rapier-html 1.1.104 → 1.2.5

package/BUILD.json

@@ -1,10 +1,10 @@
 {
   "package": "rapier-html",
-  "version": "1.1.104",
+  "version": "1.2.5",
   "path": "dist/rapier.html",
-  "bytes": 3565876,
-  "sha256": "11ef86ddc14ffd60276d7266331ae27bd47c3a4a395aedf8c8601a3a395ae5d9",
-  "builtAt": "2026-10-12T17:02:11.693Z",
+  "bytes": 4949290,
+  "sha256": "5e2cbc912f760dd5ffad630f92dcec40151df5d55d0e6c7a2796ef907671d8bc",
+  "builtAt": "2026-10-16T06:38:46.417Z",
   "node": "v22.23.3",
   "canonical": true,
   "packing": "zopfli",
@@ -14,32 +14,39 @@
       "delivery": "built-in",
       "kind": "script",
       "element": "rapier-plugin-math",
-      "bytes": 714051,
-      "packedBytes": 495012,
+      "bytes": 691650,
+      "packedBytes": 438088,
       "files": [
         {
           "id": "rapier-math",
-          "name": "rapier-math-1.1.0.js",
-          "version": "1.1.0",
-          "bytes": 714051,
-          "sri": "dYIPrqCf4rrTcAKw1Zzzo7vujbNtk2C7Zik/tIYOaLVT0U66WOXcGNE6waFbKych"
+          "name": "rapier-math-2.4.0.js",
+          "version": "2.4.0",
+          "bytes": 691650,
+          "sri": "C92x26+pBI4q9FoWypMhBb8CqSGaaPLw8dpYigWiYNsYQRTcPVrFyPVjrhc/Tnwh"
         }
       ]
     },
     {
       "id": "mermaid",
       "delivery": "built-in",
-      "kind": "script",
+      "kind": "files",
       "element": "rapier-plugin-mermaid",
-      "bytes": 292169,
-      "packedBytes": 102242,
+      "bytes": 7389640,
+      "packedBytes": 1526485,
       "files": [
         {
-          "id": "rapier-mermaid",
-          "name": "rapier-diagrams-1.1.104.js",
-          "version": "1.1.104",
-          "bytes": 292169,
-          "sri": "b+ByE92VMwroMyB4gJIAdisjv+ONeQERVFCCP9nBfchHTUxACYXg1YNbdm2bp7FT"
+          "id": "rapier-mermaid-core",
+          "name": "mermaid.min.js",
+          "version": "12.1.0",
+          "bytes": 5493176,
+          "sri": "EbBpjO7rlR6eqZEcG7GaPpyk9H9WrMyPWX4d3KvPYltgt8Z8l0z6R56B1qP40pR4"
+        },
+        {
+          "id": "rapier-mermaid-zenuml",
+          "name": "rapier-zenuml-4.5.0-2.js",
+          "version": "4.5.0-2",
+          "bytes": 1896464,
+          "sri": "8Ptjhh1zNTOvy1dxFHhXgYKfs290DSlpzow5rF9FvP38cohtbsBW381Whym1WI6E"
         }
       ]
     },
@@ -49,7 +56,7 @@
       "kind": "files",
       "element": "rapier-plugin-letters",
       "bytes": 463027,
-      "packedBytes": 204178,
+      "packedBytes": 198962,
       "files": [
         {
           "id": "rapier-letters-field",
@@ -87,7 +94,7 @@
       "kind": "files",
       "element": "rapier-plugin-font-subset",
       "bytes": 1214356,
-      "packedBytes": 453061,
+      "packedBytes": 441192,
       "files": [
         {
           "id": "rapier-font-subset",

package/README.md

@@ -1,79 +1,62 @@
 # rapier-html
 
-Turn Markdown into one offline HTML file with the full Rapier editor. It opens in any browser on a phone or
-computer, with no account. People read, edit, draw and paint watercolor. Agents deliver documents, show what
-changed and receive the person's edited copy through the door. Start with `npx rapier-html@1.1.104 notes.md`.
+Turn Markdown into one offline HTML file that contains the full Rapier editor. It opens in any browser, on a phone or
+computer, with no account. People read, edit, draw and paint; agents hand over documents, show what changed and get
+the edited copy back. Start with `npx rapier-html@1.2.5 notes.md`.
 
-Use it for a plan to rearrange, an illustrated guide to annotate, a draft to continue writing, or a revision
-to review. Text and drawings stay editable, and the file remains usable independently of a hosted workspace.
+Use it for a plan to rearrange, a guide to annotate, a draft to keep writing, or a revision to review. The file works
+without any hosted workspace.
 
-- The page writes, draws and paints, saves Markdown, exports Word, PDF and a web page, and prints, with no account
-  and nothing fetched to open, edit or save.
-- `--return` adds a one-use Send back address from the agent door: the person edits offline, presses Send back,
-  and the agent reads the returned copy.
-- `--view draw` opens on Draw; `--compare original.md` opens the edited document showing what changed;
-  `--by <name>` attributes the comparison with the time the page was made.
-- `wrap` and `unwrap` carry a document into a page and out again, exactly, for programs.
+- The page writes, draws and paints, saves Markdown, exports Word, PDF and a web page, and prints. It needs no account
+  and fetches nothing to open, edit or save.
+- `--return` adds a one-use Send back address from the agent door.
+- `--view draw` opens on Draw. `--compare original.md` opens the edit with its diff; `--by <name>` attributes it.
+- `wrap` and `unwrap` move a document into a page and back out, exactly.
 
-Node 22 or newer.
+Needs Node 22 or newer.
 
 ```sh
-npx -- rapier-html@1.1.104 notes.md                          # the editor, notes.md inside it, written beside the file
-npx -- rapier-html@1.1.104 notes.md --view draw              # opens on Draw: sketch and paint, the document behind it
-npx -- rapier-html@1.1.104 notes.md --view notes             # opens the Notes library
-npx -- rapier-html@1.1.104 notes.md --drawing sketch.svg     # carries a drawing, opened on Draw over the document
-npx -- rapier-html@1.1.104 revised.md --compare original.md # opens showing what changed
-npx -- rapier-html@1.1.104 notes.md --return "$RETURN_URL" --return-expires-at "$RETURN_EXPIRES_AT" # Send back
-npx -- rapier-html@1.1.104 notes.md out.html                 # a named output
-npm install rapier-html@1.1.104                              # as a library: wrap, unwrap
+npx -- rapier-html@1.2.5 notes.md                          # the editor, notes.md inside it, written beside the file
+npx -- rapier-html@1.2.5 notes.md --view draw              # opens on Draw: sketch and paint, the document behind it
+npx -- rapier-html@1.2.5 notes.md --view notes             # opens the Notes library
+npx -- rapier-html@1.2.5 notes.md --drawing sketch.svg     # carries a drawing, opened on Draw over the document
+npx -- rapier-html@1.2.5 revised.md --compare original.md # opens showing what changed
+npx -- rapier-html@1.2.5 notes.md --return "$RETURN_URL" --return-expires-at "$RETURN_EXPIRES_AT" # Send back
+npx -- rapier-html@1.2.5 notes.md out.html                 # a named output
+npm install rapier-html@1.2.5                              # as a library: wrap, unwrap
 ```
 
 The first `--` is for npm, so `--help` reaches the command. It never overwrites a file.
 
-For live shared editing, open the document through Rapier's MCP tools. The agent edits beside the person or
-while they are away. Rapier shows its presence and change marks; the person taps a change to see the before
-and undoes anything. Use `show {target:"comparison"}` to show a diff deliberately. Export Markdown or an offline
-editor when the result needs an independent copy. Send back returns the edited copy alongside the hosted
-document, preserving both.
-
-Will markers in the Markdown control agent edits: `keep`, `append`, `edit`.
+Will markers in the Markdown (`keep`, `append`, `edit`) control what agents may change.
 
 ## Choose a Rapier workflow
 
-Rapier is a phone-first Markdown editor for notes, diagrams, drawing and watercolor painting. It runs offline
-as one HTML file on Android, Web and Windows.
-Collaborate over MCP and WebMCP, use optional encrypted sync to your own Cloudflare account, or embed the
-editor and lightweight reader (about 190 kB gzipped). The agent edits live; the person sees its presence and
-changes, taps a change to see the before and undoes anything. Use `show {target:"comparison"}` to show a diff deliberately.
-
-1. **Work together live.** Connect to `https://mcp.rapier.website/mcp`, then call `open` to share one document with the person.
-2. **Deliver an offline editor.** Run `npx rapier-html@1.1.104 notes.md` to put the document and editor in one HTML file ([rapier-html](https://github.com/jackskip22/rapier-plugins/tree/main/npm/rapier-html)).
-3. **Embed in your app.** Install [rapier-embed](https://github.com/jackskip22/rapier-plugins/tree/main/npm/rapier-embed); mount the editor or reader, with your app's agent over WebMCP in the editor.
-4. **Keep portable Markdown.** Use [rapier-markdown-kit](https://github.com/jackskip22/rapier-plugins/tree/main/npm/rapier-markdown-kit) for pictures, editable SVG drawings and layout in one `.md` file. Respect [Will/1](https://github.com/jackskip22/will) `keep`, `append` and `edit` regions.
-5. **Encode JPEG XL.** Install [rapier-jxl](https://github.com/jackskip22/rapier-jxl) to encode pixels, photographs and existing JPEGs in JavaScript.
-6. **Host the door.** Run [rapier-server](https://github.com/jackskip22/rapier/tree/main/server) over your own folder or S3-compatible bucket.
+1. **Work together live.** Connect to `https://mcp.rapier.website/door/mcp`, then call `open` to share one document with the person.
+2. **Hand over an offline editor.** Use this package.
+3. **Embed the editor.** [rapier-embed](https://github.com/jackskip22/rapier-plugins/tree/main/npm/rapier-embed)
+   mounts the editor or reader in your app.
+4. **Keep portable Markdown.** [rapier-markdown-kit](https://github.com/jackskip22/rapier-plugins/tree/main/npm/rapier-markdown-kit)
+   keeps pictures, drawings and layout in one `.md` file.
 
 ## Send an edited document back
 
-Call `show {target:"return"}` on the Rapier agent door for the document's workspace and pass its `return_url`
-and `return_expires_at` as `--return "$RETURN_URL" --return-expires-at "$RETURN_EXPIRES_AT"`, or
-`wrap(..., {return: return_url, return_expires_at})`. Only the worker's HTTPS return route at
-`https://mcp.rapier.website/return/…` is accepted. The page then shows Send back in Share; a page without an
-address has no such action.
-
-The person edits offline and presses Send back: the current source and filename go once, the page shows the
-acceptance or the worker's refusal, and it sends nothing again. The return lasts up to one day, takes one
-document with a 64 MiB decoded-source ceiling, subject to the workspace’s remaining storage quota, and grants no
-access to the agent's workspace. After the expiry, or a refusal, Share offers
-Save instead; bring that file back to the assistant for a fresh return.
+1. Call `show {target:"return"}` on the Rapier agent door for the document's workspace.
+2. Pass its `return_url` and `return_expires_at` as `--return "$RETURN_URL" --return-expires-at "$RETURN_EXPIRES_AT"`,
+   or `wrap(..., {return: return_url, return_expires_at})`. Only `https://mcp.rapier.website/return/…` is accepted.
+   Share then shows Send back; a page without an address doesn't.
+3. The person edits offline and taps Send back. The source and filename go once; the page shows acceptance or
+   refusal and never sends again.
+4. `show {target:"ask",wait:"message"}` returns a `returned` receipt with the `return_id`, name and time, and
+   `read {state:true}` lists receipts. Read the source with `read {return_id}`, then `cursor` alone until complete.
 
-`show {target:"ask",wait:"message"}` returns a `returned` receipt with the `return_id`, name and time;
-`read {state:true}` lists returned-copy receipts. Use `read {return_id}` for the source, then `cursor`
-alone to continue until complete. The returned copy stays separate from the workspace's current document.
+A return lasts up to one day and takes one document of up to 64 MiB of decoded source, within the workspace's
+remaining storage. It grants no access to the workspace, and the returned copy stays separate from the workspace's
+current document. After expiry or a refusal, Share offers Save instead; bring that file back for a fresh return.
 
 ## As a library
 
-Save this as `example.mjs` in the folder you installed into and run `node example.mjs`:
+Save this as `example.mjs` in the folder you installed into, then run `node example.mjs`:
 
 ```js
 import {readFile, writeFile} from 'node:fs/promises';
@@ -86,50 +69,47 @@ console.log('words back exactly:', unwrap(page).text === words);
 await writeFile('hello.rapier.html', page, {flag: 'wx'});        // 'wx': never over an existing file
 ```
 
-`wrap(rapierHtml, text, name, {view, drawing, drawingName, base, baseName, by, at, return: returnURL, return_expires_at})`
-and `unwrap(pageHtml)`, which returns the same fields plus the validated `comparisonBase` record, with `null`
-for what a page does not carry. Also exported:
-`encodeCarried`, `decodeCarried`, `main`.
+- `wrap(rapierHtml, text, name, {view, drawing, drawingName, base, baseName, by, at, return: returnURL, return_expires_at})`
+- `unwrap(pageHtml)` returns the same fields, plus the validated `comparisonBase` record, with `null` for anything the
+  page doesn't carry.
+- Also exported: `encodeCarried`, `decodeCarried` and `main`.
 
 ## How the page carries the document
 
-One `<script type="text/markdown" id="rapier-document">` block at the top of the body, never executed,
-read once at boot. A drawing rides in `id="rapier-drawing"`, the original text for comparison in
-`id="rapier-base"`, the view to open on in the document block's `data-view`, the optional return URL
-in `data-return` and its exact expiry in `data-return-expires-at`. The block holds no `<`
-before `/` or `!`, no carriage return and no NUL: `\\`, `\/`, `\!`, `\r` and `\0` stand for them, one
-reversible pass each way, so a note about HTML is as safe as any other. A byte-order mark is kept as a
-fact of the file and written back on Save.
-
-`comparisonBase` contains the original `text`, `sha256`, `revision`, `name`, `by` and `at`. Rewrapping retains
-its original text, hash and revision; a baseline equal to the current text is omitted. It is a display
-reference, never a write grant or a history record. The edited document remains the source used by Save and
-Send back.
+- One `<script type="text/markdown" id="rapier-document">` block at the top of the body, never run, read once at
+  start-up.
+- A drawing goes in `id="rapier-drawing"` and the comparison original in `id="rapier-base"`. The document block's
+  `data-view` names the opening view, `data-return` the return URL, and `data-return-expires-at` its expiry.
+- The block holds no `<` before `/` or `!`, no carriage return and no NUL: `\\`, `\/`, `\!`, `\r` and `\0` stand for
+  them, one reversible pass each way. A byte-order mark is kept and written back on Save.
+- `comparisonBase` holds the original `text`, `sha256`, `revision`, `name`, `by` and `at`. Rewrapping keeps the
+  original text, hash and revision; a baseline equal to the current text is left out. It is for display only, never a
+  write grant or history. Save and Send back use the edited document.
 
 ## Safety
 
-- It never overwrites: an existing output, the document itself included, is refused, as are unknown options, a
-  `--view` other than `draw` or `notes`, a `--drawing` or `--compare` with no file, a return without its expiry, an
+- It never overwrites: an existing output, including the document itself, is refused. So are unknown options, a
+  `--view` other than `draw` or `notes`, `--drawing` or `--compare` without a file, a return without its expiry, an
   invalid expiry, an unsafe return URL and a third filename.
-- Opening and rendering use carried resources; the page cannot fetch pictures, media, fonts or plug-ins.
-  The staged editor includes verified math, Mermaid and lettering resources. Embed any document pictures.
-  An explicit Send back connects only to the minted return origin. Its URL names the worker's exact route;
-  credentials, query strings and fragments are refused.
+- The page opens and renders from what it carries; it can't fetch pictures, media, fonts or plugins. The editor
+  includes verified math, Mermaid and lettering resources. Embed any document pictures.
+- Send back connects only to the return origin it was given. Credentials, query strings and fragments in the return
+  URL are refused.
 
 ## Optional edit history
 
-`wrap(page, text, filename, {ledger, authorship})` accepts the public kit's
-`rapier-ledger/1` and `rapier-authorship/1` objects. `unwrap(page)` returns the
-checked parts beside its text. Neither is on by default. An authorship projection
-contains only attribution of current characters; a full ledger contains deleted
-text too. A wrong-text, malformed, duplicate or inconsistent part throws instead
-of attaching false history. Saved Markdown written with the kit's
-`ledger/carried.writeDocument` is read automatically when wrapping. Rewrapping a
-page without parts drops its previous document's parts. Published npm files carry
-their own staged MIT validator closure; no source checkout is needed.
+`wrap(page, text, filename, {ledger, authorship})` accepts the kit's `rapier-ledger/2` and `rapier-authorship/1`
+objects, and `unwrap(page)` returns the checked parts beside the text. Both are off by default.
+
+- An authorship projection holds only who wrote the current characters; a full ledger also holds deleted text.
+- A part that doesn't match the text, or is malformed, duplicated or inconsistent, throws instead of attaching false
+  history.
+- Markdown saved with the kit's `ledger/carried.writeDocument` is read automatically when wrapping. Rewrapping a page
+  without parts drops the old parts.
+- The published package carries its own MIT validator; no source checkout is needed.
 
 ## Licence
 
-AGPL-3.0-only (`LICENSE`): the page is the Rapier editor with the notices of the libraries it carries.
-The Markdown standard without the editor is `rapier-markdown-kit` (MIT). Rapier is https://rapier.website.
+AGPL-3.0-only (`LICENSE`): the page is the Rapier editor, with the notices of the libraries it carries. For the
+Markdown standard without the editor, use `rapier-markdown-kit` (MIT). Rapier is at https://rapier.website.
 `BUILD.json` records the page's size, SHA-256, build time and Node version.

package/dist/ledger/LICENSE

@@ -21,8 +21,11 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
 Files under this licence carry `SPDX-License-Identifier: MIT` in their first lines: the standard's
-grammar, marks and reference style (`spec/md-layout.mjs`, `spec/md-marks.mjs`, `spec/md-source.mjs`, `spec/flowchart.mjs`, `spec/markdown-style.css`), the layout model and line planner
-(`layout/model.mjs`, `layout/line-plan.mjs`, `layout/typography.mjs`, `layout/preparation.mjs`),
+grammar, marks and reference style (`spec/md-layout.mjs`, `spec/md-marks.mjs`, `spec/md-source.mjs`, `spec/flowchart.mjs`, `spec/markdown-style.css`), ink geometry
+(`spec/ink.mjs`),
+the layout model and line planner (`layout/model.mjs`, `layout/line-plan.mjs`, `layout/typography.mjs`, `layout/preparation.mjs`,
+`layout/prepared-paragraph.mjs`, `layout/hyphenation.mjs`, `layout/paragraph-fit.mjs`), the animated-picture reader and playback
+the HTML blocks use (`images/gif.mjs`, `images/playback.mjs`),
 the portable HTML and document metadata helpers (`spec/html-blocks.mjs`, `spec/frontmatter.mjs`,
 `spec/document-settings.mjs`, `spec/document-fonts.mjs`), the Will grammar (`agent/will.mjs`), the picture appendix reader and writer
 (`spec/md-assets.mjs`), the two shared-page reference readers (`tools/read-shared-page.mjs`,
@@ -32,8 +35,9 @@ own MIT notices. The edit-ledger module (`kit/rapier-ledger.mjs`, `kit/ledger/*.
 its editor compatibility import (`editor/journal-records.mjs`) are also covered. The
 record validator/replayer and text-only conflict merger were moved, not copied,
 into that module; the Notes index merger and the rest of the agent/editor remain
-AGPL-3.0-only. The wrapper's carrier-staging helper
-(`skills/rapier-html/package-files.mjs`) is MIT. The kit's MIT-marked facades,
+AGPL-3.0-only. The page wrapper (`skills/rapier-html/wrap.mjs`, `skills/rapier-html/page.mjs`,
+`skills/rapier-html/return-address.mjs`) and its carrier-staging helper
+(`skills/rapier-html/package-files.mjs`) are MIT. The kit's MIT-marked facades,
 `kit/render-entry.mjs`, `kit/render*.mjs`, `kit/export-fonts.mjs`, `kit/print-capitals.mjs`,
 `kit/pdf-vectors.mjs`, `kit/pdf-glyphs.mjs`, `kit/stage.mjs` and MIT-marked conformance
 modules are covered too. These names describe the Rapier-owned files carrying the

package/dist/ledger/authored-origin.mjs

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: MIT
+// Immutable authored origins shared by causal transport and inverse projection.
+import {_rapierTransformSplices, _rapierValidAuthored} from './journal-records.mjs';
+import {sha256} from './hash.mjs';
+
+// The frontier names only causal maxima. Linear history needs one predecessor,
+// and concurrent predecessors remain separate until an act observes both.
+function authoredFrontier(records, visit = null) {
+  const dependencies = new Map(), frontier = new Set();
+  for (const record of records) {
+    const id = record.transaction.id, basis = record.authored?.basis;
+    if (visit) visit(record, basis ?? [...frontier].sort());
+    if (!basis) { dependencies.set(id, [...frontier]); frontier.clear(); }
+    else {
+      const pending = [...basis], seen = new Set();
+      while (pending.length) {
+        const prior = pending.pop();
+        if (seen.has(prior)) continue;
+        if (!dependencies.has(prior)) throw new RangeError('canonical_origin_invalid');
+        seen.add(prior); frontier.delete(prior); pending.push(...dependencies.get(prior));
+      }
+      dependencies.set(id, basis);
+    }
+    frontier.add(id);
+  }
+  return [...frontier].sort();
+}
+
+export function authoredBasis(records) { return authoredFrontier(records); }
+
+export function authoredPlacements(base, records) {
+  const origins = new Map(); let source = base;
+  authoredFrontier(records, (record, basis) => {
+    origins.set(record.transaction.id, record.authored ?? authoredPlacement(source, record.splices, basis));
+    source = _rapierTransformSplices(source, record.splices);
+    if (source === null) throw new RangeError('canonical_origin_invalid');
+  });
+  return origins;
+}
+
+// Immutable authored placement stays on its own act. Basis IDs refer only to this
+// canonical history; no source snapshot or duplicate history is stored.
+export function authoredPlacement(source, splices, basis) {
+  const origin = {basis: basis.slice().sort(), source: sha256(source), splices: splices.map(row => ({...row}))};
+  if (!_rapierValidAuthored(origin) || _rapierTransformSplices(source, splices) === null)
+    throw new RangeError('canonical_origin_invalid');
+  return origin;
+}
+

package/dist/ledger/authorship.mjs

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 import {readLedger, exportLedger, textRoot, rootAfter} from './format.mjs';
-import {_rapierTransformSplices} from './journal-records.mjs';
+import {_rapierTransformSplices, _rapierHistoryEffects} from './journal-records.mjs';
 import {sha256} from './hash.mjs';
 import {plainData, documentText, nonnegative, exactKeys, fault} from './data.mjs';
 function coalesce(runs) {
@@ -14,16 +14,25 @@ function coalesce(runs) {
   return out;
 }
 export function authorship(input) {
-  const {ledger, text} = readLedger(input);
+  const {ledger, text} = readLedger(input), references = _rapierHistoryEffects(ledger.records).references, removed = new Map();
   let runs = ledger.start.text ? [[0, ledger.start.text.length, 'system', 'unattributed', 0]] : [];
-  for (const record of ledger.records) for (const row of record.splices) {
-    const cut = row.pos + row.removed.length, delta = row.inserted.length - row.removed.length, before = [], after = [];
-    for (const run of runs) {
-      if (run[0] < row.pos) before.push([run[0], Math.min(run[1], row.pos), ...run.slice(2)]);
-      if (run[1] > cut) after.push([Math.max(run[0], cut) + delta, run[1] + delta, ...run.slice(2)]);
+  for (const record of ledger.records) {
+    // An Undo or Redo puts back text the act it references removed: that text keeps the runs it had.
+    const tx = record.transaction, gone = [], kept = (references?.get(tx.id) || []).flatMap(id => removed.get(id) || []);
+    for (const row of record.splices) {
+      const cut = row.pos + row.removed.length, delta = row.inserted.length - row.removed.length, before = [], after = [], inside = [];
+      for (const run of runs) {
+        if (run[0] < row.pos) before.push([run[0], Math.min(run[1], row.pos), ...run.slice(2)]);
+        if (run[1] > cut) after.push([Math.max(run[0], cut) + delta, run[1] + delta, ...run.slice(2)]);
+        if (run[0] < cut && run[1] > row.pos) inside.push([Math.max(run[0], row.pos) - row.pos, Math.min(run[1], cut) - row.pos, ...run.slice(2)]);
+      }
+      if (row.removed) gone.push({text: row.removed, runs: inside});
+      const at = row.inserted ? kept.findIndex(entry => entry.text === row.inserted) : -1;
+      const put = at < 0 ? [[row.pos, row.pos + row.inserted.length, tx.actor.kind, tx.actor.id, tx.createdAt]]
+        : kept.splice(at, 1)[0].runs.map(run => [run[0] + row.pos, run[1] + row.pos, ...run.slice(2)]);
+      runs = coalesce([...before, ...put, ...after]);
     }
-    const tx = record.transaction;
-    runs = coalesce([...before, [row.pos, row.pos + row.inserted.length, tx.actor.kind, tx.actor.id, tx.createdAt], ...after]);
+    removed.set(tx.id, gone);
   }
   return {format: 'rapier-authorship/1', sha256: sha256(text), runs};
 }

package/dist/ledger/carried.mjs

@@ -73,7 +73,7 @@ export function readDocument(source) {
 export function readBase(value) {
   if (!value || typeof value !== 'object') throw fault('comparison base SHA-256 differs from its text');
   // Capture each caller-owned field once; admission and serialization use these same scalars.
-  const {text, sha256: digest, revision, name, by, at} = value;
+  const {text, sha256: digest, revision, name, by, at, fonts} = value;
   if (typeof text !== 'string' || typeof digest !== 'string' || !/^[a-f0-9]{64}$/.test(digest) || sha256(text) !== digest)
     throw fault('comparison base SHA-256 differs from its text');
   if (typeof revision !== 'string' || !revision || revision.length > 256 || /[\u0000-\u001f\u007f]/.test(revision))
@@ -84,7 +84,8 @@ export function readBase(value) {
     throw fault('a comparison needs its author name');
   if (typeof at !== 'string' || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/.test(at) || !Number.isFinite(Date.parse(at)))
     throw fault('the time of a comparison is an ISO 8601 UTC timestamp');
-  return {text, sha256: digest, revision, name, by, at};
+  if (fonts != null && typeof fonts !== 'string') throw fault('invalid comparison font resources');
+  return {text, sha256: digest, revision, name, by, at, ...(fonts ? {fonts} : {})};
 }
 const escapeAttribute = value => value.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
 const readAttribute = value => value.replace(/&(quot|lt|gt|amp);/g, (_, name) => ({quot: '"', lt: '<', gt: '>', amp: '&'})[name]);
@@ -93,7 +94,8 @@ export function writeBase(text, value) {
   const base = readBase(value);
   if (base.text === text) return '';
   return '<script type="text/markdown" id="rapier-base"' + ['name', 'sha256', 'revision', 'by', 'at']
-    .map(key => ' data-' + key + '="' + escapeAttribute(base[key]) + '"').join('') + '>' + encodeCarried(base.text) + '</script>';
+    .map(key => ' data-' + key + '="' + escapeAttribute(base[key]) + '"').join('') +
+    (base.fonts ? ' data-fonts="' + escapeAttribute(JSON.stringify(base.fonts)) + '"' : '') + '>' + encodeCarried(base.text) + '</script>';
 }
 export function readBaseElements(elements) {
   const rows = [...elements].filter(element => element.id === 'rapier-base');
@@ -102,7 +104,10 @@ export function readBaseElements(elements) {
   if (rows.length !== 1 || row.type !== 'text/markdown' || (row.tagName && row.tagName.toLowerCase() !== 'script'))
     throw fault('duplicate or executable comparison base');
   const get = name => row.getAttribute ? row.getAttribute('data-' + name) : row[name];
-  return readBase({text: decodeCarried(row.textContent), ...Object.fromEntries(['name', 'sha256', 'revision', 'by', 'at'].map(key => [key, get(key)]))});
+  let fonts;
+  try { const value = get('fonts'); if (value != null) fonts = JSON.parse(value); }
+  catch (_) { throw fault('invalid comparison font resources'); }
+  return readBase({text: decodeCarried(row.textContent), fonts, ...Object.fromEntries(['name', 'sha256', 'revision', 'by', 'at'].map(key => [key, get(key)]))});
 }
 export function takeBase(html) {
   const elements = [];
@@ -115,7 +120,7 @@ export function takeBase(html) {
       seen.add(key); values[key] = value;
     }
     elements.push({id: values.id, type: values.type, textContent: content,
-      ...Object.fromEntries(['name', 'sha256', 'revision', 'by', 'at'].map(key => [key, values['data-' + key]]))});
+      ...Object.fromEntries(['name', 'sha256', 'revision', 'by', 'at', 'fonts'].map(key => [key, values['data-' + key]]))});
     return '';
   });
   return {html: stripped, base: readBaseElements(elements)};

package/dist/ledger/data.mjs

@@ -1,10 +1,13 @@
 // SPDX-License-Identifier: MIT
 // Only plain JSON data enters the public format. Accessors and toJSON are never executed.
 export function fault(message) { return Object.assign(new Error('Ledger: ' + message), {code: 'ledger_invalid'}); }
-function fields(value, depth, active, sorted = true) {
+// A plain object's prototype is null or Object's own. Both lookups read descriptors, so no getter runs.
+export const plainPrototype = proto => proto === null || Object.getPrototypeOf(proto) === null &&
+  Object.getOwnPropertyDescriptor(Object.getOwnPropertyDescriptor(proto, 'constructor')?.value || {}, 'name')?.value === 'Object';
+export function fields(value, depth, active, sorted = true) {
   if (!value || typeof value !== 'object' || depth > 64 || active.has(value)) throw fault('not plain JSON data');
-  const array = Array.isArray(value), proto = Object.getPrototypeOf(value);
-  if (!array && proto !== null && (Object.getPrototypeOf(proto) !== null || Object.getOwnPropertyDescriptor(proto, 'constructor')?.value?.name !== 'Object')) throw fault('not a plain object');
+  const array = Array.isArray(value);
+  if (!array && !plainPrototype(Object.getPrototypeOf(value))) throw fault('not a plain object');
   const descriptors = Object.getOwnPropertyDescriptors(value), keys = Reflect.ownKeys(descriptors);
   for (const key of keys) {
     if (array && key === 'length') continue;
@@ -14,7 +17,7 @@ function fields(value, depth, active, sorted = true) {
   if (array && (keys.length !== value.length + 1 || keys.some(k => k !== 'length' && (!/^(0|[1-9]\d*)$/.test(k) || +k >= value.length)))) throw fault('sparse array');
   return {array, descriptors, keys: array ? keys.filter(key => key !== 'length') : sorted ? keys.sort() : keys};
 }
-function scalar(value) {
+export function scalar(value) {
   if (value === null || typeof value === 'boolean') return true;
   if (typeof value === 'string') { if (/[\uD800-\uDFFF]/u.test(value)) throw fault('unpaired surrogate'); return true; }
   return typeof value === 'number' && Number.isFinite(value) && !Object.is(value, -0);