@openlfcp/shared-objects 0.2.1 → 0.3.0

package/README.md

@@ -37,6 +37,69 @@ edits, the effective tree and the section admission rules are not there
 yet. It may change
 without notice until the profile is in a baseline.
 
+## Identity profile (MVP 0.4 Working Draft)
+
+`@openlfcp/shared-objects/identity` implements IDENTITY-PROFILE-01 §§2–4
+(`org.openlfcp.identity.v1`, `mvp-0.4-baseline.2`, LFCP-04-409 and 409b).
+`IdentityReplica` admits changes with AI0–AI5, validates every concurrent
+field value and exposes `roster()`, `devices()` and `requests()`. Invalid
+entries are omitted; an invalid root makes all three readers empty.
+Concurrent request maps remain invalid: readers never select a winning
+request. Device records here are display metadata and key hints, not authority.
+
+```ts
+import { IdentityReplica } from "@openlfcp/shared-objects/identity";
+
+const identity = IdentityReplica.empty({ resource, root });
+const initial = identity.write(
+  { signer: root, actorSeq: 1n, writerClass: "root" },
+  { intent: "identity.initialize" },
+);
+```
+
+Persist and send `initial.bytes` in the root's Data Unit at actor sequence 1;
+retry those exact bytes. Initialization creates only the six root keys,
+with empty roster/devices/requests/extensions. Write entries in later changes
+with `roster.put`, `device.put`, or `request.put`; matching `.delete` intents
+remove entries. Updates preserve unknown fields; omitted optional fields
+remain unchanged. Writers produce scalar strings and uints, including
+lossless bigint epochs in `missing_keys` (safe epochs read back as numbers).
+The writer permits `missing_keys` only on the signer's own device entry, and
+receivers refuse any other writer's `missing_keys` as `UNAUTHORIZED_WRITER`
+(§3 AI5, decision I8). AI2 and AI5 are decided on the objects of the causal
+history, values the engine does not select and maps since replaced or deleted
+included; AI2 looks only at the objects a write names as its predecessors.
+Reserved `recovery`/`succession` keys have no writer intent; readers preserve them.
+
+The receive boundary is `receiveChanges([{ bytes, signer, actorSeq, writerClass }])`,
+or `receive(plaintext, writer)` for SOP-framed bytes. All unit metadata must
+come from verified LFCP units. Derive `writerClass` from this Identity Resource's
+Control state **at the unit's `control_ref`**, never its latest head. Wire
+authorization, decryption, equivocation and epoch cutoffs remain the caller's
+responsibility. The actor domain is inherited unchanged from SOP §8.
+Waiting dependencies and held actor sequences are retained; `rebuildWithout`
+takes excluded change hashes and replays remaining units, removing dependants.
+
+`fromSave(save, options, verifiedUnits)` and `fromSnapshot` verify the initial
+change against the root's actual unit 1 before exposing state. They replay all
+snapshot changes with their verified carrying units, which also verifies AI4
+ownership and historical writer classes. Missing proof refuses the snapshot;
+fetch/decrypt units and retry, including when an earlier epoch is KEY_BLOCKED.
+`identityCodec` and `identitySnapshotCodec` provide the shared SOP framing.
+
+Diagnostics are `PROFILE_INVALID` with a profile diagnostic and JSON Pointer
+for state errors. Conflicted requests/kind report the first invalid value's
+diagnostic in table order; `INVALID_FIELD_TYPE` is the fallback when every
+concurrent value is valid on its own (§4 rule 2). Unknown request fields also
+invalidate the entry when conflicted. Tests use §12 ID-05 names and synthetic
+canonical changes, including the diagnostic cases beyond the corpus;
+`conformance/identity/profile.test.ts` runs IDENTITY-PROFILE-TEST-VECTORS-01.
+Admission retains causal, object and sequence indexes across calls. It applies
+new changes without cloning history and replays the trusted byte log only to
+recover from an engine error; local writes validate one candidate on a fork.
+Client DataProfileHandler wiring, durable journals, and pairing flows belong
+to LFCP-04-410.
+
 ## Automerge and WebAssembly
 
 The package depends on `@automerge/automerge` **3.5.0**, pinned exactly,

package/dist/admission/canonical.d.ts

@@ -19,12 +19,18 @@ export interface ParsedOp {
     readonly pred: readonly string[];
     /** The value's type, the low 4 bits of its metadata (8: a counter). */
     readonly valueType: number;
+    /** Lossless scalar value (Automerge JS decodeChange cannot decode integers above 2^53). */
+    readonly value: unknown;
+    readonly expand: boolean;
+    readonly name: string | null;
 }
 /** A change read from its bytes (§11.3), without the engine. */
 export interface ParsedChange {
     readonly actor: string;
     readonly seq: number;
     readonly startOp: number;
+    readonly time: number;
+    readonly message: string;
     /** Hex dependency hashes, ascending. */
     readonly deps: readonly string[];
     /** Hex other actors, ascending: actor index i is otherActors[i - 1]. */

package/dist/admission/canonical.js

@@ -329,25 +329,25 @@ function checkValue(type, bytes) {
     if (type <= 2) {
         if (bytes.length !== 0)
             refuse("a null or boolean value has bytes");
-        return;
+        return type === 0 ? null : type === 2;
     }
     if (type === 3 || type === 4 || type === 8 || type === 9) {
         const r = new Reader(bytes);
-        if (type === 3)
-            r.ubig();
-        else
-            r.sbig();
+        const value = type === 3 ? r.ubig() : r.sbig();
         if (!r.done || bytes.length === 0)
             refuse("a number value is not exactly one shortest LEB128");
-        return;
+        return value >= BigInt(Number.MIN_SAFE_INTEGER) && value <= BigInt(Number.MAX_SAFE_INTEGER)
+            ? Number(value)
+            : value;
     }
     if (type === 5) {
         if (bytes.length !== 8)
             refuse("a float value is not 8 bytes");
-        return;
+        return new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getFloat64(0, true);
     }
     if (type === 6)
-        utf8(bytes, "a string value");
+        return utf8(bytes, "a string value");
+    return bytes.slice();
 }
 /**
  * §14.1: whether the extra bytes after a change's columns begin with an
@@ -403,8 +403,10 @@ export function checkCanonicalChange(bytes) {
     const startOp = r.ubig();
     if (seq < 1n || startOp < 1n)
         refuse("the sequence number or the start op is 0");
-    r.sbig(); // time
-    utf8(r.take(r.unum()), "the message");
+    const time = r.sbig();
+    if (seq >= 1n << 53n || time <= -(1n << 53n) || time >= 1n << 53n)
+        refuse("the sequence number or time is outside the exact JavaScript integer range");
+    const message = utf8(r.take(r.unum()), "the message");
     const otherCount = r.unum();
     const others = [];
     for (let i = 0; i < otherCount; i++)
@@ -507,6 +509,7 @@ export function checkCanonicalChange(bytes) {
     const raw = data.get(VAL_RAW) ?? new Uint8Array(0);
     let rawAt = 0;
     const valueTypes = [];
+    const values = [];
     for (let i = 0; i < N; i++) {
         const m = meta?.[i] ?? null;
         if (m === null)
@@ -516,7 +519,7 @@ export function checkCanonicalChange(bytes) {
         const len = mv >> 4n;
         if (len > BigInt(raw.length - rawAt))
             refuse("the value bytes are shorter than their metadata");
-        checkValue(type, raw.subarray(rawAt, rawAt + Number(len)));
+        values.push(checkValue(type, raw.subarray(rawAt, rawAt + Number(len))));
         rawAt += Number(len);
         valueTypes.push(type);
     }
@@ -614,6 +617,9 @@ export function checkCanonicalChange(bytes) {
             action: act,
             pred: Object.freeze(pred),
             valueType: valueTypes[i],
+            value: values[i],
+            expand: exp,
+            name: mark === null ? null : String(mark),
         }));
     }
     // Rule 3: each column present exactly when the table says.
@@ -644,6 +650,8 @@ export function checkCanonicalChange(bytes) {
         actor: hex(actor),
         seq: Number(seq),
         startOp: start,
+        time: Number(time),
+        message,
         deps: Object.freeze(deps.map(hex)),
         otherActors: Object.freeze(others.map(hex)),
         ops: Object.freeze(ops),

package/dist/admission/framing.js

@@ -52,7 +52,47 @@ export function checkChange(bytes) {
         decoded = A.decodeChange(bytes);
     }
     catch (e) {
-        return reject(`invalid Automerge change bytes (§11): ${e.message}`);
+        // Canonical uint64 values are legal (SOP §11.3 rule 6), but the JS
+        // engine's JSON decoder refuses integers it cannot represent as number.
+        // The canonical parser has already checked and decoded them losslessly.
+        if (!(e instanceof RangeError) ||
+            !/^Error: -?\d+ can't be represented as a JavaScript number$/.test(e.message) ||
+            !parsed.ops.some((op) => typeof op.value === "bigint"))
+            return reject(`invalid Automerge change bytes (§11): ${e.message}`);
+        const hash = refusedChangeHash(bytes);
+        if (hash === undefined)
+            return reject("the Automerge change checksum does not match its hash (§11)");
+        const actions = ["makeMap", "set", "makeList", "del", "makeText", "inc", "makeTable", "mark"];
+        const types = {
+            3: "uint",
+            4: "int",
+            5: "float64",
+            8: "counter",
+            9: "timestamp",
+        };
+        decoded = {
+            actor: parsed.actor,
+            seq: parsed.seq,
+            startOp: parsed.startOp,
+            time: parsed.time,
+            message: parsed.message,
+            author: null,
+            hash,
+            deps: [...parsed.deps],
+            ops: parsed.ops.map((op) => ({
+                action: actions[op.action],
+                obj: op.obj,
+                pred: [...op.pred],
+                ...(op.key.kind === "prop"
+                    ? { key: op.key.name }
+                    : { elemId: op.key.kind === "head" ? "_head" : op.key.id }),
+                ...(op.insert ? { insert: true } : {}),
+                ...([1, 5, 7].includes(op.action) ? { value: op.value } : {}),
+                ...(types[op.valueType] === undefined ? {} : { datatype: types[op.valueType] }),
+                ...(op.name === null ? {} : { name: op.name }),
+                ...(op.expand ? { expand: true } : {}),
+            })),
+        };
     }
     if (toHex(bytes.subarray(4, 8)) !== decoded.hash.slice(0, 8))
         reject("the Automerge change checksum does not match its hash (§11)");
@@ -127,7 +167,14 @@ export function parsedOf(change) {
 const DECODED = new WeakMap();
 /** The decoded change, reusing the decode of checkChange when there was one. */
 export function decodedOf(change) {
-    return DECODED.get(change) ?? A.decodeChange(change.bytes);
+    const decoded = DECODED.get(change);
+    if (decoded !== undefined)
+        return decoded;
+    // CheckedChange is structural: callers can pass a copy without the cached decode.
+    const checked = checkChange(change.bytes);
+    const result = DECODED.get(checked);
+    DECODED.set(change, result);
+    return result;
 }
 /**
  * Checks that `bytes` starts as an Automerge full save (a document chunk,

package/dist/admission/references.js

@@ -14,6 +14,7 @@
 // its actor's changes and their counter ranges.
 import * as A from "@automerge/automerge";
 import { checkCanonicalChange } from "./canonical.js";
+import { refusedChangeHash } from "./framing.js";
 const MAKE = new Set([0, 2, 4, 6]);
 const MAP_LIKE = new Set([0, 6]);
 function slotOf(op, id) {
@@ -196,7 +197,9 @@ export function referenceHistoryOf(doc) {
     const parsed = new Map();
     for (const bytes of A.getAllChanges(doc)) {
         try {
-            parsed.set(A.decodeChange(bytes).hash, checkCanonicalChange(bytes));
+            const hash = refusedChangeHash(bytes);
+            if (hash !== undefined)
+                parsed.set(hash, checkCanonicalChange(bytes));
         }
         catch {
             // not readable: left out

package/dist/data-profile.d.ts

@@ -84,6 +84,11 @@ export interface SharedObjectsCodec {
     encode(change: CheckedChange): Uint8Array;
     decode(plaintext: Uint8Array): CheckedChange;
 }
+/** An object-changed listener that threw: the error, and the change it was given. */
+export interface SharedObjectsListenerFailure {
+    readonly error: unknown;
+    readonly change: ObjectChange;
+}
 export declare class SharedObjectsDataProfile {
     #private;
     readonly dataProfile = "org.openlfcp.shared-objects.v1";
@@ -103,8 +108,20 @@ export declare class SharedObjectsDataProfile {
     static restore(checkpoint: SharedObjectsCheckpoint, options: Pick<ReplicaOptions, "resource" | "principal">): SharedObjectsDataProfile;
     /** The current replica (a G-EP7 rebuild replaces it). */
     get replica(): SharedObjectsReplica;
-    /** §98, §100: object change notifications for remote merges and rebuilds. */
+    /**
+     * §98, §100: object change notifications for remote merges and rebuilds.
+     * A listener that changes the model again (re-entrantly) makes the
+     * nested event reach the listeners after it before the outer one does,
+     * as in 0.2.1.
+     */
     onObjectChanged(listener: (change: ObjectChange) => void): () => void;
+    /**
+     * Called when an object-changed listener throws (REVIEW-20261015-03),
+     * with the error and the change. Without a handler the error goes to the
+     * runtime's reportError where there is one (a browser, Electron), else it
+     * is dropped. A handler that throws is not reported again.
+     */
+    onListenerError(handler: (failure: SharedObjectsListenerFailure) => void): () => void;
     /**
      * Records which change one of this client's OWN units carries (the unit
      * was created from a local change, so it is merged already). A later

package/dist/data-profile.js

@@ -1,6 +1,7 @@
 import { LfcpError, toHex, } from "@openlfcp/core";
 import { checkChangeActor } from "./admission/actor.js";
 import { frameChange, frameSnapshot, unframeChange, unframeSnapshot, } from "./admission/framing.js";
+import { GuardedListeners } from "./listeners.js";
 import { SharedObjectsReplica } from "./replica.js";
 import { deriveActorId, PROFILE_ID } from "./values.js";
 export class SharedObjectsDataProfile {
@@ -12,7 +13,7 @@ export class SharedObjectsDataProfile {
     #pending = new Map();
     /** LFCP-accepted units whose actor and sequence number a different change has (§14.1), by unit ID hex. */
     #held = new Map();
-    #listeners = new Set();
+    #listeners = new GuardedListeners((error, change) => Object.freeze({ error, change }));
     constructor(replica) {
         this.#replica = replica;
     }
@@ -55,15 +56,34 @@ export class SharedObjectsDataProfile {
     get replica() {
         return this.#replica;
     }
-    /** §98, §100: object change notifications for remote merges and rebuilds. */
+    /**
+     * §98, §100: object change notifications for remote merges and rebuilds.
+     * A listener that changes the model again (re-entrantly) makes the
+     * nested event reach the listeners after it before the outer one does,
+     * as in 0.2.1.
+     */
     onObjectChanged(listener) {
-        this.#listeners.add(listener);
-        return () => this.#listeners.delete(listener);
+        return this.#listeners.add(listener);
     }
+    /**
+     * Called when an object-changed listener throws (REVIEW-20261015-03),
+     * with the error and the change. Without a handler the error goes to the
+     * runtime's reportError where there is one (a browser, Electron), else it
+     * is dropped. A handler that throws is not reported again.
+     */
+    onListenerError(handler) {
+        return this.#listeners.onError(handler);
+    }
+    /**
+     * Every listener gets every change, and a listener that throws never
+     * turns the operation that changed the model (a merge, a rebuild, a
+     * loaded Snapshot, a reset) into a failure: the change stands and the
+     * error is reported (onListenerError), never recursively. An engine trap
+     * is thrown on once every listener has had every change, as SyncClient
+     * does: the engine is dead.
+     */
     #emit(changes) {
-        for (const c of changes)
-            for (const l of this.#listeners)
-                l(c);
+        this.#listeners.emit(changes);
     }
     /**
      * Records which change one of this client's OWN units carries (the unit

package/dist/identity/admission.d.ts

@@ -0,0 +1,22 @@
+import * as A from "@automerge/automerge";
+import { LfcpError, type PrincipalId, type ResourceId } from "@openlfcp/core";
+import { type CheckedChange } from "../admission/framing.js";
+import { type IdentityWriter } from "./values.js";
+export declare const IDENTITY_ADMISSION_ORDER: readonly ["INVALID_AUTOMERGE_BYTES", "CHANGE_ACTOR_MISMATCH", "INVALID_ROOT", "CONTAINER_REPLACED", "IMMUTABLE_FIELD_MUTATED", "UNAUTHORIZED_WRITER", "INVALID_FIELD_TYPE"];
+export type IdentityAdmissionDiagnostic = (typeof IDENTITY_ADMISSION_ORDER)[number];
+export declare class IdentityAdmissionError extends LfcpError {
+    readonly diagnostic: IdentityAdmissionDiagnostic;
+    constructor(diagnostic: IdentityAdmissionDiagnostic, message: string);
+}
+export declare function refuseIdentity(diagnostic: IdentityAdmissionDiagnostic, message: string): never;
+/** Must run on every unit, even a duplicate change, BEFORE SOP §14.1 sequence holding. */
+export declare function checkIdentityUnit(change: CheckedChange, writer: IdentityWriter, resource: ResourceId, root: PrincipalId): void;
+/** Operations are inspected before applying them. Object provenance includes overwritten maps. */
+export declare class IdentityAdmission {
+    #private;
+    readonly root: PrincipalId;
+    constructor(doc: A.Doc<unknown>, root: PrincipalId);
+    get document(): A.Doc<unknown>;
+    accept(change: CheckedChange, writer: IdentityWriter): void;
+}
+//# sourceMappingURL=admission.d.ts.map

package/dist/identity/admission.js

@@ -0,0 +1,280 @@
+import * as A from "@automerge/automerge";
+import { actorSequence, bytesEqual, LfcpError, toHex, UINT64_MAX, } from "@openlfcp/core";
+import { checkChangeActor } from "../admission/actor.js";
+import { checkChange, decodedOf, parsedOf } from "../admission/framing.js";
+import { MAX_DOCUMENT_DEPTH } from "../admission/limits.js";
+import { ReferenceHistory } from "../admission/references.js";
+import { isWasmTrap } from "../replica.js";
+import { principalRef } from "../values.js";
+import { distinct } from "./reader.js";
+import { deriveIdentityActorId, IDENTITY_PROFILE_ID } from "./values.js";
+export const IDENTITY_ADMISSION_ORDER = Object.freeze([
+    "INVALID_AUTOMERGE_BYTES",
+    "CHANGE_ACTOR_MISMATCH",
+    "INVALID_ROOT",
+    "CONTAINER_REPLACED",
+    "IMMUTABLE_FIELD_MUTATED",
+    "UNAUTHORIZED_WRITER",
+    "INVALID_FIELD_TYPE",
+]);
+export class IdentityAdmissionError extends LfcpError {
+    diagnostic;
+    constructor(diagnostic, message) {
+        super("PROFILE_INVALID", message);
+        this.diagnostic = diagnostic;
+        this.name = "IdentityAdmissionError";
+    }
+}
+export function refuseIdentity(diagnostic, message) {
+    throw new IdentityAdmissionError(diagnostic, message);
+}
+/** Must run on every unit, even a duplicate change, BEFORE SOP §14.1 sequence holding. */
+export function checkIdentityUnit(change, writer, resource, root) {
+    // A dependency-free seq 2 is R1, even if the root/sequence eligibility also fails.
+    if (change.deps.length === 0 && new ReferenceHistory().check(parsedOf(change)) !== null)
+        refuseIdentity("INVALID_AUTOMERGE_BYTES", "the initial change fails SOP §11.4");
+    checkChangeActor(change, toHex(deriveIdentityActorId(resource, writer.signer)));
+    if (change.deps.length === 0 &&
+        (change.actor !== toHex(deriveIdentityActorId(resource, root)) ||
+            change.seq !== 1 ||
+            !bytesEqual(writer.signer, root) ||
+            (writer.actorSeq !== 1 && writer.actorSeq !== 1n)))
+        refuseIdentity("INVALID_ROOT", "AI0: the initial change must be in the root's actor sequence 1 unit");
+    actorSequence(writer.actorSeq);
+    if ((writer.writerClass === "root") !== bytesEqual(writer.signer, root) ||
+        !["root", "personal", "pairing", "other"].includes(writer.writerClass))
+        refuseIdentity("UNAUTHORIZED_WRITER", "writer class disagrees with the verified Genesis owner");
+}
+const MAKE = new Map([
+    ["makeMap", "map"],
+    ["makeList", "list"],
+    ["makeText", "text"],
+    ["makeTable", "table"],
+]);
+const CONTAINERS = new Set(["roster", "devices", "requests", "extensions"]);
+const TABLES = new Set(["roster", "devices", "requests"]);
+const FIELDS = {
+    roster: new Set(["profile", "endpoints", "coordinator", "name", "archived"]),
+    devices: new Set(["label", "kind", "platform", "added_at", "revoked", "missing_keys"]),
+    requests: new Set([
+        "descriptor",
+        "pairing",
+        "label",
+        "kind",
+        "scope",
+        "platform",
+        "requested_at",
+    ]),
+};
+/** Operations are inspected before applying them. Object provenance includes overwritten maps. */
+export class IdentityAdmission {
+    root;
+    #doc;
+    #changes;
+    #requests;
+    #objects = new Map([["_root", { path: [], type: "map" }]]);
+    constructor(doc, root) {
+        this.root = root;
+        // One independent working document, reused for every accepted change.
+        this.#doc = A.clone(doc);
+        this.#changes = A.getAllChanges(doc);
+        for (const bytes of this.#changes)
+            this.#index(decodedOf(checkChange(bytes)));
+    }
+    get document() {
+        return this.#doc;
+    }
+    #index(change) {
+        for (const [i, op] of change.ops.entries()) {
+            const type = MAKE.get(op.action);
+            const parent = this.#objects.get(op.obj);
+            if (type === undefined || parent === undefined)
+                continue;
+            const id = `${change.startOp + i}@${change.actor}`;
+            const path = [...parent.path, op.key ?? -1];
+            if (path.length === 1 && path[0] === "requests")
+                this.#requests = id;
+            const requestMap = path[0] === "requests" && path.length === 2 ? id : parent.requestMap;
+            this.#objects.set(id, { path, type, ...(requestMap === undefined ? {} : { requestMap }) });
+        }
+    }
+    accept(change, writer) {
+        const decoded = decodedOf(change);
+        const ops = decoded.ops;
+        const initial = change.deps.length === 0;
+        const found = new Set();
+        const local = new Map();
+        const info = (id) => local.get(id) ?? this.#objects.get(id);
+        const backend = A.getBackend(this.#doc);
+        const all = (obj, key) => local.has(obj) ? [] : backend.getAll(obj, key, [...change.deps]);
+        const restricted = writer.writerClass === "pairing" || writer.writerClass === "other";
+        const own = principalRef(writer.signer);
+        const touched = new Set();
+        const createdRequests = new Set();
+        const pairings = new Map();
+        if (initial) {
+            const roots = ops.filter((op) => op.obj === "_root");
+            const identity = roots.find((op) => op.key === "identity" && op.action === "makeMap");
+            const identityIndex = identity === undefined ? -1 : ops.indexOf(identity);
+            const rootValue = ops.find((op) => op.obj === `${decoded.startOp + identityIndex}@${change.actor}`);
+            if (ops.length !== 7 ||
+                roots.length !== 6 ||
+                new Set(roots.map((op) => op.key)).size !== 6 ||
+                !roots.every((op) => op.key === "profile"
+                    ? op.action === "set" && op.value === IDENTITY_PROFILE_ID && op.datatype === undefined
+                    : op.key !== undefined &&
+                        ["identity", ...CONTAINERS].includes(op.key) &&
+                        op.action === "makeMap") ||
+                rootValue?.key !== "root" ||
+                rootValue.action !== "set" ||
+                rootValue.datatype !== undefined ||
+                rootValue.value !== principalRef(this.root))
+                found.add("INVALID_ROOT");
+        }
+        for (const [i, op] of ops.entries()) {
+            const id = `${decoded.startOp + i}@${change.actor}`;
+            const parent = info(op.obj);
+            if (parent === undefined)
+                refuseIdentity("INVALID_AUTOMERGE_BYTES", "unknown operation object");
+            const path = parent.path;
+            const top = String(path[0]);
+            const key = op.key;
+            const made = MAKE.get(op.action);
+            if (made !== undefined) {
+                if (path.length + 1 > MAX_DOCUMENT_DEPTH)
+                    refuseIdentity("INVALID_AUTOMERGE_BYTES", "the change exceeds SOP §11.2 depth");
+                const child = [...path, key ?? -1];
+                const requestMap = child[0] === "requests" && child.length === 2 ? id : parent.requestMap;
+                local.set(id, {
+                    path: child,
+                    type: made,
+                    ...(requestMap === undefined ? {} : { requestMap }),
+                });
+            }
+            if (op.action === "makeText")
+                found.add("INVALID_FIELD_TYPE");
+            if (!initial && op.obj === "_root") {
+                if (key !== undefined && CONTAINERS.has(key))
+                    found.add("CONTAINER_REPLACED");
+                if (key === "profile" || key === "identity")
+                    found.add("IMMUTABLE_FIELD_MUTATED");
+            }
+            if (!initial && top === "identity")
+                found.add("IMMUTABLE_FIELD_MUTATED");
+            // AI2 on the causal history: the objects a scalar replaces are those its
+            // operation names as predecessors (SOP §11.4 R6), made in the history or
+            // earlier in this change, selected by the engine or not. Two levels
+            // only, unlike AI5: an entry map, and a list or map held in a field of
+            // an entry map. Deeper values, and a list in place of an entry map, are
+            // §4's to judge.
+            if (TABLES.has(top) && key !== undefined && op.action === "set")
+                for (const pred of op.pred) {
+                    const type = info(pred)?.type;
+                    if ((path.length === 1 && type === "map") ||
+                        (path.length === 2 && parent.type === "map" && (type === "list" || type === "map")))
+                        found.add("CONTAINER_REPLACED");
+                }
+            // AI5: devices[k].missing_keys and everything under it, in every entry
+            // map of the history (hidden, replaced or deleted ones included), is
+            // written only by the Principal k names.
+            const hint = path[0] === "devices" &&
+                ((path.length === 2 && key === "missing_keys") ||
+                    (path.length >= 3 && path[2] === "missing_keys"));
+            if (hint && path[1] !== own)
+                found.add("UNAUTHORIZED_WRITER");
+            // AI3 checks structural value kinds, leaving scalar field semantics to §4.
+            const defined = (path.length === 1 && TABLES.has(top)) ||
+                (path.length === 2 && key !== undefined && FIELDS[top]?.has(key)) ||
+                (path.length >= 3 && ["endpoints", "scope", "missing_keys"].includes(String(path[2])));
+            if (defined && op.action !== "del") {
+                const scalar = op.action === "set" &&
+                    ((typeof op.value === "string" && op.datatype === undefined) ||
+                        typeof op.value === "boolean" ||
+                        (op.datatype === "uint" &&
+                            ((typeof op.value === "number" && Number.isSafeInteger(op.value) && op.value >= 0) ||
+                                (typeof op.value === "bigint" && op.value >= 0n && op.value <= UINT64_MAX))));
+                if (!scalar && made !== "map" && made !== "list")
+                    found.add("INVALID_FIELD_TYPE");
+                if (parent.type === "list" && !scalar)
+                    found.add("INVALID_FIELD_TYPE");
+            }
+            if (!restricted)
+                continue;
+            if (op.action === "del")
+                found.add("UNAUTHORIZED_WRITER");
+            if (top !== "requests" || path.length < 1) {
+                found.add("UNAUTHORIZED_WRITER");
+                continue;
+            }
+            const entryKey = path.length === 1 ? key : String(path[1]);
+            if (entryKey === undefined) {
+                found.add("UNAUTHORIZED_WRITER");
+                continue;
+            }
+            touched.add(entryKey);
+            const requestMap = path.length === 1 ? (op.action === "makeMap" ? id : undefined) : parent.requestMap;
+            const requests = path.length === 1 ? op.obj : this.#requests;
+            const history = requests === undefined ? [] : all(requests, entryKey);
+            if (path.length === 1) {
+                if (op.action !== "makeMap" || history.length !== 0 || createdRequests.has(entryKey))
+                    found.add("UNAUTHORIZED_WRITER");
+                createdRequests.add(entryKey);
+            }
+            else if (requestMap === undefined)
+                found.add("UNAUTHORIZED_WRITER");
+            else if (!local.has(requestMap)) {
+                const pairing = distinct(all(requestMap, "pairing"));
+                if (history.length !== 1 ||
+                    history[0]?.[0] !== "map" ||
+                    history[0][1] !== requestMap ||
+                    !requestMap.endsWith(`@${change.actor}`) ||
+                    pairing.length !== 1 ||
+                    pairing[0]?.[0] !== "str" ||
+                    pairing[0][1] !== own)
+                    found.add("UNAUTHORIZED_WRITER");
+            }
+            if (requestMap !== undefined && !pairings.has(requestMap))
+                pairings.set(requestMap, new Map(all(requestMap, "pairing").map((v) => [String(v[2]), v])));
+            if (path.length === 2 && key === "pairing" && requestMap !== undefined) {
+                const values = pairings.get(requestMap);
+                for (const pred of op.pred)
+                    values.delete(pred);
+                if (op.action !== "del")
+                    values.set(id, [
+                        made ?? op.datatype ?? (typeof op.value === "string" ? "str" : typeof op.value),
+                        op.value,
+                        id,
+                    ]);
+            }
+        }
+        if (restricted) {
+            if (touched.size !== 1)
+                found.add("UNAUTHORIZED_WRITER");
+            for (const values of pairings.values()) {
+                const final = distinct([...values.values()]);
+                if (final.length !== 1 || final[0]?.[0] !== "str" || final[0][1] !== own)
+                    found.add("UNAUTHORIZED_WRITER");
+            }
+        }
+        const diagnostic = IDENTITY_ADMISSION_ORDER.find((d) => found.has(d));
+        if (diagnostic !== undefined)
+            refuseIdentity(diagnostic, `IDENTITY-PROFILE-01 §3: ${diagnostic}`);
+        // Do not copy the accumulated history on every accepted change. The byte
+        // log and object index are committed only after apply succeeds; if the
+        // engine aborts, replay that trusted log into a fresh working document.
+        const actor = A.getActorId(this.#doc);
+        try {
+            [this.#doc] = A.applyChanges(this.#doc, [change.bytes]);
+        }
+        catch (e) {
+            if (isWasmTrap(e))
+                throw e;
+            A.free(this.#doc);
+            [this.#doc] = A.applyChanges(A.init({ actor }), this.#changes);
+            refuseIdentity("INVALID_AUTOMERGE_BYTES", `the engine refused the change: ${String(e)}`);
+        }
+        this.#changes.push(change.bytes);
+        this.#index(decoded);
+    }
+}
+//# sourceMappingURL=admission.js.map

package/dist/identity/index.d.ts

@@ -0,0 +1,6 @@
+/** IDENTITY-PROFILE-01 §§2–4. No authority is inferred from document metadata. */
+export { checkIdentityUnit, IDENTITY_ADMISSION_ORDER, IdentityAdmission, type IdentityAdmissionDiagnostic, IdentityAdmissionError, } from "./admission.js";
+export { type IdentityIntent, type IdentityOptions, type IdentityReceiveResult, type IdentityRefusal, IdentityReplica, type IdentityUnit, identityCodec, identitySnapshotCodec, } from "./replica.js";
+export { IDENTITY_DIAGNOSTIC_ORDER, type IdentityDiagnostic, type IdentityProblem, type IdentityValidation, validateIdentity, } from "./schema.js";
+export { type DeviceEntry, deriveIdentityActorId, IDENTITY_PROFILE_ID, type IdentityDocument, type IdentityEpoch, type IdentityWriter, type IdentityWriterClass, isResourceRef, type PairingRequest, type ResourceRef, type RosterEntry, } from "./values.js";
+//# sourceMappingURL=index.d.ts.map