yrby 0.8.0 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9e731133b862944bb0475e1175d59c1d365924a5da722a395624426044371413
-  data.tar.gz: 1ec6b9298ecb11609d3d93279ecd5239f54b10ae5e7cd5f9d1b7deffe75288b6
+  metadata.gz: cc870d86089bc5373cbac29455b1b7818c4a710b4ca1c8c12eeee2939faa8758
+  data.tar.gz: 66c41fad450c8e71a23a166bc1f0e6a83def6bdcc94c79724bb63d7691a28f16
 SHA512:
-  metadata.gz: 3b0d016da20f2bd97529fdf0fce808a771e4997d9834f5be9234ef6f0225485f72fa3854cd7a362ff72275f84f3fa8003ac0cd42efea55028c07879fa6b9da1a
-  data.tar.gz: da77acc0583feb5e7cbb4da0076c6fd3053c11fb64a6aa4c33d708a31220a49e67f1cadf6c5ea27f67c9dd5b9c655285a004dbe70acea1133a232c606d8f7ccb
+  metadata.gz: 0725a1a0966f516316041b3d46edcd946783802691d568ed139549fbc120515b809ca368784f23f522bad7e0a4f24abb46951985ff0935627b1733d2e3b47cd3
+  data.tar.gz: 6fcf5914510b36d10fe3bf344725cb151f945c57df95b692cdd5a4344ceeba2e81ed6455a0ec3b4071ae5a9c569de4bc0ae3bea9aa6b40b399594c296fb71a0b

data/CHANGELOG.md

@@ -6,6 +6,127 @@ to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## yrby-client 0.7.1 - 2026-11-03
+
+### Fixed
+
+- yrby-client: `connect()` restores the presence that `disconnect()` removed,
+  unless the app set or cleared presence in between. Before this, a `renew()`
+  (which document sessions call with a renewed grant) or a manual reconnect
+  left the local awareness state `null`, and y-protocols ignores
+  `setLocalStateField` while it is `null`, so the user stayed invisible to
+  peers until reload.
+
+## [0.9.0] - 2026-11-03
+
+### Experimental
+
+These are new, and they may change in a minor release. See
+[docs/experimental.md](docs/experimental.md).
+
+- Live handles that write to a document from Ruby: `Doc#get_map`,
+  `get_array`, `get_text`, and `get_xml_text` return `Y::Map`, `Y::Array`,
+  `Y::Text`, and `Y::XmlText`. A write is a CRDT edit, so a person editing the
+  same document keeps their change. A handle stays on the shared type it was
+  made for while others edit around it, and releases the GVL like `Doc`.
+  Indexes are Ruby characters, and negative indexes count from the end as in
+  Ruby. `push`, `<<`, and `insert` return the receiver, and `each`
+  without a block an Enumerator, as Ruby's own do.
+- `Doc#edit { }` runs a block that writes to the document and returns the
+  update its writes produced, or nil when it wrote nothing. It is the unit a
+  process saves and sends as it writes.
+- `Y::Lexical` and `Y::Lexxy` write Lexical's node shape: `append_paragraph`,
+  `append_heading`, `append_list`, `append_quote`, `append_code`,
+  `append_markdown`, `insert_paragraph`, `append_text`, `replace_runs`, and
+  `delete_block`.
+  Text takes formatted runs (`bold:`, `italic:`, `code:`, `link:`, and so on).
+  What Ruby writes renders the same as what a person typed. Each helper
+  writes its block in one transaction. `XmlText#push_xml_text` and
+  `insert_xml_text` take the new block's content, and `append` and
+  `replace` write content into a block.
+- `append_markdown` writes a link to a script as plain text.
+- `Y::Anchor`, from `XmlText#anchor`, is a block's identity as a value to
+  store or send. `Doc#block_at` and `Doc#find` resolve it.
+  `relative_position(index)` builds the Yjs caret shape editors put in
+  awareness, and `Text#index_at(position)` resolves one.
+- `Doc#apply_update_changes(update, root)` applies an update and returns the
+  ordinals of the top-level blocks it touched. It reads the blocks and
+  applies the update in one transaction, so another thread's write doesn't
+  show up in the result.
+- `Y::Awareness` builds and reads presence frames, and `Doc#client_id` returns
+  the id a document writes under.
+
+### Changed
+
+- yrby and the renderer crates are on yrs 0.28. yrs 0.28 replaced the number
+  variants of `Any` with `Any::Number(Number::Int | Number::Float)`. Because
+  the crates take yrs types, this is a breaking release for them:
+  `lexical-yjs-html` 0.2.0, `prosemirror-yjs-html` 0.2.0, and
+  `yjs-html-core` 0.2.0 need yrs 0.28.
+
+### Fixed
+
+- The Lexical and ProseMirror renderers (and the `lexical-yjs-html` and
+  `prosemirror-yjs-html` 0.2.1 crates) refuse a link to a script: Lexical
+  sends it to `about:blank` and ProseMirror empties its `href`, as each
+  editor does.
+- A `Timeout`, `Thread#raise`, or `Thread#kill` that arrives during a
+  native call raises once the call returns. Before, Ruby could jump over
+  the extension's Rust frames without running their cleanup.
+
+## yrby-client 0.7.0 - 2026-10-08
+
+This release updates yrby-client only. The gems are unchanged.
+
+### Added
+
+- yrby-client: `<yrby-document>` has a read-only `current` property that
+  returns the `yrby:synced` detail of the bound session, or undefined when
+  nothing is bound. A binding that loads after the event fired can bind from
+  it.
+- yrby-client: `<yrby-document>` has a `retry()` method that acquires the
+  document again after its session blocked or was discarded, without changing
+  whether the page is live. It works from a lease abort handler or right after
+  `session.discard()`, so a binding can replace a broken document with a fresh
+  session. It replaces calling `activate()`, which is internal to the Turbo
+  adapter.
+- yrby-client: `YrbyDocumentElement.consumer` accepts a function that returns
+  a consumer or a promise of one. The element calls it when it first needs a
+  consumer and reuses the result. A function that throws or rejects is called
+  again on the next attempt, and assigning a different value replaces the
+  result.
+
+## [0.8.1] - 2026-10-03
+
+### Added
+
+- `unknown_types` on `Y::Lexical` and `Y::ProseMirror`, and so on `Y::Lexxy`
+  and `Y::Tiptap`. It lists the node types in a document that neither the
+  built-in schema nor a rule handles, which are the ones `to_html` can't fully
+  render. Render a real document from your editor in a test and assert the list
+  is empty.
+- The renderer crates export `escape_text` and `escape_attr` for callers that
+  build their own markup (`lexical-yjs-html` 0.1.4, `prosemirror-yjs-html`
+  0.1.5).
+
+### Changed
+
+- The demo app and the render-parity test run on Lexxy 1.0. `Y::Lexxy`
+  output matches Lexxy 1.0's own `value`, including image alt text edited
+  after the document syncs.
+
+### Fixed
+
+- The Lexical renderers keep the text of an unknown inline wrapper, such as a
+  mark with no rule. The text renders without the wrapper. Before, the whole
+  node rendered as nothing, so its text was missing from the HTML.
+- `Y::Lexxy`'s list-item rule escapes the stored `__checked` and `__value`
+  attributes. Collaborators write those attributes, and a crafted value could
+  break out of the HTML attribute. Normal values (booleans and integers) render
+  the same as before.
+- The crate READMEs' callback examples escape the values they insert, and both
+  READMEs describe how unknown node types render.
+
 ## [0.8.0] - 2026-10-01
 
 This release ships alongside yrby-client 0.6.0, and the client entries below

data/Cargo.lock

@@ -13,9 +13,9 @@ dependencies = [
 
 [[package]]
 name = "arc-swap"
-version = "1.8.0"
+version = "1.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51d03449bb8ca2cc2ef70869af31463d1ae5ccc8fa3e334b307203fbf815207e"
+checksum = "380962b3d93b99642e50b9febf72c071e97e8b32d86eae9cf4ef582bb960ae6e"
 dependencies = [
  "rustversion",
 ]
@@ -117,9 +117,9 @@ checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
 [[package]]
 name = "dashmap"
-version = "6.1.0"
+version = "6.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5041cc499144891f3790297212f32a74fb938e5136a14943f338ef9e0ae276cf"
+checksum = "e6361d5c062261c78a176addb82d4c821ae42bed6089de0e12603cd25de2059c"
 dependencies = [
  "cfg-if",
  "crossbeam-utils",
@@ -229,7 +229,7 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
 [[package]]
 name = "lexical-yjs-html"
-version = "0.1.3"
+version = "0.2.1"
 dependencies = [
  "serde_json",
  "yjs-html-core",
@@ -308,9 +308,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.21.3"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
 [[package]]
 name = "parking"
@@ -348,7 +348,7 @@ dependencies = [
 
 [[package]]
 name = "prosemirror-yjs-html"
-version = "0.1.4"
+version = "0.2.1"
 dependencies = [
  "serde_json",
  "yjs-html-core",
@@ -400,6 +400,27 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cca7ad6a7e21e72151d56fe2495a259b5670e204c3adac41ee7ef676ea08117a"
 
+[[package]]
+name = "rb-sys-test-helpers"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccc637c53cad6a6b49ad51c5857c64e36bd70c955ffafe9dc9cc5bc9dd0b3b18"
+dependencies = [
+ "rb-sys",
+ "rb-sys-env 0.2.3",
+ "rb-sys-test-helpers-macros",
+]
+
+[[package]]
+name = "rb-sys-test-helpers-macros"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1c1fce35d9ac77a2745e539232fb82a75856675a5daf4ef8b1ca994d89f8b3f"
+dependencies = [
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
@@ -628,7 +649,7 @@ checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
 [[package]]
 name = "yjs-html-core"
-version = "0.1.3"
+version = "0.2.1"
 dependencies = [
  "serde_json",
  "yrs",
@@ -643,6 +664,7 @@ dependencies = [
  "prosemirror-yjs-html",
  "rb-sys",
  "rb-sys-env 0.1.2",
+ "rb-sys-test-helpers",
  "serde_json",
  "yjs-html-core",
  "yrs",
@@ -650,9 +672,9 @@ dependencies = [
 
 [[package]]
 name = "yrs"
-version = "0.27.2"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccc6a0094c76c87b1b72ca0579bf7aa00f540957182264e6561cbde707c2ce51"
+checksum = "52c70dc8beca8666c77612a96889106ca3cd65318609721f464624ff79685da9"
 dependencies = [
  "arc-swap",
  "async-lock",

data/README.md

@@ -101,6 +101,7 @@ bin/rails generate yrby:install && bin/rails db:migrate
   - [Rendering to HTML](#rendering-to-html)
   - [Protocol codec (module functions)](#protocol-codec-module-functions)
   - [ActionCable Integration](#actioncable-integration)
+- [Experimental: writing from Ruby](#experimental-writing-from-ruby)
 - [Thread Safety](#thread-safety)
   - [Parallelism (GVL release)](#parallelism-gvl-release)
 - [Message Type Constants](#message-type-constants)
@@ -117,7 +118,9 @@ primitives. By default the Ruby side treats a document as opaque CRDT state. It
 applies updates, answers sync handshakes, and records deltas without reading
 the contents, and the browser editor decides what shape the document has. When
 you do need to look inside, `Doc#read_text` and `Doc#read_map` rebuild it in
-Ruby.
+Ruby, and live handles (`Doc#get_map`, `get_array`, `get_text`,
+`get_xml_text`) write to it. The handles are
+[experimental](docs/experimental.md).
 
 ## Durability and delivery
 
@@ -338,12 +341,12 @@ every editor configures its own. `Y::Lexical` is the core Lexical base
 (paragraphs, headings, quotes, code, lists, tables, links, and the full
 text-format model), and other Lexical editors extend it with rules.
 
-It handles every node in the Lexxy 0.9.x set: paragraphs, headings, every text
-format and their combinations, links, the four list types with nesting,
-blockquotes, code blocks, tabs and soft breaks, horizontal rules, tables with
-header cells, image galleries, and ActionText attachments. Uploads and mentions
-both render as `<action-text-attachment>` elements, which ActionText can
-re-render.
+It handles every node in Lexxy 1.0, which has the same set as 0.9.x:
+paragraphs, headings, every text format and their combinations, links, the
+four list types with nesting, blockquotes, code blocks, tabs and soft breaks,
+horizontal rules, tables with header cells, image galleries, and ActionText
+attachments. Uploads and mentions both render as `<action-text-attachment>`
+elements, which ActionText can re-render.
 
 The Lexical support has the same two layers. `Y::Lexical` handles core Lexical
 structure natively, and everything Lexxy adds is in `Y::Lexxy`'s rule set,
@@ -401,6 +404,13 @@ attribute names your templates and blocks will read, and `children` and `text`
 tell you which `contains:` to pick. Child block types mean `:blocks`, and text
 means `:inline`.
 
+`unknown_types` lists the types whose `handled` is nil. `to_html` still
+renders them as well as it can. An unknown container or inline wrapper renders
+its children without its own markup, so its text stays. A node that keeps its
+content only in its attributes renders nothing. Either way, the node's markup is
+missing from the HTML, and nothing raises. When you add editor nodes, add a test
+that renders a real document and asserts `unknown_types` is empty.
+
 When a declarative rule can't express the markup, give the node a block:
 
 ```ruby
@@ -673,7 +683,7 @@ gets blocked at the next reconnect. To avoid that, pair `expires_in:` with
 # app/controllers/posts_controller.rb
 def grant
   @post = current_user.posts.find(params[:id])   # your own authorization, again
-  render json: { grant: @post.collaborative_sgid(:body, expires_in: 10.minutes) }
+  render json: { grant: @post.collaborative_document(:body).grant(expires_in: 10.minutes) }
 end
 ```
 
@@ -737,7 +747,7 @@ up the record from it, so the page decides which document the client gets.
 
 ```erb
 <%# the view picks the document and signs it %>
-<%= tag.div data: { grant: post.collaborative_sgid(:body) } %>
+<%= tag.div data: { grant: post.collaborative_document(:body).grant } %>
 ```
 
 ```ruby
@@ -1067,6 +1077,18 @@ The browser clients manage presence (cursors, selections). The server doesn't
 set or hold presence state, and it relays awareness frames without reading
 them. See `yrby-client` for the client-side awareness API.
 
+## Experimental: writing from Ruby
+
+These APIs are new. They may change in any minor release, and they aren't
+covered by yrby's usual compatibility promise.
+[docs/experimental.md](docs/experimental.md) documents them:
+
+- Live `Y::Map`, `Y::Array`, and `Y::Text` handles that write to a document
+- Writing Lexical rich text from Ruby, with `Y::Lexical` and `Y::Lexxy`
+- Anchors: a block's identity as a value
+- Streaming into a document with `Doc#edit`
+- Editing a record's document from Ruby
+
 ## Thread Safety
 
 You can share a `Doc` across Ruby threads. Puma workers, ActionCable connection

data/ext/yrby/Cargo.toml

@@ -12,7 +12,7 @@ crate-type = ["cdylib"]
 [dependencies]
 magnus = "0.8"
 rb-sys = "0.9"
-yrs = { version = "0.27", features = ["sync"] }
+yrs = { version = "0.28", features = ["sync"] }
 serde_json = "1.0"
 yjs-html-core = { path = "crates/html-core" }
 lexical-yjs-html = { path = "crates/lexical-html" }
@@ -20,3 +20,5 @@ prosemirror-yjs-html = { path = "crates/prosemirror-html" }
 
 [dev-dependencies]
 rb-sys-env = "0.1"
+magnus = { version = "0.8", features = ["embed"] }
+rb-sys-test-helpers = "0.3"

data/ext/yrby/crates/html-core/Cargo.toml

@@ -3,7 +3,7 @@ name = "yjs-html-core"
 description = "Internal core for the lexical-yjs-html and prosemirror-yjs-html renderer crates; depend on those instead"
 repository = "https://github.com/jpcamara/yrby"
 readme = "README.md"
-version = "0.1.3"
+version = "0.2.1"
 edition = "2024"
 rust-version = "1.85"
 authors = ["JP Camara <johnpcamara@gmail.com>"]
@@ -12,5 +12,5 @@ keywords = ["yjs", "crdt", "yrs", "html", "rendering"]
 categories = ["text-processing", "web-programming"]
 
 [dependencies]
-yrs = { version = "0.27", features = ["sync"] }
+yrs = { version = "0.28", features = ["sync"] }
 serde_json = "1.0"

data/ext/yrby/crates/html-core/src/lib.rs

@@ -18,7 +18,7 @@
 //! every binding and caller.
 
 use std::collections::{BTreeMap, BTreeSet, HashMap};
-use yrs::{Any, Out, ReadTxn, Xml};
+use yrs::{Any, Number, Out, ReadTxn, Xml};
 
 /// One piece of renderer output. `Html` is finished markup; `Deferred` is a
 /// callback node whose markup the caller supplies after the render, carrying
@@ -216,12 +216,12 @@ pub fn xml_ref_attr<T: ReadTxn, N: Xml>(txn: &T, node: &N, name: &str) -> Option
 pub fn any_attr_string(any: &Any) -> Option<String> {
     match any {
         Any::String(s) => Some(s.to_string()),
-        Any::Number(n) => Some(if n.fract() == 0.0 {
+        Any::Number(Number::Int(n)) => Some(format!("{n}")),
+        Any::Number(Number::Float(n)) => Some(if n.fract() == 0.0 {
             format!("{}", *n as i64)
         } else {
             format!("{n}")
         }),
-        Any::BigInt(n) => Some(format!("{n}")),
         Any::Bool(b) => Some(if *b { "true" } else { "false" }.to_string()),
         _ => None,
     }
@@ -458,10 +458,41 @@ fn parse_parts(name: &str, parts: &[serde_json::Value]) -> Result<Vec<AttrPart>,
         .collect()
 }
 
+/// The scheme a URL names, lowercased, or `None` for a URL without one (a
+/// path). Browsers ignore whitespace and control characters in a scheme, so
+/// they don't count here either: `java\tscript:` is `javascript`.
+pub fn url_scheme(url: &str) -> Option<String> {
+    let url: String = url
+        .chars()
+        .filter(|c| !c.is_whitespace() && !c.is_control())
+        .collect();
+    let (scheme, _) = url.split_once(':')?;
+    let mut chars = scheme.chars();
+    let starts_with_letter = chars.next().is_some_and(|c| c.is_ascii_alphabetic());
+    let valid = chars.all(|c| c.is_ascii_alphanumeric() || matches!(c, '+' | '.' | '-'));
+    (starts_with_letter && valid).then(|| scheme.to_ascii_lowercase())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    #[test]
+    fn url_scheme_reads_a_scheme_as_a_browser_does() {
+        assert_eq!(url_scheme("https://example.com").as_deref(), Some("https"));
+        assert_eq!(
+            url_scheme("JavaScript:alert(1)").as_deref(),
+            Some("javascript")
+        );
+        assert_eq!(
+            url_scheme(" java\tscript:alert(1)").as_deref(),
+            Some("javascript")
+        );
+        assert_eq!(url_scheme("/docs/a:b"), None);
+        assert_eq!(url_scheme("#top"), None);
+        assert_eq!(url_scheme("example.com"), None);
+    }
+
     #[test]
     fn parses_the_compiled_rule_shape() {
         let rules = Rules::parse(

data/ext/yrby/crates/lexical-html/Cargo.toml

@@ -3,7 +3,7 @@ name = "lexical-yjs-html"
 description = "Render Lexical-shaped yrs documents to HTML, no browser or Node required"
 repository = "https://github.com/jpcamara/yrby"
 readme = "README.md"
-version = "0.1.3"
+version = "0.2.1"
 edition = "2024"
 rust-version = "1.85"
 authors = ["JP Camara <johnpcamara@gmail.com>"]
@@ -12,6 +12,6 @@ keywords = ["yjs", "crdt", "lexical", "html", "yrs"]
 categories = ["text-processing", "web-programming"]
 
 [dependencies]
-yrs = { version = "0.27", features = ["sync"] }
+yrs = { version = "0.28", features = ["sync"] }
 serde_json = "1.0"
-yjs-html-core = { path = "../html-core", version = "0.1.3" }
+yjs-html-core = { path = "../html-core", version = "0.2.1" }

data/ext/yrby/crates/lexical-html/src/lib.rs

@@ -67,8 +67,8 @@ mod readme_examples {}
 pub use yjs_html_core::*;
 use yrs::types::text::YChange;
 use yrs::{
-    Any, GetString, Map, Out, ReadTxn, Text, Xml, XmlElementRef, XmlFragment, XmlFragmentRef,
-    XmlOut, XmlTextRef,
+    Any, GetString, Map, Number, Out, ReadTxn, Text, Xml, XmlElementRef, XmlFragment,
+    XmlFragmentRef, XmlOut, XmlTextRef,
 };
 
 // Lexical text format bitmask (lexical 0.44).
@@ -391,13 +391,11 @@ fn open_block<T: ReadTxn>(
             push_block_children(txn, t, depth, "</tr>", false, stack);
         }
         "tablecell" => {
-            let header = matches!(
-                t.get_attribute(txn, "__headerState"),
-                Some(Out::Any(Any::Number(n))) if n > 0.0
-            ) || matches!(
-                t.get_attribute(txn, "__headerState"),
-                Some(Out::Any(Any::BigInt(n))) if n > 0
-            );
+            let header = match t.get_attribute(txn, "__headerState") {
+                Some(Out::Any(Any::Number(Number::Int(n)))) => n > 0,
+                Some(Out::Any(Any::Number(Number::Float(n)))) => n > 0.0,
+                _ => false,
+            };
             let close = if header {
                 em.push_str("<th>");
                 "</th>"
@@ -562,8 +560,8 @@ fn open_listitem<T: ReadTxn>(
     rules: &Rules,
 ) {
     let value = match t.get_attribute(txn, "__value") {
-        Some(Out::Any(Any::Number(n))) => n as i64,
-        Some(Out::Any(Any::BigInt(n))) => n,
+        Some(Out::Any(Any::Number(Number::Int(n)))) => n,
+        Some(Out::Any(Any::Number(Number::Float(n)))) => n as i64,
         _ => 1,
     };
     let checked = match t.get_attribute(txn, "__checked") {
@@ -669,8 +667,8 @@ fn render_inline<T: ReadTxn>(
                     _ => {
                         is_tab = false;
                         format = match m.get(txn, "__format") {
-                            Some(Out::Any(Any::Number(n))) => n as u32,
-                            Some(Out::Any(Any::BigInt(n))) => n as u32,
+                            Some(Out::Any(Any::Number(Number::Int(n)))) => n as u32,
+                            Some(Out::Any(Any::Number(Number::Float(n)))) => n as u32,
                             _ => 0,
                         };
                         style = match m.get(txn, "__style") {
@@ -697,8 +695,15 @@ fn render_inline<T: ReadTxn>(
                         None => render_link(txn, &child, depth, em, rules),
                     }
                 } else if ruled_inline && !is_builtin(&ty) {
-                    if let Some(rule) = rules.nodes.get(ty.as_str()) {
-                        render_rule_inline(txn, &child, &ty, rule, depth, em, rules);
+                    match rules.nodes.get(ty.as_str()) {
+                        Some(rule) => render_rule_inline(txn, &child, &ty, rule, depth, em, rules),
+                        // An unknown inline wrapper, such as a mark with no
+                        // rule, renders its text without the wrapper, the same
+                        // way unknown blocks do. Its text is kept.
+                        None if depth < MAX_INLINE_DEPTH => {
+                            render_inline(txn, &child, depth + 1, ruled_inline, em, rules);
+                        }
+                        None => {}
                     }
                 }
                 // Nested blocks are rendered by their parent block's renderer.
@@ -789,13 +794,24 @@ fn lexxy_style(style: &str) -> Option<String> {
     if css.is_empty() { None } else { Some(css) }
 }
 
+/// The schemes a link may use, and what an editor shows for any other, as
+/// Lexical's `LinkNode` does: a `javascript:` link would run in the page.
+const LINK_SCHEMES: [&str; 5] = ["http", "https", "mailto", "sms", "tel"];
+
+fn safe_href(url: String) -> String {
+    match url_scheme(&url) {
+        Some(scheme) if !LINK_SCHEMES.contains(&scheme.as_str()) => "about:blank".to_string(),
+        _ => url,
+    }
+}
+
 /// `link` / `autolink`: Lexxy's sanitize keeps only `href` and `title`
 /// (`target`/`rel` are stored in the doc but stripped from exported HTML).
 fn render_link<T: ReadTxn>(txn: &T, t: &XmlTextRef, depth: usize, em: &mut Emitter, rules: &Rules) {
     em.push_str("<a");
     if let Some(url) = str_attr(txn, t, "__url") {
         em.push_str(" href=\"");
-        em.push_str(&escape_attr(&url));
+        em.push_str(&escape_attr(&safe_href(url)));
         em.push('"');
     }
     if let Some(title) = str_attr(txn, t, "__title").filter(|s| !s.is_empty()) {
@@ -956,21 +972,39 @@ fn elem_type<T: ReadTxn>(txn: &T, e: &XmlElementRef) -> String {
 }
 
 /// Text-content escaping, matching what the browser's serializer emits:
-/// `&`, `<`, `>` escaped; quotes left alone in text.
-fn escape_text(s: &str) -> String {
+/// `&`, `<`, `>` escaped; quotes left alone in text. Public for splice
+/// callers. Values read from a deferred segment's attributes come from
+/// collaborators, so escape anything you put into markup.
+pub fn escape_text(s: &str) -> String {
     s.replace('&', "&amp;")
         .replace('<', "&lt;")
         .replace('>', "&gt;")
 }
 
-/// Attribute-value escaping: text escaping plus `"`.
-fn escape_attr(s: &str) -> String {
+/// Attribute-value escaping: text escaping plus `"`. Public for splice
+/// callers, for document values interpolated into attribute positions.
+pub fn escape_attr(s: &str) -> String {
     escape_text(s).replace('"', "&quot;")
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
+
+    #[test]
+    fn a_link_to_an_unsafe_scheme_goes_nowhere() {
+        assert_eq!(
+            safe_href("https://example.com".into()),
+            "https://example.com"
+        );
+        assert_eq!(safe_href("/docs".into()), "/docs");
+        assert_eq!(
+            safe_href("mailto:a@example.com".into()),
+            "mailto:a@example.com"
+        );
+        assert_eq!(safe_href("javascript:alert(1)".into()), "about:blank");
+        assert_eq!(safe_href(" JAVA\tSCRIPT:alert(1)".into()), "about:blank");
+    }
     use yrs::updates::decoder::Decode;
     use yrs::{Doc, Transact, Update};
 
@@ -1140,6 +1174,34 @@ mod tests {
         assert!(html.contains("<p>Before gallery</p>"));
     }
 
+    /// An unknown inline wrapper never drops its text. The fixture is a
+    /// real capture: two collaborating editors typed "Collab #ruby rocks
+    /// and #peer too", the word "rocks" wrapped in @lexical/mark's
+    /// MarkNode and the hashtags as @lexical/hashtag TextNode runs. With
+    /// no rules, the mark's wrapper is lost but "rocks" survives, and
+    /// hashtags render as their text.
+    #[test]
+    fn unknown_inline_wrappers_keep_their_text() {
+        let bytes = include_bytes!("fixtures/mark_hashtag.bin");
+        let doc = Doc::new();
+        doc.transact_mut()
+            .apply_update(Update::decode_v1(bytes).unwrap())
+            .unwrap();
+        let txn = doc.transact();
+        let frag = txn.get_xml_fragment("root").unwrap();
+        let html = render(&txn, &frag).unwrap();
+
+        assert!(
+            html.contains("rocks"),
+            "marked text survives without a rule: {html}"
+        );
+        assert!(
+            !html.contains("<mark"),
+            "no wrapper is invented for it: {html}"
+        );
+        assert!(html.contains("#ruby"), "hashtag text survives: {html}");
+    }
+
     #[test]
     fn format_runs_match_lexxys_export_algorithm() {
         // Singles take their semantic tag; the span for plain text unwraps.

data/ext/yrby/crates/prosemirror-html/Cargo.toml

@@ -3,7 +3,7 @@ name = "prosemirror-yjs-html"
 description = "Render ProseMirror-shaped yrs documents to HTML, no browser or Node required"
 repository = "https://github.com/jpcamara/yrby"
 readme = "README.md"
-version = "0.1.4"
+version = "0.2.1"
 edition = "2024"
 rust-version = "1.85"
 authors = ["JP Camara <johnpcamara@gmail.com>"]
@@ -12,6 +12,6 @@ keywords = ["yjs", "crdt", "prosemirror", "tiptap", "html"]
 categories = ["text-processing", "web-programming"]
 
 [dependencies]
-yrs = { version = "0.27", features = ["sync"] }
+yrs = { version = "0.28", features = ["sync"] }
 serde_json = "1.0"
-yjs-html-core = { path = "../html-core", version = "0.1.3" }
+yjs-html-core = { path = "../html-core", version = "0.2.1" }