edytor 0.1.0-next.41 → 0.1.0-next.43

package/README.md

@@ -10,13 +10,14 @@
 <p>
     <a href="https://edytor.dev/docs">Documentation</a> •
     <a href="#quick-start">Quick start</a> •
-    <a href="https://edytor.dev/docs/reference/migration">Changelog</a>
+    <a href="https://edytor.dev/docs/reference/migration">Changelog</a> •
+    <a href="SECURITY.md">Security</a>
   </p>
 </div>
 
 Edytor aims to be for Svelte what Slate.js is for React: a heavily customizable editor with an API to build any kind of collaborative rich text editor.
 
-> **Work in progress.** Edytor is a pre-release (`0.1.0-next.41`, `edytor@next` on npm) and not ready for production; the API changes between releases without a compatibility layer. The untagged `edytor@0.0.11` on npm predates the current API. Issues and PRs are welcome: when you report a bug, include the document's JSON value.
+> **Work in progress.** Edytor is a pre-release (`0.1.0-next.43`, `edytor@next` on npm) and not ready for production; the API changes between releases without a compatibility layer. The untagged `edytor@0.0.11` on npm predates the current API. Issues and PRs are welcome: when you report a bug, include the document's JSON value.
 
 ## Features
 

package/dist/cloudflare/DocumentRoom.d.ts

@@ -278,6 +278,10 @@ export type DocumentRoomEnv = {
     EDYTOR_ROOMS?: MoveNamespace;
     /** `off`: the room keeps no comment threads (its comments requests answer `404`). */
     EDYTOR_COMMENTS?: string;
+    /** The bytes the room's comments may hold ({@link CommentOptions.maxBytes}). */
+    EDYTOR_MAX_COMMENT_BYTES?: string | number;
+    /** Comment requests per second ({@link CommentOptions.maxRequestsPerSecond}). */
+    EDYTOR_MAX_COMMENT_REQUESTS_PER_SECOND?: string | number;
 };
 /** What a socket is bound to: its verified user, its replica (Yjs client id), its access. */
 export type SocketIdentity = {
@@ -300,7 +304,7 @@ export type Attachment = SocketIdentity & {
     comments?: boolean;
 };
 export type Refusal = {
-    reason: 'generation' | 'schema' | 'malformed' | 'container' | 'identity' | 'replica' | 'read-only' | 'waiting' | 'storage' | 'internal' | 'quota' | 'access' | 'presence' | 'mark' | 'forged' | 'denied' | 'orphan' | 'relayed' | 'history';
+    reason: 'generation' | 'schema' | 'malformed' | 'container' | 'identity' | 'replica' | 'read-only' | 'waiting' | 'storage' | 'internal' | 'quota' | 'access' | 'presence' | 'comments' | 'mark' | 'forged' | 'denied' | 'orphan' | 'relayed' | 'history';
     detail: unknown;
 };
 /** A duration series: how many, their total and longest (ms; see {@link RoomMetrics}). */
@@ -490,7 +494,26 @@ export type CommentOptions = {
     onComment?: (change: CommentChange) => void | Promise<void>;
     /** The longest comment body (default and ceiling 10,000 characters). */
     maxLength?: number;
+    /**
+     * The bytes the room's comments may hold (default
+     * {@link DEFAULT_MAX_COMMENT_BYTES}, 4 MiB): each body and quote in UTF-8
+     * plus 128 a comment. A thread or reply past it is refused `413`; a
+     * delete frees its bytes.
+     */
+    maxBytes?: number;
+    /**
+     * Comment requests per second (default
+     * {@link DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND}, a ten-second burst):
+     * over HTTP per verified user (past it, `429`), and a socket's comment
+     * messages per socket (past it, dropped). RPC calls are the host's own and
+     * are not counted.
+     */
+    maxRequestsPerSecond?: number;
 };
+/** The bytes a room's comments hold at most, by default (4 MiB). */
+export declare const DEFAULT_MAX_COMMENT_BYTES: number;
+/** Comment requests per second and user (or socket), by default. */
+export declare const DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND = 2;
 /** What {@link attachRoom} (and `DocumentRoom`) takes. */
 export type AttachRoomOptions = {
     /**

package/dist/cloudflare/DocumentRoom.js

@@ -242,6 +242,10 @@ export const noTimers = (fn) => {
         [g.setTimeout, g.setInterval] = saved;
     }
 };
+/** The bytes a room's comments hold at most, by default (4 MiB). */
+export const DEFAULT_MAX_COMMENT_BYTES = 4 * 1024 * 1024;
+/** Comment requests per second and user (or socket), by default. */
+export const DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND = 2;
 /** `EDYTOR_PURGE_AFTER_DAYS`: `off` (or `false`) never purges; a number of days; anything else the default. */
 const purgeAfterDays = (value) => {
     if (value === 'off' || value === 'false' || value === false)
@@ -703,7 +707,11 @@ export class DocumentRoom extends DurableObject {
         const locks = () => this.locks();
         const comments = () => String(knobs.EDYTOR_COMMENTS ?? '') === 'off'
             ? false
-            : { onComment: (change) => this.onComment(change) };
+            : {
+                onComment: (change) => this.onComment(change),
+                maxBytes: Number(knobs.EDYTOR_MAX_COMMENT_BYTES),
+                maxRequestsPerSecond: Number(knobs.EDYTOR_MAX_COMMENT_REQUESTS_PER_SECOND)
+            };
         this.room = new AttachedDocument(ctx, {
             maxRowBytes: Number(knobs.EDYTOR_MAX_ROW_BYTES),
             maxFrameBytes: Number(knobs.EDYTOR_MAX_FRAME_BYTES),

package/dist/cloudflare/index.d.ts

@@ -4,10 +4,10 @@
  * `cloudflare:workers`); built on the Worker-safe CRDT entry. Documented in
  * the site's `server/` section (room, authorization, extending, protocol).
  */
-export { DocumentRoom, AttachedDocument, attachRoom, SOCKET_TAG, closedSocket, type AttachRoomOptions, type CommentOptions, DEFAULT_COMPACT_AFTER, DEFAULT_MAX_ROW_BYTES, DEFAULT_SAVE_AFTER, DEFAULT_MAX_DOCUMENT_BYTES, DEFAULT_MAX_INBOUND_FRAME_BYTES, DEFAULT_MAX_BUFFERED_BYTES, DEFAULT_MAX_UPDATES_PER_SECOND, DEFAULT_MAX_PRESENCE_BYTES, DEFAULT_MAX_PRESENCE_PER_SECOND, DEFAULT_MAX_PRESENCE_FANOUT, MAX_REFUSALS, MAX_WAITING_DELETES, ROOM_ORIGIN, RESTORE_ORIGIN, PURGE_ORIGIN, IDENTITY_HEADERS, PROBE_HEADER, noTimers, type Attachment, type DocumentRoomEnv, type LoadedDocument, type Refusal, type ReplicaOwner, type SavedDocument, type SocketIdentity, type StoredRecord, type FrameValidation, type ValidatedBlock, type RoomMetrics, type RoomLogEntry, type RestoreResult, type Timing } from './DocumentRoom.js';
+export { DocumentRoom, AttachedDocument, attachRoom, SOCKET_TAG, closedSocket, type AttachRoomOptions, type CommentOptions, DEFAULT_COMPACT_AFTER, DEFAULT_MAX_ROW_BYTES, DEFAULT_SAVE_AFTER, DEFAULT_MAX_DOCUMENT_BYTES, DEFAULT_MAX_INBOUND_FRAME_BYTES, DEFAULT_MAX_BUFFERED_BYTES, DEFAULT_MAX_UPDATES_PER_SECOND, DEFAULT_MAX_PRESENCE_BYTES, DEFAULT_MAX_PRESENCE_PER_SECOND, DEFAULT_MAX_PRESENCE_FANOUT, DEFAULT_MAX_COMMENT_BYTES, DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND, MAX_REFUSALS, MAX_WAITING_DELETES, ROOM_ORIGIN, RESTORE_ORIGIN, PURGE_ORIGIN, IDENTITY_HEADERS, PROBE_HEADER, noTimers, type Attachment, type DocumentRoomEnv, type LoadedDocument, type Refusal, type ReplicaOwner, type SavedDocument, type SocketIdentity, type StoredRecord, type FrameValidation, type ValidatedBlock, type RoomMetrics, type RoomLogEntry, type RestoreResult, type Timing } from './DocumentRoom.js';
 export { DEFAULT_RETENTION_DAYS, HISTORY_MAX_VALUE_BYTES, R2_HISTORY_MAX_VALUE_BYTES, ROOM_HISTORY_MAX_BYTES, ROOM_HISTORY_MAX_VALUE_BYTES, kvHistory, r2History, roomHistory, type HistoryEntry, type HistoryMetadata, type HistoryOptions, type HistoryRoomStorage, type HistoryStore, type HistoryStoreFactory, type HistoryStoreRecord, type KVLike, type R2BucketLike } from './history.js';
 export { type PurgeReport } from '../crdt/purge.js';
-export { COMMENT_STATUS, MAX_COMMENT_LENGTH, MAX_COMMENTS_PER_THREAD, MAX_THREADS, commentAnchors, decideComment, type ThreadComment, type CommentActor, type CommentChange, type CommentOutcome, type CommentRefusal, type CommentRequest, type CommentRun, type CommentSnapshot, type CommentThread } from '../crdt/protocols/comments.js';
+export { COMMENT_ROW_BYTES, COMMENT_STATUS, MAX_COMMENT_LENGTH, MAX_COMMENTS_PER_THREAD, MAX_THREADS, commentAnchors, commentBytes, decideComment, type ThreadComment, type CommentActor, type CommentChange, type CommentOutcome, type CommentRefusal, type CommentRequest, type CommentRun, type CommentSnapshot, type CommentThread } from '../crdt/protocols/comments.js';
 export { lockedBlocks, type LockOptions } from './locks.js';
 export { moveBlocksBetweenRooms, forwardLateEdits, DEFAULT_MOVE_GRACE_DAYS, type CommitResult, type ExportedBlocks, type ImportReceipt, type ImportRequest, type LateEdit, type LateEditBatch, type MoveDestination, type MovedState, type MoveNamespace, type MoveRoom } from './move.js';
 export { routeDocumentSocket, routeDocumentHistory, routeDocumentComments, requestedReplica, type AuthorizeDocumentSocket, type ExpiredCredential, type DocumentNamespace, type DocumentIdentity, type RouteDocumentOptions } from './routeDocumentSocket.js';

package/dist/cloudflare/index.js

@@ -4,10 +4,10 @@
  * `cloudflare:workers`); built on the Worker-safe CRDT entry. Documented in
  * the site's `server/` section (room, authorization, extending, protocol).
  */
-export { DocumentRoom, AttachedDocument, attachRoom, SOCKET_TAG, closedSocket, DEFAULT_COMPACT_AFTER, DEFAULT_MAX_ROW_BYTES, DEFAULT_SAVE_AFTER, DEFAULT_MAX_DOCUMENT_BYTES, DEFAULT_MAX_INBOUND_FRAME_BYTES, DEFAULT_MAX_BUFFERED_BYTES, DEFAULT_MAX_UPDATES_PER_SECOND, DEFAULT_MAX_PRESENCE_BYTES, DEFAULT_MAX_PRESENCE_PER_SECOND, DEFAULT_MAX_PRESENCE_FANOUT, MAX_REFUSALS, MAX_WAITING_DELETES, ROOM_ORIGIN, RESTORE_ORIGIN, PURGE_ORIGIN, IDENTITY_HEADERS, PROBE_HEADER, noTimers } from './DocumentRoom.js';
+export { DocumentRoom, AttachedDocument, attachRoom, SOCKET_TAG, closedSocket, DEFAULT_COMPACT_AFTER, DEFAULT_MAX_ROW_BYTES, DEFAULT_SAVE_AFTER, DEFAULT_MAX_DOCUMENT_BYTES, DEFAULT_MAX_INBOUND_FRAME_BYTES, DEFAULT_MAX_BUFFERED_BYTES, DEFAULT_MAX_UPDATES_PER_SECOND, DEFAULT_MAX_PRESENCE_BYTES, DEFAULT_MAX_PRESENCE_PER_SECOND, DEFAULT_MAX_PRESENCE_FANOUT, DEFAULT_MAX_COMMENT_BYTES, DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND, MAX_REFUSALS, MAX_WAITING_DELETES, ROOM_ORIGIN, RESTORE_ORIGIN, PURGE_ORIGIN, IDENTITY_HEADERS, PROBE_HEADER, noTimers } from './DocumentRoom.js';
 export { DEFAULT_RETENTION_DAYS, HISTORY_MAX_VALUE_BYTES, R2_HISTORY_MAX_VALUE_BYTES, ROOM_HISTORY_MAX_BYTES, ROOM_HISTORY_MAX_VALUE_BYTES, kvHistory, r2History, roomHistory } from './history.js';
 export {} from '../crdt/purge.js';
-export { COMMENT_STATUS, MAX_COMMENT_LENGTH, MAX_COMMENTS_PER_THREAD, MAX_THREADS, commentAnchors, decideComment } from '../crdt/protocols/comments.js';
+export { COMMENT_ROW_BYTES, COMMENT_STATUS, MAX_COMMENT_LENGTH, MAX_COMMENTS_PER_THREAD, MAX_THREADS, commentAnchors, commentBytes, decideComment } from '../crdt/protocols/comments.js';
 export { lockedBlocks } from './locks.js';
 export { moveBlocksBetweenRooms, forwardLateEdits, DEFAULT_MOVE_GRACE_DAYS } from './move.js';
 export { routeDocumentSocket, routeDocumentHistory, routeDocumentComments, requestedReplica } from './routeDocumentSocket.js';

package/dist/cloudflare/room/admission.d.ts

@@ -2,16 +2,21 @@ import { type RoomContext } from './context.js';
 /** The provider's keepalive text frame, and the room's answer. */
 export declare const PING = "ping";
 export declare const PONG = "pong";
-/** Each socket's allowance (a token bucket; memory: a wake refills it). */
-export type Allowances = WeakMap<WebSocket, {
+/** A token bucket: its tokens, refilled since `at` (ms). */
+export type Bucket = {
     tokens: number;
     at: number;
-}>;
+};
+/** Each socket's allowance (a token bucket; memory: a wake refills it). */
+export type Allowances = WeakMap<WebSocket, Bucket>;
 /**
- * A token bucket per socket, refilled at `perSecond` up to ten seconds'
- * worth: takes one token. `false`: over the rate.
+ * A token bucket per key (a socket, a user), refilled at `perSecond` up to
+ * ten seconds' worth: takes one token. `false`: over the rate.
  */
-export declare const allowance: (allowances: Allowances, ws: WebSocket, perSecond: number) => boolean;
+export declare const allowance: <K>(allowances: {
+    get(key: K): Bucket | undefined;
+    set(key: K, bucket: Bucket): unknown;
+}, key: K, perSecond: number, now?: number) => boolean;
 export declare class Admission {
     private readonly room;
     /** Each socket's update allowance. */

package/dist/cloudflare/room/admission.js

@@ -32,19 +32,18 @@ export const PONG = 'pong';
 /** Seconds of the update rate a socket may spend at once. */
 const BURST_SECONDS = 10;
 /**
- * A token bucket per socket, refilled at `perSecond` up to ten seconds'
- * worth: takes one token. `false`: over the rate.
+ * A token bucket per key (a socket, a user), refilled at `perSecond` up to
+ * ten seconds' worth: takes one token. `false`: over the rate.
  */
-export const allowance = (allowances, ws, perSecond) => {
-    const now = Date.now();
+export const allowance = (allowances, key, perSecond, now = Date.now()) => {
     const burst = perSecond * BURST_SECONDS;
-    const held = allowances.get(ws) ?? { tokens: burst, at: now };
-    const tokens = Math.min(burst, held.tokens + ((now - held.at) / 1000) * perSecond);
+    const held = allowances.get(key) ?? { tokens: burst, at: now };
+    const tokens = Math.min(burst, held.tokens + (Math.max(0, now - held.at) / 1000) * perSecond);
     if (tokens < 1) {
-        allowances.set(ws, { tokens, at: now });
+        allowances.set(key, { tokens, at: now });
         return false;
     }
-    allowances.set(ws, { tokens: tokens - 1, at: now });
+    allowances.set(key, { tokens: tokens - 1, at: now });
     return true;
 };
 /** A chunk sequence the room does not take at its start: past the rate, or past the room's buffer. */

package/dist/cloudflare/room/comments.d.ts

@@ -9,12 +9,16 @@
 import * as E from '../../crdt/protocol.js';
 import { type CommentActor, type CommentOutcome, type CommentRequest, type CommentSnapshot } from '../../crdt/protocols/comments.js';
 import { type Attachment, type SocketIdentity } from '../DocumentRoom.js';
-import type { RoomContext } from './context.js';
+import { type RoomContext } from './context.js';
 /** The largest request body `routeDocumentComments` forwards, in bytes. */
 export declare const MAX_COMMENT_REQUEST_BYTES: number;
 export declare class RoomComments {
     private readonly room;
     private ready;
+    /** Each verified user's HTTP request allowance (memory: a wake refills it). */
+    private readonly users;
+    /** Each socket's comment message allowance. */
+    private readonly sockets;
     constructor(room: RoomContext);
     /** Comments are on unless the room's `comments` option is `false`. */
     get enabled(): boolean;
@@ -28,6 +32,16 @@ export declare class RoomComments {
     private seq;
     /** One thread as stored, or `null`. */
     private read;
+    /**
+     * The bytes the comments hold, as the byte quota counts them
+     * (`commentBytes`: each body and quote in UTF-8, plus a row's cost).
+     */
+    private bytes;
+    /**
+     * Whether `key` (a user over HTTP, a socket) is within the comment
+     * rate; past it the room notes it (`comments`, `quota: 'rate'`).
+     */
+    private allow;
     /** Every thread, oldest first, with the last sequence number. */
     list(): CommentSnapshot;
     /** Store `change` (one SQLite transaction with its sequence number). */
@@ -46,7 +60,9 @@ export declare class RoomComments {
      * A socket's comment message (`messageComments`): a subscribe marks its
      * attachment (it survives hibernation) and is answered with every
      * thread; an unsubscribe clears it. Any other comment message from a
-     * client is malformed. Subscribes share the socket's presence rate.
+     * client is malformed. A subscribe while subscribed answers nothing; a
+     * socket's comment messages past the comment rate are dropped (its
+     * subscription unchanged), the socket stays.
      */
     onMessage(ws: WebSocket, attachment: Attachment, decoder: E.Decoder): void;
     /**

package/dist/cloudflare/room/comments.js

@@ -7,13 +7,17 @@
  * may do what) are `crdt/protocols/comments.ts`, shared with the clients.
  */
 import * as E from '../../crdt/protocol.js';
-import { COMMENT_MARK, COMMENT_STATUS, commentAnchors, decideComment, parseCommentRequest, validCommentId } from '../../crdt/protocols/comments.js';
-import { SOCKET_TAG, noTimers } from '../DocumentRoom.js';
+import { COMMENT_MARK, COMMENT_ROW_BYTES, COMMENT_STATUS, commentAnchors, decideComment, OVER_BYTE_QUOTA, parseCommentRequest, validCommentId } from '../../crdt/protocols/comments.js';
+import { DEFAULT_MAX_COMMENT_BYTES, DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND, SOCKET_TAG, noTimers } from '../DocumentRoom.js';
+import { allowance } from './admission.js';
+import { knob } from './context.js';
 import { decode } from './frames.js';
 /** The `meta` key holding the comments' last sequence number. */
 const SEQ_KEY = 'comments';
 /** The largest request body `routeDocumentComments` forwards, in bytes. */
 export const MAX_COMMENT_REQUEST_BYTES = 64 * 1024;
+/** The users whose request rate the room tracks at once (the oldest is forgotten past it). */
+const MAX_RATE_USERS = 1_000;
 const threadOf = (row, comments) => ({
     id: row.id,
     block: row.block,
@@ -35,6 +39,10 @@ const commentOf = (row) => ({
 export class RoomComments {
     room;
     ready = false;
+    /** Each verified user's HTTP request allowance (memory: a wake refills it). */
+    users = new Map();
+    /** Each socket's comment message allowance. */
+    sockets = new WeakMap();
     constructor(room) {
         this.room = room;
     }
@@ -95,6 +103,32 @@ export class RoomComments {
             .map(commentOf);
         return threadOf(row, comments);
     }
+    /**
+     * The bytes the comments hold, as the byte quota counts them
+     * (`commentBytes`: each body and quote in UTF-8, plus a row's cost).
+     */
+    bytes() {
+        const { sql, tables } = this.room;
+        const comments = sql
+            .exec(`SELECT SUM(LENGTH(CAST(body AS BLOB))) AS bytes, COUNT(*) AS n FROM ${tables.comments}`)
+            .one();
+        const quotes = sql
+            .exec(`SELECT SUM(LENGTH(CAST(quote AS BLOB))) AS bytes FROM ${tables.threads}`)
+            .one().bytes ?? 0;
+        return (comments.bytes ?? 0) + quotes + comments.n * COMMENT_ROW_BYTES;
+    }
+    /**
+     * Whether `key` (a user over HTTP, a socket) is within the comment
+     * rate; past it the room notes it (`comments`, `quota: 'rate'`).
+     */
+    allow(buckets, key, user) {
+        const room = this.room;
+        const limit = limitsOf(room).maxRequestsPerSecond;
+        if (allowance(buckets, key, limit, room.clock()))
+            return true;
+        room.note({ reason: 'comments', detail: { user, quota: 'rate', limit } });
+        return false;
+    }
     /** Every thread, oldest first, with the last sequence number. */
     list() {
         if (!this.enabled)
@@ -158,13 +192,21 @@ export class RoomComments {
             const threads = request.op === 'add'
                 ? sql.exec(`SELECT COUNT(*) AS n FROM ${tables.threads}`).one().n
                 : 0;
+            const maxBytes = limitsOf(room).maxBytes;
             const decided = decideComment(request, actor, {
                 thread,
                 threads,
                 now: room.clock(),
                 seq: this.seq() + 1,
-                maxLength: commentsOptions(room).maxLength
+                maxLength: commentsOptions(room).maxLength,
+                bytes: request.op === 'add' || request.op === 'reply' ? this.bytes() : undefined,
+                maxBytes
             });
+            if (decided.status === 'refused' && decided.message === OVER_BYTE_QUOTA)
+                room.note({
+                    reason: 'comments',
+                    detail: { user: actor.user, quota: 'bytes', limit: maxBytes }
+                });
             if (decided.status !== 'applied')
                 return decided;
             this.store(decided.change);
@@ -232,7 +274,9 @@ export class RoomComments {
      * A socket's comment message (`messageComments`): a subscribe marks its
      * attachment (it survives hibernation) and is answered with every
      * thread; an unsubscribe clears it. Any other comment message from a
-     * client is malformed. Subscribes share the socket's presence rate.
+     * client is malformed. A subscribe while subscribed answers nothing; a
+     * socket's comment messages past the comment rate are dropped (its
+     * subscription unchanged), the socket stays.
      */
     onMessage(ws, attachment, decoder) {
         const room = this.room;
@@ -240,10 +284,11 @@ export class RoomComments {
         if (message.type !== 'subscribe') {
             return room.refuse(ws, { reason: 'malformed', detail: `comment message ${message.type}` });
         }
-        if (!room.presence.allow(ws))
-            return room.presence.overRate(ws, attachment);
+        if (!this.allow(this.sockets, ws, attachment.user))
+            return;
+        const was = attachment.comments === true;
         ws.serializeAttachment({ ...attachment, comments: message.on });
-        if (!message.on)
+        if (!message.on || was)
             return;
         const snapshot = this.list();
         room.send(ws, E.frame(E.messageComments, (e) => E.writeCommentsSnapshot(e, snapshot)));
@@ -257,6 +302,11 @@ export class RoomComments {
     async request(op, identity, body) {
         if (!this.enabled)
             return new Response('no comments', { status: 404 });
+        const users = this.users;
+        if (!users.has(identity.user) && users.size >= MAX_RATE_USERS)
+            users.delete(users.keys().next().value);
+        if (!this.allow(users, identity.user, identity.user))
+            return new Response('too many comment requests', { status: 429 });
         try {
             if (op === 'list')
                 return Response.json(this.list());
@@ -291,3 +341,11 @@ const commentsOptions = (room) => {
     const options = room.options.comments;
     return options === false || options === undefined ? {} : options;
 };
+/** The room's comment quotas, defaults applied. */
+const limitsOf = (room) => {
+    const options = commentsOptions(room);
+    return {
+        maxBytes: knob(options.maxBytes, DEFAULT_MAX_COMMENT_BYTES, 128 * 1024 * 1024),
+        maxRequestsPerSecond: knob(options.maxRequestsPerSecond, DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND, 1_000)
+    };
+};

package/dist/cloudflare/room/context.d.ts

@@ -56,7 +56,7 @@ export declare const crdt: {
         SchemaMismatchError: typeof E.SchemaMismatchError;
         create: (doc: E.EngineDoc, config?: import("../../crdt/edytor-doc.js").EdytorDocConfig) => {
             prepare: {
-                insertFlow: (target: import("../../crdt/flow.js").FlowTarget, flow: import("../../crdt/flow.js").Flow, view?: import("../../crdt/flow.js").FlowView) => import("../../index.js").Prepared;
+                insertFlow: (target: import("../../index.js").FlowTarget, flow: import("../../index.js").Flow, view?: import("../../crdt/flow.js").FlowView) => import("../../index.js").Prepared;
                 deleteRange: (from: import("../../crdt/rangeDelete.js").DocPosition, to: import("../../crdt/rangeDelete.js").DocPosition, view?: import("../../crdt/rangeDelete.js").RangeView) => import("../../index.js").Prepared;
                 replaceRange: (from: import("../../crdt/rangeDelete.js").DocPosition, to: import("../../crdt/rangeDelete.js").DocPosition, view?: import("../../crdt/rangeDelete.js").RangeView) => import("../../index.js").Prepared;
                 insertTableRow: (table: import("../../crdt/index.js").BlockId, index: number) => import("../../index.js").Prepared;
@@ -93,7 +93,7 @@ export declare const crdt: {
                     children?: import("../../crdt/index.js").BlockSpec[];
                 }) => import("../../index.js").Prepared;
                 setBlockType: (id: import("../../crdt/index.js").BlockId, type: string) => import("../../index.js").Prepared;
-                patchData: (target: import("../../crdt/edytor-doc.js").DataTarget, patches: readonly import("../../crdt/data.js").DataPatch[]) => import("../../index.js").Prepared;
+                patchData: (target: import("../../crdt/edytor-doc.js").DataTarget, patches: readonly import("../../index.js").DataPatch[]) => import("../../index.js").Prepared;
                 setBlockData: (id: import("../../crdt/index.js").BlockId, data: Record<string, unknown>) => import("../../index.js").Prepared;
                 duplicateBlock: (id: import("../../crdt/index.js").BlockId, freshId: (oldId: string, kind: "block" | "inline") => string) => import("../../index.js").Prepared;
                 insertText: (id: import("../../crdt/index.js").BlockId, offset: number, text: string, marks?: Record<string, unknown>) => import("../../index.js").Prepared;
@@ -180,7 +180,7 @@ export declare const crdt: {
             runsView: import("../../crdt/text/runs.js").RunView;
             version: number;
             block: (id: import("../../crdt/index.js").BlockId) => import("../../crdt/nodes.js").DocBlock;
-            insertFlow: (target: import("../../crdt/flow.js").FlowTarget, flow: import("../../crdt/flow.js").Flow, view?: import("../../crdt/flow.js").FlowView | undefined) => import("../../index.js").OpResult;
+            insertFlow: (target: import("../../index.js").FlowTarget, flow: import("../../index.js").Flow, view?: import("../../crdt/flow.js").FlowView | undefined) => import("../../index.js").OpResult;
             deleteRange: (from: import("../../crdt/rangeDelete.js").DocPosition, to: import("../../crdt/rangeDelete.js").DocPosition, view?: import("../../crdt/rangeDelete.js").RangeView | undefined) => import("../../index.js").OpResult;
             replaceRange: (from: import("../../crdt/rangeDelete.js").DocPosition, to: import("../../crdt/rangeDelete.js").DocPosition, view?: import("../../crdt/rangeDelete.js").RangeView | undefined) => import("../../index.js").OpResult;
             insertTableRow: (table: string, index: number) => import("../../index.js").OpResult;
@@ -217,7 +217,7 @@ export declare const crdt: {
                 children?: import("../../crdt/index.js").BlockSpec[];
             }) => import("../../index.js").OpResult;
             setBlockType: (id: string, type: string) => import("../../index.js").OpResult;
-            patchData: (target: import("../../crdt/edytor-doc.js").DataTarget, patches: readonly import("../../crdt/data.js").DataPatch[]) => import("../../index.js").OpResult;
+            patchData: (target: import("../../crdt/edytor-doc.js").DataTarget, patches: readonly import("../../index.js").DataPatch[]) => import("../../index.js").OpResult;
             setBlockData: (id: string, data: Record<string, unknown>) => import("../../index.js").OpResult;
             duplicateBlock: (id: string, freshId: (oldId: string, kind: "block" | "inline") => string) => import("../../index.js").OpResult;
             insertText: (id: string, offset: number, text: string, marks?: Record<string, unknown> | undefined) => import("../../index.js").OpResult;
@@ -263,7 +263,7 @@ export declare const crdt: {
             blockDataOf: (id: string) => Record<string, unknown> | undefined;
             docData: () => import("../../crdt/doc/types.js").JsonObj;
             dataItemIds: (target: import("../../crdt/edytor-doc.js").DataTarget, path: readonly string[]) => string[];
-            blockAttribution: (id: string) => import("../../crdt/index.js").BlockAttribution | undefined;
+            blockAttribution: (id: string) => import("../../index.js").BlockAttribution | undefined;
             crdtId: (id: string) => string | null;
             resolveBlock: (id: string) => E.EngineNode | null;
             displayLength: (id: string) => number;
@@ -274,12 +274,12 @@ export declare const crdt: {
             compare: (a: import("../../crdt/index.js").BlockId, b: import("../../crdt/index.js").BlockId) => number;
             next: (id: string, policy?: import("../../crdt/edytor-doc.js").OrderPolicy | undefined) => string | null;
             previous: (id: string, policy?: import("../../crdt/edytor-doc.js").OrderPolicy | undefined) => string | null;
-            anchorAt: (id: string, offset: number, affinity?: import("../../crdt/edytor-doc.js").AnchorAffinity | undefined) => import("../../crdt/edytor-doc.js").DocAnchor | null;
-            resolveAnchor: (anchor: import("../../crdt/edytor-doc.js").DocAnchor) => {
+            anchorAt: (id: string, offset: number, affinity?: import("../../index.js").AnchorAffinity | undefined) => import("../../index.js").DocAnchor | null;
+            resolveAnchor: (anchor: import("../../index.js").DocAnchor) => {
                 blockId: import("../../crdt/index.js").BlockId;
                 offset: number;
             } | null;
-            followUndo: (anchor: import("../../crdt/edytor-doc.js").DocAnchor) => import("../../crdt/edytor-doc.js").DocAnchor;
+            followUndo: (anchor: import("../../index.js").DocAnchor) => import("../../index.js").DocAnchor;
             rolesChanged: () => void;
             isVoid: (id: string) => boolean;
             isIsland: (id: string) => boolean;
@@ -404,9 +404,9 @@ export declare const crdt: {
         };
     };
     providers: {
-        prefetch: (options: import("../../crdt/index.js").PrefetchOptions) => Promise<import("../../crdt/index.js").PrefetchResult>;
-        lastUpdated: (options: import("../../crdt/index.js").LastUpdatedOptions) => Promise<number | null>;
-        documentSnapshot: (options: import("../../crdt/index.js").LastUpdatedOptions) => Promise<JSONDoc | null>;
+        prefetch: (options: import("../../index.js").PrefetchOptions) => Promise<import("../../index.js").PrefetchResult>;
+        lastUpdated: (options: import("../../index.js").LastUpdatedOptions) => Promise<number | null>;
+        documentSnapshot: (options: import("../../index.js").LastUpdatedOptions) => Promise<JSONDoc | null>;
         IndexeddbPersistence: {
             new (name: string, doc: YDoc, options?: E.IndexeddbPersistenceOptions): {
                 doc: YDoc;
@@ -627,7 +627,7 @@ export declare const crdt: {
     };
     attribution: {
         attach: (doc: E.EngineDoc, opts: {
-            actor: import("../../crdt/index.js").AttributionActor;
+            actor: import("../../index.js").AttributionActor;
         }) => import("../../crdt/index.js").AttributionController;
     };
 };
@@ -671,7 +671,7 @@ export declare const tally: (t: Timing, ms: number) => void;
 export declare const encodeJSON: (value: unknown) => Uint8Array<ArrayBuffer>;
 /** A semantics config as the facade's lookups — own keys only: block types come off the wire. */
 declare const lookups: (semantics: DocumentSemanticsConfig) => {
-    roleOf: (type: string) => import("../../crdt/edytor-doc.js").BlockRole | undefined;
+    roleOf: (type: string) => import("../../index.js").BlockRole | undefined;
     kinds: () => string[];
     defaultChildOf: (type: string) => string | undefined;
     rendersContent: (type: string) => boolean;

package/dist/cloudflare/routeDocumentSocket.d.ts

@@ -88,7 +88,8 @@ export declare function routeDocumentHistory(request: Request, rooms: DocumentNa
  * write, another user's comment, an `Origin` that `options.allowedOrigins`
  * does not list), `404` (no such thread or comment, or the room keeps no
  * comments), `405` (another method), `409` (a thread or comment id taken),
- * `413` (a body over 64 KiB, or too many threads or comments).
+ * `413` (a body over 64 KiB, too many threads or comments, or the room's
+ * comment bytes full), `429` (the user past the room's comment rate).
  */
 export declare function routeDocumentComments(request: Request, rooms: DocumentNamespace, documentId: string, authorize: AuthorizeDocumentSocket, options?: RouteDocumentOptions): Promise<Response>;
 export declare function routeDocumentSocket(request: Request, rooms: DocumentNamespace, documentId: string, authorize: AuthorizeDocumentSocket, options?: RouteDocumentOptions): Promise<Response>;

package/dist/cloudflare/routeDocumentSocket.js

@@ -141,6 +141,35 @@ export async function routeDocumentHistory(request, rooms, documentId, authorize
     }
     return rooms.getByName(documentId).fetch(new Request(request.url, { method: 'GET', headers }));
 }
+/**
+ * A request's body as text, read no further than `max` bytes (`null`: it
+ * holds more, its declared length or not).
+ */
+const bodyWithin = async (request, max) => {
+    if (request.body === null)
+        return '';
+    const reader = request.body.getReader();
+    const chunks = [];
+    let length = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        length += value.byteLength;
+        if (length > max) {
+            await reader.cancel().catch(() => { });
+            return null;
+        }
+        chunks.push(value);
+    }
+    const bytes = new Uint8Array(length);
+    let at = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, at);
+        at += chunk.byteLength;
+    }
+    return new TextDecoder().decode(bytes);
+};
 /**
  * The host Worker's door to a document's comment threads, authorized as
  * {@link routeDocumentSocket} authorizes a dial, forwarding only the
@@ -158,7 +187,8 @@ export async function routeDocumentHistory(request, rooms, documentId, authorize
  * write, another user's comment, an `Origin` that `options.allowedOrigins`
  * does not list), `404` (no such thread or comment, or the room keeps no
  * comments), `405` (another method), `409` (a thread or comment id taken),
- * `413` (a body over 64 KiB, or too many threads or comments).
+ * `413` (a body over 64 KiB, too many threads or comments, or the room's
+ * comment bytes full), `429` (the user past the room's comment rate).
  */
 export async function routeDocumentComments(request, rooms, documentId, authorize, options) {
     const op = request.method === 'GET' ? 'list' : request.method === 'POST' ? 'post' : null;
@@ -174,8 +204,8 @@ export async function routeDocumentComments(request, rooms, documentId, authoriz
         const declared = Number(request.headers.get('Content-Length') ?? 0);
         if (declared > MAX_COMMENT_REQUEST_BYTES)
             return new Response('request too large', { status: 413 });
-        body = await request.text();
-        if (new TextEncoder().encode(body).length > MAX_COMMENT_REQUEST_BYTES)
+        body = await bodyWithin(request, MAX_COMMENT_REQUEST_BYTES);
+        if (body === null)
             return new Response('request too large', { status: 413 });
     }
     const headers = identityHeaders(identity);

package/dist/collaboration/awarenessSelection.d.ts

@@ -52,7 +52,7 @@ export type EdytorAwarenessState = {
  * Structural awareness surface used by `publishPresence` — the real
  * `Awareness` satisfies it; tests may substitute stubs.
  */
-type AwarenessLike = {
+export type AwarenessLike = {
     getLocalState: () => Record<string, unknown> | null;
     setLocalState: (state: Record<string, unknown> | null) => void;
 };
@@ -130,4 +130,3 @@ export declare const resolvePeerSelection: (edytor: Edytor, state: unknown) => {
 } | {
     blocks: string[];
 } | null;
-export {};

package/dist/crdt/protocols/comments.d.ts

@@ -19,6 +19,12 @@ export declare const MAX_QUOTE_LENGTH = 300;
 export declare const MAX_COMMENTS_PER_THREAD = 500;
 /** Threads one document holds at most, resolved ones included. */
 export declare const MAX_THREADS = 5000;
+/**
+ * What one stored comment counts against a store's byte quota beyond its
+ * text (its ids, author, times; a thread's row is counted with its first
+ * comment).
+ */
+export declare const COMMENT_ROW_BYTES = 128;
 /** The mark a thread's anchor is: `comment:<thread id>` (a key of its own per thread). */
 export declare const COMMENT_MARK = "comment";
 /** One comment of a thread. */
@@ -137,9 +143,25 @@ export type CommentContext = {
     seq: number;
     /** The longest body (default {@link MAX_COMMENT_LENGTH}; only lowered). */
     maxLength?: number;
+    /**
+     * The bytes the store holds ({@link commentBytes} of every comment and
+     * quote): a thread or reply that would pass `maxBytes` is refused
+     * (`full`). Absent: no byte quota.
+     */
+    bytes?: number;
+    /** The store's byte quota (with `bytes`). */
+    maxBytes?: number;
     /** A fresh comment id (default {@link commentId}). */
     newId?: () => string;
 };
+/** The message of a thread or reply refused past its store's byte quota (`full`). */
+export declare const OVER_BYTE_QUOTA = "comments over their byte quota";
+/**
+ * What a stored comment counts against a byte quota: its body's and its
+ * thread's quote's UTF-8 bytes (the quote with the first comment only),
+ * plus {@link COMMENT_ROW_BYTES}.
+ */
+export declare const commentBytes: (body: string, quote?: string) => number;
 /**
  * Decide `request` by `actor`: the one rule of every comment store.
  *

package/dist/crdt/protocols/comments.js

@@ -19,6 +19,12 @@ export const MAX_QUOTE_LENGTH = 300;
 export const MAX_COMMENTS_PER_THREAD = 500;
 /** Threads one document holds at most, resolved ones included. */
 export const MAX_THREADS = 5_000;
+/**
+ * What one stored comment counts against a store's byte quota beyond its
+ * text (its ids, author, times; a thread's row is counted with its first
+ * comment).
+ */
+export const COMMENT_ROW_BYTES = 128;
 /** The mark a thread's anchor is: `comment:<thread id>` (a key of its own per thread). */
 export const COMMENT_MARK = 'comment';
 /** The HTTP status of each refusal. */
@@ -97,6 +103,32 @@ const bodyOf = (body, max) => {
         return refuse('invalid', `comment over ${max} characters`);
     return text;
 };
+/** The message of a thread or reply refused past its store's byte quota (`full`). */
+export const OVER_BYTE_QUOTA = 'comments over their byte quota';
+/** UTF-8 bytes of `text`. */
+const utf8 = (text) => {
+    let bytes = 0;
+    for (let i = 0; i < text.length; i++) {
+        const code = text.charCodeAt(i);
+        if (code < 0x80)
+            bytes += 1;
+        else if (code < 0x800)
+            bytes += 2;
+        else if (code >= 0xd800 && code <= 0xdbff && i + 1 < text.length) {
+            bytes += 4;
+            i++;
+        }
+        else
+            bytes += 3;
+    }
+    return bytes;
+};
+/**
+ * What a stored comment counts against a byte quota: its body's and its
+ * thread's quote's UTF-8 bytes (the quote with the first comment only),
+ * plus {@link COMMENT_ROW_BYTES}.
+ */
+export const commentBytes = (body, quote = '') => utf8(body) + utf8(quote) + COMMENT_ROW_BYTES;
 /** A quote as stored: one line of white space collapsed, cut at {@link MAX_QUOTE_LENGTH}. */
 const quoteOf = (quote) => (quote ?? '').replace(/\s+/gu, ' ').trim().slice(0, MAX_QUOTE_LENGTH);
 /**
@@ -121,6 +153,9 @@ export const decideComment = (request, actor, context) => {
     const { thread, now: at, seq } = context;
     const max = Math.min(context.maxLength ?? MAX_COMMENT_LENGTH, MAX_COMMENT_LENGTH);
     const user = actor.user;
+    const overQuota = (body, quote) => context.bytes !== undefined &&
+        context.maxBytes !== undefined &&
+        context.bytes + commentBytes(body, quote) > context.maxBytes;
     const newComment = (body, id) => {
         const text = bodyOf(body, max);
         if (typeof text !== 'string')
@@ -143,10 +178,13 @@ export const decideComment = (request, actor, context) => {
         const comment = newComment(request.body, request.comment);
         if ('status' in comment)
             return comment;
+        const quote = quoteOf(request.quote);
+        if (overQuota(comment.body, quote))
+            return refuse('full', OVER_BYTE_QUOTA);
         return applied('added', {
             id: request.thread,
             block: request.block ?? null,
-            quote: quoteOf(request.quote),
+            quote,
             createdBy: user,
             createdAt: at,
             resolved: null,
@@ -165,6 +203,8 @@ export const decideComment = (request, actor, context) => {
                 return comment;
             if (thread.comments.some(({ id }) => id === comment.id))
                 return refuse('exists', 'comment exists');
+            if (overQuota(comment.body))
+                return refuse('full', OVER_BYTE_QUOTA);
             return applied('replied', { ...thread, comments: [...thread.comments, comment], rev: seq }, comment);
         }
         case 'resolve':

package/dist/edytor.svelte.d.ts

@@ -216,6 +216,12 @@ export declare class Edytor {
     deleteBlocks: (payload: {
         blocks: Block[];
     }) => boolean;
+    /**
+     * Focus the editor, as a click in it would, without scrolling: the
+     * selection it has stays, and with none the caret goes to the start of
+     * the first text. For a menu button or a shortcut outside the editor.
+     */
+    focus: () => void;
     /**
      * Replace the whole document with one empty block and put the caret in it,
      * as one undo step. A readonly view or a read-only document refuses it

package/dist/edytor.svelte.js

@@ -319,7 +319,7 @@ export class Edytor {
     historyUndo = () => this.#replay('undo');
     historyRedo = () => this.#replay('redo');
     #replay = (command) => {
-        this.dispatcher.last = { operation: command, status: this.history.replay(command) };
+        this.dispatcher.record({ operation: command, status: this.history.replay(command) });
     };
     constructor(options) {
         const { snippets, readonly, hotkeys, plugins, document, doc, awareness, actor, requireHydration, presence, sync, value, onSelectionChange, placeholder, labels, onChange, onDocChange } = options;
@@ -789,6 +789,20 @@ export class Edytor {
     };
     /** @internal The handle of inline atom `atom`, shown in block `id`. */
     atomAt = (id, atom) => this.idToBlock.atom(id, atom);
+    /**
+     * Focus the editor, as a click in it would, without scrolling: the
+     * selection it has stays, and with none the caret goes to the start of
+     * the first text. For a menu button or a shortcut outside the editor.
+     */
+    focus = () => {
+        if (this.selection.value.kind === 'none') {
+            const text = this.root?.firstText;
+            if (text)
+                this.selection.setAtTextOffset(text, 0);
+        }
+        this.expectInternalFocus();
+        this.node?.focus({ preventScroll: true });
+    };
     /**
      * Replace the whole document with one empty block and put the caret in it,
      * as one undo step. A readonly view or a read-only document refuses it
@@ -804,7 +818,7 @@ export class Edytor {
         }));
         if (!newBlock)
             return false;
-        this.dispatcher.last = { operation: 'clear', status: 'applied' };
+        this.dispatcher.record({ operation: 'clear', status: 'applied' });
         this.selection.setAtTextOffset(newBlock.firstText ?? this.root?.children[0]?.firstText, 0);
         this.expectInternalFocus();
         this.node?.focus({ preventScroll: true });

package/dist/events/onBeforeInput.js

@@ -379,7 +379,7 @@ const occur = (edytor, occurrence, key = null, offered = null, reuse) => {
 const refuseTargetless = (edytor, occurrence, key, reuse) => {
     if (reuse)
         edytor.attempts.close(reuse);
-    edytor.dispatcher.last = { operation: occurrence.inputType, status: 'refused' };
+    edytor.dispatcher.record({ operation: occurrence.inputType, status: 'refused' });
     // The caret the browser placed for this key is its own, never adopted.
     edytor.projector.parked();
     if (occurrence.cancelable || !occurrence.event) {

package/dist/events/onKeyDown.js

@@ -198,7 +198,7 @@ export function onKeyDown(e) {
     this.markUserGesture();
     if (refused) {
         e.preventDefault();
-        this.dispatcher.last = { operation: keyed, status: 'refused' };
+        this.dispatcher.record({ operation: keyed, status: 'refused' });
         this.projector.parked();
         return;
     }

package/dist/index.d.ts

@@ -49,3 +49,26 @@ export { EdytorDocument, createDocument, loadDocument, attachDocument, defaultSe
 export { createIndexeddbSync, createWebsocketSync, clearDocument, prefetch, lastUpdated, documentSnapshot, DEFAULT_PRESENCE_THROTTLE, type EdytorSync, type EdytorSyncPayload, type IndexeddbSyncOptions, type WebsocketSync, type WebsocketSyncOptions, type PresenceOptions, type PresenceShare } from './collaboration/index.js';
 export { createCommentsClient, createMemoryCommentsClient, CommentRequestError, commentAnchors, type CommentDocument, type CommentFeed, type CommentResult, type CommentsClient, type CommentsClientOptions, type MemoryCommentsClient, type MemoryCommentsClientOptions, type CommentChange, type CommentRequest, type CommentRun, type CommentSnapshot, type CommentThread, type ThreadComment } from './collaboration/comments/index.js';
 export { HistoryPanel, createHistoryClient, HistoryRequestError, versionDiff, defaultHistoryLabels, type HistoryClient, type HistoryClientOptions, type HistoryRestoreResult, type HistoryUndoResult, type HistoryVersion, type HistoryPanelLabels, type HistoryPanelProps, type VersionChange, type VersionDiff } from './collaboration/history/index.js';
+export type { EdytorProps } from './components/Edytor.svelte';
+export type { EdytorOptions, Snippets } from './edytor.svelte.js';
+export type { BlockHandlesLabels, BlockMenuLabels, CodeLabels, ColumnsLabels, CommentsLabels, EditorLabels, EquationLabels, FindLabels, ImageLabels, MediaKindLabels, MediaLabels, MentionLabels, PageLabels, PageLinkLabels, RichTextLabels, SlashMenuLabels, SuggestionsLabels, TableLabels, TocLabels, ToolbarLabels } from './labels.js';
+export type { BlockElement, BlockView, InitializedPlugin, InlineBlockView, PluginDefinitions, PluginOperations } from './plugins.js';
+export type { Dispatcher } from './session/commands.js';
+export type { PresenceSelection, SelectCause, SelectionPoint, SelectionProjection, SelectionSegment, SelectionValue } from './session/selection.js';
+export type { SelectionState, TextAnchor } from './selection/selection.svelte.js';
+export type { Key, Modifier, Modifiers } from './session/keymap.js';
+export type { TextOperations } from './text/text.utils.js';
+export type { BlockBeside, BlockOperations } from './block/block.utils.js';
+export type { TextInsertionPayload, TriggerRange } from './plugins/triggers/TriggerController.svelte.js';
+export type { RichTextLink, RichTextMark } from './plugins/richtext/richTextOperations.js';
+export type { AwarenessLike, PresenceWriter } from './collaboration/awarenessSelection.js';
+export type { DataPatch } from './crdt/data.js';
+export type { AnchorAffinity, BlockRole, DocAnchor, TextRange } from './crdt/doc/types.js';
+export type { Flow, FlowLine, FlowTarget } from './crdt/flow.js';
+export type { EdytorDoc } from './crdt/edytor-doc.js';
+export type { DocumentOptions } from './crdt/document.js';
+export type { ActorProfile, AttributionActor, BlockLineageEntry, DocumentAttribution } from './crdt/attribution/attribution.js';
+export type { ActorId, BlockAttribution } from './crdt/attribution/block.js';
+export type { CommentMessage } from './crdt/protocols/comments.js';
+export type { EdytorSyncCleanup, LastUpdatedOptions, PrefetchOptions, PrefetchResult, WebsocketTarget } from './crdt/providers/index.js';
+export type { ProtocolMismatch, SchemaMismatchDetail } from './crdt/providers/room.js';

package/dist/plugins/blockHandles/BlockHandleController.svelte.js

@@ -307,7 +307,7 @@ export class BlockHandleController {
             if (!refused)
                 return out;
             selection.select(held);
-            dispatcher.last = refused;
+            dispatcher.record(refused);
             return false;
         };
         const detail = { block, anchor, insert };

package/dist/plugins/columns/ColumnsPlugin.svelte

@@ -116,7 +116,7 @@
 					return wrapBlocks(edytor, selected, 'columns', n);
 				const block = edytor.selection.state.startBlock;
 				if (inColumn(block)) {
-					edytor.dispatcher.last = { operation: 'setBlock', status: 'refused' };
+					edytor.dispatcher.record({ operation: 'setBlock', status: 'refused' });
 					return false;
 				}
 				return convertToKind(edytor, block, layoutRow(edytor, n, options));

package/dist/plugins/table/TablePlugin.svelte

@@ -75,13 +75,26 @@
 		return Array.from({ length: widest }, (_, i) => String(i));
 	};
 
-	/** A cell's column position in its table (reactive through the cells), `-1` when none. */
+	/**
+	 * A cell's column position in its table (reactive through the cells), `-1`
+	 * when none. A cell naming a listed column reads only the table's list:
+	 * a keystroke in another cell re-renders nothing here
+	 * (`table.render.scale`). Only a column the table no longer lists (an
+	 * undo's) scans the rows, as `columnsOfTable` orders those after the
+	 * listed ones.
+	 */
 	const columnIndex = (edytor: Edytor, table: string, row: string, id: string): number => {
-		const columns = columnsOfTable(edytor, table);
-		const listed = Array.isArray(edytor.cells?.get(table)?.data?.columns);
-		if (!listed) return edytor.cells?.get(row)?.childIds.indexOf(id) ?? -1;
+		const listed = edytor.cells?.get(table)?.data?.columns;
+		if (!Array.isArray(listed)) return edytor.cells?.get(row)?.childIds.indexOf(id) ?? -1;
 		const column = edytor.cells?.get(id)?.data?.column;
-		return typeof column === 'string' ? columns.indexOf(column) : -1;
+		if (typeof column !== 'string') return -1;
+		const ids: string[] = [];
+		for (const c of listed) {
+			const at = (c as { id?: unknown } | null)?.id;
+			if (typeof at === 'string' && !ids.includes(at)) ids.push(at);
+		}
+		const index = ids.indexOf(column);
+		return index !== -1 ? index : columnsOfTable(edytor, table).indexOf(column);
 	};
 
 	/**

package/dist/selection/replaceSelection.js

@@ -322,7 +322,7 @@ export const caretAfterBlockDelete = (blocks) => {
 export const keepsSelectedBlocks = (edytor, blocks) => {
     const kept = edytor.dispatcher.intercept((plugin) => vetoable((prevent) => plugin.onDeleteSelectedBlocks?.({ prevent, selectedBlocks: blocks })));
     if (kept)
-        edytor.dispatcher.last = { operation: 'deleteSelectedBlocks', status: 'refused' };
+        edytor.dispatcher.record({ operation: 'deleteSelectedBlocks', status: 'refused' });
     return kept;
 };
 /**

package/dist/selection/selection.svelte.d.ts

@@ -35,7 +35,7 @@ export type Caret = {
  * `content`, `marks`, the `isAt…`/`is…Spanning` flags, `islandRoot`,
  * `voidRoot` — are read from `selection.projection`.
  */
-type SelectionState = {
+export type SelectionState = {
     yStart: number;
     yEnd: number;
     isCollapsed: boolean;
@@ -67,9 +67,13 @@ export declare class EdytorSelection {
     #private;
     private edytorOnSelectionChange?;
     edytor: Edytor;
-    focusedBlocks: SvelteSet<Block>;
-    /** The selected blocks as clicked: a grip-selected list is one block. */
-    selectedBlocks: SvelteSet<Block>;
+    /** The blocks the selection touches (read-only: `select()` keeps it). */
+    get focusedBlocks(): ReadonlySet<Block>;
+    /**
+     * The selected blocks as clicked: a grip-selected list is one block
+     * (read-only: `select()` keeps it).
+     */
+    get selectedBlocks(): ReadonlySet<Block>;
     /**
      * The blocks a command over the block selection acts on, in document
      * order: the selected blocks, a selected list or code block with its
@@ -84,9 +88,10 @@ export declare class EdytorSelection {
     private modelSelectionPreservationBlock;
     /**
      * The selection: a value — none, a text range of two anchors,
-     * one inline atom, or a set of block ids. Only `select()` replaces it.
+     * one inline atom, or a set of block ids. Read-only: only `select()`
+     * replaces it.
      */
-    value: SelectionValue;
+    get value(): SelectionValue;
     constructor(edytor: Edytor, edytorOnSelectionChange?: ((selection: EdytorSelection) => void) | undefined);
     /** The projection of the current value at the current document version. */
     get projection(): SelectionProjection;
@@ -231,4 +236,3 @@ export declare class EdytorSelection {
      */
     setAtBlockRange: (block?: Block | null, startOffset?: number, endOffset?: number) => void;
 }
-export {};

package/dist/selection/selection.svelte.js

@@ -110,9 +110,19 @@ const rangeEdge = (block, edge, cover = false) => {
 export class EdytorSelection {
     edytorOnSelectionChange;
     edytor;
-    focusedBlocks = new SvelteSet();
-    /** The selected blocks as clicked: a grip-selected list is one block. */
-    selectedBlocks = new SvelteSet();
+    #focused = new SvelteSet();
+    #selected = new SvelteSet();
+    /** The blocks the selection touches (read-only: `select()` keeps it). */
+    get focusedBlocks() {
+        return this.#focused;
+    }
+    /**
+     * The selected blocks as clicked: a grip-selected list is one block
+     * (read-only: `select()` keeps it).
+     */
+    get selectedBlocks() {
+        return this.#selected;
+    }
     /**
      * The blocks a command over the block selection acts on, in document
      * order: the selected blocks, a selected list or code block with its
@@ -139,9 +149,13 @@ export class EdytorSelection {
     modelSelectionPreservationBlock = null;
     /**
      * The selection: a value — none, a text range of two anchors,
-     * one inline atom, or a set of block ids. Only `select()` replaces it.
+     * one inline atom, or a set of block ids. Read-only: only `select()`
+     * replaces it.
      */
-    value = $state.raw(noSelection);
+    get value() {
+        return this.#value;
+    }
+    #value = $state.raw(noSelection);
     /** @internal Advanced by every `select()`. */
     epoch = 0;
     /**
@@ -248,7 +262,7 @@ export class EdytorSelection {
         next = this.#keepPending(this.#shown(next));
         const changed = !sameValue(this.value, next);
         if (changed)
-            this.value = next;
+            this.#value = next;
         const value = this.value;
         this.epoch++;
         // A repair is a background display (it never takes focus); a command,
@@ -275,8 +289,8 @@ export class EdytorSelection {
             : value.kind === 'atom'
                 ? [blockOf(value.blockId) ?? []].flat()
                 : [];
-        this.#sync(this.selectedBlocks, selected, 'selected');
-        this.#sync(this.focusedBlocks, focused, 'focused');
+        this.#sync(this.#selected, selected, 'selected');
+        this.#sync(this.#focused, focused, 'focused');
         if (atom !== this.inlineBlockDeletionTarget || (!atom && this.selectedInlineBlock.size)) {
             this.selectedInlineBlock.clear();
             if (atom)

package/dist/session/commands.d.ts

@@ -35,8 +35,8 @@ type Normalizer = (this: Block) => void;
 export declare class Dispatcher {
     #private;
     private edytor;
-    /** The last operation's result. */
-    last: CommandResult | null;
+    /** The last operation's result (read-only: the dispatcher records it). */
+    get last(): CommandResult | null;
     /**
      * The result selection a command in flight declared before its operations: the seam repair leaves this view's endpoints to it.
      */

package/dist/session/commands.js

@@ -130,8 +130,20 @@ const specJSON = (spec) => ({
 });
 export class Dispatcher {
     edytor;
-    /** The last operation's result. */
-    last = null;
+    #last = null;
+    /** The last operation's result (read-only: the dispatcher records it). */
+    get last() {
+        return this.#last;
+    }
+    /**
+     * Record `result` as the last operation's: a refusal or result decided
+     * outside a dispatch (a key or input no command took, a gesture the
+     * layout refused, a history replay).
+     * @internal
+     */
+    record(result) {
+        this.#last = result;
+    }
     /**
      * The result selection a command in flight declared before its operations: the seam repair leaves this view's endpoints to it.
      */
@@ -266,7 +278,7 @@ export class Dispatcher {
             }
         });
         if (this.applied && this.last?.status !== 'applied' && this.last?.status !== 'failed')
-            this.last = this.applied;
+            this.#last = this.applied;
         this.applied = null;
         const after = () => this.cut(kind, 'after');
         if (out instanceof Promise)
@@ -395,16 +407,16 @@ export class Dispatcher {
             });
         }
         catch (error) {
-            this.last = { operation, status: 'failed', error };
+            this.#last = { operation, status: 'failed', error };
             throw error;
         }
         if (cut === 'both')
             this.edytor.undoManager?.stopCapturing();
-        this.last = {
+        const own = {
             operation,
             status: this.edytor.facade.version === version ? 'noop' : 'applied'
         };
-        const own = this.last;
+        this.#last = own;
         if (this.running && own.status === 'applied')
             this.applied = own;
         const change = { operation, payload: original, ...context };
@@ -435,7 +447,7 @@ export class Dispatcher {
         const next = { ...this.last, ...patch };
         if (this.#produced === this.last)
             this.#produced = next;
-        this.last = next;
+        this.#last = next;
     }
     /**
      * Run `body` with `lead` (a plan prepared now) composed into the first
@@ -617,7 +629,7 @@ export class Dispatcher {
     }
     /** Record `operation` as refused; answers that result. */
     #refused(operation) {
-        return (this.last = { operation, status: 'refused' });
+        return (this.#last = { operation, status: 'refused' });
     }
     settle(error, onPrevent) {
         const stop = prevented(error);

package/dist/session/keymap.d.ts

@@ -10,10 +10,12 @@ type Chars<S extends string, Acc = never> = S extends `${infer C}${infer R}` ? C
 /** The one-character keys a chord names: `KeyboardEvent.key`, lower case. */
 declare const CHARS = "abcdefghijklmnopqrstuvwxyz0123456789`~!@#$%^&*()-_=+[]{}\\|;:'\",.<>/?";
 declare const NAMED: readonly ["arrowup", "arrowdown", "arrowleft", "arrowright", "tab", "enter", "backspace", "delete", "space", "escape", "home", "end", "pageup", "pagedown", "insert", "f1", "f2", "f3", "f4", "f5", "f6", "f7", "f8", "f9", "f10", "f11", "f12"];
-type Key = Chars<typeof CHARS> | (typeof NAMED)[number];
-type Modifier = 'mod' | 'alt' | 'ctrl' | 'shift';
+/** A key a chord names: a one-character key or a named one, lower case. */
+export type Key = Chars<typeof CHARS> | (typeof NAMED)[number];
+/** A chord's modifier (`mod`: Cmd on Apple platforms, Ctrl elsewhere). */
+export type Modifier = 'mod' | 'alt' | 'ctrl' | 'shift';
 /** One to three distinct modifiers, in any order. */
-type Modifiers = {
+export type Modifiers = {
     [A in Modifier]: A | {
         [B in Exclude<Modifier, A>]: `${A}+${B}` | `${A}+${B}+${Exclude<Modifier, A | B>}`;
     }[Exclude<Modifier, A>];

package/dist/session/moves.js

@@ -115,7 +115,7 @@ const place = (edytor, request) => {
     if (!move) {
         // Refused before any command ran: `last` still reports it (commands#results).
         const operation = request.blocks.length > 1 ? 'moveBlocks' : 'moveBlock';
-        edytor.dispatcher.last = { operation, status: request.blocks.length ? 'refused' : 'noop' };
+        edytor.dispatcher.record({ operation, status: request.blocks.length ? 'refused' : 'noop' });
         return [];
     }
     const [first, ...rest] = move.blocks;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "edytor",
 	"license": "MIT",
-	"version": "0.1.0-next.41",
+	"version": "0.1.0-next.43",
 	"repository": {
 		"type": "git",
 		"url": "git+https://github.com/beynar/edytor.git"