rapier-html 1.2.32 → 1.2.40

package/BUILD.json

@@ -1,11 +1,11 @@
 {
   "package": "rapier-html",
-  "version": "1.2.32",
+  "version": "1.2.40",
   "path": "dist/rapier.html",
-  "bytes": 5757325,
-  "sha256": "942ea78a99eecf884bac10962172f899904675220334a89ab632436cdf03f17e",
-  "builtAt": "2026-10-22T18:36:56.645Z",
-  "node": "v22.23.3",
+  "bytes": 5923993,
+  "sha256": "b0fc95b2633a468feba1c5dc1d7e59d49bc147ff48ae50c2eaa891296eacf23e",
+  "builtAt": "2026-10-24T09:33:09.207Z",
+  "node": "v22.23.4",
   "canonical": true,
   "packing": "zopfli",
   "plugins": [
@@ -49,7 +49,7 @@
       "kind": "files",
       "element": "rapier-plugin-mermaid-zenuml",
       "bytes": 1888111,
-      "packedBytes": 251401,
+      "packedBytes": 249770,
       "files": [
         {
           "id": "rapier-mermaid-zenuml",

package/README.md

@@ -1,15 +1,24 @@
 # rapier-html
 
-Turn Markdown into one offline HTML file that contains the full Rapier editor. It opens in any browser, on a phone or
-computer, with no account. People read, edit, draw and paint; agents hand over documents, show what changed and get
-the edited copy back. Start with `npx rapier-html@1.2.32 notes.md`.
+Turn Markdown into one offline HTML file that contains the full Rapier editor.
 
-Use it for a plan to rearrange, a guide to annotate, a draft to keep writing, or a revision to review. The file works
-without any hosted workspace.
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/jackskip22/rapier-plugins/main/assets/write-390-dark.png">
+  <img src="https://raw.githubusercontent.com/jackskip22/rapier-plugins/main/assets/write-390-light.png" alt="The Rapier editor on a phone: a launch plan with an agent's change marked" width="320">
+</picture>
+
+Try it: `npx rapier-html@1.2.40 notes.md`, then open `notes.rapier.html` in any browser.
+Install: `npm install rapier-html@1.2.40`.
+
+It opens on a phone or computer, with no account. People read, edit, draw and paint; agents hand over documents, show
+what changed and get the edited copy back.
+
+The file needs no hosted workspace.
 
 - The page writes, saves Markdown, exports Word, PDF and a web page, and prints. It needs no account and fetches
   nothing to open, edit or save. It is the base editor (about 1.7 MB) with the plug-ins the document displays with
   (Math, Mermaid, and page layout for a template page); `--include draw` adds drawing and painting. Notes never travel.
+- Where scripts don't run (a mail preview, a strict viewer), the file shows the document's words.
 - `--return` adds a one-use Send back address from the agent door.
 - `--view draw` opens on Draw. `--compare original.md` opens the edit with its diff; `--by <name>` attributes it.
 - `writePage(text, name)` makes the page in one call; `unwrap` gives the document back, exactly.
@@ -17,14 +26,14 @@ without any hosted workspace.
 Needs Node 22 or newer.
 
 ```sh
-npx -- rapier-html@1.2.32 notes.md                          # the editor, notes.md inside it, written beside the file
-npx -- rapier-html@1.2.32 notes.md --view draw              # opens on Draw: sketch and paint, the document behind it
-npx -- rapier-html@1.2.32 notes.md --include draw,math     # carries Draw and Math (default: what the document needs)
-npx -- rapier-html@1.2.32 notes.md --drawing sketch.svg     # carries a drawing, opened on Draw over the document
-npx -- rapier-html@1.2.32 revised.md --compare original.md # opens showing what changed
-npx -- rapier-html@1.2.32 notes.md --return "$RETURN_URL" --return-expires-at "$RETURN_EXPIRES_AT" # Send back
-npx -- rapier-html@1.2.32 notes.md out.html                 # a named output
-npm install rapier-html@1.2.32                              # as a library: writePage, unwrap
+npx -- rapier-html@1.2.40 notes.md                          # the editor, notes.md inside it, written beside the file
+npx -- rapier-html@1.2.40 notes.md --view draw              # opens on Draw: sketch and paint, the document behind it
+npx -- rapier-html@1.2.40 notes.md --include draw,math     # carries Draw and Math (default: what the document needs)
+npx -- rapier-html@1.2.40 notes.md --drawing sketch.svg     # carries a drawing, opened on Draw over the document
+npx -- rapier-html@1.2.40 revised.md --compare original.md # opens showing what changed
+npx -- rapier-html@1.2.40 notes.md --return "$RETURN_URL" --return-expires-at "$RETURN_EXPIRES_AT" # Send back
+npx -- rapier-html@1.2.40 notes.md out.html                 # a named output
+npm install rapier-html@1.2.40                              # as a library: writePage, unwrap
 ```
 
 The first `--` is for npm, so `--help` reaches the command. It never overwrites a file.

package/dist/ledger/data.mjs

@@ -17,7 +17,7 @@ export function fields(value, depth, active, sorted = true) {
 }
 export function scalar(value) {
   if (value === null || typeof value === 'boolean') return true;
-  if (typeof value === 'string') { if (/[\uD800-\uDFFF]/u.test(value)) throw fault('unpaired surrogate'); return true; }
+  if (typeof value === 'string') { if (!value.isWellFormed()) throw fault('unpaired surrogate'); return true; }
   return typeof value === 'number' && Number.isFinite(value) && !Object.is(value, -0);
 }
 export function plainData(value) {
@@ -39,7 +39,7 @@ function* quoted(text, whole = true) {
     let end = Math.min(text.length, at + 16384);
     if (end < text.length && (text.charCodeAt(end - 1) & 0xfc00) === 0xd800 && (text.charCodeAt(end) & 0xfc00) === 0xdc00) end--;
     const part = text.slice(at, end);
-    if (whole && /[\uD800-\uDFFF]/u.test(part)) throw fault('unpaired surrogate');
+    if (whole && !part.isWellFormed()) throw fault('unpaired surrogate');
     yield JSON.stringify(part).slice(1, -1); at = end;
   }
   yield '"';

package/dist/ledger/document-settings.mjs

@@ -129,6 +129,7 @@ function paperOf(value) {
 	return pixels && width <= 10000 && height <= 10000 ? Object.freeze({name, width: width * 15, height: height * 15, css: width + 'px ' + height + 'px'}) : null;
 }
 export const pageSizeOf = settings => settings?.papersize || PAPERS.letter;
+export const paperForLanguage = language => /(?:^|[-_])(?:US|CA|MX|PH|CL|CO|VE|CR|GT)$/i.test(String(language || '')) ? PAPERS.letter : PAPERS.a4;
 export const PAGE_SIZES = Object.freeze(['letter', 'legal', 'tabloid', 'a3', 'a4', 'a5', '1080x1080px', '1080x1350px', '1920x1080px', '1200x630px']);
 const EMPTY = Object.freeze({
 	title: null, subtitle: null, lang: null, fontsize: null, mainfont: null, sansfont: null, monofont: null, defaultfont: null, linestretch: null,

package/dist/ledger/format.mjs

@@ -3,10 +3,12 @@ import {_rapierPrepareHistoryRecords, _rapierValidMetadata, _rapierTransformMeta
 import {pictureHistorySplices} from './history.mjs';
 import {HistorySource} from './source.mjs';
 import {authoredHistory} from './transport.mjs';
-import {textRoot, rootAfter, sha256, sha256Parts, createSHA256} from './hash.mjs';
+import {textRoot, rootAfter, sha256, sha256PartsAsync, createSHA256} from './hash.mjs';
 import {canonicalJSON, canonicalParts, plainData, documentText, utf8Length, exactKeys, nonnegative, fault} from './data.mjs';
+import {diff} from './diff/diff.mjs';
+import {minimalHistorySplice} from './inverse-source.mjs';
+import {evaluateWill} from './will.mjs';
 export {textRoot, rootAfter};
-const digest = value => sha256Parts(canonicalParts(value));
 const rootShape = value => typeof value === 'string' && /^\d+:[a-z0-9]+:[a-z0-9]+$/.test(value);
 function* checkedRecords(ledger, prepared) {
   if (!prepared.ok || ledger.records.length !== prepared.records.length) throw fault('record chain differs');
@@ -26,42 +28,61 @@ function* checkedRecords(ledger, prepared) {
   if (ledger.head.revision !== revision || ledger.head.root !== root) throw fault('history does not describe this document');
 }
 const proofs = new WeakMap();
-function readLedgerState(input, expectedText, expectedMetadata) {
-  const ledger = plainData(input);
+function copiedLedger(input, proof) {
+  if (!proof || !input || typeof input !== 'object') return plainData(input);
+  const fields = Object.getOwnPropertyDescriptors(input), start = fields.start;
+  if (!start || !Object.hasOwn(start, 'value') || !start.value || typeof start.value !== 'object') return plainData(input);
+  const parts = Object.getOwnPropertyDescriptors(start.value), text = parts.text;
+  if (!text || !Object.hasOwn(text, 'value') || text.value !== proof.startText) return plainData(input);
+  const shell = Object.create(Object.getPrototypeOf(input), {...fields, start: {...start,
+    value: Object.create(Object.getPrototypeOf(start.value), {...parts, text: {...text, value: ''}})}});
+  const ledger = plainData(shell);
+  ledger.start.text = proof.startText;
+  return ledger;
+}
+function ledgerAdmission(input) {
+  const held = input && typeof input === 'object' ? proofs.get(input) : undefined;
+  const ledger = copiedLedger(input, held);
   if (!exactKeys(ledger, ['format','documentAuthority','start','records','head','complete','sha256']) || ledger.format !== 'rapier-ledger/2' ||
       typeof ledger.documentAuthority !== 'string' || !ledger.documentAuthority || ledger.documentAuthority.length > 256 ||
       typeof ledger.complete !== 'boolean' || !Array.isArray(ledger.records) ||
       !exactKeys(ledger.start, ['text','revision','root','sha256','metadata']) || !exactKeys(ledger.head, ['revision','root','sha256','metadata'])) throw fault('unsupported or invalid envelope');
   const shell = canonicalJSON({...ledger, start: {...ledger.start, text: ''}});
-  let proof = typeof input === 'object' ? proofs.get(input) : undefined;
-  if (!proof || proof.shell !== shell || proof.startText !== ledger.start.text) {
-    proof = {shell, startText: ledger.start.text, ...proveLedger(ledger)};
-    if (typeof input === 'object') proofs.set(input, proof);
-  }
+  const proof = held?.shell === shell && held.startText === ledger.start.text ? held : null;
+  return {ledger, shell, proof};
+}
+function ledgerResult(ledger, proof, expectedText, expectedMetadata) {
   proofs.set(ledger, proof);
   const {text, metadata, root, revision, prepared, source} = proof;
   if (expectedMetadata !== undefined && (!_rapierValidMetadata(expectedMetadata) || canonicalJSON(metadata) !== canonicalJSON(expectedMetadata)))
     throw fault('metadata does not describe this document');
   if (expectedText !== undefined && text !== expectedText) throw fault('history does not describe this document');
-  return {value: {ledger, text, metadata: {...metadata}, root, revision, complete: ledger.complete}, prepared, source};
+  return {value: {ledger, text, metadata: {...metadata}, root, revision, complete: ledger.complete}, prepared, source, proof};
 }
-function proveLedger(ledger) {
+function readLedgerState(input, expectedText, expectedMetadata) {
+  const {ledger, shell, proof: held} = ledgerAdmission(input);
+  const proof = held || {shell, startText: ledger.start.text, ...finish(proveLedger(ledger))};
+  if (typeof input === 'object') proofs.set(input, proof);
+  return ledgerResult(ledger, proof, expectedText, expectedMetadata);
+}
+function* proveLedger(ledger, native = false) {
   const {sha256: claimed, ...payload} = ledger;
-  if (claimed !== digest(payload)) throw fault('envelope checksum differs');
-  let text = documentText(ledger.start.text), root = ledger.start.root, revision = ledger.start.revision;
+  if (claimed !== (yield* checksum(canonicalParts(payload), native))) throw fault('envelope checksum differs');
+  let text = ledger.start.text, root = ledger.start.root, revision = ledger.start.revision;
+  const startFacts = yield* sourceFacts(text, native);
   if (!_rapierValidMetadata(ledger.start.metadata) || !_rapierValidMetadata(ledger.head.metadata)) throw fault('invalid document metadata');
-  if (!nonnegative(revision) || !rootShape(root) || (revision === 0 && root !== textRoot(text)) || ledger.start.sha256 !== sha256(text) ||
+  if (!nonnegative(revision) || !rootShape(root) || (revision === 0 && root !== startFacts.contentRoot) || ledger.start.sha256 !== startFacts.sha256 ||
       (ledger.complete && revision !== 0)) throw fault('invalid start');
   const prepared = _rapierPrepareHistoryRecords(ledger.records);
   if (!prepared.ok) throw fault('record chain differs');
-  let source = new HistorySource(text), bytes = utf8Length(text);
+  let source = new HistorySource(text), bytes = startFacts.utf8Bytes;
   for (const record of checkedRecords(ledger, prepared)) {
     const next = source.apply(record.splices);
     if (next === null) throw fault('splice does not replay');
     source = next;
     for (const row of record.splices) bytes += utf8Length(row.inserted) - utf8Length(row.removed);
     if (bytes > 64 * 1024 * 1024) throw fault('document exceeds the editor text limit');
-    root = record.afterHash; revision = record.transaction.revision;
+    root = record.afterHash; revision = record.transaction.revision; yield;
   }
   text = source.slice();
   if (ledger.records.some(row => Object.hasOwn(row, 'authored'))) {
@@ -69,7 +90,8 @@ function proveLedger(ledger) {
   }
   const metadata = prepared.replayMetadata(ledger.start.metadata);
   if (!metadata || canonicalJSON(metadata) !== canonicalJSON(ledger.head.metadata)) throw fault('metadata does not describe this document');
-  if (ledger.head.revision !== revision || ledger.head.root !== root || ledger.head.sha256 !== sha256(text)) throw fault('history does not describe this document');
+  const headFacts = ledger.records.every(row => !row.splices.length) ? startFacts : yield* sourceFacts(text, native);
+  if (ledger.head.revision !== revision || ledger.head.root !== root || ledger.head.sha256 !== headFacts.sha256) throw fault('history does not describe this document');
   return {text, metadata, root, revision, prepared, source};
 }
 export function ledgerWithStart(input, text) {
@@ -83,14 +105,25 @@ export function ledgerWithStart(input, text) {
 export function readLedger(input, expectedText, expectedMetadata) {
   return readLedgerState(input, expectedText, expectedMetadata).value;
 }
-function* checksum(parts) {
+export async function readLedgerAsync(input, expectedText, expectedMetadata, options = {}) {
+  options.signal?.throwIfAborted();
+  const {ledger, shell, proof: held} = ledgerAdmission(input);
+  const metadata = expectedMetadata === undefined ? undefined : plainData(expectedMetadata);
+  const proof = held || {shell, startText: ledger.start.text,
+    ...await finishAsync(proveLedger(ledger, !!globalThis.crypto?.subtle), options)};
+  options.signal?.throwIfAborted();
+  if (typeof input === 'object') proofs.set(input, proof);
+  return ledgerResult(ledger, proof, expectedText, metadata).value;
+}
+function* checksum(parts, native = false) {
+  if (native) return yield {parts};
   const hash = createSHA256();
   for (const part of parts) { hash.update(part); yield; }
   return hash.digest();
 }
-function* sourceFacts(text) {
+function* sourceFacts(text, native = false) {
   if (typeof text !== 'string') throw fault('document is not whole-character text');
-  const hash = createSHA256();
+  const hash = native ? null : createSHA256();
   let fnv = 0x811c9dc5, a = 1, b = 0, bytes = 0;
   for (let at = 0; at < text.length;) {
     const start = at, end = Math.min(text.length, at + 65536);
@@ -112,18 +145,19 @@ function* sourceFacts(text) {
       a %= 65521; b %= 65521;
     }
     if (bytes > 64 * 1024 * 1024) throw fault('document exceeds the editor text limit');
-    hash.update(text.slice(start, end)); yield;
+    hash?.update(text.slice(start, end)); yield;
   }
-  return {utf8Bytes: bytes, sha256: hash.digest(), contentRoot: text.length + ':' +
+  const digest = hash ? hash.digest() : yield {parts: [text], byteLength: bytes};
+  return {utf8Bytes: bytes, sha256: digest, contentRoot: text.length + ':' +
     (fnv >>> 0).toString(36) + ':' + (((b << 16) | a) >>> 0).toString(36)};
 }
-function* produceLedger({text, metadata, records, documentAuthority, revision, root, complete = false, earlier = records} = {}) {
+function* produceLedger({text, metadata, records, documentAuthority, revision, root, complete = false, earlier = records} = {}, native = false) {
   if (!_rapierValidMetadata(metadata)) throw fault('document metadata required');
   metadata = {...metadata};
   if (!Array.isArray(records) || !Array.isArray(earlier)) throw fault('records required');
   const prepared = _rapierPrepareHistoryRecords(records, earlier);
   if (!prepared.ok) throw fault('navigation target was not retained');
-  const headFacts = yield* sourceFacts(text);
+  const headFacts = yield* sourceFacts(text, native);
   let bytes = headFacts.utf8Bytes;
   const expanded = [];
   for (const {record, splices: rows, metadata: effect} of prepared.rows) {
@@ -153,7 +187,7 @@ function* produceLedger({text, metadata, records, documentAuthority, revision, r
   const startRevision = expanded[0]?.transaction.baseRevision ?? revision, startRoot = expanded[0]?.beforeHash ?? root;
   if (typeof documentAuthority !== 'string' || !documentAuthority || documentAuthority.length > 256) throw fault('unsupported or invalid envelope');
   if (!nonnegative(startRevision) || !rootShape(startRoot)) throw fault('invalid start');
-  const startFacts = unchangedText ? headFacts : yield* sourceFacts(startText);
+  const startFacts = unchangedText ? headFacts : yield* sourceFacts(startText, native);
   if (startRevision === 0 && startRoot !== startFacts.contentRoot) throw fault('invalid start');
   const headSHA = headFacts.sha256, startSHA = startFacts.sha256;
   const payload = {format: 'rapier-ledger/2', documentAuthority,
@@ -165,7 +199,10 @@ function* produceLedger({text, metadata, records, documentAuthority, revision, r
   }
   const replayedMetadata = prepared.replayMetadata(startMetadata);
   if (!replayedMetadata || canonicalJSON(replayedMetadata) !== canonicalJSON(metadata)) throw fault('metadata does not describe this document');
-  const ledger = {...payload, sha256: yield* checksum(canonicalParts(payload))};
+  const ledger = {...payload, sha256: yield* checksum(canonicalParts(payload), native)};
+  proofs.set(ledger, {shell: canonicalJSON({...ledger, start: {...ledger.start, text: ''}}), startText,
+    text, metadata: {...metadata}, root, revision, prepared: _rapierPrepareHistoryRecords(ledger.records),
+    source: new HistorySource(text)});
   return {ledger, contentRoot, utf8Bytes: headBytes};
 }
 function finish(producer) {
@@ -174,13 +211,14 @@ function finish(producer) {
   return step.value;
 }
 export function exportLedger(input) { return finish(produceLedger(input)).ledger; }
-export async function prepareLedgerAsync(input, {yield: yieldWork, signal} = {}) {
-  const producer = produceLedger(input);
-  let step;
+async function finishAsync(producer, {yield: yieldWork, signal} = {}) {
+  let step, digest;
   do {
     signal?.throwIfAborted();
-    step = producer.next();
-    if (!step.done && yieldWork) {
+    step = producer.next(digest); digest = undefined;
+    if (!step.done && step.value) digest = await sha256PartsAsync(step.value.parts,
+      {yield: yieldWork, signal, byteLength: step.value.byteLength});
+    else if (!step.done && yieldWork) {
       const pending = yieldWork();
       if (pending) await pending;
     }
@@ -188,8 +226,10 @@ export async function prepareLedgerAsync(input, {yield: yieldWork, signal} = {})
   signal?.throwIfAborted();
   return step.value;
 }
-export function historyEnvelope(input, segmentIdentity = [], expectedText, expectedMetadata) {
-  const {value: {ledger, text, metadata}, prepared, source} = readLedgerState(input, expectedText, expectedMetadata);
+export function prepareLedgerAsync(input, options = {}) {
+  return finishAsync(produceLedger(input, !!globalThis.crypto?.subtle), options);
+}
+function historyNavigation(ledger, text, metadata, prepared, source) {
   const {byId, effects: {pictures}} = prepared;
   let branch = [], cursor = 0;
   for (const {transaction: tx} of ledger.records) {
@@ -232,8 +272,13 @@ export function historyEnvelope(input, segmentIdentity = [], expectedText, expec
       if (active === null || !activeMetadata || (i + 1 === cursor && (active.length !== text.length || !active.matches(0, text) || canonicalJSON(activeMetadata) !== canonicalJSON(metadata)))) throw fault('complete branch differs');
     }
   }
+  return {branch, cursor};
+}
+export function historyEnvelope(input, segmentIdentity = [], expectedText, expectedMetadata) {
+  const {value: {ledger, text, metadata}, prepared, source, proof} = readLedgerState(input, expectedText, expectedMetadata);
+  const {branch, cursor} = proof.navigation ??= historyNavigation(ledger, text, metadata, prepared, source);
   return {schemaVersion: 5, documentAuthority: ledger.documentAuthority, documentRevision: ledger.head.revision,
-    ledger: ledger.records, branch, cursor, earliestRevision: ledger.start.revision, earliestHash: ledger.start.root,
+    ledger: ledger.records, branch: branch.slice(), cursor, earliestRevision: ledger.start.revision, earliestHash: ledger.start.root,
     sourceRootId: ledger.head.root, earliestMetadata: {...ledger.start.metadata}, documentMetadata: {...metadata}, segmentIdentity, historyComplete: ledger.complete,
     trimReason: ledger.complete ? '' : 'carried_start', trimmedBytes: 0};
 }
@@ -249,15 +294,14 @@ export function agentActorId(door, agent) {
 export function replaceLedgerText(input, text, {actor = {kind: 'system', id: 'rapier'}, operation = 'document.replace', at} = {}) {
   const current = readLedger(input); documentText(text);
   if (current.text === text) return current.ledger;
-  let start = 0, a = current.text.length, b = text.length;
-  while (start < a && start < b && current.text[start] === text[start]) start++;
-  if (start && /[\uDC00-\uDFFF]/.test(current.text[start] || text[start] || '')) start--;
-  while (a > start && b > start && current.text[a - 1] === text[b - 1]) { a--; b--; }
-  if (/[\uDC00-\uDFFF]/.test(current.text[a] || text[b] || '')) { a++; b++; }
-  const splices = [{pos: start, removed: current.text.slice(start, a), inserted: text.slice(start, b)}];
-  const revision = current.revision + 1, root = rootAfter(current.root, splices[0]);
+  const splices = diff(current.text, text, {_unit: 'word'}).edits.map(edit =>
+    minimalHistorySplice(current.text.slice(...edit.before), text.slice(...edit.after), edit.before[0])).reverse();
+  const revision = current.revision + 1, root = splices.reduce(rootAfter, current.root);
+  if (actor.kind === 'agent' && current.metadata.docKind === 'markdown' && evaluateWill(current.text, splices).outcome !== 'applied')
+    throw fault('will_violation');
+  const identity = sha256(canonicalJSON({before: current.ledger.sha256, text, actor, operation, at: at ?? null}));
   const record = {beforeHash: current.root, afterHash: root, splices, transaction: {
-    id: current.ledger.documentAuthority.slice(0, 48) + ':export:' + revision.toString(36),
+    id: current.ledger.documentAuthority.slice(0, 48) + ':export:' + identity,
     documentAuthority: current.ledger.documentAuthority, baseRevision: current.revision, revision,
     actor, transport: 'platform', operation, requestId: null, sourceTransactionId: null,
     affectedBlockIds: [], parent: current.ledger.records.at(-1)?.transaction.id ?? null,

package/dist/ledger/hash.mjs

@@ -111,9 +111,50 @@ export function sha256Parts(parts) {
   for (const part of parts) hash.update(part);
   return hash.digest();
 }
-const LONG_TEXT = 65536, DIGESTS = new Map();
+export async function sha256PartsAsync(parts, {yield: yieldWork, signal, byteLength} = {}) {
+  const encoder = new TextEncoder(), chunks = [];
+  let bytes = byteLength === undefined ? null : new Uint8Array(byteLength);
+  let high = '', length = 0;
+  const write = text => {
+    if (bytes) {
+      const result = encoder.encodeInto(text, bytes.subarray(length));
+      if (result.read !== text.length) throw new RangeError('SHA-256 byte length differs');
+      length += result.written;
+    } else {
+      const chunk = encoder.encode(text); chunks.push(chunk); length += chunk.length;
+    }
+  };
+  for (const value of parts) {
+    let text = high + String(value === undefined ? '' : value); high = '';
+    if (text.length && (text.charCodeAt(text.length - 1) & 0xfc00) === 0xd800) {
+      high = text.slice(-1); text = text.slice(0, -1);
+    }
+    for (let at = 0; at < text.length;) {
+      signal?.throwIfAborted();
+      let end = Math.min(text.length, at + 32768);
+      if (end < text.length && (text.charCodeAt(end - 1) & 0xfc00) === 0xd800 &&
+          (text.charCodeAt(end) & 0xfc00) === 0xdc00) end--;
+      write(text.slice(at, end)); at = end;
+      const pending = yieldWork?.(); if (pending) await pending;
+    }
+  }
+  if (high) write(high);
+  if (bytes && length !== bytes.length) throw new RangeError('SHA-256 byte length differs');
+  bytes ||= new Uint8Array(length);
+  let at = 0;
+  for (const chunk of chunks) {
+    signal?.throwIfAborted(); bytes.set(chunk, at); at += chunk.length;
+    const pending = yieldWork?.(); if (pending) await pending;
+  }
+  chunks.length = 0;
+  signal?.throwIfAborted();
+  const digest = await globalThis.crypto.subtle.digest('SHA-256', bytes);
+  signal?.throwIfAborted();
+  return Array.from(new Uint8Array(digest), value => value.toString(16).padStart(2, '0')).join('');
+}
+const LONG_TEXT = 65536, DOCUMENT_TEXT = 1048576, DIGESTS = new Map();
 export function sha256(text) {
-  if (typeof text !== 'string' || text.length < LONG_TEXT) return createSHA256().update(text).digest();
+  if (typeof text !== 'string' || text.length < LONG_TEXT || text.length >= DOCUMENT_TEXT) return createSHA256().update(text).digest();
   let digest = DIGESTS.get(text);
   if (digest === undefined) {
     digest = createSHA256().update(text).digest();

package/dist/ledger/history.mjs

@@ -5,6 +5,7 @@ import {sourceView, HistorySource} from './source.mjs';
 import {textRootParts, rootAfter} from './hash.mjs';
 import {authoredHistory, authoredPlacements} from './transport.mjs';
 import {plainData, canonicalJSON} from './data.mjs';
+import {evaluateWill} from './will.mjs';
 
 const historyFailure = reason => ({ok: false, reason});
 const historyInteger = value => Number.isSafeInteger(value) && value >= 0 && !Object.is(value, -0);
@@ -323,6 +324,8 @@ export function selectiveUndo(input, actIds, options = {}) {
 		(options.splitSplice !== undefined && typeof options.splitSplice !== 'function')) return historyFailure('act_invalid');
 	const requested = new Set(actIds), available = prepared.byId;
 	if ([...requested].some(id => !available.has(id))) return historyFailure('act_unavailable');
+	if (options.actor?.kind === 'agent' && [...requested].some(id => available.get(id).record.transaction.actor.kind !== 'agent'))
+		return historyFailure('act_forbidden');
 	const selected = new Set([...requested].filter(id => prepared.effects.active.has(id)));
 	const records = prepared.records;
 	let inverseId = 'planned-inverse'; while (available.has(inverseId)) inverseId += ':';
@@ -359,6 +362,9 @@ export function selectiveUndo(input, actIds, options = {}) {
 			sourceIndices: transported.sourceIndices.get(record.transaction.id)})) : prepared.rows;
 		const result = projectInverseSource(transported ? {...prepared, rows, records: transported.records} : prepared, selected, projectedEffects, options);
 		if (!result.ok) return result;
+		if (options.actor?.kind === 'agent' && prepared.metadata.docKind === 'markdown' &&
+			evaluateWill(prepared.source, result.splices).outcome !== 'applied')
+			return historyFailure('will_refused');
 		return {...result, actIds: [...requested], sourceTransactionIds: [...selected], metadata, afterMetadata,
 			effectChanged, unchanged: result.after === prepared.source && !metadata && !effectChanged};
 	} catch (_) { return historyFailure('history_invalid'); }

package/dist/ledger/inverse-source.mjs

@@ -10,7 +10,7 @@ const historyBoundary = (source, at) => Number.isSafeInteger(at) && at >= 0 && !
 	!(at > 0 && at < source.length && (source.charCodeAt(at - 1) & 0xFC00) === 0xD800 &&
 	(source.charCodeAt(at) & 0xFC00) === 0xDC00);
 
-function minimalHistorySplice(before, after, pos = 0) {
+export function minimalHistorySplice(before, after, pos = 0) {
 	let first = 0, a = before.length, b = after.length;
 	while (first < a && first < b && before[first] === after[first]) first++;
 	if (!historyBoundary(before, first) || !historyBoundary(after, first)) first--;
@@ -262,7 +262,11 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 					const start = boundary(row.pos), end = boundary(row.pos + row.removed.length);
 					let at = start.last, count = Math.max(0, end.first - at);
 					if (!row.removed.length) {
-						const marker = pieces.slice(start.first, start.last).findIndex(item => item.mark?.inserted.length);
+						const run = pieces.slice(start.first, start.last), next = pieces[start.last];
+						let before = start.first - 1; while (before >= 0 && !pieces[before].text) before--;
+						const leftAct = before >= 0 ? byId.get(pieces[before].owner)?.actId : undefined;
+						const sameAct = leftAct !== undefined && run.some(item => item.mark?.actId === leftAct);
+						const marker = run.findIndex(item => item.mark?.inserted.length && (next && owns(next, item.mark) || !sameAct));
 						at = marker < 0 ? start.last : start.first + marker; count = 0;
 					}
 					const removed = pieces.slice(at, at + count);

package/dist/ledger/journal-records.mjs

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: MIT
 import {fields, scalar, plainPrototype} from './data.mjs';
 import {transformText} from './source.mjs';
+import {dataImage} from './md-assets.mjs';
 
 const _RAPIER_TRANSACTION_ACTOR_LIMIT = 160;
 const _RAPIER_TRANSACTION_OPERATION_LIMIT = 96;
@@ -175,10 +176,10 @@ function _rapierPictureFinish(record, original, earlier, lookup) {
 	if (!reference || !/^\]\[[a-z0-9-]+\]$/i.test(reference.inserted) || reference.removed === reference.inserted) return false;
 	const definition = rows.find(row => row !== reference), oldLabel = reference.removed.slice(2, -1), newLabel = reference.inserted.slice(2, -1);
 	const body = (text, label) => {
-		const prefix = '[' + label + ']: data:image/svg+xml;base64,';
+		const prefix = '[' + label + ']: ';
 		if (typeof text !== 'string' || !text.startsWith(prefix)) return null;
 		const value = text.slice(prefix.length), end = value.indexOf(' '), bytes = end < 0 ? value : value.slice(0, end), title = end < 0 ? '' : value.slice(end);
-		return /^[A-Za-z0-9+/]+={0,2}$/.test(bytes) && !/[\r\n]/.test(title) ? title : null;
+		return dataImage(bytes)?.codec === 'image/svg+xml' && !/[\r\n]/.test(title) ? title : null;
 	};
 	const title = body(definition.removed, oldLabel);
 	if (title === null || body(definition.inserted, newLabel) !== title) return false;
@@ -292,6 +293,7 @@ function _rapierWalkHistoryEffects(records, lookup, visit = null, observe = null
 				}
 			}
 			if (refs.some(id => typeof id !== 'string' || !nodes.has(id) || pictures.has(id))) return {ok: false};
+			if (tx.actor?.kind === 'agent' && refs.some(id => byId.get(id).transaction.actor?.kind !== 'agent')) return {ok: false};
 			nodes.set(tx.id, {active: true, blockers: 0, references: refs, dependents: []}); references.set(tx.id, refs.slice());
 			byId.set(tx.id, record); earlier.push(record);
 			for (const ref of refs) {