@openlfcp/shared-objects 0.2.0-beta.2 → 0.2.0-beta.4

package/dist/admission/framing.d.ts

@@ -29,15 +29,18 @@ export interface CheckedChange {
  */
 export declare function checkChange(bytes: Uint8Array): CheckedChange;
 /**
- * The change hash of bytes checkChange refused, read without decoding
- * them: the SHA-256 of the chunk from its type byte on (the Automerge
- * change hash). A change above a §11.1 limit is named this way, so a
- * receiver can report it without expanding it. Undefined when the bytes
- * are not one change chunk that could be read: no magic bytes, another
- * chunk type, a length that does not cover them exactly, or a header or
- * column cut short.
+ * The change hash of bytes checkChange refused, read without decoding them:
+ * the SHA-256 of the chunk from its type byte on (the Automerge change hash).
+ * §14.1 names a refused change by this hash whenever the bytes are one change
+ * chunk of type 1 whose length field covers them exactly and whose checksum
+ * matches — the inner header is never read, so a change above a §11.1 limit
+ * (named without being expanded) and one whose header holds a length running
+ * past its end (finding C3) are both named. Undefined when the bytes are not
+ * such a chunk: no magic bytes, another chunk type (a compressed chunk
+ * included), a length that does not cover them exactly, or a wrong checksum
+ * (whose name would be its intact copy's, finding C1).
  */
-export declare function refusedChangeHash(bytes: Uint8Array, error: unknown): string | undefined;
+export declare function refusedChangeHash(bytes: Uint8Array): string | undefined;
 /** The change as its canonical bytes give it (§11.3), reusing the walk of checkChange. */
 export declare function parsedOf(change: CheckedChange): ParsedChange;
 /** The decoded change, reusing the decode of checkChange when there was one. */

package/dist/admission/framing.js

@@ -3,7 +3,7 @@ import { LfcpError, toHex } from "@openlfcp/core";
 import { sha256 } from "@openlfcp/crypto";
 import { ProfileInvalidError } from "../profile-invalid.js";
 import { checkCanonicalChange } from "./canonical.js";
-import { checkChangeExpansion, MalformedChunkError } from "./limits.js";
+import { checkChangeExpansion } from "./limits.js";
 /**
  * Automerge byte checks of the SHARED-OBJECTS-PROFILE-01 payloads (LFCP-031):
  * a Data Unit plaintext carries exactly one Automerge change (§11, §12), a
@@ -70,17 +70,18 @@ export function checkChange(bytes) {
     return checked;
 }
 /**
- * The change hash of bytes checkChange refused, read without decoding
- * them: the SHA-256 of the chunk from its type byte on (the Automerge
- * change hash). A change above a §11.1 limit is named this way, so a
- * receiver can report it without expanding it. Undefined when the bytes
- * are not one change chunk that could be read: no magic bytes, another
- * chunk type, a length that does not cover them exactly, or a header or
- * column cut short.
+ * The change hash of bytes checkChange refused, read without decoding them:
+ * the SHA-256 of the chunk from its type byte on (the Automerge change hash).
+ * §14.1 names a refused change by this hash whenever the bytes are one change
+ * chunk of type 1 whose length field covers them exactly and whose checksum
+ * matches — the inner header is never read, so a change above a §11.1 limit
+ * (named without being expanded) and one whose header holds a length running
+ * past its end (finding C3) are both named. Undefined when the bytes are not
+ * such a chunk: no magic bytes, another chunk type (a compressed chunk
+ * included), a length that does not cover them exactly, or a wrong checksum
+ * (whose name would be its intact copy's, finding C1).
  */
-export function refusedChangeHash(bytes, error) {
-    if (error instanceof MalformedChunkError)
-        return undefined;
+export function refusedChangeHash(bytes) {
     if (bytes.length < HEADER || MAGIC.some((b, i) => bytes[i] !== b))
         return undefined;
     if (bytes[8] !== CHUNK_CHANGE)
@@ -100,7 +101,16 @@ export function refusedChangeHash(bytes, error) {
     }
     if (pos + length !== bytes.length)
         return undefined;
-    return toHex(sha256(bytes.subarray(8)));
+    // §14.1 (baseline.7, finding C1): name the bytes only when their checksum
+    // matches. The name is the SHA-256 of the chunk from its type byte on, and
+    // the checksum (bytes 4 to 8) is the first four bytes of that same hash; a
+    // chunk with a wrong checksum would be named by its intact copy's hash, so
+    // it is left unnamed and the intact copy is checked as any change is.
+    const hash = sha256(bytes.subarray(8));
+    for (let i = 0; i < 4; i++)
+        if (bytes[4 + i] !== hash[i])
+            return undefined;
+    return toHex(hash);
 }
 /** The operations checkChange read from the bytes (§11.3), for the references of §11.4. */
 const PARSED = new WeakMap();

package/dist/sections/replica.js

@@ -292,7 +292,7 @@ export class SectionReplica {
             }
             catch (e) {
                 // Never decoded: a change refused by the checks is named from its bytes only.
-                refused.push(refusal(index, refusedChangeHash(unit.bytes, e), e, false));
+                refused.push(refusal(index, refusedChangeHash(unit.bytes), e, false));
                 return;
             }
             if (unit.signer !== undefined &&

package/dist/sections/tree.js

@@ -189,8 +189,13 @@ export function deriveTree(doc, validation = validateSection(doc)) {
  * the node or of an ancestor, from the change history. A change deletes
  * when the last lifecycle value it writes to an owner (a Task node's Task,
  * another node itself) is "deleted"; content is a node's creation, an
- * operation on its Text, or a Task's title or status. Two changes are
- * concurrent when neither is in the other's dependencies.
+ * operation on its Text, a Task's title or status, or a move of the node
+ * (a write to its `placement` register — node.move or node.resolve_placement,
+ * §8). Two changes are concurrent when neither is in the other's dependencies.
+ * Only a deletion the lifecycle register still holds counts: one a later write
+ * to the same register depends on is superseded (deleting the node again clears
+ * the attention a concurrent edit raised), while two concurrent deletions both
+ * count (baseline.9).
  */
 function retainedEdits(doc, hidden, parentOf, sectionId) {
     const root = doc;
@@ -201,8 +206,13 @@ function retainedEdits(doc, hidden, parentOf, sectionId) {
     const textOf = new Map();
     const ownerOf = new Map();
     const taskOf = new Map();
+    // The object ID of each node's own map, for a move written to its `placement`.
+    const nodeMapOf = new Map();
     for (const id of Object.keys(nodes)) {
         const n = nodes[id];
+        const nodeMap = A.getObjectId(n);
+        if (nodeMap !== null)
+            nodeMapOf.set(nodeMap, id);
         const text = A.getObjectId(n, "text");
         if (text !== null)
             textOf.set(text, id);
@@ -219,6 +229,8 @@ function retainedEdits(doc, hidden, parentOf, sectionId) {
     }
     const deps = new Map();
     const deletes = [];
+    // Every lifecycle write (any value), to tell whether a deletion is still held.
+    const lifecycleWrites = [];
     const edits = [];
     for (const bytes of A.getAllChanges(doc)) {
         const change = A.decodeChange(bytes);
@@ -236,13 +248,21 @@ function retainedEdits(doc, hidden, parentOf, sectionId) {
             const task = taskOf.get(op.obj);
             if (task !== undefined && hidden.has(task) && (key === "title" || key === "status"))
                 touched.add(task);
+            // §8, §9: a move writes the node's `placement` register (node.move or
+            // node.resolve_placement). A creation also writes it and is already
+            // counted above; what this adds is a move of an existing node.
+            const moved = nodeMapOf.get(op.obj);
+            if (moved !== undefined && key === "placement" && hidden.has(moved))
+                touched.add(moved);
             const owner = ownerOf.get(op.obj);
             if (owner !== undefined && key === "lifecycle")
                 lastLifecycle.set(owner, value);
         }
-        for (const [owner, value] of lastLifecycle)
+        for (const [owner, value] of lastLifecycle) {
+            lifecycleWrites.push({ hash: change.hash, node: owner });
             if (value === "deleted")
                 deletes.push({ hash: change.hash, node: owner });
+        }
         for (const node of touched)
             edits.push({ hash: change.hash, node });
     }
@@ -269,8 +289,15 @@ function retainedEdits(doc, hidden, parentOf, sectionId) {
         return out;
     };
     const concurrent = (a, b) => a !== b && !ancestorsOf(a).has(b) && !ancestorsOf(b).has(a);
+    // §9 (baseline.9): a deletion counts only while the lifecycle register still
+    // holds it. A later write to the same register — one that has the deletion in
+    // its dependencies — supersedes it, so deleting a node again clears the
+    // attention a concurrent edit raised. Two concurrent deletions supersede
+    // neither, so both still count (SS86); the writes come from each change's
+    // operations, which also keeps a deletion merged after a concurrent one.
+    const heldDeletes = deletes.filter((d) => !lifecycleWrites.some((w) => w.node === d.node && w.hash !== d.hash && ancestorsOf(w.hash).has(d.hash)));
     const deletesOf = new Map();
-    for (const d of deletes)
+    for (const d of heldDeletes)
         deletesOf.set(d.node, [...(deletesOf.get(d.node) ?? []), d.hash]);
     const attention = new Set();
     for (const edit of edits) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openlfcp/shared-objects",
-  "version": "0.2.0-beta.2",
+  "version": "0.2.0-beta.4",
   "description": "SHARED-OBJECTS-PROFILE-01 (org.openlfcp.shared-objects.v1) implementation.",
   "keywords": [
     "openlfcp",
@@ -53,8 +53,8 @@
   "dependencies": {
     "@automerge/automerge": "3.5.0",
     "fflate": "0.8.3",
-    "@openlfcp/core": "^0.2.0-beta.2",
-    "@openlfcp/crypto": "^0.2.0-beta.2"
+    "@openlfcp/core": "^0.2.0-beta.4",
+    "@openlfcp/crypto": "^0.2.0-beta.4"
   },
   "devDependencies": {
     "fast-check": "4.10.2"