rapier-markdown-kit 1.1.102 → 1.1.104

package/dist/kit/ledger/journal-records.mjs

@@ -111,16 +111,47 @@ function _rapierValidAuthored(origin) {
 		!/[\uD800-\uDFFF]/u.test(row.removed) && !/[\uD800-\uDFFF]/u.test(row.inserted));
 }
 
+// The lookup is an observation of one call's supplied records. Material rows keep
+// their existing borrowed-row API; an inverse owns fresh rows. Navigation only
+// follows strictly earlier revisions, including when an unadmitted list is unordered.
+function _rapierRecordIndex(records) {
+	const byId = new Map(), splices = new Map(), metadata = new Map();
+	for (const record of records) {
+		const id = record?.transaction?.id;
+		if (!byId.has(id)) byId.set(id, []);
+		byId.get(id).push(record);
+	}
+	const resolve = (entry, effects) => {
+		const cache = effects ? metadata : splices, path = [], pending = new Set();
+		let current = entry, value;
+		while (true) {
+			if (cache.has(current)) { value = cache.get(current); break; }
+			if (!current || pending.has(current)) { value = effects ? undefined : null; break; }
+			if (effects && Object.hasOwn(current, 'metadata')) {
+				value = _rapierValidMetadataEffect(current.metadata) ? current.metadata : undefined; break;
+			}
+			if (Array.isArray(current.splices)) { value = effects ? null : current.splices; break; }
+			const tx = current.transaction, id = tx?.reverts || tx?.reapplies;
+			const target = id && byId.get(id)?.find(record => record?.transaction?.revision < tx.revision);
+			if (!target) { value = effects ? undefined : null; break; }
+			pending.add(current); path.push(current); current = target;
+		}
+		cache.set(current, value);
+		for (let i = path.length - 1; i >= 0; i--) {
+			if (path[i].transaction.reverts && value != null) value = effects
+				? Object.fromEntries(Object.entries(value).map(([key, pair]) => [key, {before: pair.after, after: pair.before}]))
+				: value.slice().reverse().map(row => ({pos: row.pos, removed: row.inserted, inserted: row.removed}));
+			cache.set(path[i], value);
+		}
+		return value;
+	};
+	return {byId, splices: record => resolve(record, false), metadata: record => resolve(record, true)};
+}
+
 function _rapierRecordSplices(entry, ledger) {
 	try {
 		if (entry && Array.isArray(entry.splices)) return entry.splices;
-		const tx = entry?.transaction, targetId = tx?.reverts || tx?.reapplies;
-		const prior = (ledger || []).filter(record => record?.transaction?.revision < tx?.revision);
-		const target = targetId && prior.find(record => record?.transaction?.id === targetId);
-		if (!target) return null;
-		const rows = _rapierRecordSplices(target, prior);
-		if (!rows) return null;
-		return tx.reverts ? rows.slice().reverse().map(row => ({pos: row.pos, removed: row.inserted, inserted: row.removed})) : rows;
+		return _rapierRecordIndex(ledger || []).splices(entry);
 	} catch (_) { return null; }
 }
 
@@ -128,16 +159,18 @@ function _rapierRecordSplices(entry, ledger) {
 function journalOperations(before, after, journal) {
 	if (typeof before !== 'string' || typeof after !== 'string' || !Array.isArray(journal)) return;
 	if (before === after) return [];
-	let text = after;
-	const groups = [];
-	for (let index = journal.length - 1; index >= 0; index--) {
-		const rows = _rapierRecordSplices(journal[index], journal);
-		const prior = _rapierTransformSplices(text, rows, true);
-		if (prior === null) return;
-		groups.push(rows);
-		if (prior === before) return groups.reverse().flat().map(({pos, removed, inserted}) => ({pos, removed, inserted}));
-		text = prior;
-	}
+	try {
+		let text = after;
+		const lookup = _rapierRecordIndex(journal), groups = [];
+		for (let index = journal.length - 1; index >= 0; index--) {
+			const rows = lookup.splices(journal[index]);
+			const prior = _rapierTransformSplices(text, rows, true);
+			if (prior === null) return;
+			groups.push(rows);
+			if (prior === before) return groups.reverse().flat().map(({pos, removed, inserted}) => ({pos, removed, inserted}));
+			text = prior;
+		}
+	} catch (_) { return; }
 }
 
 function _rapierRecordMetadata(entry, ledger) {
@@ -145,20 +178,13 @@ function _rapierRecordMetadata(entry, ledger) {
 		if (Object.hasOwn(entry, 'metadata')) return _rapierValidMetadataEffect(entry.metadata) ? entry.metadata : undefined;
 		// An expanded record owns its complete effect; only compact navigation inherits one.
 		if (Array.isArray(entry.splices)) return null;
-		const tx = entry.transaction, targetId = tx.reverts || tx.reapplies;
-		const prior = (ledger || []).filter(record => record?.transaction?.revision < tx.revision);
-		const target = targetId && prior.find(record => record?.transaction?.id === targetId);
-		if (!target) return undefined;
-		const effect = _rapierRecordMetadata(target, prior);
-		if (effect == null) return effect;
-		return tx.reverts ? Object.fromEntries(Object.entries(effect).map(([key, pair]) =>
-			[key, {before: pair.after, after: pair.before}])) : effect;
+		return _rapierRecordIndex(ledger || []).metadata(entry);
 	} catch (_) { return undefined; }
 }
 
 // A codec replacement owns only one inserted definition and its reference. Its
 // source act remains the picture's author; an arbitrary edit cannot claim upkeep.
-function _rapierPictureFinish(record, original, earlier) {
+function _rapierPictureFinish(record, original, earlier, lookup) {
 	const tx = record?.transaction, rows = record?.splices;
 	if (tx?.operation !== 'document.finish-picture' || !tx.sourceTransactionId || tx.sourceTransactionIds ||
 		tx.reverts || tx.reapplies || record.metadata || !Array.isArray(rows) || rows.length !== 2 ||
@@ -192,7 +218,7 @@ function _rapierPictureFinish(record, original, earlier) {
 		};
 		for (const prior of rows.slice(0, index).reverse()) if (cross(prior, false)) return false;
 		for (let at = earlier.length - 1; at >= 0; at--) {
-			const prior = earlier[at], source = _rapierRecordSplices(prior, earlier);
+			const prior = earlier[at], source = lookup.splices(prior);
 			if (!source) return false;
 			const owner = prior === original || prior.transaction?.reapplies === original.transaction.id;
 			for (const splice of source.slice().reverse()) {
@@ -207,7 +233,7 @@ function _rapierPictureFinish(record, original, earlier) {
 // Every active inverse keeps its original targets suppressed. Independent inverses
 // can share a target; withdrawing one restores it only after the last blocker leaves.
 // This includes assignments hidden by later choices. No second history is retained.
-function _rapierHistoryEffects(records, visit = null) {
+function _rapierWalkHistoryEffects(records, lookup, visit = null, observe = null) {
 	try {
 		if (!Array.isArray(records)) return {ok: false};
 		const nodes = new Map(), references = new Map(), pictures = new Map(), byId = new Map(), finished = new Set(), earlier = [];
@@ -221,6 +247,25 @@ function _rapierHistoryEffects(records, visit = null) {
 				if (was !== node.active) for (const ref of node.references) pending.push([ref, node.active ? 1 : -1]);
 			}
 		};
+		// Most admission needs only the final effect graph. A backwards pass proves it
+		// in linear work; prefix activity is asked only by native Redo, picture custody,
+		// or a metadata assignment. The explicit stack also bounds long inverse chains.
+		const activity = new Map();
+		const active = id => {
+			if (visit) return nodes.get(id).active;
+			const pending = [[id, 0]];
+			while (pending.length) {
+				const frame = pending.at(-1), target = frame[0];
+				if (activity.has(target)) { pending.pop(); continue; }
+				const dependents = nodes.get(target).dependents;
+				if (frame[1] === dependents.length) { activity.set(target, true); pending.pop(); continue; }
+				const next = dependents[frame[1]];
+				if (!activity.has(next)) pending.push([next, 0]);
+				else if (activity.get(next)) { activity.set(target, false); pending.pop(); }
+				else frame[1]++;
+			}
+			return activity.get(id);
+		};
 		const lastUndo = new Map(), contexts = new Map(), order = [];
 		// Native Redo names an original act. Its inverse target is the last Undo
 		// in the author's proved causal view, not an unrelated later arrival.
@@ -256,7 +301,8 @@ function _rapierHistoryEffects(records, visit = null) {
 			let refs = supplied;
 			if (tx.operation === 'document.finish-picture' && tx.sourceTransactionId) {
 				const owner = tx.sourceTransactionId;
-				if (!nodes.get(owner)?.active || finished.has(owner) || !_rapierPictureFinish(record, byId.get(owner), earlier)) return {ok: false};
+				if (!nodes.has(owner) || !active(owner) || finished.has(owner) ||
+					!_rapierPictureFinish(record, byId.get(owner), earlier, lookup ||= _rapierRecordIndex(records))) return {ok: false};
 				pictures.set(tx.id, owner); finished.add(owner); refs = [];
 			}
 			if (tx.reverts || tx.reapplies) {
@@ -266,16 +312,19 @@ function _rapierHistoryEffects(records, visit = null) {
 				else {
 					const context = contextOf(record.authored || tx.authored);
 					const undo = (lastUndo.get(target) || []).findLast(id => context
-						? context.known.has(id) && !context.inactive.has(id) : nodes.get(id).active);
+						? context.known.has(id) && !context.inactive.has(id) : active(id));
 					if (!undo) return {ok: false};
 					refs = [undo];
 				}
 			}
 			if (refs.some(id => typeof id !== 'string' || !nodes.has(id) || pictures.has(id))) return {ok: false};
-			nodes.set(tx.id, {active: true, blockers: 0, references: refs}); references.set(tx.id, refs.slice());
-			byId.set(tx.id, record);
-			earlier.push(record);
-			for (const ref of refs) update(ref, 1);
+			nodes.set(tx.id, {active: true, blockers: 0, references: refs, dependents: []}); references.set(tx.id, refs.slice());
+			byId.set(tx.id, record); earlier.push(record);
+			for (const ref of refs) {
+				nodes.get(ref).dependents.push(tx.id);
+				if (visit) update(ref, 1);
+			}
+			activity.clear();
 			const origin = record.authored || tx.authored;
 			contexts.set(tx.id, {index: order.length, basis: origin?.basis || null}); order.push(tx.id);
 			if (tx.reverts) {
@@ -283,55 +332,219 @@ function _rapierHistoryEffects(records, visit = null) {
 				lastUndo.get(tx.reverts).push(tx.id);
 			}
 			if (visit) visit(record, nodes, refs);
+			if (observe) observe(record, refs, active);
+		}
+		if (!visit) for (let i = order.length - 1; i >= 0; i--) {
+			const node = nodes.get(order[i]); node.active = node.blockers === 0;
+			if (node.active) for (const ref of node.references) nodes.get(ref).blockers++;
 		}
 		const effectiveActIds = [...nodes].filter(([id, node]) => node.active && !pictures.has(id)).map(([id]) => id);
 		return {ok: true, effectiveActIds, active: new Set(effectiveActIds), references, pictures};
 	} catch (_) { return {ok: false}; }
 }
 
+function _rapierHistoryEffects(records, visit = null) {
+	return _rapierWalkHistoryEffects(records, null, visit);
+}
+
+// Every transition constrains the two initial metadata scalars. This proves each
+// inverse's result once, before the caller supplies the exact initial metadata.
+function _rapierMetadataProof(lookup) {
+	const values = {}, required = {}, assignments = {filename: [], docKind: []};
+	const requireInitial = (key, value) => {
+		if (Object.hasOwn(required, key) && required[key] !== value) throw Error('metadata_effect');
+		required[key] = value;
+	};
+	const observe = (record, refs, active) => {
+		const effect = lookup.metadata(record);
+		if (effect === undefined) throw Error('metadata');
+		for (const [key, pair] of Object.entries(effect || {})) {
+			if (!Object.hasOwn(values, key)) requireInitial(key, pair.before);
+			else if (values[key] !== pair.before) throw Error('metadata');
+			values[key] = pair.after;
+			if (!refs.length) assignments[key].push({id: record.transaction.id, value: pair.after});
+		}
+		// Source-only rows cannot change a previously proved metadata assignment.
+		if (!effect && !refs.length) return;
+		for (const key of ['filename', 'docKind']) {
+			const expected = assignments[key].findLast(row => active(row.id));
+			if (expected) {
+				if (!Object.hasOwn(values, key)) requireInitial(key, expected.value);
+				else if (values[key] !== expected.value) throw Error('metadata_effect');
+			} else if (Object.hasOwn(values, key)) requireInitial(key, values[key]);
+		}
+	};
+	const replay = initial => {
+		if (!_rapierValidMetadata(initial) || Object.keys(required).some(key => initial[key] !== required[key])) return null;
+		return {...initial, ...values};
+	};
+	return {observe, replay};
+}
+
 function _rapierMetadataState(initial, records, effects = _rapierHistoryEffects(records)) {
 	if (!_rapierValidMetadata(initial) || !effects.ok) return null;
-	const state = {...initial};
-	for (const record of records) if (effects.active.has(record.transaction.id) && !effects.references.get(record.transaction.id)?.length) {
-		const effect = _rapierRecordMetadata(record, records);
-		if (effect === undefined) return null;
-		for (const [key, pair] of Object.entries(effect || {})) state[key] = pair.after;
-	}
-	return state;
+	try {
+		const state = {...initial}, lookup = _rapierRecordIndex(records);
+		for (const record of records) if (effects.active.has(record.transaction.id) && !effects.references.get(record.transaction.id)?.length) {
+			const effect = lookup.metadata(record);
+			if (effect === undefined) return null;
+			for (const [key, pair] of Object.entries(effect || {})) state[key] = pair.after;
+		}
+		return state;
+	} catch (_) { return null; }
 }
 
 // Prove each recorded transition and each inverse's semantic result, not only the final values.
 function _rapierReplayMetadata(initial, records) {
 	if (!_rapierValidMetadata(initial)) return null;
-	let state = {...initial};
-	const earlier = [], assignments = {filename: [], docKind: []};
-	const effects = _rapierHistoryEffects(records, (record, nodes, refs) => {
-		const effect = _rapierRecordMetadata(record, earlier);
-		if (effect === undefined) throw Error('metadata');
-		state = _rapierTransformMetadata(state, effect);
-		if (!state) throw Error('metadata');
-		if (!refs.length) for (const [key, pair] of Object.entries(effect || {}))
-			assignments[key].push({id: record.transaction.id, value: pair.after});
-		for (const key of ['filename', 'docKind']) {
-			let expected = initial[key];
-			for (let i = assignments[key].length - 1; i >= 0; i--) if (nodes.get(assignments[key][i].id).active) {
-				expected = assignments[key][i].value; break;
-			}
-			if (state[key] !== expected) throw Error('metadata_effect');
-		}
-		earlier.push(record);
-	});
-	return effects.ok ? state : null;
+	try {
+		const lookup = _rapierRecordIndex(records), proof = _rapierMetadataProof(lookup);
+		return _rapierWalkHistoryEffects(records, lookup, null, proof.observe).ok ? proof.replay(initial) : null;
+	} catch (_) { return null; }
 }
 
 function _rapierHasHistoryEffect(record, earlier = []) {
 	const tx = record?.transaction;
 	if (!tx || !(tx.reverts || tx.reapplies || tx.sourceTransactionId || tx.sourceTransactionIds?.length)) return false;
 	let id = tx.id;
-	if (!id) { id = 'candidate'; while (earlier.some(row => row?.transaction?.id === id)) id += ':'; }
+	if (!id) {
+		const ids = new Set(earlier.map(row => row?.transaction?.id));
+		id = 'candidate'; while (ids.has(id)) id += ':';
+	}
 	return _rapierHistoryEffects([...earlier, {...record, transaction: {...tx, id}}]).ok;
 }
 
+// A cached observation owns every byte-bearing record. Mutable graphs are compared
+// through descriptors on every call; only a proved, recursively frozen graph can
+// bypass that walk. Per-object weak entries keep one latest copy, not a revision log.
+const _rapierPrepareHistoryRecords = (() => {
+	const copies = new WeakMap();
+	// Repeated queries share the latest proved snapshot. A live but inactive input
+	// does not need to retain its record/effect indexes; immutable copies remain weak.
+	let prepared = new WeakMap();
+	// Object.freeze does not freeze Map/Set entries. Keep those collections inside
+	// the preparation and expose only immutable values through reading closures.
+	const view = collection => Object.freeze({size: collection.size, has: key => collection.has(key),
+		...(collection instanceof Map ? {get: key => collection.get(key)} : {}),
+		keys: () => collection.keys(), values: () => collection.values(), entries: () => collection.entries(),
+		[Symbol.iterator]: () => collection[Symbol.iterator]()});
+	const capture = value => {
+		const active = new Set(), pending = [{value, depth: 0}], result = {};
+		const finish = (frame, value, immutable, height = -1) => {
+			const parent = frame.parent;
+			if (!parent) { result.value = value; return; }
+			parent.immutable &&= immutable;
+			parent.height = Math.max(parent.height, height + 1);
+			if (!parent.out && parent.previous[frame.key] !== value)
+				parent.out = Array.isArray(parent.previous) ? parent.previous.slice() : {...parent.previous};
+			if (parent.out) parent.out[frame.key] = value;
+		};
+		while (pending.length) {
+			const frame = pending.pop(), value = frame.value;
+			if (frame.leaving) {
+				active.delete(value);
+				const copy = frame.out ? Object.freeze(frame.out) : frame.previous;
+				copies.set(value, {copy, immutable: frame.immutable, height: frame.height, ...(frame.frozen && !frame.immutable ? {frozen: true, descriptors: frame.descriptors, fields: frame.fields} : {})});
+				copies.set(copy, {copy, immutable: true, height: frame.height});
+				finish(frame, copy, frame.immutable, frame.height); continue;
+			}
+			const old = frame.parent?.previous;
+			if (old && Object.hasOwn(old, frame.key) && Object.is(value, old[frame.key]) && (value === null || typeof value !== 'object')) {
+				finish(frame, value, true); continue;
+			}
+			if (value === null || typeof value === 'boolean' || typeof value === 'string' && !/[\uD800-\uDFFF]/u.test(value) ||
+				typeof value === 'number' && Number.isFinite(value) && !Object.is(value, -0)) {
+				finish(frame, value, true); continue;
+			}
+			if (!value || typeof value !== 'object' || frame.depth > 64 || active.has(value)) throw Error('history_data');
+			const previous = copies.get(value);
+			if (previous?.immutable) {
+				if (frame.depth + previous.height > 64) throw Error('history_data');
+				finish(frame, previous.copy, true, previous.height); continue;
+			}
+			frame.previous = previous?.copy;
+			frame.height = 0;
+			if (previous?.frozen) {
+				// A frozen shell fixes its descriptors, but every mutable child is still
+				// observed afresh. Fixed scalar fields need no second Unicode/data proof.
+				frame.frozen = frame.immutable = true;
+				frame.descriptors = previous.descriptors; frame.fields = previous.fields;
+				frame.out = null; frame.leaving = true; active.add(value); pending.push(frame);
+				for (let at = frame.fields.length - 1; at >= 0; at--) {
+					const key = frame.fields[at], child = frame.descriptors[key].value;
+					if (child && typeof child === 'object') pending.push({value: child, parent: frame, key, depth: frame.depth + 1});
+				}
+				continue;
+			}
+			// Check frozen-ness before capturing descriptors. A caller freezing a mutable
+			// input later cannot retroactively certify an earlier view of its properties.
+			frame.frozen = frame.immutable = Object.isFrozen(value);
+			const array = Array.isArray(value), proto = Object.getPrototypeOf(value);
+			if (!array && proto !== null && (Object.getPrototypeOf(proto) !== null ||
+				Object.getOwnPropertyDescriptor(Object.getOwnPropertyDescriptor(proto, 'constructor')?.value || {}, 'name')?.value !== 'Object')) throw Error('history_data');
+			const descriptors = Object.getOwnPropertyDescriptors(value), keys = Reflect.ownKeys(descriptors);
+			if (array && keys.length !== descriptors.length.value + 1) throw Error('history_data');
+			for (const key of keys) {
+				if (array && key === 'length') continue;
+				const field = descriptors[key];
+				if (typeof key !== 'string' || ['__proto__', 'constructor', 'prototype'].includes(key) ||
+					!Object.hasOwn(field, 'value') || !field.enumerable || array &&
+					(!/^(0|[1-9]\d*)$/.test(key) || +key >= descriptors.length.value)) throw Error('history_data');
+			}
+			const fields = array ? keys.filter(key => key !== 'length') : keys;
+			const sameKeys = frame.previous && Object.keys(frame.previous).length === fields.length && fields.every(key => Object.hasOwn(frame.previous, key));
+			frame.out = sameKeys ? null : array ? [] : {};
+			if (!sameKeys && !array) fields.sort();
+			frame.descriptors = descriptors; frame.fields = fields;
+			frame.leaving = true; active.add(value); pending.push(frame);
+			for (let at = fields.length - 1; at >= 0; at--) {
+				const key = fields[at]; pending.push({value: descriptors[key].value, parent: frame, key, depth: frame.depth + 1});
+			}
+		}
+		return result.value;
+	};
+	return (input, earlier = input) => {
+		try {
+			if (!Array.isArray(input) || !Array.isArray(earlier)) return {ok: false};
+			const records = capture(input), basis = input === earlier ? records : capture(earlier), previous = prepared.get(records);
+			if (previous?.basis === basis) return previous.observation;
+			const byId = new Map();
+			for (const record of records) {
+				const id = record?.transaction?.id;
+				if (typeof id !== 'string' || !id || byId.has(id)) return {ok: false};
+				byId.set(id, record);
+			}
+			const lookup = _rapierRecordIndex(basis), proof = _rapierMetadataProof(lookup);
+			const rows = records.map(record => {
+				const splices = lookup.splices(record), metadata = lookup.metadata(record);
+				if (splices && !Object.isFrozen(splices)) {
+					for (const row of splices) Object.freeze(row);
+					Object.freeze(splices);
+				}
+				if (metadata && !Object.isFrozen(metadata)) {
+					for (const pair of Object.values(metadata)) Object.freeze(pair);
+					Object.freeze(metadata);
+				}
+				return Object.freeze({record, splices, metadata});
+			});
+			const effects = _rapierWalkHistoryEffects(records, lookup, null, proof.observe);
+			if (!effects.ok) return {ok: false};
+			for (const refs of effects.references.values()) Object.freeze(refs);
+			const effectView = Object.freeze({ok: true, effectiveActIds: Object.freeze(effects.effectiveActIds),
+				active: view(effects.active), references: view(effects.references), pictures: view(effects.pictures)});
+			const observation = Object.freeze({ok: effects.ok, records, rows: Object.freeze(rows), effects: effectView, byId: view(byId),
+				replayMetadata: initial => effects.ok ? proof.replay(initial) : null,
+				validRecord: (index, documentAuthority, maxDocumentBytes, utf8Length, allowGap = false) => {
+					if (!effects.ok || !Number.isSafeInteger(index) || index < 0 || index >= records.length) return false;
+					const row = rows[index], tx = row.record.transaction;
+					return _rapierCheckLedgerRecord(row.record, records[index - 1] || null, documentAuthority, maxDocumentBytes, utf8Length, allowGap,
+						{...row, duplicate: false, semantic: !!(tx.reverts || tx.reapplies || tx.sourceTransactionId || tx.sourceTransactionIds?.length)});
+				}});
+			prepared = new WeakMap([[records, {basis, observation}]]); return observation;
+		} catch (_) { return {ok: false}; }
+	};
+})();
+
 // A ledger record as the journal and the Notes return validate it below: plain data, nothing
 // undefined anywhere in it. A live record could carry a row whose type or order is not yet known (a
 // block just inserted, before its first render: `type: undefined`), and the validator would refuse
@@ -353,15 +566,28 @@ function _rapierValidLedgerRecord(record, prior, earlier, documentAuthority, max
 	// Iterative traversal refuses cycles without exhausting the call stack. Proxies/counters that
 	// throw are refused by the same gate rather than escaping into document recovery.
 	try {
-		if (!_rapierPlainLedgerData(record) || (Object.hasOwn(record, 'authored') && !_rapierValidAuthored(record.authored))) return false;
+		if (!_rapierPlainLedgerData(record) || !Array.isArray(earlier)) return false;
+		const own = Array.isArray(record?.splices), lookup = own ? null : _rapierRecordIndex(earlier);
+		const metadata = Object.hasOwn(record, 'metadata')
+			? _rapierValidMetadataEffect(record.metadata) ? record.metadata : undefined : own ? null : lookup.metadata(record);
+		return _rapierCheckLedgerRecord(record, prior, documentAuthority, maxDocumentBytes, utf8Length, allowGap,
+			{splices: own ? record.splices : lookup.splices(record), metadata,
+				semantic: _rapierHasHistoryEffect(record, earlier), duplicate: earlier.some(row => row?.transaction?.id === record?.transaction?.id)});
+	} catch (_) { return false; }
+}
+
+// Both callers proved plain data themselves: the public single-row validator above,
+// or the private owned-snapshot preparation. No caller-supplied trusted flag exists.
+function _rapierCheckLedgerRecord(record, prior, documentAuthority, maxDocumentBytes, utf8Length, allowGap,
+	{splices, metadata, semantic, duplicate}) {
+	try {
+		if (Object.hasOwn(record, 'authored') && !_rapierValidAuthored(record.authored)) return false;
 		if (!record || typeof record !== 'object' ||
 				typeof record.beforeHash !== 'string' || !record.beforeHash.length ||
 				typeof record.afterHash !== 'string' || !record.afterHash.length) return false;
 		const own = Array.isArray(record.splices), navigation = !!(record.transaction?.reverts || record.transaction?.reapplies);
 		if ((!own && !navigation) || (own && record.splices.length > 64) ||
 			(record.transaction?.reverts && record.transaction?.reapplies)) return false;
-		const splices = _rapierRecordSplices(record, earlier), metadata = _rapierRecordMetadata(record, earlier);
-		const semantic = _rapierHasHistoryEffect(record, earlier);
 		if (metadata === undefined || (!splices?.length && !Object.values(metadata || {}).some(pair => pair.before !== pair.after) && !semantic) ||
 			(record.beforeHash === record.afterHash && splices?.length) ||
 			(record.beforeHash !== record.afterHash && !splices?.length) ||
@@ -380,8 +606,7 @@ function _rapierValidLedgerRecord(record, prior, earlier, documentAuthority, max
 		const optional = (value, valid) => value === undefined || valid(value);
 		const identity = (value, limit) => typeof value === 'string' && value.length > 0 && value.length <= limit;
 		if (!transaction || typeof transaction.id !== 'string' || !transaction.id.length ||
-				transaction.id.length > 256 || !Array.isArray(earlier) ||
-				earlier.some(row => row?.transaction?.id === transaction.id) ||
+				transaction.id.length > 256 || duplicate ||
 				typeof transaction.documentAuthority !== 'string' ||
 				transaction.documentAuthority !== documentAuthority ||
 				(transaction.transport !== 'platform' && transaction.transport !== 'webmcp') ||
@@ -419,4 +644,4 @@ function _rapierValidLedgerRecord(record, prior, earlier, documentAuthority, max
 	} catch (_) { return false; }
 }
 
-export { _rapierValidAuthored, _RAPIER_TRANSACTION_ACTOR_LIMIT, _RAPIER_TRANSACTION_OPERATION_LIMIT, _RAPIER_TRANSACTION_REQUEST_LIMIT, _rapierTransformSplices, _rapierRecordSplices, _rapierValidLedgerRecord, _rapierJournalRecord, _rapierValidMetadata, _rapierValidMetadataEffect, _rapierMetadataDelta, _rapierTransformMetadata, _rapierRecordMetadata, _rapierHistoryEffects, _rapierMetadataState, _rapierReplayMetadata, _rapierHasHistoryEffect, journalOperations};
+export { _rapierPrepareHistoryRecords, _rapierValidAuthored, _RAPIER_TRANSACTION_ACTOR_LIMIT, _RAPIER_TRANSACTION_OPERATION_LIMIT, _RAPIER_TRANSACTION_REQUEST_LIMIT, _rapierTransformSplices, _rapierRecordSplices, _rapierValidLedgerRecord, _rapierJournalRecord, _rapierValidMetadata, _rapierValidMetadataEffect, _rapierMetadataDelta, _rapierTransformMetadata, _rapierRecordMetadata, _rapierHistoryEffects, _rapierMetadataState, _rapierReplayMetadata, _rapierHasHistoryEffect, journalOperations};

package/dist/kit/model.mjs

@@ -1,3 +1,3 @@
 // SPDX-License-Identifier: MIT
 export * from '../layout/model.mjs';
-export {prepareRichInline, materializeRichInlineLineRange} from '../agent/vendor/pretext/rich-inline.js';
+export {layoutNextRichInlineLineRange, materializeRichInlineLineRange} from '../agent/vendor/pretext/rich-inline.js';

package/dist/kit/pdf-glyphs.mjs

@@ -2,12 +2,11 @@
 // The licensed static faces retain the shipped variable font's exact glyphs and metrics.
 // Browser ranges own placement; unsupported shaping stays in the original page paint.
 
-const fontCache = new Map();
 const familyName = value => value.trim().replace(/^['"]|['"]$/g, '');
 
-function readFont(asset) {
+function readFont(asset, fontCache) {
   if (fontCache.has(asset)) return fontCache.get(asset);
-  const bytes = Uint8Array.from(atob(asset.data), character => character.charCodeAt(0));
+  const bytes = typeof asset.read === 'function' ? asset.read() : Uint8Array.from(atob(asset.data), character => character.charCodeAt(0));
   const view = new DataView(bytes.buffer), u16 = at => view.getUint16(at), i16 = at => view.getInt16(at), u32 = at => view.getUint32(at);
   const tag = at => String.fromCharCode(...bytes.subarray(at, at + 4)), tables = new Map();
   for (let at = 12, end = 12 + u16(4) * 16; at < end; at += 16) tables.set(tag(at), {at: u32(at + 8), length: u32(at + 12)});
@@ -94,6 +93,7 @@ function shape(value, font, preserve, ligatures) {
 }
 
 export async function collectPdfGlyphs(main, {width, check, faces = []}) {
+  const fontCache = new Map(); // Parsed byte copies belong to this PDF operation.
   const document = main.ownerDocument, window = document.defaultView, origin = main.getBoundingClientRect();
   const nodes = new Map(), hidden = [], canvas = document.createElement('canvas'); canvas.width = canvas.height = 1;
   const context = canvas.getContext('2d', {willReadFrequently: true});
@@ -134,7 +134,7 @@ export async function collectPdfGlyphs(main, {width, check, faces = []}) {
       if (generated || altered || !Array.from(document.fonts).some(face => familyName(face.family) === family && face.status === 'loaded')) continue;
       const asset = faces.find(face => face.family === family && face.weight === weight);
       if (!asset) continue;
-      const font = readFont(asset), preserve = /pre|break-spaces/.test(style.whiteSpace), node = textNodes[0];
+      const font = readFont(asset, fontCache), preserve = /pre|break-spaces/.test(style.whiteSpace), node = textNodes[0];
       const shaped = shape(node.data, font, preserve, style.fontVariantLigatures === 'normal' && !(Number.parseFloat(style.letterSpacing) || 0));
       if (!shaped) continue;
       context.font = [style.fontStyle, style.fontWeight, style.fontSize, style.fontFamily].join(' ');