
+    return rows;
+}
+/** Column metadata. The count has no limit of its own (§11.1): each entry takes at least two bytes. */
+function columnMetas(c) {
+    const count = c.uleb();
+    if (count > (c.end - c.pos) / 2)
+        refuse("the column metadata runs past the end");
+    const out = [];
+    const specs = new Set();
+    for (let i = 0; i < count; i++) {
+        const spec = c.uleb();
+        if (specs.has(spec))
+            refuse("two columns share a specification");
+        specs.add(spec);
+        out.push({ spec, length: c.uleb() });
+    }
+    return out;
+}
+function lengthPrefixedList(c, limit, what, fixed) {
+    const count = c.uleb();
+    if (count > limit)
+        refuse(`more than ${limit} ${what}`);
+    const out = [];
+    for (let i = 0; i < count; i++)
+        out.push(c.take(fixed ?? c.uleb()));
+    return out;
+}
+const toHexString = (b) => Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
+/**
+ * Each column's value limit: a column that shares its id with a group
+ * column holds that group's entries (predecessors, successors, a change's
+ * dependencies), so the group sum bounds it; every other column has the
+ * row limit.
+ */
+function rowLimits(metas, limits) {
+    const grouped = new Set(metas.filter((m) => (m.spec & 7) === TYPE_GROUP).map((m) => m.spec >> 4));
+    return (spec) => grouped.has(spec >> 4) && (spec & 7) !== TYPE_GROUP ? limits.maxGroupSum : limits.maxRows;
+}
+/** The chunk's single body: magic, checksum, type, length; nothing may follow it. */
+function body(bytes, want, what) {
+    const c = new Cursor(bytes);
+    const magic = c.take(4);
+    if (!MAGIC.every((b, i) => magic[i] === b))
+        refuse(`${what} has no Automerge magic bytes`);
+    c.take(4); // checksum: verified elsewhere (checkChange; the engine for a Snapshot)
+    const type = c.take(1)[0];
+    if (type !== want)
+        refuse(`${what} is chunk type ${type}, not ${want}`);
+    const length = c.uleb();
+    if (length !== bytes.length - c.pos)
+        refuse(`${what} must be exactly one chunk with nothing after it`);
+    return c;
+}
+/**
+ * §11.1: checks an uncompressed change chunk (type 1) against the exact
+ * change limits before the engine sees it. Throws PROFILE_INVALID /
+ * INVALID_AUTOMERGE_BYTES; returns what it expands to.
+ */
+export function checkChangeExpansion(bytes) {
+    const c = body(bytes, CHUNK_CHANGE, "a change");
+    const tally = new Tally(CHANGE_LIMITS);
+    lengthPrefixedList(c, CHANGE_LIMITS.maxDeps, "dependencies", 32);
+    c.take(c.uleb()); // actor
+    c.uleb(); // seq
+    c.uleb(); // start op
+    c.sleb(); // time
+    c.take(c.uleb()); // message
+    const otherActors = lengthPrefixedList(c, CHANGE_LIMITS.maxActors, "other actors");
+    const others = otherActors.length;
+    const metas = columnMetas(c);
+    const limitOf = rowLimits(metas, CHANGE_LIMITS);
+    const columns = [];
+    for (const m of metas) {
+        if (m.spec & DEFLATE_BIT)
+            refuse("a change column is deflated");
+        const bounds = { actors: 1 + others, group: 1 + others, rows: limitOf(m.spec) };
+        columns.push({ spec: m.spec, rows: countColumn(m.spec & 7, c.take(m.length), tally, bounds) });
+        tally.columnBytes += m.length;
+    }
+    // The rest of the chunk is the change's extra bytes: kept, not expanded.
+    return Object.freeze({
+        maxRows: tally.maxRows,
+        groupSum: tally.groupSum,
+        stringBytes: tally.stringBytes,
+        columnBytes: tally.columnBytes,
+        columns: Object.freeze(columns),
+        otherActors: Object.freeze(otherActors.map(toHexString)),
+        maxDepth: 0,
+    });
+}
+/** Inflates raw DEFLATE data, refusing as soon as the output passes `budget` bytes. */
+function inflateCapped(input, budget) {
+    const parts = [];
+    let total = 0;
+    let over = false;
+    let failed;
+    const inflater = new Inflate((chunk) => {
+        total += chunk.length;
+        if (total > budget)
+            over = true;
+        else
+            parts.push(chunk);
+    });
+    try {
+        for (let i = 0; i < input.length && !over; i += INFLATE_SLICE)
+            inflater.push(input.subarray(i, i + INFLATE_SLICE), i + INFLATE_SLICE >= input.length);
+        if (input.length === 0)
+            inflater.push(new Uint8Array(0), true);
+    }
+    catch (e) {
+        failed = e;
+    }
+    if (over)
+        refuse(`Snapshot columns inflate to more than ${budget} more bytes`);
+    if (failed !== undefined)
+        refuse("a deflated Snapshot column is not valid DEFLATE");
+    const out = new Uint8Array(total);
+    let o = 0;
+    for (const p of parts) {
+        out.set(p, o);
+        o += p.length;
+    }
+    return out;
+}
+/** The values of an actor (1), integer (2) or delta (3) column: null for a null row. */
+function columnValues(type, data) {
+    const c = new Cursor(data);
+    const out = [];
+    let acc = 0;
+    const one = () => {
+        if (type === TYPE_DELTA) {
+            acc += c.sleb();
+            return acc;
+        }
+        return c.uleb();
+    };
+    while (!c.done) {
+        const header = c.sleb();
+        if (header > 0) {
+            if (type === TYPE_DELTA) {
+                const delta = c.sleb();
+                for (let i = 0; i < header; i++) {
+                    acc += delta;
+                    out.push(acc);
+                }
+            }
+            else {
+                const v = c.uleb();
+                for (let i = 0; i < header; i++)
+                    out.push(v);
+            }
+        }
+        else if (header < 0)
+            for (let i = 0; i < -header; i++)
+                out.push(one());
+        else {
+            const nulls = c.uleb();
+            for (let i = 0; i < nulls; i++)
+                out.push(null);
+        }
+    }
+    return out;
+}
+/**
+ * §11.2: the deepest object of a document chunk, from its operation
+ * columns (object, operation ID, action), computed without recursion.
+ * Refuses an object deeper than MAX_DOCUMENT_DEPTH, a cycle, or an object
+ * written into one the document never created.
+ */
+function documentDepth(columns) {
+    const col = (spec) => {
+        const data = columns.get(spec);
+        return data === undefined ? [] : columnValues(spec & 7, data);
+    };
+    const action = col((4 << 4) | 2);
+    const objActor = col((0 << 4) | 1);
+    const objCtr = col((0 << 4) | 2);
+    const idActor = col((2 << 4) | 1);
+    const idCtr = col((2 << 4) | 3);
+    const ROOT = "_root";
+    const parent = new Map();
+    action.forEach((a, i) => {
+        if (a === null || !OBJECT_ACTIONS.has(a))
+            return;
+        const id = `${idCtr[i]}@${idActor[i]}`;
+        const oc = objCtr[i] ?? null;
+        parent.set(id, oc === null ? ROOT : `${oc}@${objActor[i]}`);
+    });
+    const depth = new Map([[ROOT, 0]]);
+    let deepest = 0;
+    for (const start of parent.keys()) {
+        const path = [];
+        let at = start;
+        while (!depth.has(at)) {
+            path.push(at);
+            if (path.length > MAX_DOCUMENT_DEPTH)
+                refuse(`an object is deeper than ${MAX_DOCUMENT_DEPTH} levels (§11.2)`);
+            const up = parent.get(at);
+            if (up === undefined)
+                refuse("an object is written into one the document never created (§11.2)");
+            at = up;
+        }
+        let d = depth.get(at);
+        for (let k = path.length - 1; k >= 0; k--) {
+            d += 1;
+            if (d > MAX_DOCUMENT_DEPTH)
+                refuse(`an object is deeper than ${MAX_DOCUMENT_DEPTH} levels (§11.2)`);
+            depth.set(path[k], d);
+        }
+        if (d > deepest)
+            deepest = d;
+    }
+    return deepest;
+}
+/**
+ * §13.1: checks a Snapshot's save (exactly one document chunk) against
+ * `limits` (at least SNAPSHOT_LIMITS_FLOOR) before the engine sees it,
+ * inflating deflated columns under a running cap. Throws PROFILE_INVALID /
+ * INVALID_AUTOMERGE_BYTES.
+ */
+export function checkSnapshotExpansion(bytes, limits = SNAPSHOT_LIMITS_FLOOR) {
+    const c = body(bytes, CHUNK_DOCUMENT, "a Snapshot");
+    const tally = new Tally(limits);
+    const actors = lengthPrefixedList(c, limits.maxActors, "actors").length;
+    lengthPrefixedList(c, limits.maxDeps, "heads", 32);
+    const changeMetas = columnMetas(c);
+    const opMetas = columnMetas(c);
+    const changeLimit = rowLimits(changeMetas, limits);
+    const opLimit = rowLimits(opMetas, limits);
+    let inflated = 0;
+    const columns = [];
+    const opData = new Map();
+    for (const [m, limitOf] of [
+        ...changeMetas.map((m) => [m, changeLimit]),
+        ...opMetas.map((m) => [m, opLimit]),
+    ]) {
+        let data = c.take(m.length);
+        if (m.spec & DEFLATE_BIT)
+            data = inflateCapped(data, limits.maxInflatedBytes - inflated);
+        inflated += data.length;
+        if (inflated > limits.maxInflatedBytes)
+            refuse(`Snapshot columns hold more than ${limits.maxInflatedBytes} bytes`);
+        const bounds = { actors, group: Number.POSITIVE_INFINITY, rows: limitOf(m.spec) };
+        columns.push({ spec: m.spec, rows: countColumn(m.spec & 7, data, tally, bounds) });
+        if (limitOf === opLimit)
+            opData.set(m.spec & ~DEFLATE_BIT, data);
+    }
+    // §11.2: depths from the operation columns, once their sizes are known to be bounded.
+    const maxDepth = documentDepth(opData);
+    tally.columnBytes = inflated;
+    // The rest is the document's head indices.
+    return Object.freeze({
+        maxRows: tally.maxRows,
+        groupSum: tally.groupSum,
+        stringBytes: tally.stringBytes,
+        columnBytes: tally.columnBytes,
+        columns: Object.freeze(columns),
+        otherActors: Object.freeze([]),
+        maxDepth,
+    });
+}
+//# sourceMappingURL=chunk-limits.js.map

package/dist/data-profile.d.ts

@@ -0,0 +1,159 @@
+import { type DataUnitId, type PrincipalId, type ResourceId } from "@openlfcp/core";
+import { type CheckedChange } from "./automerge-bytes.js";
+import { type ObjectChange, type ReplicaOptions, SharedObjectsReplica } from "./replica.js";
+/**
+ * The Shared Objects Data Profile handler (LFCP-033): what a profile-
+ * agnostic Data Unit applier (@openlfcp/client DataUnitApplier) calls once
+ * LFCP has accepted a unit. It matches the client's DataProfileHandler
+ * structurally; this package depends on neither client nor wire.
+ *
+ * - decode: the §11 plaintext is one checked Automerge change, written by
+ *   the §8 actor of the unit's signing Principal (§8, §11, SO-SEC1);
+ * - apply: the change merges into the replica, or waits in a buffer until
+ *   the changes it depends on arrive in other units (profile-pending), and
+ *   every buffered change it unblocks merges with it;
+ * - one object becoming profile-invalid is a diagnostic, never a refusal:
+ *   the other objects stay usable (§77);
+ * - exclude (§14.1, G-EP7): rebuilds the replica without given units.
+ */
+/** An accepted unit as the applier passes it (structurally the client's ProfileUnit). */
+export interface SharedObjectsUnit {
+    readonly unitId: DataUnitId;
+}
+export interface SharedObjectsDiagnostic {
+    readonly objectId?: string;
+    readonly code: string;
+    readonly diagnostic?: string;
+    readonly pointer?: string;
+    readonly message: string;
+}
+export interface SharedObjectsApplyResult {
+    readonly merged: readonly DataUnitId[];
+    readonly objects: readonly string[];
+    readonly diagnostics: readonly SharedObjectsDiagnostic[];
+    readonly pending?: string;
+}
+/** The outcome of applyBatch: per unit merged, pending or rejected, and the objects once. */
+export interface SharedObjectsBatchResult {
+    /** Units merged now: the batch's and buffered ones it released. */
+    readonly merged: readonly DataUnitId[];
+    /** Units buffered for Automerge dependencies (the batch's and earlier ones still waiting). */
+    readonly pending: readonly DataUnitId[];
+    /** Units whose change was refused (ACTOR_EQUIVOCATION, INVALID_AUTOMERGE_BYTES, …). */
+    readonly rejected: readonly {
+        readonly unitId: DataUnitId;
+        readonly code: string;
+        readonly message: string;
+    }[];
+    readonly objects: readonly string[];
+    readonly diagnostics: readonly SharedObjectsDiagnostic[];
+}
+export interface SharedObjectsExcludeResult {
+    readonly objects: readonly string[];
+    readonly pending: readonly DataUnitId[];
+}
+/** A persisted handler state (structurally the storage ProfileCheckpoint). */
+export interface SharedObjectsCheckpoint {
+    readonly resourceId: ResourceId;
+    readonly dataProfile: string;
+    readonly state: Uint8Array;
+    readonly actorSeq: number;
+    readonly units: readonly {
+        readonly unitId: DataUnitId;
+        readonly ref: string;
+    }[];
+}
+/** The §13 Snapshot codec (structurally the wire DataProfileCodec): plaintext ↔ full save. */
+export interface SharedObjectsSnapshotCodec {
+    readonly dataProfile: string;
+    encode(save: Uint8Array): Uint8Array;
+    decode(plaintext: Uint8Array): Uint8Array;
+}
+/** The §11 codec of one unit (structurally the wire DataProfileCodec). */
+export interface SharedObjectsCodec {
+    readonly dataProfile: string;
+    encode(change: CheckedChange): Uint8Array;
+    decode(plaintext: Uint8Array): CheckedChange;
+}
+export declare class SharedObjectsDataProfile {
+    #private;
+    readonly dataProfile = "org.openlfcp.shared-objects.v1";
+    constructor(replica: SharedObjectsReplica);
+    /**
+     * The local state to persist (structurally the storage ProfileCheckpoint,
+     * LFCP-034/035): the Automerge full save, this actor's sequence (the §9
+     * minSeq on restore) and which unit carried which merged change (for a
+     * G-EP7 rebuild). Units buffered for Automerge dependencies are not in it:
+     * they stay "profile-pending" in storage and are offered again on restore.
+     */
+    checkpoint(): SharedObjectsCheckpoint;
+    /**
+     * The handler of a persisted checkpoint. The replica refuses local writes
+     * if its actor is behind the checkpoint's sequence (§9).
+     */
+    static restore(checkpoint: SharedObjectsCheckpoint, options: Pick<ReplicaOptions, "resource" | "principal">): SharedObjectsDataProfile;
+    /** The current replica (a G-EP7 rebuild replaces it). */
+    get replica(): SharedObjectsReplica;
+    /** §98, §100: object change notifications for remote merges and rebuilds. */
+    onObjectChanged(listener: (change: ObjectChange) => void): () => void;
+    /**
+     * Records which change one of this client's OWN units carries (the unit
+     * was created from a local change, so it is merged already). A later
+     * G-EP7 exclusion of that unit then rebuilds the replica without it, and
+     * the checkpoint keeps the reference. Use it as createQueuedDataUnit's
+     * onCreated.
+     */
+    recordLocal(unitId: DataUnitId, change: CheckedChange): void;
+    /**
+     * The §13 Snapshot codec (structurally the wire DataProfileCodec): an
+     * Automerge full save framed as [1, save]; decoding requires a document
+     * chunk. For receiveSnapshot and createSnapshot.
+     */
+    snapshotCodec(): SharedObjectsSnapshotCodec;
+    /** The state to publish as a Snapshot: the replica's full save. */
+    snapshotState(): Uint8Array;
+    /**
+     * Loads a received Snapshot's full save (§13, §66 step 3): the replica
+     * becomes the save merged with everything it held, and buffered units
+     * whose dependencies the Snapshot brings are merged. Returns the objects
+     * that changed and the units merged from the buffer.
+     */
+    loadSnapshot(save: Uint8Array): {
+        readonly objects: readonly string[];
+        readonly merged: readonly DataUnitId[];
+    };
+    /**
+     * Forgets the whole state (an empty replica that keeps the §9 sequence,
+     * no merged or buffered units), so it can be rebuilt from accepted units
+     * only (SNAP-EP: Snapshot-derived state dropped). Notifies the changes.
+     */
+    reset(): void;
+    /** Whether this handler holds the unit's change (merged, recorded or buffered). */
+    has(unitId: DataUnitId): boolean;
+    /** The units waiting for Automerge dependencies. */
+    pendingUnits(): DataUnitId[];
+    codecFor(unit: {
+        readonly resourceId: ResourceId;
+        readonly actor: PrincipalId;
+    }): SharedObjectsCodec;
+    apply(unit: SharedObjectsUnit, change: CheckedChange): SharedObjectsApplyResult;
+    /**
+     * Applies many accepted units at once (catch-up, store replay, a
+     * Snapshot's remainder): their changes and every buffered one go to the
+     * replica in one receiveChanges call, which hands Automerge one batch
+     * (§14.1 admission per change; one change per call is quadratic). A
+     * refused change rejects only its unit; units missing a dependency are
+     * buffered. Diagnostics are computed once, for the objects that changed.
+     */
+    applyBatch(units: readonly {
+        readonly unit: SharedObjectsUnit;
+        readonly value: CheckedChange;
+    }[]): SharedObjectsBatchResult;
+    /**
+     * §14.1 (G-EP7): the state without `unitIds`, rebuilt from the
+     * remaining changes. Merged units whose changes build on an excluded one
+     * go back to the buffer and are reported as pending.
+     */
+    exclude(unitIds: readonly DataUnitId[]): SharedObjectsExcludeResult;
+}
+//# sourceMappingURL=data-profile.d.ts.map