@openlfcp/shared-objects 0.1.3 → 0.1.5

package/README.md

@@ -20,9 +20,9 @@ reaches the replica (§95). The replica has no Markdown or editor concepts.
 
 Part of the OpenLFCP TypeScript SDK, which implements the OpenLFCP MVP 0.1
 subset of [LFCP-WIRE-01](https://github.com/openlfcp/spec/blob/main/wire/LFCP-WIRE-01.md)
-at `mvp-0.1-baseline.9`, not every deferred WIRE-01 feature. It does not
+at `mvp-0.1-baseline.10`, not every deferred WIRE-01 feature. It does not
 claim full LFCP-WIRE-01 conformance. This is the MVP 0.1 release
-(`0.1.3`, npm dist-tag `latest`). Until 1.0, minor versions may change APIs.
+(`0.1.4`, npm dist-tag `latest`). Until 1.0, minor versions may change APIs.
 
 ## Automerge and WebAssembly
 

package/dist/automerge-bytes.d.ts

@@ -1,3 +1,4 @@
+import { type ParsedChange } from "./canonical.js";
 /** A checked Automerge change: its bytes and decoded header. */
 export interface CheckedChange {
     readonly bytes: Uint8Array;
@@ -20,6 +21,8 @@ export interface CheckedChange {
  * a change without verifying its checksum, so the check is done here.
  */
 export declare function checkChange(bytes: Uint8Array): CheckedChange;
+/** The change as its canonical bytes give it (§11.3), reusing the walk of checkChange. */
+export declare function parsedOf(change: CheckedChange): ParsedChange;
 /**
  * Checks that `bytes` starts as an Automerge full save (a document chunk,
  * §13). Whether the whole image loads, checksums included, is decided by

package/dist/automerge-bytes.js

@@ -1,5 +1,6 @@
 import * as A from "@automerge/automerge";
 import { toHex } from "@openlfcp/core";
+import { checkCanonicalChange } from "./canonical.js";
 import { checkChangeExpansion } from "./chunk-limits.js";
 import { ProfileInvalidError } from "./profile-invalid.js";
 import { frameProfilePayload, unframeProfilePayload } from "./values.js";
@@ -44,6 +45,8 @@ export function checkChange(bytes) {
         reject(`chunk type ${type} is not an Automerge change (§11)`);
     // §11.1: what the change expands to and its structure, before Automerge decodes it.
     const expansion = checkChangeExpansion(bytes);
+    // §11.3: the canonical encoding, by the format's properties, still before the engine.
+    const parsed = checkCanonicalChange(bytes);
     let decoded;
     try {
         decoded = A.decodeChange(bytes);
@@ -53,7 +56,7 @@ export function checkChange(bytes) {
     }
     if (toHex(bytes.subarray(4, 8)) !== decoded.hash.slice(0, 8))
         reject("the Automerge change checksum does not match its hash (§11)");
-    return Object.freeze({
+    const checked = Object.freeze({
         bytes: Uint8Array.from(bytes),
         hash: decoded.hash,
         actor: decoded.actor,
@@ -61,6 +64,19 @@ export function checkChange(bytes) {
         deps: Object.freeze([...decoded.deps]),
         otherActors: expansion.otherActors,
     });
+    PARSED.set(checked, parsed);
+    return checked;
+}
+/** The operations checkChange read from the bytes (§11.3), for the references of §11.4. */
+const PARSED = new WeakMap();
+/** The change as its canonical bytes give it (§11.3), reusing the walk of checkChange. */
+export function parsedOf(change) {
+    let p = PARSED.get(change);
+    if (p === undefined) {
+        p = checkCanonicalChange(change.bytes);
+        PARSED.set(change, p);
+    }
+    return p;
 }
 /**
  * Checks that `bytes` starts as an Automerge full save (a document chunk,

package/dist/canonical.d.ts

@@ -0,0 +1,38 @@
+/** An operation of a change, as the references of §11.4 read it. */
+export interface ParsedOp {
+    /** "_root", or the creating operation's ID "counter@actorhex". */
+    readonly obj: string;
+    /** A property name, the head of a sequence, or an element ID. */
+    readonly key: {
+        readonly kind: "prop";
+        readonly name: string;
+    } | {
+        readonly kind: "head";
+    } | {
+        readonly kind: "elem";
+        readonly id: string;
+    };
+    readonly insert: boolean;
+    /** 0 makeMap, 1 set, 2 makeList, 3 del, 4 makeText, 5 inc, 6 makeTable, 7 mark. */
+    readonly action: number;
+    /** Predecessor IDs "counter@actorhex", in order. */
+    readonly pred: readonly string[];
+}
+/** A change read from its bytes (§11.3), without the engine. */
+export interface ParsedChange {
+    readonly actor: string;
+    readonly seq: number;
+    readonly startOp: number;
+    /** Hex dependency hashes, ascending. */
+    readonly deps: readonly string[];
+    /** Hex other actors, ascending: actor index i is otherActors[i - 1]. */
+    readonly otherActors: readonly string[];
+    readonly ops: readonly ParsedOp[];
+}
+/**
+ * §11.3: checks that `bytes` (one change chunk within the §11.1 limits) is
+ * the canonical encoding of its change, and returns the change's operations
+ * read from it. Throws PROFILE_INVALID / INVALID_AUTOMERGE_BYTES.
+ */
+export declare function checkCanonicalChange(bytes: Uint8Array): ParsedChange;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/canonical.js

@@ -0,0 +1,613 @@
+// The canonical change encoding (SHARED-OBJECTS-PROFILE-01 §11.3,
+// SPEC-PATCH-10, ADR 0010), checked by the properties of the change format
+// version 1, before the Automerge engine decodes the change. An engine does
+// not keep the bytes of a change it applies: it writes the change again
+// when it saves or hands it out, so a change with any other encoding of the
+// same operations gets a different hash there, and the document's save
+// then fails to load. The walk also gives the change's operations, read
+// without the engine, for the operation references of §11.4.
+//
+// Each run-length column is decoded strictly (shortest LEB128, 64-bit
+// range) and encoded again by the one rule of §11.3 rule 5; the two must be
+// the same bytes. Everything else is checked as stated: the header, the
+// columns and their presence, row counts, value metadata and bytes,
+// actions, IDs and counters below 2^32, sorted predecessors.
+import { ProfileInvalidError } from "./profile-invalid.js";
+const refuse = (why) => {
+    throw new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", `the change is not in its canonical encoding (§11.3): ${why}`);
+};
+const U64 = 1n << 64n;
+const I64_MIN = -(1n << 63n);
+const I64_MAX = (1n << 63n) - 1n;
+const U32 = 2 ** 32;
+const UTF8 = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+function utf8(bytes, what) {
+    try {
+        return UTF8.decode(bytes);
+    }
+    catch {
+        return refuse(`${what} is not valid UTF-8`);
+    }
+}
+const hex = (b) => Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
+/** Byte-wise lexicographic order, a shorter prefix first. */
+function compareBytes(a, b) {
+    const n = Math.min(a.length, b.length);
+    for (let i = 0; i < n; i++)
+        if (a[i] !== b[i])
+            return a[i] - b[i];
+    return a.length - b.length;
+}
+/** A strict reader: every LEB128 number in its shortest form and in range (rule 1). */
+class Reader {
+    bytes;
+    pos = 0;
+    constructor(bytes) {
+        this.bytes = bytes;
+    }
+    get done() {
+        return this.pos >= this.bytes.length;
+    }
+    take(n) {
+        if (!(n <= this.bytes.length - this.pos))
+            refuse("a length runs past the end");
+        const out = this.bytes.subarray(this.pos, this.pos + n);
+        this.pos += n;
+        return out;
+    }
+    ubig() {
+        let value = 0n;
+        let shift = 0n;
+        const start = this.pos;
+        for (;;) {
+            if (this.pos >= this.bytes.length)
+                refuse("a LEB128 number runs past the end");
+            if (this.pos - start >= 10)
+                refuse("an unsigned number is 2^64 or more");
+            const b = this.bytes[this.pos++];
+            value |= BigInt(b & 0x7f) << shift;
+            shift += 7n;
+            if ((b & 0x80) === 0) {
+                if (b === 0 && this.pos - start > 1)
+                    refuse("a LEB128 number is not in its shortest form");
+                if (value >= U64)
+                    refuse("an unsigned number is 2^64 or more");
+                return value;
+            }
+        }
+    }
+    sbig() {
+        let value = 0n;
+        let shift = 0n;
+        const start = this.pos;
+        for (;;) {
+            if (this.pos >= this.bytes.length)
+                refuse("a LEB128 number runs past the end");
+            if (this.pos - start >= 10)
+                refuse("a signed number is outside the 64-bit range");
+            const b = this.bytes[this.pos++];
+            value |= BigInt(b & 0x7f) << shift;
+            shift += 7n;
+            if ((b & 0x80) === 0) {
+                if (b & 0x40)
+                    value -= 1n << shift;
+                if (this.pos - start > 1) {
+                    const prev = this.bytes[this.pos - 2];
+                    if ((b === 0x00 && (prev & 0x40) === 0) || (b === 0x7f && (prev & 0x40) !== 0))
+                        refuse("a LEB128 number is not in its shortest form");
+                }
+                if (value < I64_MIN || value > I64_MAX)
+                    refuse("a signed number is outside the 64-bit range");
+                return value;
+            }
+        }
+    }
+    /** An unsigned count or length: a safe integer, else over every bound. */
+    unum() {
+        const v = this.ubig();
+        return v > BigInt(Number.MAX_SAFE_INTEGER) ? Number.POSITIVE_INFINITY : Number(v);
+    }
+}
+function uleb(v, out) {
+    let x = v;
+    do {
+        let b = Number(x & 0x7fn);
+        x >>= 7n;
+        if (x !== 0n)
+            b |= 0x80;
+        out.push(b);
+    } while (x !== 0n);
+}
+function sleb(v, out) {
+    let x = v;
+    for (;;) {
+        const b = Number(x & 0x7fn);
+        x >>= 7n;
+        const done = (x === 0n && (b & 0x40) === 0) || (x === -1n && (b & 0x40) !== 0);
+        out.push(done ? b : b | 0x80);
+        if (done)
+            return;
+    }
+}
+const TYPE_DELTA = 3;
+const TYPE_BOOLEAN = 4;
+const TYPE_STRING = 5;
+const same = (a, b) => {
+    if (a === null || b === null)
+        return a === b;
+    if (typeof a === "bigint" || typeof b === "bigint")
+        return a === b;
+    return a.length === b.length && compareBytes(a, b) === 0;
+};
+/**
+ * No column of a change within the §11.1 limits has more rows (a group's
+ * entries are bounded by the group sum); the walk refuses more on its own,
+ * whether or not the limits ran first.
+ */
+const MAX_ROWS = 262_144;
+const room = (have, add) => {
+    if (add > BigInt(MAX_ROWS - have))
+        refuse("a column has more rows than a change may");
+};
+/** Decodes a run-length column (types 0, 1, 2, 3, 5, 6) strictly; a delta column's rows are absolute. */
+function decodeRle(type, data) {
+    const r = new Reader(data);
+    const rows = [];
+    let acc = 0n;
+    const one = () => {
+        if (type === TYPE_STRING)
+            return r.take(r.unum());
+        if (type === TYPE_DELTA)
+            return r.sbig();
+        return r.ubig();
+    };
+    const push = (v) => {
+        if (type === TYPE_DELTA) {
+            acc += v;
+            rows.push(acc);
+        }
+        else
+            rows.push(v);
+    };
+    while (!r.done) {
+        const n = r.sbig();
+        room(rows.length, n < 0n ? -n : n);
+        if (n > 0n) {
+            const v = one();
+            for (let i = 0n; i < n; i++)
+                push(v);
+        }
+        else if (n < 0n)
+            for (let i = 0n; i < -n; i++)
+                push(one());
+        else {
+            const nulls = r.ubig();
+            room(rows.length, nulls);
+            for (let i = 0n; i < nulls; i++)
+                rows.push(null);
+        }
+    }
+    return rows;
+}
+/** The one encoding of §11.3 rule 5 of `rows` (a delta column's rows absolute). */
+function encodeRle(type, rows) {
+    let values = rows;
+    if (type === TYPE_DELTA) {
+        let prev = 0n;
+        values = rows.map((v) => {
+            if (v === null)
+                return null;
+            const d = v - prev;
+            prev = v;
+            return d;
+        });
+    }
+    const out = [];
+    const value = (v) => {
+        if (type === TYPE_STRING) {
+            const b = v;
+            uleb(BigInt(b.length), out);
+            for (const x of b)
+                out.push(x);
+        }
+        else if (type === TYPE_DELTA)
+            sleb(v, out);
+        else
+            uleb(v, out);
+    };
+    let i = 0;
+    while (i < values.length) {
+        const v = values[i];
+        if (v === null) {
+            let j = i;
+            while (j < values.length && values[j] === null)
+                j++;
+            sleb(0n, out);
+            uleb(BigInt(j - i), out);
+            i = j;
+            continue;
+        }
+        let j = i + 1;
+        while (j < values.length && same(values[j], v))
+            j++;
+        if (j - i >= 2) {
+            sleb(BigInt(j - i), out);
+            value(v);
+            i = j;
+            continue;
+        }
+        // A literal run: up to a null or the start of a repetition.
+        let k = i;
+        while (k < values.length &&
+            values[k] !== null &&
+            !(k + 1 < values.length && same(values[k + 1], values[k])))
+            k++;
+        sleb(BigInt(-(k - i)), out);
+        for (let m = i; m < k; m++)
+            value(values[m]);
+        i = k;
+    }
+    return Uint8Array.from(out);
+}
+function decodeBoolean(data) {
+    const r = new Reader(data);
+    const rows = [];
+    let bit = false;
+    while (!r.done) {
+        const n = r.unum();
+        room(rows.length, BigInt(Number.isFinite(n) ? n : Number.MAX_SAFE_INTEGER));
+        for (let i = 0; i < n; i++)
+            rows.push(bit);
+        bit = !bit;
+    }
+    return rows;
+}
+function encodeBoolean(rows) {
+    const out = [];
+    let bit = false;
+    let i = 0;
+    while (i < rows.length) {
+        let j = i;
+        while (j < rows.length && rows[j] === bit)
+            j++;
+        uleb(BigInt(j - i), out);
+        bit = !bit;
+        i = j;
+    }
+    return Uint8Array.from(out);
+}
+/** The columns of the change format (§11.3 rule 3), by specification. */
+const OBJ_ACTOR = 0x01;
+const OBJ_CTR = 0x02;
+const KEY_ACTOR = 0x11;
+const KEY_CTR = 0x13;
+const KEY_STR = 0x15;
+const INSERT = 0x34;
+const ACTION = 0x42;
+const VAL_META = 0x56;
+const VAL_RAW = 0x57;
+const PRED_GROUP = 0x70;
+const PRED_ACTOR = 0x71;
+const PRED_CTR = 0x73;
+const EXPAND = 0x94;
+const MARK_NAME = 0xa5;
+const KNOWN = new Set([
+    OBJ_ACTOR,
+    OBJ_CTR,
+    KEY_ACTOR,
+    KEY_CTR,
+    KEY_STR,
+    INSERT,
+    ACTION,
+    VAL_META,
+    VAL_RAW,
+    PRED_GROUP,
+    PRED_ACTOR,
+    PRED_CTR,
+    EXPAND,
+    MARK_NAME,
+]);
+/** Decodes and checks one column; the rows must encode back to the same bytes (rule 5). */
+function column(spec, data) {
+    const type = spec & 7;
+    if (type === TYPE_BOOLEAN) {
+        const rows = decodeBoolean(data);
+        if (compareBytes(encodeBoolean(rows), data) !== 0)
+            refuse(`column 0x${spec.toString(16)} is not in its one run encoding`);
+        return rows;
+    }
+    const rows = decodeRle(type, data);
+    if (compareBytes(encodeRle(type, rows), data) !== 0)
+        refuse(`column 0x${spec.toString(16)} is not in its one run encoding`);
+    return rows;
+}
+const num = (v) => (v === null ? null : Number(v));
+/** Rule 6: a value's bytes for its metadata type. */
+function checkValue(type, bytes) {
+    if (type >= 10)
+        refuse(`value type ${type} is reserved`);
+    if (type <= 2) {
+        if (bytes.length !== 0)
+            refuse("a null or boolean value has bytes");
+        return;
+    }
+    if (type === 3 || type === 4 || type === 8 || type === 9) {
+        const r = new Reader(bytes);
+        if (type === 3)
+            r.ubig();
+        else
+            r.sbig();
+        if (!r.done || bytes.length === 0)
+            refuse("a number value is not exactly one shortest LEB128");
+        return;
+    }
+    if (type === 5) {
+        if (bytes.length !== 8)
+            refuse("a float value is not 8 bytes");
+        return;
+    }
+    if (type === 6)
+        utf8(bytes, "a string value");
+}
+/**
+ * §11.3: checks that `bytes` (one change chunk within the §11.1 limits) is
+ * the canonical encoding of its change, and returns the change's operations
+ * read from it. Throws PROFILE_INVALID / INVALID_AUTOMERGE_BYTES.
+ */
+export function checkCanonicalChange(bytes) {
+    const r = new Reader(bytes);
+    r.take(9); // magic, checksum, chunk type: checked by the framing
+    const length = r.ubig();
+    if (length !== BigInt(bytes.length - r.pos))
+        refuse("the chunk length is wrong");
+    // Rule 2: the header.
+    const depCount = r.unum();
+    const deps = [];
+    for (let i = 0; i < depCount; i++)
+        deps.push(r.take(32));
+    for (let i = 1; i < deps.length; i++)
+        if (compareBytes(deps[i - 1], deps[i]) >= 0)
+            refuse("the dependencies are not strictly ascending");
+    const actor = r.take(r.unum());
+    const seq = r.ubig();
+    const startOp = r.ubig();
+    if (seq < 1n || startOp < 1n)
+        refuse("the sequence number or the start op is 0");
+    r.sbig(); // time
+    utf8(r.take(r.unum()), "the message");
+    const otherCount = r.unum();
+    const others = [];
+    for (let i = 0; i < otherCount; i++)
+        others.push(r.take(r.unum()));
+    for (let i = 0; i < others.length; i++) {
+        const o = others[i];
+        if (compareBytes(o, actor) === 0)
+            refuse("the change's actor is among its other actors");
+        if (i > 0 && compareBytes(others[i - 1], o) >= 0)
+            refuse("the other actors are not strictly ascending");
+    }
+    // Rule 3: the columns, in specification order, each once, never empty or deflated.
+    const columnCount = r.unum();
+    const metas = [];
+    for (let i = 0; i < columnCount; i++) {
+        const spec = r.unum();
+        const len = r.unum();
+        if (!KNOWN.has(spec))
+            refuse(`column 0x${spec.toString(16)} is not a change column`);
+        if (metas.length > 0 && metas.at(-1).spec >= spec)
+            refuse("the columns are not in ascending specification order");
+        if (len === 0)
+            refuse(`column 0x${spec.toString(16)} is empty`);
+        metas.push({ spec, length: len });
+    }
+    const data = new Map();
+    for (const m of metas)
+        data.set(m.spec, r.take(m.length));
+    // What follows is the change's extra bytes.
+    const rle = (spec) => {
+        const d = data.get(spec);
+        return d === undefined ? undefined : column(spec, d);
+    };
+    const bools = (spec) => {
+        const d = data.get(spec);
+        return d === undefined ? undefined : column(spec, d);
+    };
+    const action = rle(ACTION) ?? [];
+    const N = action.length;
+    const objActor = rle(OBJ_ACTOR);
+    const objCtr = rle(OBJ_CTR);
+    const keyActor = rle(KEY_ACTOR);
+    const keyCtr = rle(KEY_CTR);
+    const keyStr = rle(KEY_STR);
+    const insert = bools(INSERT);
+    const meta = rle(VAL_META);
+    const predCount = rle(PRED_GROUP);
+    const predActor = rle(PRED_ACTOR);
+    const predCtr = rle(PRED_CTR);
+    const expand = bools(EXPAND);
+    const markName = rle(MARK_NAME);
+    // Rule 4: row counts.
+    for (const [spec, rows] of [
+        [OBJ_ACTOR, objActor],
+        [OBJ_CTR, objCtr],
+        [KEY_ACTOR, keyActor],
+        [KEY_CTR, keyCtr],
+        [KEY_STR, keyStr],
+        [INSERT, insert],
+        [VAL_META, meta],
+        [PRED_GROUP, predCount],
+        [EXPAND, expand],
+        [MARK_NAME, markName],
+    ])
+        if (rows !== undefined && rows.length !== N)
+            refuse(`column 0x${spec.toString(16)} has ${rows.length} rows, not ${N}`);
+    let predRows = 0;
+    for (const c of predCount ?? []) {
+        if (c === null)
+            refuse("a predecessor count is null");
+        predRows += Number(c);
+    }
+    for (const [spec, rows] of [
+        [PRED_ACTOR, predActor],
+        [PRED_CTR, predCtr],
+    ])
+        if (rows !== undefined && rows.length !== predRows)
+            refuse(`column 0x${spec.toString(16)} has ${rows.length} rows, not ${predRows}`);
+    const actorOf = (index) => {
+        const i = num(index);
+        if (i === null)
+            return refuse("an actor index is null");
+        if (i === 0)
+            return hex(actor);
+        const o = others[i - 1];
+        if (o === undefined)
+            return refuse("an actor index is out of range");
+        return hex(o);
+    };
+    const named = new Set();
+    const counter = (v, what) => {
+        const c = num(v);
+        if (c === null || c < 1 || c >= U32)
+            return refuse(`${what} is not a counter from 1 below 2^32`);
+        return c;
+    };
+    // Values (rule 6) and the value bytes column (rule 4).
+    const raw = data.get(VAL_RAW) ?? new Uint8Array(0);
+    let rawAt = 0;
+    const valueTypes = [];
+    for (let i = 0; i < N; i++) {
+        const m = meta?.[i] ?? null;
+        if (m === null)
+            refuse("a value metadata row is null");
+        const mv = m;
+        const type = Number(mv & 15n);
+        const len = mv >> 4n;
+        if (len > BigInt(raw.length - rawAt))
+            refuse("the value bytes are shorter than their metadata");
+        checkValue(type, raw.subarray(rawAt, rawAt + Number(len)));
+        rawAt += Number(len);
+        valueTypes.push(type);
+    }
+    if (rawAt !== raw.length)
+        refuse("the value bytes are longer than their metadata");
+    if (startOp + BigInt(N) - 1n >= BigInt(U32))
+        refuse("the last operation counter is 2^32 or more");
+    const start = Number(startOp);
+    const ops = [];
+    let p = 0;
+    let anyObj = false;
+    let anyElem = false;
+    let anyKeyCtr = false;
+    let anyProp = false;
+    let anyPred = false;
+    let anyExpand = false;
+    let anyMark = false;
+    for (let i = 0; i < N; i++) {
+        // Rule 7: actions.
+        const a = num(action[i]);
+        if (a === null || a > 7)
+            refuse("an action is not 0 to 7");
+        const act = a;
+        const ins = insert?.[i] ?? false;
+        const exp = expand?.[i] ?? false;
+        const mark = markName?.[i] ?? null;
+        if ((act === 0 || act === 2 || act === 4 || act === 6 || act === 3) && valueTypes[i] !== 0)
+            refuse("an operation that makes an object or deletes has a value");
+        if (act === 5 && valueTypes[i] !== 3 && valueTypes[i] !== 4)
+            refuse("an increment's value is not an integer");
+        if (act === 7 && !ins)
+            refuse("a mark does not insert");
+        if (act !== 7 && (exp || mark !== null))
+            refuse("only a mark has a mark name or expands");
+        if (mark !== null) {
+            anyMark = true;
+            utf8(mark, "a mark name");
+        }
+        if (exp)
+            anyExpand = true;
+        // Rule 8: the object and the key.
+        const oa = objActor?.[i] ?? null;
+        const oc = objCtr?.[i] ?? null;
+        let obj;
+        if (oa === null && oc === null)
+            obj = "_root";
+        else if (oa !== null && oc !== null) {
+            obj = `${counter(oc, "an object counter")}@${actorOf(oa)}`;
+            named.add(num(oa));
+            anyObj = true;
+        }
+        else
+            return refuse("an object is half null");
+        const ka = keyActor?.[i] ?? null;
+        const kc = keyCtr?.[i] ?? null;
+        const ks = keyStr?.[i] ?? null;
+        let key;
+        if (ks !== null && ka === null && kc === null) {
+            key = { kind: "prop", name: utf8(ks, "a key") };
+            anyProp = true;
+        }
+        else if (ks === null && ka === null && kc !== null && num(kc) === 0) {
+            key = { kind: "head" };
+            anyKeyCtr = true;
+        }
+        else if (ks === null && ka !== null && kc !== null) {
+            key = { kind: "elem", id: `${counter(kc, "a key counter")}@${actorOf(ka)}` };
+            named.add(num(ka));
+            anyElem = true;
+            anyKeyCtr = true;
+        }
+        else
+            return refuse("a key is neither a property, the head nor an element");
+        // Rule 9: the predecessors, ascending by counter then actor.
+        const count = Number(predCount?.[i]);
+        const pred = [];
+        let last = null;
+        for (let k = 0; k < count; k++, p++) {
+            const pa = predActor?.[p] ?? null;
+            const ctr = counter(predCtr?.[p] ?? null, "a predecessor counter");
+            const id = actorOf(pa);
+            const idBytes = num(pa) === 0 ? actor : others[num(pa) - 1];
+            if (last !== null &&
+                (ctr < last.ctr || (ctr === last.ctr && compareBytes(last.actor, idBytes) >= 0)))
+                refuse("the predecessors are not strictly ascending");
+            last = { ctr, actor: idBytes };
+            named.add(num(pa));
+            pred.push(`${ctr}@${id}`);
+            anyPred = true;
+        }
+        ops.push(Object.freeze({ obj, key, insert: ins, action: act, pred: Object.freeze(pred) }));
+    }
+    // Rule 3: each column present exactly when the table says.
+    const presence = [
+        [OBJ_ACTOR, anyObj],
+        [OBJ_CTR, anyObj],
+        [KEY_ACTOR, anyElem],
+        [KEY_CTR, anyKeyCtr],
+        [KEY_STR, anyProp],
+        [INSERT, N > 0],
+        [ACTION, N > 0],
+        [VAL_META, N > 0],
+        [VAL_RAW, raw.length > 0],
+        [PRED_GROUP, N > 0],
+        [PRED_ACTOR, anyPred],
+        [PRED_CTR, anyPred],
+        [EXPAND, anyExpand],
+        [MARK_NAME, anyMark],
+    ];
+    for (const [spec, want] of presence)
+        if (data.has(spec) !== want)
+            refuse(`column 0x${spec.toString(16)} is ${want ? "missing" : "present without a use"}`);
+    // Rule 2: the other actors are exactly those the operations name.
+    named.delete(0);
+    if (named.size !== others.length)
+        refuse("the other actors are not exactly those the operations name");
+    return Object.freeze({
+        actor: hex(actor),
+        seq: Number(seq),
+        startOp: start,
+        deps: Object.freeze(deps.map(hex)),
+        otherActors: Object.freeze(others.map(hex)),
+        ops: Object.freeze(ops),
+    });
+}
+//# sourceMappingURL=canonical.js.map

package/dist/index.d.ts

@@ -7,7 +7,7 @@ export declare const PACKAGE = "@openlfcp/shared-objects";
 export { type CheckedChange, checkChange, checkSaveHeader, frameChange, frameSnapshot, unframeChange, unframeSnapshot, } from "./automerge-bytes.js";
 export { CHANGE_LIMITS, type ChunkExpansion, checkChangeExpansion, checkSnapshotExpansion, MAX_DOCUMENT_DEPTH, SNAPSHOT_LIMITS_FLOOR, type SnapshotLimits, } from "./chunk-limits.js";
 export { type SharedObjectsApplyResult, type SharedObjectsBatchResult, type SharedObjectsCheckpoint, type SharedObjectsCodec, SharedObjectsDataProfile, type SharedObjectsDiagnostic, type SharedObjectsExcludeResult, type SharedObjectsSnapshotCodec, type SharedObjectsUnit, } from "./data-profile.js";
-export { type BatchReceiveResult, type BuiltReplica, type LocalChange, type ObjectChange, ObjectIdCollisionError, type ObjectStatus, type ReceiveResult, type ReplicaIntent, type ReplicaOptions, type ReplicaValidation, type ResolveFieldConflict, resolveFieldConflict, SCALAR_FIELDS, type ScalarField, type ScalarView, SharedObjectsReplica, type TaskView, } from "./replica.js";
+export { applyBatchChecked, applyChecked, type BatchReceiveResult, type BuiltReplica, isWasmTrap, type LocalChange, type ObjectChange, ObjectIdCollisionError, type ObjectStatus, type ReceiveResult, type ReplicaIntent, type ReplicaOptions, type ReplicaValidation, type ResolveFieldConflict, resolveFieldConflict, SCALAR_FIELDS, type ScalarField, type ScalarView, SharedObjectsReplica, type TaskView, } from "./replica.js";
 export { addTag, assign, cancel, clearDue, clearScheduled, complete, createTask, deleteTask, type NewTask, type ParsedTask, ProfileError, parseTask, removeTag, reopen, restoreTask, setDue, setPriority, setScheduled, setStatus, setTitle, type Task, type TaskChange, type TaskIntent, type TaskPriority, type TaskStatus, taskToJson, unassign, } from "./task.js";
 export { DIAGNOSTIC_ORDER, firstPerField, isMap, type Json, objectProblems, type ProfileDiagnostic, ProfileInvalidError, type ProfileProblem, pointerToken, type RootValidation, validateRoot, validateTransition, } from "./validate.js";
 export { deriveActorId, FRAMING_VERSION, frameProfilePayload, isLocalDate, isNamespacedValue, isPrincipalRef, isReverseDomain, isUtcTimestamp, PROFILE_ID, type PrincipalRef, parsePrincipalRef, principalRef, unframeProfilePayload, } from "./values.js";

package/dist/index.js

@@ -7,7 +7,7 @@ export const PACKAGE = "@openlfcp/shared-objects";
 export { checkChange, checkSaveHeader, frameChange, frameSnapshot, unframeChange, unframeSnapshot, } from "./automerge-bytes.js";
 export { CHANGE_LIMITS, checkChangeExpansion, checkSnapshotExpansion, MAX_DOCUMENT_DEPTH, SNAPSHOT_LIMITS_FLOOR, } from "./chunk-limits.js";
 export { SharedObjectsDataProfile, } from "./data-profile.js";
-export { ObjectIdCollisionError, resolveFieldConflict, SCALAR_FIELDS, SharedObjectsReplica, } from "./replica.js";
+export { applyBatchChecked, applyChecked, isWasmTrap, ObjectIdCollisionError, resolveFieldConflict, SCALAR_FIELDS, SharedObjectsReplica, } from "./replica.js";
 export { addTag, assign, cancel, clearDue, clearScheduled, complete, createTask, deleteTask, ProfileError, parseTask, removeTag, reopen, restoreTask, setDue, setPriority, setScheduled, setStatus, setTitle, taskToJson, unassign, } from "./task.js";
 export { DIAGNOSTIC_ORDER, firstPerField, isMap, objectProblems, ProfileInvalidError, pointerToken, validateRoot, validateTransition, } from "./validate.js";
 export { deriveActorId, FRAMING_VERSION, frameProfilePayload, isLocalDate, isNamespacedValue, isPrincipalRef, isReverseDomain, isUtcTimestamp, PROFILE_ID, parsePrincipalRef, principalRef, unframeProfilePayload, } from "./values.js";

package/dist/references.d.ts

@@ -0,0 +1,28 @@
+import * as A from "@automerge/automerge";
+import { type ParsedChange } from "./canonical.js";
+/** A §11.4 rule a change breaks. */
+export type ReferenceRule = "R1" | "R2" | "R3" | "R4" | "R5" | "R6" | "R7" | "R10";
+/**
+ * The changes of a document as §11.4 reads them. A replica keeps it current
+ * as changes are admitted and committed, or builds it again from its
+ * document.
+ */
+export declare class ReferenceHistory {
+    #private;
+    get size(): number;
+    has(hash: string): boolean;
+    /**
+     * Adds a change the document now holds. Its dependencies are added
+     * first; one this index does not hold adds nothing to its history.
+     */
+    add(hash: string, change: ParsedChange): void;
+    /** The §11.4 rule `change` breaks against its causal history, or null. */
+    check(change: ParsedChange): ReferenceRule | null;
+}
+/**
+ * The index of every change a document holds, as the engine hands them
+ * out (in its encoding, so canonical), dependencies first. A change the
+ * walk cannot read is left out: references into it are then refused.
+ */
+export declare function referenceHistoryOf(doc: A.Doc<unknown>): ReferenceHistory;
+//# sourceMappingURL=references.d.ts.map

package/dist/references.js

@@ -0,0 +1,225 @@
+// Operation references (SHARED-OBJECTS-PROFILE-01 §11.4, SPEC-PATCH-10,
+// ADR 0010): a change's operations refer only to its own causal history H
+// (its dependencies and all their ancestors) or to operations earlier in
+// the change. An engine applies a change that refers elsewhere (a
+// predecessor on another key, an element of another list, an object that is
+// not one), but then cannot write it back out, and some such changes abort
+// the apply itself, which in Automerge JS terminates its wasm module. The
+// rules are decided against H only, never anything else the receiver holds,
+// so every replica decides alike.
+//
+// H is held as a vector clock: an admitted change's actor chain is
+// contiguous in its history (R1), so the latest sequence number of each
+// actor in H says exactly which changes H holds. An operation is found by
+// its actor's changes and their counter ranges.
+import * as A from "@automerge/automerge";
+import { checkCanonicalChange } from "./canonical.js";
+const MAKE = new Set([0, 2, 4, 6]);
+const MAP_LIKE = new Set([0, 6]);
+function slotOf(op, id) {
+    if (op.insert)
+        return `e:${id}`;
+    if (op.key.kind === "prop")
+        return `p:${op.key.name}`;
+    if (op.key.kind === "elem")
+        return `e:${op.key.id}`;
+    return "e:_head";
+}
+const targetOf = (op, id) => ({
+    obj: op.obj,
+    slot: slotOf(op, id),
+    insert: op.insert,
+    del: op.action === 3,
+    make: MAKE.has(op.action) ? op.action : null,
+});
+function splitId(id) {
+    const at = id.indexOf("@");
+    return { ctr: Number(id.slice(0, at)), actor: id.slice(at + 1) };
+}
+/**
+ * The changes of a document as §11.4 reads them. A replica keeps it current
+ * as changes are admitted and committed, or builds it again from its
+ * document.
+ */
+export class ReferenceHistory {
+    #byHash = new Map();
+    /** Each actor's changes by sequence number (index seq - 1). */
+    #byActor = new Map();
+    get size() {
+        return this.#byHash.size;
+    }
+    has(hash) {
+        return this.#byHash.has(hash);
+    }
+    /** H of a change with these dependencies: the latest sequence of each actor. */
+    #history(deps) {
+        const clock = new Map();
+        for (const d of deps) {
+            const e = this.#byHash.get(d);
+            if (e === undefined)
+                continue;
+            for (const [a, s] of e.clock)
+                if ((clock.get(a) ?? 0) < s)
+                    clock.set(a, s);
+        }
+        return clock;
+    }
+    /**
+     * Adds a change the document now holds. Its dependencies are added
+     * first; one this index does not hold adds nothing to its history.
+     */
+    add(hash, change) {
+        if (this.#byHash.has(hash))
+            return;
+        const clock = this.#history(change.deps);
+        if ((clock.get(change.actor) ?? 0) < change.seq)
+            clock.set(change.actor, change.seq);
+        const entry = {
+            actor: change.actor,
+            seq: change.seq,
+            startOp: change.startOp,
+            ops: change.ops.map((op, i) => targetOf(op, `${change.startOp + i}@${change.actor}`)),
+            clock,
+        };
+        this.#byHash.set(hash, entry);
+        const list = this.#byActor.get(change.actor) ?? [];
+        list[change.seq - 1] = entry;
+        this.#byActor.set(change.actor, list);
+    }
+    /** The change of `actor` holding operation counter `ctr`, among its first `upToSeq` changes. */
+    #find(actor, ctr, upToSeq) {
+        const list = this.#byActor.get(actor);
+        if (list === undefined)
+            return null;
+        let lo = 0;
+        let hi = Math.min(upToSeq, list.length) - 1;
+        while (lo <= hi) {
+            const mid = (lo + hi) >> 1;
+            const e = list[mid];
+            if (e === undefined)
+                return null;
+            if (ctr < e.startOp)
+                hi = mid - 1;
+            else if (ctr >= e.startOp + e.ops.length)
+                lo = mid + 1;
+            else
+                return { entry: e, index: ctr - e.startOp };
+        }
+        return null;
+    }
+    /** The §11.4 rule `change` breaks against its causal history, or null. */
+    check(change) {
+        const H = this.#history(change.deps);
+        // R1: the actor's previous change is in H.
+        if (change.seq > 1 && (H.get(change.actor) ?? 0) < change.seq - 1)
+            return "R1";
+        // R2: the start op follows H's largest counter (each actor's latest change in H has its largest).
+        let top = 0;
+        for (const [a, s] of H) {
+            const e = this.#byActor.get(a)?.[s - 1];
+            if (e !== undefined && e.startOp + e.ops.length - 1 > top)
+                top = e.startOp + e.ops.length - 1;
+        }
+        if (change.startOp !== top + 1)
+            return "R2";
+        const own = [];
+        // An operation of H or earlier in this change; deletions are not targets.
+        const target = (id) => {
+            const { ctr, actor } = splitId(id);
+            let t;
+            if (actor === change.actor && ctr >= change.startOp && ctr < change.startOp + own.length)
+                t = own[ctr - change.startOp];
+            else {
+                const found = this.#find(actor, ctr, H.get(actor) ?? 0);
+                t = found === null ? undefined : found.entry.ops[found.index];
+            }
+            return t === undefined || t.del ? undefined : t;
+        };
+        for (const [i, op] of change.ops.entries()) {
+            const id = `${change.startOp + i}@${change.actor}`;
+            // R10: no operation makes a table. Automerge JS 3.5.0 cannot write a
+            // table back out and aborts applying one (differential fuzzing D1); a
+            // writer of this profile never makes one.
+            if (op.action === 6)
+                return "R10";
+            // R3: the root, or an object an operation made; its key form.
+            let sequence;
+            if (op.obj === "_root")
+                sequence = false;
+            else {
+                const made = target(op.obj)?.make ?? null;
+                if (made === null)
+                    return "R3";
+                sequence = !MAP_LIKE.has(made);
+            }
+            if (!sequence && (op.insert || op.key.kind !== "prop"))
+                return op.insert ? "R4" : "R3";
+            if (sequence && op.key.kind === "prop")
+                return "R3";
+            const element = (e) => {
+                const t = target(e);
+                return t !== undefined && t.insert && t.obj === op.obj;
+            };
+            // R4: an insertion goes after the head or an element of the same object, without predecessors.
+            if (op.insert && (op.pred.length > 0 || (op.key.kind === "elem" && !element(op.key.id))))
+                return "R4";
+            // R5: any other sequence operation names an element of the same object.
+            if (sequence && !op.insert && (op.key.kind !== "elem" || !element(op.key.id)))
+                return "R5";
+            // R6: predecessors on the same object and key.
+            const slot = slotOf(op, id);
+            for (const p of op.pred) {
+                const t = target(p);
+                if (t === undefined || t.obj !== op.obj || t.slot !== slot)
+                    return "R6";
+            }
+            // R7: a deletion has a predecessor.
+            if (op.action === 3 && op.pred.length === 0)
+                return "R7";
+            own.push(targetOf(op, id));
+        }
+        return null;
+    }
+}
+/**
+ * The index of every change a document holds, as the engine hands them
+ * out (in its encoding, so canonical), dependencies first. A change the
+ * walk cannot read is left out: references into it are then refused.
+ */
+export function referenceHistoryOf(doc) {
+    const parsed = new Map();
+    for (const bytes of A.getAllChanges(doc)) {
+        try {
+            parsed.set(A.decodeChange(bytes).hash, checkCanonicalChange(bytes));
+        }
+        catch {
+            // not readable: left out
+        }
+    }
+    const refs = new ReferenceHistory();
+    const placed = new Set();
+    for (const start of parsed.keys()) {
+        // Iterative depth-first: dependencies first, without recursion.
+        const stack = [{ hash: start, next: 0 }];
+        while (stack.length > 0) {
+            const top = stack[stack.length - 1];
+            const change = parsed.get(top.hash);
+            if (change === undefined || placed.has(top.hash)) {
+                stack.pop();
+                continue;
+            }
+            const dep = change.deps[top.next];
+            if (dep !== undefined) {
+                top.next++;
+                if (!placed.has(dep) && parsed.has(dep))
+                    stack.push({ hash: dep, next: 0 });
+                continue;
+            }
+            placed.add(top.hash);
+            refs.add(top.hash, change);
+            stack.pop();
+        }
+    }
+    return refs;
+}
+//# sourceMappingURL=references.js.map

package/dist/replica.d.ts

@@ -143,6 +143,12 @@ export interface BuiltReplica {
 type Doc = A.Doc<Record<string, unknown>>;
 /** §30: an object's maps and lists nest at most this many levels (the field's own map is 1). */
 export declare const MAX_VALUE_DEPTH = 64;
+/**
+ * Whether a thrown value is a wasm trap (the engine's module is dead, not
+ * the change refused): it is rethrown as it is, never turned into
+ * INVALID_AUTOMERGE_BYTES, so a crash-loop breaker sees it.
+ */
+export declare function isWasmTrap(e: unknown): boolean;
 /**
  * Applies one change that passed the receive checks. Automerge can throw
  * after changing the document in place (a change that skips a sequence

package/dist/replica.js

@@ -1,10 +1,11 @@
 import * as A from "@automerge/automerge";
 import { fromHex, LfcpError, toHex, } from "@openlfcp/core";
-import { checkChange, checkSaveHeader, unframeChange, unframeSnapshot, } from "./automerge-bytes.js";
+import { checkChange, checkSaveHeader, parsedOf, unframeChange, unframeSnapshot, } from "./automerge-bytes.js";
 import { checkSnapshotExpansion, MAX_DOCUMENT_DEPTH, SNAPSHOT_LIMITS_FLOOR, } from "./chunk-limits.js";
 /** The decoded actions that create an object (§11.2). */
 const MAKE_ACTIONS = new Set(["makeMap", "makeList", "makeText", "makeTable"]);
 import { ProfileInvalidError } from "./profile-invalid.js";
+import { referenceHistoryOf } from "./references.js";
 import { ProfileError, parseTask } from "./task.js";
 import { firstPerField, isMap, objectProblems, pointerToken, validateRoot, } from "./validate.js";
 import { deriveActorId, frameProfilePayload, PROFILE_ID } from "./values.js";
@@ -55,6 +56,8 @@ export function resolveFieldConflict(id, field, value) {
         throw new LfcpError("UNSUPPORTED_VALUE", `only a date field can be cleared (§36)`);
     return Object.freeze({ intent: "task.resolve_field_conflict", id, field, value });
 }
+/** §11.4: a refusal for a change whose operations refer outside its causal history. */
+const referenceError = (rule) => new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", `the change's operations refer outside its causal history (§11.4 ${rule})`);
 /** §21: two concurrent objects under one Object ID: OBJECT_ID_COLLISION, a profile error of its own, not PROFILE_INVALID. */
 export class ObjectIdCollisionError extends LfcpError {
     objectId;
@@ -311,7 +314,7 @@ const actorHex = (opts) => toHex(deriveActorId(opts.resource, opts.principal));
  * the change refused): it is rethrown as it is, never turned into
  * INVALID_AUTOMERGE_BYTES, so a crash-loop breaker sees it.
  */
-function isWasmTrap(e) {
+export function isWasmTrap(e) {
     const trap = globalThis
         .WebAssembly?.RuntimeError;
     if (trap !== undefined && e instanceof trap)
@@ -327,7 +330,18 @@ function isWasmTrap(e) {
  * is: the module is dead, and only a restart recovers. Exported for tests.
  */
 export function applyChecked(doc, bytes) {
+    // Capture the document's changes BEFORE the apply: a change the engine
+    // aborts on (D1: a makeTable it cannot write back) stays in the document's
+    // graph or aborts the apply mid-way, so A.getAllChanges(doc) AFTER the
+    // error still holds the bad change and rebuilding from it re-aborts
+    // ("could not be restored"). Rebuilding from the changes it held before
+    // always gives its prior state.
+    //
+    // Do NOT "simplify" this by applying to A.clone(doc): A.clone gives the
+    // clone a new actor id, which breaks local writes (§8) and convergence.
     const before = [...A.getHeads(doc)].sort().join();
+    const actor = A.getActorId(doc);
+    const good = A.getAllChanges(doc);
     try {
         return { next: A.applyChanges(doc, [bytes])[0] };
     }
@@ -335,18 +349,22 @@ export function applyChecked(doc, bytes) {
         if (isWasmTrap(e))
             throw e;
         const error = e instanceof Error ? e : new Error(String(e));
-        let restored;
-        try {
-            [restored] = A.applyChanges(A.init({ actor: A.getActorId(doc) }), A.getAllChanges(doc));
-        }
-        catch (r) {
-            throw new Error(`the replica could not be restored after an Automerge error: ${String(r)}`);
-        }
-        if ([...A.getHeads(restored)].sort().join() !== before)
-            throw new Error("the replica could not be restored after an Automerge error: heads differ");
-        return { restored, error };
+        return { restored: restoreFrom(good, actor, before), error };
     }
 }
+/** Rebuilds a document from the changes it held before an aborted apply (never from the aborted one). */
+function restoreFrom(good, actor, before) {
+    let restored;
+    try {
+        [restored] = A.applyChanges(A.init({ actor }), [...good]);
+    }
+    catch (r) {
+        throw new Error(`the replica could not be restored after an Automerge error: ${String(r)}`);
+    }
+    if ([...A.getHeads(restored)].sort().join() !== before)
+        throw new Error("the replica could not be restored after an Automerge error: heads differ");
+    return restored;
+}
 /**
  * applyChecked for a batch of admitted changes, in one engine call. On any
  * engine error the handle is dropped and the document as it was before is
@@ -354,7 +372,10 @@ export function applyChecked(doc, bytes) {
  * heads it had. Exported for tests.
  */
 export function applyBatchChecked(doc, batch) {
-    const heads = A.getHeads(doc);
+    // See applyChecked: capture the changes before the apply, restore from them.
+    const before = [...A.getHeads(doc)].sort().join();
+    const actor = A.getActorId(doc);
+    const good = A.getAllChanges(doc);
     try {
         return {
             next: A.applyChanges(doc, batch.map((c) => c.bytes))[0],
@@ -364,23 +385,9 @@ export function applyBatchChecked(doc, batch) {
         if (isWasmTrap(e))
             throw e;
         const error = e instanceof Error ? e : new Error(String(e));
-        return { restored: restoreWithout(doc, batch, heads), error };
+        return { restored: restoreFrom(good, actor, before), error };
     }
 }
-function restoreWithout(doc, batch, heads) {
-    const out = new Set(batch.map((c) => c.hash));
-    const kept = A.getAllChanges(doc).filter((c) => !out.has(A.decodeChange(c).hash));
-    let restored;
-    try {
-        [restored] = A.applyChanges(A.init({ actor: A.getActorId(doc) }), kept);
-    }
-    catch (r) {
-        throw new Error(`the replica could not be restored after an Automerge error: ${String(r)}`);
-    }
-    if ([...A.getHeads(restored)].sort().join() !== [...heads].sort().join())
-        throw new Error("the replica could not be restored after an Automerge error: heads differ");
-    return restored;
-}
 function loadFailure(e, what) {
     if (e instanceof LfcpError)
         throw e;
@@ -394,6 +401,8 @@ export class SharedObjectsReplica {
     #actor;
     #minSeq;
     #doc;
+    /** §11.4: the document's changes as references read them; null to build again from the document. */
+    #refs = null;
     /** Highest sequence seen per actor (hex). */
     #seqs = new Map();
     /** §11.2: known object depths (object ID → depth below the root), filled as objects appear. */
@@ -789,11 +798,13 @@ export class SharedObjectsReplica {
             // this replica held is outdated by A.change: rebuild it without the change.
             const hash = A.decodeChange(bytes).hash;
             this.#doc = A.applyChanges(A.init({ actor: this.#actor }), A.getAllChanges(next).filter((c) => A.decodeChange(c).hash !== hash))[0];
+            this.#refs = null;
             throw new LfcpError("CHANGE_TOO_LARGE", `the transaction "${message}" is larger than one change may be (§11.1: ${e.message}); split it into several (§12)`);
         }
         if (checked.seq !== this.actorSeq + 1)
             throw new LfcpError("SEQUENCE_REUSE", `actor sequence ${checked.seq} after ${this.actorSeq} (§9)`);
         this.#doc = next;
+        this.#refs?.add(checked.hash, parsedOf(checked));
         this.#noteSeq(checked.actor, checked.seq);
         for (const [id, d] of created)
             this.#depths.set(id, d);
@@ -890,6 +901,12 @@ export class SharedObjectsReplica {
                 continue;
             }
             else {
+                // §11.4: the operations refer only to the change's causal history.
+                const rule = this.#references().check(parsedOf(c));
+                if (rule !== null) {
+                    refused.push({ change: c, error: referenceError(rule) });
+                    continue;
+                }
                 // §11.2: the depths of the objects it creates, given the document and the batch so far.
                 let created;
                 try {
@@ -902,6 +919,7 @@ export class SharedObjectsReplica {
                 for (const [id, d] of created)
                     batchDepths.set(id, d);
                 seqs.set(c.actor, c.seq);
+                this.#references().add(c.hash, parsedOf(c));
                 admitted.push(c);
             }
             for (const child of children.get(c.hash) ?? []) {
@@ -924,6 +942,8 @@ export class SharedObjectsReplica {
             }
             else {
                 this.#doc = batch.restored;
+                // The index already holds the batch: build it again from the restored document.
+                this.#refs = null;
                 applied = [];
                 for (const c of admitted) {
                     try {
@@ -952,6 +972,11 @@ export class SharedObjectsReplica {
             objects: Object.freeze(applied.length > 0 ? this.#objectChanges(before, "remote") : []),
         });
     }
+    /** The reference index of the document (§11.4), built once and kept with it. */
+    #references() {
+        this.#refs ??= referenceHistoryOf(this.#doc);
+        return this.#refs;
+    }
     #receive(change) {
         if (A.hasHeads(this.#doc, [change.hash]))
             return Object.freeze({ status: "duplicate", change });
@@ -977,16 +1002,22 @@ export class SharedObjectsReplica {
             throw new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", `the change names actor ${unknown}, unknown to this document (§11.1)`);
         if (change.seq !== (this.#seqs.get(change.actor) ?? 0) + 1)
             throw new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", `actor ${change.actor} sequence ${change.seq} skips sequence ${(this.#seqs.get(change.actor) ?? 0) + 1} (§14.1)`);
+        // §11.4: the operations refer only to the change's causal history.
+        const rule = this.#references().check(parsedOf(change));
+        if (rule !== null)
+            throw referenceError(rule);
         // §11.2: no object deeper than MAX_DOCUMENT_DEPTH, before the engine.
         const created = this.#createdDepths(change, new Map());
         const before = A.getHeads(this.#doc);
         const applied = applyChecked(this.#doc, change.bytes);
         if ("error" in applied) {
             this.#doc = applied.restored;
+            this.#refs = null;
             throw new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", `Automerge rejected the change (§11): ${applied.error.message}`);
         }
         const next = applied.next;
         this.#doc = next;
+        this.#refs?.add(change.hash, parsedOf(change));
         this.#noteSeq(change.actor, change.seq);
         for (const [id, d] of created)
             this.#depths.set(id, d);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openlfcp/shared-objects",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "SHARED-OBJECTS-PROFILE-01 (org.openlfcp.shared-objects.v1) implementation.",
   "keywords": [
     "openlfcp",
@@ -45,8 +45,8 @@
   "dependencies": {
     "@automerge/automerge": "3.5.0",
     "fflate": "0.8.3",
-    "@openlfcp/core": "^0.1.3",
-    "@openlfcp/crypto": "^0.1.3"
+    "@openlfcp/core": "^0.1.5",
+    "@openlfcp/crypto": "^0.1.5"
   },
   "devDependencies": {
     "fast-check": "4.10.2"