yrby-rails 0.8.0 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 83a5440fa6532dbedcf992660959297611b9b7cf958f7c7c6c1522dd0ac162b0
-  data.tar.gz: 23509b37d1bb0ce706c648a779993236addb244cb603031415de4084a58e4636
+  metadata.gz: 56e31c8cc1697d3894702fdfff977817fe1c22bb95318718dd3b0940171ed74f
+  data.tar.gz: 2a3a49d17af5c0d690ab98ca0c3bf6f41f7c79d0a9b6041f3dd49b98f0829e84
 SHA512:
-  metadata.gz: c51b2e0b9acefc89d6c69e3b935206d195ccaba7b302ec13316c39f7fab0115d09fd7a5d108f537294b8c069a54ef2e1a53fc19b39ec21873e7b61be866e7a5d
-  data.tar.gz: 5ffd94a472cd16ada77f62e57c7bd571f7df461a9552756212ef6fd12c9c1a2cb92bdb3ac72fe0320a1992d27f6b22ce8964240db81057ffaaa4cc2be1872124
+  metadata.gz: 148304e573708e6ace7234f5de8ecde4020fa8139f4daf8284598b6a6c79f478791c342dc7b70ab91e4d65e9bbf11eb4dc88a82ea364c027d44714337228a9a7
+  data.tar.gz: 9b929e7b58b7524052bb18026aee2ec7a90d82b22fd8d0eb3b61275d4c912da416a3a442121a516643da8621984ff06e843f3405ad74eb64766e14005c00893b

data/CHANGELOG-rails.md

@@ -7,6 +7,34 @@ this project aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-11-09
+
+Requires yrby 0.9.0 or later.
+
+### Security
+
+- `Y::ActionCable::Sync`'s methods and `Y::DocumentChannel`'s
+  `authorized_document_key` accessors are private. Action Cable treats a
+  channel's public methods as actions a client can call, so a client could call
+  `sync_subscribed` directly and skip the channel's own `subscribed` and
+  `receive`. Channels that call these from `subscribed` and `receive` keep
+  working. Code that calls them on a channel from outside, such as a test, now
+  needs `send`.
+
+### Added
+
+- `bin/rails generate yrby:install` pins `yrby-client`, `yrby-client/element`,
+  `yjs`, and `@rails/actioncable` when the app has `config/importmap.rb`. The
+  gem ships `yrby/yrby-client.js` and `yrby/yjs.js` for those pins, so an
+  import-map app needs no npm packages. Each shared module has one pin, so the
+  page and its editor binding load one copy of yjs. Pins the app already has
+  are left alone.
+- `has_collaborative_document :body, channel: "PostDocumentChannel"` names
+  an app's own `Y::DocumentChannel` subclass for an attribute.
+  `collaborative_document(:body).channel` returns it, so
+  `collaborative_document_tag` and Ruby clients subscribe there without
+  passing `channel:` each time.
+
 ## [0.8.0] - 2026-11-03
 
 Requires yrby 0.9.0 or later.

data/README.md

@@ -76,15 +76,21 @@ doc = post.collaborative_document(:body).y_doc
 doc.read_text("content")  # or Y::Lexxy.new(doc).to_html for rich text
 ```
 
-Install the gem and the npm package:
+Install the gem and run its generator:
 
 ```
-gem install yrby-rails # depends on yrby
-npm install yrby-client yjs y-protocols @rails/actioncable
-
+bundle add yrby-rails # depends on yrby
 bin/rails generate yrby:install && bin/rails db:migrate
 ```
 
+In an app that uses import maps, the generator pins `yrby-client`, `yjs`, and
+`@rails/actioncable` to JavaScript the gem ships. With a bundler, install the
+npm packages instead:
+
+```
+npm install yrby-client yjs y-protocols @rails/actioncable
+```
+
 ## Contents
 
 - [Scope](#scope)
@@ -101,7 +107,7 @@ bin/rails generate yrby:install && bin/rails db:migrate
   - [Rendering to HTML](#rendering-to-html)
   - [Protocol codec (module functions)](#protocol-codec-module-functions)
   - [ActionCable Integration](#actioncable-integration)
-- [Experimental: writing from Ruby](#experimental-writing-from-ruby)
+- [Experimental: writing from Ruby, and collaborators](#experimental-writing-from-ruby-and-collaborators)
 - [Thread Safety](#thread-safety)
   - [Parallelism (GVL release)](#parallelism-gvl-release)
 - [Message Type Constants](#message-type-constants)
@@ -664,6 +670,16 @@ the `authorize_document` block with the record and the attribute name, or to
 accept any valid grant when there's no block. A subclass can override
 `authorized?` directly and read the located record from `record`.
 
+A page subscribes to the channel its document names, `Y::DocumentChannel`
+unless the model says otherwise. Name a subclass where you declare the
+attribute, and the tag, a Ruby client, and a collaborator all use it:
+
+```ruby
+class Post < ApplicationRecord
+  has_collaborative_document :body, channel: "PostDocumentChannel"
+end
+```
+
 ### Grant lifetime and refresh
 
 A grant lasts as long as GlobalID's signed-id default, which is one month under
@@ -1077,7 +1093,7 @@ The browser clients manage presence (cursors, selections). The server doesn't
 set or hold presence state, and it relays awareness frames without reading
 them. See `yrby-client` for the client-side awareness API.
 
-## Experimental: writing from Ruby
+## Experimental: writing from Ruby, and collaborators
 
 These APIs are new. They may change in any minor release, and they aren't
 covered by yrby's usual compatibility promise.
@@ -1088,6 +1104,12 @@ covered by yrby's usual compatibility promise.
 - Anchors: a block's identity as a value
 - Streaming into a document with `Doc#edit`
 - Editing a record's document from Ruby
+- From the `yrby-agent` gem: joining a document from a Ruby process with
+  `Y::ActionCable::Client`, collaborators with `Y::Collaborator`, and agents
+  with `Y::Agent`
+
+`require "y/action_cable/client"`, `require "y/collaborator"`, and
+`require "y/agent"` print a warning in Ruby's `:experimental` category. `Warning[:experimental] = false` turns it off.
 
 ## Thread Safety