@openlfcp/shared-objects 0.2.0-beta.1 → 0.2.0-beta.2

package/dist/admission/canonical.d.ts

@@ -30,6 +30,13 @@ export interface ParsedChange {
     /** Hex other actors, ascending: actor index i is otherActors[i - 1]. */
     readonly otherActors: readonly string[];
     readonly ops: readonly ParsedOp[];
+    /**
+     * §14.1: the extra bytes after the columns (which rule 4 leaves free) begin
+     * with an Automerge author — an unsigned LEB128 1, a length L, then at least
+     * L bytes. automerge 0.12 reads it and asserts the change's sequence number
+     * is 1, so a later change carrying one is refused (finding D5).
+     */
+    readonly beginsWithAuthor: boolean;
 }
 /**
  * §11.3: checks that `bytes` (one change chunk within the §11.1 limits) is

package/dist/admission/canonical.js

@@ -349,6 +349,36 @@ function checkValue(type, bytes) {
     if (type === 6)
         utf8(bytes, "a string value");
 }
+/**
+ * §14.1: whether the extra bytes after a change's columns begin with an
+ * Automerge author (finding D5). Rule 4 leaves these bytes free, but
+ * automerge 0.12 reads an author there — an unsigned LEB128 1, a length L,
+ * then L bytes — and asserts the change's sequence number is 1. The LEB128 is
+ * read as automerge reads it: up to ten bytes, under 2^64, in any encoding
+ * (not the shortest-form `Reader` the rest of the walk uses).
+ */
+function beginsWithAuthor(extra) {
+    let pos = 0;
+    const leb = () => {
+        let value = 0n;
+        let shift = 0n;
+        for (;;) {
+            if (pos >= extra.length)
+                return null;
+            const b = extra[pos++];
+            if (shift === 63n && b !== 0 && b !== 1)
+                return null;
+            value |= BigInt(b & 0x7f) << shift;
+            if ((b & 0x80) === 0)
+                return value;
+            shift += 7n;
+        }
+    };
+    if (leb() !== 1n)
+        return false;
+    const length = leb();
+    return length !== null && BigInt(extra.length - pos) >= length;
+}
 /**
  * §11.3: checks that `bytes` (one change chunk within the §11.1 limits) is
  * the canonical encoding of its change, and returns the change's operations
@@ -403,7 +433,9 @@ export function checkCanonicalChange(bytes) {
     const data = new Map();
     for (const m of metas)
         data.set(m.spec, r.take(m.length));
-    // What follows is the change's extra bytes.
+    // What follows is the change's extra bytes (§11.3 rule 4), free except that
+    // automerge reads an author from their start (§14.1, finding D5).
+    const authored = beginsWithAuthor(bytes.subarray(r.pos));
     const rle = (spec) => {
         const d = data.get(spec);
         return d === undefined ? undefined : column(spec, d);
@@ -615,6 +647,7 @@ export function checkCanonicalChange(bytes) {
         deps: Object.freeze(deps.map(hex)),
         otherActors: Object.freeze(others.map(hex)),
         ops: Object.freeze(ops),
+        beginsWithAuthor: authored,
     });
 }
 //# sourceMappingURL=canonical.js.map

package/dist/admission/framing.d.ts

@@ -12,6 +12,12 @@ export interface CheckedChange {
     readonly deps: readonly string[];
     /** Hex IDs of the other actors the change refers to (§11.1: each must be known to the document). */
     readonly otherActors: readonly string[];
+    /**
+     * §14.1: the change's extra bytes begin with an Automerge author, allowed
+     * only in an actor's first change (finding D5). See
+     * {@link ParsedChange.beginsWithAuthor}.
+     */
+    readonly beginsWithAuthor: boolean;
 }
 /**
  * Checks that `bytes` is exactly one valid Automerge change (§11, §12) and

package/dist/admission/framing.js

@@ -63,6 +63,7 @@ export function checkChange(bytes) {
         seq: decoded.seq,
         deps: Object.freeze([...decoded.deps]),
         otherActors: expansion.otherActors,
+        beginsWithAuthor: parsed.beginsWithAuthor,
     });
     DECODED.set(checked, decoded);
     PARSED.set(checked, parsed);

package/dist/admission/sequence.js

@@ -69,6 +69,14 @@ export function admitBatch(changes, doc, accept = () => undefined) {
             });
             continue;
         }
+        else if (c.beginsWithAuthor && c.seq !== 1) {
+            refused.push({
+                change: c,
+                error: new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", `the change's extra bytes begin with an author but its sequence number is ${c.seq}, not 1 (§14.1)`),
+                held: false,
+            });
+            continue;
+        }
         else {
             const references = referenceRefusal(c, doc);
             if (references !== null) {
@@ -124,6 +132,12 @@ export function admitChange(change, doc) {
             kind: "invalid",
             error: new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", `actor ${change.actor} sequence ${change.seq} skips sequence ${latest + 1} (§14.1)`),
         };
+    // §14.1: an author belongs only in an actor's first change (finding D5).
+    if (change.beginsWithAuthor && change.seq !== 1)
+        return {
+            kind: "invalid",
+            error: new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", `the change's extra bytes begin with an author but its sequence number is ${change.seq}, not 1 (§14.1)`),
+        };
     // §11.4: checked only; the caller adds the change once the engine applied it.
     const references = referenceRefusal(change, doc);
     if (references !== null)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openlfcp/shared-objects",
-  "version": "0.2.0-beta.1",
+  "version": "0.2.0-beta.2",
   "description": "SHARED-OBJECTS-PROFILE-01 (org.openlfcp.shared-objects.v1) implementation.",
   "keywords": [
     "openlfcp",
@@ -53,8 +53,8 @@
   "dependencies": {
     "@automerge/automerge": "3.5.0",
     "fflate": "0.8.3",
-    "@openlfcp/core": "^0.2.0-beta.1",
-    "@openlfcp/crypto": "^0.2.0-beta.1"
+    "@openlfcp/core": "^0.2.0-beta.2",
+    "@openlfcp/crypto": "^0.2.0-beta.2"
   },
   "devDependencies": {
     "fast-check": "4.10.2"