rapier-html 1.2.33 → 1.2.42

package/BUILD.json

@@ -1,11 +1,11 @@
 {
   "package": "rapier-html",
-  "version": "1.2.33",
+  "version": "1.2.42",
   "path": "dist/rapier.html",
-  "bytes": 5764398,
-  "sha256": "5f1d5fc07e6d302c33f0ac297ea2b21e179d5b458353e108a5da7f83fd04e889",
-  "builtAt": "2026-10-22T21:58:20.465Z",
-  "node": "v22.23.3",
+  "bytes": 5828319,
+  "sha256": "12f1cc548ff4e0d95a105b0170ce2f40aed8989cc58a4937f43eacb05581833c",
+  "builtAt": "2026-10-24T21:57:08.348Z",
+  "node": "v22.23.4",
   "canonical": true,
   "packing": "zopfli",
   "plugins": [
@@ -31,15 +31,15 @@
       "delivery": "built-in",
       "kind": "files",
       "element": "rapier-plugin-mermaid",
-      "bytes": 677968,
-      "packedBytes": 224584,
+      "bytes": 720263,
+      "packedBytes": 240280,
       "files": [
         {
           "id": "rapier-mermaid-core",
-          "name": "pele-1.6.0.js",
-          "version": "1.6.0",
-          "bytes": 677968,
-          "sri": "wvZ8yi9fl1G4U3tYTRguH7dHJxCgl7Rgu/Bb+sz+ip80toql8Bc0N2aLeJCCtUMS"
+          "name": "pele-1.9.0-native-1.js",
+          "version": "1.9.0-native-1",
+          "bytes": 720263,
+          "sri": "zPE63bYrlp1ZqlwxePk6pclPq6VoxZ7o769Lz109vEo8OEPtvOl1GPrMDj0OhtVB"
         }
       ]
     },
@@ -48,15 +48,15 @@
       "delivery": "built-in",
       "kind": "files",
       "element": "rapier-plugin-mermaid-zenuml",
-      "bytes": 1888111,
-      "packedBytes": 251401,
+      "bytes": 420431,
+      "packedBytes": 110835,
       "files": [
         {
           "id": "rapier-mermaid-zenuml",
-          "name": "rapier-zenuml-4.5.0-3.js",
-          "version": "4.5.0-3",
-          "bytes": 1888111,
-          "sri": "/JAYBQPgTaslQtUck91RnxcqXI8V8T0iYa+dRwc9StJhd0MPJGLTOCLj9aNDRHDG"
+          "name": "rapier-zenuml-svg-4.5.0-1.js",
+          "version": "4.5.0-svg-1",
+          "bytes": 420431,
+          "sri": "Dma7QZLWfZx3gWM0ie8JpjR4KwOXqndKcIJywkdxJ2shsdw/gDRFByjGlUv+eNoQ"
         }
       ]
     },
@@ -145,15 +145,15 @@
       "delivery": "built-in",
       "kind": "files",
       "element": "rapier-plugin-font-subset",
-      "bytes": 1214779,
-      "packedBytes": 441276,
+      "bytes": 1207570,
+      "packedBytes": 439575,
       "files": [
         {
           "id": "rapier-font-subset",
           "name": "rapier-font-subset-3.js",
           "version": "3",
-          "bytes": 1214779,
-          "sri": "iAjccOClLDb549FPCJnflzsNIlLa4G4N/SRm/GnIvhcUyQd0COW2672AA2Mldcnz"
+          "bytes": 1207570,
+          "sri": "eyBreJCziFoHQdGSPtvd0S2IRcHna191kq83/ps/rafZwWWd6reInBALyPdLQmdL"
         }
       ]
     }

package/README.md

@@ -1,15 +1,24 @@
 # rapier-html
 
-Turn Markdown into one offline HTML file that contains the full Rapier editor. It opens in any browser, on a phone or
-computer, with no account. People read, edit, draw and paint; agents hand over documents, show what changed and get
-the edited copy back. Start with `npx rapier-html@1.2.33 notes.md`.
+Turn Markdown into one offline HTML file that contains the full Rapier editor.
 
-Use it for a plan to rearrange, a guide to annotate, a draft to keep writing, or a revision to review. The file works
-without any hosted workspace.
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/jackskip22/rapier-plugins/main/assets/write-390-dark.png">
+  <img src="https://raw.githubusercontent.com/jackskip22/rapier-plugins/main/assets/write-390-light.png" alt="The Rapier editor on a phone: a launch plan with an agent's change marked" width="320">
+</picture>
+
+Try it: `npx rapier-html@1.2.42 notes.md`, then open `notes.rapier.html` in any browser.
+Install: `npm install rapier-html@1.2.42`.
+
+It opens on a phone or computer, with no account. People read, edit, draw and paint; agents hand over documents, show
+what changed and get the edited copy back.
+
+The file needs no hosted workspace.
 
 - The page writes, saves Markdown, exports Word, PDF and a web page, and prints. It needs no account and fetches
   nothing to open, edit or save. It is the base editor (about 1.7 MB) with the plug-ins the document displays with
   (Math, Mermaid, and page layout for a template page); `--include draw` adds drawing and painting. Notes never travel.
+- Where scripts don't run (a mail preview, a strict viewer), the file shows the document's words.
 - `--return` adds a one-use Send back address from the agent door.
 - `--view draw` opens on Draw. `--compare original.md` opens the edit with its diff; `--by <name>` attributes it.
 - `writePage(text, name)` makes the page in one call; `unwrap` gives the document back, exactly.
@@ -17,14 +26,14 @@ without any hosted workspace.
 Needs Node 22 or newer.
 
 ```sh
-npx -- rapier-html@1.2.33 notes.md                          # the editor, notes.md inside it, written beside the file
-npx -- rapier-html@1.2.33 notes.md --view draw              # opens on Draw: sketch and paint, the document behind it
-npx -- rapier-html@1.2.33 notes.md --include draw,math     # carries Draw and Math (default: what the document needs)
-npx -- rapier-html@1.2.33 notes.md --drawing sketch.svg     # carries a drawing, opened on Draw over the document
-npx -- rapier-html@1.2.33 revised.md --compare original.md # opens showing what changed
-npx -- rapier-html@1.2.33 notes.md --return "$RETURN_URL" --return-expires-at "$RETURN_EXPIRES_AT" # Send back
-npx -- rapier-html@1.2.33 notes.md out.html                 # a named output
-npm install rapier-html@1.2.33                              # as a library: writePage, unwrap
+npx -- rapier-html@1.2.42 notes.md                          # the editor, notes.md inside it, written beside the file
+npx -- rapier-html@1.2.42 notes.md --view draw              # opens on Draw: sketch and paint, the document behind it
+npx -- rapier-html@1.2.42 notes.md --include draw,math     # carries Draw and Math (default: what the document needs)
+npx -- rapier-html@1.2.42 notes.md --drawing sketch.svg     # carries a drawing, opened on Draw over the document
+npx -- rapier-html@1.2.42 revised.md --compare original.md # opens showing what changed
+npx -- rapier-html@1.2.42 notes.md --return "$RETURN_URL" --return-expires-at "$RETURN_EXPIRES_AT" # Send back
+npx -- rapier-html@1.2.42 notes.md out.html                 # a named output
+npm install rapier-html@1.2.42                              # as a library: writePage, unwrap
 ```
 
 The first `--` is for npm, so `--help` reaches the command. It never overwrites a file.

package/dist/ledger/data.mjs

@@ -17,7 +17,7 @@ export function fields(value, depth, active, sorted = true) {
 }
 export function scalar(value) {
   if (value === null || typeof value === 'boolean') return true;
-  if (typeof value === 'string') { if (/[\uD800-\uDFFF]/u.test(value)) throw fault('unpaired surrogate'); return true; }
+  if (typeof value === 'string') { if (!value.isWellFormed()) throw fault('unpaired surrogate'); return true; }
   return typeof value === 'number' && Number.isFinite(value) && !Object.is(value, -0);
 }
 export function plainData(value) {
@@ -39,16 +39,18 @@ function* quoted(text, whole = true) {
     let end = Math.min(text.length, at + 16384);
     if (end < text.length && (text.charCodeAt(end - 1) & 0xfc00) === 0xd800 && (text.charCodeAt(end) & 0xfc00) === 0xdc00) end--;
     const part = text.slice(at, end);
-    if (whole && /[\uD800-\uDFFF]/u.test(part)) throw fault('unpaired surrogate');
+    if (whole && !part.isWellFormed()) throw fault('unpaired surrogate');
     yield JSON.stringify(part).slice(1, -1); at = end;
   }
   yield '"';
 }
-function* dataParts(value, depth, active, sorted) {
+function* dataParts(value, depth, active, sorted, known = null) {
   if (typeof value === 'string') { yield* quoted(value); return; }
   if (value === null || typeof value === 'boolean' || typeof value === 'number' && Number.isFinite(value) && !Object.is(value, -0)) {
     yield JSON.stringify(value); return;
   }
+  const text = known?.(value, depth);
+  if (text !== undefined) { yield text; return; }
   const {array, descriptors, keys} = fields(value, depth, active, sorted);
   active.add(value);
   yield array ? '[' : '{';
@@ -56,14 +58,65 @@ function* dataParts(value, depth, active, sorted) {
     if (i) yield ',';
     const key = keys[i];
     if (!array) { yield* quoted(key, false); yield ':'; }
-    yield* dataParts(descriptors[key].value, depth + 1, active, sorted);
+    yield* dataParts(descriptors[key].value, depth + 1, active, sorted, known);
   }
   yield array ? ']' : '}';
   active.delete(value);
 }
 export function canonicalParts(value, depth = 0, active = new Set()) { return dataParts(value, depth, active, true); }
 export function jsonParts(value) { return dataParts(value, 0, new Set(), false); }
+export function jsonPartsKnown(value, known) { return dataParts(value, 0, new Set(), false, known); }
+export function jsonTextAt(value, depth) { return Array.from(dataParts(value, depth, new Set(), false)).join(''); }
 export function canonicalJSON(value, depth = 0, active = new Set()) { return Array.from(canonicalParts(value, depth, active)).join(''); }
+const ownedRows = new WeakSet(), rowCanonical = new Map();
+let rowCanonicalChars = 0;
+const ROW_CANONICAL_LIMIT = 32 * 1024 * 1024;
+function freezeData(value) {
+  if (!value || typeof value !== 'object' || ownedRows.has(value) || ownedLedgers.has(value)) return value;
+  for (const key of Object.keys(value)) freezeData(value[key]);
+  return Object.freeze(value);
+}
+export function ownRow(row) { if (!ownedRows.has(row)) { freezeData(row); ownedRows.add(row); } return row; }
+const ownedLedgers = new WeakSet();
+export function ownLedger(ledger) {
+  if (ledger && typeof ledger === 'object' && !ownedLedgers.has(ledger)) { freezeData(ledger); ownedLedgers.add(ledger); }
+  return ledger;
+}
+export function isOwnedLedger(ledger) { return !!ledger && ownedLedgers.has(ledger); }
+const rowText = new WeakMap();
+function canonicalRow(row, depth) {
+  if (!ownedRows.has(row)) return canonicalJSON(row, depth);
+  const own = rowText.get(row);
+  if (own?.depth === depth) return own.json;
+  const json = keyedRow(row, depth);
+  rowText.set(row, {depth, json});
+  return json;
+}
+function keyedRow(row, depth) {
+  const id = typeof row.transaction?.id === 'string' ? row.transaction.id : null, seen = JSON.stringify(row);
+  const hit = id === null ? null : rowCanonical.get(id);
+  if (hit && hit.depth === depth && hit.seen.includes(seen)) return hit.json;
+  const json = canonicalJSON(row, depth);
+  if (id !== null && 2 * seen.length + json.length <= ROW_CANONICAL_LIMIT / 4) {
+    const size = entry => entry.seen.reduce((sum, text) => sum + text.length, entry.json.length);
+    const seenAlso = hit && hit.depth === depth && hit.json === json ? [hit.seen.at(-1), seen] : [seen];
+    if (hit) { rowCanonical.delete(id); rowCanonicalChars -= size(hit); }
+    const entry = {depth, seen: seenAlso, json};
+    rowCanonical.set(id, entry); rowCanonicalChars += size(entry);
+    for (const [key, value] of rowCanonical) {
+      if (rowCanonicalChars <= ROW_CANONICAL_LIMIT) break;
+      rowCanonical.delete(key); rowCanonicalChars -= size(value);
+    }
+  }
+  return json;
+}
+export function* canonicalRowsParts(rows, depth = 0) {
+  const {array, keys} = fields(rows, depth, new Set());
+  if (!array) { yield* canonicalParts(rows, depth); return; }
+  yield '[';
+  for (let i = 0; i < keys.length; i++) { if (i) yield ','; yield canonicalRow(rows[keys[i]], depth + 1); }
+  yield ']';
+}
 export function exactKeys(value, keys) {
   return value && typeof value === 'object' && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every(key => Object.hasOwn(value, key));
 }

package/dist/ledger/document-settings.mjs

@@ -129,6 +129,7 @@ function paperOf(value) {
 	return pixels && width <= 10000 && height <= 10000 ? Object.freeze({name, width: width * 15, height: height * 15, css: width + 'px ' + height + 'px'}) : null;
 }
 export const pageSizeOf = settings => settings?.papersize || PAPERS.letter;
+export const paperForLanguage = language => /(?:^|[-_])(?:US|CA|MX|PH|CL|CO|VE|CR|GT)$/i.test(String(language || '')) ? PAPERS.letter : PAPERS.a4;
 export const PAGE_SIZES = Object.freeze(['letter', 'legal', 'tabloid', 'a3', 'a4', 'a5', '1080x1080px', '1080x1350px', '1920x1080px', '1200x630px']);
 const EMPTY = Object.freeze({
 	title: null, subtitle: null, lang: null, fontsize: null, mainfont: null, sansfont: null, monofont: null, defaultfont: null, linestretch: null,

package/dist/ledger/format.mjs

@@ -3,10 +3,12 @@ import {_rapierPrepareHistoryRecords, _rapierValidMetadata, _rapierTransformMeta
 import {pictureHistorySplices} from './history.mjs';
 import {HistorySource} from './source.mjs';
 import {authoredHistory} from './transport.mjs';
-import {textRoot, rootAfter, sha256, sha256Parts, createSHA256} from './hash.mjs';
-import {canonicalJSON, canonicalParts, plainData, documentText, utf8Length, exactKeys, nonnegative, fault} from './data.mjs';
+import {textRoot, rootAfter, sha256, sha256PartsAsync, createSHA256} from './hash.mjs';
+import {canonicalJSON, canonicalParts, canonicalRowsParts, ownRow, ownLedger, isOwnedLedger, plainData, documentText, utf8Length, exactKeys, nonnegative, fault} from './data.mjs';
+import {diff} from './diff/diff.mjs';
+import {minimalHistorySplice} from './inverse-source.mjs';
+import {evaluateWill} from './will.mjs';
 export {textRoot, rootAfter};
-const digest = value => sha256Parts(canonicalParts(value));
 const rootShape = value => typeof value === 'string' && /^\d+:[a-z0-9]+:[a-z0-9]+$/.test(value);
 function* checkedRecords(ledger, prepared) {
   if (!prepared.ok || ledger.records.length !== prepared.records.length) throw fault('record chain differs');
@@ -25,43 +27,77 @@ function* checkedRecords(ledger, prepared) {
   }
   if (ledger.head.revision !== revision || ledger.head.root !== root) throw fault('history does not describe this document');
 }
+function* envelopeParts(envelope) {
+  const keys = Object.keys(envelope).sort();
+  yield '{';
+  for (let i = 0; i < keys.length; i++) {
+    if (i) yield ',';
+    yield JSON.stringify(keys[i]); yield ':';
+    yield* keys[i] === 'records' ? canonicalRowsParts(envelope.records, 1) : canonicalParts(envelope[keys[i]], 1, new Set());
+  }
+  yield '}';
+}
 const proofs = new WeakMap();
-function readLedgerState(input, expectedText, expectedMetadata) {
-  const ledger = plainData(input);
+function ownedRows(ledger) {
+  if (ledger && Array.isArray(ledger.records)) for (const row of ledger.records) if (row && typeof row === 'object') ownRow(row);
+  return ledger;
+}
+function copiedLedger(input, proof) {
+  if (!proof || !input || typeof input !== 'object') return ownedRows(plainData(input));
+  const fields = Object.getOwnPropertyDescriptors(input), start = fields.start;
+  if (!start || !Object.hasOwn(start, 'value') || !start.value || typeof start.value !== 'object') return ownedRows(plainData(input));
+  const parts = Object.getOwnPropertyDescriptors(start.value), text = parts.text;
+  if (!text || !Object.hasOwn(text, 'value') || text.value !== proof.startText) return ownedRows(plainData(input));
+  const shell = Object.create(Object.getPrototypeOf(input), {...fields, start: {...start,
+    value: Object.create(Object.getPrototypeOf(start.value), {...parts, text: {...text, value: ''}})}});
+  const ledger = ownedRows(plainData(shell));
+  ledger.start.text = proof.startText;
+  return ledger;
+}
+function ledgerAdmission(input) {
+  const held = input && typeof input === 'object' ? proofs.get(input) : undefined;
+  if (held && isOwnedLedger(input)) return {ledger: input, shell: held.shell, proof: held};
+  const ledger = copiedLedger(input, held);
   if (!exactKeys(ledger, ['format','documentAuthority','start','records','head','complete','sha256']) || ledger.format !== 'rapier-ledger/2' ||
       typeof ledger.documentAuthority !== 'string' || !ledger.documentAuthority || ledger.documentAuthority.length > 256 ||
       typeof ledger.complete !== 'boolean' || !Array.isArray(ledger.records) ||
       !exactKeys(ledger.start, ['text','revision','root','sha256','metadata']) || !exactKeys(ledger.head, ['revision','root','sha256','metadata'])) throw fault('unsupported or invalid envelope');
-  const shell = canonicalJSON({...ledger, start: {...ledger.start, text: ''}});
-  let proof = typeof input === 'object' ? proofs.get(input) : undefined;
-  if (!proof || proof.shell !== shell || proof.startText !== ledger.start.text) {
-    proof = {shell, startText: ledger.start.text, ...proveLedger(ledger)};
-    if (typeof input === 'object') proofs.set(input, proof);
-  }
-  proofs.set(ledger, proof);
+  const shell = Array.from(envelopeParts({...ledger, start: {...ledger.start, text: ''}})).join('');
+  const proof = held?.shell === shell && held.startText === ledger.start.text ? held : null;
+  return {ledger, shell, proof};
+}
+function ledgerResult(ledger, proof, expectedText, expectedMetadata) {
+  proofs.set(ledger, proof); ownLedger(ledger);
   const {text, metadata, root, revision, prepared, source} = proof;
   if (expectedMetadata !== undefined && (!_rapierValidMetadata(expectedMetadata) || canonicalJSON(metadata) !== canonicalJSON(expectedMetadata)))
     throw fault('metadata does not describe this document');
   if (expectedText !== undefined && text !== expectedText) throw fault('history does not describe this document');
-  return {value: {ledger, text, metadata: {...metadata}, root, revision, complete: ledger.complete}, prepared, source};
+  return {value: {ledger, text, metadata: {...metadata}, root, revision, complete: ledger.complete}, prepared, source, proof};
+}
+function readLedgerState(input, expectedText, expectedMetadata) {
+  const {ledger, shell, proof: held} = ledgerAdmission(input);
+  const proof = held || {shell, startText: ledger.start.text, ...finish(proveLedger(ledger))};
+  if (typeof input === 'object') proofs.set(input, proof);
+  return ledgerResult(ledger, proof, expectedText, expectedMetadata);
 }
-function proveLedger(ledger) {
+function* proveLedger(ledger, native = false) {
   const {sha256: claimed, ...payload} = ledger;
-  if (claimed !== digest(payload)) throw fault('envelope checksum differs');
-  let text = documentText(ledger.start.text), root = ledger.start.root, revision = ledger.start.revision;
+  if (claimed !== (yield* checksum(envelopeParts(payload), native))) throw fault('envelope checksum differs');
+  let text = ledger.start.text, root = ledger.start.root, revision = ledger.start.revision;
+  const startFacts = yield* sourceFacts(text, native);
   if (!_rapierValidMetadata(ledger.start.metadata) || !_rapierValidMetadata(ledger.head.metadata)) throw fault('invalid document metadata');
-  if (!nonnegative(revision) || !rootShape(root) || (revision === 0 && root !== textRoot(text)) || ledger.start.sha256 !== sha256(text) ||
+  if (!nonnegative(revision) || !rootShape(root) || (revision === 0 && root !== startFacts.contentRoot) || ledger.start.sha256 !== startFacts.sha256 ||
       (ledger.complete && revision !== 0)) throw fault('invalid start');
   const prepared = _rapierPrepareHistoryRecords(ledger.records);
   if (!prepared.ok) throw fault('record chain differs');
-  let source = new HistorySource(text), bytes = utf8Length(text);
+  let source = new HistorySource(text), bytes = startFacts.utf8Bytes;
   for (const record of checkedRecords(ledger, prepared)) {
     const next = source.apply(record.splices);
     if (next === null) throw fault('splice does not replay');
     source = next;
     for (const row of record.splices) bytes += utf8Length(row.inserted) - utf8Length(row.removed);
     if (bytes > 64 * 1024 * 1024) throw fault('document exceeds the editor text limit');
-    root = record.afterHash; revision = record.transaction.revision;
+    root = record.afterHash; revision = record.transaction.revision; yield;
   }
   text = source.slice();
   if (ledger.records.some(row => Object.hasOwn(row, 'authored'))) {
@@ -69,7 +105,8 @@ function proveLedger(ledger) {
   }
   const metadata = prepared.replayMetadata(ledger.start.metadata);
   if (!metadata || canonicalJSON(metadata) !== canonicalJSON(ledger.head.metadata)) throw fault('metadata does not describe this document');
-  if (ledger.head.revision !== revision || ledger.head.root !== root || ledger.head.sha256 !== sha256(text)) throw fault('history does not describe this document');
+  const headFacts = ledger.records.every(row => !row.splices.length) ? startFacts : yield* sourceFacts(text, native);
+  if (ledger.head.revision !== revision || ledger.head.root !== root || ledger.head.sha256 !== headFacts.sha256) throw fault('history does not describe this document');
   return {text, metadata, root, revision, prepared, source};
 }
 export function ledgerWithStart(input, text) {
@@ -83,14 +120,25 @@ export function ledgerWithStart(input, text) {
 export function readLedger(input, expectedText, expectedMetadata) {
   return readLedgerState(input, expectedText, expectedMetadata).value;
 }
-function* checksum(parts) {
+export async function readLedgerAsync(input, expectedText, expectedMetadata, options = {}) {
+  options.signal?.throwIfAborted();
+  const {ledger, shell, proof: held} = ledgerAdmission(input);
+  const metadata = expectedMetadata === undefined ? undefined : plainData(expectedMetadata);
+  const proof = held || {shell, startText: ledger.start.text,
+    ...await finishAsync(proveLedger(ledger, !!globalThis.crypto?.subtle), options)};
+  options.signal?.throwIfAborted();
+  if (typeof input === 'object') proofs.set(input, proof);
+  return ledgerResult(ledger, proof, expectedText, metadata).value;
+}
+function* checksum(parts, native = false) {
+  if (native) return yield {parts};
   const hash = createSHA256();
   for (const part of parts) { hash.update(part); yield; }
   return hash.digest();
 }
-function* sourceFacts(text) {
+function* sourceFacts(text, native = false) {
   if (typeof text !== 'string') throw fault('document is not whole-character text');
-  const hash = createSHA256();
+  const hash = native ? null : createSHA256();
   let fnv = 0x811c9dc5, a = 1, b = 0, bytes = 0;
   for (let at = 0; at < text.length;) {
     const start = at, end = Math.min(text.length, at + 65536);
@@ -112,26 +160,34 @@ function* sourceFacts(text) {
       a %= 65521; b %= 65521;
     }
     if (bytes > 64 * 1024 * 1024) throw fault('document exceeds the editor text limit');
-    hash.update(text.slice(start, end)); yield;
+    hash?.update(text.slice(start, end)); yield;
   }
-  return {utf8Bytes: bytes, sha256: hash.digest(), contentRoot: text.length + ':' +
+  const digest = hash ? hash.digest() : yield {parts: [text], byteLength: bytes};
+  return {utf8Bytes: bytes, sha256: digest, contentRoot: text.length + ':' +
     (fnv >>> 0).toString(36) + ':' + (((b << 16) | a) >>> 0).toString(36)};
 }
-function* produceLedger({text, metadata, records, documentAuthority, revision, root, complete = false, earlier = records} = {}) {
+const expandedRows = new WeakMap();
+const sameSplices = (a, b) => a === b || a.length === b.length &&
+  a.every((row, i) => row.pos === b[i].pos && row.removed === b[i].removed && row.inserted === b[i].inserted);
+const sameEffect = (a, b) => a === b || !!a && !!b && canonicalJSON(a) === canonicalJSON(b);
+function* produceLedger({text, metadata, records, documentAuthority, revision, root, complete = false, earlier = records} = {}, native = false) {
   if (!_rapierValidMetadata(metadata)) throw fault('document metadata required');
   metadata = {...metadata};
   if (!Array.isArray(records) || !Array.isArray(earlier)) throw fault('records required');
   const prepared = _rapierPrepareHistoryRecords(records, earlier);
   if (!prepared.ok) throw fault('navigation target was not retained');
-  const headFacts = yield* sourceFacts(text);
+  const headFacts = yield* sourceFacts(text, native);
   let bytes = headFacts.utf8Bytes;
   const expanded = [];
   for (const {record, splices: rows, metadata: effect} of prepared.rows) {
     if (!rows || effect === undefined) throw fault('navigation target was not retained');
-    expanded.push({transaction: plainData(record.transaction), splices: rows.map(row => ({pos: row.pos, removed: row.removed, inserted: row.inserted})),
+    const held = expandedRows.get(record);
+    if (held && sameSplices(held.rows, rows) && sameEffect(held.effect, effect)) { expanded.push(held.row); yield; continue; }
+    expanded.push(ownRow({transaction: plainData(record.transaction), splices: rows.map(row => ({pos: row.pos, removed: row.removed, inserted: row.inserted})),
       beforeHash: record.beforeHash, afterHash: record.afterHash, ...(Object.hasOwn(record, 'authored') ? {authored: plainData(record.authored)} : {}), ...(effect ? {metadata: plainData(effect)} : {}),
       ...(record.changeSet && Object.hasOwn(record.changeSet, 'label') ? {changeSet: {label: typeof record.changeSet.label === 'string' ? record.changeSet.label : plainData(record.changeSet.label)}} : {}),
-      ...(record.derivedCommentIndex == null ? {} : {derivedCommentIndex: typeof record.derivedCommentIndex === 'string' ? record.derivedCommentIndex : plainData(record.derivedCommentIndex)})});
+      ...(record.derivedCommentIndex == null ? {} : {derivedCommentIndex: typeof record.derivedCommentIndex === 'string' ? record.derivedCommentIndex : plainData(record.derivedCommentIndex)})}));
+    expandedRows.set(record, {row: expanded.at(-1), rows, effect});
     yield;
   }
   const headBytes = bytes;
@@ -153,7 +209,7 @@ function* produceLedger({text, metadata, records, documentAuthority, revision, r
   const startRevision = expanded[0]?.transaction.baseRevision ?? revision, startRoot = expanded[0]?.beforeHash ?? root;
   if (typeof documentAuthority !== 'string' || !documentAuthority || documentAuthority.length > 256) throw fault('unsupported or invalid envelope');
   if (!nonnegative(startRevision) || !rootShape(startRoot)) throw fault('invalid start');
-  const startFacts = unchangedText ? headFacts : yield* sourceFacts(startText);
+  const startFacts = unchangedText ? headFacts : yield* sourceFacts(startText, native);
   if (startRevision === 0 && startRoot !== startFacts.contentRoot) throw fault('invalid start');
   const headSHA = headFacts.sha256, startSHA = startFacts.sha256;
   const payload = {format: 'rapier-ledger/2', documentAuthority,
@@ -165,7 +221,11 @@ function* produceLedger({text, metadata, records, documentAuthority, revision, r
   }
   const replayedMetadata = prepared.replayMetadata(startMetadata);
   if (!replayedMetadata || canonicalJSON(replayedMetadata) !== canonicalJSON(metadata)) throw fault('metadata does not describe this document');
-  const ledger = {...payload, sha256: yield* checksum(canonicalParts(payload))};
+  const ledger = {...payload, sha256: yield* checksum(envelopeParts(payload), native)};
+  ownLedger(ledger);
+  proofs.set(ledger, {shell: Array.from(envelopeParts({...ledger, start: {...ledger.start, text: ''}})).join(''), startText,
+    text, metadata: {...metadata}, root, revision, prepared: _rapierPrepareHistoryRecords(ledger.records),
+    source: new HistorySource(text)});
   return {ledger, contentRoot, utf8Bytes: headBytes};
 }
 function finish(producer) {
@@ -174,13 +234,14 @@ function finish(producer) {
   return step.value;
 }
 export function exportLedger(input) { return finish(produceLedger(input)).ledger; }
-export async function prepareLedgerAsync(input, {yield: yieldWork, signal} = {}) {
-  const producer = produceLedger(input);
-  let step;
+async function finishAsync(producer, {yield: yieldWork, signal} = {}) {
+  let step, digest;
   do {
     signal?.throwIfAborted();
-    step = producer.next();
-    if (!step.done && yieldWork) {
+    step = producer.next(digest); digest = undefined;
+    if (!step.done && step.value) digest = await sha256PartsAsync(step.value.parts,
+      {yield: yieldWork, signal, byteLength: step.value.byteLength});
+    else if (!step.done && yieldWork) {
       const pending = yieldWork();
       if (pending) await pending;
     }
@@ -188,8 +249,10 @@ export async function prepareLedgerAsync(input, {yield: yieldWork, signal} = {})
   signal?.throwIfAborted();
   return step.value;
 }
-export function historyEnvelope(input, segmentIdentity = [], expectedText, expectedMetadata) {
-  const {value: {ledger, text, metadata}, prepared, source} = readLedgerState(input, expectedText, expectedMetadata);
+export function prepareLedgerAsync(input, options = {}) {
+  return finishAsync(produceLedger(input, !!globalThis.crypto?.subtle), options);
+}
+function historyNavigation(ledger, text, metadata, prepared, source) {
   const {byId, effects: {pictures}} = prepared;
   let branch = [], cursor = 0;
   for (const {transaction: tx} of ledger.records) {
@@ -232,8 +295,13 @@ export function historyEnvelope(input, segmentIdentity = [], expectedText, expec
       if (active === null || !activeMetadata || (i + 1 === cursor && (active.length !== text.length || !active.matches(0, text) || canonicalJSON(activeMetadata) !== canonicalJSON(metadata)))) throw fault('complete branch differs');
     }
   }
+  return {branch, cursor};
+}
+export function historyEnvelope(input, segmentIdentity = [], expectedText, expectedMetadata) {
+  const {value: {ledger, text, metadata}, prepared, source, proof} = readLedgerState(input, expectedText, expectedMetadata);
+  const {branch, cursor} = proof.navigation ??= historyNavigation(ledger, text, metadata, prepared, source);
   return {schemaVersion: 5, documentAuthority: ledger.documentAuthority, documentRevision: ledger.head.revision,
-    ledger: ledger.records, branch, cursor, earliestRevision: ledger.start.revision, earliestHash: ledger.start.root,
+    ledger: ledger.records, branch: branch.slice(), cursor, earliestRevision: ledger.start.revision, earliestHash: ledger.start.root,
     sourceRootId: ledger.head.root, earliestMetadata: {...ledger.start.metadata}, documentMetadata: {...metadata}, segmentIdentity, historyComplete: ledger.complete,
     trimReason: ledger.complete ? '' : 'carried_start', trimmedBytes: 0};
 }
@@ -249,15 +317,14 @@ export function agentActorId(door, agent) {
 export function replaceLedgerText(input, text, {actor = {kind: 'system', id: 'rapier'}, operation = 'document.replace', at} = {}) {
   const current = readLedger(input); documentText(text);
   if (current.text === text) return current.ledger;
-  let start = 0, a = current.text.length, b = text.length;
-  while (start < a && start < b && current.text[start] === text[start]) start++;
-  if (start && /[\uDC00-\uDFFF]/.test(current.text[start] || text[start] || '')) start--;
-  while (a > start && b > start && current.text[a - 1] === text[b - 1]) { a--; b--; }
-  if (/[\uDC00-\uDFFF]/.test(current.text[a] || text[b] || '')) { a++; b++; }
-  const splices = [{pos: start, removed: current.text.slice(start, a), inserted: text.slice(start, b)}];
-  const revision = current.revision + 1, root = rootAfter(current.root, splices[0]);
+  const splices = diff(current.text, text, {_unit: 'word'}).edits.map(edit =>
+    minimalHistorySplice(current.text.slice(...edit.before), text.slice(...edit.after), edit.before[0])).reverse();
+  const revision = current.revision + 1, root = splices.reduce(rootAfter, current.root);
+  if (actor.kind === 'agent' && current.metadata.docKind === 'markdown' && evaluateWill(current.text, splices).outcome !== 'applied')
+    throw fault('will_violation');
+  const identity = sha256(canonicalJSON({before: current.ledger.sha256, text, actor, operation, at: at ?? null}));
   const record = {beforeHash: current.root, afterHash: root, splices, transaction: {
-    id: current.ledger.documentAuthority.slice(0, 48) + ':export:' + revision.toString(36),
+    id: current.ledger.documentAuthority.slice(0, 48) + ':export:' + identity,
     documentAuthority: current.ledger.documentAuthority, baseRevision: current.revision, revision,
     actor, transport: 'platform', operation, requestId: null, sourceTransactionId: null,
     affectedBlockIds: [], parent: current.ledger.records.at(-1)?.transaction.id ?? null,

package/dist/ledger/hash.mjs

@@ -111,9 +111,50 @@ export function sha256Parts(parts) {
   for (const part of parts) hash.update(part);
   return hash.digest();
 }
-const LONG_TEXT = 65536, DIGESTS = new Map();
+export async function sha256PartsAsync(parts, {yield: yieldWork, signal, byteLength} = {}) {
+  const encoder = new TextEncoder(), chunks = [];
+  let bytes = byteLength === undefined ? null : new Uint8Array(byteLength);
+  let high = '', length = 0;
+  const write = text => {
+    if (bytes) {
+      const result = encoder.encodeInto(text, bytes.subarray(length));
+      if (result.read !== text.length) throw new RangeError('SHA-256 byte length differs');
+      length += result.written;
+    } else {
+      const chunk = encoder.encode(text); chunks.push(chunk); length += chunk.length;
+    }
+  };
+  for (const value of parts) {
+    let text = high + String(value === undefined ? '' : value); high = '';
+    if (text.length && (text.charCodeAt(text.length - 1) & 0xfc00) === 0xd800) {
+      high = text.slice(-1); text = text.slice(0, -1);
+    }
+    for (let at = 0; at < text.length;) {
+      signal?.throwIfAborted();
+      let end = Math.min(text.length, at + 32768);
+      if (end < text.length && (text.charCodeAt(end - 1) & 0xfc00) === 0xd800 &&
+          (text.charCodeAt(end) & 0xfc00) === 0xdc00) end--;
+      write(text.slice(at, end)); at = end;
+      const pending = yieldWork?.(); if (pending) await pending;
+    }
+  }
+  if (high) write(high);
+  if (bytes && length !== bytes.length) throw new RangeError('SHA-256 byte length differs');
+  bytes ||= new Uint8Array(length);
+  let at = 0;
+  for (const chunk of chunks) {
+    signal?.throwIfAborted(); bytes.set(chunk, at); at += chunk.length;
+    const pending = yieldWork?.(); if (pending) await pending;
+  }
+  chunks.length = 0;
+  signal?.throwIfAborted();
+  const digest = await globalThis.crypto.subtle.digest('SHA-256', bytes);
+  signal?.throwIfAborted();
+  return Array.from(new Uint8Array(digest), value => value.toString(16).padStart(2, '0')).join('');
+}
+const LONG_TEXT = 65536, DOCUMENT_TEXT = 1048576, DIGESTS = new Map();
 export function sha256(text) {
-  if (typeof text !== 'string' || text.length < LONG_TEXT) return createSHA256().update(text).digest();
+  if (typeof text !== 'string' || text.length < LONG_TEXT || text.length >= DOCUMENT_TEXT) return createSHA256().update(text).digest();
   let digest = DIGESTS.get(text);
   if (digest === undefined) {
     digest = createSHA256().update(text).digest();

package/dist/ledger/history.mjs

@@ -5,6 +5,7 @@ import {sourceView, HistorySource} from './source.mjs';
 import {textRootParts, rootAfter} from './hash.mjs';
 import {authoredHistory, authoredPlacements} from './transport.mjs';
 import {plainData, canonicalJSON} from './data.mjs';
+import {evaluateWill} from './will.mjs';
 
 const historyFailure = reason => ({ok: false, reason});
 const historyInteger = value => Number.isSafeInteger(value) && value >= 0 && !Object.is(value, -0);
@@ -323,6 +324,8 @@ export function selectiveUndo(input, actIds, options = {}) {
 		(options.splitSplice !== undefined && typeof options.splitSplice !== 'function')) return historyFailure('act_invalid');
 	const requested = new Set(actIds), available = prepared.byId;
 	if ([...requested].some(id => !available.has(id))) return historyFailure('act_unavailable');
+	if (options.actor?.kind === 'agent' && [...requested].some(id => available.get(id).record.transaction.actor.kind !== 'agent'))
+		return historyFailure('act_forbidden');
 	const selected = new Set([...requested].filter(id => prepared.effects.active.has(id)));
 	const records = prepared.records;
 	let inverseId = 'planned-inverse'; while (available.has(inverseId)) inverseId += ':';
@@ -359,6 +362,9 @@ export function selectiveUndo(input, actIds, options = {}) {
 			sourceIndices: transported.sourceIndices.get(record.transaction.id)})) : prepared.rows;
 		const result = projectInverseSource(transported ? {...prepared, rows, records: transported.records} : prepared, selected, projectedEffects, options);
 		if (!result.ok) return result;
+		if (options.actor?.kind === 'agent' && prepared.metadata.docKind === 'markdown' &&
+			evaluateWill(prepared.source, result.splices, {restores: result.splices}).outcome !== 'applied')
+			return historyFailure('will_refused');
 		return {...result, actIds: [...requested], sourceTransactionIds: [...selected], metadata, afterMetadata,
 			effectChanged, unchanged: result.after === prepared.source && !metadata && !effectChanged};
 	} catch (_) { return historyFailure('history_invalid'); }