@openlfcp/shared-objects 0.2.1 → 0.3.0

package/dist/identity/schema.js

@@ -0,0 +1,271 @@
+import { UINT64_MAX } from "@openlfcp/core";
+import { pointerToken } from "../validate.js";
+import { isPrincipalRef, isReverseDomain, isUtcTimestamp, principalRef } from "../values.js";
+import { IdentityReader } from "./reader.js";
+import { IDENTITY_PROFILE_ID, isIdentityDescriptor, isResourceRef, } from "./values.js";
+export const IDENTITY_DIAGNOSTIC_ORDER = Object.freeze([
+    "INVALID_ROOT",
+    "MISSING_REQUIRED_FIELD",
+    "INVALID_FIELD_TYPE",
+    "INVALID_RESOURCE_REF",
+    "INVALID_PRINCIPAL_REF",
+    "INVALID_DESCRIPTOR",
+    "INVALID_ENUM_VALUE",
+    "INVALID_TIMESTAMP",
+    "INVALID_EXTENSION_NAMESPACE",
+]);
+const at = (base, key) => `${base}/${pointerToken(String(key))}`;
+const uint = ([type, value]) => type === "uint" &&
+    ((typeof value === "number" && Number.isSafeInteger(value) && value >= 0) ||
+        (typeof value === "bigint" && value >= 0n && value <= UINT64_MAX));
+const epochOrder = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+const textOrder = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+class Fields {
+    reader;
+    problems = new Map();
+    conflicts = new Set();
+    constructor(reader) {
+        this.reader = reader;
+    }
+    fail(diagnostic, pointer) {
+        const previous = this.problems.get(pointer);
+        if (previous !== undefined &&
+            IDENTITY_DIAGNOSTIC_ORDER.indexOf(previous.diagnostic) <=
+                IDENTITY_DIAGNOSTIC_ORDER.indexOf(diagnostic))
+            return;
+        this.problems.set(pointer, Object.freeze({
+            code: "PROFILE_INVALID",
+            diagnostic,
+            pointer,
+            message: `IDENTITY-PROFILE-01 §4: ${diagnostic} at ${pointer || "/"}`,
+        }));
+    }
+    field(obj, key, base, required, request) {
+        const values = this.reader.all(obj, key);
+        if (required && values.length === 0)
+            this.fail("MISSING_REQUIRED_FIELD", at(base, key));
+        if (request && values.length > 1)
+            this.conflicts.add(at(base, key));
+        return values;
+    }
+    finishEntry(base) {
+        const belongs = (p) => p === base || p.startsWith(`${base}/`);
+        // §4 rule 2: report invalid values first. A conflict is INVALID_FIELD_TYPE
+        // only when every concurrent value is valid on its own (including maps).
+        if ([...this.problems.keys()].some(belongs))
+            return;
+        for (const pointer of this.conflicts)
+            if (belongs(pointer))
+                this.fail("INVALID_FIELD_TYPE", pointer);
+    }
+    scalar(values, type, pointer, validate, diagnostic = "INVALID_FIELD_TYPE") {
+        for (const value of values) {
+            if (value[0] !== type)
+                this.fail("INVALID_FIELD_TYPE", pointer);
+            else if (validate !== undefined && !validate(value[1]))
+                this.fail(diagnostic, pointer);
+        }
+        return values[0]?.[1];
+    }
+    list(values, pointer, type, request, resource = false) {
+        const lists = [];
+        for (const [kind, id] of values) {
+            if (kind !== "list") {
+                this.fail("INVALID_FIELD_TYPE", pointer);
+                continue;
+            }
+            const result = [];
+            for (const [i, entries] of this.reader.list(String(id)).entries()) {
+                const pos = at(pointer, i);
+                if (request && entries.length > 1)
+                    this.conflicts.add(pos);
+                for (const entry of entries) {
+                    if (entry[0] !== type || (type === "uint" && !uint(entry)))
+                        this.fail("INVALID_FIELD_TYPE", pos);
+                    else if (resource && !isResourceRef(entry[1]))
+                        this.fail("INVALID_RESOURCE_REF", pos);
+                }
+                result.push(entries[0]?.[1]);
+            }
+            if (resource &&
+                (result.length === 0 || result.length > 64 || new Set(result).size !== result.length))
+                this.fail("INVALID_FIELD_TYPE", pointer);
+            lists.push(result);
+        }
+        return lists[0] ?? [];
+    }
+    entry(obj, key, table) {
+        const base = at(`/${table}`, key);
+        const request = table === "requests";
+        const roster = table === "roster";
+        const output = {};
+        if (roster ? !isResourceRef(key) : !isPrincipalRef(key))
+            this.fail(roster ? "INVALID_RESOURCE_REF" : "INVALID_PRINCIPAL_REF", base);
+        const required = roster
+            ? ["profile", "endpoints", "coordinator"]
+            : request
+                ? ["descriptor", "pairing", "label", "kind"]
+                : ["label", "kind"];
+        const strings = roster
+            ? ["profile", "coordinator", "name"]
+            : request
+                ? ["descriptor", "pairing", "label", "platform", "requested_at"]
+                : ["label", "platform", "added_at"];
+        const field = (name) => this.field(obj, name, base, required.includes(name), request);
+        for (const name of strings) {
+            const values = field(name);
+            if (values.length === 0)
+                continue;
+            const pointer = at(base, name);
+            output[name] = this.scalar(values, "str", pointer);
+            for (const [type, value] of values) {
+                if (type !== "str")
+                    continue;
+                if (name === "pairing" && !isPrincipalRef(value))
+                    this.fail("INVALID_PRINCIPAL_REF", pointer);
+                if (name === "descriptor" && !isIdentityDescriptor(String(value), key))
+                    this.fail("INVALID_DESCRIPTOR", pointer);
+                if ((name === "added_at" || name === "requested_at") && !isUtcTimestamp(value))
+                    this.fail("INVALID_TIMESTAMP", pointer);
+            }
+        }
+        if (roster)
+            output.endpoints = this.list(field("endpoints"), at(base, "endpoints"), "str", false);
+        else {
+            const kinds = field("kind");
+            if (kinds.length > 1)
+                this.conflicts.add(at(base, "kind"));
+            output.kind = this.scalar(kinds, "uint", at(base, "kind"), (v) => v === 0 || v === 1, "INVALID_ENUM_VALUE");
+            if (request) {
+                const scope = this.field(obj, "scope", base, kinds.some((v) => v[1] === 1), true);
+                if (scope.length > 0) {
+                    if (kinds.some((v) => v[1] === 0))
+                        this.fail("INVALID_FIELD_TYPE", at(base, "scope"));
+                    output.scope = this.list(scope, at(base, "scope"), "str", true, true);
+                }
+            }
+        }
+        const bool = roster ? "archived" : "revoked";
+        if (!request) {
+            const values = field(bool);
+            if (values.length > 0)
+                output[bool] = this.scalar(values, "boolean", at(base, bool));
+        }
+        if (table === "devices") {
+            const values = field("missing_keys");
+            const union = new Map();
+            for (const [type, id] of values) {
+                if (type !== "map") {
+                    this.fail("INVALID_FIELD_TYPE", at(base, "missing_keys"));
+                    continue;
+                }
+                for (const resource of this.reader.keys(String(id))) {
+                    const pointer = at(at(base, "missing_keys"), resource);
+                    if (!isResourceRef(resource))
+                        this.fail("INVALID_RESOURCE_REF", pointer);
+                    const epochs = union.get(resource) ?? new Set();
+                    for (const list of this.reader.all(String(id), resource)) {
+                        this.list([list], pointer, "uint", false);
+                        if (list[0] === "list")
+                            for (const items of this.reader.list(String(list[1])))
+                                for (const item of items)
+                                    if (uint(item))
+                                        epochs.add(item[1]);
+                    }
+                    union.set(resource, epochs);
+                }
+            }
+            if (values.length > 0)
+                output.missing_keys = Object.freeze(Object.fromEntries([...union]
+                    .sort(([a], [b]) => textOrder(a, b))
+                    .map(([k, v]) => [k, Object.freeze([...v].sort(epochOrder))])));
+        }
+        // Unknown request fields are preserved/ignored too, but any conflict invalidates a request.
+        if (request)
+            for (const name of this.reader.keys(obj))
+                if (this.reader.all(obj, name).length > 1)
+                    this.conflicts.add(at(base, name));
+        for (const value of Object.values(output))
+            if (Array.isArray(value))
+                Object.freeze(value);
+        return Object.freeze(output);
+    }
+}
+/** §4: validate every concurrent value; return only usable entries, never request winners. */
+export function validateIdentity(doc, root) {
+    const r = new IdentityReader(doc);
+    const f = new Fields(r);
+    const profiles = r.all("_root", "profile");
+    if (profiles.length !== 1 || profiles[0]?.[0] !== "str" || profiles[0][1] !== IDENTITY_PROFILE_ID)
+        f.fail("INVALID_ROOT", "/profile");
+    for (const key of ["identity", "roster", "devices", "requests", "extensions"])
+        if (r.map("_root", key) === undefined)
+            f.fail("INVALID_ROOT", at("", key));
+    const identity = r.map("_root", "identity");
+    if (identity !== undefined) {
+        const roots = r.all(identity, "root");
+        if (roots.length !== 1 || roots[0]?.[0] !== "str" || roots[0][1] !== principalRef(root))
+            f.fail("INVALID_ROOT", "/identity/root");
+    }
+    const usable = ![...f.problems.values()].some((p) => p.diagnostic === "INVALID_ROOT");
+    const extensions = r.map("_root", "extensions");
+    if (extensions !== undefined)
+        for (const key of r.keys(extensions))
+            if (!isReverseDomain(key))
+                f.fail("INVALID_EXTENSION_NAMESPACE", at("/extensions", key));
+    const tables = {};
+    for (const table of ["roster", "devices", "requests"]) {
+        const entries = [];
+        const container = r.map("_root", table);
+        if (container !== undefined)
+            for (const key of r.keys(container)) {
+                const base = at(`/${table}`, key);
+                const values = r.all(container, key);
+                if (table === "requests" && values.length > 1)
+                    f.conflicts.add(base);
+                const projections = [];
+                for (const [type, id] of values) {
+                    if (type !== "map")
+                        f.fail("INVALID_FIELD_TYPE", base);
+                    else
+                        projections.push(f.entry(String(id), key, table));
+                }
+                // Concurrent device maps also cannot disagree about kind; hints union across maps.
+                if (table === "devices" && new Set(projections.map((p) => p.kind)).size > 1)
+                    f.conflicts.add(at(base, "kind"));
+                f.finishEntry(base);
+                if (usable && ![...f.problems.keys()].some((p) => p === base || p.startsWith(`${base}/`))) {
+                    const first = projections[0];
+                    if (first !== undefined) {
+                        if (table === "devices" && projections.some((p) => p.missing_keys !== undefined)) {
+                            const union = new Map();
+                            for (const p of projections)
+                                for (const [ref, epochs] of Object.entries((p.missing_keys ?? {})))
+                                    union.set(ref, new Set([...(union.get(ref) ?? []), ...epochs]));
+                            entries.push([
+                                key,
+                                Object.freeze({
+                                    ...first,
+                                    missing_keys: Object.freeze(Object.fromEntries([...union]
+                                        .sort(([a], [b]) => textOrder(a, b))
+                                        .map(([k, v]) => [k, Object.freeze([...v].sort(epochOrder))]))),
+                                }),
+                            ]);
+                        }
+                        else
+                            entries.push([key, first]);
+                    }
+                }
+            }
+        tables[table] = Object.freeze(Object.fromEntries(entries));
+    }
+    return Object.freeze({
+        usable,
+        problems: Object.freeze([...f.problems.values()].sort((a, b) => IDENTITY_DIAGNOSTIC_ORDER.indexOf(a.diagnostic) -
+            IDENTITY_DIAGNOSTIC_ORDER.indexOf(b.diagnostic) || textOrder(a.pointer, b.pointer))),
+        roster: tables.roster,
+        devices: tables.devices,
+        requests: tables.requests,
+    });
+}
+//# sourceMappingURL=schema.js.map

package/dist/identity/values.d.ts

@@ -0,0 +1,56 @@
+import { type PrincipalId } from "@openlfcp/core";
+export declare const IDENTITY_PROFILE_ID = "org.openlfcp.identity.v1";
+export { deriveActorId as deriveIdentityActorId } from "../values.js";
+export type ResourceRef = string & {
+    readonly __resourceRef: true;
+};
+export declare function isResourceRef(value: unknown): value is ResourceRef;
+/** W §7 has exactly one deterministic encoding: a3, then 0/1/2 + bstr32. */
+export declare function isIdentityDescriptor(text: string, key: string): boolean;
+/** Supplied from the verified Identity Resource Control state at control_ref (§2.3). */
+export type IdentityWriterClass = "root" | "personal" | "pairing" | "other";
+export interface IdentityWriter {
+    readonly signer: PrincipalId;
+    /** The LFCP Data Unit actor sequence, not the Automerge sequence. */
+    readonly actorSeq: bigint | number;
+    readonly writerClass: IdentityWriterClass;
+}
+export interface RosterEntry {
+    readonly profile: string;
+    readonly endpoints: readonly string[];
+    readonly coordinator: string;
+    readonly name?: string;
+    readonly archived?: boolean;
+}
+export interface DeviceEntry {
+    readonly label: string;
+    readonly kind: 0 | 1;
+    readonly platform?: string;
+    readonly added_at?: string;
+    readonly revoked?: boolean;
+    /** Safe values are numbers; larger uint64 epochs are lossless bigints. */
+    readonly missing_keys?: Readonly<Record<string, readonly IdentityEpoch[]>>;
+}
+export type IdentityEpoch = bigint | number;
+export interface PairingRequest {
+    readonly descriptor: string;
+    readonly pairing: string;
+    readonly label: string;
+    readonly kind: 0 | 1;
+    readonly scope?: readonly string[];
+    readonly platform?: string;
+    readonly requested_at?: string;
+}
+/** Logical §2.1 document; the engine stores strings as ImmutableString, never Text. */
+export interface IdentityDocument {
+    readonly profile: typeof IDENTITY_PROFILE_ID;
+    readonly identity: {
+        readonly root: string;
+    };
+    readonly roster: Readonly<Record<string, RosterEntry>>;
+    readonly devices: Readonly<Record<string, DeviceEntry>>;
+    readonly requests: Readonly<Record<string, PairingRequest>>;
+    readonly extensions: Readonly<Record<string, unknown>>;
+    readonly [unknownKey: string]: unknown;
+}
+//# sourceMappingURL=values.d.ts.map

package/dist/identity/values.js

@@ -0,0 +1,41 @@
+import { bytesEqual, fromBase64url, toBase64url } from "@openlfcp/core";
+import { isValidEd25519PublicKey, sha256 } from "@openlfcp/crypto";
+export const IDENTITY_PROFILE_ID = "org.openlfcp.identity.v1";
+// IDENTITY-PROFILE-01 §2 inherits SOP §8 without changing its domain.
+export { deriveActorId as deriveIdentityActorId } from "../values.js";
+export function isResourceRef(value) {
+    if (typeof value !== "string" || value.length !== 43)
+        return false;
+    try {
+        return fromBase64url(value).length === 32;
+    }
+    catch {
+        return false;
+    }
+}
+/** W §7 has exactly one deterministic encoding: a3, then 0/1/2 + bstr32. */
+export function isIdentityDescriptor(text, key) {
+    try {
+        const bytes = fromBase64url(text);
+        if (bytes.length !== 106 || bytes[0] !== 0xa3)
+            return false;
+        for (let k = 0; k < 3; k++) {
+            const at = 1 + 35 * k;
+            if (bytes[at] !== k || bytes[at + 1] !== 0x58 || bytes[at + 2] !== 32)
+                return false;
+        }
+        const id = bytes.subarray(4, 36);
+        const ed = bytes.subarray(39, 71);
+        const x = bytes.subarray(74, 106);
+        const domain = Uint8Array.from("LFCP-PRINCIPAL-v1", (c) => c.charCodeAt(0));
+        const input = new Uint8Array(domain.length + 64);
+        input.set(domain);
+        input.set(ed, domain.length);
+        input.set(x, domain.length + 32);
+        return (key === `p:${toBase64url(id)}` && bytesEqual(id, sha256(input)) && isValidEd25519PublicKey(ed));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=values.js.map

package/dist/index.d.ts

@@ -6,7 +6,7 @@
 export declare const PACKAGE = "@openlfcp/shared-objects";
 export { type CheckedChange, checkChange, checkSaveHeader, frameChange, frameSnapshot, unframeChange, unframeSnapshot, } from "./admission/framing.js";
 export { CHANGE_LIMITS, type ChunkExpansion, checkChangeExpansion, checkSnapshotExpansion, MAX_DOCUMENT_DEPTH, SNAPSHOT_LIMITS_FLOOR, type SnapshotLimits, } from "./admission/limits.js";
-export { type SharedObjectsApplyResult, type SharedObjectsBatchResult, type SharedObjectsCheckpoint, type SharedObjectsCodec, SharedObjectsDataProfile, type SharedObjectsDiagnostic, type SharedObjectsExcludeResult, type SharedObjectsSnapshotCodec, type SharedObjectsUnit, } from "./data-profile.js";
+export { type SharedObjectsApplyResult, type SharedObjectsBatchResult, type SharedObjectsCheckpoint, type SharedObjectsCodec, SharedObjectsDataProfile, type SharedObjectsDiagnostic, type SharedObjectsExcludeResult, type SharedObjectsListenerFailure, type SharedObjectsSnapshotCodec, type SharedObjectsUnit, } from "./data-profile.js";
 export { applyBatchChecked, applyChecked, type BatchReceiveResult, type BuiltReplica, isWasmTrap, type LocalChange, type ObjectChange, ObjectIdCollisionError, type ObjectStatus, type ReceiveResult, type ReplicaIntent, type ReplicaOptions, type ReplicaValidation, type ResolveFieldConflict, resolveFieldConflict, SCALAR_FIELDS, type ScalarField, type ScalarView, SharedObjectsReplica, type TaskView, } from "./replica.js";
 export { addTag, assign, cancel, clearDue, clearScheduled, complete, createTask, deleteTask, type NewTask, type ParsedTask, ProfileError, parseTask, removeTag, reopen, restoreTask, setDue, setPriority, setScheduled, setStatus, setTitle, type Task, type TaskChange, type TaskIntent, type TaskPriority, type TaskStatus, taskToJson, unassign, } from "./task.js";
 export { DIAGNOSTIC_ORDER, firstPerField, isMap, type Json, objectProblems, type ProfileDiagnostic, ProfileInvalidError, type ProfileProblem, pointerToken, type RootValidation, validateRoot, validateTransition, } from "./validate.js";

package/dist/listeners.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Guarded change notifications for the Data Profile handlers
+ * (REVIEW-20261015-03): every listener gets each event, and a listener that
+ * throws never turns the operation that changed the model into a failure.
+ * Its error goes to the handlers registered with onError, or, without one,
+ * to the runtime's reportError where there is one (a browser, Electron);
+ * else it is dropped. A handler that throws, or a failure while one is
+ * being reported, is not reported again (no recursion). An engine trap is
+ * the exception: it is thrown on once every listener has had the event, as
+ * the client's SyncClient does, since the engine is dead.
+ */
+/**
+ * A thrown value that looks like an engine trap (WebAssembly RuntimeError, a
+ * terminated module): the rule of the client's isEngineTrap, which this
+ * package cannot import.
+ */
+export declare function isEngineTrap(e: unknown): boolean;
+/** Listeners of events `E`, and the handlers of their failures `F`. */
+export declare class GuardedListeners<E, F> {
+    #private;
+    /** `failure` builds what a handler receives from the error and the event. */
+    constructor(failure: (error: unknown, event: E) => F);
+    add(listener: (event: E) => void): () => void;
+    onError(handler: (failure: F) => void): () => void;
+    /** Delivers each event to every listener; see the module comment. */
+    emit(events: readonly E[]): void;
+}
+//# sourceMappingURL=listeners.d.ts.map

package/dist/listeners.js

@@ -0,0 +1,93 @@
+/**
+ * Guarded change notifications for the Data Profile handlers
+ * (REVIEW-20261015-03): every listener gets each event, and a listener that
+ * throws never turns the operation that changed the model into a failure.
+ * Its error goes to the handlers registered with onError, or, without one,
+ * to the runtime's reportError where there is one (a browser, Electron);
+ * else it is dropped. A handler that throws, or a failure while one is
+ * being reported, is not reported again (no recursion). An engine trap is
+ * the exception: it is thrown on once every listener has had the event, as
+ * the client's SyncClient does, since the engine is dead.
+ */
+/**
+ * A thrown value that looks like an engine trap (WebAssembly RuntimeError, a
+ * terminated module): the rule of the client's isEngineTrap, which this
+ * package cannot import.
+ */
+export function isEngineTrap(e) {
+    const wasm = globalThis
+        .WebAssembly?.RuntimeError;
+    if (wasm !== undefined && e instanceof wasm)
+        return true;
+    if (!(e instanceof Error))
+        return false;
+    return (e.name === "RuntimeError" ||
+        /\b(module|instance)\b.*\bterminated\b|\bunreachable\b executed|\bwasm trap\b/i.test(e.message));
+}
+/** Listeners of events `E`, and the handlers of their failures `F`. */
+export class GuardedListeners {
+    #listeners = new Set();
+    #errorHandlers = new Set();
+    #failure;
+    #reporting = false;
+    /** `failure` builds what a handler receives from the error and the event. */
+    constructor(failure) {
+        this.#failure = failure;
+    }
+    add(listener) {
+        this.#listeners.add(listener);
+        return () => this.#listeners.delete(listener);
+    }
+    onError(handler) {
+        this.#errorHandlers.add(handler);
+        return () => this.#errorHandlers.delete(handler);
+    }
+    /** Delivers each event to every listener; see the module comment. */
+    emit(events) {
+        let trap;
+        const failed = [];
+        for (const event of events)
+            for (const l of [...this.#listeners])
+                try {
+                    l(event);
+                }
+                catch (error) {
+                    if (isEngineTrap(error))
+                        trap ??= { error };
+                    else
+                        failed.push({ error, event });
+                }
+        for (const { error, event } of failed)
+            this.#report(error, event);
+        if (trap !== undefined)
+            throw trap.error;
+    }
+    #report(error, event) {
+        if (this.#reporting)
+            return;
+        this.#reporting = true;
+        try {
+            if (this.#errorHandlers.size === 0) {
+                const report = globalThis.reportError;
+                if (typeof report === "function")
+                    report(error);
+                return;
+            }
+            const failure = this.#failure(error, event);
+            for (const h of [...this.#errorHandlers])
+                try {
+                    h(failure);
+                }
+                catch {
+                    // A failing error handler is not reported again (no recursion).
+                }
+        }
+        catch {
+            // reportError itself failed: nothing left to report to.
+        }
+        finally {
+            this.#reporting = false;
+        }
+    }
+}
+//# sourceMappingURL=listeners.js.map

package/dist/replica.js

@@ -1,6 +1,6 @@
 import * as A from "@automerge/automerge";
 import { fromHex, LfcpError, toHex, } from "@openlfcp/core";
-import { checkChange, checkSaveHeader, parsedOf, unframeChange, unframeSnapshot, } from "./admission/framing.js";
+import { checkChange, checkSaveHeader, decodedOf, parsedOf, refusedChangeHash, unframeChange, unframeSnapshot, } from "./admission/framing.js";
 import { checkSnapshotExpansion, MAX_DOCUMENT_DEPTH, SNAPSHOT_LIMITS_FLOOR, } from "./admission/limits.js";
 import { referenceHistoryOf } from "./admission/references.js";
 import { admitBatch, admitChange } from "./admission/sequence.js";
@@ -540,7 +540,7 @@ export class SharedObjectsReplica {
         };
     }
     #createdDepths(change, prior) {
-        const decoded = A.decodeChange(change.bytes);
+        const decoded = decodedOf(change);
         const created = new Map();
         decoded.ops.forEach((op, i) => {
             if (!MAKE_ACTIONS.has(op.action))
@@ -577,7 +577,7 @@ export class SharedObjectsReplica {
             return path.length;
         }
         for (const bytes of A.getAllChanges(this.#doc)) {
-            const c = A.decodeChange(bytes);
+            const c = decodedOf(checkChange(bytes));
             c.ops.forEach((op, i) => {
                 if (!MAKE_ACTIONS.has(op.action))
                     return;
@@ -657,7 +657,7 @@ export class SharedObjectsReplica {
      */
     rebuildWithout(exclude) {
         const out = new Set(exclude);
-        const kept = A.getAllChanges(this.#doc).filter((c) => !out.has(A.decodeChange(c).hash));
+        const kept = A.getAllChanges(this.#doc).filter((c) => !out.has(checkChange(c).hash));
         return SharedObjectsReplica.fromChanges(kept, {
             resource: this.resource,
             principal: this.#principal,
@@ -835,8 +835,8 @@ export class SharedObjectsReplica {
         catch (e) {
             // §11.1: a writer never emits a change over the limits. The handle
             // this replica held is outdated by A.change: rebuild it without the change.
-            const hash = A.decodeChange(bytes).hash;
-            this.#doc = A.applyChanges(A.init({ actor: this.#actor }), A.getAllChanges(next).filter((c) => A.decodeChange(c).hash !== hash))[0];
+            const hash = refusedChangeHash(bytes);
+            this.#doc = A.applyChanges(A.init({ actor: this.#actor }), A.getAllChanges(next).filter((c) => refusedChangeHash(c) !== hash))[0];
             this.#refs = null;
             throw new LfcpError("CHANGE_TOO_LARGE", `the transaction "${message}" is larger than one change may be (§11.1: ${e.message}); split it into several (§12)`);
         }

package/dist/sections/data-profile.d.ts

@@ -105,14 +105,31 @@ export interface SectionsNodesChanged {
     readonly origin: "local" | "remote" | "rebuild";
     readonly modelRevision: string;
 }
+/** A nodes-changed listener that threw: the error, and the event it was given. */
+export interface SectionsListenerFailure {
+    readonly error: unknown;
+    readonly event: SectionsNodesChanged;
+}
 export declare class SharedSectionsDataProfile {
     #private;
     readonly dataProfile = "org.openlfcp.shared-sections.v1";
     constructor(replica: SectionReplica);
     /** The current replica (a rebuild replaces it). */
     get replica(): SectionReplica;
-    /** §5 nodes-changed for remote merges, rebuilds and recorded local changes. */
+    /**
+     * §5 nodes-changed for remote merges, rebuilds and recorded local changes.
+     * A listener that changes the model again (re-entrantly) makes the
+     * nested event reach the listeners after it before the outer one does,
+     * as in 0.2.1.
+     */
     onNodesChanged(listener: (event: SectionsNodesChanged) => void): () => void;
+    /**
+     * Called when a nodes-changed listener throws (REVIEW-20261015-03), with
+     * the error and the event. Without a handler the error goes to the
+     * runtime's reportError where there is one (a browser, Electron), else it
+     * is dropped. A handler that throws is not reported again.
+     */
+    onListenerError(handler: (failure: SectionsListenerFailure) => void): () => void;
     /** The codec of one unit, bound to its signer's section actor (§2). */
     codecFor(unit: {
         readonly resourceId: ResourceId;

package/dist/sections/data-profile.js

@@ -1,6 +1,7 @@
 import { LfcpError, toHex, } from "@openlfcp/core";
 import { checkChangeActor } from "../admission/actor.js";
 import { checkChange, frameChange, frameSnapshot, unframeChange, unframeSnapshot, } from "../admission/framing.js";
+import { GuardedListeners } from "../listeners.js";
 import { SectionReplica } from "./replica.js";
 import { deriveSectionActorId, SECTIONS_PROFILE_ID } from "./values.js";
 /** Each node's (and the title's) projected state, to tell which ones a merge changed. */
@@ -62,7 +63,7 @@ export class SharedSectionsDataProfile {
     #pending = new Map();
     /** LFCP-accepted units whose actor sequence a different change has (SOP §14.1), by unit ID hex. */
     #held = new Map();
-    #listeners = new Set();
+    #listeners = new GuardedListeners((error, event) => Object.freeze({ error, event }));
     constructor(replica) {
         this.#replica = replica;
     }
@@ -70,17 +71,37 @@ export class SharedSectionsDataProfile {
     get replica() {
         return this.#replica;
     }
-    /** §5 nodes-changed for remote merges, rebuilds and recorded local changes. */
+    /**
+     * §5 nodes-changed for remote merges, rebuilds and recorded local changes.
+     * A listener that changes the model again (re-entrantly) makes the
+     * nested event reach the listeners after it before the outer one does,
+     * as in 0.2.1.
+     */
     onNodesChanged(listener) {
-        this.#listeners.add(listener);
-        return () => this.#listeners.delete(listener);
+        return this.#listeners.add(listener);
     }
+    /**
+     * Called when a nodes-changed listener throws (REVIEW-20261015-03), with
+     * the error and the event. Without a handler the error goes to the
+     * runtime's reportError where there is one (a browser, Electron), else it
+     * is dropped. A handler that throws is not reported again.
+     */
+    onListenerError(handler) {
+        return this.#listeners.onError(handler);
+    }
+    /**
+     * Every listener gets the event, and a listener that throws never turns
+     * the operation that changed the model (a merge, a recorded local change,
+     * a rebuild, a loaded Snapshot) into a failure: the change stands and the
+     * error is reported (onListenerError), never recursively. An engine trap
+     * is the exception and is thrown on once every listener has had the
+     * event, as before and as SyncClient does: the engine is dead.
+     */
     #emit(nodeIds, origin) {
         if (nodeIds.length === 0)
             return;
         const event = Object.freeze({ nodeIds, origin, modelRevision: this.#replica.revision() });
-        for (const l of this.#listeners)
-            l(event);
+        this.#listeners.emit([event]);
     }
     /** The codec of one unit, bound to its signer's section actor (§2). */
     codecFor(unit) {

package/dist/sections/dispatch.d.ts

@@ -1,3 +1,4 @@
+import { IDENTITY_PROFILE_ID } from "../identity/values.js";
 import { PROFILE_ID } from "../values.js";
 import { SECTIONS_PROFILE_ID } from "./values.js";
 /**
@@ -9,13 +10,16 @@ import { SECTIONS_PROFILE_ID } from "./values.js";
  * textual shape.
  */
 /** The models this package implements, by Data Profile. */
-export declare const SUPPORTED_DATA_PROFILES: readonly ["org.openlfcp.shared-objects.v1", "org.openlfcp.shared-sections.v1"];
+export declare const SUPPORTED_DATA_PROFILES: readonly ["org.openlfcp.shared-objects.v1", "org.openlfcp.shared-sections.v1", "org.openlfcp.identity.v1"];
 export type ProfileModel = {
     readonly kind: "shared-objects";
     readonly dataProfile: typeof PROFILE_ID;
 } | {
     readonly kind: "shared-sections";
     readonly dataProfile: typeof SECTIONS_PROFILE_ID;
+} | {
+    readonly kind: "identity";
+    readonly dataProfile: typeof IDENTITY_PROFILE_ID;
 }
 /**
  * LFCP-WIRE-01 §62: no model here reads this profile. The Resource is