@panphora/clayjs 1.15.2 → 1.16.0

package/src/page/ybind/recovery-proof.js

@@ -0,0 +1,191 @@
+/**
+ * recovery-proof.js — what a checkpoint covers, and what makes a proof a proof.
+ *
+ * A checkpoint covers a journaled record only when merging that record's owned bytes
+ * into the accepted page state changes neither an insertion nor a deletion. A state
+ * vector cannot answer that: inserting `abc` and then deleting `b` leaves the state
+ * vector where it was while the bytes carry the deletion. So coverage here is a byte
+ * comparison, it is sufficient but not necessary, and malformed input is an error that
+ * keeps the record rather than retiring it.
+ *
+ * A proof is made by the save integration from the capture it saved under and the bytes
+ * it read back. No room acknowledgement, `requestCheckpoint()` success, state vector or
+ * ETag order becomes a proof, and nothing here asks a host anything: the accepted page
+ * state and the receipt arrive in the proof itself.
+ */
+
+import { encodeStateAsUpdateV2, mergeUpdatesV2 } from "../../vendor/yjs.vendor.js";
+import { docFromValue } from "./provider.js";
+
+export class PageProofError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "PageProofError";
+    this.code = code;
+  }
+}
+
+const fail = (code, message) => { throw new PageProofError(code, message); };
+const HEX = /^[0-9a-f]{64}$/;
+const encoder = typeof TextEncoder === "function" ? new TextEncoder() : null;
+const bytesOf = (value) => {
+  if (value instanceof Uint8Array) return value;
+  if (value instanceof ArrayBuffer) return new Uint8Array(value);
+  return null;
+};
+const identityKey = (id) => (typeof id === "string" ? id : JSON.stringify(id));
+const copyId = (id) => (Array.isArray(id) ? [...id] : id);
+const copyState = (state) => ({ v: state.v, g: state.g, y: { ...(state.y ?? {}) } });
+
+export const equalBytes = (a, b) => a.length === b.length && a.every((value, index) => value === b[index]);
+
+/**
+ * Whether merging `update` into `checkpoint` adds nothing: no insertion, no deletion.
+ *
+ * @param {Uint8Array} checkpoint - canonical or merged Yjs V2 update bytes
+ * @param {Uint8Array} update - the bytes to look for
+ * @param {Object} [Yjs] - the vendored Yjs module
+ * @returns {boolean}
+ */
+export function containsUpdate(checkpoint, update, Yjs = null) {
+  const merge = Yjs?.mergeUpdatesV2 ?? mergeUpdatesV2;
+  const canonical = merge([checkpoint]);
+  return equalBytes(canonical, merge([canonical, update]));
+}
+
+export async function digestHex(bytes) {
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
+  return [...new Uint8Array(digest)].map((value) => value.toString(16).padStart(2, "0")).join("");
+}
+
+/**
+ * The accepted page state as one canonical update, decoded strictly.
+ *
+ * Pending structs, missing part and a delete set naming an unknown item all refuse:
+ * a checkpoint nobody can decode proves nothing about a journaled record.
+ *
+ * @param {Object} state - a version 1 page value
+ * @returns {Uint8Array}
+ */
+export function canonicalPageBytes(state) {
+  let doc;
+  try {
+    doc = docFromValue(state, { strict: true });
+  } catch (error) {
+    fail("invalid-state", `The accepted page state does not decode: ${error.message}`);
+  }
+  try {
+    return encodeStateAsUpdateV2(doc);
+  } finally {
+    doc.destroy();
+  }
+}
+
+// The same answer `sameAuthority` gives in recovery/identity.js, written here because the
+// edit bundle already pays for this module through the provider: importing the generic
+// recovery layer from the page proof would split it into a chunk every editor load pays.
+const sameAuthority = (a, b) => Boolean(a && b) && Boolean(a.host && a.documentId && a.principalId) && a.host === b.host && a.documentId === b.documentId && a.principalId === b.principalId;
+const sameGeneration = (a, b) => Boolean(a && b) && typeof a.generation === "string" && Boolean(a.generation) && a.generation === b.generation;
+
+/**
+ * Assemble the proof a checkpoint is retired with.
+ *
+ * Each named record carries the bytes it owns and the context it was journaled under, so
+ * the validator can refuse a record written under another generation without asking the
+ * store or a host. `state` must be the exact accepted page state and `article` the final
+ * outgoing canonical article; their digests are taken here, over these bytes.
+ *
+ * @param {Object} options
+ * @param {string} options.capture - the capture the save belongs to
+ * @param {Array<{id: *, revision: number, update: Uint8Array, context: ?Object}>} options.records
+ * @param {{authority: Object, lineage: Object}} options.accepted - the identity and generation it was saved under
+ * @param {string} options.article - the final outgoing canonical article
+ * @param {Object} options.state - the accepted page state
+ * @param {{file: string, pageState: string}} options.receipt - the persisted pair
+ * @param {boolean} [options.saved]
+ * @returns {Promise<Object>}
+ */
+export async function pageProof({ capture, records = [], accepted, article, state, receipt, saved = true } = {}) {
+  const entries = [];
+  for (const record of records) {
+    if (!record || record.id === undefined || typeof record.revision !== "number") fail("invalid-record", "A proof names each record by id and revision");
+    const update = bytesOf(record.update);
+    if (!update || !update.length) fail("invalid-record", "A proof needs the bytes each record owns");
+    entries.push({ id: copyId(record.id), revision: record.revision, update: update.slice(), context: record.context ?? null });
+  }
+  if (typeof article !== "string") fail("missing-article", "A proof names the final outgoing article");
+  const stateBytes = canonicalPageBytes(state);
+  return {
+    saved: saved === true,
+    capture,
+    accepted,
+    article,
+    state: copyState(state),
+    stateDigest: await digestHex(stateBytes),
+    articleDigest: await digestHex(encoder.encode(article)),
+    receipt,
+    records: entries,
+  };
+}
+
+// Checklist items 1, 2, 4 and 5, over the proof alone. Item 3 is the per-record coverage
+// test below, and the projection of the state onto the article is the producer's to make:
+// a proof whose state is not the one it was made over fails its own digest.
+async function checkProof(proof) {
+  if (!proof || typeof proof !== "object" || Array.isArray(proof)) fail("missing-proof", "A page checkpoint needs a proof");
+  if (proof.saved !== true) fail("not-saved", "Only a save that succeeded under admission makes a proof");
+  if (typeof proof.capture !== "string" || !proof.capture) fail("missing-capture", "A proof belongs to the capture it saved");
+  const receipt = proof.receipt;
+  if (!receipt || typeof receipt.file !== "string" || !receipt.file || typeof receipt.pageState !== "string" || !receipt.pageState) {
+    fail("missing-receipt", "A proof names the persisted file and page-state pair");
+  }
+  const accepted = proof.accepted;
+  if (!accepted || !accepted.authority || !accepted.lineage || typeof accepted.lineage.generation !== "string" || !accepted.lineage.generation) {
+    fail("missing-identity", "A proof names the authority and generation it was saved under");
+  }
+  if (typeof proof.article !== "string") fail("missing-article", "A proof names the final outgoing article");
+  if (!Array.isArray(proof.records)) fail("missing-records", "A proof names the records it covers");
+  if (typeof proof.stateDigest !== "string" || !HEX.test(proof.stateDigest)) fail("missing-digest", "A proof carries the accepted state digest");
+  if (typeof proof.articleDigest !== "string" || !HEX.test(proof.articleDigest)) fail("missing-digest", "A proof carries the final article digest");
+  const stateBytes = canonicalPageBytes(proof.state);
+  if (await digestHex(stateBytes) !== proof.stateDigest) fail("state-digest-mismatch", "The page state is not the one the proof was made over");
+  if (await digestHex(encoder.encode(proof.article)) !== proof.articleDigest) fail("article-digest-mismatch", "The article is not the one the proof was made over");
+  const entries = new Map();
+  for (const entry of proof.records) {
+    if (!entry || entry.id === undefined || typeof entry.revision !== "number") fail("invalid-record", "A proof names each record by id and revision");
+    const update = bytesOf(entry.update);
+    if (!update || !update.length) fail("invalid-record", "A proof needs the bytes each record owns");
+    entries.set(identityKey(entry.id), entry);
+  }
+  return { stateBytes, entries, accepted };
+}
+
+// A record is covered only by a state that still carries it, saved under the same
+// authority and the same generation it was journaled under.
+function covers(checked, entry) {
+  const context = entry.context;
+  if (!context || !sameAuthority(context.authority, checked.accepted.authority)) return false;
+  if (!sameGeneration(context.lineage, checked.accepted.lineage)) return false;
+  const update = bytesOf(entry.update);
+  return Boolean(update) && update.length > 0 && containsUpdate(checked.stateBytes, update);
+}
+
+/**
+ * The records a page checkpoint proof covers, and no others.
+ *
+ * Registered as `validateCheckpoint` on the `page.yjs` channel. It runs before the
+ * store's transaction, may only narrow the caller's list, and throws on a proof it
+ * cannot decode so that an error keeps every record.
+ *
+ * @param {Object} proof
+ * @param {Array<{id: *, revision: number}>} records - what the caller observed
+ * @returns {Promise<Array<{id: *, revision: number}>>}
+ */
+export async function validatePageCheckpoint(proof, records = []) {
+  const checked = await checkProof(proof);
+  return (records || []).filter((record) => {
+    if (!record || record.id === undefined || typeof record.revision !== "number") return false;
+    const entry = checked.entries.get(identityKey(record.id));
+    return Boolean(entry) && entry.revision === record.revision && covers(checked, entry);
+  });
+}

package/src/page/ybind/recovery-replay.js

@@ -0,0 +1,130 @@
+/**
+ * recovery-replay.js — rebuild a page from one journaled capsule, and decide whether it
+ * may be replayed at all.
+ *
+ * A capsule is one immutable base and everything the episode put on top of it: the
+ * dependencies it received (a peer update a later local insert was built on) and the
+ * local work it owns. Replaying all three into a fresh Y.Doc rebuilds the page as this
+ * tab had it, read back through the strict decoder — no room, no host, no store.
+ *
+ * Admission is a separate question from reconstruction: a journal replays only into the
+ * authority, principal and generation it was written under, only while the current page
+ * still contains the capsule's base, and only into a page sharing its ancestry.
+ */
+
+import * as Y from "../../vendor/yjs.vendor.js";
+import { toBase64 } from "../../vendor/yjs.vendor.js";
+import { NET } from "./layout.js";
+import { blocksFromYValue } from "./decode.js";
+import { sameAuthority } from "../../recovery/identity.js";
+import { sameLineage, sharesAncestry } from "./lineage.js";
+import { canonicalPageBytes, containsUpdate } from "./recovery-proof.js";
+
+export class PageReplayError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "PageReplayError";
+    this.code = code;
+  }
+}
+
+const fail = (code, message) => { throw new PageReplayError(code, message); };
+const identityKey = (id) => (typeof id === "string" ? id : JSON.stringify(id));
+const bytesOf = (value) => {
+  if (value instanceof Uint8Array) return value;
+  if (value instanceof ArrayBuffer) return new Uint8Array(value);
+  return null;
+};
+const sameId = (a, b) => identityKey(a) === identityKey(b);
+
+function merge(values) {
+  const parts = values.map(bytesOf).filter((bytes) => bytes && bytes.length);
+  if (!parts.length) return new Uint8Array(0);
+  if (parts.length === 1) return parts[0].slice();
+  return Y.mergeUpdatesV2(parts);
+}
+
+/**
+ * One writer's capsule and its batches as three self-contained updates.
+ *
+ * Batches are folded in by origin, so a duplicate batch or an update already compacted
+ * into the capsule changes nothing: Yjs merges by operation identity. A batch naming
+ * another capsule is an error rather than another page's bytes.
+ *
+ * @param {{capsule: Object, batches?: Array<Object>}} options
+ * @returns {Object}
+ */
+export function accumulateCapsule({ capsule, batches = [] } = {}) {
+  if (!capsule || capsule.kind !== "binary" || !capsule.payload) fail("invalid-capsule", "Replay needs a binary capsule");
+  if (capsule.version !== undefined && capsule.version !== 1) fail("unknown-version", `Unknown page recovery capsule version: ${capsule.version}`);
+  const dependencies = [capsule.payload.dependencies];
+  const owned = [capsule.payload.owned];
+  const seen = new Set();
+  for (const batch of batches) {
+    if (!batch || batch.kind !== "binary-batch" || !batch.payload) fail("invalid-batch", "Replay reads binary batches only");
+    if (batch.capsuleId !== undefined && !sameId(batch.capsuleId, capsule.id)) fail("foreign-batch", "A batch belongs to another capsule");
+    if (batch.id !== undefined) {
+      if (seen.has(identityKey(batch.id))) continue;
+      seen.add(identityKey(batch.id));
+    }
+    if (batch.origin === "dependency") dependencies.push(batch.payload);
+    else owned.push(batch.payload);
+  }
+  return {
+    id: capsule.id,
+    context: capsule.context ?? null,
+    revision: capsule.revision ?? 0,
+    acknowledged: capsule.acknowledged ?? null,
+    base: merge([capsule.payload.base]),
+    dependencies: merge(dependencies),
+    owned: merge(owned),
+  };
+}
+
+// The capsule as one page value: the exact bytes a save would carry, so the strict
+// decoder reads the same state a checkpoint would.
+export function replayPageValue({ capsule, batches = [] } = {}) {
+  const parts = accumulateCapsule({ capsule, batches });
+  const doc = new Y.Doc();
+  try {
+    for (const bytes of [parts.base, parts.dependencies, parts.owned]) if (bytes.length) Y.applyUpdateV2(doc, bytes, NET);
+    if (doc.store.pendingStructs || doc.store.pendingDs) fail("unresolved-update", "The capsule's updates are missing a prerequisite");
+    return { v: 1, g: 0, y: { seed: toBase64(Y.encodeStateAsUpdateV2(doc)) } };
+  } finally {
+    doc.destroy();
+  }
+}
+
+/**
+ * The whole page a capsule reconstructs, decoded through the strict decoder.
+ *
+ * @param {{capsule: Object, batches?: Array<Object>}} options
+ * @returns {Object} the block model, by block id
+ */
+export function reconstructPage({ capsule, batches = [] } = {}) {
+  return blocksFromYValue(replayPageValue({ capsule, batches }));
+}
+
+/**
+ * The capsule's parts, if this page may replay them.
+ *
+ * `current` is the page as it is now: its own authority, generation and accepted state.
+ * A journal from another authority or principal is never applied, a journal from another
+ * generation is a page that was replaced while the tab was away, and a page that no
+ * longer contains the capsule's base has nothing to replay it onto.
+ *
+ * @param {{capsule: Object, batches?: Array<Object>, current: {context: Object, state: Object}}} options
+ * @returns {Object} the accumulated parts, ready to apply
+ */
+export function admitCapsule({ capsule, batches = [], current } = {}) {
+  const parts = accumulateCapsule({ capsule, batches });
+  if (!parts.context?.authority) fail("missing-identity", "A capsule with no authority is never replayed");
+  if (!current?.context?.authority) fail("missing-identity", "Replay needs the page's own authority");
+  if (!sameAuthority(parts.context.authority, current.context.authority)) fail("foreign-authority", "This journal belongs to another document or account");
+  if (!sameLineage(parts.context.lineage, current.context.lineage)) fail("foreign-generation", "This journal belongs to another generation of this page");
+  const stateBytes = canonicalPageBytes(current.state);
+  if (parts.base.length && !containsUpdate(stateBytes, parts.base)) fail("missing-base", "The page no longer contains the journal's base");
+  if (!parts.owned.length) fail("nothing-owned", "This capsule owns no local work");
+  if (!sharesAncestry(current.state, { v: 1, g: 0, y: { seed: toBase64(parts.owned) } })) fail("foreign-lineage", "This journal shares no ancestry with this page");
+  return parts;
+}

package/src/page/ybind/tokens.js

@@ -1,6 +1,6 @@
 import { attrKeys, sameJson } from "./layout.js";
 import { blockJson } from "../model.js";
-import { marksKey, marksAttrs } from "./marks.js";
+import { marksKey, marksFields } from "./marks.js";
 import { createProjectionMap } from "./projection-map.js";
 
 export const implicitFlags = (doc, visible) => {
@@ -19,7 +19,16 @@ export const implicitFlags = (doc, visible) => {
   });
   return out;
 };
-const pickAttrs = (node) => { const o = {}; for (const k of attrKeys(node.type)) o[k] = node.attrs[k]; if (node.type.name === "table") o.rows = blockJson(node).rows; return o; };
+const opaqueOf = (node) => node.attrs.raw ?? null;
+const pickAttrs = (node) => {
+  const raw = opaqueOf(node);
+  if (raw) { const o = { ...raw }; delete o.t; delete o.pos; return o; }
+  const o = {};
+  for (const k of attrKeys(node.type)) o[k] = node.attrs[k];
+  if (node.type.name === "table") o.rows = blockJson(node).rows;
+  return o;
+};
+const typeOfNode = (node) => opaqueOf(node)?.t ?? node.type.name;
 
 export function tokensOf(doc, alias = new Map(), visible = null) {
   const toks = [];
@@ -27,9 +36,9 @@ export function tokensOf(doc, alias = new Map(), visible = null) {
   doc.forEach((block, _o, index) => {
     const implicit = flags[index] && !alias.has(block.attrs.id);
     const brk = visible ? visible[index]?.brk ?? null : null;
-    if (!implicit) toks.push({ k: "b", id: flags[index] && alias.has(block.attrs.id) ? alias.get(block.attrs.id) : block.attrs.id, t: block.type.name, attrs: pickAttrs(block), brk });
+    if (!implicit) toks.push({ k: "b", id: flags[index] && alias.has(block.attrs.id) ? alias.get(block.attrs.id) : block.attrs.id, t: typeOfNode(block), attrs: pickAttrs(block), brk });
     if (block.isTextblock) block.content.forEach((n) => {
-      if (n.isText) { const ms = block.type.name === "code_block" ? [] : n.marks; const mk = marksKey(ms), ma = marksAttrs(ms); for (let i = 0; i < n.text.length; i++) toks.push({ k: "c", ch: n.text[i], mk, ma }); }
+      if (n.isText) { const ms = typeOfNode(block) === "code_block" ? [] : n.marks; const mk = marksKey(ms), ma = marksFields(ms); for (let i = 0; i < n.text.length; i++) toks.push({ k: "c", ch: n.text[i], mk, ma }); }
       else if (n.type.name === "hard_break") toks.push({ k: "h" });
     });
   });
@@ -74,8 +83,8 @@ export function textTokenRange(doc, from, to) {
     const a = Math.max(0, startOffset - cursor), b = Math.min(node.nodeSize, endOffset - cursor);
     if (a < b) {
       if (node.isText) {
-        const marks = block.type.name === "code_block" ? [] : node.marks;
-        const mk = marksKey(marks), ma = marksAttrs(marks);
+        const marks = typeOfNode(block) === "code_block" ? [] : node.marks;
+        const mk = marksKey(marks), ma = marksFields(marks);
         for (let i = a; i < b; i++) tokens.push({ k: "c", ch: node.text[i], mk, ma });
       } else if (node.type.name === "hard_break") tokens.push({ k: "h" });
     }

package/src/page/ybind/walk.js

@@ -144,14 +144,21 @@ function walkFlow(pd, index) {
     const root = recoveredRoot(sourceKey, removalsBySource.get(sourceKey) ?? [], intents);
     const id = `recovered:${sourceKey}`;
     const t = root ? root.type : "paragraph";
-    cur = { kind: "b", id, baseId: id, brk: { client: it.id.client, clock: it.id.clock }, implicit: false, runs: [], len: 1, atom: !schema.nodes[t]?.isTextblock, recovered: true, restored: !moved, sourceKey, t, fields: root ? root.attrs : null };
+    const opaque = !Object.hasOwn(schema.nodes, t);
+    cur = { kind: "b", id, baseId: id, brk: { client: it.id.client, clock: it.id.clock }, implicit: false, runs: [], len: 1, atom: !opaque && !schema.nodes[t]?.isTextblock, opaque, recovered: true, restored: !moved, sourceKey, t, fields: root ? root.attrs : null };
     segs.push(cur);
     prevId = id;
   };
   const open = (id, brk, implicit) => {
     cur = { kind: "b", id, baseId: id, brk, implicit, runs: [], len: implicit ? 0 : 1, atom: false, items: !implicit && (markerCount.get(id) ?? 0) > 1 ? [] : null };
-    if (!implicit) { cur.t = typeOf(id); cur.atom = !schema.nodes[cur.t]?.isTextblock; }
-    else cur.t = "paragraph";
+    if (!implicit) {
+      cur.t = typeOf(id);
+      // A type this runtime has no schema for still owns the text and marks up to
+      // the next block marker: it is not an atom whose following text becomes an
+      // implicit paragraph, and it is never rewritten as one.
+      cur.opaque = !Object.hasOwn(schema.nodes, cur.t);
+      cur.atom = !cur.opaque && !schema.nodes[cur.t]?.isTextblock;
+    } else cur.t = "paragraph";
     segs.push(cur);
     prevId = id;
   };

package/src/page/ybind/writer.js

@@ -8,10 +8,23 @@ import { resolveTableFields, tableSeed, writeTable } from "./table.js";
 import { resolveBoardFields, writeBoard } from "./board.js";
 import { createOriginIndex } from "./origins.js";
 
+const FIELD = (value) => (value === true ? {} : value);
+const sameValue = (a, b) => sameJson(FIELD(a), FIELD(b));
+
 export function setAttrs(pd, id, t, attrs) {
   let m = pd.attrs.get(id);
   if (!m) { m = new Y.Map(); pd.attrs.set(id, m); }
   const type = schema.nodes[t];
+  // A block type this runtime has no schema for keeps its original record: no
+  // known field list to normalize it against, and never a paragraph in its place.
+  if (!type) {
+    if (m.get("t") !== t) m.set("t", t);
+    for (const [k, v] of Object.entries(attrs ?? {})) {
+      if (k === "t" || k === "pos") continue;
+      if (!sameJson(m.has(k) ? m.get(k) : undefined, v)) m.set(k, v);
+    }
+    return;
+  }
   const table = t === "table" && m.get("t") === "table" && !recoveredSource(id);
   const board = t === "board" && !recoveredSource(id);
   const before = table ? resolveTableFields(pd.tableFields, id, tableSeed(pd, id)) : board ? resolveBoardFields(pd.boardFields, id) : null;
@@ -46,6 +59,31 @@ export function liveKeys(ctx) {
   return out;
 }
 
+// The live keys this runtime has no schema mark for, including the reserved
+// compact-code bridge. A command never cancels them: they stay byte for byte
+// until something that understands them rewrites them.
+export function opaqueKeys(ctx) {
+  const cancelled = new Set();
+  for (const [k, v] of ctx) if (isCancel(k) && v) cancelled.add(k.split("!")[0]);
+  const out = [];
+  for (const [k, v] of ctx) if (!isCancel(k) && v !== null && v !== undefined && !cancelled.has(k) && !schema.marks[markName(k)]) out.push([k, v]);
+  return out;
+}
+
+// The attributes an inserted unit carries over from its neighbours: every known
+// key as before, and an opaque key only when the editor's mark set still names
+// it, so text at a span boundary does not inherit a format nobody can read.
+export function baseAttributes(ctx, want = {}) {
+  const out = {};
+  let opaque = false;
+  for (const [k, v] of ctx) if (isCancel(k) || schema.marks[markName(k)]) out[k] = v;
+  for (const [k, v] of opaqueKeys(ctx)) {
+    opaque = true;
+    if (want[markName(k)] !== undefined) out[k] = v;
+  }
+  return { attrs: out, opaque };
+}
+
 export function runAttributes(pd, ctx, want) {
   const rid = mintOp(pd);
   const changes = {};
@@ -54,12 +92,17 @@ export function runAttributes(pd, ctx, want) {
   for (const [k, v] of have) {
     const n = markName(k);
     const w = want[n];
-    if (w !== undefined && sameJson(w === true ? true : w, v)) kept.add(n);
+    if (w !== undefined && sameValue(w, v)) kept.add(n);
     else changes[`${k}!${rid}`] = true;
   }
+  for (const [k, v] of opaqueKeys(ctx)) {
+    const n = markName(k);
+    if (want[n] !== undefined && sameValue(want[n], v)) kept.add(n);
+  }
   for (const [n, w] of Object.entries(want)) if (!kept.has(n)) changes[`${n}~${mintOp(pd)}`] = w;
-  if (!Object.keys(changes).length) return undefined;
-  return { ...Object.fromEntries(ctx), ...changes };
+  const base = baseAttributes(ctx, want);
+  if (!Object.keys(changes).length && !base.opaque) return undefined;
+  return { ...base.attrs, ...changes };
 }
 
 export const CHUNK_CHARS = 2000;
@@ -119,7 +162,7 @@ function insertChunk(pd, yIdx, toks, fences = null) {
     i += run.length;
     run = "";
   };
-  const embed = (e) => { const attrs = Object.fromEntries(ctxAt(pd, i)); beforeFence(pd, i, fences, () => pd.flow.insertEmbed(i, e, attrs)); i += 1; };
+  const embed = (e) => { const attrs = baseAttributes(ctxAt(pd, i)).attrs; beforeFence(pd, i, fences, () => pd.flow.insertEmbed(i, e, attrs)); i += 1; };
   for (const t of toks) {
     if (t.k === "c") { if (runMk !== null && t.mk !== runMk) flush(); runMk = t.mk; runMa = t.ma; run += t.ch; }
     else if (t.k === "h") { flush(); runMk = null; embed({ br: 1 }); }
@@ -249,6 +292,7 @@ export function applyRegion(ctx, ta, oldToks, newToks, oldSurvives = null) {
     else insertTokens(pd, map.toPhysical(e.at, "before"), e.i.toks, ctx.tx, ctx.fences);
   }
   for (const [ob, nb] of attrs) ctx.tx(() => {
+    if (!schema.nodes[nb.t]) return;
     const source = ctx.recovered.get(ob.id);
     if (source) {
       if (ob.t !== nb.t) pd.gone.set(attrKey(source, "t"), nb.t);