@panphora/clayjs 1.16.0 → 1.17.0

package/src/page/blocks.js

@@ -8,6 +8,7 @@ import { REMOTE, newId } from "./model.js";
 import { safeHref, safeSrc } from "./link.js";
 import { flatten, runsOf, unflatten, unitsOf } from "./inline.js";
 import { OPAQUE_MARK, opaqueMark } from "./format-codec.js";
+import { NATIVE_NAMES, nativeAttrs } from "./format-native.js";
 import { DEFAULTS, MARKS, OPAQUE, envelopeAttrs, envelopeRecord, marksAttrs, marksEntries } from "./projection.js";
 
 const alignOf = (a) => (a === "left" || a === "right" ? a : null);
@@ -1118,6 +1119,10 @@ export const clipboardParser = new model.DOMParser(parseSchema, [
   { tag: "del", mark: "strike" },
   { tag: "code", mark: "code" },
   { tag: "a[href]", mark: "link", getAttrs: (d) => { const href = safeHref(d.getAttribute("href")); return href ? { href } : false; } },
+  { tag: "blockquote", node: "quote", getAttrs: (d) => ({ parent: parentAttr(d) }) },
+  { tag: "u", mark: "underline" },
+  { tag: "mark", mark: "highlight", getAttrs: (d) => nativeAttrs("highlight", { color: d.getAttribute("data-color") }) ?? false },
+  { tag: "span[data-color]", mark: "text_color", getAttrs: (d) => nativeAttrs("text_color", { color: d.getAttribute("data-color") }) ?? false },
 ]);
 
 // Every pasted block arrives with no id and no pos (identityPlugin mints and
@@ -1202,10 +1207,38 @@ function pasteIntoClosedSummary(view, _event, slice) {
   return true;
 }
 
+// The four formats pasted in from elsewhere are floor-1 content too: a slice
+// that holds one asks the gate before it is inserted, and text waits in the
+// clipboard rather than being dropped when the answer is a refusal.
+function writesFormat(slice) {
+  let found = false;
+  slice?.content?.descendants((node) => {
+    if (found) return false;
+    if (node.type === N.quote) found = true;
+    else if (node.isText && node.marks.some((mark) => NATIVE_NAMES.has(mark.type.name))) found = true;
+    return !found;
+  });
+  return found;
+}
+
+function pasteFormat(view, event, slice) {
+  const from = view.state.selection.from, to = view.state.selection.to;
+  const plain = () => {
+    const text = slice.content.textBetween(0, slice.content.size, "\n", " ");
+    if (!view.isDestroyed && text) view.dispatch(view.state.tr.insertText(text, from, to));
+    return false;
+  };
+  import("./format-native-commands.js").then(({ pasteFormats }) => pasteFormats(view, slice, from, to), plain);
+  return true;
+}
+
 export function pastePlugin() {
   return new Plugin({
     props: {
-      handlePaste: pasteIntoClosedSummary,
+      handlePaste(view, event, slice) {
+        if (writesFormat(slice)) return pasteFormat(view, event, slice);
+        return pasteIntoClosedSummary(view, event, slice);
+      },
       clipboardSerializer,
       transformPastedHTML: (html) => flattenPastedHTML(html),
       clipboardParser,

package/src/page/board-views.js

@@ -1,17 +1,3 @@
-import { state } from "../vendor/prosemirror.vendor.js";
-
-// The card panels a board plugin can reach, filled by the board view part when it
-// loads. The plugin works, and does nothing, for a board without a panel.
+// The card panels a board part can reach, filled by the board view part when it
+// loads. A board without a panel does nothing on every change.
 export const cardPanels = new WeakMap();
-
-export function boardPlugin() {
-  return new state.Plugin({
-    view: (view) => ({
-      update: () => cardPanels.get(view)?.sync(),
-      destroy: () => {
-        cardPanels.get(view)?.hide(false, false);
-        cardPanels.delete(view);
-      },
-    }),
-  });
-}

package/src/page/chart-tables.js

@@ -0,0 +1,11 @@
+import { schema } from "./schema.js";
+import { orderedIds } from "./model.js";
+
+// The tables a chart can be drawn from: a top-level table with at least one
+// column. The insert menu reads this without the chart module itself, which only
+// a document that takes a chart loads.
+export function chartTables(doc) {
+  const tables = [];
+  doc.forEach((node) => { if (node.type === schema.nodes.table && orderedIds(node.attrs.cols).length) tables.push(node); });
+  return tables;
+}

package/src/page/chart.js

@@ -1,6 +1,6 @@
-import { state } from "../vendor/prosemirror.vendor.js";
 import { schema } from "./schema.js";
 import { blockJson, keyBetween, newId, orderedIds } from "./model.js";
+import { chartTables } from "./chart-tables.js";
 import { chartModel, renderChartSvg } from "./rich/chart.js";
 import { openPageMenu } from "./chrome.js";
 import { project } from "./projection.js";
@@ -50,11 +50,7 @@ export function insertChartAfterTable(view, tablePos) {
   return true;
 }
 
-export function chartTables(doc) {
-  const tables = [];
-  doc.forEach((node) => { if (node.type === schema.nodes.table && orderedIds(node.attrs.cols).length) tables.push(node); });
-  return tables;
-}
+export { chartTables };
 
 // /chart: an empty line becomes the chart, otherwise it goes below the line.
 // One table is charted at once; several open a picker named by their columns.
@@ -213,8 +209,8 @@ export class ChartView {
   }
 }
 
-export function chartPlugin() {
-  return new state.Plugin({
-    view: () => ({ update(view) { for (const chart of views.get(view) ?? []) chart.refresh(); } }),
-  });
+// The hook the chart view part registers for its editor view: every change can
+// have moved a chart's source table.
+export function refreshCharts(view) {
+  for (const chart of views.get(view) ?? []) chart.refresh();
 }

package/src/page/checkpoint-proof.js

@@ -0,0 +1,289 @@
+/**
+ * checkpoint-proof.js — the proof one accepted save produces, and the conditional read
+ * that answers for bytes this tab did not write.
+ *
+ * Step 2 built the proof itself: the recorded revisions, the accepted page state, the
+ * final article and the receipt, checked by `validatePageCheckpoint` before a store
+ * retires anything. What it left here is the producer's half. A proof is made at the
+ * accepted-save event, from the page state pinned to THAT capture, never from the live
+ * store: an edit made after the capture is in the store and is not in the bytes the host
+ * took, and reading the store when the response lands would cover it and clear it.
+ *
+ * Checklist item 2 lives here too. A state that no longer projects to the article that
+ * went to disk proves nothing about those bytes, so an authored transform that changed
+ * meaning, a page rebuilt from another article or a stale tag all produce no proof, and
+ * the records stay.
+ *
+ * The second half is the conditional page-state client: the host's own copy of the page
+ * state, asked for by the accepted ETag, for the cases a local capture cannot answer —
+ * the server's checkpoint, another writer's, and a lost reply that only a verified
+ * refetch can reconcile. Nothing here reads a cookie, a room sequence or a version
+ * string: a 412, a 428 or a 404 keeps every record, and so does any state whose
+ * identity, generation, digest or projection disagrees with what was accepted.
+ *
+ * It loads only when a recovery channel is registered: nothing else imports it.
+ */
+
+import { saveToken } from "../core/host-attrs.js";
+import { setCapturePageState } from "../core/snapshot.js";
+import { canonicalPageBytes, digestHex, pageProof, validatePageCheckpoint } from "./ybind/recovery-proof.js";
+import { articleOfPageState, pageStateOfClone } from "./save-projection.js";
+
+// The capture half. A save capture carries its page state only once something can prove
+// it, so the reader is installed here rather than from the page bundle: a page that
+// journals nothing never pays for it, and a page that does gets the state of the exact
+// clone whose bytes it sends, after every transform.
+setCapturePageState(pageStateOfClone);
+
+/** The only page-state resource version this client reads. */
+export const PAGE_STATE_VERSION = 1;
+
+export class PageCheckpointError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "PageCheckpointError";
+    this.code = code;
+  }
+}
+
+const fail = (code, message) => { throw new PageCheckpointError(code, message); };
+const refused = (code, message) => ({ ok: false, code, message });
+const HEX64 = /^[0-9a-f]{64}$/;
+const GENERATION = /^[0-9a-f]{32}$/;
+
+const isObject = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+
+// The state as this tab holds it, copied: a pinned capture's value shares its `y` map
+// with the store's at the moment of the copy and must not share it after.
+function copyState(state) {
+  return { v: state.v, g: state.g, y: { ...(state.y ?? {}) } };
+}
+
+// The state the bytes are decoded from, strictly, and its canonical form.
+function stateOfTag(tag) {
+  let state;
+  try { state = JSON.parse(tag); }
+  catch (_) { fail("invalid-state", "The page state is not JSON"); }
+  if (!isObject(state) || state.v !== 1) fail("invalid-state", "Expected a version 1 Yjs page value");
+  return { state: copyState(state), bytes: canonicalPageBytes(state) };
+}
+
+const idKey = (value) => (value === null || value === undefined ? "" : String(value));
+
+/**
+ * Ask the host for the page state of one accepted version, conditionally.
+ *
+ * The ETag is the one the accepted save carried, so the answer is about those exact
+ * bytes or about nothing. 412 (another version is stored), 428 (no condition was sent,
+ * which no answer of ours can be), 404 (this host keeps no page state) and every other
+ * failure are refusals with a code: the caller keeps its records and asks again later.
+ *
+ * @param {Object} options
+ * @param {string} options.href - the resource discovery named in `document.pageState.href`
+ * @param {string} options.etag - the ETag the accepted bytes were stored under
+ * @param {Function} [options.fetch]
+ * @param {AbortSignal} [options.signal]
+ * @returns {Promise<{ok: true, version: number, documentId: *, generation: string, etag: string, stateHash: string, tag: string}|{ok: false, code: string, message: string}>}
+ */
+export async function readPageState({ href, etag, fetch: doFetch = globalThis.fetch, signal = null } = {}) {
+  if (typeof etag !== "string" || !etag) return refused("missing-etag", "A conditional read needs the accepted ETag");
+  if (typeof href !== "string" || !href) return refused("no-page-state", "This host names no page-state resource");
+  if (typeof doFetch !== "function") return refused("unavailable", "This tab cannot read the page state");
+  const base = globalThis.location?.href ?? "http://localhost/";
+  let url;
+  try { url = new URL(href, base).href; }
+  catch (_) { return refused("no-page-state", "The page-state resource is not a URL"); }
+  const token = saveToken();
+  let res;
+  try {
+    res = await doFetch(url, {
+      method: "GET",
+      credentials: token ? "omit" : "same-origin",
+      headers: { "If-Match": etag, "Document-URL": globalThis.location?.href ?? base },
+      cache: "no-store",
+      redirect: "manual",
+      signal,
+    });
+  } catch (_) {
+    return refused("unavailable", "The page-state request did not complete");
+  }
+  if (!res || typeof res.status !== "number") return refused("unavailable", "The page-state request did not answer");
+  if (res.status === 412) return refused("etag-mismatch", "Another version of this document is stored");
+  if (res.status === 428) return refused("etag-required", "The host needs a condition this read cannot send");
+  if (res.status === 404) return refused("no-page-state", "This host keeps no page state");
+  if (!res.ok) return refused("unavailable", `The host answered ${res.status}`);
+
+  let body;
+  try { body = JSON.parse(await res.text()); }
+  catch (_) { return refused("invalid-state", "The page-state answer is not JSON"); }
+  if (!isObject(body) || body.version !== PAGE_STATE_VERSION) return refused("unsupported-version", "Unknown page-state version");
+  if (typeof body.tag !== "string" || !body.tag) return refused("invalid-state", "The page-state answer carries no page tag");
+  if (typeof body.stateHash !== "string" || !HEX64.test(body.stateHash)) return refused("invalid-state", "The page-state answer carries no state digest");
+  if (typeof body.generation !== "string" || !GENERATION.test(body.generation)) return refused("invalid-state", "The page-state answer carries no generation");
+  if (typeof body.etag !== "string" || !body.etag) return refused("invalid-state", "The page-state answer carries no ETag");
+  if (!Object.hasOwn(body, "documentId")) return refused("invalid-state", "The page-state answer carries no document identity");
+  return {
+    ok: true,
+    version: body.version,
+    documentId: body.documentId,
+    generation: body.generation,
+    etag: body.etag,
+    stateHash: body.stateHash,
+    tag: body.tag,
+  };
+}
+
+/**
+ * Whether a conditional read answers for the version this tab accepted.
+ *
+ * Identity, generation, ETag, digest and projection, in that order: a state for another
+ * document, another generation, another version of the same document or another article
+ * is refused rather than used, and the receipt names the pair the host persisted.
+ *
+ * @param {Object} read - an answer from readPageState()
+ * @param {Object} options
+ * @param {{authority: Object, lineage: Object}} options.accepted
+ * @param {string} options.article - the final outgoing canonical article
+ * @param {string} options.etag - the ETag the accepted save carried
+ * @returns {Promise<{ok: true, state: Object, receipt: {file: string, pageState: string}}|{ok: false, code: string, message: string}>}
+ */
+export async function verifyPageState(read, { accepted, article, etag } = {}) {
+  if (!read || read.ok !== true) return refused(read?.code ?? "unavailable", read?.message ?? "The page state was not read");
+  if (idKey(read.documentId) !== idKey(accepted?.authority?.documentId)) return refused("foreign-document", "The page state belongs to another document");
+  if (typeof accepted?.lineage?.generation !== "string" || read.generation !== accepted.lineage.generation) return refused("foreign-generation", "The page state belongs to another generation");
+  if (read.etag !== etag) return refused("etag-mismatch", "The page state belongs to another version of this document");
+  let stateBytes, state;
+  try { ({ state, bytes: stateBytes } = stateOfTag(read.tag)); }
+  catch (error) { return refused(error?.code ?? "invalid-state", error?.message ?? "The page state does not decode"); }
+  if (await digestHex(stateBytes) !== read.stateHash) return refused("state-digest-mismatch", "The page state is not the one the host hashed");
+  if (typeof article !== "string") return refused("missing-article", "A proof names the final outgoing article");
+  let projected;
+  try { projected = articleOfPageState(state); }
+  catch (error) { return refused("invalid-state", error?.message ?? "The page state does not project"); }
+  if (projected !== article) return refused("article-mismatch", "The page state does not project to the accepted article");
+  return { ok: true, state, receipt: { file: read.etag, pageState: read.stateHash } };
+}
+
+// A proof is only worth the records the validator confirms, over the revisions the
+// caller observed: a proof that covers nothing keeps everything.
+async function covered(proof, records) {
+  const observed = (records || []).map(({ id, revision }) => ({ id, revision }));
+  try {
+    return { ok: true, proof, covered: await validatePageCheckpoint(proof, observed) };
+  } catch (error) {
+    return refused(error?.code ?? "invalid-proof", error?.message ?? "The proof does not validate");
+  }
+}
+
+/**
+ * The proof of one accepted save, from the page state pinned to its capture.
+ *
+ * The receipt is the accepted ETag and the digest of the state the proof is made over,
+ * which is this tab's own account that this capture was written and hashed. Nothing
+ * about a later edit, a store value or an acknowledgement reaches this function.
+ *
+ * @param {Object} options
+ * @param {string} options.capture - the capture the save belongs to
+ * @param {Array<Object>} options.records - {id, revision, update, context} the caller observed
+ * @param {{authority: Object, lineage: Object}} options.accepted
+ * @param {string} options.article - the final outgoing canonical article
+ * @param {Object} options.state - the page state pinned to that capture
+ * @param {string} options.etag - the ETag the accepted save carried
+ * @returns {Promise<{ok: true, proof: Object, covered: Array}|{ok: false, code: string, message: string}>}
+ */
+export async function captureProof({ capture, records = [], accepted, article, state = null, etag = null } = {}) {
+  if (!state) return refused("no-capture-state", "No page state was pinned to this capture");
+  if (typeof etag !== "string" || !etag) return refused("missing-etag", "An accepted save with no ETag proves no stored pair");
+  if (typeof article !== "string") return refused("missing-article", "The accepted bytes hold no article");
+  let projected, stateBytes;
+  try {
+    projected = articleOfPageState(state);
+    stateBytes = canonicalPageBytes(state);
+  } catch (error) {
+    return refused(error?.code ?? "invalid-state", error?.message ?? "The pinned page state does not decode");
+  }
+  if (projected !== article) return refused("article-mismatch", "The pinned page state does not project to the accepted article");
+  let proof;
+  try {
+    proof = await pageProof({
+      capture,
+      records,
+      accepted,
+      article,
+      state,
+      receipt: { file: etag, pageState: await digestHex(stateBytes) },
+    });
+  } catch (error) {
+    return refused(error?.code ?? "invalid-proof", error?.message ?? "The proof could not be built");
+  }
+  return covered(proof, records);
+}
+
+/**
+ * The proof of an accepted save, rebuilt from the page state the host persisted.
+ *
+ * The answer for the server's checkpoint, another writer's, and a save whose reply was
+ * lost: identity, generation and digest are checked against that exact ETag first, and
+ * only then is coverage asked. A host that cannot answer leaves the journal alone.
+ *
+ * @param {Object} options
+ * @param {Object} options.read - an answer from readPageState()
+ * @returns {Promise<{ok: true, proof: Object, covered: Array}|{ok: false, code: string, message: string}>}
+ */
+export async function refetchedProof({ read, capture, records = [], accepted, article, etag = null } = {}) {
+  const verified = await verifyPageState(read, { accepted, article, etag });
+  if (!verified.ok) return verified;
+  let proof;
+  try {
+    proof = await pageProof({ capture, records, accepted, article, state: verified.state, receipt: verified.receipt });
+  } catch (error) {
+    return refused(error?.code ?? "invalid-proof", error?.message ?? "The proof could not be built");
+  }
+  return covered(proof, records);
+}
+
+/**
+ * Retire exactly the records one accepted save covers.
+ *
+ * The pinned capture is tried first, because it needs no request and no host. Only a
+ * capture that cannot prove these bytes asks the host, conditionally on the accepted
+ * ETag. Whichever answers, the channel is handed the caller's observed list and the
+ * proof together: it narrows the list to what the proof covers and never widens it, and
+ * a refusal here retires nothing.
+ *
+ * @param {Object} options
+ * @param {Object} options.channel - the `page.yjs` channel api
+ * @param {Array<Object>} options.records - {id, revision, update, context} the caller observed
+ * @param {string} options.capture
+ * @param {{authority: Object, lineage: Object}} options.accepted
+ * @param {string} options.article
+ * @param {Object} [options.state] - the page state pinned to the capture
+ * @param {string} options.etag
+ * @param {?string} [options.href] - the page-state resource, or null
+ * @param {Function} [options.read]
+ * @param {Function} [options.fetch]
+ * @returns {Promise<{ok: boolean, retired: Array, proof: ?Object, code?: string}>}
+ */
+export async function checkpointAccepted({
+  channel,
+  records = [],
+  capture,
+  accepted,
+  article,
+  state = null,
+  etag = null,
+  href = null,
+  read = readPageState,
+  fetch: doFetch,
+} = {}) {
+  if (!channel || typeof channel.checkpoint !== "function") return { ok: false, code: "no-channel", retired: [], proof: null };
+  let proven = await captureProof({ capture, records, accepted, article, state, etag });
+  if (!proven.ok) {
+    const answer = await read({ href, etag, fetch: doFetch });
+    proven = await refetchedProof({ read: answer, capture, records, accepted, article, etag });
+  }
+  if (!proven.ok) return { ok: false, code: proven.code, retired: [], proof: null };
+  const answer = await channel.checkpoint({ records: proven.covered, proof: proven.proof });
+  if (!answer || answer.ok !== true) return { ok: false, code: answer?.code ?? "checkpoint-failed", retired: [], proof: proven.proof };
+  return { ok: true, retired: answer.retired ?? [], proof: proven.proof };
+}

package/src/page/chrome.js

@@ -11,9 +11,8 @@ import { currentSpan, selectBlocks, duplicateBlocks, deleteBlocks, asStep, typeI
 import { openAltEditor, setImageAttrs } from "./media.js";
 import { BlockDrag } from "./drag.js";
 import { openLinkEditor } from "./link.js";
-import { BLOCK_TYPES, MENU_ITEMS, blockTypeOf, turnInto, insertAfter, rankItems, runItem, retype, canTurnInto, insertItemsFor } from "./items.js";
+import { BLOCK_TYPES, MENU_ITEMS, blockTypeOf, turnInto, insertAfter, rankItems, runItem, retype, canTurnInto, insertItemsFor, loadChartPart } from "./items.js";
 import toast from "../ui/toast-lazy.js";
-import { insertChartAfterTable } from "./chart.js";
 import { pickCsv } from "./csv-import.js";
 import { HISTORY_INTENT, typingIntent } from "./history-intent.js";
 import { composing } from "./markdown.js";
@@ -86,7 +85,7 @@ export const ACTION_ITEMS = [
   { key: "small", label: "Small", icon: "▫", only: "image", run: (view, chrome, index) => setImageAttrs(view, imageId(view, index), { width: 240 }) },
   { key: "medium", label: "Medium", icon: "◻", only: "image", run: (view, chrome, index) => setImageAttrs(view, imageId(view, index), { width: 480 }) },
   { key: "full", label: "Full width", icon: "⬜", only: "image", run: (view, chrome, index) => setImageAttrs(view, imageId(view, index), { width: null }) },
-  { key: "chart", label: "Chart this table", icon: "📊", only: "table", run: (view, chrome, index) => insertChartAfterTable(view, blockStart(view.state.doc, index)) },
+  { key: "chart", label: "Chart this table", icon: "📊", only: "table", run: (view, chrome, index) => { const at = blockStart(view.state.doc, index); return loadChartPart(view).then(({ insertChartAfterTable }) => insertChartAfterTable(view, at)); } },
   { key: "csv", label: "Import CSV…", icon: "⇧", only: "table", focus: false, run: (view, chrome, index) => pickCsv(view, null, view.state.doc.child(index).attrs.id) },
 ];
 
@@ -217,6 +216,11 @@ function runList(view, kind) {
   if (tr.docChanged) view.dispatch(asStep(tr));
 }
 
+// The four formats this release adds are commands the format gate may refuse, and
+// a refusal is a notice rather than a change. The menu that offers them, and the
+// commands behind it, load the first time one is chosen (format-native-commands.js).
+const nativeMenu = (view, chrome, name) => import("./format-native-commands.js").then((menu) => menu.nativeMenu(view, name, chrome.more));
+
 function runMark(view, name) {
   if (name === "link") return openLinkEditor(view);
   const st = view.state;
@@ -560,6 +564,9 @@ class Chrome {
     const actions = ACTION_ITEMS.filter((a) => MORE_ACTIONS.has(a.key)).map((a) => ({ ...a, blocks: true }));
     return [
       ...tools,
+      { key: "underline", label: "Underline", icon: "U", hint: `${MOD}u`, run: (view, chrome) => nativeMenu(view, chrome, "underline") },
+      { key: "text_color", label: "Text color", icon: "A", hint: "\u203a", run: (view, chrome) => nativeMenu(view, chrome, "text_color") },
+      { key: "highlight", label: "Highlight", icon: "\u25A0", hint: "\u203a", run: (view, chrome) => nativeMenu(view, chrome, "highlight") },
       { key: "turn", label: "Turn into", icon: "\u21bb", run: (view, chrome) => chrome.openMenu("turn", chrome.more) },
       { key: "insert", label: "Insert", icon: "+", run: (view, chrome) => chrome.openMenu("insert", chrome.more, null, null, view.state.doc.child(chrome.blockIndex()).attrs.id) },
       ...actions,
@@ -668,9 +675,20 @@ class Chrome {
         this.view.focus();
         return;
       }
-      const tr = st.tr;
-      for (const id of wanted) retype(tr, this.idIndex(id), item);
-      this.view.dispatch(asStep(tr).scrollIntoView());
+      const turn = () => {
+        const tr = this.view.state.tr;
+        for (const id of wanted) {
+          const at = this.idIndex(id);
+          if (at >= 0) retype(tr, at, item);
+        }
+        if (tr.docChanged) this.view.dispatch(asStep(tr).scrollIntoView());
+        return true;
+      };
+      // A block type from a later format asks the gate before it writes.
+      if (item.type === "quote") {
+        const view = this.view;
+        import("./format-native-commands.js").then((menu) => menu.gateTurn(view, turn));
+      } else turn();
       this.view.focus();
     } else if (m.mode === "actions" || m.mode === "more" || m.mode === "external") {
       if (item.blocks) this.selectCaretBlock(wanted);

package/src/page/document-title-dom.js

@@ -15,6 +15,18 @@ export function customTitle(root) {
   return false;
 }
 
+// Mark this document's title as its author's own, the way the SEO editor's custom
+// title does. Returns whether it wrote the marker.
+export function markCustomTitle(root) {
+  const head = headOf(root);
+  if (!head || customTitle(root)) return false;
+  const meta = head.ownerDocument.createElement("meta");
+  meta.setAttribute("name", TITLE_MODE);
+  meta.setAttribute("content", "custom");
+  head.insertBefore(meta, head.querySelector("title") ?? head.firstChild);
+  return true;
+}
+
 export function titleText(root) {
   return headOf(root)?.querySelector("title")?.textContent ?? "";
 }

package/src/page/document-title-runtime.js

@@ -1,6 +1,7 @@
 import { state } from "../vendor/prosemirror.vendor.js";
 import Mutation from "../lib/mutation.js";
-import { titleFor, titleText, writeTitle } from "./document-title-dom.js";
+import { UNTITLED } from "./document-title.js";
+import { customTitle, markCustomTitle, titleFor, titleText, writeTitle } from "./document-title-dom.js";
 
 const ATOM = "\uFFFC";
 
@@ -38,6 +39,18 @@ export function refreshDocumentTitle(view) {
   return title;
 }
 
+// A file written before titles followed the first H1 can carry a title its author
+// typed with no H1 behind it. The first time an editor opens such a file, that title
+// becomes the author's own (the SEO custom marker), so deriving never replaces it;
+// a file that has an H1 keeps following it, and deleting that H1 later reads Untitled.
+export function adoptAuthoredTitle(view) {
+  const doc = view?.dom?.ownerDocument ?? null;
+  if (!doc || customTitle(doc) || titleItemsOfDoc(view.state.doc).length || [ "", UNTITLED ].includes(titleText(doc).trim())) return false;
+  Mutation.pause();
+  try { return markCustomTitle(doc); }
+  finally { Mutation.resume(); }
+}
+
 export function titlePlugin() {
   return new state.Plugin({
     view(editorView) {
@@ -46,6 +59,7 @@ export function titlePlugin() {
         doc = editorView.state.doc;
         refreshDocumentTitle(editorView);
       };
+      adoptAuthoredTitle(editorView);
       refresh();
       return {
         update(next) {

package/src/page/document-title.js

@@ -1,9 +1,12 @@
 export const UNTITLED = "Untitled";
 
-export function documentTitle(items, { custom = false, currentTitle = "" } = {}) {
+export function documentTitle(items, { custom = false, currentTitle = "", keepWithoutHeading = false } = {}) {
   if (custom) return currentTitle;
   const first = items.find(item =>
     item.t === "heading" && (item.level ?? 2) === 1 && item.parent == null
   );
+  // A file the editor has not adopted yet (see adoptAuthoredTitle) may carry a title
+  // its author wrote with no H1 behind it; a renderer that cannot ask keeps it.
+  if (!first && keepWithoutHeading && !["", UNTITLED].includes(String(currentTitle).trim())) return currentTitle;
   return String(first?.c ?? "").replace(/[\s\uFFFC]+/gu, " ").trim() || UNTITLED;
 }