rapier-markdown-kit 1.1.55 → 1.1.57

package/dist/kit/ledger/journal-records.mjs

@@ -0,0 +1,139 @@
+// SPDX-License-Identifier: MIT
+
+const _RAPIER_TRANSACTION_ACTOR_LIMIT = 160;
+const _RAPIER_TRANSACTION_OPERATION_LIMIT = 96;
+const _RAPIER_TRANSACTION_REQUEST_LIMIT = 160;
+
+/* Validate every row, not only the final string: a half-pair replacement can produce a whole
+	 character while leaving unencodable fragments in the ledger; two invalid rows can also repair
+	 each other. Refusal is atomic. Pre-existing damage elsewhere stays untouched and editable. */
+function _rapierTransformSplices(text, splices, inverse = false) {
+	try {
+		if (!Array.isArray(splices)) return null;
+		let value = String(text == null ? '' : text);
+		// In Unicode mode a complete pair is one scalar, outside the surrogate range.
+		const whole = text => typeof text === 'string' && !/[\uD800-\uDFFF]/u.test(text);
+		const splitsPair = at => at > 0 && at < value.length &&
+			(value.charCodeAt(at - 1) & 0xFC00) === 0xD800 &&
+			(value.charCodeAt(at) & 0xFC00) === 0xDC00;
+		const rows = inverse ? splices.slice().reverse() : splices;
+		for (const row of rows) {
+			if (!row || !Number.isSafeInteger(row.pos) || row.pos < 0 || Object.is(row.pos, -0)) return null;
+			const pos = row.pos;
+			const removed = inverse ? row.inserted : row.removed;
+			const inserted = inverse ? row.removed : row.inserted;
+			if (!whole(removed) || !whole(inserted) || pos > value.length ||
+					pos + removed.length > value.length || splitsPair(pos) || splitsPair(pos + removed.length) ||
+					value.slice(pos, pos + removed.length) !== removed) return null;
+			value = value.slice(0, pos) + inserted + value.slice(pos + removed.length);
+		}
+		return value;
+	} catch (_) { return null; }
+}
+
+function _rapierRecordSplices(entry, ledger) {
+	try {
+		if (entry && Array.isArray(entry.splices) && entry.splices.length) return entry.splices;
+		const transaction = entry && entry.transaction;
+		const targetId = String(transaction?.reverts || transaction?.reapplies || '');
+		const target = targetId && (ledger || []).find(record => record?.transaction?.id === targetId);
+		if (!target || !Array.isArray(target.splices) || !target.splices.length) return null;
+		return transaction.reverts ? target.splices.slice().reverse().map(row => ({
+			pos: row.pos, removed: row.inserted, inserted: row.removed,
+		})) : target.splices;
+	} catch (_) { return null; }
+}
+
+// A ledger record as the journal and the Notes return validate it below: plain data, nothing
+// undefined anywhere in it. A live record could carry a row whose type or order was not yet known
+// (a block just inserted, before its first render: `type: undefined`), and the validator refused
+// the whole ledger for that one field -- silently at boot, where a refused ledger is cleared, and on
+// the founder's phone as "Rapier could not be reopened: the document history could not be restored"
+// on every return from Notes (24 September). The copy is made once per record; records are frozen,
+// so it never goes stale.
+const _rapierJournalRecord = (() => {
+	const copies = new WeakMap();
+	return record => {
+		let copy = copies.get(record);
+		if (!copy) { copy = JSON.parse(JSON.stringify(record)); copies.set(record, copy); }
+		return copy;
+	};
+})();
+
+function _rapierValidLedgerRecord(record, prior, earlier, documentAuthority, maxDocumentBytes, utf8Length, allowGap = false) {
+	// Recovery records are data, not executable objects. Inspect descriptors without invoking
+	// accessors, and use an ancestor set (not a global seen set) so shared acyclic data stays valid.
+	// Iterative traversal refuses cycles without exhausting the call stack. Proxies/counters that
+	// throw are refused by the same gate rather than escaping into document recovery.
+	try {
+		const active = new Set(), pending = [[record, false]];
+		while (pending.length) {
+			const [value, leaving] = pending.pop();
+			if (leaving) { active.delete(value); continue; }
+			if (value === null || typeof value === 'string' || typeof value === 'boolean') continue;
+			if (typeof value === 'number') { if (!Number.isFinite(value)) return false; continue; }
+			if (!value || typeof value !== 'object' || active.has(value)) return false;
+			const array = Array.isArray(value), proto = Object.getPrototypeOf(value);
+			if (!array && proto !== null && (Object.getPrototypeOf(proto) !== null ||
+					Object.getOwnPropertyDescriptor(proto, 'constructor')?.value?.name !== 'Object')) return false;
+			const keys = Reflect.ownKeys(value);
+			if (array && keys.length !== value.length + 1) return false;
+			active.add(value); pending.push([value, true]);
+			for (const key of keys) {
+				if (array && key === 'length') continue;
+				if (typeof key !== 'string' || key === '__proto__' || key === 'constructor' || key === 'prototype' ||
+						(array && (!Number.isSafeInteger(Number(key)) || Number(key) < 0 ||
+							Number(key) >= value.length || String(Number(key)) !== key))) return false;
+				const field = Object.getOwnPropertyDescriptor(value, key);
+				if (!field || !Object.hasOwn(field, 'value')) return false;
+				pending.push([field.value, false]);
+			}
+		}
+		if (!record || typeof record !== 'object' ||
+				typeof record.beforeHash !== 'string' || !record.beforeHash.length ||
+				typeof record.afterHash !== 'string' || !record.afterHash.length || record.beforeHash === record.afterHash) return false;
+		const own = Array.isArray(record.splices) && record.splices.length;
+		const navigation = !!(record.transaction?.reverts || record.transaction?.reapplies);
+		if ((!own && !navigation) || (own && record.splices.length > 64) ||
+				(record.transaction?.reverts && record.transaction?.reapplies)) return false;
+		const splices = _rapierRecordSplices(record, earlier);
+		if (!splices || splices.length > 64 || !splices.every(row =>
+				row && Number.isSafeInteger(row.pos) && row.pos >= 0 && !Object.is(row.pos, -0) &&
+				typeof row.removed === 'string' && typeof row.inserted === 'string' &&
+				!/[\uD800-\uDFFF]/u.test(row.removed) && !/[\uD800-\uDFFF]/u.test(row.inserted) &&
+				utf8Length(row.removed) <= maxDocumentBytes &&
+				utf8Length(row.inserted) <= maxDocumentBytes)) return false;
+		const transaction = record.transaction;
+		const nullableText = (value, limit, empty = true) => value === null ||
+			(typeof value === 'string' && value.length <= limit && (empty || value.length > 0));
+		if (!transaction || typeof transaction.id !== 'string' || !transaction.id.length ||
+				transaction.id.length > 256 || !Array.isArray(earlier) ||
+				earlier.some(row => row?.transaction?.id === transaction.id) ||
+				typeof transaction.documentAuthority !== 'string' ||
+				transaction.documentAuthority !== documentAuthority ||
+				(transaction.transport !== 'platform' && transaction.transport !== 'webmcp') ||
+				typeof transaction.operation !== 'string' || !transaction.operation.length ||
+				transaction.operation.length > _RAPIER_TRANSACTION_OPERATION_LIMIT ||
+				!nullableText(transaction.requestId, _RAPIER_TRANSACTION_REQUEST_LIMIT) ||
+				!nullableText(transaction.sourceTransactionId, _RAPIER_TRANSACTION_REQUEST_LIMIT) ||
+				!nullableText(transaction.parent, 256, false) ||
+				!nullableText(transaction.reverts, 256, false) ||
+				!nullableText(transaction.reapplies, 256, false) ||
+				!Number.isSafeInteger(transaction.createdAt) || transaction.createdAt < 0 ||
+				!Array.isArray(transaction.affectedBlockIds) || transaction.affectedBlockIds.length > 64 ||
+				!transaction.affectedBlockIds.every(id => Number.isSafeInteger(id) && id >= 0) ||
+				!Number.isSafeInteger(transaction.revision) || transaction.revision < 1 ||
+				!Number.isSafeInteger(transaction.baseRevision) ||
+				transaction.baseRevision + 1 !== transaction.revision ||
+				(prior && (transaction.revision <= prior.transaction.revision ||
+					(transaction.baseRevision === prior.transaction.revision
+						? (transaction.parent !== prior.transaction.id || record.beforeHash !== prior.afterHash)
+						: (!allowGap || transaction.baseRevision <= prior.transaction.revision))))) return false;
+		return !!transaction.actor && typeof transaction.actor.kind === 'string' &&
+			/^(?:human|agent|system)$/.test(transaction.actor.kind) &&
+			typeof transaction.actor.id === 'string' && transaction.actor.id.length > 0 &&
+			transaction.actor.id.length <= _RAPIER_TRANSACTION_ACTOR_LIMIT;
+	} catch (_) { return false; }
+}
+
+export { _RAPIER_TRANSACTION_ACTOR_LIMIT, _RAPIER_TRANSACTION_OPERATION_LIMIT, _RAPIER_TRANSACTION_REQUEST_LIMIT, _rapierTransformSplices, _rapierRecordSplices, _rapierValidLedgerRecord, _rapierJournalRecord};

package/dist/kit/ledger/merge.mjs

@@ -0,0 +1,101 @@
+// SPDX-License-Identifier: MIT
+import {readLedger, exportLedger, rootAfter} from './format.mjs';
+import {_rapierTransformSplices} from './journal-records.mjs';
+import {mergeText} from './text-merge.mjs';
+import {parseWill} from '../../agent/will.mjs';
+import {sha256} from './hash.mjs';
+import {canonicalJSON, fault} from './data.mjs';
+// The same interval transport used by the agent kernel, now shared with the public ledger.
+export function transportInterval(start, end, splices) {
+  let a = start, b = end;
+  for (const row of splices) {
+    if (!Number.isSafeInteger(row.pos) || row.pos < 0) return null;
+    if (row.pos + row.removed.length <= a) {
+      const delta = row.inserted.length - row.removed.length; a += delta; b += delta;
+    } else if (row.pos < b || (a === b && row.pos < a && row.pos + row.removed.length > a)) return null;
+  }
+  return {start: a, end: b};
+}
+function over(row, other) {
+  // Equal-position insertions have no ordering evidence. Review, never a lexical winner.
+  if (!row.removed.length && !other.removed.length && row.pos === other.pos) return null;
+  const range = transportInterval(row.pos, row.pos + row.removed.length, [other]);
+  return range ? {...row, pos: range.start} : null;
+}
+const recordKey = record => sha256(canonicalJSON(record));
+const origin = record => record.transaction.sourceTransactionId?.startsWith('ledger:') ? record.transaction.sourceTransactionId : 'ledger:' + recordKey(record);
+function checkpointList(read) {
+  const list = [{root: read.ledger.start.root, text: read.ledger.start.text, index: 0}], records = read.ledger.records;
+  let text = read.ledger.start.text;
+  for (let i = 0; i < records.length; i++) { text = _rapierTransformSplices(text, records[i].splices); list.push({root: records[i].afterHash, text, index: i + 1}); }
+  return list;
+}
+function kept(text) {
+  const will = parseWill(text);
+  if (will.fault) return {fault: will.fault, text};
+  return will.regions.filter(region => region.law === 'keep').map(region => text.slice(region.start, region.end));
+}
+export function merge(first, second) {
+  const ours = readLedger(first), theirs = readLedger(second);
+  // A reviewed conflict receipt names the complete incoming envelope: it too is idempotent.
+  if (ours.ledger.records.some(record => record.transaction.operation === 'document.merge' && record.transaction.sourceTransactionId === 'ledger:' + theirs.ledger.sha256)) {
+    const clean = !ours.text.includes('<!-- note-conflict:v1 ');
+    return {text: ours.text, ledger: ours.ledger, clean, conflicts: [], review: {required: !clean, base: ours.text, proposed: ours.text}};
+  }
+  const a = checkpointList(ours), b = checkpointList(theirs);
+  let common = null;
+  for (let i = b.length - 1; i >= 0 && !common; i--) {
+    const found = a.findLast(point => point.root === b[i].root && point.text === b[i].text);
+    if (found) common = {ours: found.index, theirs: b[i].index, text: found.text};
+  }
+  if (!common) throw fault('copies have no proven common start');
+  const records = ours.ledger.records.slice(), imported = new Set(records.map(origin));
+  let text = ours.text, root = ours.root;
+  const append = (splices, actor, sourceId, operation, at) => {
+    const next = _rapierTransformSplices(text, splices);
+    if (next === null) throw fault('transported record failed replay');
+    const beforeHash = root, revision = (records.at(-1)?.transaction.revision ?? ours.ledger.start.revision) + 1;
+    for (const row of splices) root = rootAfter(root, row);
+    records.push({beforeHash, afterHash: root, splices, transaction: {
+      id: ours.ledger.documentAuthority.slice(0, 48) + ':merge:' + revision.toString(36), documentAuthority: ours.ledger.documentAuthority,
+      baseRevision: revision - 1, revision, actor, transport: 'platform', operation, requestId: null,
+      sourceTransactionId: sourceId, affectedBlockIds: [], parent: records.at(-1)?.transaction.id ?? null,
+      reverts: null, reapplies: null, createdAt: at,
+    }}); text = next;
+  };
+  let against = ours.ledger.records.slice(common.ours).flatMap(record => record.splices.map(row => ({...row})));
+  const incoming = theirs.ledger.records.slice(common.theirs);
+  // Complete repeats are detected by record content, never the revision ID (copies can reuse IDs).
+  const unseen = incoming.filter(record => !imported.has(origin(record)));
+  const keepDiffers = canonicalJSON(kept(ours.text)) !== canonicalJSON(kept(theirs.text));
+  let conflicted = keepDiffers && unseen.length > 0;
+  if (!conflicted && unseen.length && unseen.length !== incoming.length) conflicted = true; // partial receipt needs a common text merge
+  if (!conflicted) for (const record of unseen) {
+    const moved = [];
+    for (const splice of record.splices) {
+      let row = {...splice}; const nextAgainst = [];
+      for (const other of against) {
+        const next = over(row, other), otherNext = over(other, row);
+        if (!next || !otherNext) { conflicted = true; break; }
+        nextAgainst.push(otherNext); row = next;
+      }
+      if (conflicted) break;
+      moved.push(row); against = nextAgainst;
+    }
+    if (conflicted || _rapierTransformSplices(text, moved) === null) { conflicted = true; break; }
+    append(moved, record.transaction.actor, origin(record), record.transaction.operation, record.transaction.createdAt);
+  }
+  let conflicts = [];
+  if (conflicted) {
+    // Restart from the original local head: partially transported records never leak into a conflict result.
+    records.splice(ours.ledger.records.length); text = ours.text; root = ours.root;
+    const merged = mergeText(keepDiffers ? null : common.text, ours.text, theirs.text, {oursId: 'copy-' + ours.ledger.sha256.slice(0, 16), theirsId: 'copy-' + theirs.ledger.sha256.slice(0, 16)});
+    conflicts = merged.conflicts;
+    if (merged.text !== text) append([{pos: 0, removed: text, inserted: merged.text}], {kind: 'system', id: 'merge'},
+      'ledger:' + theirs.ledger.sha256, 'document.merge', Math.max(0, ...incoming.map(record => record.transaction.createdAt)));
+  }
+  const ledger = exportLedger({text, records, documentAuthority: ours.ledger.documentAuthority, root,
+    revision: records.at(-1)?.transaction.revision ?? ours.revision, complete: ours.complete});
+  const clean = !conflicts.length && !text.includes('<!-- note-conflict:v1 ');
+  return {text, ledger, clean, conflicts, review: {required: !clean, base: ours.text, proposed: text}};
+}

package/dist/kit/ledger/text-merge.mjs

@@ -0,0 +1,345 @@
+// SPDX-License-Identifier: MIT
+// Shared conflict envelopes and exact three-way text merge; Notes and the ledger import this owner.
+function textFault(code, message) { return Object.assign(new Error(message), {code}); }
+export function canonicalNote(text) {
+	if (typeof text !== 'string') throw textFault('note_text', 'A note must be text');
+	for (let i = 0; i < text.length; i++) {
+		const c = text.charCodeAt(i);
+		if (c >= 0xd800 && c <= 0xdbff) {
+			const next = text.charCodeAt(++i);
+			if (!(next >= 0xdc00 && next <= 0xdfff)) throw textFault('note_unicode', 'An unpaired surrogate has no exact UTF-8 bytes');
+		} else if (c >= 0xdc00 && c <= 0xdfff) throw textFault('note_unicode', 'An unpaired surrogate has no exact UTF-8 bytes');
+	}
+	return text;
+}
+
+const TEXT_CONFLICT = '<!-- note-conflict:v1 ';
+const textLine = line => line.replace(/(?:\r\n|\r|\n)$/, '');
+const textBlank = line => /^[ \t]*$/.test(textLine(line));
+const textSpace = unit => /^[ \t\r\n]*$/.test(unit);
+const textList = line => /^( {0,3})(?:[-+*]|\d{1,9}[.)])[ \t]+/.exec(line);
+const textFence = line => /^ {0,3}(`{3,}|~{3,})(.*)$/.exec(line);
+const textRule = line => /^ {0,3}(?:(?:\*[ \t]*){3,}|(?:-[ \t]*){3,}|(?:_[ \t]*){3,})$/.test(line);
+const textHeading = line => /^ {0,3}#{1,6}(?:[ \t]|$)/.test(line);
+const textDefinition = line => /^ {0,3}\[(?:\\.|[^\]\\\r\n])+\]:/.test(line);
+const textStart = line => textHeading(line) || textRule(line) || textFence(line) || /^ {0,3}(?:[-+*]|1[.)])[ \t]+/.test(line) || /^ {0,3}(?:>|<!--|<(?:script|style|pre|textarea)(?:\s|>))/i.test(line);
+
+// Only the exact public envelope is structural; malformed comments and fenced examples stay text.
+function textEnvelopeAt(text, start = 0) {
+	if (!text.startsWith(TEXT_CONFLICT, start)) return null;
+	const headerEnd = text.indexOf(' -->\n\n', start), variants = [];
+	if (headerEnd < 0) return null;
+	let header;
+	try { header = JSON.parse(text.slice(start + TEXT_CONFLICT.length, headerEnd)); } catch { return null; }
+	if (!header || typeof header.id !== 'string' || !Array.isArray(header.variants) || header.variants.length < 2) return null;
+	let at = headerEnd + 6;
+	for (const item of header.variants) {
+		if (!item || typeof item.device !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(item.device) || !Number.isSafeInteger(item.length) || item.length < 0) return null;
+		const label = '**Version from ' + item.device + '**\n\n';
+		if (!text.startsWith(label, at)) return null;
+		at += label.length;
+		const fence = /^(`{3,})markdown\n/.exec(text.slice(at));
+		if (!fence) return null;
+		at += fence[0].length;
+		const value = text.slice(at, at + item.length); at += item.length;
+		const tail = (value.endsWith('\n') ? '' : '\n') + fence[1] + '\n\n';
+		if (!text.startsWith(tail, at)) return null;
+		at += tail.length; variants.push({device: item.device, text: value});
+	}
+	const tail = '<!-- /note-conflict:v1 -->\n';
+	if (!text.startsWith(tail, at)) return null;
+	const end = at + tail.length, block = text.slice(start, end);
+	if (textEnvelope(header.id, variants) !== block) return null;
+	return {kind: 'text', id: header.id, start, end, block, variants};
+}
+
+export function inspectTextConflicts(text, {nested = false} = {}) {
+	canonicalNote(text);
+	const out = []; let at = 0;
+	for (const unit of textUnits(text)) {
+		const found = textEnvelopeAt(unit);
+		if (found && found.end === unit.length) {
+			out.push({...found, start: at, end: at + unit.length});
+			// Nested offsets belong to their alternative's source; custody callers use
+			// the exact block bytes. Ordinary fenced examples remain opaque at every level.
+			if (nested) for (const variant of found.variants) out.push(...inspectTextConflicts(variant.text, {nested}));
+		}
+		at += unit.length;
+	}
+	return out;
+}
+
+export function mapTextConflictVariants(text, mapper) {
+	const conflicts = inspectTextConflicts(text); let out = '', at = 0;
+	for (const block of conflicts) {
+		out += text.slice(at, block.start) + textEnvelope(block.id, block.variants.map(variant => ({
+			device: variant.device, text: canonicalNote(mapper(mapTextConflictVariants(variant.text, mapper), variant.device)),
+		})));
+		at = block.end;
+	}
+	return out + text.slice(at);
+}
+
+// This is a conservative edit boundary scan, never the document's rendering grammar.
+function textUnits(text) {
+	const lines = text.match(/[^\r\n]*(?:\r\n|\r|\n)|[^\r\n]+$/g) || [], out = [], offsets = [0];
+	for (const line of lines) offsets.push(offsets[offsets.length - 1] + line.length);
+	for (let i = 0; i < lines.length;) {
+		const start = i, first = textLine(lines[i]).replace(/^\ufeff/, ''), list = textList(first), fence = textFence(first);
+		const envelope = first.startsWith(TEXT_CONFLICT) ? textEnvelopeAt(text, offsets[i]) : null;
+		if (envelope) {
+			while (i < lines.length && offsets[i] < envelope.end) i++;
+			out.push(lines.slice(start, i).join('')); continue;
+		}
+		if (textBlank(lines[i])) { while (++i < lines.length && textBlank(lines[i])) {} }
+		else if (fence) {
+			const mark = fence[1][0], count = fence[1].length;
+			i++;
+			while (i < lines.length) {
+				const close = new RegExp('^ {0,3}' + (mark === '`' ? '`' : '~') + '{' + count + ',}[ \\t]*$').test(textLine(lines[i++]));
+				if (close) break;
+			}
+		} else if (list) {
+			const indent = list[1].length;
+			i++;
+			while (i < lines.length) {
+				const line = textLine(lines[i]), next = textList(line);
+				if (next && next[1].length <= indent) break;
+				if (textBlank(lines[i])) {
+					let j = i; while (j < lines.length && textBlank(lines[j])) j++;
+					if (j === lines.length || !new RegExp('^(?: {' + (indent + 1) + ',}|\\t)').test(lines[j])) break;
+					i = j; continue;
+				}
+				if (!/^[ \t]/.test(line) && textStart(line)) break;
+				i++;
+			}
+		} else if (/^ {0,3}>/.test(first)) {
+			i++;
+			while (i < lines.length) {
+				if (textBlank(lines[i])) {
+					let j = i; while (j < lines.length && textBlank(lines[j])) j++;
+					if (j === lines.length || !/^ {0,3}>/.test(lines[j])) break;
+					i = j; continue;
+				}
+				if (!/^ {0,3}>/.test(lines[i]) && textStart(textLine(lines[i]))) break;
+				i++;
+			}
+		} else if (/^ {0,3}<!--/.test(first)) {
+			i++;
+			if (!first.includes('-->')) while (i < lines.length && !lines[i++].includes('-->')) {}
+		} else if (/^ {0,3}<(script|style|pre|textarea)(?:\s|>)/i.test(first)) {
+			const tag = /^ {0,3}<([a-z]+)/i.exec(first)[1]; i++;
+			if (!new RegExp('</' + tag + '\\s*>', 'i').test(first)) while (i < lines.length && !new RegExp('</' + tag + '\\s*>', 'i').test(lines[i++])) {}
+		} else if (textHeading(first) || textRule(first)) i++;
+		else {
+			i++;
+			while (i < lines.length && !textBlank(lines[i])) {
+				if (/^ {0,3}(?:=+|-+)[ \t]*$/.test(textLine(lines[i]))) { i++; break; }
+				if (textStart(textLine(lines[i]))) break;
+				i++;
+			}
+			if (textDefinition(first) || /^(?: {4}|\t)/.test(first)) {
+				while (i < lines.length) {
+					let j = i; while (j < lines.length && textBlank(lines[j])) j++;
+					if (j === lines.length || !/^(?: {4}|\t)/.test(lines[j])) break;
+					i = j + 1; while (i < lines.length && !textBlank(lines[i]) && /^(?: {4}|\t)/.test(lines[i])) i++;
+				}
+			}
+		}
+		out.push(lines.slice(start, i).join(''));
+	}
+	return out;
+}
+
+function textEdits(base, side) {
+	const n = base.length, m = side.length;
+	if ((n + 1) * (m + 1) > 1000000) return null;
+	const width = m + 1, score = new Uint32Array((n + 1) * width);
+	for (let i = n - 1; i >= 0; i--) for (let j = m - 1; j >= 0; j--) {
+		const p = i * width + j;
+		score[p] = base[i] === side[j] ? score[p + width + 1] + 1 : Math.max(score[p + width], score[p + 1]);
+	}
+	const walk = () => {
+		const pairs = []; let i = 0, j = 0;
+		while (i < n && j < m) {
+			const value = score[i * width + j]; if (!value) break;
+			if (base[i] === side[j]) { pairs.push([i++, j++]); continue; }
+			if (score[(i + 1) * width + j] >= score[i * width + j + 1]) i++; else j++;
+		}
+		return pairs;
+	};
+	const pairs = walk(), meaningful = pairs.filter(([i]) => !textSpace(base[i]));
+	// Every optimal path must agree on every authored anchor, not just two greedy walks.
+	const seen = new Uint32Array(score.length); seen.fill(0xffffffff); seen[0] = 0;
+	for (let i = 0; i <= n; i++) for (let j = 0; j <= m; j++) {
+		const p = i * width + j, at = seen[p]; if (at === 0xffffffff) continue;
+		const visit = (next, count) => { if (seen[next] !== 0xffffffff && seen[next] !== count) return false; seen[next] = count; return true; };
+		if (i < n && score[p + width] === score[p] && !visit(p + width, at)) return null;
+		if (j < m && score[p + 1] === score[p] && !visit(p + 1, at)) return null;
+		if (i < n && j < m && base[i] === side[j] && score[p] === score[p + width + 1] + 1) {
+			const content = !textSpace(base[i]);
+			if (content && (meaningful[at]?.[0] !== i || meaningful[at]?.[1] !== j)) return null;
+			if (!visit(p + width + 1, at + (content ? 1 : 0))) return null;
+		}
+	}
+	if (seen[n * width + m] !== meaningful.length) return null;
+	const edits = []; let i = 0, j = 0;
+	for (const [bi, sj] of [...pairs, [n, m]]) {
+		if (i !== bi || j !== sj) edits.push({start: i, end: bi, text: side.slice(j, sj).join('')});
+		i = bi + 1; j = sj + 1;
+	}
+	return edits;
+}
+
+function textTick(base, a, b) {
+	const box = value => {
+		const m = /^( {0,3}(?:[-+*]|\d{1,9}[.)])[ \t]+\[)([ xX])(\])/.exec(value);
+		return m && {at: m[1].length, tick: m[2], body: value.slice(0, m[1].length) + ' ' + value.slice(m[1].length + 1)};
+	};
+	const c = box(base); if (!c) return null;
+	// One side ticked, the other added lines: the tick lands on the item found whole among the other side's units. Ambiguity is a conflict.
+	const au = textUnits(a), bu = textUnits(b);
+	if (au.length !== 1 || bu.length !== 1) {
+		const [one, many] = au.length === 1 ? [a, bu] : bu.length === 1 ? [b, au] : [null, null];
+		const x = one === null ? null : box(one);
+		if (!x || x.body !== c.body || x.tick === c.tick) return null;
+		const at = many.map((unit, i) => unit === base ? i : -1).filter(i => i >= 0);
+		if (at.length !== 1) return null;
+		return many.map((unit, i) => i === at[0] ? one : unit).join('');
+	}
+	const x = box(a), y = box(b); if (!x || !y) return null;
+	const body = x.body === y.body ? x.body : x.body === c.body ? y.body : y.body === c.body ? x.body : null;
+	if (body === null) return null;
+	const marked = x.tick !== ' ' && y.tick !== ' ' ? [x.tick, y.tick].sort()[0] : x.tick === c.tick ? y.tick : y.tick === c.tick ? x.tick : null;
+	const at = box(body).at;
+	return marked === null ? null : body.slice(0, at) + marked + body.slice(at + 1);
+}
+
+function textDeviceOptions(options) {
+	const {oursId, theirsId} = options || {};
+	if (![oursId, theirsId].every(id => typeof id === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(id)) || oursId === theirsId) {
+		throw textFault('merge_devices', 'A conflict needs two distinct stable device identifiers');
+	}
+	return [oursId, theirsId];
+}
+
+function textEnvelope(id, variants) {
+	let longest = 2;
+	for (const v of variants) for (const run of v.text.match(/`+/g) || []) longest = Math.max(longest, run.length);
+	const fence = '`'.repeat(longest + 1);
+	let out = TEXT_CONFLICT + JSON.stringify({id, variants: variants.map(v => ({device: v.device, length: v.text.length}))}) + ' -->\n\n';
+	for (const v of variants) {
+		out += '**Version from ' + v.device + '**\n\n' + fence + 'markdown\n' + v.text + (v.text.endsWith('\n') ? '' : '\n') + fence + '\n\n';
+	}
+	return out + '<!-- /note-conflict:v1 -->\n';
+}
+
+function textDeclarations(text) {
+	text = textUnits(text).filter(unit => !textEnvelopeAt(unit)).join('');
+	// A definition can move a destination/title onto the next unindented line, or span its label.
+	const definitions = text.match(/^\ufeff? {0,3}\[(?:\\.|[^\]\\])+\]:[^\r\n]*(?:(?:\r\n|\r|\n)(?![ 	]*(?:\r\n|\r|\n|$))[^\r\n]*)*/gm) || [];
+	const continuations = textUnits(text).filter(unit => /^\ufeff? {0,3}\[\^/.test(unit));
+	return [...definitions, ...continuations, ...(text.match(/<!--[\s\S]*?(?:-->|$)/g) || [])].join('\0');
+}
+
+export function mergeText(base, ours, theirs, options = {}) {
+	canonicalNote(ours); canonicalNote(theirs); if (base !== null) canonicalNote(base);
+	const unchanged = value => ({text: value, clean: !value.includes(TEXT_CONFLICT), conflicts: value.includes(TEXT_CONFLICT) ? [{kind: 'existing-conflict', advisory: true}] : []});
+	if (ours === theirs) return unchanged(ours);
+	if (base === ours) return unchanged(theirs);
+	if (base === theirs) return unchanged(ours);
+	const conflicts = []; let text = '';
+	const conflict = (before, a, b, kind) => {
+		// Shared framing remains ordinary text; only the changed region is a choice.
+		const ab = inspectTextConflicts(a), bb = inspectTextConflicts(b);
+		const au = textUnits(a), bu = textUnits(b); let first = 0, last = 0;
+		while (first < Math.min(au.length, bu.length) && au[first] === bu[first]) first++;
+		while (last < Math.min(au.length, bu.length) - first && au[au.length - 1 - last] === bu[bu.length - 1 - last]) last++;
+		if ((ab.length || bb.length) && (first || last)) {
+			const prefix = au.slice(0, first).join(''), suffix = last ? au.slice(-last).join('') : '';
+			text += prefix;
+			conflict(null, au.slice(first, last ? -last : undefined).join(''), bu.slice(first, last ? -last : undefined).join(''), kind);
+			text += suffix; return;
+		}
+		// A shared unresolved region is an anchor even when its alternatives have grown. Splitting
+		// around it keeps surrounding edits in their own choices instead of quoting an old choice.
+		const overlaps = (x, y) => x.variants.some(v => y.variants.some(w => v.device === w.device && v.text === w.text));
+		const anchor = ab.map(x => ({x, matches: bb.filter(y => overlaps(x, y))})).find(({x, matches}) =>
+			matches.length === 1 && ab.filter(y => overlaps(y, matches[0])).length === 1 &&
+			(x.start || matches[0].start || x.end < a.length || matches[0].end < b.length));
+		if (anchor) {
+			const {x, matches: [y]} = anchor;
+			for (const [av, bv] of [[a.slice(0, x.start), b.slice(0, y.start)], [x.block, y.block], [a.slice(x.end), b.slice(y.end)]]) {
+				if (av === bv) text += av; else conflict(null, av, bv, kind);
+			}
+			return;
+		}
+		const ids = textDeviceOptions(options), candidates = [{device: ids[0], text: a}, {device: ids[1], text: b}];
+		const variants = [...new Map(candidates.flatMap(v => {
+			const block = textEnvelopeAt(v.text);
+			return block && block.end === v.text.length ? block.variants : [v];
+		}).map(v => [JSON.stringify(v), v])).values()].sort((x, y) => x.device < y.device ? -1 : x.device > y.device ? 1 : x.text < y.text ? -1 : x.text > y.text ? 1 : 0);
+		if (text && !/[\r\n]$/.test(text)) text += '\n\n';
+		const start = text.length, block = textEnvelope(String(conflicts.length), variants);
+		conflicts.push({kind, base: before, variants, start, end: start + block.length, block});
+		text += block;
+	};
+	if (base === null) conflict(null, ours, theirs, 'no-ancestor');
+	else if (textDeclarations(ours) !== textDeclarations(base) || textDeclarations(theirs) !== textDeclarations(base)) conflict(base, ours, theirs, 'document-bindings');
+	else {
+		const units = textUnits(base), a = textEdits(units, textUnits(ours)), b = textEdits(units, textUnits(theirs));
+		if (!a || !b) conflict(base, ours, theirs, 'ambiguous-alignment-or-budget');
+		else {
+			const changes = [...a.map(e => ({...e, side: 0})), ...b.map(e => ({...e, side: 1}))].sort((x, y) => x.start - y.start || x.end - y.end || x.side - y.side);
+			let pos = 0;
+			for (let i = 0; i < changes.length;) {
+				const group = [changes[i++]], start = group[0].start; let end = group[0].end;
+				// An insertion can anchor on either side of a blank run; that is still one gap.
+				while (i < changes.length && (changes[i].start < end || group.some(e => {
+					const next = changes[i];
+					// Appending after an unresolved block does not edit any of its alternatives.
+					const afterBlock = (edit, insert) => insert.start === insert.end && insert.start === edit.end && edit.start < edit.end && units.slice(edit.start, edit.end).every(unit => textEnvelopeAt(unit));
+					if (afterBlock(e, next) || afterBlock(next, e)) return false;
+					if (e.start === e.end && next.start <= e.start && e.start <= next.end) return true;
+					if (next.start === next.end && e.start <= next.start && next.start <= e.end) return true;
+					return next.start >= e.end && units.slice(e.start, e.end).every(textSpace) &&
+						units.slice(e.end, next.start).every(textSpace) && units.slice(next.start, next.end).every(textSpace);
+				}))) {
+					group.push(changes[i]); end = Math.max(end, changes[i++].end);
+				}
+				text += units.slice(pos, start).join('');
+				const before = units.slice(start, end).join('');
+				const version = side => {
+					let value = '', at = start;
+					for (const e of group.filter(e => e.side === side)) { value += units.slice(at, e.start).join('') + e.text; at = e.end; }
+					return value + units.slice(at, end).join('');
+				};
+				const av = version(0), bv = version(1);
+				if (av === bv) text += av;
+				else if (av === before) text += bv;
+				else if (bv === before) text += av;
+				else {
+					const tick = end === start + 1 ? textTick(before, av, bv) : null;
+					if (tick !== null) text += tick; else conflict(before, av, bv, 'text');
+				}
+				pos = end;
+			}
+			text += units.slice(pos).join('');
+		}
+	}
+	return {text, clean: conflicts.length === 0 && !text.includes(TEXT_CONFLICT), conflicts};
+}
+
+// A marker is advisory data. The caller supplies its trusted descriptor and current revision.
+export function resolveTextConflict(text, conflict, device) {
+	canonicalNote(text);
+	if (!conflict || !Number.isInteger(conflict.start) || !Number.isInteger(conflict.end) || conflict.start < 0 || conflict.end < conflict.start || text.slice(conflict.start, conflict.end) !== conflict.block) {
+		throw textFault('merge_stale', 'The inspected conflict changed');
+	}
+	const matches = Number.isInteger(device) ? [conflict.variants?.[device]].filter(Boolean) : conflict.variants?.filter(v => v.device === device) || [];
+	const version = matches.length === 1 ? matches[0] : null;
+	if (!version) throw textFault('merge_choice', 'Choose one inspected version');
+	canonicalNote(version.text);
+	return text.slice(0, conflict.start) + version.text + text.slice(conflict.end);
+}
+

package/dist/kit/rapier-ledger.mjs

@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: MIT
+import {exportLedger, replaceLedgerText, readLedger, textRoot, rootAfter, historyEnvelope, agentActorId} from './ledger/format.mjs';
+export {exportLedger, replaceLedgerText, readLedger, textRoot, rootAfter, historyEnvelope, agentActorId};
+import {authorship, readAuthorship, ledgerFromAuthorship} from './ledger/authorship.mjs';
+export {authorship, readAuthorship, ledgerFromAuthorship};
+import {merge, transportInterval} from './ledger/merge.mjs';
+export {merge, transportInterval};
+import {_rapierTransformSplices, _rapierRecordSplices, _rapierValidLedgerRecord} from './ledger/journal-records.mjs';
+export {_rapierTransformSplices, _rapierRecordSplices, _rapierValidLedgerRecord};

package/dist/kit/render-entry.mjs

@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: MIT
+// The public renderer door; each factory binds explicit host ports once per document realm.
+export {createRenderer} from './render.mjs';
+export {createMarkdownRenderer} from './render-markdown.mjs';
+export {createRenderStyles} from './render-styles.mjs';
+export {createRenderSanitizer} from './render-sanitize.mjs';
+export {createPrintRenderer} from './render-print.mjs';