rapier-markdown-kit 1.1.101 → 1.1.104

package/dist/agent/will.mjs

@@ -59,6 +59,8 @@ function _rapierWillParse(text) {
 	const will = {
 		present: false, fault: '', faults: [], blocks: [], markers: [], regions: [], text: source,
 	};
+	// A marker, well formed or near, opens its line with one of the four spellings hasWillMarkers looks for.
+	if (!hasWillMarkers(source)) return will;
 	let open = null;
 	for (let index = 0, start = 0; start <= source.length; index++) {
 		let contentEnd = start;

package/dist/kit/assets.mjs

@@ -1,3 +1,7 @@
 // SPDX-License-Identifier: MIT
 // Re-export from ../spec/md-assets.mjs only: ../images/assets.mjs pulls AGPL decoders into the MIT graph (tools/check-kit.mjs).
-export * from '../spec/md-assets.mjs';
+// The kit's names are listed: that module also exports what only Rapier's own parser consumers share.
+export {IMAGE_LIMITS, configureParser, normalizeLabel, assetTitle, installMarkdownImages, markdownParser, markdownBodyOffset,
+  dataImage, parseAssets, documentAssets, packAssetIndex, restoreAssetIndex, projectImageDefinitions, blockwiseAssets,
+  imageEnvironment, referenceOccurs, mayRetireImageDefinitions, retireDeletedImageDefinitions, assetOmissions, isAssetBlock,
+  escapeImageAlt, serializeAsset, appendAssetText, appendAsset} from '../spec/md-assets.mjs';

package/dist/kit/conformance/run.mjs

@@ -19,7 +19,7 @@ function parseArgs(argv) {
 const args = parseArgs(process.argv.slice(2));
 const impl = await import(args.impl.startsWith('file://') ? args.impl : 'file://' + args.impl);
 
-const need = ['parseLayout', 'formatLayout', 'prepareRun', 'prepareRichInline', 'flowLines', 'pictureSlices', 'bandsProfile', 'polygonProfile', 'rasterTiltProfile', 'parseProfile', 'wrapColumnFloor'];
+const need = ['parseLayout', 'formatLayout', 'createPreparationScope', 'flowLines', 'pictureSlices', 'bandsProfile', 'polygonProfile', 'rasterTiltProfile', 'parseProfile', 'wrapColumnFloor'];
 const missing = need.filter(name => typeof impl[name] !== 'function');
 if (missing.length) { console.error('run.mjs: implementation at ' + args.impl + ' is missing: ' + missing.join(', ')); process.exit(2); }
 
@@ -34,6 +34,7 @@ function buildProfile(hint) {
 const documents = loadDocuments(here);
 // Install once over merged data: Pretext memoizes its context (measurer.mjs).
 const measurer = installMeasurer(documents);
+const preparation = impl.createPreparationScope();
 
 // Preservation and presentation are separate claims; preservation is exact or a bug.
 const preservationRows = documents.map(expected => {
@@ -62,9 +63,8 @@ const rows = [];
 for (const expected of documents) {
 	const font = expected.measurer.font.replace(/\/[^ ]+ /, ' '); // canvas fonts take no line-height
 	const before = {hits: measurer.stats.hits, misses: measurer.stats.misses};
-	const run = impl.prepareRun(expected.anchorText, font, expected.measurer.letterSpacing || 0);
-	if (!run) { rows.push({document: expected.document, verdict: 'ERROR', detail: 'prepareRun refused this font/text/letterSpacing'}); continue; }
-	const flow = impl.prepareRichInline([{text: run.raw, font, letterSpacing: expected.measurer.letterSpacing || 0}]);
+	const flow = preparation.prepare(expected, [{text: expected.anchorText, font, letterSpacing: expected.measurer.letterSpacing || 0}]);
+	if (!flow) { rows.push({document: expected.document, verdict: 'ERROR', detail: 'rich preparation refused this font/text/letterSpacing'}); continue; }
 	let obstacles = [];
 	if (expected.picture?.rect) {
 		const profile = buildProfile(expected.profileHint);

package/dist/kit/export-fonts.mjs

@@ -157,13 +157,17 @@ function unicodeIncludes(face, character) {
   });
 }
 
-function writeFace(face, bytes) {
+function fontSource(bytes) {
   const signature = String.fromCharCode(...bytes.subarray(0, 4));
   const format = signature === 'wOFF' ? 'woff' : signature === 'wOF2' ? 'woff2' : signature === 'OTTO' ? 'opentype' : 'truetype';
   const mime = {woff: 'woff', woff2: 'woff2', opentype: 'otf', truetype: 'ttf'}[format];
   let binary = '';
   for (let at = 0; at < bytes.length; at += 16384) binary += String.fromCharCode(...bytes.subarray(at, at + 16384));
-  const properties = {...face.properties, src: 'url("data:font/' + mime + ';base64,' + btoa(binary) + '") format("' + format + '")'};
+  return 'url("data:font/' + mime + ';base64,' + btoa(binary) + '") format("' + format + '")';
+}
+
+function writeFace(face, source) {
+  const properties = {...face.properties, src: source};
   delete properties['unicode-range'];
   return '@font-face{' + Object.entries(properties).map(([name, value]) => name + ':' + value).join(';') + '}';
 }
@@ -291,20 +295,31 @@ export async function exportFontCss(root, {settings, css = '', fontCss = '', sub
       const custom = new Set(fontFaces(customFontCss).map(face => face.family));
       candidates = candidates.filter(face => face.family === 'geist' && !custom.has(face.family));
     }
-    const faces = fontRuns(root, {settings, css, faces: candidates}), output = [];
+    const faces = fontRuns(root, {settings, css, faces: candidates}), output = [], prepared = new Map();
     let payloadBytes = 0;
     for (const face of faces) {
-      const original = Uint8Array.from(atob(face.source.slice(face.source.indexOf(',') + 1)), character => character.charCodeAt(0));
       // Adjacent inline nodes retain shaping sequences; independent runs cannot compose together.
-      const bytes = await subset(original, face.runs.join('\n'));
+      const text = face.runs.join('\n');
+      if (!prepared.has(face.source)) prepared.set(face.source, new Map());
+      const variants = prepared.get(face.source);
+      if (!variants.has(text)) {
+        const original = Uint8Array.from(atob(face.source.slice(face.source.indexOf(',') + 1)), character => character.charCodeAt(0));
+        const bytes = await subset(original, text);
+        if (portableFactory) {
+          if (!(bytes instanceof Uint8Array) || !bytes.length || bytes.length >= original.length || bytes.length > FACTORY_FONT_BYTES) return '';
+          if (typeof validateFont !== 'function' || await validateFont(Uint8Array.from(bytes), {family: 'Geist'}) !== true) return '';
+        } else if (bytes === null) { variants.set(text, null); continue; }
+        if (!(bytes instanceof Uint8Array) || !bytes.length) throw new Error('The page font subset is empty.');
+        // Retain the encoded boundary value, not additional original or subset byte buffers.
+        variants.set(text, {source: fontSource(bytes), length: bytes.length});
+      }
+      const saved = variants.get(text);
+      if (saved === null) continue;
       if (portableFactory) {
-        if (!(bytes instanceof Uint8Array) || !bytes.length || bytes.length >= original.length) return '';
-        payloadBytes += bytes.length;
+        payloadBytes += saved.length;
         if (payloadBytes > FACTORY_FONT_BYTES) return '';
-        if (typeof validateFont !== 'function' || await validateFont(Uint8Array.from(bytes), {family: 'Geist'}) !== true) return '';
-      } else if (bytes === null) continue;
-      if (!(bytes instanceof Uint8Array) || !bytes.length) throw new Error('The page font subset is empty.');
-      output.push(writeFace(face, bytes));
+      }
+      output.push(writeFace(face, saved.source));
     }
     const result = output.join('\n');
     return portableFactory && new TextEncoder().encode(result).length > FACTORY_FONT_CSS_BYTES ? '' : result;

package/dist/kit/index.mjs

@@ -2,6 +2,7 @@
 export * from './layout.mjs';
 export * from './marks.mjs';
 export * from './model.mjs';
+export * from './typography.mjs';
 export * from './will.mjs';
 export * from './assets.mjs';
 export * from './render-entry.mjs';

package/dist/kit/ledger/carried.mjs

@@ -71,18 +71,20 @@ export function readDocument(source) {
 
 // One portable baseline. A digest is integrity evidence, not authentication of the named author.
 export function readBase(value) {
-  if (!value || typeof value !== 'object' || typeof value.text !== 'string' ||
-      typeof value.sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(value.sha256) || sha256(value.text) !== value.sha256)
+  if (!value || typeof value !== 'object') throw fault('comparison base SHA-256 differs from its text');
+  // Capture each caller-owned field once; admission and serialization use these same scalars.
+  const {text, sha256: digest, revision, name, by, at} = value;
+  if (typeof text !== 'string' || typeof digest !== 'string' || !/^[a-f0-9]{64}$/.test(digest) || sha256(text) !== digest)
     throw fault('comparison base SHA-256 differs from its text');
-  if (typeof value.revision !== 'string' || !value.revision || value.revision.length > 256 || /[\u0000-\u001f\u007f]/.test(value.revision))
+  if (typeof revision !== 'string' || !revision || revision.length > 256 || /[\u0000-\u001f\u007f]/.test(revision))
     throw fault('invalid comparison base revision');
-  if (typeof value.name !== 'string' || !value.name || [...value.name].length > 256 || /[\\/\u0000-\u001f\u007f]/.test(value.name))
+  if (typeof name !== 'string' || !name || [...name].length > 256 || /[\\/\u0000-\u001f\u007f]/.test(name))
     throw fault('invalid comparison base name');
-  if (typeof value.by !== 'string' || !value.by.trim() || value.by.length > 96 || /[\u0000-\u001f\u007f]/.test(value.by))
+  if (typeof by !== 'string' || !by.trim() || by.length > 96 || /[\u0000-\u001f\u007f]/.test(by))
     throw fault('a comparison needs its author name');
-  if (typeof value.at !== 'string' || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/.test(value.at) || !Number.isFinite(Date.parse(value.at)))
+  if (typeof at !== 'string' || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/.test(at) || !Number.isFinite(Date.parse(at)))
     throw fault('the time of a comparison is an ISO 8601 UTC timestamp');
-  return {text: value.text, sha256: value.sha256, revision: value.revision, name: value.name, by: value.by, at: value.at};
+  return {text, sha256: digest, revision, name, by, at};
 }
 const escapeAttribute = value => value.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
 const readAttribute = value => value.replace(/&(quot|lt|gt|amp);/g, (_, name) => ({quot: '"', lt: '<', gt: '>', amp: '&'})[name]);

package/dist/kit/ledger/data.mjs

@@ -1,10 +1,7 @@
 // SPDX-License-Identifier: MIT
 // Only plain JSON data enters the public format. Accessors and toJSON are never executed.
 export function fault(message) { return Object.assign(new Error('Ledger: ' + message), {code: 'ledger_invalid'}); }
-export function canonicalJSON(value, depth = 0, active = new Set()) {
-  if (value === null || typeof value === 'boolean') return JSON.stringify(value);
-  if (typeof value === 'string') { if (/[\uD800-\uDFFF]/u.test(value)) throw fault('unpaired surrogate'); return JSON.stringify(value); }
-  if (typeof value === 'number' && Number.isFinite(value) && !Object.is(value, -0)) return JSON.stringify(value);
+function fields(value, depth, active, sorted = true) {
   if (!value || typeof value !== 'object' || depth > 64 || active.has(value)) throw fault('not plain JSON data');
   const array = Array.isArray(value), proto = Object.getPrototypeOf(value);
   if (!array && proto !== null && (Object.getPrototypeOf(proto) !== null || Object.getOwnPropertyDescriptor(proto, 'constructor')?.value?.name !== 'Object')) throw fault('not a plain object');
@@ -15,19 +12,82 @@ export function canonicalJSON(value, depth = 0, active = new Set()) {
     if (typeof key !== 'string' || ['__proto__', 'constructor', 'prototype'].includes(key) || !Object.hasOwn(field, 'value') || !field.enumerable) throw fault('non-data property');
   }
   if (array && (keys.length !== value.length + 1 || keys.some(k => k !== 'length' && (!/^(0|[1-9]\d*)$/.test(k) || +k >= value.length)))) throw fault('sparse array');
+  return {array, descriptors, keys: array ? keys.filter(key => key !== 'length') : sorted ? keys.sort() : keys};
+}
+function scalar(value) {
+  if (value === null || typeof value === 'boolean') return true;
+  if (typeof value === 'string') { if (/[\uD800-\uDFFF]/u.test(value)) throw fault('unpaired surrogate'); return true; }
+  return typeof value === 'number' && Number.isFinite(value) && !Object.is(value, -0);
+}
+// A canonical copy does not need a serialized document and a second parsed document.
+// Sorted insertion preserves the previous plainData result, including numeric-key ordering.
+export function plainData(value) {
+  if (typeof value === 'string') value = JSON.parse(value);
+  const active = new Set();
+  const copy = (value, depth) => {
+    if (scalar(value)) return value;
+    const {array, descriptors, keys} = fields(value, depth, active);
+    const out = array ? [] : {};
+    active.add(value);
+    for (const key of keys) out[key] = copy(descriptors[key].value, depth + 1);
+    active.delete(value); return out;
+  };
+  return copy(value, 0);
+}
+// Each yielded string is bounded, even when one value contains the whole document.
+// JSON.stringify still owns escaping; scalar boundaries keep its spelling exact.
+function* quoted(text, whole = true) {
+  yield '"';
+  for (let at = 0; at < text.length;) {
+    let end = Math.min(text.length, at + 16384);
+    if (end < text.length && (text.charCodeAt(end - 1) & 0xfc00) === 0xd800 && (text.charCodeAt(end) & 0xfc00) === 0xdc00) end--;
+    const part = text.slice(at, end);
+    if (whole && /[\uD800-\uDFFF]/u.test(part)) throw fault('unpaired surrogate');
+    yield JSON.stringify(part).slice(1, -1); at = end;
+  }
+  yield '"';
+}
+function* dataParts(value, depth, active, sorted) {
+  if (typeof value === 'string') { yield* quoted(value); return; }
+  if (value === null || typeof value === 'boolean' || typeof value === 'number' && Number.isFinite(value) && !Object.is(value, -0)) {
+    yield JSON.stringify(value); return;
+  }
+  const {array, descriptors, keys} = fields(value, depth, active, sorted);
   active.add(value);
-  const encode = item => canonicalJSON(item, depth + 1, active);
-  const out = array ? '[' + Array.from({length: value.length}, (_, i) => encode(descriptors[i].value)).join(',') + ']'
-    : '{' + keys.sort().map(key => JSON.stringify(key) + ':' + encode(descriptors[key].value)).join(',') + '}';
-  active.delete(value); return out;
+  yield array ? '[' : '{';
+  for (let i = 0; i < keys.length; i++) {
+    if (i) yield ',';
+    const key = keys[i];
+    if (!array) { yield* quoted(key, false); yield ':'; }
+    yield* dataParts(descriptors[key].value, depth + 1, active, sorted);
+  }
+  yield array ? ']' : '}';
+  active.delete(value);
 }
-export function plainData(value) { return JSON.parse(canonicalJSON(typeof value === 'string' ? JSON.parse(value) : value)); }
+export function canonicalParts(value, depth = 0, active = new Set()) { return dataParts(value, depth, active, true); }
+export function jsonParts(value) { return dataParts(value, 0, new Set(), false); }
+export function canonicalJSON(value, depth = 0, active = new Set()) { return Array.from(canonicalParts(value, depth, active)).join(''); }
 export function exactKeys(value, keys) {
   return value && typeof value === 'object' && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every(key => Object.hasOwn(value, key));
 }
-export function documentText(text) {
-  if (typeof text !== 'string' || /[\uD800-\uDFFF]/u.test(text)) throw fault('document is not whole-character text');
-  if (new TextEncoder().encode(text).length > 64 * 1024 * 1024) throw fault('document exceeds the editor text limit');
-  return text;
+// TextEncoder's exact byte count, without allocating an encoded copy. Whole-character
+// admission is performed in this same pass when the document owner requests it.
+export function utf8Length(text, whole = false) {
+  let bytes = 0;
+  for (let at = 0; at < text.length; at++) {
+    const code = text.charCodeAt(at);
+    if (code < 0x80) bytes++;
+    else if (code < 0x800) bytes += 2;
+    else if ((code & 0xfc00) === 0xd800 && (text.charCodeAt(at + 1) & 0xfc00) === 0xdc00) { bytes += 4; at++; }
+    else { if (whole && code >= 0xd800 && code <= 0xdfff) throw fault('document is not whole-character text'); bytes += 3; }
+  }
+  return bytes;
+}
+export function documentBytes(text) {
+  if (typeof text !== 'string') throw fault('document is not whole-character text');
+  const bytes = utf8Length(text, true);
+  if (bytes > 64 * 1024 * 1024) throw fault('document exceeds the editor text limit');
+  return bytes;
 }
+export function documentText(text) { documentBytes(text); return text; }
 export const nonnegative = value => Number.isSafeInteger(value) && value >= 0 && !Object.is(value, -0);

package/dist/kit/ledger/format.mjs

@@ -1,13 +1,33 @@
 // SPDX-License-Identifier: MIT
-import {_rapierValidLedgerRecord, _rapierRecordSplices, _rapierTransformSplices, _rapierRecordMetadata, _rapierValidMetadata, _rapierTransformMetadata, _rapierReplayMetadata, _rapierHistoryEffects} from './journal-records.mjs';
+import {_rapierPrepareHistoryRecords, _rapierValidMetadata, _rapierTransformMetadata} from './journal-records.mjs';
 import {pictureHistorySplices} from './history.mjs';
+import {HistorySource} from './inverse-source.mjs';
 import {authoredHistory} from './transport.mjs';
-import {textRoot, rootAfter, sha256} from './hash.mjs';
-import {canonicalJSON, plainData, documentText, exactKeys, nonnegative, fault} from './data.mjs';
+import {textRoot, rootAfter, sha256, sha256Parts, createSHA256} from './hash.mjs';
+import {canonicalJSON, canonicalParts, plainData, documentText, utf8Length, exactKeys, nonnegative, fault} from './data.mjs';
 export {textRoot, rootAfter};
-const digest = value => sha256(canonicalJSON(value));
+const digest = value => sha256Parts(canonicalParts(value));
 const rootShape = value => typeof value === 'string' && /^\d+:[a-z0-9]+:[a-z0-9]+$/.test(value);
-export function readLedger(input, expectedText, expectedMetadata) {
+// Structural/history admission is shared by the reader and the producer. The producer
+// proves source replay by reversing exact admitted splices; it need not replay its output.
+function* checkedRecords(ledger, prepared) {
+  if (!prepared.ok || ledger.records.length !== prepared.records.length) throw fault('record chain differs');
+  let root = ledger.start.root, revision = ledger.start.revision;
+  for (let index = 0; index < prepared.records.length; index++) {
+    const record = ledger.records[index];
+    if (!Array.isArray(record.splices) || !prepared.validRecord(index,
+        ledger.documentAuthority, 64 * 1024 * 1024, utf8Length, !ledger.complete) ||
+        record.transaction.baseRevision < revision || (record.transaction.baseRevision !== revision && ledger.complete) ||
+        (record.transaction.baseRevision === revision && record.beforeHash !== root)) throw fault('record chain differs');
+    if (record.transaction.baseRevision !== revision) root = record.beforeHash;
+    for (const row of record.splices) root = rootAfter(root, row);
+    if (root !== record.afterHash) throw fault('record root differs');
+    revision = record.transaction.revision;
+    yield record;
+  }
+  if (ledger.head.revision !== revision || ledger.head.root !== root) throw fault('history does not describe this document');
+}
+function readLedgerState(input, expectedText, expectedMetadata) {
   const ledger = plainData(input);
   if (!exactKeys(ledger, ['format','documentAuthority','start','records','head','complete','sha256']) || ledger.format !== 'rapier-ledger/2' ||
       typeof ledger.documentAuthority !== 'string' || !ledger.documentAuthority || ledger.documentAuthority.length > 256 ||
@@ -19,102 +39,195 @@ export function readLedger(input, expectedText, expectedMetadata) {
   if (!_rapierValidMetadata(ledger.start.metadata) || !_rapierValidMetadata(ledger.head.metadata)) throw fault('invalid document metadata');
   if (!nonnegative(revision) || !rootShape(root) || (revision === 0 && root !== textRoot(text)) || ledger.start.sha256 !== sha256(text) ||
       (ledger.complete && revision !== 0)) throw fault('invalid start');
-  const earlier = [];
-  for (const record of ledger.records) {
-    if (!Array.isArray(record.splices) || !_rapierValidLedgerRecord(record, earlier.at(-1) || null, earlier,
-        ledger.documentAuthority, 64 * 1024 * 1024, text => new TextEncoder().encode(text).length, !ledger.complete) ||
-        record.transaction.baseRevision < revision || (record.transaction.baseRevision !== revision && ledger.complete) ||
-        (record.transaction.baseRevision === revision && record.beforeHash !== root)) throw fault('record chain differs');
-    // A pruned cancelling pair leaves a stated revision gap, just as in the editor's restore reader.
-    if (record.transaction.baseRevision !== revision) root = record.beforeHash;
-    const next = _rapierTransformSplices(text, record.splices);
+  const prepared = _rapierPrepareHistoryRecords(ledger.records);
+  if (!prepared.ok) throw fault('record chain differs');
+  let source = new HistorySource(text), bytes = utf8Length(text);
+  for (const record of checkedRecords(ledger, prepared)) {
+    const next = source.apply(record.splices);
     if (next === null) throw fault('splice does not replay');
-    text = documentText(next);
-    for (const row of record.splices) root = rootAfter(root, row);
-    if (root !== record.afterHash) throw fault('record root differs');
-    revision = record.transaction.revision; earlier.push(record);
+    source = next;
+    for (const row of record.splices) bytes += utf8Length(row.inserted) - utf8Length(row.removed);
+    if (bytes > 64 * 1024 * 1024) throw fault('document exceeds the editor text limit');
+    root = record.afterHash; revision = record.transaction.revision;
   }
+  text = source.slice();
   if (ledger.records.some(row => Object.hasOwn(row, 'authored'))) {
     try { authoredHistory(ledger.start.text, ledger.records); } catch (_) { throw fault('authored origin differs'); }
   }
-  const metadata = _rapierReplayMetadata(ledger.start.metadata, ledger.records);
+  const metadata = prepared.replayMetadata(ledger.start.metadata);
   if (!metadata || canonicalJSON(metadata) !== canonicalJSON(ledger.head.metadata) ||
       (expectedMetadata !== undefined && (!_rapierValidMetadata(expectedMetadata) || canonicalJSON(metadata) !== canonicalJSON(expectedMetadata))))
     throw fault('metadata does not describe this document');
   if (ledger.head.revision !== revision || ledger.head.root !== root || ledger.head.sha256 !== sha256(text) ||
       (expectedText !== undefined && text !== expectedText)) throw fault('history does not describe this document');
-  return {ledger, text, metadata, root, revision, complete: ledger.complete};
+  return {value: {ledger, text, metadata, root, revision, complete: ledger.complete}, prepared, source};
+}
+export function readLedger(input, expectedText, expectedMetadata) {
+  return readLedgerState(input, expectedText, expectedMetadata).value;
 }
-export function exportLedger({text, metadata, records, documentAuthority, revision, root, complete = false, earlier = records} = {}) {
-  documentText(text);
+function* checksum(parts) {
+  const hash = createSHA256();
+  for (const part of parts) { hash.update(part); yield; }
+  return hash.digest();
+}
+function* sourceFacts(text) {
+  if (typeof text !== 'string') throw fault('document is not whole-character text');
+  const hash = createSHA256();
+  let fnv = 0x811c9dc5, a = 1, b = 0, bytes = 0;
+  for (let at = 0; at < text.length;) {
+    const start = at, end = Math.min(text.length, at + 65536);
+    for (; at < end;) {
+      const stop = Math.min(end, at + 4096);
+      for (; at < stop; at++) {
+        const code = text.charCodeAt(at);
+        fnv = Math.imul(fnv ^ code, 16777619); a += code; b += a;
+        if (code < 0x80) bytes++;
+        else if (code < 0x800) bytes += 2;
+        else if ((code & 0xfc00) === 0xd800) {
+          if ((text.charCodeAt(at + 1) & 0xfc00) !== 0xdc00) throw fault('document is not whole-character text');
+          bytes += 3;
+        } else if ((code & 0xfc00) === 0xdc00) {
+          if (!at || (text.charCodeAt(at - 1) & 0xfc00) !== 0xd800) throw fault('document is not whole-character text');
+          bytes++;
+        } else bytes += 3;
+      }
+      a %= 65521; b %= 65521;
+    }
+    if (bytes > 64 * 1024 * 1024) throw fault('document exceeds the editor text limit');
+    hash.update(text.slice(start, end)); yield;
+  }
+  return {utf8Bytes: bytes, sha256: hash.digest(), contentRoot: text.length + ':' +
+    (fnv >>> 0).toString(36) + ':' + (((b << 16) | a) >>> 0).toString(36)};
+}
+function* produceLedger({text, metadata, records, documentAuthority, revision, root, complete = false, earlier = records} = {}) {
   if (!_rapierValidMetadata(metadata)) throw fault('document metadata required');
+  // Metadata has two admitted scalar fields. Keep its insertion order in the
+  // emitted envelope while capturing it before the first cooperative boundary.
+  metadata = {...metadata};
   if (!Array.isArray(records) || !Array.isArray(earlier)) throw fault('records required');
   // Inspect before touching properties: exporting must not call accessors on an alleged record.
-  records = plainData(records); earlier = plainData(earlier);
-  const expanded = records.map(record => {
-    const rows = _rapierRecordSplices(record, earlier), effect = _rapierRecordMetadata(record, earlier);
+  const prepared = _rapierPrepareHistoryRecords(records, earlier);
+  if (!prepared.ok) throw fault('navigation target was not retained');
+  const headFacts = yield* sourceFacts(text);
+  let bytes = headFacts.utf8Bytes;
+  const expanded = [];
+  for (const {record, splices: rows, metadata: effect} of prepared.rows) {
     if (!rows || effect === undefined) throw fault('navigation target was not retained');
-    return {transaction: record.transaction, splices: rows.map(row => ({pos: row.pos, removed: row.removed, inserted: row.inserted})),
-      beforeHash: record.beforeHash, afterHash: record.afterHash, ...(Object.hasOwn(record, 'authored') ? {authored: record.authored} : {}), ...(effect ? {metadata: effect} : {}),
-      ...(record.changeSet && Object.hasOwn(record.changeSet, 'label') ? {changeSet: {label: record.changeSet.label}} : {}),
-      ...(record.derivedCommentIndex == null ? {} : {derivedCommentIndex: record.derivedCommentIndex})};
-  });
-  let startText = text, startMetadata = {...metadata};
+    expanded.push({transaction: plainData(record.transaction), splices: rows.map(row => ({pos: row.pos, removed: row.removed, inserted: row.inserted})),
+      beforeHash: record.beforeHash, afterHash: record.afterHash, ...(Object.hasOwn(record, 'authored') ? {authored: plainData(record.authored)} : {}), ...(effect ? {metadata: plainData(effect)} : {}),
+      ...(record.changeSet && Object.hasOwn(record.changeSet, 'label') ? {changeSet: {label: typeof record.changeSet.label === 'string' ? record.changeSet.label : plainData(record.changeSet.label)}} : {}),
+      ...(record.derivedCommentIndex == null ? {} : {derivedCommentIndex: typeof record.derivedCommentIndex === 'string' ? record.derivedCommentIndex : plainData(record.derivedCommentIndex)})});
+    yield;
+  }
+  const headBytes = bytes;
+  let startSource = new HistorySource(text), startMetadata = {...metadata};
   for (let i = expanded.length - 1; i >= 0; i--) {
-    startText = _rapierTransformSplices(startText, expanded[i].splices, true);
+    startSource = startSource.apply(expanded[i].splices, true);
     startMetadata = _rapierTransformMetadata(startMetadata, expanded[i].metadata, true);
-    if (startText === null || !startMetadata) throw fault('history does not reverse from this document');
+    if (startSource === null || !startMetadata) throw fault('history does not reverse from this document');
+    // Whole scalars and exact splice boundaries were just checked. Count the changed
+    // bytes, rather than re-encoding every reconstructed whole-document revision.
+    for (const row of expanded[i].splices) bytes += utf8Length(row.removed) - utf8Length(row.inserted);
+    if (bytes > 64 * 1024 * 1024) throw fault('document exceeds the editor text limit');
+    yield;
   }
+  const startText = startSource.slice();
+  const unchangedText = expanded.every(row => !row.splices.length);
+  const contentRoot = headFacts.contentRoot;
   revision ??= expanded.at(-1)?.transaction.revision ?? 0;
-  root ??= expanded.at(-1)?.afterHash ?? textRoot(text);
+  root ??= expanded.at(-1)?.afterHash ?? contentRoot;
   documentAuthority ??= expanded[0]?.transaction.documentAuthority;
-  const startRevision = expanded[0]?.transaction.baseRevision ?? revision;
+  const startRevision = expanded[0]?.transaction.baseRevision ?? revision, startRoot = expanded[0]?.beforeHash ?? root;
+  if (typeof documentAuthority !== 'string' || !documentAuthority || documentAuthority.length > 256) throw fault('unsupported or invalid envelope');
+  if (!nonnegative(startRevision) || !rootShape(startRoot)) throw fault('invalid start');
+  const startFacts = unchangedText ? headFacts : yield* sourceFacts(startText);
+  if (startRevision === 0 && startRoot !== startFacts.contentRoot) throw fault('invalid start');
+  const headSHA = headFacts.sha256, startSHA = startFacts.sha256;
   const payload = {format: 'rapier-ledger/2', documentAuthority,
-    start: {text: startText, revision: startRevision, root: expanded[0]?.beforeHash ?? root, sha256: sha256(startText), metadata: startMetadata},
-    records: expanded, head: {revision, root, sha256: sha256(text), metadata: {...metadata}}, complete: complete === true && startRevision === 0 && expanded.every((row, i) => !i || row.transaction.baseRevision === expanded[i - 1].transaction.revision)};
-  const ledger = {...payload, sha256: digest(payload)};
-  readLedger(ledger, text, metadata); return ledger;
+    start: {text: startText, revision: startRevision, root: startRoot, sha256: startSHA, metadata: startMetadata},
+    records: expanded, head: {revision, root, sha256: headSHA, metadata: {...metadata}}, complete: complete === true && startRevision === 0 && expanded.every((row, i) => !i || row.transaction.baseRevision === expanded[i - 1].transaction.revision)};
+  // Expanded rows are the exact canonical projection of this owned preparation.
+  // Keep its navigation/effect proof instead of admitting another copied graph.
+  for (const _record of checkedRecords(payload, prepared)) yield;
+  if (expanded.some(row => Object.hasOwn(row, 'authored'))) {
+    try { authoredHistory(startText, expanded); } catch (_) { throw fault('authored origin differs'); }
+  }
+  const replayedMetadata = prepared.replayMetadata(startMetadata);
+  if (!replayedMetadata || canonicalJSON(replayedMetadata) !== canonicalJSON(metadata)) throw fault('metadata does not describe this document');
+  const ledger = {...payload, sha256: yield* checksum(canonicalParts(payload))};
+  return {ledger, contentRoot, utf8Bytes: headBytes};
+}
+function finish(producer) {
+  let step;
+  do { step = producer.next(); } while (!step.done);
+  return step.value;
+}
+export function exportLedger(input) { return finish(produceLedger(input)).ledger; }
+// Both synchronous public export and cooperative recovery use the same producer.
+// Its returned facts were computed while admitting/hashing the exact head, never supplied.
+export function prepareLedger(input) { return finish(produceLedger(input)); }
+export async function prepareLedgerAsync(input, {yield: yieldWork, signal} = {}) {
+  const producer = produceLedger(input);
+  let step;
+  do {
+    signal?.throwIfAborted();
+    step = producer.next();
+    if (!step.done && yieldWork) {
+      // The caller owns scheduling and its clock; ledger admission reads neither.
+      const pending = yieldWork();
+      if (pending) await pending;
+    }
+  } while (!step.done);
+  signal?.throwIfAborted();
+  return step.value;
 }
 // Derived navigation, never a second history. A target older than start is intentionally unavailable.
 export function historyEnvelope(input, segmentIdentity = []) {
-  const {ledger, text, metadata} = readLedger(input), ids = new Set(ledger.records.map(row => row.transaction.id));
-  const pictures = _rapierHistoryEffects(ledger.records).pictures;
+  const {value: {ledger, text, metadata}, prepared, source} = readLedgerState(input);
+  const {byId, effects: {pictures}} = prepared;
   let branch = [], cursor = 0;
   for (const {transaction: tx} of ledger.records) {
     if (pictures.has(tx.id)) continue;
     const target = tx.reverts || tx.reapplies;
     if (target) {
-      if (!ids.has(target)) continue;
+      if (!byId.has(target)) continue;
       if (tx.reverts && branch[cursor - 1] === target) cursor--;
       else if (tx.reapplies && branch[cursor] === target) cursor++;
       else throw fault('invalid navigation order');
-    } else { branch = branch.slice(0, cursor); branch.push(tx.id); cursor = branch.length; }
+    } else { branch.length = cursor; branch.push(tx.id); cursor = branch.length; }
   }
-  const byId = new Map(ledger.records.map(row => [row.transaction.id, row]));
   const step = (source, id, redo) => {
-    const target = byId.get(id), folded = pictureHistorySplices({source, records: ledger.records}, target, redo);
-    return _rapierTransformSplices(source, folded || target.splices, !folded && !redo);
+    const target = byId.get(id), folded = pictures.size
+      ? pictureHistorySplices({source: source.slice(), records: prepared.records}, target, redo) : null;
+    return source.apply(folded || target.splices, !folded && !redo);
   };
-  let traversed = text, traversedMetadata = {...metadata};
+  let traversed = source, traversedMetadata = {...metadata};
   for (let i = cursor - 1; i >= 0; i--) {
     traversed = step(traversed, branch[i], false);
     traversedMetadata = _rapierTransformMetadata(traversedMetadata, byId.get(branch[i]).metadata, true);
     if (traversed === null || !traversedMetadata) throw fault('undo branch does not reverse');
   }
-  traversed = text; traversedMetadata = {...metadata};
+  if (ledger.complete) {
+    if (ledger.records.length && !branch.length) throw fault('complete history lost its branch');
+    // Literal admitted splices are reversible. Proving the actual head back to
+    // the exact start also proves its forward active branch, without replaying it.
+    if (traversed.length !== ledger.start.text.length || !traversed.matches(0, ledger.start.text) ||
+        canonicalJSON(traversedMetadata) !== canonicalJSON(ledger.start.metadata)) throw fault('complete branch differs');
+  }
+  traversed = source; traversedMetadata = {...metadata};
   for (let i = cursor; i < branch.length; i++) {
     traversed = step(traversed, branch[i], true);
     traversedMetadata = _rapierTransformMetadata(traversedMetadata, byId.get(branch[i]).metadata);
     if (traversed === null || !traversedMetadata) throw fault('redo branch does not replay');
   }
-  if (ledger.complete) {
-    if (ledger.records.length && !branch.length) throw fault('complete history lost its branch');
-    let active = ledger.start.text, activeMetadata = {...ledger.start.metadata};
-    if (!cursor && (active !== text || canonicalJSON(activeMetadata) !== canonicalJSON(metadata))) throw fault('complete history start differs');
+  // Picture folding may relocate finished definitions while navigating. Keep its
+  // distinct forward proof; the literal-only case above needs no second traversal.
+  if (ledger.complete && pictures.size) {
+    let active = new HistorySource(ledger.start.text), activeMetadata = {...ledger.start.metadata};
     for (let i = 0; i < branch.length; i++) {
       active = step(active, branch[i], true);
       activeMetadata = _rapierTransformMetadata(activeMetadata, byId.get(branch[i]).metadata);
-      if (active === null || !activeMetadata || (i + 1 === cursor && (active !== text || canonicalJSON(activeMetadata) !== canonicalJSON(metadata)))) throw fault('complete branch differs');
+      if (active === null || !activeMetadata || (i + 1 === cursor && (active.length !== text.length || !active.matches(0, text) || canonicalJSON(activeMetadata) !== canonicalJSON(metadata)))) throw fault('complete branch differs');
     }
   }
   return {schemaVersion: 5, documentAuthority: ledger.documentAuthority, documentRevision: ledger.head.revision,