@openlfcp/shared-objects 0.2.0-beta.1 → 0.2.0-beta.3

package/dist/admission/canonical.d.ts

@@ -30,6 +30,13 @@ export interface ParsedChange {
     /** Hex other actors, ascending: actor index i is otherActors[i - 1]. */
     readonly otherActors: readonly string[];
     readonly ops: readonly ParsedOp[];
+    /**
+     * §14.1: the extra bytes after the columns (which rule 4 leaves free) begin
+     * with an Automerge author — an unsigned LEB128 1, a length L, then at least
+     * L bytes. automerge 0.12 reads it and asserts the change's sequence number
+     * is 1, so a later change carrying one is refused (finding D5).
+     */
+    readonly beginsWithAuthor: boolean;
 }
 /**
  * §11.3: checks that `bytes` (one change chunk within the §11.1 limits) is

package/dist/admission/canonical.js

@@ -349,6 +349,36 @@ function checkValue(type, bytes) {
     if (type === 6)
         utf8(bytes, "a string value");
 }
+/**
+ * §14.1: whether the extra bytes after a change's columns begin with an
+ * Automerge author (finding D5). Rule 4 leaves these bytes free, but
+ * automerge 0.12 reads an author there — an unsigned LEB128 1, a length L,
+ * then L bytes — and asserts the change's sequence number is 1. The LEB128 is
+ * read as automerge reads it: up to ten bytes, under 2^64, in any encoding
+ * (not the shortest-form `Reader` the rest of the walk uses).
+ */
+function beginsWithAuthor(extra) {
+    let pos = 0;
+    const leb = () => {
+        let value = 0n;
+        let shift = 0n;
+        for (;;) {
+            if (pos >= extra.length)
+                return null;
+            const b = extra[pos++];
+            if (shift === 63n && b !== 0 && b !== 1)
+                return null;
+            value |= BigInt(b & 0x7f) << shift;
+            if ((b & 0x80) === 0)
+                return value;
+            shift += 7n;
+        }
+    };
+    if (leb() !== 1n)
+        return false;
+    const length = leb();
+    return length !== null && BigInt(extra.length - pos) >= length;
+}
 /**
  * §11.3: checks that `bytes` (one change chunk within the §11.1 limits) is
  * the canonical encoding of its change, and returns the change's operations
@@ -403,7 +433,9 @@ export function checkCanonicalChange(bytes) {
     const data = new Map();
     for (const m of metas)
         data.set(m.spec, r.take(m.length));
-    // What follows is the change's extra bytes.
+    // What follows is the change's extra bytes (§11.3 rule 4), free except that
+    // automerge reads an author from their start (§14.1, finding D5).
+    const authored = beginsWithAuthor(bytes.subarray(r.pos));
     const rle = (spec) => {
         const d = data.get(spec);
         return d === undefined ? undefined : column(spec, d);
@@ -615,6 +647,7 @@ export function checkCanonicalChange(bytes) {
         deps: Object.freeze(deps.map(hex)),
         otherActors: Object.freeze(others.map(hex)),
         ops: Object.freeze(ops),
+        beginsWithAuthor: authored,
     });
 }
 //# sourceMappingURL=canonical.js.map

package/dist/admission/framing.d.ts

@@ -12,6 +12,12 @@ export interface CheckedChange {
     readonly deps: readonly string[];
     /** Hex IDs of the other actors the change refers to (§11.1: each must be known to the document). */
     readonly otherActors: readonly string[];
+    /**
+     * §14.1: the change's extra bytes begin with an Automerge author, allowed
+     * only in an actor's first change (finding D5). See
+     * {@link ParsedChange.beginsWithAuthor}.
+     */
+    readonly beginsWithAuthor: boolean;
 }
 /**
  * Checks that `bytes` is exactly one valid Automerge change (§11, §12) and
@@ -23,15 +29,18 @@ export interface CheckedChange {
  */
 export declare function checkChange(bytes: Uint8Array): CheckedChange;
 /**
- * The change hash of bytes checkChange refused, read without decoding
- * them: the SHA-256 of the chunk from its type byte on (the Automerge
- * change hash). A change above a §11.1 limit is named this way, so a
- * receiver can report it without expanding it. Undefined when the bytes
- * are not one change chunk that could be read: no magic bytes, another
- * chunk type, a length that does not cover them exactly, or a header or
- * column cut short.
+ * The change hash of bytes checkChange refused, read without decoding them:
+ * the SHA-256 of the chunk from its type byte on (the Automerge change hash).
+ * §14.1 names a refused change by this hash whenever the bytes are one change
+ * chunk of type 1 whose length field covers them exactly and whose checksum
+ * matches — the inner header is never read, so a change above a §11.1 limit
+ * (named without being expanded) and one whose header holds a length running
+ * past its end (finding C3) are both named. Undefined when the bytes are not
+ * such a chunk: no magic bytes, another chunk type (a compressed chunk
+ * included), a length that does not cover them exactly, or a wrong checksum
+ * (whose name would be its intact copy's, finding C1).
  */
-export declare function refusedChangeHash(bytes: Uint8Array, error: unknown): string | undefined;
+export declare function refusedChangeHash(bytes: Uint8Array): string | undefined;
 /** The change as its canonical bytes give it (§11.3), reusing the walk of checkChange. */
 export declare function parsedOf(change: CheckedChange): ParsedChange;
 /** The decoded change, reusing the decode of checkChange when there was one. */

package/dist/admission/framing.js

@@ -3,7 +3,7 @@ import { LfcpError, toHex } from "@openlfcp/core";
 import { sha256 } from "@openlfcp/crypto";
 import { ProfileInvalidError } from "../profile-invalid.js";
 import { checkCanonicalChange } from "./canonical.js";
-import { checkChangeExpansion, MalformedChunkError } from "./limits.js";
+import { checkChangeExpansion } from "./limits.js";
 /**
  * Automerge byte checks of the SHARED-OBJECTS-PROFILE-01 payloads (LFCP-031):
  * a Data Unit plaintext carries exactly one Automerge change (§11, §12), a
@@ -63,23 +63,25 @@ export function checkChange(bytes) {
         seq: decoded.seq,
         deps: Object.freeze([...decoded.deps]),
         otherActors: expansion.otherActors,
+        beginsWithAuthor: parsed.beginsWithAuthor,
     });
     DECODED.set(checked, decoded);
     PARSED.set(checked, parsed);
     return checked;
 }
 /**
- * The change hash of bytes checkChange refused, read without decoding
- * them: the SHA-256 of the chunk from its type byte on (the Automerge
- * change hash). A change above a §11.1 limit is named this way, so a
- * receiver can report it without expanding it. Undefined when the bytes
- * are not one change chunk that could be read: no magic bytes, another
- * chunk type, a length that does not cover them exactly, or a header or
- * column cut short.
+ * The change hash of bytes checkChange refused, read without decoding them:
+ * the SHA-256 of the chunk from its type byte on (the Automerge change hash).
+ * §14.1 names a refused change by this hash whenever the bytes are one change
+ * chunk of type 1 whose length field covers them exactly and whose checksum
+ * matches — the inner header is never read, so a change above a §11.1 limit
+ * (named without being expanded) and one whose header holds a length running
+ * past its end (finding C3) are both named. Undefined when the bytes are not
+ * such a chunk: no magic bytes, another chunk type (a compressed chunk
+ * included), a length that does not cover them exactly, or a wrong checksum
+ * (whose name would be its intact copy's, finding C1).
  */
-export function refusedChangeHash(bytes, error) {
-    if (error instanceof MalformedChunkError)
-        return undefined;
+export function refusedChangeHash(bytes) {
     if (bytes.length < HEADER || MAGIC.some((b, i) => bytes[i] !== b))
         return undefined;
     if (bytes[8] !== CHUNK_CHANGE)
@@ -99,7 +101,16 @@ export function refusedChangeHash(bytes, error) {
     }
     if (pos + length !== bytes.length)
         return undefined;
-    return toHex(sha256(bytes.subarray(8)));
+    // §14.1 (baseline.7, finding C1): name the bytes only when their checksum
+    // matches. The name is the SHA-256 of the chunk from its type byte on, and
+    // the checksum (bytes 4 to 8) is the first four bytes of that same hash; a
+    // chunk with a wrong checksum would be named by its intact copy's hash, so
+    // it is left unnamed and the intact copy is checked as any change is.
+    const hash = sha256(bytes.subarray(8));
+    for (let i = 0; i < 4; i++)
+        if (bytes[4 + i] !== hash[i])
+            return undefined;
+    return toHex(hash);
 }
 /** The operations checkChange read from the bytes (§11.3), for the references of §11.4. */
 const PARSED = new WeakMap();

package/dist/admission/sequence.js

@@ -69,6 +69,14 @@ export function admitBatch(changes, doc, accept = () => undefined) {
             });
             continue;
         }
+        else if (c.beginsWithAuthor && c.seq !== 1) {
+            refused.push({
+                change: c,
+                error: new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", `the change's extra bytes begin with an author but its sequence number is ${c.seq}, not 1 (§14.1)`),
+                held: false,
+            });
+            continue;
+        }
         else {
             const references = referenceRefusal(c, doc);
             if (references !== null) {
@@ -124,6 +132,12 @@ export function admitChange(change, doc) {
             kind: "invalid",
             error: new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", `actor ${change.actor} sequence ${change.seq} skips sequence ${latest + 1} (§14.1)`),
         };
+    // §14.1: an author belongs only in an actor's first change (finding D5).
+    if (change.beginsWithAuthor && change.seq !== 1)
+        return {
+            kind: "invalid",
+            error: new ProfileInvalidError("INVALID_AUTOMERGE_BYTES", `the change's extra bytes begin with an author but its sequence number is ${change.seq}, not 1 (§14.1)`),
+        };
     // §11.4: checked only; the caller adds the change once the engine applied it.
     const references = referenceRefusal(change, doc);
     if (references !== null)

package/dist/sections/replica.js

@@ -292,7 +292,7 @@ export class SectionReplica {
             }
             catch (e) {
                 // Never decoded: a change refused by the checks is named from its bytes only.
-                refused.push(refusal(index, refusedChangeHash(unit.bytes, e), e, false));
+                refused.push(refusal(index, refusedChangeHash(unit.bytes), e, false));
                 return;
             }
             if (unit.signer !== undefined &&

package/dist/sections/tree.js

@@ -189,8 +189,9 @@ export function deriveTree(doc, validation = validateSection(doc)) {
  * the node or of an ancestor, from the change history. A change deletes
  * when the last lifecycle value it writes to an owner (a Task node's Task,
  * another node itself) is "deleted"; content is a node's creation, an
- * operation on its Text, or a Task's title or status. Two changes are
- * concurrent when neither is in the other's dependencies.
+ * operation on its Text, a Task's title or status, or a move of the node
+ * (a write to its `placement` register — node.move or node.resolve_placement,
+ * §8). Two changes are concurrent when neither is in the other's dependencies.
  */
 function retainedEdits(doc, hidden, parentOf, sectionId) {
     const root = doc;
@@ -201,8 +202,13 @@ function retainedEdits(doc, hidden, parentOf, sectionId) {
     const textOf = new Map();
     const ownerOf = new Map();
     const taskOf = new Map();
+    // The object ID of each node's own map, for a move written to its `placement`.
+    const nodeMapOf = new Map();
     for (const id of Object.keys(nodes)) {
         const n = nodes[id];
+        const nodeMap = A.getObjectId(n);
+        if (nodeMap !== null)
+            nodeMapOf.set(nodeMap, id);
         const text = A.getObjectId(n, "text");
         if (text !== null)
             textOf.set(text, id);
@@ -236,6 +242,12 @@ function retainedEdits(doc, hidden, parentOf, sectionId) {
             const task = taskOf.get(op.obj);
             if (task !== undefined && hidden.has(task) && (key === "title" || key === "status"))
                 touched.add(task);
+            // §8, §9: a move writes the node's `placement` register (node.move or
+            // node.resolve_placement). A creation also writes it and is already
+            // counted above; what this adds is a move of an existing node.
+            const moved = nodeMapOf.get(op.obj);
+            if (moved !== undefined && key === "placement" && hidden.has(moved))
+                touched.add(moved);
             const owner = ownerOf.get(op.obj);
             if (owner !== undefined && key === "lifecycle")
                 lastLifecycle.set(owner, value);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openlfcp/shared-objects",
-  "version": "0.2.0-beta.1",
+  "version": "0.2.0-beta.3",
   "description": "SHARED-OBJECTS-PROFILE-01 (org.openlfcp.shared-objects.v1) implementation.",
   "keywords": [
     "openlfcp",
@@ -53,8 +53,8 @@
   "dependencies": {
     "@automerge/automerge": "3.5.0",
     "fflate": "0.8.3",
-    "@openlfcp/core": "^0.2.0-beta.1",
-    "@openlfcp/crypto": "^0.2.0-beta.1"
+    "@openlfcp/core": "^0.2.0-beta.3",
+    "@openlfcp/crypto": "^0.2.0-beta.3"
   },
   "devDependencies": {
     "fast-check": "4.10.2"