rapier-markdown-kit 1.2.32 → 1.2.40

package/dist/agent/vendor/pretext/rich-inline.js

@@ -1,9 +1,10 @@
-/*! Pretext Unreleased (bac1774c0) | MIT; BSD/Unicode/ICU notices in LICENSE | Copyright (c) 2026 Pretext contributors */
+/*! Pretext 1.0.0 + main (0d102a5cd) | MIT; BSD/Unicode/ICU notices in LICENSE | Copyright (c) 2026 Pretext contributors */
                                                               
 import {
   alignToSource,
   analyzeText,
   isCollapsibleSpaceCode,
+  DROPPED,
   HARD_BREAK,
   KIND_BITS,
   OBJECT,
@@ -20,7 +21,6 @@ import {
                       
                       
 } from './analysis.js'
-import { getSegmentEntryWidth,                           } from './entry-geometry.js'
 import { buildLineTextFromRange, buildRangeText, getGraphemeEnds,                       } from './line-text.js'
 import {
   getItemTabAdvance,
@@ -166,7 +166,8 @@ const PRESERVED_WHITE_SPACE = 1 << PRESERVED_SPACE | 1 << TAB
                                                                                                   
                                                                                                
                                                                                                
-                                                                                         
+                                                                                           
+                                                                                
                                
                              
                                          
@@ -300,8 +301,6 @@ export function prepareRichInline(items                                       ,
   // Firefox 156 and Safari 27 prepare CJK styled paragraphs again up to 8% faster with the lists
   // made whole than with each filled by a call and a push a segment (RESEARCH.md, Keeping Work
   // Bounded, JavaScript Engines, under A paragraph's sparse lists made whole).
-  let entryGeometry                                         = null
-  let lineStartProhibitions                               = null
   let breakableLineStartExtras                             = null
   let lineStartExtras                  = null
   let lineEndTrims                  = null
@@ -531,8 +530,6 @@ export function prepareRichInline(items                                       ,
       }
       const units = getSourceUnits(offsets, normalizedStart, textEnd, starts[index] )
       if (units !== null) (sourceUnits ??= new Array                 (flags.length).fill(null))[at] = units
-      if (sub.entryGeometry !== null && sub.entryGeometry[s] !== null) (entryGeometry ??= new Array                             (flags.length).fill(null))[at] = sub.entryGeometry[s] 
-      if (sub.lineStartProhibitions !== null && sub.lineStartProhibitions[s] !== null) (lineStartProhibitions ??= new Array                   (flags.length).fill(null))[at] = sub.lineStartProhibitions[s] 
       if (sub.breakableLineStartExtras !== null && sub.breakableLineStartExtras[s] !== null) (breakableLineStartExtras ??= new Array                 (flags.length).fill(null))[at] = sub.breakableLineStartExtras[s] 
       const startExtra = (sub.lineStartExtras === null ? 0 : sub.lineStartExtras[s] ) + (i > first ? extraWidth : 0)
       if (startExtra !== 0) (lineStartExtras ??= zeroList(flags.length))[at] = startExtra
@@ -621,7 +618,7 @@ export function prepareRichInline(items                                       ,
     itemEndHalts,
     hyphenRooms: discretionaryHyphenContexts !== null && profile.unfitHyphenRetreat === 'reduced-width' ? getHyphenRooms(hyphenWidths, itemSegments, segmentItems) : null,
     insideExtras, fillExtras, openingEdges,
-    emptyObjectSpaces: null, emptyObjectReturns: null,
+    emptyObjectSpaces: null, emptyObjectReturns: null, hangEnds: null,
   }
   // The properties measureAnalysis() gives a text's handle, in its order, then the paragraph's own.
   const data = {
@@ -630,11 +627,9 @@ export function prepareRichInline(items                                       ,
     simpleLineWalkFastPath: simple,
     simpleLineCountFastPath: false,
     breakableFitAdvances,
-    entryGeometry,
     letterSpacing: spacingsDiffer || sharedSpacing === null ? 0 : sharedSpacing,
     discretionaryHyphenWidth: firstTextItem < 0 ? 0 : hyphenWidths[firstTextItem] ,
     discretionaryHyphenContexts,
-    lineStartProhibitions,
     breakableLineStartExtras,
     lineStartExtras,
     lineEndTrims,
@@ -645,6 +640,15 @@ export function prepareRichInline(items                                       ,
   }                                               
   data.segments = segments
   if (hasEmptyObject && profile.emptyAtomicAlwaysFits) setEmptyObjectFacts(segmentData, data, items, itemSegments, segmentItems, source, starts)
+  // Each item is a text frame: a zero-width space after preserved spaces of its own item ends
+  // the run of them that hangs (ParagraphSegmentData, hangEnds).
+  if (preserve && profile.hangsSpacesPerTextFrame && source.includes('\u200B')) {
+    for (let i = 1; i < segmentCount; i++) {
+      if ((segmentFlags[i]  & (KIND_BITS | DROPPED)) === ZERO_WIDTH_BREAK && (segmentFlags[i - 1]  & KIND_BITS) === PRESERVED_SPACE && segmentItems[i] === segmentItems[i - 1]) {
+        ;(segmentData.hangEnds ??= new Uint8Array(segmentCount))[i] = 1
+      }
+    }
+  }
 
   let onlyItem = -1
   for (let index = 0; index < items.length && !paddedOrObject; index++) {
@@ -894,19 +898,13 @@ function getOpeningFit(flags          , from        , to        , extraWidth
 // (`startsLine`), the first of them adds what a line that starts with it does
 // (breakableLineStartExtras), as the walker's line does.
 function getPartWidth(data                  , i        , from        , to        , startsLine         )         {
-  const { breakableFitAdvances, breakableLineStartExtras, entryGeometry, letterSpacing, items } = data
+  const { breakableFitAdvances, breakableLineStartExtras, letterSpacing, items } = data
   const advances = breakableFitAdvances[i] 
   if (to < 0) to = advances.length
-  const entry = from > 0 && entryGeometry !== null ? entryGeometry[i]  : null
-  const entryWidth = entry === null ? null : getSegmentEntryWidth(entry, from, to)
   let w = 0
-  if (entryWidth !== null) {
-    w = entryWidth
-  } else {
-    for (let g = from; g < to; g++) w += advances[g]  + letterSpacing
-    const startExtras = startsLine && breakableLineStartExtras !== null ? breakableLineStartExtras[i]  : null
-    if (startExtras !== null) w += startExtras[from] 
-  }
+  for (let g = from; g < to; g++) w += advances[g]  + letterSpacing
+  const startExtras = startsLine && breakableLineStartExtras !== null ? breakableLineStartExtras[i]  : null
+  if (startExtras !== null) w += startExtras[from] 
   if (items !== undefined && (from > 0 ? items.insideExtras !== null : items.fillExtras !== null)) w += from > 0 ? items.insideExtras [i]  : items.fillExtras [i] 
   return w
 }
@@ -928,7 +926,7 @@ function createOnlyItemLine(
   endGraphemeIndex        ,
 )                      {
   const { onlyItem } = flow
-  const ended = endSegmentIndex >= flow.data.segmentFlags.length
+  const ended = endSegmentIndex >= flow.data.widths.length
   return {
     fragments: [{
       itemIndex: onlyItem,
@@ -974,7 +972,7 @@ function createLine(
   const segmentItems = flow.segmentItems 
   const gapSegments = flow.gapSegments 
   const itemCount = itemSegments.length - 1
-  const endItemIndex = endSegmentIndex >= segmentItems.length ? itemCount : segmentItems[endSegmentIndex] 
+  const endItemIndex = endSegmentIndex >= widths.length ? itemCount : segmentItems[endSegmentIndex] 
   const end                   = { itemIndex: endItemIndex, segmentIndex: endSegmentIndex - itemSegments[endItemIndex] , graphemeIndex: endGraphemeIndex }
   const tabsInAppUnits = getEngineProfile().tabsInAppUnits
   const itemEndHalts = items.itemEndHalts
@@ -1108,7 +1106,7 @@ function createLine(
 // The paragraph's segment a cursor names, or the segment count for one past the last item.
 function getSegmentIndex(flow                            , cursor                  )         {
   const { itemSegments } = flow
-  return cursor.itemIndex < itemSegments.length ? itemSegments[cursor.itemIndex]  + cursor.segmentIndex : flow.data.segmentFlags.length
+  return cursor.itemIndex < itemSegments.length ? itemSegments[cursor.itemIndex]  + cursor.segmentIndex : flow.data.widths.length
 }
 
 export function layoutNextRichInlineLineRange(
@@ -1142,9 +1140,26 @@ function getSourceUnits(offsets            , from        , to        , itemStart
   return units
 }
 
+// Per frozen handle of a paragraph that is one text's handle, the three lists of where its
+// segments are in the item's text (InternalPreparedRichInline), found when a line of it is
+// first materialized. A handle keeps them itself; a frozen one can't take them, so they are
+// kept beside it, as its segments' grapheme ends are (getGraphemeEnds): no line function writes
+// to a frozen handle or to anything it holds, so one the app froze, or a copy of one in a store
+// that freezes its state, materializes as any other. Kept beside every handle, the lookup took
+// a pass that walks and materializes 3,000 of the chat demo's one-item paragraphs, each asked
+// once, 35-47% longer with the handles out of the processor's caches and 7-25% with them in,
+// and 40 of them over and over 1-9% (JavaScriptCore of bun 1.4.2, V8 15.4 and node 23.10's,
+// SpiderMonkey 156, one build a process on the harness's stand-in Canvas, 2026-10-12). Found
+// while preparing, the lists took such paragraphs 6-13% longer to prepare and count once in
+// JavaScriptCore and 12-20% in V8, text seen before, and a third more heap a handle, for lines
+// a long list mostly never paints; found again at every line, walking and materializing took
+// 5-9 times as long, and over 100 times in a paragraph of 6,000 units.
+                                                                                                     
+const textSources = new WeakMap                                         ()
+
 // Per segment of a paragraph that is one text's handle, where its text starts and ends in the
 // item's.
-function findSegmentSources(flow                            )       {
+function findSegmentSources(flow                            )              {
   const { segments } = flow.data
   const offsets = alignToSource(flow.text, segments.join(''), getEngineProfile().lineBreakScan)
   const sourceStarts           = []
@@ -1156,15 +1171,21 @@ function findSegmentSources(flow                            )       {
     sourceEnds.push(flow.text.charCodeAt(end - 1) === 0x0D && flow.text.charCodeAt(end) === 0x0A && segments[i] === '\n' ? end + 1 : end)
     sourceUnits.push(getSourceUnits(offsets, at, at + segments[i] .length, 0))
   }
-  flow.sourceStarts = sourceStarts
-  flow.sourceEnds = sourceEnds
-  flow.sourceUnits = sourceUnits
+  const sources = { sourceStarts, sourceEnds, sourceUnits }
+  if (Object.isFrozen(flow)) {
+    textSources.set(flow, sources)
+  } else {
+    flow.sourceStarts = sourceStarts
+    flow.sourceEnds = sourceEnds
+    flow.sourceUnits = sourceUnits
+  }
+  return sources
 }
 
 // Where unit `unit` of a segment's text is in its item's text.
-function getSourceOffset(flow                            , segmentIndex        , unit        )         {
-  const units = flow.sourceUnits === null ? null : flow.sourceUnits[segmentIndex] 
-  return units === null ? flow.sourceStarts [segmentIndex]  + unit : units[unit] 
+function getSourceOffset(sourceStarts          , sourceUnits                            , segmentIndex        , unit        )         {
+  const units = sourceUnits === null ? null : sourceUnits[segmentIndex] 
+  return units === null ? sourceStarts[segmentIndex]  + unit : units[unit] 
 }
 
 // Bridge from cheap range walking to full fragment text. Lets callers do
@@ -1176,9 +1197,8 @@ export function materializeRichInlineLineRange(
 )                 {
   const flow = getInternalPreparedRichInline(prepared)
   const { data, itemSegments } = flow
-  if (flow.sourceStarts === null) findSegmentSources(flow)
-  const sourceStarts = flow.sourceStarts 
-  const sourceEnds = flow.sourceEnds 
+  let { sourceStarts, sourceEnds, sourceUnits } = flow
+  if (sourceStarts === null) ({ sourceStarts, sourceEnds, sourceUnits } = textSources.get(flow) ?? findSegmentSources(flow))
   const lineEndSegmentIndex = getSegmentIndex(flow, line.end)
   const fragments                               = []
 
@@ -1194,11 +1214,11 @@ export function materializeRichInlineLineRange(
     const endGraphemeIndex = endSegmentIndex < itemEnd ? fragment.end.graphemeIndex : 0
     // Only the fragment a line ends with shows the hyphen of a soft hyphen it ends at.
     const endsLine = i === line.fragments.length - 1 && endSegmentIndex === lineEndSegmentIndex && endGraphemeIndex === line.end.graphemeIndex
-    let sourceStart = startSegmentIndex < itemEnd ? sourceStarts[startSegmentIndex]  : startSegmentIndex > first ? sourceEnds[startSegmentIndex - 1]  : 0
-    if (startGraphemeIndex > 0 && startSegmentIndex < itemEnd) sourceStart = getSourceOffset(flow, startSegmentIndex, getGraphemeEnds(data, startSegmentIndex)[startGraphemeIndex - 1] )
+    let sourceStart = startSegmentIndex < itemEnd ? sourceStarts[startSegmentIndex]  : startSegmentIndex > first ? sourceEnds [startSegmentIndex - 1]  : 0
+    if (startGraphemeIndex > 0 && startSegmentIndex < itemEnd) sourceStart = getSourceOffset(sourceStarts, sourceUnits, startSegmentIndex, getGraphemeEnds(data, startSegmentIndex)[startGraphemeIndex - 1] )
     let sourceEnd = sourceStart
-    if (endGraphemeIndex > 0) sourceEnd = getSourceOffset(flow, endSegmentIndex, getGraphemeEnds(data, endSegmentIndex)[endGraphemeIndex - 1]  - 1) + 1
-    else if (endSegmentIndex > startSegmentIndex) sourceEnd = sourceEnds[endSegmentIndex - 1] 
+    if (endGraphemeIndex > 0) sourceEnd = getSourceOffset(sourceStarts, sourceUnits, endSegmentIndex, getGraphemeEnds(data, endSegmentIndex)[endGraphemeIndex - 1]  - 1) + 1
+    else if (endSegmentIndex > startSegmentIndex) sourceEnd = sourceEnds [endSegmentIndex - 1] 
     fragments.push({
       itemIndex: fragment.itemIndex,
       text: endsLine ? buildLineTextFromRange(data, startSegmentIndex, startGraphemeIndex, endSegmentIndex, endGraphemeIndex)

package/dist/agent/will.mjs

@@ -162,5 +162,78 @@ function _rapierWillStripOneTerminator(text) {
 		text.charCodeAt(end - 1), end >= 2 ? text.charCodeAt(end - 2) : -1)) : text;
 }
 
+export function willOffsetBefore(rows, offset) {
+	for (let index = rows.length - 1; index >= 0 && offset >= 0; index--) {
+		const {pos, removed, inserted} = rows[index];
+		if (offset >= pos) offset = offset >= pos + inserted.length ? offset - inserted.length + removed.length : -1;
+	}
+	return offset;
+}
+
+function _rapierWillRestores(restores, region, splices, text) {
+	if (!Array.isArray(restores) || region.law !== 'append') return null;
+	const reaching = splices.filter(row => row.pos <= region.end && row.pos + row.removed.length >= region.start &&
+		(row.removed || row.inserted)).toSorted((a, b) => a.pos - b.pos);
+	if (!reaching.length || reaching.some((row, index) => row.pos < region.start || row.pos + row.removed.length > region.end ||
+		(index && row.pos !== reaching[index - 1].pos + reaching[index - 1].removed.length) || !restores.includes(row)) ||
+		!/^(?:\r\n|\r|\n)?$/.test(text.slice(reaching.at(-1).pos + reaching.at(-1).removed.length - region.start))) return null;
+	return reaching;
+}
+
+export function willTransition(beforeText, afterText, splices, markerSplices = splices, {restores = null, restored = null} = {}) {
+	const before = _rapierWillParse(beforeText), after = _rapierWillParse(afterText);
+	if (!before.present && !after.present) return null;
+	const bounds = region => ({start: region.start, end: region.end});
+	const faults = will => will.faults.slice(0, 4).map(({mode, line}) => ({mode, line}));
+	if (before.faults.length) return {law: 'keep', rule: 'before_faulted', faults: faults(before), start: 0, end: beforeText.length};
+	for (const region of before.regions) {
+		const markers = [[region.openerStart, region.openerEnd], [region.closerStart, region.closerEnd]];
+		for (let index = 0; index < splices.length; index++) {
+			const row = splices[index], end = row.pos + row.removed.length;
+			for (const marker of markers) {
+				if (row.removed.length ? row.pos < marker[1] && marker[0] < end : row.pos > marker[0] && row.pos < marker[1])
+					return {law: region.law, rule: 'marker_span_touched', editIndex: index, region: region.index, ...bounds(region)};
+				if (end <= marker[0]) { const shift = row.inserted.length - row.removed.length; marker[0] += shift; marker[1] += shift; }
+			}
+		}
+	}
+	if (after.faults.length) return {law: 'keep', rule: 'result_faulted', faults: faults(after), start: 0, end: beforeText.length};
+	if (before.markers.length !== after.markers.length || before.markers.some((marker, index) => {
+		const next = after.markers[index];
+		return marker.kind !== next.kind || beforeText.slice(marker.start, marker.end) !== afterText.slice(next.start, next.end) ||
+			willOffsetBefore(markerSplices, next.start) !== marker.start || willOffsetBefore(markerSplices, next.end - 1) !== marker.end - 1;
+	})) return {law: 'keep', rule: 'marker_sequence_mismatch', start: 0, end: beforeText.length};
+	for (const region of before.regions) {
+		const was = beforeText.slice(region.start, region.end), next = after.regions[region.index], now = afterText.slice(next.start, next.end);
+		if (region.law === 'keep' && was !== now)
+			return {law: region.law, rule: 'law_violated', region: region.index, ...bounds(region)};
+		if (region.law !== 'append' || _rapierWillStripOneTerminator(now).startsWith(_rapierWillStripOneTerminator(was))) continue;
+		const reaching = _rapierWillRestores(restores, region, splices, was);
+		if (!reaching) return {law: region.law, rule: 'law_violated', region: region.index, ...bounds(region)};
+		restored?.set(region.index, reaching);
+	}
+	return null;
+}
+
+export function evaluateWill(beforeText, splices) {
+	const invalid = rule => ({outcome: 'invalid', reason: 'precondition', rule});
+	if (typeof beforeText !== 'string' || !beforeText.isWellFormed()) return invalid('invalid_unicode');
+	if (!Array.isArray(splices)) return invalid('malformed_splice');
+	const boundary = (text, at) => !(at > 0 && at < text.length &&
+		(text.charCodeAt(at - 1) & 0xfc00) === 0xd800 && (text.charCodeAt(at) & 0xfc00) === 0xdc00);
+	let afterText = beforeText;
+	for (const row of splices) {
+		if (!row || !Number.isSafeInteger(row.pos) || row.pos < 0 || Object.is(row.pos, -0) ||
+			typeof row.removed !== 'string' || typeof row.inserted !== 'string' ||
+			!row.removed.isWellFormed() || !row.inserted.isWellFormed()) return invalid('malformed_splice');
+		const end = row.pos + row.removed.length;
+		if (end > afterText.length || !boundary(afterText, row.pos) || !boundary(afterText, end)) return invalid('out_of_range_splice');
+		if (afterText.slice(row.pos, end) !== row.removed) return invalid('source_mismatch');
+		afterText = afterText.slice(0, row.pos) + row.inserted + afterText.slice(end);
+	}
+	const refusal = splices.length && willTransition(beforeText, afterText, splices);
+	return refusal ? {outcome: 'refused', reason: 'document_law', ...refusal} : {outcome: 'applied'};
+}
+
 
 export { hasWillMarkers, _rapierWillParse as parseWill, _rapierWillMarkerOf as willMarkerOf, _rapierWillRegionsIn as willRegionsIn, _rapierWillTouchesMarker as willTouchesMarker, _rapierWillGovern as willGovern, _rapierWillIntentOf as willIntentOf, _rapierWillStripOneTerminator as stripOneTerminator, _rapierWillTerminatorWidth as terminatorWidth };

package/dist/kit/ledger/data.mjs

@@ -17,7 +17,7 @@ export function fields(value, depth, active, sorted = true) {
 }
 export function scalar(value) {
   if (value === null || typeof value === 'boolean') return true;
-  if (typeof value === 'string') { if (/[\uD800-\uDFFF]/u.test(value)) throw fault('unpaired surrogate'); return true; }
+  if (typeof value === 'string') { if (!value.isWellFormed()) throw fault('unpaired surrogate'); return true; }
   return typeof value === 'number' && Number.isFinite(value) && !Object.is(value, -0);
 }
 export function plainData(value) {
@@ -39,7 +39,7 @@ function* quoted(text, whole = true) {
     let end = Math.min(text.length, at + 16384);
     if (end < text.length && (text.charCodeAt(end - 1) & 0xfc00) === 0xd800 && (text.charCodeAt(end) & 0xfc00) === 0xdc00) end--;
     const part = text.slice(at, end);
-    if (whole && /[\uD800-\uDFFF]/u.test(part)) throw fault('unpaired surrogate');
+    if (whole && !part.isWellFormed()) throw fault('unpaired surrogate');
     yield JSON.stringify(part).slice(1, -1); at = end;
   }
   yield '"';

package/dist/kit/ledger/format.mjs

@@ -3,10 +3,12 @@ import {_rapierPrepareHistoryRecords, _rapierValidMetadata, _rapierTransformMeta
 import {pictureHistorySplices} from './history.mjs';
 import {HistorySource} from './source.mjs';
 import {authoredHistory} from './transport.mjs';
-import {textRoot, rootAfter, sha256, sha256Parts, createSHA256} from './hash.mjs';
+import {textRoot, rootAfter, sha256, sha256PartsAsync, createSHA256} from './hash.mjs';
 import {canonicalJSON, canonicalParts, plainData, documentText, utf8Length, exactKeys, nonnegative, fault} from './data.mjs';
+import {diff} from '../../packages/rapier-diff/diff.mjs';
+import {minimalHistorySplice} from './inverse-source.mjs';
+import {evaluateWill} from '../../agent/will.mjs';
 export {textRoot, rootAfter};
-const digest = value => sha256Parts(canonicalParts(value));
 const rootShape = value => typeof value === 'string' && /^\d+:[a-z0-9]+:[a-z0-9]+$/.test(value);
 function* checkedRecords(ledger, prepared) {
   if (!prepared.ok || ledger.records.length !== prepared.records.length) throw fault('record chain differs');
@@ -26,42 +28,61 @@ function* checkedRecords(ledger, prepared) {
   if (ledger.head.revision !== revision || ledger.head.root !== root) throw fault('history does not describe this document');
 }
 const proofs = new WeakMap();
-function readLedgerState(input, expectedText, expectedMetadata) {
-  const ledger = plainData(input);
+function copiedLedger(input, proof) {
+  if (!proof || !input || typeof input !== 'object') return plainData(input);
+  const fields = Object.getOwnPropertyDescriptors(input), start = fields.start;
+  if (!start || !Object.hasOwn(start, 'value') || !start.value || typeof start.value !== 'object') return plainData(input);
+  const parts = Object.getOwnPropertyDescriptors(start.value), text = parts.text;
+  if (!text || !Object.hasOwn(text, 'value') || text.value !== proof.startText) return plainData(input);
+  const shell = Object.create(Object.getPrototypeOf(input), {...fields, start: {...start,
+    value: Object.create(Object.getPrototypeOf(start.value), {...parts, text: {...text, value: ''}})}});
+  const ledger = plainData(shell);
+  ledger.start.text = proof.startText;
+  return ledger;
+}
+function ledgerAdmission(input) {
+  const held = input && typeof input === 'object' ? proofs.get(input) : undefined;
+  const ledger = copiedLedger(input, held);
   if (!exactKeys(ledger, ['format','documentAuthority','start','records','head','complete','sha256']) || ledger.format !== 'rapier-ledger/2' ||
       typeof ledger.documentAuthority !== 'string' || !ledger.documentAuthority || ledger.documentAuthority.length > 256 ||
       typeof ledger.complete !== 'boolean' || !Array.isArray(ledger.records) ||
       !exactKeys(ledger.start, ['text','revision','root','sha256','metadata']) || !exactKeys(ledger.head, ['revision','root','sha256','metadata'])) throw fault('unsupported or invalid envelope');
   const shell = canonicalJSON({...ledger, start: {...ledger.start, text: ''}});
-  let proof = typeof input === 'object' ? proofs.get(input) : undefined;
-  if (!proof || proof.shell !== shell || proof.startText !== ledger.start.text) {
-    proof = {shell, startText: ledger.start.text, ...proveLedger(ledger)};
-    if (typeof input === 'object') proofs.set(input, proof);
-  }
+  const proof = held?.shell === shell && held.startText === ledger.start.text ? held : null;
+  return {ledger, shell, proof};
+}
+function ledgerResult(ledger, proof, expectedText, expectedMetadata) {
   proofs.set(ledger, proof);
   const {text, metadata, root, revision, prepared, source} = proof;
   if (expectedMetadata !== undefined && (!_rapierValidMetadata(expectedMetadata) || canonicalJSON(metadata) !== canonicalJSON(expectedMetadata)))
     throw fault('metadata does not describe this document');
   if (expectedText !== undefined && text !== expectedText) throw fault('history does not describe this document');
-  return {value: {ledger, text, metadata: {...metadata}, root, revision, complete: ledger.complete}, prepared, source};
+  return {value: {ledger, text, metadata: {...metadata}, root, revision, complete: ledger.complete}, prepared, source, proof};
 }
-function proveLedger(ledger) {
+function readLedgerState(input, expectedText, expectedMetadata) {
+  const {ledger, shell, proof: held} = ledgerAdmission(input);
+  const proof = held || {shell, startText: ledger.start.text, ...finish(proveLedger(ledger))};
+  if (typeof input === 'object') proofs.set(input, proof);
+  return ledgerResult(ledger, proof, expectedText, expectedMetadata);
+}
+function* proveLedger(ledger, native = false) {
   const {sha256: claimed, ...payload} = ledger;
-  if (claimed !== digest(payload)) throw fault('envelope checksum differs');
-  let text = documentText(ledger.start.text), root = ledger.start.root, revision = ledger.start.revision;
+  if (claimed !== (yield* checksum(canonicalParts(payload), native))) throw fault('envelope checksum differs');
+  let text = ledger.start.text, root = ledger.start.root, revision = ledger.start.revision;
+  const startFacts = yield* sourceFacts(text, native);
   if (!_rapierValidMetadata(ledger.start.metadata) || !_rapierValidMetadata(ledger.head.metadata)) throw fault('invalid document metadata');
-  if (!nonnegative(revision) || !rootShape(root) || (revision === 0 && root !== textRoot(text)) || ledger.start.sha256 !== sha256(text) ||
+  if (!nonnegative(revision) || !rootShape(root) || (revision === 0 && root !== startFacts.contentRoot) || ledger.start.sha256 !== startFacts.sha256 ||
       (ledger.complete && revision !== 0)) throw fault('invalid start');
   const prepared = _rapierPrepareHistoryRecords(ledger.records);
   if (!prepared.ok) throw fault('record chain differs');
-  let source = new HistorySource(text), bytes = utf8Length(text);
+  let source = new HistorySource(text), bytes = startFacts.utf8Bytes;
   for (const record of checkedRecords(ledger, prepared)) {
     const next = source.apply(record.splices);
     if (next === null) throw fault('splice does not replay');
     source = next;
     for (const row of record.splices) bytes += utf8Length(row.inserted) - utf8Length(row.removed);
     if (bytes > 64 * 1024 * 1024) throw fault('document exceeds the editor text limit');
-    root = record.afterHash; revision = record.transaction.revision;
+    root = record.afterHash; revision = record.transaction.revision; yield;
   }
   text = source.slice();
   if (ledger.records.some(row => Object.hasOwn(row, 'authored'))) {
@@ -69,7 +90,8 @@ function proveLedger(ledger) {
   }
   const metadata = prepared.replayMetadata(ledger.start.metadata);
   if (!metadata || canonicalJSON(metadata) !== canonicalJSON(ledger.head.metadata)) throw fault('metadata does not describe this document');
-  if (ledger.head.revision !== revision || ledger.head.root !== root || ledger.head.sha256 !== sha256(text)) throw fault('history does not describe this document');
+  const headFacts = ledger.records.every(row => !row.splices.length) ? startFacts : yield* sourceFacts(text, native);
+  if (ledger.head.revision !== revision || ledger.head.root !== root || ledger.head.sha256 !== headFacts.sha256) throw fault('history does not describe this document');
   return {text, metadata, root, revision, prepared, source};
 }
 export function ledgerWithStart(input, text) {
@@ -83,14 +105,25 @@ export function ledgerWithStart(input, text) {
 export function readLedger(input, expectedText, expectedMetadata) {
   return readLedgerState(input, expectedText, expectedMetadata).value;
 }
-function* checksum(parts) {
+export async function readLedgerAsync(input, expectedText, expectedMetadata, options = {}) {
+  options.signal?.throwIfAborted();
+  const {ledger, shell, proof: held} = ledgerAdmission(input);
+  const metadata = expectedMetadata === undefined ? undefined : plainData(expectedMetadata);
+  const proof = held || {shell, startText: ledger.start.text,
+    ...await finishAsync(proveLedger(ledger, !!globalThis.crypto?.subtle), options)};
+  options.signal?.throwIfAborted();
+  if (typeof input === 'object') proofs.set(input, proof);
+  return ledgerResult(ledger, proof, expectedText, metadata).value;
+}
+function* checksum(parts, native = false) {
+  if (native) return yield {parts};
   const hash = createSHA256();
   for (const part of parts) { hash.update(part); yield; }
   return hash.digest();
 }
-function* sourceFacts(text) {
+function* sourceFacts(text, native = false) {
   if (typeof text !== 'string') throw fault('document is not whole-character text');
-  const hash = createSHA256();
+  const hash = native ? null : createSHA256();
   let fnv = 0x811c9dc5, a = 1, b = 0, bytes = 0;
   for (let at = 0; at < text.length;) {
     const start = at, end = Math.min(text.length, at + 65536);
@@ -112,18 +145,19 @@ function* sourceFacts(text) {
       a %= 65521; b %= 65521;
     }
     if (bytes > 64 * 1024 * 1024) throw fault('document exceeds the editor text limit');
-    hash.update(text.slice(start, end)); yield;
+    hash?.update(text.slice(start, end)); yield;
   }
-  return {utf8Bytes: bytes, sha256: hash.digest(), contentRoot: text.length + ':' +
+  const digest = hash ? hash.digest() : yield {parts: [text], byteLength: bytes};
+  return {utf8Bytes: bytes, sha256: digest, contentRoot: text.length + ':' +
     (fnv >>> 0).toString(36) + ':' + (((b << 16) | a) >>> 0).toString(36)};
 }
-function* produceLedger({text, metadata, records, documentAuthority, revision, root, complete = false, earlier = records} = {}) {
+function* produceLedger({text, metadata, records, documentAuthority, revision, root, complete = false, earlier = records} = {}, native = false) {
   if (!_rapierValidMetadata(metadata)) throw fault('document metadata required');
   metadata = {...metadata};
   if (!Array.isArray(records) || !Array.isArray(earlier)) throw fault('records required');
   const prepared = _rapierPrepareHistoryRecords(records, earlier);
   if (!prepared.ok) throw fault('navigation target was not retained');
-  const headFacts = yield* sourceFacts(text);
+  const headFacts = yield* sourceFacts(text, native);
   let bytes = headFacts.utf8Bytes;
   const expanded = [];
   for (const {record, splices: rows, metadata: effect} of prepared.rows) {
@@ -153,7 +187,7 @@ function* produceLedger({text, metadata, records, documentAuthority, revision, r
   const startRevision = expanded[0]?.transaction.baseRevision ?? revision, startRoot = expanded[0]?.beforeHash ?? root;
   if (typeof documentAuthority !== 'string' || !documentAuthority || documentAuthority.length > 256) throw fault('unsupported or invalid envelope');
   if (!nonnegative(startRevision) || !rootShape(startRoot)) throw fault('invalid start');
-  const startFacts = unchangedText ? headFacts : yield* sourceFacts(startText);
+  const startFacts = unchangedText ? headFacts : yield* sourceFacts(startText, native);
   if (startRevision === 0 && startRoot !== startFacts.contentRoot) throw fault('invalid start');
   const headSHA = headFacts.sha256, startSHA = startFacts.sha256;
   const payload = {format: 'rapier-ledger/2', documentAuthority,
@@ -165,7 +199,10 @@ function* produceLedger({text, metadata, records, documentAuthority, revision, r
   }
   const replayedMetadata = prepared.replayMetadata(startMetadata);
   if (!replayedMetadata || canonicalJSON(replayedMetadata) !== canonicalJSON(metadata)) throw fault('metadata does not describe this document');
-  const ledger = {...payload, sha256: yield* checksum(canonicalParts(payload))};
+  const ledger = {...payload, sha256: yield* checksum(canonicalParts(payload), native)};
+  proofs.set(ledger, {shell: canonicalJSON({...ledger, start: {...ledger.start, text: ''}}), startText,
+    text, metadata: {...metadata}, root, revision, prepared: _rapierPrepareHistoryRecords(ledger.records),
+    source: new HistorySource(text)});
   return {ledger, contentRoot, utf8Bytes: headBytes};
 }
 function finish(producer) {
@@ -174,13 +211,14 @@ function finish(producer) {
   return step.value;
 }
 export function exportLedger(input) { return finish(produceLedger(input)).ledger; }
-export async function prepareLedgerAsync(input, {yield: yieldWork, signal} = {}) {
-  const producer = produceLedger(input);
-  let step;
+async function finishAsync(producer, {yield: yieldWork, signal} = {}) {
+  let step, digest;
   do {
     signal?.throwIfAborted();
-    step = producer.next();
-    if (!step.done && yieldWork) {
+    step = producer.next(digest); digest = undefined;
+    if (!step.done && step.value) digest = await sha256PartsAsync(step.value.parts,
+      {yield: yieldWork, signal, byteLength: step.value.byteLength});
+    else if (!step.done && yieldWork) {
       const pending = yieldWork();
       if (pending) await pending;
     }
@@ -188,8 +226,10 @@ export async function prepareLedgerAsync(input, {yield: yieldWork, signal} = {})
   signal?.throwIfAborted();
   return step.value;
 }
-export function historyEnvelope(input, segmentIdentity = [], expectedText, expectedMetadata) {
-  const {value: {ledger, text, metadata}, prepared, source} = readLedgerState(input, expectedText, expectedMetadata);
+export function prepareLedgerAsync(input, options = {}) {
+  return finishAsync(produceLedger(input, !!globalThis.crypto?.subtle), options);
+}
+function historyNavigation(ledger, text, metadata, prepared, source) {
   const {byId, effects: {pictures}} = prepared;
   let branch = [], cursor = 0;
   for (const {transaction: tx} of ledger.records) {
@@ -232,8 +272,13 @@ export function historyEnvelope(input, segmentIdentity = [], expectedText, expec
       if (active === null || !activeMetadata || (i + 1 === cursor && (active.length !== text.length || !active.matches(0, text) || canonicalJSON(activeMetadata) !== canonicalJSON(metadata)))) throw fault('complete branch differs');
     }
   }
+  return {branch, cursor};
+}
+export function historyEnvelope(input, segmentIdentity = [], expectedText, expectedMetadata) {
+  const {value: {ledger, text, metadata}, prepared, source, proof} = readLedgerState(input, expectedText, expectedMetadata);
+  const {branch, cursor} = proof.navigation ??= historyNavigation(ledger, text, metadata, prepared, source);
   return {schemaVersion: 5, documentAuthority: ledger.documentAuthority, documentRevision: ledger.head.revision,
-    ledger: ledger.records, branch, cursor, earliestRevision: ledger.start.revision, earliestHash: ledger.start.root,
+    ledger: ledger.records, branch: branch.slice(), cursor, earliestRevision: ledger.start.revision, earliestHash: ledger.start.root,
     sourceRootId: ledger.head.root, earliestMetadata: {...ledger.start.metadata}, documentMetadata: {...metadata}, segmentIdentity, historyComplete: ledger.complete,
     trimReason: ledger.complete ? '' : 'carried_start', trimmedBytes: 0};
 }
@@ -249,15 +294,14 @@ export function agentActorId(door, agent) {
 export function replaceLedgerText(input, text, {actor = {kind: 'system', id: 'rapier'}, operation = 'document.replace', at} = {}) {
   const current = readLedger(input); documentText(text);
   if (current.text === text) return current.ledger;
-  let start = 0, a = current.text.length, b = text.length;
-  while (start < a && start < b && current.text[start] === text[start]) start++;
-  if (start && /[\uDC00-\uDFFF]/.test(current.text[start] || text[start] || '')) start--;
-  while (a > start && b > start && current.text[a - 1] === text[b - 1]) { a--; b--; }
-  if (/[\uDC00-\uDFFF]/.test(current.text[a] || text[b] || '')) { a++; b++; }
-  const splices = [{pos: start, removed: current.text.slice(start, a), inserted: text.slice(start, b)}];
-  const revision = current.revision + 1, root = rootAfter(current.root, splices[0]);
+  const splices = diff(current.text, text, {_unit: 'word'}).edits.map(edit =>
+    minimalHistorySplice(current.text.slice(...edit.before), text.slice(...edit.after), edit.before[0])).reverse();
+  const revision = current.revision + 1, root = splices.reduce(rootAfter, current.root);
+  if (actor.kind === 'agent' && current.metadata.docKind === 'markdown' && evaluateWill(current.text, splices).outcome !== 'applied')
+    throw fault('will_violation');
+  const identity = sha256(canonicalJSON({before: current.ledger.sha256, text, actor, operation, at: at ?? null}));
   const record = {beforeHash: current.root, afterHash: root, splices, transaction: {
-    id: current.ledger.documentAuthority.slice(0, 48) + ':export:' + revision.toString(36),
+    id: current.ledger.documentAuthority.slice(0, 48) + ':export:' + identity,
     documentAuthority: current.ledger.documentAuthority, baseRevision: current.revision, revision,
     actor, transport: 'platform', operation, requestId: null, sourceTransactionId: null,
     affectedBlockIds: [], parent: current.ledger.records.at(-1)?.transaction.id ?? null,

package/dist/kit/ledger/hash.mjs

@@ -111,9 +111,50 @@ export function sha256Parts(parts) {
   for (const part of parts) hash.update(part);
   return hash.digest();
 }
-const LONG_TEXT = 65536, DIGESTS = new Map();
+export async function sha256PartsAsync(parts, {yield: yieldWork, signal, byteLength} = {}) {
+  const encoder = new TextEncoder(), chunks = [];
+  let bytes = byteLength === undefined ? null : new Uint8Array(byteLength);
+  let high = '', length = 0;
+  const write = text => {
+    if (bytes) {
+      const result = encoder.encodeInto(text, bytes.subarray(length));
+      if (result.read !== text.length) throw new RangeError('SHA-256 byte length differs');
+      length += result.written;
+    } else {
+      const chunk = encoder.encode(text); chunks.push(chunk); length += chunk.length;
+    }
+  };
+  for (const value of parts) {
+    let text = high + String(value === undefined ? '' : value); high = '';
+    if (text.length && (text.charCodeAt(text.length - 1) & 0xfc00) === 0xd800) {
+      high = text.slice(-1); text = text.slice(0, -1);
+    }
+    for (let at = 0; at < text.length;) {
+      signal?.throwIfAborted();
+      let end = Math.min(text.length, at + 32768);
+      if (end < text.length && (text.charCodeAt(end - 1) & 0xfc00) === 0xd800 &&
+          (text.charCodeAt(end) & 0xfc00) === 0xdc00) end--;
+      write(text.slice(at, end)); at = end;
+      const pending = yieldWork?.(); if (pending) await pending;
+    }
+  }
+  if (high) write(high);
+  if (bytes && length !== bytes.length) throw new RangeError('SHA-256 byte length differs');
+  bytes ||= new Uint8Array(length);
+  let at = 0;
+  for (const chunk of chunks) {
+    signal?.throwIfAborted(); bytes.set(chunk, at); at += chunk.length;
+    const pending = yieldWork?.(); if (pending) await pending;
+  }
+  chunks.length = 0;
+  signal?.throwIfAborted();
+  const digest = await globalThis.crypto.subtle.digest('SHA-256', bytes);
+  signal?.throwIfAborted();
+  return Array.from(new Uint8Array(digest), value => value.toString(16).padStart(2, '0')).join('');
+}
+const LONG_TEXT = 65536, DOCUMENT_TEXT = 1048576, DIGESTS = new Map();
 export function sha256(text) {
-  if (typeof text !== 'string' || text.length < LONG_TEXT) return createSHA256().update(text).digest();
+  if (typeof text !== 'string' || text.length < LONG_TEXT || text.length >= DOCUMENT_TEXT) return createSHA256().update(text).digest();
   let digest = DIGESTS.get(text);
   if (digest === undefined) {
     digest = createSHA256().update(text).digest();