rapier-html 1.1.88 → 1.1.91

package/dist/ledger/journal-records.mjs

@@ -31,19 +31,203 @@ function _rapierTransformSplices(text, splices, inverse = false) {
 	} catch (_) { return null; }
 }
 
+function _rapierPlainLedgerData(record) {
+	try {
+		const active = new Set(), pending = [[record, false]];
+		while (pending.length) {
+			const [value, leaving] = pending.pop();
+			if (leaving) { active.delete(value); continue; }
+			if (value === null || typeof value === 'boolean') continue;
+			if (typeof value === 'string') { if (/[\uD800-\uDFFF]/u.test(value)) return false; continue; }
+			if (typeof value === 'number') { if (!Number.isFinite(value) || Object.is(value, -0)) return false; continue; }
+			if (!value || typeof value !== 'object' || active.has(value)) return false;
+			const array = Array.isArray(value), proto = Object.getPrototypeOf(value);
+			if (!array && proto !== null && (Object.getPrototypeOf(proto) !== null ||
+				Object.getOwnPropertyDescriptor(proto, 'constructor')?.value?.name !== 'Object')) return false;
+			const keys = Reflect.ownKeys(value);
+			if (array && keys.length !== value.length + 1) return false;
+			active.add(value); pending.push([value, true]);
+			for (const key of keys) {
+				if (array && key === 'length') continue;
+				if (typeof key !== 'string' || ['__proto__', 'constructor', 'prototype'].includes(key) ||
+					(array && (!Number.isSafeInteger(Number(key)) || Number(key) < 0 || Number(key) >= value.length || String(Number(key)) !== key))) return false;
+				const field = Object.getOwnPropertyDescriptor(value, key);
+				if (!field || !Object.hasOwn(field, 'value') || !field.enumerable) return false;
+				pending.push([field.value, false]);
+			}
+		}
+		return true;
+	} catch (_) { return false; }
+}
+
+const _rapierMetadataValue = (key, value) => key === 'filename'
+	? typeof value === 'string' && value.trim().length > 0 && value.length <= 512 &&
+		!/[<>"\x00-\x1f\x7f/\\\u200b-\u200f\u2028-\u202e\u2066-\u2069\ufeff\uD800-\uDFFF]/u.test(value) && value !== '.' && value !== '..'
+	: key === 'docKind' && ['markdown', 'text', 'code'].includes(value);
+
+function _rapierValidMetadata(value) {
+	return _rapierPlainLedgerData(value) && value && !Array.isArray(value) &&
+		Object.keys(value).length === 2 && ['filename', 'docKind'].every(key => Object.hasOwn(value, key) && _rapierMetadataValue(key, value[key]));
+}
+
+function _rapierValidMetadataEffect(effect) {
+	return _rapierPlainLedgerData(effect) && effect && !Array.isArray(effect) &&
+		Object.keys(effect).length > 0 && Object.keys(effect).every(key => {
+			const pair = effect[key];
+			return pair && !Array.isArray(pair) && Object.keys(pair).length === 2 &&
+				Object.hasOwn(pair, 'before') && Object.hasOwn(pair, 'after') &&
+				_rapierMetadataValue(key, pair.before) && _rapierMetadataValue(key, pair.after);
+		});
+}
+
+function _rapierMetadataDelta(before, after, {assign = []} = {}) {
+	if (!_rapierValidMetadata(before) || !_rapierValidMetadata(after)) return null;
+	const effect = {};
+	for (const key of ['filename', 'docKind']) if (before[key] !== after[key] || assign.includes(key)) effect[key] = {before: before[key], after: after[key]};
+	return Object.keys(effect).length ? effect : null;
+}
+
+function _rapierTransformMetadata(value, effect, inverse = false) {
+	if (!_rapierValidMetadata(value) || (effect != null && !_rapierValidMetadataEffect(effect))) return null;
+	const next = {...value};
+	for (const [key, pair] of Object.entries(effect || {})) {
+		if (next[key] !== pair[inverse ? 'after' : 'before']) return null;
+		next[key] = pair[inverse ? 'before' : 'after'];
+	}
+	return next;
+}
+
+// An origin binds transported placement to exact authored rows and their causal basis.
+function _rapierValidAuthored(origin) {
+	if (!_rapierPlainLedgerData(origin) || !origin || Array.isArray(origin) ||
+		Object.keys(origin).length !== 3 || !Array.isArray(origin.basis) ||
+		new Set(origin.basis).size !== origin.basis.length || origin.basis.some((id, index) => index && origin.basis[index - 1] >= id) ||
+		!origin.basis.every(id => typeof id === 'string' && id.length > 0 && id.length <= 256) ||
+		typeof origin.source !== 'string' || !/^[a-f0-9]{64}$/.test(origin.source) ||
+		!Array.isArray(origin.splices) || origin.splices.length > 64) return false;
+	return origin.splices.every(row => row && !Array.isArray(row) && Object.keys(row).length === 3 &&
+		Number.isSafeInteger(row.pos) && row.pos >= 0 && !Object.is(row.pos, -0) &&
+		typeof row.removed === 'string' && typeof row.inserted === 'string' &&
+		!/[\uD800-\uDFFF]/u.test(row.removed) && !/[\uD800-\uDFFF]/u.test(row.inserted));
+}
+
 function _rapierRecordSplices(entry, ledger) {
 	try {
-		if (entry && Array.isArray(entry.splices) && entry.splices.length) return entry.splices;
-		const transaction = entry && entry.transaction;
-		const targetId = String(transaction?.reverts || transaction?.reapplies || '');
-		const target = targetId && (ledger || []).find(record => record?.transaction?.id === targetId);
-		if (!target || !Array.isArray(target.splices) || !target.splices.length) return null;
-		return transaction.reverts ? target.splices.slice().reverse().map(row => ({
-			pos: row.pos, removed: row.inserted, inserted: row.removed,
-		})) : target.splices;
+		if (entry && Array.isArray(entry.splices)) return entry.splices;
+		const tx = entry?.transaction, targetId = tx?.reverts || tx?.reapplies;
+		const prior = (ledger || []).filter(record => record?.transaction?.revision < tx?.revision);
+		const target = targetId && prior.find(record => record?.transaction?.id === targetId);
+		if (!target) return null;
+		const rows = _rapierRecordSplices(target, prior);
+		if (!rows) return null;
+		return tx.reverts ? rows.slice().reverse().map(row => ({pos: row.pos, removed: row.inserted, inserted: row.removed})) : rows;
 	} catch (_) { return null; }
 }
 
+function _rapierRecordMetadata(entry, ledger) {
+	try {
+		if (Object.hasOwn(entry, 'metadata')) return _rapierValidMetadataEffect(entry.metadata) ? entry.metadata : undefined;
+		// An expanded record owns its complete effect; only compact navigation inherits one.
+		if (Array.isArray(entry.splices)) return null;
+		const tx = entry.transaction, targetId = tx.reverts || tx.reapplies;
+		const prior = (ledger || []).filter(record => record?.transaction?.revision < tx.revision);
+		const target = targetId && prior.find(record => record?.transaction?.id === targetId);
+		if (!target) return undefined;
+		const effect = _rapierRecordMetadata(target, prior);
+		if (effect == null) return effect;
+		return tx.reverts ? Object.fromEntries(Object.entries(effect).map(([key, pair]) =>
+			[key, {before: pair.after, after: pair.before}])) : effect;
+	} catch (_) { return undefined; }
+}
+
+// Active inverses suppress their targets. Reversing an inverse restores its targets,
+// including assignments hidden by later choices. Nothing outside these records is retained.
+function _rapierHistoryEffects(records, visit = null) {
+	try {
+		if (!Array.isArray(records)) return {ok: false};
+		const nodes = new Map(), references = new Map();
+		const update = (target, delta) => {
+			const pending = [[target, delta]];
+			while (pending.length) {
+				const [id, change] = pending.pop(), node = nodes.get(id), was = node.active;
+				node.blockers += change;
+				if (node.blockers < 0) throw Error('effect');
+				node.active = node.blockers === 0;
+				if (was !== node.active) for (const ref of node.references) pending.push([ref, node.active ? 1 : -1]);
+			}
+		};
+		const lastUndo = new Map();
+		for (const record of records) {
+			const tx = record?.transaction;
+			if (!tx || typeof tx.id !== 'string' || !tx.id || nodes.has(tx.id) || (tx.reverts && tx.reapplies)) return {ok: false};
+			const supplied = tx.sourceTransactionIds || (tx.sourceTransactionId ? [tx.sourceTransactionId] : []);
+			if (!Array.isArray(supplied) || new Set(supplied).size !== supplied.length ||
+				(tx.sourceTransactionIds && tx.sourceTransactionId && (supplied.length !== 1 || supplied[0] !== tx.sourceTransactionId))) return {ok: false};
+			let refs = supplied;
+			if (tx.reverts || tx.reapplies) {
+				const target = tx.reverts || tx.reapplies;
+				if (!nodes.has(target) || (supplied.length && (supplied.length !== 1 || supplied[0] !== target))) return {ok: false};
+				if (tx.reverts) refs = [target];
+				else {
+					const undo = lastUndo.get(target);
+					if (!undo || !nodes.get(undo).active) return {ok: false};
+					refs = [undo];
+				}
+			}
+			if (refs.some(id => typeof id !== 'string' || !nodes.get(id)?.active)) return {ok: false};
+			nodes.set(tx.id, {active: true, blockers: 0, references: refs}); references.set(tx.id, refs.slice());
+			for (const ref of refs) update(ref, 1);
+			if (tx.reverts) lastUndo.set(tx.reverts, tx.id);
+			if (visit) visit(record, nodes, refs);
+		}
+		const effectiveActIds = [...nodes].filter(([, node]) => node.active).map(([id]) => id);
+		return {ok: true, effectiveActIds, active: new Set(effectiveActIds), references};
+	} catch (_) { return {ok: false}; }
+}
+
+function _rapierMetadataState(initial, records, effects = _rapierHistoryEffects(records)) {
+	if (!_rapierValidMetadata(initial) || !effects.ok) return null;
+	const state = {...initial};
+	for (const record of records) if (effects.active.has(record.transaction.id) && !effects.references.get(record.transaction.id)?.length) {
+		const effect = _rapierRecordMetadata(record, records);
+		if (effect === undefined) return null;
+		for (const [key, pair] of Object.entries(effect || {})) state[key] = pair.after;
+	}
+	return state;
+}
+
+// Prove each recorded transition and each inverse's semantic result, not only the final values.
+function _rapierReplayMetadata(initial, records) {
+	if (!_rapierValidMetadata(initial)) return null;
+	let state = {...initial};
+	const earlier = [], assignments = {filename: [], docKind: []};
+	const effects = _rapierHistoryEffects(records, (record, nodes, refs) => {
+		const effect = _rapierRecordMetadata(record, earlier);
+		if (effect === undefined) throw Error('metadata');
+		state = _rapierTransformMetadata(state, effect);
+		if (!state) throw Error('metadata');
+		if (!refs.length) for (const [key, pair] of Object.entries(effect || {}))
+			assignments[key].push({id: record.transaction.id, value: pair.after});
+		for (const key of ['filename', 'docKind']) {
+			let expected = initial[key];
+			for (let i = assignments[key].length - 1; i >= 0; i--) if (nodes.get(assignments[key][i].id).active) {
+				expected = assignments[key][i].value; break;
+			}
+			if (state[key] !== expected) throw Error('metadata_effect');
+		}
+		earlier.push(record);
+	});
+	return effects.ok ? state : null;
+}
+
+function _rapierHasHistoryEffect(record, earlier = []) {
+	const tx = record?.transaction;
+	if (!tx || !(tx.reverts || tx.reapplies || tx.sourceTransactionId || tx.sourceTransactionIds?.length)) return false;
+	let id = tx.id;
+	if (!id) { id = 'candidate'; while (earlier.some(row => row?.transaction?.id === id)) id += ':'; }
+	return _rapierHistoryEffects([...earlier, {...record, transaction: {...tx, id}}]).ok;
+}
+
 // A ledger record as the journal and the Notes return validate it below: plain data, nothing
 // undefined anywhere in it. A live record could carry a row whose type or order is not yet known (a
 // block just inserted, before its first render: `type: undefined`), and the validator would refuse
@@ -65,48 +249,30 @@ function _rapierValidLedgerRecord(record, prior, earlier, documentAuthority, max
 	// Iterative traversal refuses cycles without exhausting the call stack. Proxies/counters that
 	// throw are refused by the same gate rather than escaping into document recovery.
 	try {
-		const active = new Set(), pending = [[record, false]];
-		while (pending.length) {
-			const [value, leaving] = pending.pop();
-			if (leaving) { active.delete(value); continue; }
-			if (value === null || typeof value === 'string' || typeof value === 'boolean') continue;
-			if (typeof value === 'number') { if (!Number.isFinite(value)) return false; continue; }
-			if (!value || typeof value !== 'object' || active.has(value)) return false;
-			const array = Array.isArray(value), proto = Object.getPrototypeOf(value);
-			if (!array && proto !== null && (Object.getPrototypeOf(proto) !== null ||
-					Object.getOwnPropertyDescriptor(proto, 'constructor')?.value?.name !== 'Object')) return false;
-			const keys = Reflect.ownKeys(value);
-			if (array && keys.length !== value.length + 1) return false;
-			active.add(value); pending.push([value, true]);
-			for (const key of keys) {
-				if (array && key === 'length') continue;
-				if (typeof key !== 'string' || key === '__proto__' || key === 'constructor' || key === 'prototype' ||
-						(array && (!Number.isSafeInteger(Number(key)) || Number(key) < 0 ||
-							Number(key) >= value.length || String(Number(key)) !== key))) return false;
-				const field = Object.getOwnPropertyDescriptor(value, key);
-				if (!field || !Object.hasOwn(field, 'value')) return false;
-				pending.push([field.value, false]);
-			}
-		}
+		if (!_rapierPlainLedgerData(record) || (Object.hasOwn(record, 'authored') && !_rapierValidAuthored(record.authored))) return false;
 		if (!record || typeof record !== 'object' ||
 				typeof record.beforeHash !== 'string' || !record.beforeHash.length ||
-				typeof record.afterHash !== 'string' || !record.afterHash.length || record.beforeHash === record.afterHash) return false;
-		const own = Array.isArray(record.splices) && record.splices.length;
-		const navigation = !!(record.transaction?.reverts || record.transaction?.reapplies);
+				typeof record.afterHash !== 'string' || !record.afterHash.length) return false;
+		const own = Array.isArray(record.splices), navigation = !!(record.transaction?.reverts || record.transaction?.reapplies);
 		if ((!own && !navigation) || (own && record.splices.length > 64) ||
-				(record.transaction?.reverts && record.transaction?.reapplies)) return false;
-		const splices = _rapierRecordSplices(record, earlier);
+			(record.transaction?.reverts && record.transaction?.reapplies)) return false;
+		const splices = _rapierRecordSplices(record, earlier), metadata = _rapierRecordMetadata(record, earlier);
+		const semantic = _rapierHasHistoryEffect(record, earlier);
+		if (metadata === undefined || (!splices?.length && !Object.values(metadata || {}).some(pair => pair.before !== pair.after) && !semantic) ||
+			(record.beforeHash === record.afterHash && splices?.length) ||
+			(record.beforeHash !== record.afterHash && !splices?.length) ||
+			((record.transaction?.sourceTransactionId || record.transaction?.sourceTransactionIds?.length || navigation) && !semantic)) return false;
 		if (!splices || splices.length > 64 || !splices.every(row =>
 				row && Number.isSafeInteger(row.pos) && row.pos >= 0 && !Object.is(row.pos, -0) &&
 				typeof row.removed === 'string' && typeof row.inserted === 'string' &&
 				!/[\uD800-\uDFFF]/u.test(row.removed) && !/[\uD800-\uDFFF]/u.test(row.inserted) &&
 				utf8Length(row.removed) <= maxDocumentBytes &&
 				utf8Length(row.inserted) <= maxDocumentBytes)) return false;
+		if (record.authored && record.authored.splices.some(row => utf8Length(row.removed) > maxDocumentBytes || utf8Length(row.inserted) > maxDocumentBytes)) return false;
 		const transaction = record.transaction;
 		const nullableText = (value, limit, empty = true) => value === null ||
 			(typeof value === 'string' && value.length <= limit && (empty || value.length > 0));
-		// A grouped agent contribution's optional fields, bounded like the identities beside them: a name of 1 to 120 characters, a
-		// revision, at most 500 source identities (the journal the kernel retains) of 1 to 160, and a hosted row's identity of 1 to 256.
+		// Identity fields are bounded individually; durable history has no record-count limit.
 		const optional = (value, valid) => value === undefined || valid(value);
 		const identity = (value, limit) => typeof value === 'string' && value.length > 0 && value.length <= limit;
 		if (!transaction || typeof transaction.id !== 'string' || !transaction.id.length ||
@@ -118,17 +284,21 @@ function _rapierValidLedgerRecord(record, prior, earlier, documentAuthority, max
 				typeof transaction.operation !== 'string' || !transaction.operation.length ||
 				transaction.operation.length > _RAPIER_TRANSACTION_OPERATION_LIMIT ||
 				!nullableText(transaction.requestId, _RAPIER_TRANSACTION_REQUEST_LIMIT) ||
-				!nullableText(transaction.sourceTransactionId, _RAPIER_TRANSACTION_REQUEST_LIMIT) ||
+				!nullableText(transaction.sourceTransactionId, 256, false) ||
+				!optional(transaction.label, value => nullableText(value, 120)) ||
+				!optional(transaction.turnBaseRevision, value => Number.isSafeInteger(value) && value >= 0) ||
+				!optional(transaction.turnId, value => value === null || identity(value, 160)) ||
+				!optional(transaction.turnLabel, value => value === null || identity(value, 120)) ||
 				!optional(transaction.contribution, value => identity(value, 120)) ||
 				!optional(transaction.contributionBaseRevision, value => Number.isSafeInteger(value) && value >= 0 && !Object.is(value, -0)) ||
-				!optional(transaction.sourceTransactionIds, value => Array.isArray(value) && value.length <= 500 &&
-					value.every(id => identity(id, _RAPIER_TRANSACTION_REQUEST_LIMIT))) ||
+				!optional(transaction.sourceTransactionIds, value => Array.isArray(value) && value.length > 0 &&
+					new Set(value).size === value.length && value.every(id => identity(id, 256))) ||
 				!optional(transaction.remoteTransactionId, value => identity(value, 256)) ||
 				!nullableText(transaction.parent, 256, false) ||
 				!nullableText(transaction.reverts, 256, false) ||
 				!nullableText(transaction.reapplies, 256, false) ||
-				!Number.isSafeInteger(transaction.createdAt) || transaction.createdAt < 0 ||
-				!Array.isArray(transaction.affectedBlockIds) || transaction.affectedBlockIds.length > 64 ||
+				!(transaction.createdAt === null || (Number.isSafeInteger(transaction.createdAt) && transaction.createdAt >= 0)) ||
+				!Array.isArray(transaction.affectedBlockIds) ||
 				!transaction.affectedBlockIds.every(id => Number.isSafeInteger(id) && id >= 0) ||
 				!Number.isSafeInteger(transaction.revision) || transaction.revision < 1 ||
 				!Number.isSafeInteger(transaction.baseRevision) ||
@@ -140,8 +310,9 @@ function _rapierValidLedgerRecord(record, prior, earlier, documentAuthority, max
 		return !!transaction.actor && typeof transaction.actor.kind === 'string' &&
 			/^(?:human|agent|system)$/.test(transaction.actor.kind) &&
 			typeof transaction.actor.id === 'string' && transaction.actor.id.length > 0 &&
-			transaction.actor.id.length <= _RAPIER_TRANSACTION_ACTOR_LIMIT;
+			transaction.actor.id.length <= _RAPIER_TRANSACTION_ACTOR_LIMIT &&
+			optional(transaction.actor.name, value => nullableText(value, 120, false));
 	} catch (_) { return false; }
 }
 
-export { _RAPIER_TRANSACTION_ACTOR_LIMIT, _RAPIER_TRANSACTION_OPERATION_LIMIT, _RAPIER_TRANSACTION_REQUEST_LIMIT, _rapierTransformSplices, _rapierRecordSplices, _rapierValidLedgerRecord, _rapierJournalRecord};
+export { _rapierValidAuthored, _RAPIER_TRANSACTION_ACTOR_LIMIT, _RAPIER_TRANSACTION_OPERATION_LIMIT, _RAPIER_TRANSACTION_REQUEST_LIMIT, _rapierTransformSplices, _rapierRecordSplices, _rapierValidLedgerRecord, _rapierJournalRecord, _rapierValidMetadata, _rapierValidMetadataEffect, _rapierMetadataDelta, _rapierTransformMetadata, _rapierRecordMetadata, _rapierHistoryEffects, _rapierMetadataState, _rapierReplayMetadata, _rapierHasHistoryEffect};

package/dist/ledger/transport.mjs

@@ -0,0 +1,318 @@
+// SPDX-License-Identifier: MIT
+// Paired source placement, shared by live editing and canonical-history proof.
+import {_rapierTransformSplices, _rapierValidAuthored, _rapierHistoryEffects} from './journal-records.mjs';
+import {sha256} from './hash.mjs';
+import {canonicalJSON} from './data.mjs';
+
+const whole = text => typeof text === 'string' && !/[\uD800-\uDFFF]/u.test(text);
+function admitted(rows) {
+  if (!Array.isArray(rows)) throw new RangeError('source_edits_invalid');
+  let end = 0;
+  for (const row of rows) {
+    if (!row || !Number.isSafeInteger(row.at) || row.at < end || Object.is(row.at, -0) ||
+        !Number.isSafeInteger(row.remove) || row.remove < 0 || Object.is(row.remove, -0) ||
+        !Number.isSafeInteger(row.at + row.remove) || !whole(row.insert)) throw new RangeError('source_edits_invalid');
+    end = row.at + row.remove;
+  }
+}
+function emit(rows, at, remove, insert = '') {
+  if (!remove && !insert) return;
+  const prior = rows.at(-1);
+  if (prior && prior.at + prior.remove === at && (!insert || !prior.remove)) {
+    prior.remove += remove; prior.insert += insert;
+  } else rows.push({at, remove, insert});
+}
+
+// Sweep original-source boundaries. Each counter names a coordinate in one input's
+// resulting document; concurrent insertions never enter the other input's removals.
+export function transformPair(left, right, leftFirst) {
+  admitted(left); admitted(right);
+  const points = [...new Set([0, ...left.flatMap(row => [row.at, row.at + row.remove]),
+    ...right.flatMap(row => [row.at, row.at + row.remove])])].sort((a, b) => a - b);
+  const out = [[], []], rows = [left, right], index = [0, 0], position = [0, 0], deletingUntil = [0, 0];
+  for (let point = 0; point < points.length; point++) {
+    const at = points[point], insertions = ['', ''];
+    for (let side = 0; side < 2; side++) while (rows[side][index[side]]?.at === at) {
+      const row = rows[side][index[side]++];
+      insertions[side] += row.insert;
+      deletingUntil[side] = Math.max(deletingUntil[side], row.at + row.remove);
+    }
+    for (const side of leftFirst ? [0, 1] : [1, 0]) if (insertions[side]) {
+      emit(out[side], position[1 - side], 0, insertions[side]);
+      position[side] += insertions[side].length;
+    }
+    const length = (points[point + 1] ?? at) - at;
+    for (let side = 0; side < 2; side++) {
+      if (deletingUntil[side] > at && deletingUntil[1 - side] <= at)
+        emit(out[side], position[1 - side], length);
+    }
+    for (let side = 0; side < 2; side++) if (deletingUntil[side] <= at) position[side] += length;
+  }
+  return {left: out[0], right: out[1]};
+}
+
+function applyBatch(text, rows) {
+  const exact = rows.slice().reverse().map(row => ({pos: row.at,
+    removed: text.slice(row.at, row.at + row.remove), inserted: row.insert}));
+  if (rows.some(row => row.at + row.remove > text.length)) throw new RangeError('source_edits_invalid');
+  const after = _rapierTransformSplices(text, exact);
+  if (after === null) throw new RangeError('source_edits_invalid');
+  return {text: after, splices: exact};
+}
+
+// Transport one sequential canonical act and every crossed record together. The
+// reciprocal path is checked against exact source, rather than only equal end text.
+// Canonical transport refuses deleting any authored unit already removed elsewhere.
+export function transposeRecord(base, splices, id, records) {
+  if (typeof base !== 'string' || !Array.isArray(splices) || typeof id !== 'string' || !Array.isArray(records))
+    throw new RangeError('canonical_transport_invalid');
+  let source = base, current = base;
+  let crossed = records.map(record => ({...record, splices: record.splices.map(row => ({...row}))}));
+  for (const record of crossed) {
+    const next = _rapierTransformSplices(current, record.splices);
+    if (next === null) throw new RangeError('canonical_transport_invalid');
+    current = next;
+  }
+  const moved = [], sourceIndices = [];
+  for (const [sourceIndex, row] of splices.entries()) {
+    const submitted = _rapierTransformSplices(source, [row]);
+    if (submitted === null) throw new RangeError('canonical_transport_invalid');
+    let left = [{at: row.pos, remove: row.removed.length, insert: row.inserted}];
+    const reciprocal = [];
+    for (const record of crossed) {
+      const steps = [];
+      for (const other of record.splices) {
+        const pair = transformPair(left, [{at: other.pos, remove: other.removed.length, insert: other.inserted}], id < record.transaction.id);
+        left = pair.left; steps.push(pair.right);
+      }
+      reciprocal.push({record, steps});
+    }
+    if (left.reduce((sum, part) => sum + part.remove, 0) !== row.removed.length ||
+        left.map(part => part.insert).join('') !== row.inserted) throw new RangeError('canonical_act_rebase_conflict');
+    const applied = applyBatch(current, left);
+    let replay = submitted;
+    crossed = reciprocal.map(({record, steps}) => {
+      const transported = [];
+      for (const step of steps) {
+        const value = applyBatch(replay, step); replay = value.text; transported.push(...value.splices);
+      }
+      const before = record.splices.reduce((sum, part) => sum + part.removed.length, 0);
+      if (transported.reduce((sum, part) => sum + part.removed.length, 0) !== before ||
+          transported.map(part => part.inserted).join('') !== record.splices.map(part => part.inserted).join(''))
+        throw new RangeError('canonical_act_rebase_conflict');
+      return {...record, splices: transported};
+    });
+    if (replay !== applied.text) throw new RangeError('canonical_transport_invalid');
+    moved.push(...applied.splices); sourceIndices.push(...applied.splices.map(() => sourceIndex)); current = applied.text; source = submitted;
+  }
+  return {splices: moved, sourceIndices, against: crossed, text: current};
+}
+
+// Hosted and editor callers already own a reciprocal transport log. Convert only
+// its admitted exact source to records, then prove canonical-unit preservation.
+export function transposeSource(base, splices, client, log) {
+  let source = base;
+  const records = log.map(entry => {
+    const applied = applyBatch(source, entry.splices); source = applied.text;
+    return {transaction: {id: entry.client}, splices: applied.splices};
+  });
+  return transposeRecord(base, splices, client, records);
+}
+
+// The frontier names only causal maxima. Linear history needs one predecessor,
+// and concurrent predecessors remain separate until an act observes both.
+function authoredFrontier(records, visit = null) {
+  const dependencies = new Map(), frontier = new Set();
+  for (const record of records) {
+    const id = record.transaction.id, basis = record.authored?.basis;
+    if (visit) visit(record, basis ?? [...frontier].sort());
+    if (!basis) { dependencies.set(id, [...frontier]); frontier.clear(); }
+    else {
+      const pending = [...basis], seen = new Set();
+      while (pending.length) {
+        const prior = pending.pop();
+        if (seen.has(prior)) continue;
+        if (!dependencies.has(prior)) throw new RangeError('canonical_origin_invalid');
+        seen.add(prior); frontier.delete(prior); pending.push(...dependencies.get(prior));
+      }
+      dependencies.set(id, basis);
+    }
+    frontier.add(id);
+  }
+  return [...frontier].sort();
+}
+
+export function authoredBasis(records) { return authoredFrontier(records); }
+
+export function authoredPlacements(base, records) {
+  const origins = new Map(); let source = base;
+  authoredFrontier(records, (record, basis) => {
+    origins.set(record.transaction.id, record.authored ?? authoredPlacement(source, record.splices, basis));
+    source = _rapierTransformSplices(source, record.splices);
+    if (source === null) throw new RangeError('canonical_origin_invalid');
+  });
+  return origins;
+}
+
+// Immutable authored placement stays on its own act. Basis IDs refer only to this
+// canonical history; no source snapshot or duplicate history is stored.
+export function authoredPlacement(source, splices, basis) {
+  const origin = {basis: basis.slice().sort(), source: sha256(source), splices: splices.map(row => ({...row}))};
+  if (!_rapierValidAuthored(origin) || _rapierTransformSplices(source, splices) === null)
+    throw new RangeError('canonical_origin_invalid');
+  return origin;
+}
+
+// Reconstruct an authored view from the same records, then prove its exact physical
+// placement. Equality of resulting text alone cannot prove a repeated-text anchor.
+function authoredReplay(base, records, append = null) {
+  const origins = new Map(), byId = new Map(), originalOrder = [], cache = new Map(), frontier = new Set();
+  const effects = _rapierHistoryEffects(append ? [...records, append] : records);
+  if (!effects.ok) throw new RangeError('canonical_origin_invalid');
+  let source = base;
+  for (const record of append ? [...records, append] : records) {
+    const id = record.transaction.id;
+    if (byId.has(id)) throw new RangeError('canonical_origin_invalid');
+    const origin = Object.hasOwn(record, 'authored') ? record.authored : authoredPlacement(source, record.splices, [...frontier]);
+    if (!_rapierValidAuthored(origin) || origin.basis.some(prior => !byId.has(prior)))
+      throw new RangeError('canonical_origin_invalid');
+    const seen = new Set(), pending = [...origin.basis];
+    while (pending.length) {
+      const prior = pending.pop(); if (seen.has(prior)) continue;
+      seen.add(prior); pending.push(...origins.get(prior).basis);
+    }
+    if (origin.basis.some(id => origin.basis.some(other => other !== id && (() => {
+      const pending = [...origins.get(other).basis], visited = new Set();
+      while (pending.length) { const next = pending.pop(); if (next === id) return true;
+        if (!visited.has(next)) { visited.add(next); pending.push(...origins.get(next).basis); } }
+      return false;
+    })()))) throw new RangeError('canonical_origin_invalid');
+    const refs = effects.references.get(id) || [];
+    if (refs.some(id => !seen.has(id))) throw new RangeError('canonical_origin_invalid');
+    for (const prior of seen) frontier.delete(prior); frontier.add(id);
+    origins.set(id, origin); byId.set(id, record); originalOrder.push(id);
+    if (record !== append) {
+      source = _rapierTransformSplices(source, record.splices);
+      if (source === null) throw new RangeError('canonical_origin_invalid');
+    }
+  }
+  const same = (a, b) => canonicalJSON(a) === canonicalJSON(b);
+  const ordered = (ids, selected = null) => {
+    const order = [], known = new Set(ids), waiting = new Map(), dependents = new Map(), ready = [];
+    const rank = id => selected ? Number(selected.has(id)) : Number(origins.get(id).splices.some(row => row.removed.length));
+    const compare = (a, b) => rank(a) - rank(b) || (a < b ? -1 : a > b ? 1 : 0);
+    const push = id => { let at = ready.length; ready.push(id);
+      while (at) { const parent = (at - 1) >> 1; if (compare(ready[parent], id) <= 0) break;
+        ready[at] = ready[parent]; at = parent; } ready[at] = id; };
+    const pop = () => { const first = ready[0], last = ready.pop(); if (ready.length) {
+      let at = 0; while (at * 2 + 1 < ready.length) { let child = at * 2 + 1;
+        if (child + 1 < ready.length && compare(ready[child + 1], ready[child]) < 0) child++;
+        if (compare(last, ready[child]) <= 0) break; ready[at] = ready[child]; at = child;
+      } ready[at] = last; } return first; };
+    for (const id of ids) {
+      const basis = origins.get(id)?.basis;
+      if (!basis || basis.some(prior => !known.has(prior))) throw new RangeError('canonical_origin_invalid');
+      waiting.set(id, basis.length);
+      for (const prior of basis) { if (!dependents.has(prior)) dependents.set(prior, []); dependents.get(prior).push(id); }
+      if (!basis.length) push(id);
+    }
+    while (ready.length) {
+      const id = pop(); order.push(id);
+      for (const next of dependents.get(id) || []) { waiting.set(next, waiting.get(next) - 1); if (!waiting.get(next)) push(next); }
+    }
+    if (order.length !== ids.length) throw new RangeError('canonical_origin_invalid');
+    return order;
+  };
+  const closureOf = basis => {
+    const closure = new Set(), pending = [...basis];
+    while (pending.length) { const prior = pending.pop(); if (closure.has(prior)) continue;
+      closure.add(prior); pending.push(...origins.get(prior).basis); }
+    return closure;
+  };
+  const canonicalOrder = ordered(originalOrder), firstExplicit = (append ? [...records, append] : records).findIndex(record => Object.hasOwn(record, 'authored'));
+  const implicitPrefix = firstExplicit < 0 ? records.length : firstExplicit;
+  const materialize = order => {
+    const key = canonicalJSON(order);
+    if (cache.has(key)) return cache.get(key);
+    const placed = [], ids = new Set(), sourceIndices = new Map(); let text = base;
+    if (!order.length) { const empty = {text, records: [], sourceIndices}; cache.set(key, empty); return empty; }
+    // An implicit linear prefix already is its authored view. Replay it once;
+    // reconstructing every growing prefix adds no evidence.
+    let prefix = 0;
+    while (prefix < order.length && prefix < implicitPrefix && order[prefix] === originalOrder[prefix]) {
+      const record = byId.get(order[prefix]); text = _rapierTransformSplices(text, record.splices);
+      if (text === null) throw new RangeError('canonical_origin_invalid');
+      placed.push(record); ids.add(order[prefix++]);
+      if (record.derivedCommentIndex != null) sourceIndices.set(record.transaction.id, record.splices.map((_, index) => index));
+    }
+    for (const id of order.slice(prefix)) {
+      const original = byId.get(id), origin = origins.get(id);
+      if (!original || ids.has(id) || origin.basis.some(prior => !ids.has(prior)))
+        throw new RangeError('canonical_origin_invalid');
+      const closure = closureOf(origin.basis), basisOrder = canonicalOrder.filter(prior => closure.has(prior)), basis = materialize(basisOrder);
+      if (sha256(basis.text) !== origin.source) throw new RangeError('canonical_origin_invalid');
+      // Reconstruct causal context before crossing it. Physical gaps may already
+      // have collapsed under a deletion; they cannot choose concurrent ordering.
+      const contextOrder = canonicalOrder.filter(prior => ids.has(prior)), context = same(contextOrder, [...ids]) ? {text, records: placed} : materialize(contextOrder);
+      if (context.text !== text) throw new RangeError('canonical_origin_invalid');
+      const alignedOrder = [...basisOrder, ...contextOrder.filter(prior => !closure.has(prior))];
+      const aligned = same(alignedOrder, [...ids]) ? {text, records: placed} : materialize(alignedOrder);
+      if (aligned.text !== text) throw new RangeError('canonical_origin_invalid');
+      const crossed = aligned.records.slice(basisOrder.length);
+      const moved = transposeRecord(basis.text, origin.splices, id, crossed);
+      if (_rapierTransformSplices(text, moved.splices) !== moved.text) throw new RangeError('canonical_origin_invalid');
+      placed.push({...original, splices: moved.splices}); text = moved.text; ids.add(id);
+      if (original.derivedCommentIndex != null) sourceIndices.set(id, moved.sourceIndices);
+      cache.set(canonicalJSON(order.slice(0, placed.length)), {text, records: placed.slice(), sourceIndices: new Map(sourceIndices)});
+    }
+    const value = {text, records: placed, sourceIndices}; cache.set(key, value); return value;
+  };
+  const physicalOrder = append ? originalOrder.slice(0, -1) : originalOrder, physical = materialize(physicalOrder);
+  if (physical.text !== source || physical.records.some((row, index) => !same(row.splices, records[index].splices)))
+    throw new RangeError('canonical_origin_invalid');
+  return {source, origins, originalOrder, materialize, ordered};
+}
+
+export function authoredHistory(base, records, selected = null) {
+  const replay = authoredReplay(base, records);
+  if (!selected) return {text: replay.source, records, origins: replay.origins};
+  // Targets follow independent work only in this transient Undo projection.
+  const projected = replay.materialize(replay.ordered(replay.originalOrder, selected));
+  if (projected.text !== replay.source) throw new RangeError('canonical_origin_invalid');
+  return {...projected, origins: replay.origins};
+}
+
+// Semantic annotations use the original splice coordinates, even when an accepted
+// physical placement split those rows. The same replay proves the causal basis first.
+export function authoredSourceReader(base, records) {
+  const replay = authoredReplay(base, records);
+  return actId => {
+    const origin = replay.origins.get(actId);
+    if (!origin) throw new RangeError('canonical_origin_invalid');
+    const ids = new Set(), pending = [...origin.basis];
+    while (pending.length) {
+      const id = pending.pop();
+      if (ids.has(id)) continue;
+      ids.add(id); pending.push(...replay.origins.get(id).basis);
+    }
+    const basis = replay.materialize(replay.ordered([...ids]));
+    if (sha256(basis.text) !== origin.source) throw new RangeError('canonical_origin_invalid');
+    return {source: basis.text, splices: origin.splices};
+  };
+}
+
+// The original view and the accepted view are both reconstructed from the same
+// immutable acts. The reciprocal rows are an exact ACK, not another history.
+export function transposeAuthored(base, records, incoming, submitted) {
+  if (!incoming.authored || !Array.isArray(submitted)) throw new RangeError('canonical_origin_invalid');
+  const replay = authoredReplay(base, records, incoming), id = incoming.transaction.id;
+  const authored = replay.materialize([...submitted, id]);
+  if (canonicalJSON(authored.records.at(-1).splices) !== canonicalJSON(incoming.splices))
+    throw new RangeError('canonical_origin_invalid');
+  const accepted = replay.materialize(replay.originalOrder), known = new Set([...submitted, id]);
+  const reciprocal = replay.materialize([...submitted, id, ...replay.ordered(replay.originalOrder).filter(prior => !known.has(prior))]);
+  if (reciprocal.text !== accepted.text) throw new RangeError('canonical_origin_invalid');
+  return {text: accepted.text, splices: accepted.records.at(-1).splices,
+    submittedBefore: replay.materialize(submitted).text, submitted: authored.text,
+    against: reciprocal.records.slice(submitted.length + 1)};
+}