docblocks-core 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -1,5 +1,74 @@
 # docblocks-core
 
+## 0.1.2
+
+### Patch Changes
+
+- bf92634: The README's snapshot shape stands the actual JSON form: the document
+  fields (`id`, `title`, the optional `avatar`, `createdAt`) stand at the
+  top level of the snapshot next to the `blocks` map — the former `meta` /
+  `children` top-level description was wrong (the `children` order lives
+  inside the blocks, the `meta` object does not exist in the JSON).
+- b66e45e: The cross-minor as-is stand reaches the KNOWN block types: an additive
+  top-level field (a future minor's data) on a known type no longer stands
+  dropped on `fromJSON` — the layout writer keeps it with the generic
+  storage semantics (the opaque writer's parity) and the snapshot reader
+  passes it through (sorted keys, the `Y.Text` field reads as runs), so a
+  load → save cycle never loses unknown data.
+  
+  The mark value's as-is stand completes too: an unknown mark with a
+  non-boolean primitive value (string / number) is preserved on read —
+  the reader previously kept only the `true` and the object value shapes,
+  silently dropping the primitive ones on save.
+- c5a38d2: The link href's gate mirrors the WHATWG URL parser's full input
+  normalization: ASCII tab / LF / CR (U+0009–U+000D) are removed from ANY
+  position (plus the edge C0 / space trim) before the scheme detection. A
+  mid-string control could not hide the scheme before — `java\tscript:…`
+  carried no scheme per the `^[a-z][a-z0-9+.-]*:` test, while the browser's
+  URL parser strips the control and resolves the `javascript:` scheme, so a
+  documented link executed as script. The gate is the single stand of the
+  validator's link check, the renderer's href gate, and the paste's
+  markdown link re-gate.
+- 769c12a: The reactivity's handler isolation: a subscription handler's throw (the
+  handlers fire inside the Yjs transaction, the afterTransaction hook) no
+  longer rolls back the caller's committed batch (the `transact`'s rollback
+  guard would catch the listener's throw otherwise) and no longer aborts the
+  remaining handlers of the emission — the throw stands the logged error,
+  the emission continues, and the batch stays committed and undoable.
+  
+  The export's stable key order: `toJSON` assembles the blocks in sorted id
+  order — the Y.Map's iteration order depends on the creation history, so
+  converged peers stood the same data in different key orders before. The
+  converged peers' exports are byte-identical now (the `JSON.stringify`'s
+  bytes stand the convergence's check, not just the deep equality); the JSON's
+  object order is semantically irrelevant — the children's arrays carry the
+  document order.
+- 72fdfd3: The block and mark registry lookups stand the own-property stand over the
+  prototype-key values (`constructor`, `toString`, ...): the unknown block
+  type named by a prototype key keeps its data over the `fromJSON` /
+  `toJSON` round-trip (the opaque stand — the reader's lenient contract),
+  the strict commands refuse the unknown type and mark, and the export's
+  attr assembly writes own properties only (no prototype swap over a
+  hostile attr key).
+  
+  The same stand over the remaining lookup points: the `changeBlockType`'s
+  attrs merge (the target spec's whitelist membership over the own
+  properties — the hostile key stands reset like the type-specific attrs,
+  the patch's hostile key stands the strict rejection, the own writes keep
+  the prototype's setters out), the strict mark-field validation (an
+  unknown field named like an `Object.prototype` member stands the
+  rejection — the strict posture rejects rather than preserves it), and the
+  export's
+  id-keyed assemblies (the own writes over the `blocks` / `rows`
+  dictionaries — the wire's defense in depth).
+
+## 0.1.1
+
+### Patch Changes
+
+- The README's `createDoc`'s contract stands the actual initial state (only
+  the root block — no auto first paragraph).
+
 ## 0.1.0
 
 ### Added

package/README.md

@@ -31,7 +31,7 @@ const para = doc.insertBlock("paragraph");
 doc.insertText(para, 0, "hello world");
 doc.setMark(para, 0, 5, { type: "bold" });
 
-const json = doc.toJSON(); // { v, meta, blocks, children }
+const json = doc.toJSON(); // { v, id, title, avatar?, createdAt, blocks }
 // …persist or send `json` …
 const restored = fromJSON(json); // a fresh Doc over the same data
 ```
@@ -56,13 +56,14 @@ silently.
 
 ## The Doc
 
-`createDoc(options?)` builds a document with a root block and an empty,
-editable first paragraph. The other entry points:
+`createDoc(options?)` builds a document with only the root block (an empty
+page — no auto first paragraph; the react-ui editor guarantees the trailing
+editable paragraph). The other entry points:
 
 - `fromJSON(json)` — build a `Doc` from a JSON snapshot.
 - `loadDoc(bytes)` — build a `Doc` from an encoded full state (a base
   snapshot; apply diffs with `applyUpdate`).
-- `doc.toJSON()` — the JSON snapshot (`{ v, meta, blocks, children }`).
+- `doc.toJSON()` — the JSON snapshot (`{ v, id, title, avatar?, createdAt, blocks }`).
 - `doc.encode()` / `doc.encodeUpdate(stateVector?)` — the encoded full
   state / the incremental update.
 - `doc.applyUpdate(bytes)` — apply an encoded update (the remote-apply path).
@@ -127,8 +128,9 @@ projects a selection into the presence payload shape.
 
 ## Data format
 
-The JSON format is `v: 1`: `meta` (the doc `id`, `title`, the optional
-`avatar`) plus a **flat block map** (`id → block`) with explicit order via
+The JSON format is `v: 1`: the document fields (`id`, `title`, the
+optional `avatar`, `createdAt`) at the top level, plus a **flat block map**
+(`id → block`) with explicit order via
 `children: [blockId]`; nesting (lists, table cells) is `children`. The text
 of a text block is `content: [{ text, marks }]` runs. JSON ↔ Yjs is
 isomorphic — every JSON field has exactly one Yjs image.

package/dist/index.d.mts

@@ -757,7 +757,7 @@ interface ValidationError {
 //#region src/schema/validate/utils/common.d.ts
 declare const isHexColor: (value: unknown) => boolean;
 /** The public link-href contract (the validator's and the consumer
- *  renderer's gate): the trimmed form is an http/https URL or a
+ *  renderer's gate): the normalized form is an http/https URL or a
  *  scheme-less (relative) path; any other scheme is rejected. */
 declare const isSafeLinkHref: (value: string) => boolean;
 /**
@@ -1132,6 +1132,9 @@ declare class Doc {
    * propagates. A failed batch still emits a transient `onChange` emission
    * and a partial wire update before the rollback (CRDT property: the
    * rollback is best-effort on the wire; observable state converges).
+   * A subscription handler's throw (the handlers fire inside the
+   * transaction) is isolated — it stands the logged error and never rolls
+   * back a committed batch.
    */
   transact(fn: () => void): void;
   /** Undo the last local edit; a safe no-op when there is nothing to undo. */

package/dist/index.mjs

@@ -875,6 +875,20 @@ const MARK_REGISTRY = {
 		attrOptional: true
 	}
 };
+/**
+* The registry's membership checks: the `in` operator is prototype-aware,
+* so an Object.prototype-reserved key (`constructor`, `toString`, …) would
+* pass it as a registered entry (the inherited function, not a spec).
+* The data-key stand is the own-property lookup: the reserved key stands
+* unknown (the lenient reader's pass-through / the strict writer's
+* rejection), never a spec.
+*/
+function isRegisteredBlockType(type) {
+	return typeof type === "string" && Object.hasOwn(BLOCK_REGISTRY, type);
+}
+function isRegisteredMarkName(name) {
+	return typeof name === "string" && Object.hasOwn(MARK_REGISTRY, name);
+}
 //#endregion
 //#region src/schema/utils.ts
 /** The schema's shared helpers: the plain-object check + the block's
@@ -899,7 +913,7 @@ function indentOf(block) {
 function legacyChildrenOf(block) {
 	if (!Array.isArray(block.children)) return null;
 	const type = block.type;
-	if (typeof type !== "string" || !(type in BLOCK_REGISTRY)) return null;
+	if (!isRegisteredBlockType(type)) return null;
 	return BLOCK_REGISTRY[type].legacyChildrenTypes !== void 0 ? block.children : null;
 }
 /**
@@ -956,7 +970,7 @@ function projectBlock(block, id, input, state) {
 	const ordered = block.children;
 	if (!Array.isArray(ordered)) return withIndent(block, id, state);
 	const type = block.type;
-	const spec = typeof type === "string" && type in BLOCK_REGISTRY ? BLOCK_REGISTRY[type] : void 0;
+	const spec = isRegisteredBlockType(type) ? BLOCK_REGISTRY[type] : void 0;
 	if (spec === void 0) return withIndent(block, id, state);
 	if (!spec.children) {
 		const withoutChildren = { ...block };
@@ -1131,16 +1145,19 @@ const show = (value) => {
 const isIso8601 = (value) => typeof value === "string" && ISO_8601.test(value) && !Number.isNaN(Date.parse(value));
 const isHexColor = (value) => typeof value === "string" && HEX_COLOR.test(value);
 /** `http://` / `https://` URLs and relative paths; other schemes are
-*  rejected. The check runs over the trimmed form — the browser trims the
-*  leading / trailing C0 controls and spaces (U+0000–U+0020) before the
-*  scheme detection, so an untrimmed check stands the `"\tjavascript:…"`
-*  bypass (the raw string carries no scheme, the browser's does). */
+*  rejected. The check runs over the browser's normalization of the input:
+*  the WHATWG URL parser removes ASCII tab / LF / CR (U+0009–U+000D) from
+*  ANY position and trims the leading / trailing C0 controls and spaces
+*  (U+0000–U+0020) before the scheme detection — so an unnormalized check
+*  stands the `"java\tscript:…"` bypass (the raw string carries no scheme
+*  per the `^[a-z][a-z0-9+.-]*:` test, the browser's does). */
 const CONTROL_TRIM = /^[\u0000-\u0020]+|[\u0000-\u0020]+$/g;
+const MID_STRING_CONTROLS = /[\u0009\u000A\u000D]/g;
 /** The public link-href contract (the validator's and the consumer
-*  renderer's gate): the trimmed form is an http/https URL or a
+*  renderer's gate): the normalized form is an http/https URL or a
 *  scheme-less (relative) path; any other scheme is rejected. */
 const isSafeLinkHref = (value) => {
-	const trimmed = value.replace(CONTROL_TRIM, "");
+	const trimmed = value.replace(MID_STRING_CONTROLS, "").replace(CONTROL_TRIM, "");
 	return trimmed.length > 0 && (WEB_URL.test(trimmed) || !SCHEME_PREFIX.test(trimmed));
 };
 const isLinkHref = (value) => isSafeLinkHref(value);
@@ -1733,7 +1750,7 @@ function validateMarkFields(name, fields, value, markPath, errors, lenient = fal
 			message: `Mark "${name}" field "${key}" must be a non-empty string.`
 		});
 	}
-	for (const key of Object.keys(value)) if (!(key in fields)) {
+	for (const key of Object.keys(value)) if (!Object.hasOwn(fields, key)) {
 		if (!lenient) errors.push({
 			path: `${markPath}.${key}`,
 			message: `Unknown attribute "${key}" for mark "${name}".`
@@ -1757,20 +1774,20 @@ function validateMarks(blockType, marks, path, errors, lenient = false) {
 	}
 	const names = Object.keys(marks);
 	if (blockType === "code" && names.length > 0) {
-		if (!lenient || names.some((name) => name in MARK_REGISTRY)) errors.push({
+		if (!lenient || names.some((name) => isRegisteredMarkName(name))) errors.push({
 			path,
 			message: "Runs in a code block must not carry marks."
 		});
 	}
 	for (const name of names) {
-		const spec = MARK_REGISTRY[name];
-		if (!spec) {
+		if (!isRegisteredMarkName(name)) {
 			if (!lenient) errors.push({
 				path: `${path}.${name}`,
 				message: `Unknown mark "${name}".`
 			});
 			continue;
 		}
+		const spec = MARK_REGISTRY[name];
 		const markPath = `${path}.${name}`;
 		const value = marks[name];
 		if (spec.kind === "toggle") {
@@ -1819,7 +1836,7 @@ function validateMarks(blockType, marks, path, errors, lenient = false) {
 			});
 		}
 	}
-	const exclusive = names.find((name) => MARK_REGISTRY[name]?.exclusive);
+	const exclusive = names.find((name) => isRegisteredMarkName(name) && MARK_REGISTRY[name].exclusive);
 	if (exclusive && names.length > 1) errors.push({
 		path,
 		message: `A run with exclusive mark "${exclusive}" must not carry other marks.`
@@ -2439,13 +2456,14 @@ function markSetToAttrs(marks) {
 * A Y.Text attribute object as a `MarkSet` (mirrors the snapshot reader:
 * `true` toggles kept, object values reduced to their string fields). The
 * cross-minor stand: an unknown mark name is preserved (its fields pass
-* through as-is, not only the string ones) — the data is not lost on save,
-* the reader/renderer stand the text without it, the strict validator
-* rejects it. A known mark's unknown fields stand the same pass-through
-* (a future minor's additive field on a known mark, any value shape);
-* a known field keeps the string stand (a non-string value on a known
-* field is corrupt data — a future minor cannot change a known field's
-* contract — and is dropped protectively).
+* through as-is, not only the string ones), and a non-boolean primitive
+* value (a future minor's additive value shape) is kept as-is — the data
+* is not lost on save, the reader/renderer stand the text without it, the
+* strict validator rejects it. A known mark's unknown fields stand the
+* same pass-through (a future minor's additive field on a known mark, any
+* value shape); a known field keeps the string stand (a non-string value
+* on a known field is corrupt data — a future minor cannot change a known
+* field's contract — and is dropped protectively).
 */
 function attrsToMarkSet(attributes) {
 	const marks = {};
@@ -2461,7 +2479,7 @@ function attrsToMarkSet(attributes) {
 			setOwn(attrs, key, attrValue);
 		}
 		setOwn(marks, name, attrs);
-	}
+	} else setOwn(marks, name, value);
 	return marks;
 }
 /**
@@ -2491,6 +2509,20 @@ function exclusiveFreeSpans(content, from, to) {
 *  registry's fields), the parents' write, the full-document write, and the
 *  opaque block write (the cross-minor stand). */
 const isPlainObject$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** The layout's own top-level keys (the spec-gated writers + the CRDT
+*  owner field): everything else on a block entry is additive data of a
+*  future minor and stands the generic as-is write (the cross-minor stand). */
+const LAYOUT_BLOCK_KEYS = /* @__PURE__ */ new Set([
+	"type",
+	"attrs",
+	"geometry",
+	"content",
+	"children",
+	"rows",
+	"rowOrder",
+	"columnOrder",
+	"parent"
+]);
 /** Primitive attr values are stored directly; plain objects become nested Y.Maps, and arrays become Y.Arrays (array elements are stored as-is — the schema keeps them plain). */
 function writeAttrValue(target, key, value) {
 	if (value === void 0) return;
@@ -2584,6 +2616,10 @@ function writeBlock(blocks, id, block) {
 			}
 		}
 	}
+	for (const [key, value] of Object.entries(block)) {
+		if (LAYOUT_BLOCK_KEYS.has(key)) continue;
+		writeAttrValue(yblock, key, value);
+	}
 	blocks.set(id, yblock);
 }
 /**
@@ -2617,7 +2653,7 @@ function writeDocument(ydoc, json) {
 		for (const [id, block] of Object.entries(json.blocks)) {
 			const writable = block;
 			if (writable.type === "root") for (const childId of writable.children ?? []) rootOrder.push([childId]);
-			if (writable.type in BLOCK_REGISTRY) writeBlock(blocks, id, writable);
+			if (isRegisteredBlockType(writable.type)) writeBlock(blocks, id, writable);
 			else writeOpaqueBlock(blocks, id, block);
 		}
 		setParents(json, blocks);
@@ -2736,7 +2772,7 @@ function normalizeRuns(runs) {
 /** The read unit's value helpers: the known-type check, the order dedup, and
 *  the plain-value read. */
 function isKnownBlockType(value) {
-	return typeof value === "string" && Object.hasOwn(BLOCK_REGISTRY, value);
+	return isRegisteredBlockType(value);
 }
 /**
 * Read-side dedupe of an order array: duplicate entries can only arise from
@@ -2859,7 +2895,7 @@ function readOpaqueBlock(yblock, type) {
 		attrs.forEach((value, key) => entries.push([key, readPlainValue(value)]));
 		entries.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
 		const plain = {};
-		for (const [key, value] of entries) plain[key] = value;
+		for (const [key, value] of entries) setOwn(plain, key, value);
 		block.attrs = plain;
 	}
 	const geometry = yblock.get("geometry");
@@ -2964,7 +3000,7 @@ function readBlock(ydoc, id) {
 		const rows = {};
 		const rowsMap = yblock.get("rows");
 		if (rowsMap instanceof Y.Map) rowsMap.forEach((row, rowId) => {
-			rows[rowId] = row instanceof Y.Map ? readPlainValue(row) : {};
+			setOwn(rows, rowId, row instanceof Y.Map ? readPlainValue(row) : {});
 		});
 		const rowOrder = yblock.get("rowOrder");
 		const hasCells = (rowId) => rowsMap instanceof Y.Map && rowsMap.has(rowId);
@@ -2985,6 +3021,27 @@ function readBlock(ydoc, id) {
 			columnWidths: derived
 		};
 	}
+	const extra = [];
+	yblock.forEach((value, key) => {
+		if (typeof key === "string" && !LAYOUT_BLOCK_KEYS.has(key)) extra.push([key, value]);
+	});
+	extra.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+	for (const [key, value] of extra) {
+		if (value instanceof Y.Text) {
+			const raw = [];
+			for (const op of value.toDelta()) {
+				if (typeof op.insert !== "string") continue;
+				raw.push({
+					text: op.insert,
+					marks: attrsToMarkSet(op.attributes)
+				});
+			}
+			const runs = normalizeRuns(raw);
+			if (runs.length > 0) setOwn(block, key, runs);
+			continue;
+		}
+		setOwn(block, key, readPlainValue(value));
+	}
 	return block;
 }
 /**
@@ -3005,10 +3062,11 @@ function readBlockSnapshot(ydoc, id) {
 function toDocJSON(ydoc) {
 	const meta = readMeta(ydoc);
 	const blocks = {};
-	ydoc.getMap("blocks").forEach((_, id) => {
+	const ids = [...ydoc.getMap("blocks").keys()].sort();
+	for (const id of ids) {
 		const block = readBlockSnapshot(ydoc, id);
-		if (block) blocks[id] = block;
-	});
+		if (block) setOwn(blocks, id, block);
+	}
 	return {
 		...meta,
 		blocks
@@ -3037,7 +3095,7 @@ function blockTypeOf(ydoc, id) {
 	const block = getBlockMap(ydoc, id);
 	if (!block) return null;
 	const type = block.get("type");
-	return typeof type === "string" && type in BLOCK_REGISTRY ? type : null;
+	return isRegisteredBlockType(type) ? type : null;
 }
 /**
 * The block's raw children array; null when the block has none. The root
@@ -3100,7 +3158,7 @@ function findParentInArrays(ydoc, id) {
 	blocks.forEach((block, blockId) => {
 		if (parent !== null || !(block instanceof Y.Map)) return;
 		const type = block.get("type");
-		if (typeof type !== "string" || !(type in BLOCK_REGISTRY) || !BLOCK_REGISTRY[type].children) return;
+		if (!isRegisteredBlockType(type) || !BLOCK_REGISTRY[type].children) return;
 		const children = block.get("children");
 		if (children instanceof Y.Array && children.toArray().includes(id)) parent = blockId;
 	});
@@ -3511,7 +3569,7 @@ function changeBlockType(ydoc, generateId, id, type, attrs) {
 	const currentType = blockTypeOf(ydoc, id);
 	if (currentType === null) throw new UnknownBlockError(`Unknown block "${id}".`);
 	if (currentType === "root") throw new InvalidOperationError("The root block's type cannot be changed.");
-	if (!(type in BLOCK_REGISTRY)) throw new UnknownBlockTypeError(`Unknown block type "${String(type)}".`);
+	if (!isRegisteredBlockType(type)) throw new UnknownBlockTypeError(`Unknown block type "${String(type)}".`);
 	if (type === currentType) throw new InvalidOperationError(`Block "${id}" is already of type "${type}".`);
 	const from = BLOCK_REGISTRY[currentType];
 	const to = BLOCK_REGISTRY[type];
@@ -3538,8 +3596,8 @@ function changeBlockType(ydoc, generateId, id, type, attrs) {
 	const snapshot = readBlock(ydoc, id);
 	const currentAttrs = snapshot !== null && "attrs" in snapshot ? snapshot.attrs : void 0;
 	const merged = {};
-	for (const [key, value] of Object.entries(currentAttrs ?? {})) if (to.attrs !== void 0 && key in to.attrs) merged[key] = value;
-	for (const [key, value] of Object.entries(isPlainObject$1(attrs) ? attrs : {})) if (value !== void 0) merged[key] = value;
+	for (const [key, value] of Object.entries(currentAttrs ?? {})) if (to.attrs !== void 0 && Object.hasOwn(to.attrs, key)) setOwn(merged, key, value);
+	for (const [key, value] of Object.entries(isPlainObject$1(attrs) ? attrs : {})) if (value !== void 0) setOwn(merged, key, value);
 	if (to.attrs !== void 0) {
 		const errors = validateBlockAttrs(type, merged);
 		if (errors.length > 0) throw new InvalidAttrsError(`Invalid attrs for type "${type}" on block "${id}": ${formatValidationErrors(errors)}`);
@@ -3948,7 +4006,7 @@ function writeNewBlock(blocks, id, type, attrs) {
 }
 /** Inserts a new block under `at.parent` (default: root) after `at.after` (default: appended). */
 function insertBlock(ydoc, generateId, type, attrs, at) {
-	if (!(type in BLOCK_REGISTRY)) throw new UnknownBlockTypeError(`Unknown block type "${String(type)}".`);
+	if (!isRegisteredBlockType(type)) throw new UnknownBlockTypeError(`Unknown block type "${String(type)}".`);
 	if (type === "root") throw new InvalidOperationError("The root block already exists and cannot be inserted.");
 	const explicitId = at?.id;
 	if (explicitId !== void 0) {
@@ -4406,7 +4464,7 @@ function setMark(ydoc, blockId, from, to, mark) {
 }
 /** Removes `name` from the marks of the characters in [from, to); other marks stay. */
 function unsetMark(ydoc, blockId, from, to, name) {
-	if (!(name in MARK_REGISTRY)) throw new InvalidMarkError(`Unknown mark "${String(name)}".`);
+	if (!isRegisteredMarkName(name)) throw new InvalidMarkError(`Unknown mark "${String(name)}".`);
 	const { content } = requireTextBlock(ydoc, blockId);
 	const total = contentTextLength(content);
 	if (!Number.isInteger(from) || !Number.isInteger(to) || from < 0 || from > to || to > total) throw new InvalidRangeError(`Range must satisfy 0 <= from < to <= ${total} (got from=${from}, to=${to}).`);
@@ -4876,20 +4934,35 @@ function emitPending(ydoc, hub, isRemote) {
 		metaChanged: pending.metaChanged
 	}, isRemote);
 }
+/**
+* Run the handler with its throw isolated: a listener fires inside the
+* Yjs transaction (the afterTransaction hook), so a listener's throw must
+* not abort the remaining handlers of the emission nor roll back the
+* caller's committed batch (the `transact`'s rollback guard would catch
+* it otherwise). The throw stands the logged error; the emission
+* continues with the next handler.
+*/
+function safeCall(label, handler) {
+	try {
+		handler();
+	} catch (error) {
+		console.error(`docblocks: a ${label} handler threw — the emission continues`, error);
+	}
+}
 function emitChange(ydoc, change, isRemote) {
 	const hub = getHub(ydoc);
-	for (const handler of [...hub.changeHandlers]) handler(change);
-	if (isRemote) for (const handler of [...hub.remoteChangeHandlers]) handler(change);
+	for (const handler of [...hub.changeHandlers]) safeCall("change", () => handler(change));
+	if (isRemote) for (const handler of [...hub.remoteChangeHandlers]) safeCall("remote-change", () => handler(change));
 	for (const blockId of change.blockIds) {
 		const blockHandlers = hub.blockHandlers.get(blockId);
 		if (blockHandlers !== void 0 && blockHandlers.size > 0) {
 			const block = readBlock(ydoc, blockId);
-			if (block !== null) for (const handler of [...blockHandlers]) handler(block);
+			if (block !== null) for (const handler of [...blockHandlers]) safeCall("block", () => handler(block));
 		}
 		const textHandlers = hub.textHandlers.get(blockId);
 		if (textHandlers !== void 0 && textHandlers.size > 0) {
 			const text = readText(ydoc, blockId);
-			for (const handler of [...textHandlers]) handler(text);
+			for (const handler of [...textHandlers]) safeCall("text", () => handler(text));
 		}
 	}
 }
@@ -5949,6 +6022,9 @@ var Doc = class Doc {
 	* propagates. A failed batch still emits a transient `onChange` emission
 	* and a partial wire update before the rollback (CRDT property: the
 	* rollback is best-effort on the wire; observable state converges).
+	* A subscription handler's throw (the handlers fire inside the
+	* transaction) is isolated — it stands the logged error and never rolls
+	* back a committed batch.
 	*/
 	transact(fn) {
 		const ydoc = this.#ydoc;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "docblocks-core",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Headless CRDT document engine: schema v1, Doc (commands/transactions/undo), sync providers. Yjs-based, zero UI dependencies.",
   "type": "module",
   "license": "MIT",