@openlfcp/shared-objects 0.1.1 → 0.1.2

package/README.md

@@ -20,9 +20,9 @@ reaches the replica (§95). The replica has no Markdown or editor concepts.
 
 Part of the OpenLFCP TypeScript SDK, which implements the OpenLFCP MVP 0.1
 subset of [LFCP-WIRE-01](https://github.com/openlfcp/spec/blob/main/wire/LFCP-WIRE-01.md)
-at `mvp-0.1-baseline.8`, not every deferred WIRE-01 feature. It does not
+at `mvp-0.1-baseline.9`, not every deferred WIRE-01 feature. It does not
 claim full LFCP-WIRE-01 conformance. This is the MVP 0.1 release
-(`0.1.1`, npm dist-tag `latest`). Until 1.0, minor versions may change APIs.
+(`0.1.2`, npm dist-tag `latest`). Until 1.0, minor versions may change APIs.
 
 ## Automerge and WebAssembly
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openlfcp/shared-objects",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "SHARED-OBJECTS-PROFILE-01 (org.openlfcp.shared-objects.v1) implementation.",
   "keywords": [
     "openlfcp",
@@ -45,8 +45,8 @@
   "dependencies": {
     "@automerge/automerge": "3.5.0",
     "fflate": "0.8.3",
-    "@openlfcp/core": "^0.1.1",
-    "@openlfcp/crypto": "^0.1.1"
+    "@openlfcp/core": "^0.1.2",
+    "@openlfcp/crypto": "^0.1.2"
   },
   "devDependencies": {
     "fast-check": "4.10.2"

package/dist/automerge-bytes.d.ts

@@ -1,37 +0,0 @@
-/** A checked Automerge change: its bytes and decoded header. */
-export interface CheckedChange {
-    readonly bytes: Uint8Array;
-    /** Hex SHA-256 change hash (the Automerge change identity). */
-    readonly hash: string;
-    /** Hex actor ID. */
-    readonly actor: string;
-    readonly seq: number;
-    /** Hex hashes of the changes this one depends on. */
-    readonly deps: readonly string[];
-    /** Hex IDs of the other actors the change refers to (§11.1: each must be known to the document). */
-    readonly otherActors: readonly string[];
-}
-/**
- * Checks that `bytes` is exactly one valid Automerge change (§11, §12) and
- * returns it decoded. Rejects with PROFILE_INVALID / INVALID_AUTOMERGE_BYTES: a chunk that is not a
- * change (a document chunk is a full save, §13), bytes Automerge cannot
- * parse, trailing bytes such as a second concatenated change, and a
- * checksum that does not match the change hash. Automerge JS 3.5.0 parses
- * a change without verifying its checksum, so the check is done here.
- */
-export declare function checkChange(bytes: Uint8Array): CheckedChange;
-/**
- * Checks that `bytes` starts as an Automerge full save (a document chunk,
- * §13). Whether the whole image loads, checksums included, is decided by
- * Automerge's load.
- */
-export declare function checkSaveHeader(bytes: Uint8Array): void;
-/** §11: the Data Unit plaintext [1, change] of one checked Automerge change. */
-export declare function frameChange(change: Uint8Array): Uint8Array;
-/** §11: the one Automerge change a Data Unit plaintext carries, checked. Throws PROFILE_INVALID / INVALID_AUTOMERGE_BYTES. */
-export declare function unframeChange(plaintext: Uint8Array): CheckedChange;
-/** §13: the Snapshot plaintext [1, save] of an Automerge full save. */
-export declare function frameSnapshot(save: Uint8Array): Uint8Array;
-/** §13: the Automerge full save a Snapshot plaintext carries (header checked). Throws PROFILE_INVALID / INVALID_AUTOMERGE_BYTES. */
-export declare function unframeSnapshot(plaintext: Uint8Array): Uint8Array;
-//# sourceMappingURL=automerge-bytes.d.ts.map

package/dist/automerge-bytes.js

@@ -1,95 +0,0 @@
-import * as A from "@automerge/automerge";
-import { toHex } from "@openlfcp/core";
-import { checkChangeExpansion } from "./chunk-limits.js";
-import { ProfileInvalidError } from "./profile-invalid.js";
-import { frameProfilePayload, unframeProfilePayload } from "./values.js";
-/**
- * Automerge byte checks of the SHARED-OBJECTS-PROFILE-01 payloads (LFCP-031):
- * a Data Unit plaintext carries exactly one Automerge change (§11, §12), a
- * Snapshot plaintext one Automerge full save (§13). The framing itself is
- * frameProfilePayload / unframeProfilePayload (LFCP-030); this adds the
- * check that the framed bytes are what they claim to be.
- *
- * Automerge storage chunks start with the magic bytes 85 6f 4a 83, a 4-byte
- * checksum (the first 4 bytes of the chunk hash) and a chunk type: 0 for a
- * document (a full save), 1 for a change, 2 for a compressed change.
- */
-const MAGIC = [0x85, 0x6f, 0x4a, 0x83];
-const CHUNK_DOCUMENT = 0;
-const CHUNK_CHANGE = 1;
-const CHUNK_COMPRESSED_CHANGE = 2;
-const HEADER = 9; // magic, checksum, chunk type
-/** §11, §13, §74.1: PROFILE_INVALID / INVALID_AUTOMERGE_BYTES. */
-const reject = (why) => {
-    throw new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", why);
-};
-function chunkType(bytes, what) {
-    if (bytes.length < HEADER || MAGIC.some((b, i) => bytes[i] !== b))
-        return reject(`${what} is not an Automerge chunk`);
-    return bytes[8];
-}
-/**
- * Checks that `bytes` is exactly one valid Automerge change (§11, §12) and
- * returns it decoded. Rejects with PROFILE_INVALID / INVALID_AUTOMERGE_BYTES: a chunk that is not a
- * change (a document chunk is a full save, §13), bytes Automerge cannot
- * parse, trailing bytes such as a second concatenated change, and a
- * checksum that does not match the change hash. Automerge JS 3.5.0 parses
- * a change without verifying its checksum, so the check is done here.
- */
-export function checkChange(bytes) {
-    const type = chunkType(bytes, "the change");
-    if (type === CHUNK_COMPRESSED_CHANGE)
-        reject("a compressed Automerge change (chunk type 2): a change is uncompressed (§11)");
-    if (type !== CHUNK_CHANGE)
-        reject(`chunk type ${type} is not an Automerge change (§11)`);
-    // §11.1: what the change expands to and its structure, before Automerge decodes it.
-    const expansion = checkChangeExpansion(bytes);
-    let decoded;
-    try {
-        decoded = A.decodeChange(bytes);
-    }
-    catch (e) {
-        return reject(`invalid Automerge change bytes (§11): ${e.message}`);
-    }
-    if (toHex(bytes.subarray(4, 8)) !== decoded.hash.slice(0, 8))
-        reject("the Automerge change checksum does not match its hash (§11)");
-    return Object.freeze({
-        bytes: Uint8Array.from(bytes),
-        hash: decoded.hash,
-        actor: decoded.actor,
-        seq: decoded.seq,
-        deps: Object.freeze([...decoded.deps]),
-        otherActors: expansion.otherActors,
-    });
-}
-/**
- * Checks that `bytes` starts as an Automerge full save (a document chunk,
- * §13). Whether the whole image loads, checksums included, is decided by
- * Automerge's load.
- */
-export function checkSaveHeader(bytes) {
-    const type = chunkType(bytes, "the Snapshot image");
-    if (type !== CHUNK_DOCUMENT)
-        reject(`chunk type ${type} is not an Automerge document (full save, §13)`);
-}
-/** §11: the Data Unit plaintext [1, change] of one checked Automerge change. */
-export function frameChange(change) {
-    checkChange(change);
-    return frameProfilePayload(change);
-}
-/** §11: the one Automerge change a Data Unit plaintext carries, checked. Throws PROFILE_INVALID / INVALID_AUTOMERGE_BYTES. */
-export function unframeChange(plaintext) {
-    return checkChange(unframeProfilePayload(plaintext));
-}
-/** §13: the Snapshot plaintext [1, save] of an Automerge full save. */
-export function frameSnapshot(save) {
-    checkSaveHeader(save);
-    return frameProfilePayload(save);
-}
-/** §13: the Automerge full save a Snapshot plaintext carries (header checked). Throws PROFILE_INVALID / INVALID_AUTOMERGE_BYTES. */
-export function unframeSnapshot(plaintext) {
-    const save = unframeProfilePayload(plaintext);
-    checkSaveHeader(save);
-    return save;
-}
-//# sourceMappingURL=automerge-bytes.js.map

package/dist/chunk-limits.d.ts

@@ -1,58 +0,0 @@
-/** The exact limits of a change (§11.1): writers stay within them, receivers reject above. */
-export declare const CHANGE_LIMITS: Readonly<{
-    maxRows: 16384;
-    maxGroupSum: 262144;
-    maxStringBytes: number;
-    maxDeps: 1024;
-    maxActors: 1024;
-}>;
-/**
- * The floor of a Snapshot's limits (§13.1): every receiver accepts at least
- * these. A receiver MAY configure higher limits; above its own it rejects
- * the Snapshot before the engine and falls back to the data round.
- */
-export declare const SNAPSHOT_LIMITS_FLOOR: Readonly<{
-    maxRows: 262144;
-    maxGroupSum: 262144;
-    maxStringBytes: number;
-    maxInflatedBytes: number;
-    maxDeps: 1024;
-    maxActors: 1024;
-}>;
-export type SnapshotLimits = typeof SNAPSHOT_LIMITS_FLOOR;
-/** §11.2: no object of a document is deeper than this (the root is depth 0). */
-export declare const MAX_DOCUMENT_DEPTH = 256;
-/** The operation actions that create an object (§11.2): makeMap, makeList, makeText, makeTable. */
-export declare const OBJECT_ACTIONS: ReadonlySet<number>;
-/** What a chunk expands to (for tests and diagnostics). */
-export interface ChunkExpansion {
-    /** The largest value count of any column (a change's op count is its action column's). */
-    readonly maxRows: number;
-    readonly groupSum: number;
-    readonly stringBytes: number;
-    /** Column data bytes after inflation (a change has no deflated columns). */
-    readonly columnBytes: number;
-    /** Each column's spec (id << 4 | deflate << 3 | type) and value count, in chunk order. */
-    readonly columns: readonly {
-        readonly spec: number;
-        readonly rows: number;
-    }[];
-    /** A change's other actors (hex), in order: actor index i + 1 (§11.1). Empty for a Snapshot. */
-    readonly otherActors: readonly string[];
-    /** A Snapshot's deepest object (§11.2); 0 for a change (its depths depend on the document). */
-    readonly maxDepth: number;
-}
-/**
- * §11.1: checks an uncompressed change chunk (type 1) against the exact
- * change limits before the engine sees it. Throws PROFILE_INVALID /
- * INVALID_AUTOMERGE_BYTES; returns what it expands to.
- */
-export declare function checkChangeExpansion(bytes: Uint8Array): ChunkExpansion;
-/**
- * §13.1: checks a Snapshot's save (exactly one document chunk) against
- * `limits` (at least SNAPSHOT_LIMITS_FLOOR) before the engine sees it,
- * inflating deflated columns under a running cap. Throws PROFILE_INVALID /
- * INVALID_AUTOMERGE_BYTES.
- */
-export declare function checkSnapshotExpansion(bytes: Uint8Array, limits?: SnapshotLimits): ChunkExpansion;
-//# sourceMappingURL=chunk-limits.d.ts.map

package/dist/chunk-limits.js

@@ -1,457 +0,0 @@
-// Expansion limits for Automerge chunks (SHARED-OBJECTS-PROFILE-01 §11.1,
-// §13.1; SPEC-PATCH-07). Automerge's columnar format run-length encodes its
-// columns, and a Snapshot's columns may also be deflated, so a few bytes can
-// declare millions of operations or gigabytes of data: a 112-byte change
-// expanded to 1,000,000 operations and 1.2 GiB in Automerge JS 3.5.0. This
-// walker reads a chunk's structure and the run headers of every column,
-// without materialising any value, and refuses a chunk over the limits
-// BEFORE the Automerge engine sees it. It runs in time linear in the input
-// (plus the capped inflation of a Snapshot's deflated columns).
-//
-// Counting rules (the profile states them; both SDKs count the same way):
-// - every column's value count (its rows): an RLE run of n adds n, a
-//   literal run of n adds n, a null run of n adds n; a boolean column adds
-//   each run length; a raw value column adds nothing;
-// - every group column's sum (the total of its values: pred and succ
-//   entries);
-// - expanded string bytes: each string value counted once per row it
-//   occupies (an RLE run of n copies of a k-byte string adds n * k);
-// - structure: no two columns with one specification, every actor index
-//   below the number of actors, and (a change) no group value above one
-//   plus the number of other actors (an op's predecessors have distinct
-//   actors);
-// - for a Snapshot, the bytes of all column data after inflation.
-import { Inflate } from "fflate";
-import { ProfileInvalidError } from "./profile-invalid.js";
-/** The exact limits of a change (§11.1): writers stay within them, receivers reject above. */
-export const CHANGE_LIMITS = Object.freeze({
-    maxRows: 16_384,
-    maxGroupSum: 262_144,
-    maxStringBytes: 4 * 1024 * 1024,
-    maxDeps: 1_024,
-    maxActors: 1_024,
-});
-/**
- * The floor of a Snapshot's limits (§13.1): every receiver accepts at least
- * these. A receiver MAY configure higher limits; above its own it rejects
- * the Snapshot before the engine and falls back to the data round.
- */
-export const SNAPSHOT_LIMITS_FLOOR = Object.freeze({
-    maxRows: 262_144,
-    maxGroupSum: 262_144,
-    maxStringBytes: 32 * 1024 * 1024,
-    maxInflatedBytes: 32 * 1024 * 1024,
-    maxDeps: 1_024,
-    maxActors: 1_024,
-});
-/** §11.2: no object of a document is deeper than this (the root is depth 0). */
-export const MAX_DOCUMENT_DEPTH = 256;
-/** The operation actions that create an object (§11.2): makeMap, makeList, makeText, makeTable. */
-export const OBJECT_ACTIONS = new Set([0, 2, 4, 6]);
-const MAGIC = [0x85, 0x6f, 0x4a, 0x83];
-const CHUNK_DOCUMENT = 0;
-const CHUNK_CHANGE = 1;
-const DEFLATE_BIT = 0x08;
-const TYPE_GROUP = 0;
-const TYPE_ACTOR = 1;
-const TYPE_DELTA = 3;
-const TYPE_BOOLEAN = 4;
-const TYPE_STRING = 5;
-const TYPE_RAW = 7;
-/** Input fed to the inflater per push: each push yields at most ~1,032x its size. */
-const INFLATE_SLICE = 1024;
-const refuse = (why) => {
-    throw new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", `Automerge chunk refused (§11.1): ${why}`);
-};
-class Cursor {
-    bytes;
-    end;
-    pos = 0;
-    constructor(bytes, end = bytes.length) {
-        this.bytes = bytes;
-        this.end = end;
-    }
-    get done() {
-        return this.pos >= this.end;
-    }
-    take(n) {
-        if (n > this.end - this.pos)
-            refuse("a length runs past the end");
-        const out = this.bytes.subarray(this.pos, this.pos + n);
-        this.pos += n;
-        return out;
-    }
-    /** Unsigned LEB128 as a number; values at or above 2^53 come back as Infinity (over every limit). */
-    uleb() {
-        let value = 0;
-        let scale = 1;
-        for (let i = 0; i < 10; i++) {
-            if (this.pos >= this.end)
-                refuse("a LEB128 number runs past the end");
-            const b = this.bytes[this.pos++];
-            value += (b & 0x7f) * scale;
-            if ((b & 0x80) === 0)
-                return value >= 2 ** 53 ? Number.POSITIVE_INFINITY : value;
-            scale *= 128;
-        }
-        return refuse("a LEB128 number is longer than 10 bytes");
-    }
-    /** Signed LEB128 as a number; magnitudes at or above 2^53 come back as +/-Infinity. */
-    sleb() {
-        let value = 0;
-        let scale = 1;
-        for (let i = 0; i < 10; i++) {
-            if (this.pos >= this.end)
-                refuse("a LEB128 number runs past the end");
-            const b = this.bytes[this.pos++];
-            value += (b & 0x7f) * scale;
-            scale *= 128;
-            if ((b & 0x80) === 0) {
-                if (b & 0x40)
-                    value -= scale;
-                return Math.abs(value) >= 2 ** 53 ? Math.sign(value) * Number.POSITIVE_INFINITY : value;
-            }
-        }
-        return refuse("a LEB128 number is longer than 10 bytes");
-    }
-}
-class Tally {
-    limits;
-    maxRows = 0;
-    groupSum = 0;
-    stringBytes = 0;
-    columnBytes = 0;
-    constructor(limits) {
-        this.limits = limits;
-    }
-    rows(column, limit) {
-        if (column > limit)
-            refuse(`a column has more than ${limit} values`);
-        if (column > this.maxRows)
-            this.maxRows = column;
-    }
-    group(add) {
-        this.groupSum += add;
-        if (!(this.groupSum <= this.limits.maxGroupSum))
-            refuse(`group columns sum to more than ${this.limits.maxGroupSum}`);
-    }
-    strings(add) {
-        this.stringBytes += add;
-        if (!(this.stringBytes <= this.limits.maxStringBytes))
-            refuse(`strings expand to more than ${this.limits.maxStringBytes} bytes`);
-    }
-}
-/** Counts one column's values (and group sums, string bytes) from its run headers. */
-function countColumn(type, data, tally, bounds) {
-    if (type === TYPE_RAW)
-        return 0;
-    const c = new Cursor(data);
-    let rows = 0;
-    const add = (n) => {
-        rows += n;
-        tally.rows(rows, bounds.rows);
-    };
-    if (type === TYPE_BOOLEAN) {
-        while (!c.done)
-            add(c.uleb());
-        return rows;
-    }
-    // One value of an RLE column: its group count, its string length, or skipped.
-    const value = () => {
-        if (type === TYPE_STRING) {
-            const len = c.uleb();
-            c.take(len);
-            return len;
-        }
-        if (type === TYPE_DELTA)
-            return c.sleb();
-        return c.uleb();
-    };
-    const account = (v, times) => {
-        if (type === TYPE_GROUP) {
-            if (v > bounds.group)
-                refuse("an operation has more predecessors than the change has actors");
-            tally.group(v * times);
-        }
-        else if (type === TYPE_STRING)
-            tally.strings(v * times);
-        else if (type === TYPE_ACTOR && !(v < bounds.actors))
-            refuse("an actor index is out of range");
-    };
-    while (!c.done) {
-        const header = c.sleb();
-        if (header > 0) {
-            add(header);
-            account(value(), header);
-        }
-        else if (header < 0) {
-            const n = -header;
-            add(n); // refuses before reading an oversized literal run
-            for (let i = 0; i < n; i++)
-                account(value(), 1);
-        }
-        else
-            add(c.uleb());
-    }
-    return rows;
-}
-/** Column metadata. The count has no limit of its own (§11.1): each entry takes at least two bytes. */
-function columnMetas(c) {
-    const count = c.uleb();
-    if (count > (c.end - c.pos) / 2)
-        refuse("the column metadata runs past the end");
-    const out = [];
-    const specs = new Set();
-    for (let i = 0; i < count; i++) {
-        const spec = c.uleb();
-        if (specs.has(spec))
-            refuse("two columns share a specification");
-        specs.add(spec);
-        out.push({ spec, length: c.uleb() });
-    }
-    return out;
-}
-function lengthPrefixedList(c, limit, what, fixed) {
-    const count = c.uleb();
-    if (count > limit)
-        refuse(`more than ${limit} ${what}`);
-    const out = [];
-    for (let i = 0; i < count; i++)
-        out.push(c.take(fixed ?? c.uleb()));
-    return out;
-}
-const toHexString = (b) => Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
-/**
- * Each column's value limit: a column that shares its id with a group
- * column holds that group's entries (predecessors, successors, a change's
- * dependencies), so the group sum bounds it; every other column has the
- * row limit.
- */
-function rowLimits(metas, limits) {
-    const grouped = new Set(metas.filter((m) => (m.spec & 7) === TYPE_GROUP).map((m) => m.spec >> 4));
-    return (spec) => grouped.has(spec >> 4) && (spec & 7) !== TYPE_GROUP ? limits.maxGroupSum : limits.maxRows;
-}
-/** The chunk's single body: magic, checksum, type, length; nothing may follow it. */
-function body(bytes, want, what) {
-    const c = new Cursor(bytes);
-    const magic = c.take(4);
-    if (!MAGIC.every((b, i) => magic[i] === b))
-        refuse(`${what} has no Automerge magic bytes`);
-    c.take(4); // checksum: verified elsewhere (checkChange; the engine for a Snapshot)
-    const type = c.take(1)[0];
-    if (type !== want)
-        refuse(`${what} is chunk type ${type}, not ${want}`);
-    const length = c.uleb();
-    if (length !== bytes.length - c.pos)
-        refuse(`${what} must be exactly one chunk with nothing after it`);
-    return c;
-}
-/**
- * §11.1: checks an uncompressed change chunk (type 1) against the exact
- * change limits before the engine sees it. Throws PROFILE_INVALID /
- * INVALID_AUTOMERGE_BYTES; returns what it expands to.
- */
-export function checkChangeExpansion(bytes) {
-    const c = body(bytes, CHUNK_CHANGE, "a change");
-    const tally = new Tally(CHANGE_LIMITS);
-    lengthPrefixedList(c, CHANGE_LIMITS.maxDeps, "dependencies", 32);
-    c.take(c.uleb()); // actor
-    c.uleb(); // seq
-    c.uleb(); // start op
-    c.sleb(); // time
-    c.take(c.uleb()); // message
-    const otherActors = lengthPrefixedList(c, CHANGE_LIMITS.maxActors, "other actors");
-    const others = otherActors.length;
-    const metas = columnMetas(c);
-    const limitOf = rowLimits(metas, CHANGE_LIMITS);
-    const columns = [];
-    for (const m of metas) {
-        if (m.spec & DEFLATE_BIT)
-            refuse("a change column is deflated");
-        const bounds = { actors: 1 + others, group: 1 + others, rows: limitOf(m.spec) };
-        columns.push({ spec: m.spec, rows: countColumn(m.spec & 7, c.take(m.length), tally, bounds) });
-        tally.columnBytes += m.length;
-    }
-    // The rest of the chunk is the change's extra bytes: kept, not expanded.
-    return Object.freeze({
-        maxRows: tally.maxRows,
-        groupSum: tally.groupSum,
-        stringBytes: tally.stringBytes,
-        columnBytes: tally.columnBytes,
-        columns: Object.freeze(columns),
-        otherActors: Object.freeze(otherActors.map(toHexString)),
-        maxDepth: 0,
-    });
-}
-/** Inflates raw DEFLATE data, refusing as soon as the output passes `budget` bytes. */
-function inflateCapped(input, budget) {
-    const parts = [];
-    let total = 0;
-    let over = false;
-    let failed;
-    const inflater = new Inflate((chunk) => {
-        total += chunk.length;
-        if (total > budget)
-            over = true;
-        else
-            parts.push(chunk);
-    });
-    try {
-        for (let i = 0; i < input.length && !over; i += INFLATE_SLICE)
-            inflater.push(input.subarray(i, i + INFLATE_SLICE), i + INFLATE_SLICE >= input.length);
-        if (input.length === 0)
-            inflater.push(new Uint8Array(0), true);
-    }
-    catch (e) {
-        failed = e;
-    }
-    if (over)
-        refuse(`Snapshot columns inflate to more than ${budget} more bytes`);
-    if (failed !== undefined)
-        refuse("a deflated Snapshot column is not valid DEFLATE");
-    const out = new Uint8Array(total);
-    let o = 0;
-    for (const p of parts) {
-        out.set(p, o);
-        o += p.length;
-    }
-    return out;
-}
-/** The values of an actor (1), integer (2) or delta (3) column: null for a null row. */
-function columnValues(type, data) {
-    const c = new Cursor(data);
-    const out = [];
-    let acc = 0;
-    const one = () => {
-        if (type === TYPE_DELTA) {
-            acc += c.sleb();
-            return acc;
-        }
-        return c.uleb();
-    };
-    while (!c.done) {
-        const header = c.sleb();
-        if (header > 0) {
-            if (type === TYPE_DELTA) {
-                const delta = c.sleb();
-                for (let i = 0; i < header; i++) {
-                    acc += delta;
-                    out.push(acc);
-                }
-            }
-            else {
-                const v = c.uleb();
-                for (let i = 0; i < header; i++)
-                    out.push(v);
-            }
-        }
-        else if (header < 0)
-            for (let i = 0; i < -header; i++)
-                out.push(one());
-        else {
-            const nulls = c.uleb();
-            for (let i = 0; i < nulls; i++)
-                out.push(null);
-        }
-    }
-    return out;
-}
-/**
- * §11.2: the deepest object of a document chunk, from its operation
- * columns (object, operation ID, action), computed without recursion.
- * Refuses an object deeper than MAX_DOCUMENT_DEPTH, a cycle, or an object
- * written into one the document never created.
- */
-function documentDepth(columns) {
-    const col = (spec) => {
-        const data = columns.get(spec);
-        return data === undefined ? [] : columnValues(spec & 7, data);
-    };
-    const action = col((4 << 4) | 2);
-    const objActor = col((0 << 4) | 1);
-    const objCtr = col((0 << 4) | 2);
-    const idActor = col((2 << 4) | 1);
-    const idCtr = col((2 << 4) | 3);
-    const ROOT = "_root";
-    const parent = new Map();
-    action.forEach((a, i) => {
-        if (a === null || !OBJECT_ACTIONS.has(a))
-            return;
-        const id = `${idCtr[i]}@${idActor[i]}`;
-        const oc = objCtr[i] ?? null;
-        parent.set(id, oc === null ? ROOT : `${oc}@${objActor[i]}`);
-    });
-    const depth = new Map([[ROOT, 0]]);
-    let deepest = 0;
-    for (const start of parent.keys()) {
-        const path = [];
-        let at = start;
-        while (!depth.has(at)) {
-            path.push(at);
-            if (path.length > MAX_DOCUMENT_DEPTH)
-                refuse(`an object is deeper than ${MAX_DOCUMENT_DEPTH} levels (§11.2)`);
-            const up = parent.get(at);
-            if (up === undefined)
-                refuse("an object is written into one the document never created (§11.2)");
-            at = up;
-        }
-        let d = depth.get(at);
-        for (let k = path.length - 1; k >= 0; k--) {
-            d += 1;
-            if (d > MAX_DOCUMENT_DEPTH)
-                refuse(`an object is deeper than ${MAX_DOCUMENT_DEPTH} levels (§11.2)`);
-            depth.set(path[k], d);
-        }
-        if (d > deepest)
-            deepest = d;
-    }
-    return deepest;
-}
-/**
- * §13.1: checks a Snapshot's save (exactly one document chunk) against
- * `limits` (at least SNAPSHOT_LIMITS_FLOOR) before the engine sees it,
- * inflating deflated columns under a running cap. Throws PROFILE_INVALID /
- * INVALID_AUTOMERGE_BYTES.
- */
-export function checkSnapshotExpansion(bytes, limits = SNAPSHOT_LIMITS_FLOOR) {
-    const c = body(bytes, CHUNK_DOCUMENT, "a Snapshot");
-    const tally = new Tally(limits);
-    const actors = lengthPrefixedList(c, limits.maxActors, "actors").length;
-    lengthPrefixedList(c, limits.maxDeps, "heads", 32);
-    const changeMetas = columnMetas(c);
-    const opMetas = columnMetas(c);
-    const changeLimit = rowLimits(changeMetas, limits);
-    const opLimit = rowLimits(opMetas, limits);
-    let inflated = 0;
-    const columns = [];
-    const opData = new Map();
-    for (const [m, limitOf] of [
-        ...changeMetas.map((m) => [m, changeLimit]),
-        ...opMetas.map((m) => [m, opLimit]),
-    ]) {
-        let data = c.take(m.length);
-        if (m.spec & DEFLATE_BIT)
-            data = inflateCapped(data, limits.maxInflatedBytes - inflated);
-        inflated += data.length;
-        if (inflated > limits.maxInflatedBytes)
-            refuse(`Snapshot columns hold more than ${limits.maxInflatedBytes} bytes`);
-        const bounds = { actors, group: Number.POSITIVE_INFINITY, rows: limitOf(m.spec) };
-        columns.push({ spec: m.spec, rows: countColumn(m.spec & 7, data, tally, bounds) });
-        if (limitOf === opLimit)
-            opData.set(m.spec & ~DEFLATE_BIT, data);
-    }
-    // §11.2: depths from the operation columns, once their sizes are known to be bounded.
-    const maxDepth = documentDepth(opData);
-    tally.columnBytes = inflated;
-    // The rest is the document's head indices.
-    return Object.freeze({
-        maxRows: tally.maxRows,
-        groupSum: tally.groupSum,
-        stringBytes: tally.stringBytes,
-        columnBytes: tally.columnBytes,
-        columns: Object.freeze(columns),
-        otherActors: Object.freeze([]),
-        maxDepth,
-    });
-}
-//# sourceMappingURL=chunk-limits.js.map