rapier-html 1.1.56 → 1.1.57

package/BUILD.json

@@ -1,10 +1,10 @@
 {
   "package": "rapier-html",
-  "version": "1.1.56",
-  "path": "rapier.html",
-  "bytes": 1779203,
-  "sha256": "339fce7d8b30e330fe35a653e1ce70afcf403bda889021faafff50c4a3e156da",
-  "builtAt": "2026-10-04T05:51:57.517Z",
+  "version": "1.1.57",
+  "path": "dist/rapier.html",
+  "bytes": 1788469,
+  "sha256": "5a89d07839f98151b413e820b17f9b037cf6a334d9f77309b0ef718855792418",
+  "builtAt": "2026-10-04T06:43:06.832Z",
   "node": "v22.22.2",
   "canonical": true,
   "packing": "zopfli",

package/README.md

@@ -14,14 +14,14 @@ editor, offline, with the document inside.
 Node 22 or newer.
 
 ```sh
-npx -- rapier-html@1.1.56 notes.md                          # the editor, notes.md inside it, written beside the file
-npx -- rapier-html@1.1.56 notes.md --view draw              # opens on Draw: sketch and paint, the document behind it
-npx -- rapier-html@1.1.56 notes.md --view notes             # opens the Notes library
-npx -- rapier-html@1.1.56 notes.md --drawing sketch.svg     # carries a drawing, opened on Draw over the document
-npx -- rapier-html@1.1.56 proposal.md --base original.md    # opens on the diff of a proposed change
-npx -- rapier-html@1.1.56 notes.md --return "$RETURN_URL" --return-expires-at "$RETURN_EXPIRES_AT" # Send back
-npx -- rapier-html@1.1.56 notes.md out.html                 # a named output
-npm install rapier-html@1.1.56                              # as a library: wrap, unwrap
+npx -- rapier-html@1.1.57 notes.md                          # the editor, notes.md inside it, written beside the file
+npx -- rapier-html@1.1.57 notes.md --view draw              # opens on Draw: sketch and paint, the document behind it
+npx -- rapier-html@1.1.57 notes.md --view notes             # opens the Notes library
+npx -- rapier-html@1.1.57 notes.md --drawing sketch.svg     # carries a drawing, opened on Draw over the document
+npx -- rapier-html@1.1.57 proposal.md --base original.md    # opens on the diff of a proposed change
+npx -- rapier-html@1.1.57 notes.md --return "$RETURN_URL" --return-expires-at "$RETURN_EXPIRES_AT" # Send back
+npx -- rapier-html@1.1.57 notes.md out.html                 # a named output
+npm install rapier-html@1.1.57                              # as a library: wrap, unwrap
 ```
 
 The first `--` is for npm, so `--help` reaches the command. It never overwrites a file.
@@ -92,3 +92,16 @@ fact of the file and written back on Save.
 AGPL-3.0-only (`LICENSE`): the page is the Rapier editor with the notices of the libraries it carries.
 The Markdown standard without the editor is `rapier-markdown-kit` (MIT). Rapier is https://rapier.website.
 `BUILD.json` records the page's size, SHA-256, build time and Node version.
+
+
+## Optional edit history
+
+`wrap(page, text, filename, {ledger, authorship})` accepts the public kit's
+`rapier-ledger/1` and `rapier-authorship/1` objects. `unwrap(page)` returns the
+checked parts beside its text. Neither is on by default. An authorship projection
+contains only attribution of current characters; a full ledger contains deleted
+text too. A wrong-text, malformed, duplicate or inconsistent part throws instead
+of attaching false history. Saved Markdown written with the kit's
+`ledger/carried.writeDocument` is read automatically when wrapping. Rewrapping a
+page without parts drops its previous document's parts. Published npm files carry
+their own staged MIT validator closure; no source checkout is needed.

package/dist/ledger/LICENSE

@@ -0,0 +1,45 @@
+MIT License
+
+Copyright (c) 2026 Jack Skipworth
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+Files under this licence carry `SPDX-License-Identifier: MIT` in their first lines: the standard's
+grammar, marks and reference style (`spec/md-layout.mjs`, `spec/md-marks.mjs`, `spec/flowchart.mjs`, `spec/markdown-style.css`), the layout model and line planner
+(`layout/model.mjs`, `layout/line-plan.mjs`), the Will grammar (`agent/will.mjs`), the picture appendix reader and writer
+(`spec/md-assets.mjs`), the two shared-page reference readers (`tools/read-shared-page.mjs`,
+`tools/read-shared-page.py`), and the host helper `packages/rapier-embed/embed.mjs`. The vendored Pretext (`agent/vendor/pretext`) and micromark carry their
+own MIT notices. The edit-ledger module (`kit/rapier-ledger.mjs`, `kit/ledger/*.mjs`) and
+its editor compatibility import (`editor/journal-records.mjs`) are also covered. The
+record validator/replayer and text-only conflict merger were moved, not copied,
+into that module; the Notes index merger and the rest of the agent/editor remain
+AGPL-3.0-only. The wrapper's carrier-staging helper
+(`skills/rapier-html/package-files.mjs`) is MIT. Everything else in Rapier is AGPL-3.0-only (see `LICENSE`).
+
+The picture appendix reader and writer used to be part of `images/assets.mjs`, a file that also
+holds JPEG XL/raster header inspection and SVG sanitizing -- both of which reach the editor's own
+AGPL-3.0-only decoders (`images/raster.mjs`, `draw/font.mjs`), so the whole file could not honestly
+sit in this list. The appendix logic (`parseAssets`, `documentAssets`, `imageEnvironment`,
+`mayRetireImageDefinitions`, `retireDeletedImageDefinitions`, `assetOmissions`, `isAssetBlock`,
+`serializeAsset`, `appendAssetText`, `appendAsset`, and the small markdown-it plumbing they share)
+depends on nothing but a markdown-it factory, so it lives in `spec/md-assets.mjs`; `images/assets.mjs`
+re-imports and re-exports that surface unchanged (one owner, no copy) and keeps everything that
+needs the AGPL decoders, so it is AGPL-3.0-only like the rest of the editor. The `rapier-markdown-kit`
+package re-exports `spec/md-assets.mjs` directly, never `images/assets.mjs`, so its import graph
+never touches AGPL code.

package/dist/ledger/authorship.mjs

@@ -0,0 +1,59 @@
+// SPDX-License-Identifier: MIT
+import {readLedger, exportLedger, textRoot, rootAfter} from './format.mjs';
+import {_rapierTransformSplices} from './journal-records.mjs';
+import {sha256} from './hash.mjs';
+import {plainData, documentText, nonnegative, exactKeys, fault} from './data.mjs';
+function coalesce(runs) {
+  const out = [];
+  for (const run of runs) {
+    if (run[0] === run[1]) continue;
+    const last = out.at(-1);
+    if (last && last[1] === run[0] && last.slice(2).every((value, i) => value === run[i + 2])) last[1] = run[1];
+    else out.push(run.slice());
+  }
+  return out;
+}
+export function authorship(input) {
+  const {ledger, text} = readLedger(input);
+  let runs = ledger.start.text ? [[0, ledger.start.text.length, 'system', 'unattributed', 0]] : [];
+  for (const record of ledger.records) for (const row of record.splices) {
+    const cut = row.pos + row.removed.length, delta = row.inserted.length - row.removed.length, before = [], after = [];
+    for (const run of runs) {
+      if (run[0] < row.pos) before.push([run[0], Math.min(run[1], row.pos), ...run.slice(2)]);
+      if (run[1] > cut) after.push([Math.max(run[0], cut) + delta, run[1] + delta, ...run.slice(2)]);
+    }
+    const tx = record.transaction;
+    runs = coalesce([...before, [row.pos, row.pos + row.inserted.length, tx.actor.kind, tx.actor.id, tx.createdAt], ...after]);
+  }
+  return {format: 'rapier-authorship/1', sha256: sha256(text), runs};
+}
+export function readAuthorship(input, text) {
+  documentText(text); const value = plainData(input);
+  if (!exactKeys(value, ['format','sha256','runs']) || value.format !== 'rapier-authorship/1' || value.sha256 !== sha256(text) || !Array.isArray(value.runs)) throw fault('authorship is not for this text');
+  let cursor = 0;
+  for (const run of value.runs) {
+    if (!Array.isArray(run) || run.length !== 5 || run[0] !== cursor || !nonnegative(run[1]) || run[1] <= cursor || run[1] > text.length ||
+        !['human','agent','system'].includes(run[2]) || typeof run[3] !== 'string' || !run[3] || run[3].length > 160 || !nonnegative(run[4]) ||
+        /[\uD800-\uDFFF]/u.test(text.slice(cursor, run[1]))) throw fault('invalid authorship run');
+    cursor = run[1];
+  }
+  if (cursor !== text.length) throw fault('authorship does not cover the text');
+  return value;
+}
+// Authorship-only imports become an incomplete insertion ledger. There is no mutable blame database.
+export function ledgerFromAuthorship(input, text, documentAuthority) {
+  const value = readAuthorship(input, text), records = [];
+  let current = '', root = textRoot('');
+  for (const [start, end, kind, id, createdAt] of value.runs) {
+    const row = {pos: start, removed: '', inserted: text.slice(start, end)}, revision = records.length + 1;
+    const beforeHash = root; root = rootAfter(root, row);
+    current = _rapierTransformSplices(current, [row]);
+    records.push({beforeHash, afterHash: root, splices: [row], transaction: {
+      id: documentAuthority.slice(0, 48) + ':authorship:' + revision.toString(36), documentAuthority,
+      baseRevision: revision - 1, revision, actor: {kind, id}, transport: 'platform', operation: 'authorship.import',
+      requestId: null, sourceTransactionId: null, affectedBlockIds: [], parent: records.at(-1)?.transaction.id ?? null,
+      reverts: null, reapplies: null, createdAt,
+    }});
+  }
+  return exportLedger({text: current, records, documentAuthority, revision: records.length, root, complete: false});
+}

package/dist/ledger/carried.mjs

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: MIT
+import {readLedger} from './format.mjs';
+import {authorship as projectAuthorship, readAuthorship} from './authorship.mjs';
+import {canonicalJSON, fault} from './data.mjs';
+export function encodeCarried(text) {
+  return String(text).replace(/[\\\r\0]|<[/!]/g, m => m === '\\' ? '\\\\' : m === '\r' ? '\\r' : m === '\0' ? '\\0' : m === '</' ? '\\/' : '\\!');
+}
+export function decodeCarried(text) {
+  return String(text).replace(/\\([\\/!r0])/g, (_, c) => c === '\\' ? '\\' : c === 'r' ? '\r' : c === '0' ? '\0' : c === '/' ? '</' : '<!');
+}
+export function validateParts(text, {ledger = null, authorship = null} = {}) {
+  // A file's leading BOM is metadata, as in the editor's source intake.
+  const canonical = text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
+  const history = ledger === null ? null : readLedger(ledger, canonical).ledger;
+  const runs = authorship === null ? null : readAuthorship(authorship, canonical);
+  if (history && runs && canonicalJSON(projectAuthorship(history)) !== canonicalJSON(runs)) throw fault('authorship differs from ledger replay');
+  return {ledger: history, authorship: runs};
+}
+export function writeParts(text, options) {
+  const parts = validateParts(text, options);
+  return Object.entries(parts).filter(([, value]) => value !== null).map(([name, value]) =>
+    '<script type="application/json" id="rapier-' + name + '">' + encodeCarried(JSON.stringify(value)) + '</script>\n').join('');
+}
+// Pure adapter: the browser supplies inert script elements, Node supplies parsed script records.
+export function readParts(text, elements) {
+  const parts = {ledger: null, authorship: null};
+  for (const element of elements) {
+    const name = element.id === 'rapier-ledger' ? 'ledger' : element.id === 'rapier-authorship' ? 'authorship' : null;
+    if (!name) continue;
+    if (parts[name] !== null || element.type !== 'application/json' || (element.tagName && element.tagName.toLowerCase() !== 'script')) throw fault('duplicate or executable carried part');
+    try { parts[name] = JSON.parse(decodeCarried(element.textContent)); }
+    catch (_) { throw fault('invalid carried JSON'); }
+    if (parts[name] === null) throw fault('empty carried part');
+  }
+  return validateParts(text, parts);
+}
+// The wrapper only removes whole script elements. Strings inside other scripts are not carriers.
+export function takeParts(html, text) {
+  const elements = [];
+  const stripped = html.replace(/<script\b([^>]*)>([\s\S]*?)<\/script\s*>/gi, (whole, attrs, content) => {
+    const attributes = [...attrs.matchAll(/(?:^|\s)([\w-]+)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/g)];
+    const ids = attributes.filter(m => m[1].toLowerCase() === 'id').map(m => m[2] ?? m[3] ?? m[4]);
+    if (!ids.some(id => id === 'rapier-ledger' || id === 'rapier-authorship')) return whole;
+    const types = attributes.filter(m => m[1].toLowerCase() === 'type').map(m => m[2] ?? m[3] ?? m[4]);
+    if (ids.length !== 1 || types.length !== 1) throw fault('ambiguous carried part');
+    elements.push({id: ids[0], type: types[0].toLowerCase(), textContent: content}); return '';
+  });
+  if (elements.length && text === null) throw fault('carried history without a document');
+  return {html: stripped, ...readParts(text ?? '', elements)};
+}
+const OPEN = '\n\n<!-- rapier-carried/1\n', CLOSE = '\n-->\n';
+// One optional HTML comment at EOF; every other Markdown reader ignores it. Source is never rewritten.
+export function writeDocument(text, options) {
+  const parts = validateParts(text, options);
+  if (!parts.ledger && !parts.authorship) return text;
+  const json = JSON.stringify(parts).replace(/</g, '\\u003c').replace(/>/g, '\\u003e');
+  return text + OPEN + json + CLOSE;
+}
+export function readDocument(source) {
+  const at = source.lastIndexOf(OPEN);
+  if (at < 0) return {text: source, ledger: null, authorship: null};
+  if (!source.endsWith(CLOSE)) throw fault('unfinished document metadata');
+  let parts;
+  try { parts = JSON.parse(source.slice(at + OPEN.length, -CLOSE.length)); }
+  catch (_) { throw fault('invalid document metadata'); }
+  if (!parts || Object.keys(parts).length !== 2 || !Object.hasOwn(parts, 'ledger') || !Object.hasOwn(parts, 'authorship')) throw fault('invalid document parts');
+  const text = source.slice(0, at);
+  return {text, ...validateParts(text, parts)};
+}

package/dist/ledger/data.mjs

@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: MIT
+// Only plain JSON data enters the public format. Accessors and toJSON are never executed.
+export function fault(message) { return Object.assign(new Error('Ledger: ' + message), {code: 'ledger_invalid'}); }
+export function canonicalJSON(value, depth = 0, active = new Set()) {
+  if (value === null || typeof value === 'boolean') return JSON.stringify(value);
+  if (typeof value === 'string') { if (/[\uD800-\uDFFF]/u.test(value)) throw fault('unpaired surrogate'); return JSON.stringify(value); }
+  if (typeof value === 'number' && Number.isFinite(value) && !Object.is(value, -0)) return JSON.stringify(value);
+  if (!value || typeof value !== 'object' || depth > 64 || active.has(value)) throw fault('not plain JSON data');
+  const array = Array.isArray(value), proto = Object.getPrototypeOf(value);
+  if (!array && proto !== null && (Object.getPrototypeOf(proto) !== null || Object.getOwnPropertyDescriptor(proto, 'constructor')?.value?.name !== 'Object')) throw fault('not a plain object');
+  const descriptors = Object.getOwnPropertyDescriptors(value), keys = Reflect.ownKeys(descriptors);
+  for (const key of keys) {
+    if (array && key === 'length') continue;
+    const field = descriptors[key];
+    if (typeof key !== 'string' || ['__proto__', 'constructor', 'prototype'].includes(key) || !Object.hasOwn(field, 'value') || !field.enumerable) throw fault('non-data property');
+  }
+  if (array && (keys.length !== value.length + 1 || keys.some(k => k !== 'length' && (!/^(0|[1-9]\d*)$/.test(k) || +k >= value.length)))) throw fault('sparse array');
+  active.add(value);
+  const encode = item => canonicalJSON(item, depth + 1, active);
+  const out = array ? '[' + Array.from({length: value.length}, (_, i) => encode(descriptors[i].value)).join(',') + ']'
+    : '{' + keys.sort().map(key => JSON.stringify(key) + ':' + encode(descriptors[key].value)).join(',') + '}';
+  active.delete(value); return out;
+}
+export function plainData(value) { return JSON.parse(canonicalJSON(typeof value === 'string' ? JSON.parse(value) : value)); }
+export function exactKeys(value, keys) {
+  return value && typeof value === 'object' && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every(key => Object.hasOwn(value, key));
+}
+export function documentText(text) {
+  if (typeof text !== 'string' || /[\uD800-\uDFFF]/u.test(text)) throw fault('document is not whole-character text');
+  if (new TextEncoder().encode(text).length > 25 * 1024 * 1024) throw fault('document exceeds the editor text limit');
+  return text;
+}
+export const nonnegative = value => Number.isSafeInteger(value) && value >= 0 && !Object.is(value, -0);

package/dist/ledger/format.mjs

@@ -0,0 +1,131 @@
+// SPDX-License-Identifier: MIT
+import {_rapierValidLedgerRecord, _rapierRecordSplices, _rapierTransformSplices} from './journal-records.mjs';
+import {textRoot, rootAfter, sha256} from './hash.mjs';
+import {canonicalJSON, plainData, documentText, exactKeys, nonnegative, fault} from './data.mjs';
+export {textRoot, rootAfter};
+const digest = value => sha256(canonicalJSON(value));
+const rootShape = value => typeof value === 'string' && /^\d+:[a-z0-9]+:[a-z0-9]+$/.test(value);
+export function readLedger(input, expectedText) {
+  const ledger = plainData(input);
+  if (!exactKeys(ledger, ['format','documentAuthority','start','records','head','complete','sha256']) || ledger.format !== 'rapier-ledger/1' ||
+      typeof ledger.documentAuthority !== 'string' || !ledger.documentAuthority || ledger.documentAuthority.length > 256 ||
+      typeof ledger.complete !== 'boolean' || !Array.isArray(ledger.records) ||
+      !exactKeys(ledger.start, ['text','revision','root','sha256']) || !exactKeys(ledger.head, ['revision','root','sha256'])) throw fault('invalid envelope');
+  const {sha256: claimed, ...payload} = ledger;
+  if (claimed !== digest(payload)) throw fault('envelope checksum differs');
+  let text = documentText(ledger.start.text), root = ledger.start.root, revision = ledger.start.revision;
+  if (!nonnegative(revision) || !rootShape(root) || (revision === 0 && root !== textRoot(text)) || ledger.start.sha256 !== sha256(text) ||
+      (ledger.complete && revision !== 0)) throw fault('invalid start');
+  const earlier = [];
+  for (const record of ledger.records) {
+    if (!Array.isArray(record.splices) || !record.splices.length || !_rapierValidLedgerRecord(record, earlier.at(-1) || null, earlier,
+        ledger.documentAuthority, 25 * 1024 * 1024, text => new TextEncoder().encode(text).length, !ledger.complete) ||
+        record.transaction.baseRevision < revision || (record.transaction.baseRevision !== revision && ledger.complete) ||
+        (record.transaction.baseRevision === revision && record.beforeHash !== root)) throw fault('record chain differs');
+    // A pruned cancelling pair leaves a stated revision gap, just as in the editor's restore reader.
+    if (record.transaction.baseRevision !== revision) root = record.beforeHash;
+    const next = _rapierTransformSplices(text, record.splices);
+    if (next === null) throw fault('splice does not replay');
+    text = documentText(next);
+    for (const row of record.splices) root = rootAfter(root, row);
+    if (root !== record.afterHash) throw fault('record root differs');
+    revision = record.transaction.revision; earlier.push(record);
+  }
+  if (ledger.head.revision !== revision || ledger.head.root !== root || ledger.head.sha256 !== sha256(text) ||
+      (expectedText !== undefined && text !== expectedText)) throw fault('history does not describe this document');
+  return {ledger, text, root, revision, complete: ledger.complete};
+}
+export function exportLedger({text, records, documentAuthority, revision, root, complete = false, earlier = records} = {}) {
+  documentText(text);
+  if (!Array.isArray(records) || !Array.isArray(earlier)) throw fault('records required');
+  // Inspect before touching properties: exporting must not call accessors on an alleged record.
+  records = plainData(records); earlier = plainData(earlier);
+  const expanded = records.map(record => {
+    const rows = _rapierRecordSplices(record, earlier);
+    if (!rows) throw fault('navigation target was not retained');
+    return {transaction: record.transaction, splices: rows.map(row => ({pos: row.pos, removed: row.removed, inserted: row.inserted})),
+      beforeHash: record.beforeHash, afterHash: record.afterHash};
+  });
+  let startText = text;
+  for (let i = expanded.length - 1; i >= 0; i--) {
+    startText = _rapierTransformSplices(startText, expanded[i].splices, true);
+    if (startText === null) throw fault('history does not reverse from this document');
+  }
+  revision ??= expanded.at(-1)?.transaction.revision ?? 0;
+  root ??= expanded.at(-1)?.afterHash ?? textRoot(text);
+  documentAuthority ??= expanded[0]?.transaction.documentAuthority;
+  const startRevision = expanded[0]?.transaction.baseRevision ?? revision;
+  const payload = {format: 'rapier-ledger/1', documentAuthority,
+    start: {text: startText, revision: startRevision, root: expanded[0]?.beforeHash ?? root, sha256: sha256(startText)},
+    records: expanded, head: {revision, root, sha256: sha256(text)}, complete: complete === true && startRevision === 0 && expanded.every((row, i) => !i || row.transaction.baseRevision === expanded[i - 1].transaction.revision)};
+  const ledger = {...payload, sha256: digest(payload)};
+  readLedger(ledger, text); return ledger;
+}
+// Derived navigation, never a second history. A target older than start is intentionally unavailable.
+export function historyEnvelope(input, segmentIdentity = []) {
+  const {ledger, text} = readLedger(input), ids = new Set(ledger.records.map(row => row.transaction.id));
+  let branch = [], cursor = 0;
+  for (const {transaction: tx} of ledger.records) {
+    const target = tx.reverts || tx.reapplies;
+    if (target) {
+      if (!ids.has(target)) continue;
+      if (tx.reverts && branch[cursor - 1] === target) cursor--;
+      else if (tx.reapplies && branch[cursor] === target) cursor++;
+      else throw fault('invalid navigation order');
+    } else { branch = branch.slice(0, cursor); branch.push(tx.id); cursor = branch.length; }
+  }
+  const byId = new Map(ledger.records.map(row => [row.transaction.id, row]));
+  let traversed = text;
+  for (let i = cursor - 1; i >= 0; i--) {
+    traversed = _rapierTransformSplices(traversed, byId.get(branch[i]).splices, true);
+    if (traversed === null) throw fault('undo branch does not reverse');
+  }
+  traversed = text;
+  for (let i = cursor; i < branch.length; i++) {
+    traversed = _rapierTransformSplices(traversed, byId.get(branch[i]).splices);
+    if (traversed === null) throw fault('redo branch does not replay');
+  }
+  if (ledger.complete) {
+    if (ledger.records.length && !branch.length) throw fault('complete history lost its branch');
+    let active = ledger.start.text;
+    if (!cursor && active !== text) throw fault('complete history start differs');
+    for (let i = 0; i < branch.length; i++) {
+      active = _rapierTransformSplices(active, byId.get(branch[i]).splices);
+      if (active === null || (i + 1 === cursor && active !== text)) throw fault('complete branch differs');
+    }
+  }
+  return {schemaVersion: 4, documentAuthority: ledger.documentAuthority, documentRevision: ledger.head.revision,
+    ledger: ledger.records, branch, cursor, earliestRevision: ledger.start.revision, earliestHash: ledger.start.root,
+    sourceRootId: ledger.head.root, segmentIdentity, historyComplete: ledger.complete,
+    trimReason: ledger.complete ? '' : 'carried_start', trimmedBytes: 0};
+}
+export function agentActorId(door, agent) {
+  if (typeof door !== 'string' || !door || door.length > 160 || /[\u0000-\u001f\u007f]/.test(door)) throw fault('invalid door');
+  if (agent == null) return door;
+  agent = plainData(agent);
+  if (!exactKeys(agent, ['name']) || typeof agent.name !== 'string' || !agent.name.trim() || agent.name.length > 96 ||
+      /[\u0000-\u001f\u007f]/.test(agent.name) || door.length + agent.name.length + 1 > 160) throw fault('invalid host-given name');
+  return door + '/' + agent.name;
+}
+
+// A writer changing representation records that change, rather than attaching an unrelated head.
+export function replaceLedgerText(input, text, {actor = {kind: 'system', id: 'rapier'}, operation = 'document.replace', at} = {}) {
+  const current = readLedger(input); documentText(text);
+  if (current.text === text) return current.ledger;
+  let start = 0, a = current.text.length, b = text.length;
+  while (start < a && start < b && current.text[start] === text[start]) start++;
+  if (start && /[\uDC00-\uDFFF]/.test(current.text[start] || text[start] || '')) start--;
+  while (a > start && b > start && current.text[a - 1] === text[b - 1]) { a--; b--; }
+  if (/[\uDC00-\uDFFF]/.test(current.text[a] || text[b] || '')) { a++; b++; }
+  const splices = [{pos: start, removed: current.text.slice(start, a), inserted: text.slice(start, b)}];
+  const revision = current.revision + 1, root = rootAfter(current.root, splices[0]);
+  const record = {beforeHash: current.root, afterHash: root, splices, transaction: {
+    id: current.ledger.documentAuthority.slice(0, 48) + ':export:' + revision.toString(36),
+    documentAuthority: current.ledger.documentAuthority, baseRevision: current.revision, revision,
+    actor, transport: 'platform', operation, requestId: null, sourceTransactionId: null,
+    affectedBlockIds: [], parent: current.ledger.records.at(-1)?.transaction.id ?? null,
+    reverts: null, reapplies: null, createdAt: at ?? current.ledger.records.at(-1)?.transaction.createdAt ?? 0,
+  }};
+  return exportLedger({text, records: [...current.ledger.records, record], documentAuthority: current.ledger.documentAuthority,
+    revision, root, complete: current.complete});
+}

package/dist/ledger/hash.mjs

@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: MIT
+// The editor's path-dependent root, plus synchronous SHA-256 for file readers (including offline wrappers).
+export function textRoot(text) {
+  let fnv = 0x811c9dc5, a = 1, b = 0;
+  for (let i = 0; i < text.length; i++) {
+    const c = text.charCodeAt(i);
+    fnv = Math.imul(fnv ^ c, 16777619); a = (a + c) % 65521; b = (b + a) % 65521;
+  }
+  return text.length + ':' + (fnv >>> 0).toString(36) + ':' + (((b << 16) | a) >>> 0).toString(36);
+}
+export function rootAfter(root, row) {
+  return textRoot(String(root || '') + ':' + row.pos + ':' + textRoot(row.removed) + ':' + textRoot(row.inserted));
+}
+const K = new Uint32Array([
+  0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5,0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5,
+  0xd807aa98,0x12835b01,0x243185be,0x550c7dc3,0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174,
+  0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc,0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da,
+  0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7,0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967,
+  0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13,0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85,
+  0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3,0xd192e819,0xd6990624,0xf40e3585,0x106aa070,
+  0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5,0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3,
+  0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2,
+]);
+const rotate = (x, n) => (x >>> n) | (x << (32 - n));
+export function sha256(text) {
+  const bytes = new TextEncoder().encode(text);
+  const padded = new Uint8Array(Math.ceil((bytes.length + 9) / 64) * 64);
+  padded.set(bytes); padded[bytes.length] = 0x80;
+  const data = new DataView(padded.buffer), bits = bytes.length * 8;
+  data.setUint32(padded.length - 8, Math.floor(bits / 0x100000000)); data.setUint32(padded.length - 4, bits >>> 0);
+  const h = new Uint32Array([0x6a09e667,0xbb67ae85,0x3c6ef372,0xa54ff53a,0x510e527f,0x9b05688c,0x1f83d9ab,0x5be0cd19]), w = new Uint32Array(64);
+  for (let offset = 0; offset < padded.length; offset += 64) {
+    for (let i = 0; i < 16; i++) w[i] = data.getUint32(offset + i * 4);
+    for (let i = 16; i < 64; i++) {
+      const x = w[i - 15], y = w[i - 2];
+      w[i] = w[i - 16] + (rotate(x, 7) ^ rotate(x, 18) ^ (x >>> 3)) + w[i - 7] + (rotate(y, 17) ^ rotate(y, 19) ^ (y >>> 10));
+    }
+    let [a,b,c,d,e,f,g,k] = h;
+    for (let i = 0; i < 64; i++) {
+      const t1 = (k + (rotate(e, 6) ^ rotate(e, 11) ^ rotate(e, 25)) + ((e & f) ^ (~e & g)) + K[i] + w[i]) >>> 0;
+      const t2 = ((rotate(a, 2) ^ rotate(a, 13) ^ rotate(a, 22)) + ((a & b) ^ (a & c) ^ (b & c))) >>> 0;
+      k = g; g = f; f = e; e = (d + t1) >>> 0; d = c; c = b; b = a; a = (t1 + t2) >>> 0;
+    }
+    for (const [i, value] of [a,b,c,d,e,f,g,k].entries()) h[i] += value;
+  }
+  return [...h].map(x => x.toString(16).padStart(8, '0')).join('');
+}

package/dist/ledger/journal-records.mjs

@@ -0,0 +1,139 @@
+// SPDX-License-Identifier: MIT
+
+const _RAPIER_TRANSACTION_ACTOR_LIMIT = 160;
+const _RAPIER_TRANSACTION_OPERATION_LIMIT = 96;
+const _RAPIER_TRANSACTION_REQUEST_LIMIT = 160;
+
+/* Validate every row, not only the final string: a half-pair replacement can produce a whole
+	 character while leaving unencodable fragments in the ledger; two invalid rows can also repair
+	 each other. Refusal is atomic. Pre-existing damage elsewhere stays untouched and editable. */
+function _rapierTransformSplices(text, splices, inverse = false) {
+	try {
+		if (!Array.isArray(splices)) return null;
+		let value = String(text == null ? '' : text);
+		// In Unicode mode a complete pair is one scalar, outside the surrogate range.
+		const whole = text => typeof text === 'string' && !/[\uD800-\uDFFF]/u.test(text);
+		const splitsPair = at => at > 0 && at < value.length &&
+			(value.charCodeAt(at - 1) & 0xFC00) === 0xD800 &&
+			(value.charCodeAt(at) & 0xFC00) === 0xDC00;
+		const rows = inverse ? splices.slice().reverse() : splices;
+		for (const row of rows) {
+			if (!row || !Number.isSafeInteger(row.pos) || row.pos < 0 || Object.is(row.pos, -0)) return null;
+			const pos = row.pos;
+			const removed = inverse ? row.inserted : row.removed;
+			const inserted = inverse ? row.removed : row.inserted;
+			if (!whole(removed) || !whole(inserted) || pos > value.length ||
+					pos + removed.length > value.length || splitsPair(pos) || splitsPair(pos + removed.length) ||
+					value.slice(pos, pos + removed.length) !== removed) return null;
+			value = value.slice(0, pos) + inserted + value.slice(pos + removed.length);
+		}
+		return value;
+	} catch (_) { return null; }
+}
+
+function _rapierRecordSplices(entry, ledger) {
+	try {
+		if (entry && Array.isArray(entry.splices) && entry.splices.length) return entry.splices;
+		const transaction = entry && entry.transaction;
+		const targetId = String(transaction?.reverts || transaction?.reapplies || '');
+		const target = targetId && (ledger || []).find(record => record?.transaction?.id === targetId);
+		if (!target || !Array.isArray(target.splices) || !target.splices.length) return null;
+		return transaction.reverts ? target.splices.slice().reverse().map(row => ({
+			pos: row.pos, removed: row.inserted, inserted: row.removed,
+		})) : target.splices;
+	} catch (_) { return null; }
+}
+
+// A ledger record as the journal and the Notes return validate it below: plain data, nothing
+// undefined anywhere in it. A live record could carry a row whose type or order was not yet known
+// (a block just inserted, before its first render: `type: undefined`), and the validator refused
+// the whole ledger for that one field -- silently at boot, where a refused ledger is cleared, and on
+// the founder's phone as "Rapier could not be reopened: the document history could not be restored"
+// on every return from Notes (24 September). The copy is made once per record; records are frozen,
+// so it never goes stale.
+const _rapierJournalRecord = (() => {
+	const copies = new WeakMap();
+	return record => {
+		let copy = copies.get(record);
+		if (!copy) { copy = JSON.parse(JSON.stringify(record)); copies.set(record, copy); }
+		return copy;
+	};
+})();
+
+function _rapierValidLedgerRecord(record, prior, earlier, documentAuthority, maxDocumentBytes, utf8Length, allowGap = false) {
+	// Recovery records are data, not executable objects. Inspect descriptors without invoking
+	// accessors, and use an ancestor set (not a global seen set) so shared acyclic data stays valid.
+	// Iterative traversal refuses cycles without exhausting the call stack. Proxies/counters that
+	// throw are refused by the same gate rather than escaping into document recovery.
+	try {
+		const active = new Set(), pending = [[record, false]];
+		while (pending.length) {
+			const [value, leaving] = pending.pop();
+			if (leaving) { active.delete(value); continue; }
+			if (value === null || typeof value === 'string' || typeof value === 'boolean') continue;
+			if (typeof value === 'number') { if (!Number.isFinite(value)) return false; continue; }
+			if (!value || typeof value !== 'object' || active.has(value)) return false;
+			const array = Array.isArray(value), proto = Object.getPrototypeOf(value);
+			if (!array && proto !== null && (Object.getPrototypeOf(proto) !== null ||
+					Object.getOwnPropertyDescriptor(proto, 'constructor')?.value?.name !== 'Object')) return false;
+			const keys = Reflect.ownKeys(value);
+			if (array && keys.length !== value.length + 1) return false;
+			active.add(value); pending.push([value, true]);
+			for (const key of keys) {
+				if (array && key === 'length') continue;
+				if (typeof key !== 'string' || key === '__proto__' || key === 'constructor' || key === 'prototype' ||
+						(array && (!Number.isSafeInteger(Number(key)) || Number(key) < 0 ||
+							Number(key) >= value.length || String(Number(key)) !== key))) return false;
+				const field = Object.getOwnPropertyDescriptor(value, key);
+				if (!field || !Object.hasOwn(field, 'value')) return false;
+				pending.push([field.value, false]);
+			}
+		}
+		if (!record || typeof record !== 'object' ||
+				typeof record.beforeHash !== 'string' || !record.beforeHash.length ||
+				typeof record.afterHash !== 'string' || !record.afterHash.length || record.beforeHash === record.afterHash) return false;
+		const own = Array.isArray(record.splices) && record.splices.length;
+		const navigation = !!(record.transaction?.reverts || record.transaction?.reapplies);
+		if ((!own && !navigation) || (own && record.splices.length > 64) ||
+				(record.transaction?.reverts && record.transaction?.reapplies)) return false;
+		const splices = _rapierRecordSplices(record, earlier);
+		if (!splices || splices.length > 64 || !splices.every(row =>
+				row && Number.isSafeInteger(row.pos) && row.pos >= 0 && !Object.is(row.pos, -0) &&
+				typeof row.removed === 'string' && typeof row.inserted === 'string' &&
+				!/[\uD800-\uDFFF]/u.test(row.removed) && !/[\uD800-\uDFFF]/u.test(row.inserted) &&
+				utf8Length(row.removed) <= maxDocumentBytes &&
+				utf8Length(row.inserted) <= maxDocumentBytes)) return false;
+		const transaction = record.transaction;
+		const nullableText = (value, limit, empty = true) => value === null ||
+			(typeof value === 'string' && value.length <= limit && (empty || value.length > 0));
+		if (!transaction || typeof transaction.id !== 'string' || !transaction.id.length ||
+				transaction.id.length > 256 || !Array.isArray(earlier) ||
+				earlier.some(row => row?.transaction?.id === transaction.id) ||
+				typeof transaction.documentAuthority !== 'string' ||
+				transaction.documentAuthority !== documentAuthority ||
+				(transaction.transport !== 'platform' && transaction.transport !== 'webmcp') ||
+				typeof transaction.operation !== 'string' || !transaction.operation.length ||
+				transaction.operation.length > _RAPIER_TRANSACTION_OPERATION_LIMIT ||
+				!nullableText(transaction.requestId, _RAPIER_TRANSACTION_REQUEST_LIMIT) ||
+				!nullableText(transaction.sourceTransactionId, _RAPIER_TRANSACTION_REQUEST_LIMIT) ||
+				!nullableText(transaction.parent, 256, false) ||
+				!nullableText(transaction.reverts, 256, false) ||
+				!nullableText(transaction.reapplies, 256, false) ||
+				!Number.isSafeInteger(transaction.createdAt) || transaction.createdAt < 0 ||
+				!Array.isArray(transaction.affectedBlockIds) || transaction.affectedBlockIds.length > 64 ||
+				!transaction.affectedBlockIds.every(id => Number.isSafeInteger(id) && id >= 0) ||
+				!Number.isSafeInteger(transaction.revision) || transaction.revision < 1 ||
+				!Number.isSafeInteger(transaction.baseRevision) ||
+				transaction.baseRevision + 1 !== transaction.revision ||
+				(prior && (transaction.revision <= prior.transaction.revision ||
+					(transaction.baseRevision === prior.transaction.revision
+						? (transaction.parent !== prior.transaction.id || record.beforeHash !== prior.afterHash)
+						: (!allowGap || transaction.baseRevision <= prior.transaction.revision))))) return false;
+		return !!transaction.actor && typeof transaction.actor.kind === 'string' &&
+			/^(?:human|agent|system)$/.test(transaction.actor.kind) &&
+			typeof transaction.actor.id === 'string' && transaction.actor.id.length > 0 &&
+			transaction.actor.id.length <= _RAPIER_TRANSACTION_ACTOR_LIMIT;
+	} catch (_) { return false; }
+}
+
+export { _RAPIER_TRANSACTION_ACTOR_LIMIT, _RAPIER_TRANSACTION_OPERATION_LIMIT, _RAPIER_TRANSACTION_REQUEST_LIMIT, _rapierTransformSplices, _rapierRecordSplices, _rapierValidLedgerRecord, _rapierJournalRecord};