@openlfcp/shared-objects 0.1.5 → 0.2.0-beta.10

package/README.md

@@ -20,9 +20,22 @@ reaches the replica (§95). The replica has no Markdown or editor concepts.
 
 Part of the OpenLFCP TypeScript SDK, which implements the OpenLFCP MVP 0.1
 subset of [LFCP-WIRE-01](https://github.com/openlfcp/spec/blob/main/wire/LFCP-WIRE-01.md)
-at `mvp-0.1-baseline.10`, not every deferred WIRE-01 feature. It does not
+at `mvp-0.1-baseline.9`, not every deferred WIRE-01 feature. It does not
 claim full LFCP-WIRE-01 conformance. This is the MVP 0.1 release
-(`0.1.4`, npm dist-tag `latest`). Until 1.0, minor versions may change APIs.
+(`0.1.3`, npm dist-tag `latest`). Until 1.0, minor versions may change APIs.
+
+## Shared sections (Working Draft)
+
+`@openlfcp/shared-objects/sections` implements part of
+SHARED-SECTIONS-PROFILE-01 (`org.openlfcp.shared-sections.v1`, Working
+Draft 0.3, not in any implementation baseline): profile dispatch by a
+Resource's Genesis profile (`profileModel`), the section actor binding
+(`deriveSectionActorId`) and schema validation of a section document
+(`validateSection`, `SectionDocument`), and the writer of a section's
+creation and Task intents (`SectionReplica`). Moves, lifecycle, Text
+edits, the effective tree and the section admission rules are not there
+yet. It may change
+without notice until the profile is in a baseline.
 
 ## Automerge and WebAssembly
 

package/dist/admission/actor.d.ts

@@ -0,0 +1,16 @@
+import { type PrincipalId, type ResourceId } from "@openlfcp/core";
+import type { CheckedChange } from "./framing.js";
+/**
+ * SHARED-OBJECTS-PROFILE-01 §8, the actor binding, for any profile that
+ * inherits it with its own domain (SHARED-SECTIONS-PROFILE-01 §2):
+ * SHA-256(ASCII(domain) || resource_id || principal_id), from the raw
+ * 32-byte IDs.
+ */
+export declare function deriveDomainActorId(domain: string, resource: ResourceId, principal: PrincipalId): Uint8Array;
+/**
+ * §8, §11: a Data Unit carries only changes of its signer's actor. Throws
+ * PROFILE_INVALID / CHANGE_ACTOR_MISMATCH otherwise; `actor` is the hex
+ * actor ID the signer's binding gives.
+ */
+export declare function checkChangeActor(change: CheckedChange, actor: string): CheckedChange;
+//# sourceMappingURL=actor.d.ts.map

package/dist/admission/actor.js

@@ -0,0 +1,35 @@
+import { ID32_LENGTH, LfcpError } from "@openlfcp/core";
+import { sha256 } from "@openlfcp/crypto";
+import { ProfileInvalidError } from "../profile-invalid.js";
+/**
+ * SHARED-OBJECTS-PROFILE-01 §8, the actor binding, for any profile that
+ * inherits it with its own domain (SHARED-SECTIONS-PROFILE-01 §2):
+ * SHA-256(ASCII(domain) || resource_id || principal_id), from the raw
+ * 32-byte IDs.
+ */
+export function deriveDomainActorId(domain, resource, principal) {
+    for (const [what, id] of [
+        ["the Resource ID", resource],
+        ["the Principal ID", principal],
+    ]) {
+        if (!(id instanceof Uint8Array) || id.length !== ID32_LENGTH)
+            throw new LfcpError("INVALID_LENGTH", `${what} must be the raw 32-byte ID`);
+    }
+    const prefix = Uint8Array.from(domain, (c) => c.charCodeAt(0));
+    const input = new Uint8Array(prefix.length + 2 * ID32_LENGTH);
+    input.set(prefix, 0);
+    input.set(resource, prefix.length);
+    input.set(principal, prefix.length + ID32_LENGTH);
+    return sha256(input);
+}
+/**
+ * §8, §11: a Data Unit carries only changes of its signer's actor. Throws
+ * PROFILE_INVALID / CHANGE_ACTOR_MISMATCH otherwise; `actor` is the hex
+ * actor ID the signer's binding gives.
+ */
+export function checkChangeActor(change, actor) {
+    if (change.actor !== actor)
+        throw new ProfileInvalidError("CHANGE_ACTOR_MISMATCH", `the change's Automerge actor ${change.actor} is not the §8 actor ${actor} of the unit's signer (§11, SO-SEC1)`);
+    return change;
+}
+//# sourceMappingURL=actor.js.map

package/dist/{canonical.d.ts → admission/canonical.d.ts}

@@ -17,6 +17,8 @@ export interface ParsedOp {
     readonly action: number;
     /** Predecessor IDs "counter@actorhex", in order. */
     readonly pred: readonly string[];
+    /** The value's type, the low 4 bits of its metadata (8: a counter). */
+    readonly valueType: number;
 }
 /** A change read from its bytes (§11.3), without the engine. */
 export interface ParsedChange {
@@ -28,6 +30,13 @@ export interface ParsedChange {
     /** Hex other actors, ascending: actor index i is otherActors[i - 1]. */
     readonly otherActors: readonly string[];
     readonly ops: readonly ParsedOp[];
+    /**
+     * §14.1: the extra bytes after the columns (which rule 4 leaves free) begin
+     * with an Automerge author — an unsigned LEB128 1, a length L, then at least
+     * L bytes. automerge 0.12 reads it and asserts the change's sequence number
+     * is 1, so a later change carrying one is refused (finding D5).
+     */
+    readonly beginsWithAuthor: boolean;
 }
 /**
  * §11.3: checks that `bytes` (one change chunk within the §11.1 limits) is

package/dist/{canonical.js → admission/canonical.js}

@@ -12,7 +12,7 @@
 // the same bytes. Everything else is checked as stated: the header, the
 // columns and their presence, row counts, value metadata and bytes,
 // actions, IDs and counters below 2^32, sorted predecessors.
-import { ProfileInvalidError } from "./profile-invalid.js";
+import { ProfileInvalidError } from "../profile-invalid.js";
 const refuse = (why) => {
     throw new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", `the change is not in its canonical encoding (§11.3): ${why}`);
 };
@@ -349,6 +349,36 @@ function checkValue(type, bytes) {
     if (type === 6)
         utf8(bytes, "a string value");
 }
+/**
+ * §14.1: whether the extra bytes after a change's columns begin with an
+ * Automerge author (finding D5). Rule 4 leaves these bytes free, but
+ * automerge 0.12 reads an author there — an unsigned LEB128 1, a length L,
+ * then L bytes — and asserts the change's sequence number is 1. The LEB128 is
+ * read as automerge reads it: up to ten bytes, under 2^64, in any encoding
+ * (not the shortest-form `Reader` the rest of the walk uses).
+ */
+function beginsWithAuthor(extra) {
+    let pos = 0;
+    const leb = () => {
+        let value = 0n;
+        let shift = 0n;
+        for (;;) {
+            if (pos >= extra.length)
+                return null;
+            const b = extra[pos++];
+            if (shift === 63n && b !== 0 && b !== 1)
+                return null;
+            value |= BigInt(b & 0x7f) << shift;
+            if ((b & 0x80) === 0)
+                return value;
+            shift += 7n;
+        }
+    };
+    if (leb() !== 1n)
+        return false;
+    const length = leb();
+    return length !== null && BigInt(extra.length - pos) >= length;
+}
 /**
  * §11.3: checks that `bytes` (one change chunk within the §11.1 limits) is
  * the canonical encoding of its change, and returns the change's operations
@@ -403,7 +433,9 @@ export function checkCanonicalChange(bytes) {
     const data = new Map();
     for (const m of metas)
         data.set(m.spec, r.take(m.length));
-    // What follows is the change's extra bytes.
+    // What follows is the change's extra bytes (§11.3 rule 4), free except that
+    // automerge reads an author from their start (§14.1, finding D5).
+    const authored = beginsWithAuthor(bytes.subarray(r.pos));
     const rle = (spec) => {
         const d = data.get(spec);
         return d === undefined ? undefined : column(spec, d);
@@ -575,7 +607,14 @@ export function checkCanonicalChange(bytes) {
             pred.push(`${ctr}@${id}`);
             anyPred = true;
         }
-        ops.push(Object.freeze({ obj, key, insert: ins, action: act, pred: Object.freeze(pred) }));
+        ops.push(Object.freeze({
+            obj,
+            key,
+            insert: ins,
+            action: act,
+            pred: Object.freeze(pred),
+            valueType: valueTypes[i],
+        }));
     }
     // Rule 3: each column present exactly when the table says.
     const presence = [
@@ -608,6 +647,7 @@ export function checkCanonicalChange(bytes) {
         deps: Object.freeze(deps.map(hex)),
         otherActors: Object.freeze(others.map(hex)),
         ops: Object.freeze(ops),
+        beginsWithAuthor: authored,
     });
 }
 //# sourceMappingURL=canonical.js.map

package/dist/{automerge-bytes.d.ts → admission/framing.d.ts}

@@ -1,3 +1,4 @@
+import * as A from "@automerge/automerge";
 import { type ParsedChange } from "./canonical.js";
 /** A checked Automerge change: its bytes and decoded header. */
 export interface CheckedChange {
@@ -11,6 +12,12 @@ export interface CheckedChange {
     readonly deps: readonly string[];
     /** Hex IDs of the other actors the change refers to (§11.1: each must be known to the document). */
     readonly otherActors: readonly string[];
+    /**
+     * §14.1: the change's extra bytes begin with an Automerge author, allowed
+     * only in an actor's first change (finding D5). See
+     * {@link ParsedChange.beginsWithAuthor}.
+     */
+    readonly beginsWithAuthor: boolean;
 }
 /**
  * Checks that `bytes` is exactly one valid Automerge change (§11, §12) and
@@ -21,8 +28,23 @@ export interface CheckedChange {
  * a change without verifying its checksum, so the check is done here.
  */
 export declare function checkChange(bytes: Uint8Array): CheckedChange;
+/**
+ * The change hash of bytes checkChange refused, read without decoding them:
+ * the SHA-256 of the chunk from its type byte on (the Automerge change hash).
+ * §14.1 names a refused change by this hash whenever the bytes are one change
+ * chunk of type 1 whose length field covers them exactly and whose checksum
+ * matches — the inner header is never read, so a change above a §11.1 limit
+ * (named without being expanded) and one whose header holds a length running
+ * past its end (finding C3) are both named. Undefined when the bytes are not
+ * such a chunk: no magic bytes, another chunk type (a compressed chunk
+ * included), a length that does not cover them exactly, or a wrong checksum
+ * (whose name would be its intact copy's, finding C1).
+ */
+export declare function refusedChangeHash(bytes: Uint8Array): string | undefined;
 /** The change as its canonical bytes give it (§11.3), reusing the walk of checkChange. */
 export declare function parsedOf(change: CheckedChange): ParsedChange;
+/** The decoded change, reusing the decode of checkChange when there was one. */
+export declare function decodedOf(change: CheckedChange): A.DecodedChange;
 /**
  * Checks that `bytes` starts as an Automerge full save (a document chunk,
  * §13). Whether the whole image loads, checksums included, is decided by
@@ -37,4 +59,22 @@ export declare function unframeChange(plaintext: Uint8Array): CheckedChange;
 export declare function frameSnapshot(save: Uint8Array): Uint8Array;
 /** §13: the Automerge full save a Snapshot plaintext carries (header checked). Throws PROFILE_INVALID / INVALID_AUTOMERGE_BYTES. */
 export declare function unframeSnapshot(plaintext: Uint8Array): Uint8Array;
-//# sourceMappingURL=automerge-bytes.d.ts.map
+/** §11, §13: the only framing version. */
+export declare const FRAMING_VERSION = 1;
+/**
+ * Deterministic CBOR of [1, bstr] (§11 shared-objects-change, §13
+ * shared-objects-snapshot): the profile plaintext of a Data Unit (one
+ * Automerge change) or a Snapshot (one Automerge full save). The bytes are
+ * framed as given; checking that they are a valid Automerge change or save
+ * is the Automerge binding (LFCP-031).
+ */
+export declare function frameProfilePayload(bytes: Uint8Array): Uint8Array;
+/**
+ * The inner bytes of a framed profile plaintext. §11: a receiver MUST
+ * reject plaintext that is not valid CBOR, not a two-element array, or
+ * uses an unsupported framing version; this also requires the
+ * deterministic encoding and no trailing bytes. Throws PROFILE_INVALID /
+ * INVALID_AUTOMERGE_BYTES (§74.1).
+ */
+export declare function unframeProfilePayload(framed: Uint8Array): Uint8Array;
+//# sourceMappingURL=framing.d.ts.map

package/dist/admission/framing.js

@@ -0,0 +1,242 @@
+import * as A from "@automerge/automerge";
+import { LfcpError, toHex } from "@openlfcp/core";
+import { sha256 } from "@openlfcp/crypto";
+import { ProfileInvalidError } from "../profile-invalid.js";
+import { checkCanonicalChange } from "./canonical.js";
+import { checkChangeExpansion } from "./limits.js";
+/**
+ * Automerge byte checks of the SHARED-OBJECTS-PROFILE-01 payloads (LFCP-031):
+ * a Data Unit plaintext carries exactly one Automerge change (§11, §12), a
+ * Snapshot plaintext one Automerge full save (§13). The framing itself is
+ * frameProfilePayload / unframeProfilePayload (LFCP-030); this adds the
+ * check that the framed bytes are what they claim to be.
+ *
+ * Automerge storage chunks start with the magic bytes 85 6f 4a 83, a 4-byte
+ * checksum (the first 4 bytes of the chunk hash) and a chunk type: 0 for a
+ * document (a full save), 1 for a change, 2 for a compressed change.
+ */
+const MAGIC = [0x85, 0x6f, 0x4a, 0x83];
+const CHUNK_DOCUMENT = 0;
+const CHUNK_CHANGE = 1;
+const CHUNK_COMPRESSED_CHANGE = 2;
+const HEADER = 9; // magic, checksum, chunk type
+/** §11, §13, §74.1: PROFILE_INVALID / INVALID_AUTOMERGE_BYTES. */
+const reject = (why) => {
+    throw new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", why);
+};
+function chunkType(bytes, what) {
+    if (bytes.length < HEADER || MAGIC.some((b, i) => bytes[i] !== b))
+        return reject(`${what} is not an Automerge chunk`);
+    return bytes[8];
+}
+/**
+ * Checks that `bytes` is exactly one valid Automerge change (§11, §12) and
+ * returns it decoded. Rejects with PROFILE_INVALID / INVALID_AUTOMERGE_BYTES: a chunk that is not a
+ * change (a document chunk is a full save, §13), bytes Automerge cannot
+ * parse, trailing bytes such as a second concatenated change, and a
+ * checksum that does not match the change hash. Automerge JS 3.5.0 parses
+ * a change without verifying its checksum, so the check is done here.
+ */
+export function checkChange(bytes) {
+    const type = chunkType(bytes, "the change");
+    if (type === CHUNK_COMPRESSED_CHANGE)
+        reject("a compressed Automerge change (chunk type 2): a change is uncompressed (§11)");
+    if (type !== CHUNK_CHANGE)
+        reject(`chunk type ${type} is not an Automerge change (§11)`);
+    // §11.1: what the change expands to and its structure, before Automerge decodes it.
+    const expansion = checkChangeExpansion(bytes);
+    // §11.3: the canonical encoding, by the format's properties, still before the engine.
+    const parsed = checkCanonicalChange(bytes);
+    let decoded;
+    try {
+        decoded = A.decodeChange(bytes);
+    }
+    catch (e) {
+        return reject(`invalid Automerge change bytes (§11): ${e.message}`);
+    }
+    if (toHex(bytes.subarray(4, 8)) !== decoded.hash.slice(0, 8))
+        reject("the Automerge change checksum does not match its hash (§11)");
+    const checked = Object.freeze({
+        bytes: Uint8Array.from(bytes),
+        hash: decoded.hash,
+        actor: decoded.actor,
+        seq: decoded.seq,
+        deps: Object.freeze([...decoded.deps]),
+        otherActors: expansion.otherActors,
+        beginsWithAuthor: parsed.beginsWithAuthor,
+    });
+    DECODED.set(checked, decoded);
+    PARSED.set(checked, parsed);
+    return checked;
+}
+/**
+ * The change hash of bytes checkChange refused, read without decoding them:
+ * the SHA-256 of the chunk from its type byte on (the Automerge change hash).
+ * §14.1 names a refused change by this hash whenever the bytes are one change
+ * chunk of type 1 whose length field covers them exactly and whose checksum
+ * matches — the inner header is never read, so a change above a §11.1 limit
+ * (named without being expanded) and one whose header holds a length running
+ * past its end (finding C3) are both named. Undefined when the bytes are not
+ * such a chunk: no magic bytes, another chunk type (a compressed chunk
+ * included), a length that does not cover them exactly, or a wrong checksum
+ * (whose name would be its intact copy's, finding C1).
+ */
+export function refusedChangeHash(bytes) {
+    if (bytes.length < HEADER || MAGIC.some((b, i) => bytes[i] !== b))
+        return undefined;
+    if (bytes[8] !== CHUNK_CHANGE)
+        return undefined;
+    // The ULEB128 chunk length after the type byte must cover the rest exactly.
+    let length = 0;
+    let scale = 1;
+    let pos = HEADER;
+    for (;;) {
+        if (pos >= bytes.length || pos - HEADER >= 8)
+            return undefined;
+        const b = bytes[pos++];
+        length += (b & 0x7f) * scale;
+        scale *= 128;
+        if ((b & 0x80) === 0)
+            break;
+    }
+    if (pos + length !== bytes.length)
+        return undefined;
+    // §14.1 (baseline.7, finding C1): name the bytes only when their checksum
+    // matches. The name is the SHA-256 of the chunk from its type byte on, and
+    // the checksum (bytes 4 to 8) is the first four bytes of that same hash; a
+    // chunk with a wrong checksum would be named by its intact copy's hash, so
+    // it is left unnamed and the intact copy is checked as any change is.
+    const hash = sha256(bytes.subarray(8));
+    for (let i = 0; i < 4; i++)
+        if (bytes[4 + i] !== hash[i])
+            return undefined;
+    return toHex(hash);
+}
+/** The operations checkChange read from the bytes (§11.3), for the references of §11.4. */
+const PARSED = new WeakMap();
+/** The change as its canonical bytes give it (§11.3), reusing the walk of checkChange. */
+export function parsedOf(change) {
+    let p = PARSED.get(change);
+    if (p === undefined) {
+        p = checkCanonicalChange(change.bytes);
+        PARSED.set(change, p);
+    }
+    return p;
+}
+/** The decoded form checkChange made, kept for the change's lifetime (decoding is not cheap). */
+const DECODED = new WeakMap();
+/** The decoded change, reusing the decode of checkChange when there was one. */
+export function decodedOf(change) {
+    return DECODED.get(change) ?? A.decodeChange(change.bytes);
+}
+/**
+ * Checks that `bytes` starts as an Automerge full save (a document chunk,
+ * §13). Whether the whole image loads, checksums included, is decided by
+ * Automerge's load.
+ */
+export function checkSaveHeader(bytes) {
+    const type = chunkType(bytes, "the Snapshot image");
+    if (type !== CHUNK_DOCUMENT)
+        reject(`chunk type ${type} is not an Automerge document (full save, §13)`);
+}
+/** §11: the Data Unit plaintext [1, change] of one checked Automerge change. */
+export function frameChange(change) {
+    checkChange(change);
+    return frameProfilePayload(change);
+}
+/** §11: the one Automerge change a Data Unit plaintext carries, checked. Throws PROFILE_INVALID / INVALID_AUTOMERGE_BYTES. */
+export function unframeChange(plaintext) {
+    return checkChange(unframeProfilePayload(plaintext));
+}
+/** §13: the Snapshot plaintext [1, save] of an Automerge full save. */
+export function frameSnapshot(save) {
+    checkSaveHeader(save);
+    return frameProfilePayload(save);
+}
+/** §13: the Automerge full save a Snapshot plaintext carries (header checked). Throws PROFILE_INVALID / INVALID_AUTOMERGE_BYTES. */
+export function unframeSnapshot(plaintext) {
+    const save = unframeProfilePayload(plaintext);
+    checkSaveHeader(save);
+    return save;
+}
+/** §11, §13: the only framing version. */
+export const FRAMING_VERSION = 1;
+/** The deterministic CBOR head of a byte string of `length` bytes (major type 2, shortest form). */
+function bstrHead(length) {
+    if (length < 24)
+        return [0x40 | length];
+    if (length < 0x100)
+        return [0x58, length];
+    if (length < 0x10000)
+        return [0x59, length >> 8, length & 0xff];
+    if (length <= 0xffffffff)
+        return [
+            0x5a,
+            (length >>> 24) & 0xff,
+            (length >>> 16) & 0xff,
+            (length >>> 8) & 0xff,
+            length & 0xff,
+        ];
+    throw new LfcpError("OUT_OF_RANGE", "the framed bytes are too long");
+}
+/**
+ * Deterministic CBOR of [1, bstr] (§11 shared-objects-change, §13
+ * shared-objects-snapshot): the profile plaintext of a Data Unit (one
+ * Automerge change) or a Snapshot (one Automerge full save). The bytes are
+ * framed as given; checking that they are a valid Automerge change or save
+ * is the Automerge binding (LFCP-031).
+ */
+export function frameProfilePayload(bytes) {
+    if (!(bytes instanceof Uint8Array))
+        throw new LfcpError("INVALID_LENGTH", "framing takes bytes");
+    const head = bstrHead(bytes.length);
+    const out = new Uint8Array(2 + head.length + bytes.length);
+    out.set([0x82, FRAMING_VERSION, ...head], 0);
+    out.set(bytes, 2 + head.length);
+    return out;
+}
+/**
+ * The inner bytes of a framed profile plaintext. §11: a receiver MUST
+ * reject plaintext that is not valid CBOR, not a two-element array, or
+ * uses an unsupported framing version; this also requires the
+ * deterministic encoding and no trailing bytes. Throws PROFILE_INVALID /
+ * INVALID_AUTOMERGE_BYTES (§74.1).
+ */
+export function unframeProfilePayload(framed) {
+    const fail = (why) => {
+        throw new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", `invalid profile framing: ${why}`);
+    };
+    if (!(framed instanceof Uint8Array) || framed.length < 3)
+        return fail("too short");
+    if (framed[0] !== 0x82)
+        return fail("not a two-element array");
+    if (framed[1] !== FRAMING_VERSION)
+        return fail("unsupported framing version");
+    const first = framed[2];
+    if (first >> 5 !== 2)
+        return fail("the second element is not a byte string");
+    const info = first & 0x1f;
+    let length;
+    let offset;
+    const at = (i) => framed[i];
+    if (info < 24)
+        [length, offset] = [info, 3];
+    else if (info === 24)
+        [length, offset] = [at(3), 4];
+    else if (info === 25)
+        [length, offset] = [(at(3) << 8) | at(4), 5];
+    else if (info === 26)
+        [length, offset] = [((at(3) << 24) >>> 0) + (at(4) << 16) + (at(5) << 8) + at(6), 7];
+    else
+        return fail("unsupported byte string length");
+    if (offset > framed.length)
+        return fail("truncated");
+    const bytes = framed.subarray(offset);
+    if (bytes.length !== length)
+        return fail(bytes.length < length ? "truncated" : "trailing bytes");
+    const canonical = bstrHead(length);
+    if (canonical.length !== offset - 2)
+        return fail("non-shortest byte string length");
+    return Uint8Array.from(bytes);
+}
+//# sourceMappingURL=framing.js.map

package/dist/admission/index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The admission of SHARED-OBJECTS-PROFILE-01 §§7–18 that every profile
+ * inheriting them shares (SHARED-SECTIONS-PROFILE-01 §2; LFCP-02-085),
+ * checked before the Automerge engine sees a change or a Snapshot:
+ *
+ * - framing (§11, §13): [1, change] and [1, full save], one uncompressed
+ *   change chunk with a verified checksum;
+ * - limits (§11.1, §11.2, §13.1): the exact change expansion limits, the
+ *   document depth bound, the Snapshot limits with their floor;
+ * - the canonical change encoding (§11.3), by the format's properties;
+ * - operation references (§11.4) against the change's causal history;
+ * - actor binding (§8), with the profile's domain;
+ * - sequence admission (§14.1): duplicates, dependencies, the sequence
+ *   check, and holding a change whose actor and sequence another change
+ *   has (POST-001).
+ *
+ * It knows no profile semantics: a profile's own rules (its values, §74.1)
+ * run after it, on admitted changes only. `@openlfcp/shared-objects/admission`.
+ */
+export { checkChangeActor, deriveDomainActorId } from "./actor.js";
+export { checkCanonicalChange, type ParsedChange, type ParsedOp } from "./canonical.js";
+export { type CheckedChange, checkChange, checkSaveHeader, FRAMING_VERSION, frameChange, frameProfilePayload, frameSnapshot, parsedOf, refusedChangeHash, unframeChange, unframeProfilePayload, unframeSnapshot, } from "./framing.js";
+export { CHANGE_LIMITS, type ChunkExpansion, checkChangeExpansion, checkSnapshotExpansion, MAX_DOCUMENT_DEPTH, SNAPSHOT_LIMITS_FLOOR, type SnapshotLimits, } from "./limits.js";
+export { ReferenceHistory, type ReferenceRule } from "./references.js";
+export { admitBatch, admitChange, type BatchAdmission, type ChangeAdmission, type DocumentSequences, type RefusedChange, } from "./sequence.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/admission/index.js

@@ -0,0 +1,26 @@
+/**
+ * The admission of SHARED-OBJECTS-PROFILE-01 §§7–18 that every profile
+ * inheriting them shares (SHARED-SECTIONS-PROFILE-01 §2; LFCP-02-085),
+ * checked before the Automerge engine sees a change or a Snapshot:
+ *
+ * - framing (§11, §13): [1, change] and [1, full save], one uncompressed
+ *   change chunk with a verified checksum;
+ * - limits (§11.1, §11.2, §13.1): the exact change expansion limits, the
+ *   document depth bound, the Snapshot limits with their floor;
+ * - the canonical change encoding (§11.3), by the format's properties;
+ * - operation references (§11.4) against the change's causal history;
+ * - actor binding (§8), with the profile's domain;
+ * - sequence admission (§14.1): duplicates, dependencies, the sequence
+ *   check, and holding a change whose actor and sequence another change
+ *   has (POST-001).
+ *
+ * It knows no profile semantics: a profile's own rules (its values, §74.1)
+ * run after it, on admitted changes only. `@openlfcp/shared-objects/admission`.
+ */
+export { checkChangeActor, deriveDomainActorId } from "./actor.js";
+export { checkCanonicalChange } from "./canonical.js";
+export { checkChange, checkSaveHeader, FRAMING_VERSION, frameChange, frameProfilePayload, frameSnapshot, parsedOf, refusedChangeHash, unframeChange, unframeProfilePayload, unframeSnapshot, } from "./framing.js";
+export { CHANGE_LIMITS, checkChangeExpansion, checkSnapshotExpansion, MAX_DOCUMENT_DEPTH, SNAPSHOT_LIMITS_FLOOR, } from "./limits.js";
+export { ReferenceHistory } from "./references.js";
+export { admitBatch, admitChange, } from "./sequence.js";
+//# sourceMappingURL=index.js.map

package/dist/{chunk-limits.d.ts → admission/limits.d.ts}

@@ -1,3 +1,4 @@
+import { ProfileInvalidError } from "../profile-invalid.js";
 /** The exact limits of a change (§11.1): writers stay within them, receivers reject above. */
 export declare const CHANGE_LIMITS: Readonly<{
     maxRows: 16384;
@@ -42,6 +43,15 @@ export interface ChunkExpansion {
     /** A Snapshot's deepest object (§11.2); 0 for a change (its depths depend on the document). */
     readonly maxDepth: number;
 }
+/**
+ * A chunk refused because it cannot be read as one: no magic bytes, a
+ * length that does not cover it exactly, a truncated number or field. A
+ * chunk refused for anything else (a limit, a deflated or duplicate column,
+ * an out-of-range value) was read in full and still names its change hash.
+ */
+export declare class MalformedChunkError extends ProfileInvalidError {
+    constructor(why: string);
+}
 /**
  * §11.1: checks an uncompressed change chunk (type 1) against the exact
  * change limits before the engine sees it. Throws PROFILE_INVALID /
@@ -55,4 +65,4 @@ export declare function checkChangeExpansion(bytes: Uint8Array): ChunkExpansion;
  * INVALID_AUTOMERGE_BYTES.
  */
 export declare function checkSnapshotExpansion(bytes: Uint8Array, limits?: SnapshotLimits): ChunkExpansion;
-//# sourceMappingURL=chunk-limits.d.ts.map
+//# sourceMappingURL=limits.d.ts.map