@openlfcp/shared-objects 0.1.4 → 0.2.0-beta.1

package/README.md

@@ -20,9 +20,22 @@ reaches the replica (§95). The replica has no Markdown or editor concepts.
 
 Part of the OpenLFCP TypeScript SDK, which implements the OpenLFCP MVP 0.1
 subset of [LFCP-WIRE-01](https://github.com/openlfcp/spec/blob/main/wire/LFCP-WIRE-01.md)
-at `mvp-0.1-baseline.10`, not every deferred WIRE-01 feature. It does not
+at `mvp-0.1-baseline.9`, not every deferred WIRE-01 feature. It does not
 claim full LFCP-WIRE-01 conformance. This is the MVP 0.1 release
-(`0.1.4`, npm dist-tag `latest`). Until 1.0, minor versions may change APIs.
+(`0.1.3`, npm dist-tag `latest`). Until 1.0, minor versions may change APIs.
+
+## Shared sections (Working Draft)
+
+`@openlfcp/shared-objects/sections` implements part of
+SHARED-SECTIONS-PROFILE-01 (`org.openlfcp.shared-sections.v1`, Working
+Draft 0.3, not in any implementation baseline): profile dispatch by a
+Resource's Genesis profile (`profileModel`), the section actor binding
+(`deriveSectionActorId`) and schema validation of a section document
+(`validateSection`, `SectionDocument`), and the writer of a section's
+creation and Task intents (`SectionReplica`). Moves, lifecycle, Text
+edits, the effective tree and the section admission rules are not there
+yet. It may change
+without notice until the profile is in a baseline.
 
 ## Automerge and WebAssembly
 

package/dist/admission/actor.d.ts

@@ -0,0 +1,16 @@
+import { type PrincipalId, type ResourceId } from "@openlfcp/core";
+import type { CheckedChange } from "./framing.js";
+/**
+ * SHARED-OBJECTS-PROFILE-01 §8, the actor binding, for any profile that
+ * inherits it with its own domain (SHARED-SECTIONS-PROFILE-01 §2):
+ * SHA-256(ASCII(domain) || resource_id || principal_id), from the raw
+ * 32-byte IDs.
+ */
+export declare function deriveDomainActorId(domain: string, resource: ResourceId, principal: PrincipalId): Uint8Array;
+/**
+ * §8, §11: a Data Unit carries only changes of its signer's actor. Throws
+ * PROFILE_INVALID / CHANGE_ACTOR_MISMATCH otherwise; `actor` is the hex
+ * actor ID the signer's binding gives.
+ */
+export declare function checkChangeActor(change: CheckedChange, actor: string): CheckedChange;
+//# sourceMappingURL=actor.d.ts.map

package/dist/admission/actor.js

@@ -0,0 +1,35 @@
+import { ID32_LENGTH, LfcpError } from "@openlfcp/core";
+import { sha256 } from "@openlfcp/crypto";
+import { ProfileInvalidError } from "../profile-invalid.js";
+/**
+ * SHARED-OBJECTS-PROFILE-01 §8, the actor binding, for any profile that
+ * inherits it with its own domain (SHARED-SECTIONS-PROFILE-01 §2):
+ * SHA-256(ASCII(domain) || resource_id || principal_id), from the raw
+ * 32-byte IDs.
+ */
+export function deriveDomainActorId(domain, resource, principal) {
+    for (const [what, id] of [
+        ["the Resource ID", resource],
+        ["the Principal ID", principal],
+    ]) {
+        if (!(id instanceof Uint8Array) || id.length !== ID32_LENGTH)
+            throw new LfcpError("INVALID_LENGTH", `${what} must be the raw 32-byte ID`);
+    }
+    const prefix = Uint8Array.from(domain, (c) => c.charCodeAt(0));
+    const input = new Uint8Array(prefix.length + 2 * ID32_LENGTH);
+    input.set(prefix, 0);
+    input.set(resource, prefix.length);
+    input.set(principal, prefix.length + ID32_LENGTH);
+    return sha256(input);
+}
+/**
+ * §8, §11: a Data Unit carries only changes of its signer's actor. Throws
+ * PROFILE_INVALID / CHANGE_ACTOR_MISMATCH otherwise; `actor` is the hex
+ * actor ID the signer's binding gives.
+ */
+export function checkChangeActor(change, actor) {
+    if (change.actor !== actor)
+        throw new ProfileInvalidError("CHANGE_ACTOR_MISMATCH", `the change's Automerge actor ${change.actor} is not the §8 actor ${actor} of the unit's signer (§11, SO-SEC1)`);
+    return change;
+}
+//# sourceMappingURL=actor.js.map

package/dist/{canonical.d.ts → admission/canonical.d.ts}

@@ -17,6 +17,8 @@ export interface ParsedOp {
     readonly action: number;
     /** Predecessor IDs "counter@actorhex", in order. */
     readonly pred: readonly string[];
+    /** The value's type, the low 4 bits of its metadata (8: a counter). */
+    readonly valueType: number;
 }
 /** A change read from its bytes (§11.3), without the engine. */
 export interface ParsedChange {

package/dist/{canonical.js → admission/canonical.js}

@@ -12,7 +12,7 @@
 // the same bytes. Everything else is checked as stated: the header, the
 // columns and their presence, row counts, value metadata and bytes,
 // actions, IDs and counters below 2^32, sorted predecessors.
-import { ProfileInvalidError } from "./profile-invalid.js";
+import { ProfileInvalidError } from "../profile-invalid.js";
 const refuse = (why) => {
     throw new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", `the change is not in its canonical encoding (§11.3): ${why}`);
 };
@@ -575,7 +575,14 @@ export function checkCanonicalChange(bytes) {
             pred.push(`${ctr}@${id}`);
             anyPred = true;
         }
-        ops.push(Object.freeze({ obj, key, insert: ins, action: act, pred: Object.freeze(pred) }));
+        ops.push(Object.freeze({
+            obj,
+            key,
+            insert: ins,
+            action: act,
+            pred: Object.freeze(pred),
+            valueType: valueTypes[i],
+        }));
     }
     // Rule 3: each column present exactly when the table says.
     const presence = [

package/dist/{automerge-bytes.d.ts → admission/framing.d.ts}

@@ -1,3 +1,4 @@
+import * as A from "@automerge/automerge";
 import { type ParsedChange } from "./canonical.js";
 /** A checked Automerge change: its bytes and decoded header. */
 export interface CheckedChange {
@@ -21,8 +22,20 @@ export interface CheckedChange {
  * a change without verifying its checksum, so the check is done here.
  */
 export declare function checkChange(bytes: Uint8Array): CheckedChange;
+/**
+ * The change hash of bytes checkChange refused, read without decoding
+ * them: the SHA-256 of the chunk from its type byte on (the Automerge
+ * change hash). A change above a §11.1 limit is named this way, so a
+ * receiver can report it without expanding it. Undefined when the bytes
+ * are not one change chunk that could be read: no magic bytes, another
+ * chunk type, a length that does not cover them exactly, or a header or
+ * column cut short.
+ */
+export declare function refusedChangeHash(bytes: Uint8Array, error: unknown): string | undefined;
 /** The change as its canonical bytes give it (§11.3), reusing the walk of checkChange. */
 export declare function parsedOf(change: CheckedChange): ParsedChange;
+/** The decoded change, reusing the decode of checkChange when there was one. */
+export declare function decodedOf(change: CheckedChange): A.DecodedChange;
 /**
  * Checks that `bytes` starts as an Automerge full save (a document chunk,
  * §13). Whether the whole image loads, checksums included, is decided by
@@ -37,4 +50,22 @@ export declare function unframeChange(plaintext: Uint8Array): CheckedChange;
 export declare function frameSnapshot(save: Uint8Array): Uint8Array;
 /** §13: the Automerge full save a Snapshot plaintext carries (header checked). Throws PROFILE_INVALID / INVALID_AUTOMERGE_BYTES. */
 export declare function unframeSnapshot(plaintext: Uint8Array): Uint8Array;
-//# sourceMappingURL=automerge-bytes.d.ts.map
+/** §11, §13: the only framing version. */
+export declare const FRAMING_VERSION = 1;
+/**
+ * Deterministic CBOR of [1, bstr] (§11 shared-objects-change, §13
+ * shared-objects-snapshot): the profile plaintext of a Data Unit (one
+ * Automerge change) or a Snapshot (one Automerge full save). The bytes are
+ * framed as given; checking that they are a valid Automerge change or save
+ * is the Automerge binding (LFCP-031).
+ */
+export declare function frameProfilePayload(bytes: Uint8Array): Uint8Array;
+/**
+ * The inner bytes of a framed profile plaintext. §11: a receiver MUST
+ * reject plaintext that is not valid CBOR, not a two-element array, or
+ * uses an unsupported framing version; this also requires the
+ * deterministic encoding and no trailing bytes. Throws PROFILE_INVALID /
+ * INVALID_AUTOMERGE_BYTES (§74.1).
+ */
+export declare function unframeProfilePayload(framed: Uint8Array): Uint8Array;
+//# sourceMappingURL=framing.d.ts.map

package/dist/admission/framing.js

@@ -0,0 +1,231 @@
+import * as A from "@automerge/automerge";
+import { LfcpError, toHex } from "@openlfcp/core";
+import { sha256 } from "@openlfcp/crypto";
+import { ProfileInvalidError } from "../profile-invalid.js";
+import { checkCanonicalChange } from "./canonical.js";
+import { checkChangeExpansion, MalformedChunkError } from "./limits.js";
+/**
+ * Automerge byte checks of the SHARED-OBJECTS-PROFILE-01 payloads (LFCP-031):
+ * a Data Unit plaintext carries exactly one Automerge change (§11, §12), a
+ * Snapshot plaintext one Automerge full save (§13). The framing itself is
+ * frameProfilePayload / unframeProfilePayload (LFCP-030); this adds the
+ * check that the framed bytes are what they claim to be.
+ *
+ * Automerge storage chunks start with the magic bytes 85 6f 4a 83, a 4-byte
+ * checksum (the first 4 bytes of the chunk hash) and a chunk type: 0 for a
+ * document (a full save), 1 for a change, 2 for a compressed change.
+ */
+const MAGIC = [0x85, 0x6f, 0x4a, 0x83];
+const CHUNK_DOCUMENT = 0;
+const CHUNK_CHANGE = 1;
+const CHUNK_COMPRESSED_CHANGE = 2;
+const HEADER = 9; // magic, checksum, chunk type
+/** §11, §13, §74.1: PROFILE_INVALID / INVALID_AUTOMERGE_BYTES. */
+const reject = (why) => {
+    throw new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", why);
+};
+function chunkType(bytes, what) {
+    if (bytes.length < HEADER || MAGIC.some((b, i) => bytes[i] !== b))
+        return reject(`${what} is not an Automerge chunk`);
+    return bytes[8];
+}
+/**
+ * Checks that `bytes` is exactly one valid Automerge change (§11, §12) and
+ * returns it decoded. Rejects with PROFILE_INVALID / INVALID_AUTOMERGE_BYTES: a chunk that is not a
+ * change (a document chunk is a full save, §13), bytes Automerge cannot
+ * parse, trailing bytes such as a second concatenated change, and a
+ * checksum that does not match the change hash. Automerge JS 3.5.0 parses
+ * a change without verifying its checksum, so the check is done here.
+ */
+export function checkChange(bytes) {
+    const type = chunkType(bytes, "the change");
+    if (type === CHUNK_COMPRESSED_CHANGE)
+        reject("a compressed Automerge change (chunk type 2): a change is uncompressed (§11)");
+    if (type !== CHUNK_CHANGE)
+        reject(`chunk type ${type} is not an Automerge change (§11)`);
+    // §11.1: what the change expands to and its structure, before Automerge decodes it.
+    const expansion = checkChangeExpansion(bytes);
+    // §11.3: the canonical encoding, by the format's properties, still before the engine.
+    const parsed = checkCanonicalChange(bytes);
+    let decoded;
+    try {
+        decoded = A.decodeChange(bytes);
+    }
+    catch (e) {
+        return reject(`invalid Automerge change bytes (§11): ${e.message}`);
+    }
+    if (toHex(bytes.subarray(4, 8)) !== decoded.hash.slice(0, 8))
+        reject("the Automerge change checksum does not match its hash (§11)");
+    const checked = Object.freeze({
+        bytes: Uint8Array.from(bytes),
+        hash: decoded.hash,
+        actor: decoded.actor,
+        seq: decoded.seq,
+        deps: Object.freeze([...decoded.deps]),
+        otherActors: expansion.otherActors,
+    });
+    DECODED.set(checked, decoded);
+    PARSED.set(checked, parsed);
+    return checked;
+}
+/**
+ * The change hash of bytes checkChange refused, read without decoding
+ * them: the SHA-256 of the chunk from its type byte on (the Automerge
+ * change hash). A change above a §11.1 limit is named this way, so a
+ * receiver can report it without expanding it. Undefined when the bytes
+ * are not one change chunk that could be read: no magic bytes, another
+ * chunk type, a length that does not cover them exactly, or a header or
+ * column cut short.
+ */
+export function refusedChangeHash(bytes, error) {
+    if (error instanceof MalformedChunkError)
+        return undefined;
+    if (bytes.length < HEADER || MAGIC.some((b, i) => bytes[i] !== b))
+        return undefined;
+    if (bytes[8] !== CHUNK_CHANGE)
+        return undefined;
+    // The ULEB128 chunk length after the type byte must cover the rest exactly.
+    let length = 0;
+    let scale = 1;
+    let pos = HEADER;
+    for (;;) {
+        if (pos >= bytes.length || pos - HEADER >= 8)
+            return undefined;
+        const b = bytes[pos++];
+        length += (b & 0x7f) * scale;
+        scale *= 128;
+        if ((b & 0x80) === 0)
+            break;
+    }
+    if (pos + length !== bytes.length)
+        return undefined;
+    return toHex(sha256(bytes.subarray(8)));
+}
+/** The operations checkChange read from the bytes (§11.3), for the references of §11.4. */
+const PARSED = new WeakMap();
+/** The change as its canonical bytes give it (§11.3), reusing the walk of checkChange. */
+export function parsedOf(change) {
+    let p = PARSED.get(change);
+    if (p === undefined) {
+        p = checkCanonicalChange(change.bytes);
+        PARSED.set(change, p);
+    }
+    return p;
+}
+/** The decoded form checkChange made, kept for the change's lifetime (decoding is not cheap). */
+const DECODED = new WeakMap();
+/** The decoded change, reusing the decode of checkChange when there was one. */
+export function decodedOf(change) {
+    return DECODED.get(change) ?? A.decodeChange(change.bytes);
+}
+/**
+ * Checks that `bytes` starts as an Automerge full save (a document chunk,
+ * §13). Whether the whole image loads, checksums included, is decided by
+ * Automerge's load.
+ */
+export function checkSaveHeader(bytes) {
+    const type = chunkType(bytes, "the Snapshot image");
+    if (type !== CHUNK_DOCUMENT)
+        reject(`chunk type ${type} is not an Automerge document (full save, §13)`);
+}
+/** §11: the Data Unit plaintext [1, change] of one checked Automerge change. */
+export function frameChange(change) {
+    checkChange(change);
+    return frameProfilePayload(change);
+}
+/** §11: the one Automerge change a Data Unit plaintext carries, checked. Throws PROFILE_INVALID / INVALID_AUTOMERGE_BYTES. */
+export function unframeChange(plaintext) {
+    return checkChange(unframeProfilePayload(plaintext));
+}
+/** §13: the Snapshot plaintext [1, save] of an Automerge full save. */
+export function frameSnapshot(save) {
+    checkSaveHeader(save);
+    return frameProfilePayload(save);
+}
+/** §13: the Automerge full save a Snapshot plaintext carries (header checked). Throws PROFILE_INVALID / INVALID_AUTOMERGE_BYTES. */
+export function unframeSnapshot(plaintext) {
+    const save = unframeProfilePayload(plaintext);
+    checkSaveHeader(save);
+    return save;
+}
+/** §11, §13: the only framing version. */
+export const FRAMING_VERSION = 1;
+/** The deterministic CBOR head of a byte string of `length` bytes (major type 2, shortest form). */
+function bstrHead(length) {
+    if (length < 24)
+        return [0x40 | length];
+    if (length < 0x100)
+        return [0x58, length];
+    if (length < 0x10000)
+        return [0x59, length >> 8, length & 0xff];
+    if (length <= 0xffffffff)
+        return [
+            0x5a,
+            (length >>> 24) & 0xff,
+            (length >>> 16) & 0xff,
+            (length >>> 8) & 0xff,
+            length & 0xff,
+        ];
+    throw new LfcpError("OUT_OF_RANGE", "the framed bytes are too long");
+}
+/**
+ * Deterministic CBOR of [1, bstr] (§11 shared-objects-change, §13
+ * shared-objects-snapshot): the profile plaintext of a Data Unit (one
+ * Automerge change) or a Snapshot (one Automerge full save). The bytes are
+ * framed as given; checking that they are a valid Automerge change or save
+ * is the Automerge binding (LFCP-031).
+ */
+export function frameProfilePayload(bytes) {
+    if (!(bytes instanceof Uint8Array))
+        throw new LfcpError("INVALID_LENGTH", "framing takes bytes");
+    const head = bstrHead(bytes.length);
+    const out = new Uint8Array(2 + head.length + bytes.length);
+    out.set([0x82, FRAMING_VERSION, ...head], 0);
+    out.set(bytes, 2 + head.length);
+    return out;
+}
+/**
+ * The inner bytes of a framed profile plaintext. §11: a receiver MUST
+ * reject plaintext that is not valid CBOR, not a two-element array, or
+ * uses an unsupported framing version; this also requires the
+ * deterministic encoding and no trailing bytes. Throws PROFILE_INVALID /
+ * INVALID_AUTOMERGE_BYTES (§74.1).
+ */
+export function unframeProfilePayload(framed) {
+    const fail = (why) => {
+        throw new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", `invalid profile framing: ${why}`);
+    };
+    if (!(framed instanceof Uint8Array) || framed.length < 3)
+        return fail("too short");
+    if (framed[0] !== 0x82)
+        return fail("not a two-element array");
+    if (framed[1] !== FRAMING_VERSION)
+        return fail("unsupported framing version");
+    const first = framed[2];
+    if (first >> 5 !== 2)
+        return fail("the second element is not a byte string");
+    const info = first & 0x1f;
+    let length;
+    let offset;
+    const at = (i) => framed[i];
+    if (info < 24)
+        [length, offset] = [info, 3];
+    else if (info === 24)
+        [length, offset] = [at(3), 4];
+    else if (info === 25)
+        [length, offset] = [(at(3) << 8) | at(4), 5];
+    else if (info === 26)
+        [length, offset] = [((at(3) << 24) >>> 0) + (at(4) << 16) + (at(5) << 8) + at(6), 7];
+    else
+        return fail("unsupported byte string length");
+    if (offset > framed.length)
+        return fail("truncated");
+    const bytes = framed.subarray(offset);
+    if (bytes.length !== length)
+        return fail(bytes.length < length ? "truncated" : "trailing bytes");
+    const canonical = bstrHead(length);
+    if (canonical.length !== offset - 2)
+        return fail("non-shortest byte string length");
+    return Uint8Array.from(bytes);
+}
+//# sourceMappingURL=framing.js.map

package/dist/admission/index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The admission of SHARED-OBJECTS-PROFILE-01 §§7–18 that every profile
+ * inheriting them shares (SHARED-SECTIONS-PROFILE-01 §2; LFCP-02-085),
+ * checked before the Automerge engine sees a change or a Snapshot:
+ *
+ * - framing (§11, §13): [1, change] and [1, full save], one uncompressed
+ *   change chunk with a verified checksum;
+ * - limits (§11.1, §11.2, §13.1): the exact change expansion limits, the
+ *   document depth bound, the Snapshot limits with their floor;
+ * - the canonical change encoding (§11.3), by the format's properties;
+ * - operation references (§11.4) against the change's causal history;
+ * - actor binding (§8), with the profile's domain;
+ * - sequence admission (§14.1): duplicates, dependencies, the sequence
+ *   check, and holding a change whose actor and sequence another change
+ *   has (POST-001).
+ *
+ * It knows no profile semantics: a profile's own rules (its values, §74.1)
+ * run after it, on admitted changes only. `@openlfcp/shared-objects/admission`.
+ */
+export { checkChangeActor, deriveDomainActorId } from "./actor.js";
+export { checkCanonicalChange, type ParsedChange, type ParsedOp } from "./canonical.js";
+export { type CheckedChange, checkChange, checkSaveHeader, FRAMING_VERSION, frameChange, frameProfilePayload, frameSnapshot, parsedOf, refusedChangeHash, unframeChange, unframeProfilePayload, unframeSnapshot, } from "./framing.js";
+export { CHANGE_LIMITS, type ChunkExpansion, checkChangeExpansion, checkSnapshotExpansion, MAX_DOCUMENT_DEPTH, SNAPSHOT_LIMITS_FLOOR, type SnapshotLimits, } from "./limits.js";
+export { ReferenceHistory, type ReferenceRule } from "./references.js";
+export { admitBatch, admitChange, type BatchAdmission, type ChangeAdmission, type DocumentSequences, type RefusedChange, } from "./sequence.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/admission/index.js

@@ -0,0 +1,26 @@
+/**
+ * The admission of SHARED-OBJECTS-PROFILE-01 §§7–18 that every profile
+ * inheriting them shares (SHARED-SECTIONS-PROFILE-01 §2; LFCP-02-085),
+ * checked before the Automerge engine sees a change or a Snapshot:
+ *
+ * - framing (§11, §13): [1, change] and [1, full save], one uncompressed
+ *   change chunk with a verified checksum;
+ * - limits (§11.1, §11.2, §13.1): the exact change expansion limits, the
+ *   document depth bound, the Snapshot limits with their floor;
+ * - the canonical change encoding (§11.3), by the format's properties;
+ * - operation references (§11.4) against the change's causal history;
+ * - actor binding (§8), with the profile's domain;
+ * - sequence admission (§14.1): duplicates, dependencies, the sequence
+ *   check, and holding a change whose actor and sequence another change
+ *   has (POST-001).
+ *
+ * It knows no profile semantics: a profile's own rules (its values, §74.1)
+ * run after it, on admitted changes only. `@openlfcp/shared-objects/admission`.
+ */
+export { checkChangeActor, deriveDomainActorId } from "./actor.js";
+export { checkCanonicalChange } from "./canonical.js";
+export { checkChange, checkSaveHeader, FRAMING_VERSION, frameChange, frameProfilePayload, frameSnapshot, parsedOf, refusedChangeHash, unframeChange, unframeProfilePayload, unframeSnapshot, } from "./framing.js";
+export { CHANGE_LIMITS, checkChangeExpansion, checkSnapshotExpansion, MAX_DOCUMENT_DEPTH, SNAPSHOT_LIMITS_FLOOR, } from "./limits.js";
+export { ReferenceHistory } from "./references.js";
+export { admitBatch, admitChange, } from "./sequence.js";
+//# sourceMappingURL=index.js.map

package/dist/{chunk-limits.d.ts → admission/limits.d.ts}

@@ -1,3 +1,4 @@
+import { ProfileInvalidError } from "../profile-invalid.js";
 /** The exact limits of a change (§11.1): writers stay within them, receivers reject above. */
 export declare const CHANGE_LIMITS: Readonly<{
     maxRows: 16384;
@@ -42,6 +43,15 @@ export interface ChunkExpansion {
     /** A Snapshot's deepest object (§11.2); 0 for a change (its depths depend on the document). */
     readonly maxDepth: number;
 }
+/**
+ * A chunk refused because it cannot be read as one: no magic bytes, a
+ * length that does not cover it exactly, a truncated number or field. A
+ * chunk refused for anything else (a limit, a deflated or duplicate column,
+ * an out-of-range value) was read in full and still names its change hash.
+ */
+export declare class MalformedChunkError extends ProfileInvalidError {
+    constructor(why: string);
+}
 /**
  * §11.1: checks an uncompressed change chunk (type 1) against the exact
  * change limits before the engine sees it. Throws PROFILE_INVALID /
@@ -55,4 +65,4 @@ export declare function checkChangeExpansion(bytes: Uint8Array): ChunkExpansion;
  * INVALID_AUTOMERGE_BYTES.
  */
 export declare function checkSnapshotExpansion(bytes: Uint8Array, limits?: SnapshotLimits): ChunkExpansion;
-//# sourceMappingURL=chunk-limits.d.ts.map
+//# sourceMappingURL=limits.d.ts.map

package/dist/{chunk-limits.js → admission/limits.js}

@@ -22,7 +22,7 @@
 //   actors);
 // - for a Snapshot, the bytes of all column data after inflation.
 import { Inflate } from "fflate";
-import { ProfileInvalidError } from "./profile-invalid.js";
+import { ProfileInvalidError } from "../profile-invalid.js";
 /** The exact limits of a change (§11.1): writers stay within them, receivers reject above. */
 export const CHANGE_LIMITS = Object.freeze({
     maxRows: 16_384,
@@ -63,6 +63,21 @@ const INFLATE_SLICE = 1024;
 const refuse = (why) => {
     throw new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", `Automerge chunk refused (§11.1): ${why}`);
 };
+/**
+ * A chunk refused because it cannot be read as one: no magic bytes, a
+ * length that does not cover it exactly, a truncated number or field. A
+ * chunk refused for anything else (a limit, a deflated or duplicate column,
+ * an out-of-range value) was read in full and still names its change hash.
+ */
+export class MalformedChunkError extends ProfileInvalidError {
+    constructor(why) {
+        super("INVALID_AUTOMERGE_BYTES", `Automerge chunk refused (§11.1): ${why}`);
+        this.name = "MalformedChunkError";
+    }
+}
+const malformed = (why) => {
+    throw new MalformedChunkError(why);
+};
 class Cursor {
     bytes;
     end;
@@ -76,7 +91,7 @@ class Cursor {
     }
     take(n) {
         if (n > this.end - this.pos)
-            refuse("a length runs past the end");
+            malformed("a length runs past the end");
         const out = this.bytes.subarray(this.pos, this.pos + n);
         this.pos += n;
         return out;
@@ -87,14 +102,14 @@ class Cursor {
         let scale = 1;
         for (let i = 0; i < 10; i++) {
             if (this.pos >= this.end)
-                refuse("a LEB128 number runs past the end");
+                malformed("a LEB128 number runs past the end");
             const b = this.bytes[this.pos++];
             value += (b & 0x7f) * scale;
             if ((b & 0x80) === 0)
                 return value >= 2 ** 53 ? Number.POSITIVE_INFINITY : value;
             scale *= 128;
         }
-        return refuse("a LEB128 number is longer than 10 bytes");
+        return malformed("a LEB128 number is longer than 10 bytes");
     }
     /** Signed LEB128 as a number; magnitudes at or above 2^53 come back as +/-Infinity. */
     sleb() {
@@ -102,7 +117,7 @@ class Cursor {
         let scale = 1;
         for (let i = 0; i < 10; i++) {
             if (this.pos >= this.end)
-                refuse("a LEB128 number runs past the end");
+                malformed("a LEB128 number runs past the end");
             const b = this.bytes[this.pos++];
             value += (b & 0x7f) * scale;
             scale *= 128;
@@ -112,7 +127,7 @@ class Cursor {
                 return Math.abs(value) >= 2 ** 53 ? Math.sign(value) * Number.POSITIVE_INFINITY : value;
             }
         }
-        return refuse("a LEB128 number is longer than 10 bytes");
+        return malformed("a LEB128 number is longer than 10 bytes");
     }
 }
 class Tally {
@@ -199,7 +214,7 @@ function countColumn(type, data, tally, bounds) {
 function columnMetas(c) {
     const count = c.uleb();
     if (count > (c.end - c.pos) / 2)
-        refuse("the column metadata runs past the end");
+        malformed("the column metadata runs past the end");
     const out = [];
     const specs = new Set();
     for (let i = 0; i < count; i++) {
@@ -236,14 +251,14 @@ function body(bytes, want, what) {
     const c = new Cursor(bytes);
     const magic = c.take(4);
     if (!MAGIC.every((b, i) => magic[i] === b))
-        refuse(`${what} has no Automerge magic bytes`);
+        malformed(`${what} has no Automerge magic bytes`);
     c.take(4); // checksum: verified elsewhere (checkChange; the engine for a Snapshot)
     const type = c.take(1)[0];
     if (type !== want)
         refuse(`${what} is chunk type ${type}, not ${want}`);
     const length = c.uleb();
     if (length !== bytes.length - c.pos)
-        refuse(`${what} must be exactly one chunk with nothing after it`);
+        malformed(`${what} must be exactly one chunk with nothing after it`);
     return c;
 }
 /**
@@ -454,4 +469,4 @@ export function checkSnapshotExpansion(bytes, limits = SNAPSHOT_LIMITS_FLOOR) {
         maxDepth,
     });
 }
-//# sourceMappingURL=chunk-limits.js.map
+//# sourceMappingURL=limits.js.map

package/dist/{references.d.ts → admission/references.d.ts}

@@ -1,7 +1,7 @@
 import * as A from "@automerge/automerge";
 import { type ParsedChange } from "./canonical.js";
 /** A §11.4 rule a change breaks. */
-export type ReferenceRule = "R1" | "R2" | "R3" | "R4" | "R5" | "R6" | "R7";
+export type ReferenceRule = "R1" | "R2" | "R3" | "R4" | "R5" | "R6" | "R7" | "R8" | "R9" | "R10";
 /**
  * The changes of a document as §11.4 reads them. A replica keeps it current
  * as changes are admitted and committed, or builds it again from its

package/dist/{references.js → admission/references.js}

@@ -31,6 +31,7 @@ const targetOf = (op, id) => ({
     insert: op.insert,
     del: op.action === 3,
     make: MAKE.has(op.action) ? op.action : null,
+    counterPut: op.action === 1 && op.valueType === 8,
 });
 function splitId(id) {
     const at = id.indexOf("@");
@@ -137,6 +138,12 @@ export class ReferenceHistory {
         };
         for (const [i, op] of change.ops.entries()) {
             const id = `${change.startOp + i}@${change.actor}`;
+            // R9: no operation is a mark. R10: no operation makes a table (an engine
+            // cannot write a table back out, and writing into one aborts the apply).
+            if (op.action === 7)
+                return "R9";
+            if (op.action === 6)
+                return "R10";
             // R3: the root, or an object an operation made; its key form.
             let sequence;
             if (op.obj === "_root")
@@ -171,6 +178,10 @@ export class ReferenceHistory {
             // R7: a deletion has a predecessor.
             if (op.action === 3 && op.pred.length === 0)
                 return "R7";
+            // R8: an increment names at least one put of a counter, and only such puts (R6 put
+            // them on the same object and key).
+            if (op.action === 5 && (op.pred.length === 0 || op.pred.some((p) => !target(p)?.counterPut)))
+                return "R8";
             own.push(targetOf(op, id));
         }
         return null;