rapier-markdown-kit 1.1.99 → 1.1.101

package/LICENSE

@@ -22,7 +22,9 @@ SOFTWARE.
 
 Files under this licence carry `SPDX-License-Identifier: MIT` in their first lines: the standard's
 grammar, marks and reference style (`spec/md-layout.mjs`, `spec/md-marks.mjs`, `spec/flowchart.mjs`, `spec/markdown-style.css`), the layout model and line planner
-(`layout/model.mjs`, `layout/line-plan.mjs`), the Will grammar (`agent/will.mjs`), the picture appendix reader and writer
+(`layout/model.mjs`, `layout/line-plan.mjs`, `layout/typography.mjs`),
+the portable HTML and document metadata helpers (`spec/html-blocks.mjs`, `spec/frontmatter.mjs`,
+`spec/document-settings.mjs`, `spec/document-fonts.mjs`), the Will grammar (`agent/will.mjs`), the picture appendix reader and writer
 (`spec/md-assets.mjs`), the two shared-page reference readers (`tools/read-shared-page.mjs`,
 `tools/read-shared-page.py`), and the host helper `packages/rapier-embed/embed.mjs` with its
 contract owner `packages/rapier-embed/contract.mjs`. The vendored Pretext (`agent/vendor/pretext`) and micromark carry their
@@ -32,12 +34,18 @@ record validator/replayer and text-only conflict merger were moved, not copied,
 into that module; the Notes index merger and the rest of the agent/editor remain
 AGPL-3.0-only. The wrapper's carrier-staging helper
 (`skills/rapier-html/package-files.mjs`) is MIT. The kit's MIT-marked facades,
-`kit/render-entry.mjs`, `kit/render*.mjs`, `kit/stage.mjs` and MIT-marked conformance
+`kit/render-entry.mjs`, `kit/render*.mjs`, `kit/export-fonts.mjs`, `kit/print-capitals.mjs`,
+`kit/pdf-vectors.mjs`, `kit/pdf-glyphs.mjs`, `kit/stage.mjs` and MIT-marked conformance
 modules are covered too. These names describe the Rapier-owned files carrying the
 MIT notice, not a grant over the editor or third-party code. Other Rapier-owned
 files retain their stated licence; the editor is AGPL-3.0-only (see `LICENSE`).
 Third-party components retain their own copyright and licence notices.
 
+The portable font helpers read document definitions and accept explicit host validation and
+subsetting functions. The application binding (`editor/export-fonts.mjs`), captured-font
+materializer (`kit/document-fonts.mjs`) and font codecs (`draw/font*.mjs`) remain AGPL-3.0-only
+and are not part of the MIT package's import graph.
+
 The picture appendix reader and writer used to be part of `images/assets.mjs`, a file that also
 holds JPEG XL/raster header inspection and SVG sanitizing -- both of which reach the editor's own
 AGPL-3.0-only decoders (`images/raster.mjs`, `draw/font.mjs`), so the whole file could not honestly

package/README.md

@@ -17,7 +17,7 @@ To show documents in your app without writing a renderer, frame the read-only re
 offline file, run `npx rapier-html notes.md`.
 
 In the editor, an agent edits live beside the person or while they are away. Rapier shows its presence and changes;
-the person taps a change to see what was there before and undoes anything. `comparison.present` lets the agent
+the person taps a change to see what was there before and undoes anything. `show {target:"comparison"}` lets the agent
 deliberately show a diff. The kit supplies the portable source and history those tools use.
 
 ```sh
@@ -37,7 +37,7 @@ import {parseAssets} from 'rapier-markdown-kit/assets';   // the picture appendi
 Rapier is a phone-first Markdown editor for notes, diagrams, drawing and watercolor painting. It runs offline
 as one HTML file on Android, Web and Windows.
 
-1. **Work together live.** Connect to `https://mcp.rapier.website/mcp`, then call `rapier.open` to share one document with the person.
+1. **Work together live.** Connect to `https://mcp.rapier.website/mcp`, then call `open` to share one document with the person.
 2. **Deliver an offline editor.** Run `npx rapier-html notes.md` to put the document and editor in one HTML file ([rapier-html](https://github.com/jackskip22/rapier-plugins/tree/main/npm/rapier-html)).
 3. **Embed in your app.** Install [rapier-embed](https://github.com/jackskip22/rapier-plugins/tree/main/npm/rapier-embed); mount the editor or reader, with your app's agent over WebMCP in the editor.
 4. **Keep portable Markdown.** Use [rapier-markdown-kit](https://github.com/jackskip22/rapier-plugins/tree/main/npm/rapier-markdown-kit) for pictures, editable SVG drawings and layout in one `.md` file. Respect [Will/1](https://github.com/jackskip22/will) `keep`, `append` and `edit` regions.
@@ -47,7 +47,8 @@ as one HTML file on Android, Web and Windows.
 ## The shared renderer
 
 `rapier-markdown-kit/render` exports `createRenderer`, `createMarkdownRenderer`,
-`createRenderStyles`, `createRenderSanitizer` and `createPrintRenderer`. These are the
+`createRenderStyles`, `createRenderSanitizer` and `createPrintRenderer`, plus the explicit font helpers
+`exportFontCss`, `requireDocumentFonts`, `fontRequests`, `waitForFonts` and `waitForFontRequests`. These are the
 functions used by the editor and exported pages. Each factory takes explicit host dependencies
 in its first argument. `style.css` is the
 MIT `spec/markdown-style.css`, including the numbered-list, checkbox, callout, table,
@@ -56,8 +57,8 @@ footnote and picture-layout treatment.
 ```js
 import {createRenderer} from 'rapier-markdown-kit/render';
 
-// host is your bound DOM/codec/Markdown/image/style environment. Its named ports are
-// declared at the top of createRenderer; preparation returns a detached semantic root.
+// host binds the DOM, Markdown, image, style and font capabilities described below.
+// Preparation returns a detached semantic root; source comes from this captured request.
 const writer = createRenderer(host);
 const {html, filename} = await writer.render(source, {filename: 'report.md'});
 ```
@@ -80,6 +81,39 @@ not part of this MIT package.
 Serialization tests preserve source bytes through HTML export and recovery. Server integration
 tests also check the exported HTTP response through a browser DOM.
 
+### Fonts in exported HTML
+
+Settings HTML and Share pages use the same offline font policy. The writer reads custom font
+definitions from the captured Markdown and carries their exact bytes and face metadata. A used
+custom family must have valid embedded data; otherwise export stops without changing the document.
+Font preparation and binary validation are explicit host capabilities:
+
+| Host port | Contract |
+| --- | --- |
+| `materializeDocumentFonts(source, {parser})` | Optional at `render()` entry; returns the prepared Markdown string or a promise for it. Without this port, the caller supplies already portable, captured Markdown. Materialization must preserve explicit font authority and return source for this request. |
+| `validateFont(bytes, {family, format})` | Validates a `Uint8Array` and returns exactly `true`, synchronously or asynchronously, only on admission. Required used custom fonts refuse with `export_font_unavailable` if the port is absent and `export_font_invalid` if it returns another value. Host errors and cancellation propagate. |
+
+Browser hosts additionally check the exact captured container with an uninstalled `FontFace`.
+Without `FontFace`, only the host validator's admission is established; it does not establish
+browser container support. The HTML font helpers do not bundle the application's font importer,
+container codecs or subsetter. Rapier binds its existing materializer and shared importer at `editor/render-host.js` through
+`editor/export-fonts.mjs`; those implementations retain their application licence.
+An embedded family named Geist or Geist Mono remains custom data and takes precedence over the
+factory family. Custom fonts have no optional factory size limit.
+
+Factory typography may add a genuine subset of Geist Sans for the page's actual text, using the
+host's subsetter. `exportFontCss` accepts `subset` and `validateFont` ports; with `portableFactory:true`,
+missing or unsuccessful validation omits this optional CSS. The complete set of used factory faces must fit both 8 KiB of font payload and
+12 KiB of emitted font CSS, including base64. If subsetting is unavailable, unsafe, unchanged or too
+large, the page uses the existing local/system fallback. HTML never carries factory Geist Mono;
+code and native diagram labels retain their existing monospace fallbacks. No font is downloaded
+when the saved file is opened, and optional factory fonts never enter the carried Markdown.
+
+Publishing HTML remains a fragment: it carries only its custom font declarations and local
+body, heading, code and inline choices, without a page wrapper or a factory bundle. The host must
+permit inline styles and data fonts. Two fragments with different custom faces under the same
+family name share the host's font namespace. Print retains its existing factory font policy.
+
 ## What it gives you
 
 | Import | What it is |
@@ -291,8 +325,8 @@ tolerance.
 ## Licence
 
 MIT, the full text in `LICENSE`; Rapier-owned modules and the stylesheet keep their MIT line. Pretext's licence, notice and
-pinned source inventory are in `dist/agent/vendor/pretext/`. The history projection's jsdiff dependency is BSD-3-Clause;
-`dist/agent/diff.mjs` carries its complete upstream copyright, conditions and disclaimer. The Rapier editor is AGPL-3.0-only and
+pinned source inventory are in `dist/agent/vendor/pretext/`. The history projection uses the MIT diff core;
+its full grant is in `dist/packages/rapier-diff/LICENSE`. The Rapier editor is AGPL-3.0-only and
 none of it is in this package. The kit carries Rapier's release number, written from the one
 value the editor's release reads.
 
@@ -342,7 +376,7 @@ transaction: {id, documentAuthority, baseRevision, revision, actor: {kind, id},
 retained record. Every outgoing record carries its own splices, including Undo and
 Redo. Offsets and ranges count UTF-16 code units; no boundary may cut a surrogate
 pair. Splices execute in their recorded order. UTF-8 checksums preserve CRLF, tabs,
-NUL and non-ASCII text. The canonical text limit is 25 MiB; each record has at most
+NUL and non-ASCII text. The canonical text limit is 64 MiB; each record has at most
 64 splices. Metadata is {filename, docKind}; a record may carry filename or docKind pairs {before, after}. Metadata-only acts keep equal source roots and an empty splice list. Inverses reference retained act IDs, so later metadata choices survive selective Undo. File handles and save permissions are never portable. The existing record validator remains authoritative for field bounds.
 
 An optional `authored: {basis, source, splices}` preserves an act's original placement

package/dist/kit/export-fonts.mjs

@@ -0,0 +1,403 @@
+// SPDX-License-Identifier: MIT
+import {documentFontUsage, CSS_GENERIC_FONT_FAMILIES} from '../spec/document-fonts.mjs';
+import {normalizeFontFamily} from '../spec/md-marks.mjs';
+// Collect document font data without a layout engine. Authored drawing resources keep their identities.
+const FONT_FIELDS = new Set(['font', 'font-family', 'font-weight', 'font-style', 'font-stretch', 'text-transform']);
+const FAMILY = "'Geist',system-ui,sans-serif";
+const MONO = "'Geist Mono',monospace";
+
+// Optional HTML enhancement: the font payload and its encoded stylesheet have separate limits.
+const FACTORY_FONT_BYTES = 8 * 1024, FACTORY_FONT_CSS_BYTES = 12 * 1024;
+const decodeCss = value => value.replace(/\\(?:([\da-f]{1,6})(?:\r\n|[ \t\n\r\f])?|([^\n\r\f]))/gi,
+  (_, hex, character) => hex ? String.fromCodePoint(Math.max(1, Math.min(0x10ffff, parseInt(hex, 16)))) : character);
+const unquote = value => decodeCss(value.trim().replace(/^(['"])([\s\S]*)\1$/, '$2'));
+
+function splitCss(text, delimiter) {
+  const parts = [];
+  let quote = '', depth = 0, start = 0;
+  for (let at = 0; at < text.length; at++) {
+    const char = text[at];
+    if (char === '\\') { at++; continue; }
+    if (quote) { if (char === quote) quote = ''; continue; }
+    if (char === '"' || char === "'") { quote = char; continue; }
+    if (char === '(' || char === '[') depth++;
+    else if (char === ')' || char === ']') depth--;
+    else if (!depth && (delimiter === ' ' ? /\s/.test(char) : char === delimiter)) {
+      if (at > start || delimiter !== ' ') parts.push(text.slice(start, at));
+      start = at + 1;
+    }
+  }
+  if (start < text.length || delimiter !== ' ') parts.push(text.slice(start));
+  return parts;
+}
+
+function declarations(text) {
+  return splitCss(text, ';').flatMap(item => {
+    const colon = item.indexOf(':');
+    if (colon < 0) return [];
+    const name = item.slice(0, colon).trim().toLowerCase(), raw = item.slice(colon + 1).trim();
+    return [{name, value: raw.replace(/\s*!important\s*$/i, ''), important: /!important\s*$/i.test(raw)}];
+  });
+}
+
+function rules(text, visit) {
+  let start = 0, quote = '', parentheses = 0, depth = 0, selector = '', body = 0;
+  for (let at = 0; at < text.length; at++) {
+    const char = text[at];
+    if (char === '\\') { at++; continue; }
+    if (quote) { if (char === quote) quote = ''; continue; }
+    if (char === '/' && text[at + 1] === '*') {
+      const end = text.indexOf('*/', at + 2);
+      if (end < 0) return;
+      text = text.slice(0, at) + ' '.repeat(end + 2 - at) + text.slice(end + 2);
+      at = end + 1; continue;
+    }
+    if (char === '"' || char === "'") { quote = char; continue; }
+    if (char === '(' || char === '[') parentheses++;
+    else if (char === ')' || char === ']') parentheses--;
+    else if (!parentheses && char === '{') { if (depth++ === 0) { selector = text.slice(start, at).trim(); body = at + 1; } }
+    else if (!parentheses && char === '}') {
+      if (--depth === 0) {
+        const value = text.slice(body, at);
+        if (/^@(?:media|supports|layer|container)\b/i.test(selector)) rules(value, visit);
+        else if (!selector.startsWith('@') || /^@font-face\b/i.test(selector)) visit(selector, declarations(value));
+        start = at + 1;
+      }
+    } else if (!depth && !parentheses && char === ';') start = at + 1;
+  }
+}
+
+function specificity(selector) {
+  // The reference sheet uses :where() for zero-specificity defaults.
+  let value = selector.replace(/:where\((?:[^()]|\([^()]*\))*\)/g, '');
+  const ids = (value.match(/#[\w-]+/g) || []).length;
+  const classes = (value.match(/\.[\w-]+|\[[^\]]*\]|:(?!:)[\w-]+/g) || []).length;
+  value = value.replace(/#[\w-]+|\.[\w-]+|\[[^\]]*\]|::?[\w-]+/g, '');
+  return ids * 1000000 + classes * 1000 + (value.match(/(?:^|[\s>+~,(])[a-zA-Z][\w-]*/g) || []).length;
+}
+
+function resolveValue(value, variables, trail = new Set()) {
+  return value.replace(/var\(\s*(--[\w-]+)\s*(?:,\s*([^()]*))?\)/g, (whole, name, fallback) => {
+    if (trail.has(name)) return fallback || '';
+    const found = variables[name];
+    return found == null ? fallback || '' : resolveValue(found, variables, new Set([...trail, name]));
+  });
+}
+
+function fontShorthand(value) {
+  const parts = splitCss(value, ' ');
+  const size = parts.findIndex(part => /^(?:[\d.]+(?:px|pt|em|rem|%|pc|in|cm|mm|ex|ch)|(?:calc|min|max|clamp)\(|(?:xx?-small|small|medium|large|xx?-large))/.test(part));
+  if (size < 0) return {};
+  let firstFamily = size + 1;
+  if (parts[firstFamily] === '/') firstFamily += 2;
+  else if (parts[firstFamily]?.startsWith('/')) firstFamily++;
+  const prefix = parts.slice(0, size);
+  return {'font-family': parts.slice(firstFamily).join(' '), 'font-style': prefix.find(part => /^(?:italic|oblique)$/.test(part)) || 'normal',
+    'font-weight': prefix.find(part => /^(?:bold|bolder|lighter|[1-9]\d{0,3})$/.test(part)) || '400',
+    'font-stretch': prefix.find(part => /^(?:ultra-|extra-|semi-)?(?:condensed|expanded)$/.test(part)) || 'normal'};
+}
+
+function fontFaces(css) {
+  const faces = [];
+  rules(css, (selector, fields) => {
+    if (!/^@font-face\b/i.test(selector)) return;
+    const properties = Object.fromEntries(fields.map(row => [row.name, row.value]));
+    const family = unquote(properties['font-family'] || '').toLowerCase();
+    const match = /url\(\s*(?:"([^"]*)"|'([^']*)'|([^\s)]*))\s*\)/i.exec(properties.src || '');
+    if (!family || !match) return;
+    const source = decodeCss(match[1] ?? match[2] ?? match[3]);
+    if (!/^data:(?:font\/(?:woff2?|ttf|otf)|application\/(?:font-woff|x-font-ttf|x-font-opentype|octet-stream));base64,[a-z\d+/]+={0,2}$/i.test(source))
+      throw Object.assign(new Error('The page font is not embedded: ' + family), {code: 'export_font_unavailable'});
+    faces.push({family, properties, source, runs: []});
+  });
+  return faces;
+}
+
+function weightDistance(face, desired) {
+  const weight = value => value === 'normal' ? 400 : value === 'bold' ? 700 : Number(value);
+  const range = splitCss(face.properties['font-weight'] || '400', ' ').map(weight), value = weight(desired) || 400;
+  const low = range[0] || 400, high = range[1] || low;
+  if (value >= low && value <= high) return 0;
+  const nearest = value < low ? low : high;
+  if (value >= 400 && value <= 500) return nearest >= value && nearest <= 500 ? nearest - value : nearest < value ? 1000 + value - nearest : 2000 + nearest - value;
+  return value < 400 ? nearest < value ? value - nearest : 1000 + nearest - value : nearest > value ? nearest - value : 1000 + value - nearest;
+}
+
+function stretchOrder(first, second, desired) {
+  const keywords = {'ultra-condensed': 50, 'extra-condensed': 62.5, condensed: 75, 'semi-condensed': 87.5,
+    normal: 100, 'semi-expanded': 112.5, expanded: 125, 'extra-expanded': 150, 'ultra-expanded': 200};
+  const width = value => Object.hasOwn(keywords, value) ? keywords[value] : parseFloat(value);
+  const target = width(desired) || 100;
+  const distance = face => {
+    const range = splitCss(face.properties['font-stretch'] || '100%', ' ').map(width);
+    const low = range[0] || 100, high = range[1] || low;
+    if (low <= target && target <= high) return [0, 0];
+    const nearest = target < low ? low : high, preferred = target <= 100 ? nearest < target : nearest > target;
+    return [preferred ? 1 : 2, Math.abs(nearest - target)];
+  };
+  const a = distance(first), b = distance(second);
+  return a[0] - b[0] || a[1] - b[1];
+}
+
+function styleDistance(face, style) {
+  const wanted = style.startsWith('italic') ? 'italic' : style.startsWith('oblique') ? 'oblique' : 'normal';
+  const actual = (face.properties['font-style'] || 'normal').split(/\s/)[0];
+  return ({normal: ['normal', 'oblique', 'italic'], italic: ['italic', 'oblique', 'normal'], oblique: ['oblique', 'italic', 'normal']}[wanted]).indexOf(actual);
+}
+
+function unicodeIncludes(face, character) {
+  const range = face.properties['unicode-range'];
+  if (!range) return true;
+  const code = character.codePointAt(0);
+  return splitCss(range, ',').some(value => {
+    const match = /^\s*u\+([\da-f?]+)(?:-([\da-f]+))?\s*$/i.exec(value);
+    if (!match) return false;
+    const from = parseInt(match[1].replace(/\?/g, '0'), 16), to = parseInt((match[2] || match[1]).replace(/\?/g, 'f'), 16);
+    return code >= from && code <= to;
+  });
+}
+
+function writeFace(face, bytes) {
+  const signature = String.fromCharCode(...bytes.subarray(0, 4));
+  const format = signature === 'wOFF' ? 'woff' : signature === 'wOF2' ? 'woff2' : signature === 'OTTO' ? 'opentype' : 'truetype';
+  const mime = {woff: 'woff', woff2: 'woff2', opentype: 'otf', truetype: 'ttf'}[format];
+  let binary = '';
+  for (let at = 0; at < bytes.length; at += 16384) binary += String.fromCharCode(...bytes.subarray(at, at + 16384));
+  const properties = {...face.properties, src: 'url("data:font/' + mime + ';base64,' + btoa(binary) + '") format("' + format + '")'};
+  delete properties['unicode-range'];
+  return '@font-face{' + Object.entries(properties).map(([name, value]) => name + ':' + value).join(';') + '}';
+}
+
+function fontRuns(root, {settings, css = '', fontCss = '', faces = fontFaces(fontCss)}) {
+  if (!root?.querySelectorAll) throw new TypeError('The page font writer needs a document.');
+  if (!faces.length) return faces;
+  const selectors = [];
+  const addRules = text => rules(text, (selector, fields) => {
+    if (selector.startsWith('@')) return;
+    const kept = fields.filter(row => FONT_FIELDS.has(row.name) || row.name.startsWith('--'));
+    if (kept.length) for (const selectorPart of splitCss(selector, ',')) selectors.push({selector: selectorPart.trim(), fields: kept, rank: specificity(selectorPart)});
+  });
+  addRules(css);
+  for (const style of root.querySelectorAll('style:not([data-rapier-font])')) addRules(style.textContent || '');
+  const oldClass = root.getAttribute('class');
+  root.setAttribute('class', (oldClass ? oldClass + ' ' : '') + 'md-render rapier-page');
+  try {
+    const initial = {'font-family': settings?.mainfont?.css || FAMILY, 'font-weight': '400', 'font-style': 'normal', 'font-stretch': 'normal',
+      'text-transform': 'none', variables: {'--md-font-sans': settings?.sansfont?.css || settings?.mainfont?.css || FAMILY,
+        '--md-font-main': settings?.mainfont?.css || settings?.sansfont?.css || FAMILY,
+        '--md-font-mono': settings?.monofont?.css || MONO}};
+    const computed = new WeakMap();
+    let priorFace = null, priorStyle = '';
+    const breakRun = () => { priorFace = null; priorStyle = ''; };
+    function styleOf(element) {
+      if (computed.has(element)) return computed.get(element);
+      const parent = element === root ? initial : styleOf(element.parentElement || root);
+      const state = {...parent, variables: Object.create(parent.variables)}, chosen = new Map();
+      let order = 0;
+      function take(row, rank) {
+        const score = (row.important ? 1e12 : 0) + rank, prior = chosen.get(row.name);
+        order++;
+        if (!prior || score >= prior.score) chosen.set(row.name, {...row, score, order});
+      }
+      for (const field of FONT_FIELDS) if (element.hasAttribute(field)) take({name: field, value: element.getAttribute(field)}, -1);
+      for (const rule of selectors) {
+        let matches = false;
+        try { matches = element.matches(rule.selector); } catch (_) {}
+        if (matches) for (const row of rule.fields) take(row, rule.rank);
+      }
+      for (const row of declarations(element.getAttribute('style') || '')) if (FONT_FIELDS.has(row.name) || row.name.startsWith('--')) take(row, 1e9);
+      for (const row of chosen.values()) if (row.name.startsWith('--')) state.variables[row.name] = row.value;
+      const shorthand = chosen.get('font');
+      if (shorthand) for (const [name, value] of Object.entries(fontShorthand(resolveValue(shorthand.value, state.variables)))) {
+        const longhand = chosen.get(name);
+        if (!longhand || longhand.score < shorthand.score || longhand.score === shorthand.score && longhand.order <= shorthand.order)
+          chosen.set(name, {...shorthand, name, value});
+      }
+      for (const field of FONT_FIELDS) {
+        if (field === 'font' || !chosen.has(field)) continue;
+        const value = resolveValue(chosen.get(field).value, state.variables);
+        if (value && value !== 'inherit' && value !== 'unset') state[field] = value;
+      }
+      if (state['font-weight'] === 'bolder') state['font-weight'] = Number(parent['font-weight']) >= 600 ? '900' : '700';
+      if (state['font-weight'] === 'lighter') state['font-weight'] = Number(parent['font-weight']) >= 600 ? '400' : '100';
+      computed.set(element, state); return state;
+    }
+    function add(text, element, overrides) {
+      if (!text || !text.trim() && !element.closest('pre,code,svg text,svg tspan')) { breakRun(); return; }
+      const state = {...styleOf(element), ...overrides};
+      if (state['text-transform'] === 'uppercase') text = text.toLocaleUpperCase(element.closest('[lang]')?.getAttribute('lang') || 'en');
+      else if (state['text-transform'] === 'lowercase') text = text.toLocaleLowerCase(element.closest('[lang]')?.getAttribute('lang') || 'en');
+      else if (state['text-transform'] === 'capitalize') text = text.replace(/(^|\s)(\p{L})/gu, (_, gap, letter) => gap + letter.toUpperCase());
+      const families = splitCss(state['font-family'], ',').filter(name => /^\s*['"]/.test(name) || !CSS_GENERIC_FONT_FAMILIES.includes(unquote(name).toLowerCase()))
+        .map(name => unquote(name).toLowerCase());
+      const runStyle = [state['font-weight'], state['font-style'], state['font-stretch']].join('/');
+      for (const character of text) {
+        let selected = null;
+        for (const family of families) {
+          const candidates = faces.filter(face => face.family === family && unicodeIncludes(face, character));
+          if (!candidates.length) continue;
+          candidates.sort((a, b) => stretchOrder(a, b, state['font-stretch']) ||
+            styleDistance(a, state['font-style']) - styleDistance(b, state['font-style']) ||
+            weightDistance(a, state['font-weight']) - weightDistance(b, state['font-weight']));
+          selected = candidates[0]; break;
+        }
+        if (!selected) { breakRun(); continue; }
+        if (selected === priorFace && runStyle === priorStyle) selected.runs[selected.runs.length - 1] += character;
+        else selected.runs.push(character);
+        priorFace = selected; priorStyle = runStyle;
+      }
+    }
+    function walk(element) {
+      const name = element.localName?.toLowerCase();
+      if (['script', 'style', 'metadata', 'title', 'desc', 'defs', 'template'].includes(name) || element.hasAttribute('hidden') ||
+          element.classList?.contains('diagram-source') && element.closest('[data-diagram-state="ready"]') ||
+          element.classList?.contains('rapier-image-asset-record')) return;
+      const boundary = /^(?:address|article|aside|blockquote|br|dd|details|div|dl|dt|fieldset|figcaption|figure|footer|form|h[1-6]|header|hr|li|main|nav|ol|p|pre|section|summary|table|td|text|th|tr|ul)$/.test(name);
+      if (boundary) breakRun();
+      if (name === 'input' && !/^(?:checkbox|radio|hidden|range|color|file)$/i.test(element.getAttribute('type') || 'text')) {
+        breakRun(); add(element.getAttribute('value') || element.getAttribute('placeholder') || '', element); breakRun();
+      }
+      if (element.hasAttribute('data-md-break')) { breakRun(); add('page', element); breakRun(); }
+      if (name === 'ol') {
+        const native = element.classList.contains('footnotes-list');
+        let ordinal = Number(element.getAttribute('start')) || 1;
+        for (const item of element.children) if (item.localName?.toLowerCase() === 'li') {
+          if (item.hasAttribute('value')) ordinal = Number(item.getAttribute('value'));
+          breakRun();
+          add(String(ordinal++) + (native ? '. ' : ''), item, native ? undefined :
+            {'font-family': resolveValue('var(--md-font-sans)', styleOf(item).variables), 'font-weight': resolveValue('var(--md-fw-semibold)', styleOf(item).variables)});
+          breakRun();
+        }
+      }
+      for (const child of element.childNodes) {
+        if (child.nodeType === 3) add(child.nodeValue || '', element);
+        else if (child.nodeType === 1) walk(child);
+      }
+      if (boundary) breakRun();
+    }
+    walk(root);
+  } finally {
+    if (oldClass == null) root.removeAttribute('class'); else root.setAttribute('class', oldClass);
+  }
+  return faces.filter(face => face.runs.length);
+}
+
+export async function exportFontCss(root, {settings, css = '', fontCss = '', subset, validateFont, portableFactory = false, customFontCss = ''}) {
+  try {
+    if (typeof subset !== 'function') throw new TypeError('The page font writer needs a subsetter.');
+    let candidates = fontFaces(fontCss);
+    if (portableFactory) {
+      // These candidates come from the factory resource host. Carried data owns a same-name family.
+      const custom = new Set(fontFaces(customFontCss).map(face => face.family));
+      candidates = candidates.filter(face => face.family === 'geist' && !custom.has(face.family));
+    }
+    const faces = fontRuns(root, {settings, css, faces: candidates}), output = [];
+    let payloadBytes = 0;
+    for (const face of faces) {
+      const original = Uint8Array.from(atob(face.source.slice(face.source.indexOf(',') + 1)), character => character.charCodeAt(0));
+      // Adjacent inline nodes retain shaping sequences; independent runs cannot compose together.
+      const bytes = await subset(original, face.runs.join('\n'));
+      if (portableFactory) {
+        if (!(bytes instanceof Uint8Array) || !bytes.length || bytes.length >= original.length) return '';
+        payloadBytes += bytes.length;
+        if (payloadBytes > FACTORY_FONT_BYTES) return '';
+        if (typeof validateFont !== 'function' || await validateFont(Uint8Array.from(bytes), {family: 'Geist'}) !== true) return '';
+      } else if (bytes === null) continue;
+      if (!(bytes instanceof Uint8Array) || !bytes.length) throw new Error('The page font subset is empty.');
+      output.push(writeFace(face, bytes));
+    }
+    const result = output.join('\n');
+    return portableFactory && new TextEncoder().encode(result).length > FACTORY_FONT_CSS_BYTES ? '' : result;
+  } catch (error) {
+    if (!portableFactory || error?.name === 'AbortError' || error?.code === 'cancelled') throw error;
+    return '';
+  }
+}
+
+// Validate the captured custom resources without rewriting their source or borrowing a live catalog.
+export async function requireDocumentFonts(source, {parser, index, root, settings, css = '', fontCss = '', validateFont}) {
+  const candidates = fontFaces(fontCss), known = new Set(candidates.map(face => face.family));
+  // Missing named choices participate in the same cascade, but inert and generic runs need no data.
+  for (const family of ['Geist', 'Geist Mono', ...documentFontUsage(source, parser).keys()]) {
+    const name = family.toLowerCase();
+    if (!known.has(name)) {
+      candidates.push({family: name, properties: {}, runs: []});
+      known.add(name);
+    }
+  }
+  const used = new Set(fontRuns(root, {settings, css, faces: candidates}).map(face => face.family));
+  const checked = new Set(), Font = root.ownerDocument?.defaultView?.FontFace || globalThis.FontFace;
+  for (const family of used) {
+    const assets = index.assets.filter(asset => asset.family.toLowerCase() === family);
+    if (!assets.length) {
+      const factory = family === 'geist' || family === 'geist mono';
+      const declared = Object.entries(index.references).some(([label, definition]) => {
+        if (!label.startsWith('FONT:')) return false;
+        if (label === 'FONT:' + family.toUpperCase() || label.startsWith('FONT:' + family.toUpperCase() + '/')) return true;
+        try { return normalizeFontFamily(JSON.parse(definition.title).family)?.toLowerCase() === family; }
+        catch (_) { return false; }
+      });
+      if (!factory || declared)
+        throw Object.assign(new Error('The selected font is not embedded: ' + family), {code: 'export_font_unavailable'});
+      continue;
+    }
+    for (const asset of assets) {
+      if (checked.has(asset.url)) continue;
+      const bytes = Uint8Array.from(atob(asset.data), character => character.charCodeAt(0));
+      if (typeof validateFont !== 'function')
+        throw Object.assign(new Error('Embedded font validation is unavailable: ' + asset.family), {code: 'export_font_unavailable'});
+      if (await validateFont(bytes, {family: asset.family, format: asset.format}) !== true)
+        throw Object.assign(new Error('The embedded font is invalid: ' + asset.family), {code: 'export_font_invalid'});
+      // The host validates the font; the viewing engine must also accept this exact container.
+      // Loading an uninstalled face checks bytes without changing this document's font set.
+      if (typeof Font === 'function') try { await new Font('rapier-export-validation', bytes).load(); }
+      catch (cause) { throw Object.assign(new Error('The embedded font could not be loaded: ' + asset.family, {cause}), {code: 'export_font_invalid'}); }
+      checked.add(asset.url);
+    }
+  }
+}
+
+export function fontRequests(root, options = {}) {
+  return fontRuns(root, options).map(record => ({family: unquote(record.properties['font-family']),
+    style: record.properties['font-style'] || 'normal', weight: record.properties['font-weight'] || '400',
+    stretch: record.properties['font-stretch'] || '100%'}));
+}
+
+// This self-contained readiness step also runs in the isolated server print document.
+export async function waitForFontRequests(doc, requests) {
+  if (!requests?.length) return;
+  const family = value => String(value).trim().replace(/^(['"])([\s\S]*)\1$/, '$2').replace(/\\(?:([\da-f]{1,6})\s?|([^\r\n\f]))/gi,
+    (_, hex, character) => hex ? String.fromCodePoint(Math.max(1, Math.min(0x10ffff, parseInt(hex, 16)))) : character).toLowerCase();
+  const weight = value => String(value || '400').trim().replace(/\s+/g, ' ').replace(/^normal$/, '400').replace(/^bold$/, '700');
+  const stretch = value => String(value || '100%').trim().replace(/\s+/g, ' ').replace(/^normal$/, '100%');
+  for (const request of requests) {
+    const faces = Array.from(doc.fonts || []).filter(face => family(face.family) === request.family.toLowerCase() &&
+      face.style === request.style && weight(face.weight) === weight(request.weight) && stretch(face.stretch) === stretch(request.stretch));
+    try {
+      if (!faces.length) throw new Error('The font is missing from the print page.');
+      await Promise.all(faces.map(face => face.load()));
+    } catch (cause) { throw Object.assign(new Error('The embedded font could not be loaded: ' + request.family, {cause}), {code: 'export_font_unavailable'}); }
+  }
+}
+
+// CSS font loading can finish successfully while a required face is in the error state.
+// Load the exact embedded bytes before print takes its immutable page, and leave unrelated
+// local fallbacks and unused family styles outside this document's readiness decision.
+export async function waitForFonts(root, {settings, css = '', fontCss = '', install = true} = {}) {
+  const required = fontRuns(root, {settings, css, fontCss});
+  if (!required.length) return () => {};
+  const doc = root.ownerDocument, Font = doc?.defaultView?.FontFace || globalThis.FontFace;
+  if (typeof Font !== 'function' || !doc?.fonts)
+    throw Object.assign(new Error('Embedded document fonts cannot be loaded for printing.'), {code: 'export_font_unavailable'});
+  const loaded = await Promise.all(required.map(async record => {
+    const family = unquote(record.properties['font-family']);
+    const descriptor = {};
+    for (const [css, name] of [['font-style', 'style'], ['font-weight', 'weight'], ['font-stretch', 'stretch'], ['unicode-range', 'unicodeRange']])
+      if (record.properties[css]) descriptor[name] = record.properties[css];
+    const bytes = Uint8Array.from(atob(record.source.slice(record.source.indexOf(',') + 1)), character => character.charCodeAt(0));
+    try { return await new Font(record.properties['font-family'], bytes, descriptor).load(); }
+    catch (cause) { throw Object.assign(new Error('The embedded font could not be loaded: ' + family, {cause}), {code: 'export_font_unavailable'}); }
+  }));
+  if (install) for (const face of loaded) doc.fonts.add(face);
+  return () => { if (install) for (const face of loaded) doc.fonts.delete(face); };
+}

package/dist/kit/ledger/data.mjs

@@ -27,7 +27,7 @@ export function exactKeys(value, keys) {
 }
 export function documentText(text) {
   if (typeof text !== 'string' || /[\uD800-\uDFFF]/u.test(text)) throw fault('document is not whole-character text');
-  if (new TextEncoder().encode(text).length > 25 * 1024 * 1024) throw fault('document exceeds the editor text limit');
+  if (new TextEncoder().encode(text).length > 64 * 1024 * 1024) throw fault('document exceeds the editor text limit');
   return text;
 }
 export const nonnegative = value => Number.isSafeInteger(value) && value >= 0 && !Object.is(value, -0);

package/dist/kit/ledger/format.mjs

@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: MIT
-import {_rapierValidLedgerRecord, _rapierRecordSplices, _rapierTransformSplices, _rapierRecordMetadata, _rapierValidMetadata, _rapierTransformMetadata, _rapierReplayMetadata} from './journal-records.mjs';
+import {_rapierValidLedgerRecord, _rapierRecordSplices, _rapierTransformSplices, _rapierRecordMetadata, _rapierValidMetadata, _rapierTransformMetadata, _rapierReplayMetadata, _rapierHistoryEffects} from './journal-records.mjs';
+import {pictureHistorySplices} from './history.mjs';
 import {authoredHistory} from './transport.mjs';
 import {textRoot, rootAfter, sha256} from './hash.mjs';
 import {canonicalJSON, plainData, documentText, exactKeys, nonnegative, fault} from './data.mjs';
@@ -21,7 +22,7 @@ export function readLedger(input, expectedText, expectedMetadata) {
   const earlier = [];
   for (const record of ledger.records) {
     if (!Array.isArray(record.splices) || !_rapierValidLedgerRecord(record, earlier.at(-1) || null, earlier,
-        ledger.documentAuthority, 25 * 1024 * 1024, text => new TextEncoder().encode(text).length, !ledger.complete) ||
+        ledger.documentAuthority, 64 * 1024 * 1024, text => new TextEncoder().encode(text).length, !ledger.complete) ||
         record.transaction.baseRevision < revision || (record.transaction.baseRevision !== revision && ledger.complete) ||
         (record.transaction.baseRevision === revision && record.beforeHash !== root)) throw fault('record chain differs');
     // A pruned cancelling pair leaves a stated revision gap, just as in the editor's restore reader.
@@ -77,8 +78,10 @@ export function exportLedger({text, metadata, records, documentAuthority, revisi
 // Derived navigation, never a second history. A target older than start is intentionally unavailable.
 export function historyEnvelope(input, segmentIdentity = []) {
   const {ledger, text, metadata} = readLedger(input), ids = new Set(ledger.records.map(row => row.transaction.id));
+  const pictures = _rapierHistoryEffects(ledger.records).pictures;
   let branch = [], cursor = 0;
   for (const {transaction: tx} of ledger.records) {
+    if (pictures.has(tx.id)) continue;
     const target = tx.reverts || tx.reapplies;
     if (target) {
       if (!ids.has(target)) continue;
@@ -88,15 +91,19 @@ export function historyEnvelope(input, segmentIdentity = []) {
     } else { branch = branch.slice(0, cursor); branch.push(tx.id); cursor = branch.length; }
   }
   const byId = new Map(ledger.records.map(row => [row.transaction.id, row]));
+  const step = (source, id, redo) => {
+    const target = byId.get(id), folded = pictureHistorySplices({source, records: ledger.records}, target, redo);
+    return _rapierTransformSplices(source, folded || target.splices, !folded && !redo);
+  };
   let traversed = text, traversedMetadata = {...metadata};
   for (let i = cursor - 1; i >= 0; i--) {
-    traversed = _rapierTransformSplices(traversed, byId.get(branch[i]).splices, true);
+    traversed = step(traversed, branch[i], false);
     traversedMetadata = _rapierTransformMetadata(traversedMetadata, byId.get(branch[i]).metadata, true);
     if (traversed === null || !traversedMetadata) throw fault('undo branch does not reverse');
   }
   traversed = text; traversedMetadata = {...metadata};
   for (let i = cursor; i < branch.length; i++) {
-    traversed = _rapierTransformSplices(traversed, byId.get(branch[i]).splices);
+    traversed = step(traversed, branch[i], true);
     traversedMetadata = _rapierTransformMetadata(traversedMetadata, byId.get(branch[i]).metadata);
     if (traversed === null || !traversedMetadata) throw fault('redo branch does not replay');
   }
@@ -105,7 +112,7 @@ export function historyEnvelope(input, segmentIdentity = []) {
     let active = ledger.start.text, activeMetadata = {...ledger.start.metadata};
     if (!cursor && (active !== text || canonicalJSON(activeMetadata) !== canonicalJSON(metadata))) throw fault('complete history start differs');
     for (let i = 0; i < branch.length; i++) {
-      active = _rapierTransformSplices(active, byId.get(branch[i]).splices);
+      active = step(active, branch[i], true);
       activeMetadata = _rapierTransformMetadata(activeMetadata, byId.get(branch[i]).metadata);
       if (active === null || !activeMetadata || (i + 1 === cursor && (active !== text || canonicalJSON(activeMetadata) !== canonicalJSON(metadata)))) throw fault('complete branch differs');
     }