edytor 0.1.0-next.41 → 0.1.0-next.44

package/README.md

@@ -10,13 +10,14 @@
 <p>
     <a href="https://edytor.dev/docs">Documentation</a> •
     <a href="#quick-start">Quick start</a> •
-    <a href="https://edytor.dev/docs/reference/migration">Changelog</a>
+    <a href="https://edytor.dev/docs/reference/migration">Changelog</a> •
+    <a href="SECURITY.md">Security</a>
   </p>
 </div>
 
 Edytor aims to be for Svelte what Slate.js is for React: a heavily customizable editor with an API to build any kind of collaborative rich text editor.
 
-> **Work in progress.** Edytor is a pre-release (`0.1.0-next.41`, `edytor@next` on npm) and not ready for production; the API changes between releases without a compatibility layer. The untagged `edytor@0.0.11` on npm predates the current API. Issues and PRs are welcome: when you report a bug, include the document's JSON value.
+> **Work in progress.** Edytor is a pre-release (`0.1.0-next.44`, `edytor@next` on npm) and not ready for production; the API changes between releases without a compatibility layer. The untagged `edytor@0.0.11` on npm predates the current API. Issues and PRs are welcome: when you report a bug, include the document's JSON value.
 
 ## Features
 

package/dist/clipboard/insertClipboardFragment.d.ts

@@ -4,6 +4,14 @@ import { type SelectionInsertionTarget, type SelectionReplacementState } from '.
 import { type JSONText } from '../utils/json.js';
 import type { EdytorClipboardFragment } from './types.js';
 export declare const flowOfText: (text: string, marks?: JSONText["marks"]) => Flow;
+/**
+ * A pasted `text/plain` as markdown (`paste.markdown`): `null` unless a line
+ * holds block markdown (`hasBlockMarkdown`), else the blocks it reads as
+ * (`textToBlocks`). A kind the view does not register is a paragraph of its
+ * text, its children after it (a divider is dropped); without a paragraph
+ * kind, nothing converts.
+ */
+export declare const flowOfMarkdown: (edytor: Pick<Edytor, "blocks">, text: string) => Flow | null;
 export declare const flowOfFragment: (fragment: EdytorClipboardFragment) => Flow;
 /**
  * Place `flow` (`flow.*`) at `at`, over the selected blocks (unless

package/dist/clipboard/insertClipboardFragment.js

@@ -4,6 +4,7 @@ import { cloneJsonSafe, jsonBlockToSpec, jsonContentToItems } from '../utils/jso
 import { id } from '../utils.js';
 import { caretAt } from '../session/attempt.js';
 import { isValidEdytorClipboardFragment } from './fragmentData.js';
+import { hasBlockMarkdown, textToBlocks } from './textBlocks.js';
 // Admission (`flow.shape`): every id is minted fresh here, once.
 const run = (content) => ({
     id: id('b'),
@@ -12,6 +13,28 @@ const run = (content) => ({
 export const flowOfText = (text, marks) => ({
     lines: text.split(/\r\n|\r|\n/).map((line) => run(line ? [{ text: line, marks }] : []))
 });
+/**
+ * A pasted `text/plain` as markdown (`paste.markdown`): `null` unless a line
+ * holds block markdown (`hasBlockMarkdown`), else the blocks it reads as
+ * (`textToBlocks`). A kind the view does not register is a paragraph of its
+ * text, its children after it (a divider is dropped); without a paragraph
+ * kind, nothing converts.
+ */
+export const flowOfMarkdown = (edytor, text) => {
+    if (!edytor.blocks.has('paragraph') || !hasBlockMarkdown(text))
+        return null;
+    const known = (block) => {
+        const children = (block.children ?? []).flatMap(known);
+        if (edytor.blocks.has(block.type))
+            return [{ ...block, ...(block.children ? { children } : {}) }];
+        const own = block.type === 'divider' || (!block.content?.length && block.children?.length)
+            ? []
+            : [{ type: 'paragraph', content: block.content ?? [] }];
+        return [...own, ...children];
+    };
+    const blocks = textToBlocks(text).flatMap(known);
+    return blocks.length ? { lines: blocks.map((block) => jsonBlockToSpec(block, true)) } : null;
+};
 export const flowOfFragment = (fragment) => fragment.kind === 'content'
     ? { lines: [run(fragment.content)] }
     : {

package/dist/clipboard/textBlocks.d.ts

@@ -19,5 +19,7 @@ export type TextToBlocksOptions = {
     /** The kind of a paragraph (default `paragraph`). */
     type?: string;
 };
+/** Whether `text` holds block markdown (one line of it is enough), as a paste reads it. */
+export declare const hasBlockMarkdown: (text: string) => boolean;
 /** `text` as blocks (see the module comment). */
 export declare const textToBlocks: (text: string, { markdown, type }?: TextToBlocksOptions) => JSONBlock[];

package/dist/clipboard/textBlocks.js

@@ -21,6 +21,10 @@ const runs = (text) => {
         out.push({ text: text.slice(at) });
     return out;
 };
+/** A line that opens block markdown: a heading, a list or to-do item, a quote, a fence, a divider. */
+const BLOCK_LINE = /^\s*(?:#{1,6}\s|[-*+]\s|\d+[.)]\s|>|```|(?:-{3,}|\*{3,}|_{3,})\s*$)/;
+/** Whether `text` holds block markdown (one line of it is enough), as a paste reads it. */
+export const hasBlockMarkdown = (text) => text.split(/\r?\n/).some((line) => BLOCK_LINE.test(line));
 /** One line's kind, data and text, or `null` for a paragraph line. */
 const lineKind = (line) => {
     let m = /^(#{1,6})\s+(.*)$/.exec(line);

package/dist/cloudflare/DocumentRoom.d.ts

@@ -278,6 +278,10 @@ export type DocumentRoomEnv = {
     EDYTOR_ROOMS?: MoveNamespace;
     /** `off`: the room keeps no comment threads (its comments requests answer `404`). */
     EDYTOR_COMMENTS?: string;
+    /** The bytes the room's comments may hold ({@link CommentOptions.maxBytes}). */
+    EDYTOR_MAX_COMMENT_BYTES?: string | number;
+    /** Comment requests per second ({@link CommentOptions.maxRequestsPerSecond}). */
+    EDYTOR_MAX_COMMENT_REQUESTS_PER_SECOND?: string | number;
 };
 /** What a socket is bound to: its verified user, its replica (Yjs client id), its access. */
 export type SocketIdentity = {
@@ -300,7 +304,7 @@ export type Attachment = SocketIdentity & {
     comments?: boolean;
 };
 export type Refusal = {
-    reason: 'generation' | 'schema' | 'malformed' | 'container' | 'identity' | 'replica' | 'read-only' | 'waiting' | 'storage' | 'internal' | 'quota' | 'access' | 'presence' | 'mark' | 'forged' | 'denied' | 'orphan' | 'relayed' | 'history';
+    reason: 'generation' | 'schema' | 'malformed' | 'container' | 'identity' | 'replica' | 'read-only' | 'waiting' | 'storage' | 'internal' | 'quota' | 'access' | 'presence' | 'comments' | 'mark' | 'forged' | 'denied' | 'orphan' | 'relayed' | 'history';
     detail: unknown;
 };
 /** A duration series: how many, their total and longest (ms; see {@link RoomMetrics}). */
@@ -490,7 +494,26 @@ export type CommentOptions = {
     onComment?: (change: CommentChange) => void | Promise<void>;
     /** The longest comment body (default and ceiling 10,000 characters). */
     maxLength?: number;
+    /**
+     * The bytes the room's comments may hold (default
+     * {@link DEFAULT_MAX_COMMENT_BYTES}, 4 MiB): each body and quote in UTF-8
+     * plus 128 a comment. A thread or reply past it is refused `413`; a
+     * delete frees its bytes.
+     */
+    maxBytes?: number;
+    /**
+     * Comment requests per second (default
+     * {@link DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND}, a ten-second burst):
+     * over HTTP per verified user (past it, `429`), and a socket's comment
+     * messages per socket (past it, dropped). RPC calls are the host's own and
+     * are not counted.
+     */
+    maxRequestsPerSecond?: number;
 };
+/** The bytes a room's comments hold at most, by default (4 MiB). */
+export declare const DEFAULT_MAX_COMMENT_BYTES: number;
+/** Comment requests per second and user (or socket), by default. */
+export declare const DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND = 2;
 /** What {@link attachRoom} (and `DocumentRoom`) takes. */
 export type AttachRoomOptions = {
     /**

package/dist/cloudflare/DocumentRoom.js

@@ -242,6 +242,10 @@ export const noTimers = (fn) => {
         [g.setTimeout, g.setInterval] = saved;
     }
 };
+/** The bytes a room's comments hold at most, by default (4 MiB). */
+export const DEFAULT_MAX_COMMENT_BYTES = 4 * 1024 * 1024;
+/** Comment requests per second and user (or socket), by default. */
+export const DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND = 2;
 /** `EDYTOR_PURGE_AFTER_DAYS`: `off` (or `false`) never purges; a number of days; anything else the default. */
 const purgeAfterDays = (value) => {
     if (value === 'off' || value === 'false' || value === false)
@@ -703,7 +707,11 @@ export class DocumentRoom extends DurableObject {
         const locks = () => this.locks();
         const comments = () => String(knobs.EDYTOR_COMMENTS ?? '') === 'off'
             ? false
-            : { onComment: (change) => this.onComment(change) };
+            : {
+                onComment: (change) => this.onComment(change),
+                maxBytes: Number(knobs.EDYTOR_MAX_COMMENT_BYTES),
+                maxRequestsPerSecond: Number(knobs.EDYTOR_MAX_COMMENT_REQUESTS_PER_SECOND)
+            };
         this.room = new AttachedDocument(ctx, {
             maxRowBytes: Number(knobs.EDYTOR_MAX_ROW_BYTES),
             maxFrameBytes: Number(knobs.EDYTOR_MAX_FRAME_BYTES),

package/dist/cloudflare/index.d.ts

@@ -4,10 +4,10 @@
  * `cloudflare:workers`); built on the Worker-safe CRDT entry. Documented in
  * the site's `server/` section (room, authorization, extending, protocol).
  */
-export { DocumentRoom, AttachedDocument, attachRoom, SOCKET_TAG, closedSocket, type AttachRoomOptions, type CommentOptions, DEFAULT_COMPACT_AFTER, DEFAULT_MAX_ROW_BYTES, DEFAULT_SAVE_AFTER, DEFAULT_MAX_DOCUMENT_BYTES, DEFAULT_MAX_INBOUND_FRAME_BYTES, DEFAULT_MAX_BUFFERED_BYTES, DEFAULT_MAX_UPDATES_PER_SECOND, DEFAULT_MAX_PRESENCE_BYTES, DEFAULT_MAX_PRESENCE_PER_SECOND, DEFAULT_MAX_PRESENCE_FANOUT, MAX_REFUSALS, MAX_WAITING_DELETES, ROOM_ORIGIN, RESTORE_ORIGIN, PURGE_ORIGIN, IDENTITY_HEADERS, PROBE_HEADER, noTimers, type Attachment, type DocumentRoomEnv, type LoadedDocument, type Refusal, type ReplicaOwner, type SavedDocument, type SocketIdentity, type StoredRecord, type FrameValidation, type ValidatedBlock, type RoomMetrics, type RoomLogEntry, type RestoreResult, type Timing } from './DocumentRoom.js';
+export { DocumentRoom, AttachedDocument, attachRoom, SOCKET_TAG, closedSocket, type AttachRoomOptions, type CommentOptions, DEFAULT_COMPACT_AFTER, DEFAULT_MAX_ROW_BYTES, DEFAULT_SAVE_AFTER, DEFAULT_MAX_DOCUMENT_BYTES, DEFAULT_MAX_INBOUND_FRAME_BYTES, DEFAULT_MAX_BUFFERED_BYTES, DEFAULT_MAX_UPDATES_PER_SECOND, DEFAULT_MAX_PRESENCE_BYTES, DEFAULT_MAX_PRESENCE_PER_SECOND, DEFAULT_MAX_PRESENCE_FANOUT, DEFAULT_MAX_COMMENT_BYTES, DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND, MAX_REFUSALS, MAX_WAITING_DELETES, ROOM_ORIGIN, RESTORE_ORIGIN, PURGE_ORIGIN, IDENTITY_HEADERS, PROBE_HEADER, noTimers, type Attachment, type DocumentRoomEnv, type LoadedDocument, type Refusal, type ReplicaOwner, type SavedDocument, type SocketIdentity, type StoredRecord, type FrameValidation, type ValidatedBlock, type RoomMetrics, type RoomLogEntry, type RestoreResult, type Timing } from './DocumentRoom.js';
 export { DEFAULT_RETENTION_DAYS, HISTORY_MAX_VALUE_BYTES, R2_HISTORY_MAX_VALUE_BYTES, ROOM_HISTORY_MAX_BYTES, ROOM_HISTORY_MAX_VALUE_BYTES, kvHistory, r2History, roomHistory, type HistoryEntry, type HistoryMetadata, type HistoryOptions, type HistoryRoomStorage, type HistoryStore, type HistoryStoreFactory, type HistoryStoreRecord, type KVLike, type R2BucketLike } from './history.js';
 export { type PurgeReport } from '../crdt/purge.js';
-export { COMMENT_STATUS, MAX_COMMENT_LENGTH, MAX_COMMENTS_PER_THREAD, MAX_THREADS, commentAnchors, decideComment, type ThreadComment, type CommentActor, type CommentChange, type CommentOutcome, type CommentRefusal, type CommentRequest, type CommentRun, type CommentSnapshot, type CommentThread } from '../crdt/protocols/comments.js';
+export { COMMENT_ROW_BYTES, COMMENT_STATUS, MAX_COMMENT_LENGTH, MAX_COMMENTS_PER_THREAD, MAX_THREADS, commentAnchors, commentBytes, decideComment, type ThreadComment, type CommentActor, type CommentChange, type CommentOutcome, type CommentRefusal, type CommentRequest, type CommentRun, type CommentSnapshot, type CommentThread } from '../crdt/protocols/comments.js';
 export { lockedBlocks, type LockOptions } from './locks.js';
 export { moveBlocksBetweenRooms, forwardLateEdits, DEFAULT_MOVE_GRACE_DAYS, type CommitResult, type ExportedBlocks, type ImportReceipt, type ImportRequest, type LateEdit, type LateEditBatch, type MoveDestination, type MovedState, type MoveNamespace, type MoveRoom } from './move.js';
 export { routeDocumentSocket, routeDocumentHistory, routeDocumentComments, requestedReplica, type AuthorizeDocumentSocket, type ExpiredCredential, type DocumentNamespace, type DocumentIdentity, type RouteDocumentOptions } from './routeDocumentSocket.js';

package/dist/cloudflare/index.js

@@ -4,10 +4,10 @@
  * `cloudflare:workers`); built on the Worker-safe CRDT entry. Documented in
  * the site's `server/` section (room, authorization, extending, protocol).
  */
-export { DocumentRoom, AttachedDocument, attachRoom, SOCKET_TAG, closedSocket, DEFAULT_COMPACT_AFTER, DEFAULT_MAX_ROW_BYTES, DEFAULT_SAVE_AFTER, DEFAULT_MAX_DOCUMENT_BYTES, DEFAULT_MAX_INBOUND_FRAME_BYTES, DEFAULT_MAX_BUFFERED_BYTES, DEFAULT_MAX_UPDATES_PER_SECOND, DEFAULT_MAX_PRESENCE_BYTES, DEFAULT_MAX_PRESENCE_PER_SECOND, DEFAULT_MAX_PRESENCE_FANOUT, MAX_REFUSALS, MAX_WAITING_DELETES, ROOM_ORIGIN, RESTORE_ORIGIN, PURGE_ORIGIN, IDENTITY_HEADERS, PROBE_HEADER, noTimers } from './DocumentRoom.js';
+export { DocumentRoom, AttachedDocument, attachRoom, SOCKET_TAG, closedSocket, DEFAULT_COMPACT_AFTER, DEFAULT_MAX_ROW_BYTES, DEFAULT_SAVE_AFTER, DEFAULT_MAX_DOCUMENT_BYTES, DEFAULT_MAX_INBOUND_FRAME_BYTES, DEFAULT_MAX_BUFFERED_BYTES, DEFAULT_MAX_UPDATES_PER_SECOND, DEFAULT_MAX_PRESENCE_BYTES, DEFAULT_MAX_PRESENCE_PER_SECOND, DEFAULT_MAX_PRESENCE_FANOUT, DEFAULT_MAX_COMMENT_BYTES, DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND, MAX_REFUSALS, MAX_WAITING_DELETES, ROOM_ORIGIN, RESTORE_ORIGIN, PURGE_ORIGIN, IDENTITY_HEADERS, PROBE_HEADER, noTimers } from './DocumentRoom.js';
 export { DEFAULT_RETENTION_DAYS, HISTORY_MAX_VALUE_BYTES, R2_HISTORY_MAX_VALUE_BYTES, ROOM_HISTORY_MAX_BYTES, ROOM_HISTORY_MAX_VALUE_BYTES, kvHistory, r2History, roomHistory } from './history.js';
 export {} from '../crdt/purge.js';
-export { COMMENT_STATUS, MAX_COMMENT_LENGTH, MAX_COMMENTS_PER_THREAD, MAX_THREADS, commentAnchors, decideComment } from '../crdt/protocols/comments.js';
+export { COMMENT_ROW_BYTES, COMMENT_STATUS, MAX_COMMENT_LENGTH, MAX_COMMENTS_PER_THREAD, MAX_THREADS, commentAnchors, commentBytes, decideComment } from '../crdt/protocols/comments.js';
 export { lockedBlocks } from './locks.js';
 export { moveBlocksBetweenRooms, forwardLateEdits, DEFAULT_MOVE_GRACE_DAYS } from './move.js';
 export { routeDocumentSocket, routeDocumentHistory, routeDocumentComments, requestedReplica } from './routeDocumentSocket.js';

package/dist/cloudflare/room/admission.d.ts

@@ -2,16 +2,21 @@ import { type RoomContext } from './context.js';
 /** The provider's keepalive text frame, and the room's answer. */
 export declare const PING = "ping";
 export declare const PONG = "pong";
-/** Each socket's allowance (a token bucket; memory: a wake refills it). */
-export type Allowances = WeakMap<WebSocket, {
+/** A token bucket: its tokens, refilled since `at` (ms). */
+export type Bucket = {
     tokens: number;
     at: number;
-}>;
+};
+/** Each socket's allowance (a token bucket; memory: a wake refills it). */
+export type Allowances = WeakMap<WebSocket, Bucket>;
 /**
- * A token bucket per socket, refilled at `perSecond` up to ten seconds'
- * worth: takes one token. `false`: over the rate.
+ * A token bucket per key (a socket, a user), refilled at `perSecond` up to
+ * ten seconds' worth: takes one token. `false`: over the rate.
  */
-export declare const allowance: (allowances: Allowances, ws: WebSocket, perSecond: number) => boolean;
+export declare const allowance: <K>(allowances: {
+    get(key: K): Bucket | undefined;
+    set(key: K, bucket: Bucket): unknown;
+}, key: K, perSecond: number, now?: number) => boolean;
 export declare class Admission {
     private readonly room;
     /** Each socket's update allowance. */

package/dist/cloudflare/room/admission.js

@@ -32,19 +32,18 @@ export const PONG = 'pong';
 /** Seconds of the update rate a socket may spend at once. */
 const BURST_SECONDS = 10;
 /**
- * A token bucket per socket, refilled at `perSecond` up to ten seconds'
- * worth: takes one token. `false`: over the rate.
+ * A token bucket per key (a socket, a user), refilled at `perSecond` up to
+ * ten seconds' worth: takes one token. `false`: over the rate.
  */
-export const allowance = (allowances, ws, perSecond) => {
-    const now = Date.now();
+export const allowance = (allowances, key, perSecond, now = Date.now()) => {
     const burst = perSecond * BURST_SECONDS;
-    const held = allowances.get(ws) ?? { tokens: burst, at: now };
-    const tokens = Math.min(burst, held.tokens + ((now - held.at) / 1000) * perSecond);
+    const held = allowances.get(key) ?? { tokens: burst, at: now };
+    const tokens = Math.min(burst, held.tokens + (Math.max(0, now - held.at) / 1000) * perSecond);
     if (tokens < 1) {
-        allowances.set(ws, { tokens, at: now });
+        allowances.set(key, { tokens, at: now });
         return false;
     }
-    allowances.set(ws, { tokens: tokens - 1, at: now });
+    allowances.set(key, { tokens: tokens - 1, at: now });
     return true;
 };
 /** A chunk sequence the room does not take at its start: past the rate, or past the room's buffer. */

package/dist/cloudflare/room/comments.d.ts

@@ -9,12 +9,16 @@
 import * as E from '../../crdt/protocol.js';
 import { type CommentActor, type CommentOutcome, type CommentRequest, type CommentSnapshot } from '../../crdt/protocols/comments.js';
 import { type Attachment, type SocketIdentity } from '../DocumentRoom.js';
-import type { RoomContext } from './context.js';
+import { type RoomContext } from './context.js';
 /** The largest request body `routeDocumentComments` forwards, in bytes. */
 export declare const MAX_COMMENT_REQUEST_BYTES: number;
 export declare class RoomComments {
     private readonly room;
     private ready;
+    /** Each verified user's HTTP request allowance (memory: a wake refills it). */
+    private readonly users;
+    /** Each socket's comment message allowance. */
+    private readonly sockets;
     constructor(room: RoomContext);
     /** Comments are on unless the room's `comments` option is `false`. */
     get enabled(): boolean;
@@ -28,6 +32,16 @@ export declare class RoomComments {
     private seq;
     /** One thread as stored, or `null`. */
     private read;
+    /**
+     * The bytes the comments hold, as the byte quota counts them
+     * (`commentBytes`: each body and quote in UTF-8, plus a row's cost).
+     */
+    private bytes;
+    /**
+     * Whether `key` (a user over HTTP, a socket) is within the comment
+     * rate; past it the room notes it (`comments`, `quota: 'rate'`).
+     */
+    private allow;
     /** Every thread, oldest first, with the last sequence number. */
     list(): CommentSnapshot;
     /** Store `change` (one SQLite transaction with its sequence number). */
@@ -46,7 +60,9 @@ export declare class RoomComments {
      * A socket's comment message (`messageComments`): a subscribe marks its
      * attachment (it survives hibernation) and is answered with every
      * thread; an unsubscribe clears it. Any other comment message from a
-     * client is malformed. Subscribes share the socket's presence rate.
+     * client is malformed. A subscribe while subscribed answers nothing; a
+     * socket's comment messages past the comment rate are dropped (its
+     * subscription unchanged), the socket stays.
      */
     onMessage(ws: WebSocket, attachment: Attachment, decoder: E.Decoder): void;
     /**

package/dist/cloudflare/room/comments.js

@@ -7,13 +7,17 @@
  * may do what) are `crdt/protocols/comments.ts`, shared with the clients.
  */
 import * as E from '../../crdt/protocol.js';
-import { COMMENT_MARK, COMMENT_STATUS, commentAnchors, decideComment, parseCommentRequest, validCommentId } from '../../crdt/protocols/comments.js';
-import { SOCKET_TAG, noTimers } from '../DocumentRoom.js';
+import { COMMENT_MARK, COMMENT_ROW_BYTES, COMMENT_STATUS, commentAnchors, decideComment, OVER_BYTE_QUOTA, parseCommentRequest, validCommentId } from '../../crdt/protocols/comments.js';
+import { DEFAULT_MAX_COMMENT_BYTES, DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND, SOCKET_TAG, noTimers } from '../DocumentRoom.js';
+import { allowance } from './admission.js';
+import { knob } from './context.js';
 import { decode } from './frames.js';
 /** The `meta` key holding the comments' last sequence number. */
 const SEQ_KEY = 'comments';
 /** The largest request body `routeDocumentComments` forwards, in bytes. */
 export const MAX_COMMENT_REQUEST_BYTES = 64 * 1024;
+/** The users whose request rate the room tracks at once (the oldest is forgotten past it). */
+const MAX_RATE_USERS = 1_000;
 const threadOf = (row, comments) => ({
     id: row.id,
     block: row.block,
@@ -35,6 +39,10 @@ const commentOf = (row) => ({
 export class RoomComments {
     room;
     ready = false;
+    /** Each verified user's HTTP request allowance (memory: a wake refills it). */
+    users = new Map();
+    /** Each socket's comment message allowance. */
+    sockets = new WeakMap();
     constructor(room) {
         this.room = room;
     }
@@ -95,6 +103,32 @@ export class RoomComments {
             .map(commentOf);
         return threadOf(row, comments);
     }
+    /**
+     * The bytes the comments hold, as the byte quota counts them
+     * (`commentBytes`: each body and quote in UTF-8, plus a row's cost).
+     */
+    bytes() {
+        const { sql, tables } = this.room;
+        const comments = sql
+            .exec(`SELECT SUM(LENGTH(CAST(body AS BLOB))) AS bytes, COUNT(*) AS n FROM ${tables.comments}`)
+            .one();
+        const quotes = sql
+            .exec(`SELECT SUM(LENGTH(CAST(quote AS BLOB))) AS bytes FROM ${tables.threads}`)
+            .one().bytes ?? 0;
+        return (comments.bytes ?? 0) + quotes + comments.n * COMMENT_ROW_BYTES;
+    }
+    /**
+     * Whether `key` (a user over HTTP, a socket) is within the comment
+     * rate; past it the room notes it (`comments`, `quota: 'rate'`).
+     */
+    allow(buckets, key, user) {
+        const room = this.room;
+        const limit = limitsOf(room).maxRequestsPerSecond;
+        if (allowance(buckets, key, limit, room.clock()))
+            return true;
+        room.note({ reason: 'comments', detail: { user, quota: 'rate', limit } });
+        return false;
+    }
     /** Every thread, oldest first, with the last sequence number. */
     list() {
         if (!this.enabled)
@@ -158,13 +192,21 @@ export class RoomComments {
             const threads = request.op === 'add'
                 ? sql.exec(`SELECT COUNT(*) AS n FROM ${tables.threads}`).one().n
                 : 0;
+            const maxBytes = limitsOf(room).maxBytes;
             const decided = decideComment(request, actor, {
                 thread,
                 threads,
                 now: room.clock(),
                 seq: this.seq() + 1,
-                maxLength: commentsOptions(room).maxLength
+                maxLength: commentsOptions(room).maxLength,
+                bytes: request.op === 'add' || request.op === 'reply' ? this.bytes() : undefined,
+                maxBytes
             });
+            if (decided.status === 'refused' && decided.message === OVER_BYTE_QUOTA)
+                room.note({
+                    reason: 'comments',
+                    detail: { user: actor.user, quota: 'bytes', limit: maxBytes }
+                });
             if (decided.status !== 'applied')
                 return decided;
             this.store(decided.change);
@@ -232,7 +274,9 @@ export class RoomComments {
      * A socket's comment message (`messageComments`): a subscribe marks its
      * attachment (it survives hibernation) and is answered with every
      * thread; an unsubscribe clears it. Any other comment message from a
-     * client is malformed. Subscribes share the socket's presence rate.
+     * client is malformed. A subscribe while subscribed answers nothing; a
+     * socket's comment messages past the comment rate are dropped (its
+     * subscription unchanged), the socket stays.
      */
     onMessage(ws, attachment, decoder) {
         const room = this.room;
@@ -240,10 +284,11 @@ export class RoomComments {
         if (message.type !== 'subscribe') {
             return room.refuse(ws, { reason: 'malformed', detail: `comment message ${message.type}` });
         }
-        if (!room.presence.allow(ws))
-            return room.presence.overRate(ws, attachment);
+        if (!this.allow(this.sockets, ws, attachment.user))
+            return;
+        const was = attachment.comments === true;
         ws.serializeAttachment({ ...attachment, comments: message.on });
-        if (!message.on)
+        if (!message.on || was)
             return;
         const snapshot = this.list();
         room.send(ws, E.frame(E.messageComments, (e) => E.writeCommentsSnapshot(e, snapshot)));
@@ -257,6 +302,11 @@ export class RoomComments {
     async request(op, identity, body) {
         if (!this.enabled)
             return new Response('no comments', { status: 404 });
+        const users = this.users;
+        if (!users.has(identity.user) && users.size >= MAX_RATE_USERS)
+            users.delete(users.keys().next().value);
+        if (!this.allow(users, identity.user, identity.user))
+            return new Response('too many comment requests', { status: 429 });
         try {
             if (op === 'list')
                 return Response.json(this.list());
@@ -291,3 +341,11 @@ const commentsOptions = (room) => {
     const options = room.options.comments;
     return options === false || options === undefined ? {} : options;
 };
+/** The room's comment quotas, defaults applied. */
+const limitsOf = (room) => {
+    const options = commentsOptions(room);
+    return {
+        maxBytes: knob(options.maxBytes, DEFAULT_MAX_COMMENT_BYTES, 128 * 1024 * 1024),
+        maxRequestsPerSecond: knob(options.maxRequestsPerSecond, DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND, 1_000)
+    };
+};

package/dist/cloudflare/room/context.d.ts

@@ -56,7 +56,7 @@ export declare const crdt: {
         SchemaMismatchError: typeof E.SchemaMismatchError;
         create: (doc: E.EngineDoc, config?: import("../../crdt/edytor-doc.js").EdytorDocConfig) => {
             prepare: {
-                insertFlow: (target: import("../../crdt/flow.js").FlowTarget, flow: import("../../crdt/flow.js").Flow, view?: import("../../crdt/flow.js").FlowView) => import("../../index.js").Prepared;
+                insertFlow: (target: import("../../index.js").FlowTarget, flow: import("../../index.js").Flow, view?: import("../../crdt/flow.js").FlowView) => import("../../index.js").Prepared;
                 deleteRange: (from: import("../../crdt/rangeDelete.js").DocPosition, to: import("../../crdt/rangeDelete.js").DocPosition, view?: import("../../crdt/rangeDelete.js").RangeView) => import("../../index.js").Prepared;
                 replaceRange: (from: import("../../crdt/rangeDelete.js").DocPosition, to: import("../../crdt/rangeDelete.js").DocPosition, view?: import("../../crdt/rangeDelete.js").RangeView) => import("../../index.js").Prepared;
                 insertTableRow: (table: import("../../crdt/index.js").BlockId, index: number) => import("../../index.js").Prepared;
@@ -93,7 +93,7 @@ export declare const crdt: {
                     children?: import("../../crdt/index.js").BlockSpec[];
                 }) => import("../../index.js").Prepared;
                 setBlockType: (id: import("../../crdt/index.js").BlockId, type: string) => import("../../index.js").Prepared;
-                patchData: (target: import("../../crdt/edytor-doc.js").DataTarget, patches: readonly import("../../crdt/data.js").DataPatch[]) => import("../../index.js").Prepared;
+                patchData: (target: import("../../crdt/edytor-doc.js").DataTarget, patches: readonly import("../../index.js").DataPatch[]) => import("../../index.js").Prepared;
                 setBlockData: (id: import("../../crdt/index.js").BlockId, data: Record<string, unknown>) => import("../../index.js").Prepared;
                 duplicateBlock: (id: import("../../crdt/index.js").BlockId, freshId: (oldId: string, kind: "block" | "inline") => string) => import("../../index.js").Prepared;
                 insertText: (id: import("../../crdt/index.js").BlockId, offset: number, text: string, marks?: Record<string, unknown>) => import("../../index.js").Prepared;
@@ -180,7 +180,7 @@ export declare const crdt: {
             runsView: import("../../crdt/text/runs.js").RunView;
             version: number;
             block: (id: import("../../crdt/index.js").BlockId) => import("../../crdt/nodes.js").DocBlock;
-            insertFlow: (target: import("../../crdt/flow.js").FlowTarget, flow: import("../../crdt/flow.js").Flow, view?: import("../../crdt/flow.js").FlowView | undefined) => import("../../index.js").OpResult;
+            insertFlow: (target: import("../../index.js").FlowTarget, flow: import("../../index.js").Flow, view?: import("../../crdt/flow.js").FlowView | undefined) => import("../../index.js").OpResult;
             deleteRange: (from: import("../../crdt/rangeDelete.js").DocPosition, to: import("../../crdt/rangeDelete.js").DocPosition, view?: import("../../crdt/rangeDelete.js").RangeView | undefined) => import("../../index.js").OpResult;
             replaceRange: (from: import("../../crdt/rangeDelete.js").DocPosition, to: import("../../crdt/rangeDelete.js").DocPosition, view?: import("../../crdt/rangeDelete.js").RangeView | undefined) => import("../../index.js").OpResult;
             insertTableRow: (table: string, index: number) => import("../../index.js").OpResult;
@@ -217,7 +217,7 @@ export declare const crdt: {
                 children?: import("../../crdt/index.js").BlockSpec[];
             }) => import("../../index.js").OpResult;
             setBlockType: (id: string, type: string) => import("../../index.js").OpResult;
-            patchData: (target: import("../../crdt/edytor-doc.js").DataTarget, patches: readonly import("../../crdt/data.js").DataPatch[]) => import("../../index.js").OpResult;
+            patchData: (target: import("../../crdt/edytor-doc.js").DataTarget, patches: readonly import("../../index.js").DataPatch[]) => import("../../index.js").OpResult;
             setBlockData: (id: string, data: Record<string, unknown>) => import("../../index.js").OpResult;
             duplicateBlock: (id: string, freshId: (oldId: string, kind: "block" | "inline") => string) => import("../../index.js").OpResult;
             insertText: (id: string, offset: number, text: string, marks?: Record<string, unknown> | undefined) => import("../../index.js").OpResult;
@@ -263,7 +263,7 @@ export declare const crdt: {
             blockDataOf: (id: string) => Record<string, unknown> | undefined;
             docData: () => import("../../crdt/doc/types.js").JsonObj;
             dataItemIds: (target: import("../../crdt/edytor-doc.js").DataTarget, path: readonly string[]) => string[];
-            blockAttribution: (id: string) => import("../../crdt/index.js").BlockAttribution | undefined;
+            blockAttribution: (id: string) => import("../../index.js").BlockAttribution | undefined;
             crdtId: (id: string) => string | null;
             resolveBlock: (id: string) => E.EngineNode | null;
             displayLength: (id: string) => number;
@@ -274,12 +274,12 @@ export declare const crdt: {
             compare: (a: import("../../crdt/index.js").BlockId, b: import("../../crdt/index.js").BlockId) => number;
             next: (id: string, policy?: import("../../crdt/edytor-doc.js").OrderPolicy | undefined) => string | null;
             previous: (id: string, policy?: import("../../crdt/edytor-doc.js").OrderPolicy | undefined) => string | null;
-            anchorAt: (id: string, offset: number, affinity?: import("../../crdt/edytor-doc.js").AnchorAffinity | undefined) => import("../../crdt/edytor-doc.js").DocAnchor | null;
-            resolveAnchor: (anchor: import("../../crdt/edytor-doc.js").DocAnchor) => {
+            anchorAt: (id: string, offset: number, affinity?: import("../../index.js").AnchorAffinity | undefined) => import("../../index.js").DocAnchor | null;
+            resolveAnchor: (anchor: import("../../index.js").DocAnchor) => {
                 blockId: import("../../crdt/index.js").BlockId;
                 offset: number;
             } | null;
-            followUndo: (anchor: import("../../crdt/edytor-doc.js").DocAnchor) => import("../../crdt/edytor-doc.js").DocAnchor;
+            followUndo: (anchor: import("../../index.js").DocAnchor) => import("../../index.js").DocAnchor;
             rolesChanged: () => void;
             isVoid: (id: string) => boolean;
             isIsland: (id: string) => boolean;
@@ -404,9 +404,9 @@ export declare const crdt: {
         };
     };
     providers: {
-        prefetch: (options: import("../../crdt/index.js").PrefetchOptions) => Promise<import("../../crdt/index.js").PrefetchResult>;
-        lastUpdated: (options: import("../../crdt/index.js").LastUpdatedOptions) => Promise<number | null>;
-        documentSnapshot: (options: import("../../crdt/index.js").LastUpdatedOptions) => Promise<JSONDoc | null>;
+        prefetch: (options: import("../../index.js").PrefetchOptions) => Promise<import("../../index.js").PrefetchResult>;
+        lastUpdated: (options: import("../../index.js").LastUpdatedOptions) => Promise<number | null>;
+        documentSnapshot: (options: import("../../index.js").LastUpdatedOptions) => Promise<JSONDoc | null>;
         IndexeddbPersistence: {
             new (name: string, doc: YDoc, options?: E.IndexeddbPersistenceOptions): {
                 doc: YDoc;
@@ -627,7 +627,7 @@ export declare const crdt: {
     };
     attribution: {
         attach: (doc: E.EngineDoc, opts: {
-            actor: import("../../crdt/index.js").AttributionActor;
+            actor: import("../../index.js").AttributionActor;
         }) => import("../../crdt/index.js").AttributionController;
     };
 };
@@ -671,7 +671,7 @@ export declare const tally: (t: Timing, ms: number) => void;
 export declare const encodeJSON: (value: unknown) => Uint8Array<ArrayBuffer>;
 /** A semantics config as the facade's lookups — own keys only: block types come off the wire. */
 declare const lookups: (semantics: DocumentSemanticsConfig) => {
-    roleOf: (type: string) => import("../../crdt/edytor-doc.js").BlockRole | undefined;
+    roleOf: (type: string) => import("../../index.js").BlockRole | undefined;
     kinds: () => string[];
     defaultChildOf: (type: string) => string | undefined;
     rendersContent: (type: string) => boolean;

package/dist/cloudflare/routeDocumentSocket.d.ts

@@ -88,7 +88,8 @@ export declare function routeDocumentHistory(request: Request, rooms: DocumentNa
  * write, another user's comment, an `Origin` that `options.allowedOrigins`
  * does not list), `404` (no such thread or comment, or the room keeps no
  * comments), `405` (another method), `409` (a thread or comment id taken),
- * `413` (a body over 64 KiB, or too many threads or comments).
+ * `413` (a body over 64 KiB, too many threads or comments, or the room's
+ * comment bytes full), `429` (the user past the room's comment rate).
  */
 export declare function routeDocumentComments(request: Request, rooms: DocumentNamespace, documentId: string, authorize: AuthorizeDocumentSocket, options?: RouteDocumentOptions): Promise<Response>;
 export declare function routeDocumentSocket(request: Request, rooms: DocumentNamespace, documentId: string, authorize: AuthorizeDocumentSocket, options?: RouteDocumentOptions): Promise<Response>;

package/dist/cloudflare/routeDocumentSocket.js

@@ -141,6 +141,35 @@ export async function routeDocumentHistory(request, rooms, documentId, authorize
     }
     return rooms.getByName(documentId).fetch(new Request(request.url, { method: 'GET', headers }));
 }
+/**
+ * A request's body as text, read no further than `max` bytes (`null`: it
+ * holds more, its declared length or not).
+ */
+const bodyWithin = async (request, max) => {
+    if (request.body === null)
+        return '';
+    const reader = request.body.getReader();
+    const chunks = [];
+    let length = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        length += value.byteLength;
+        if (length > max) {
+            await reader.cancel().catch(() => { });
+            return null;
+        }
+        chunks.push(value);
+    }
+    const bytes = new Uint8Array(length);
+    let at = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, at);
+        at += chunk.byteLength;
+    }
+    return new TextDecoder().decode(bytes);
+};
 /**
  * The host Worker's door to a document's comment threads, authorized as
  * {@link routeDocumentSocket} authorizes a dial, forwarding only the
@@ -158,7 +187,8 @@ export async function routeDocumentHistory(request, rooms, documentId, authorize
  * write, another user's comment, an `Origin` that `options.allowedOrigins`
  * does not list), `404` (no such thread or comment, or the room keeps no
  * comments), `405` (another method), `409` (a thread or comment id taken),
- * `413` (a body over 64 KiB, or too many threads or comments).
+ * `413` (a body over 64 KiB, too many threads or comments, or the room's
+ * comment bytes full), `429` (the user past the room's comment rate).
  */
 export async function routeDocumentComments(request, rooms, documentId, authorize, options) {
     const op = request.method === 'GET' ? 'list' : request.method === 'POST' ? 'post' : null;
@@ -174,8 +204,8 @@ export async function routeDocumentComments(request, rooms, documentId, authoriz
         const declared = Number(request.headers.get('Content-Length') ?? 0);
         if (declared > MAX_COMMENT_REQUEST_BYTES)
             return new Response('request too large', { status: 413 });
-        body = await request.text();
-        if (new TextEncoder().encode(body).length > MAX_COMMENT_REQUEST_BYTES)
+        body = await bodyWithin(request, MAX_COMMENT_REQUEST_BYTES);
+        if (body === null)
             return new Response('request too large', { status: 413 });
     }
     const headers = identityHeaders(identity);

package/dist/collaboration/awarenessSelection.d.ts

@@ -52,7 +52,7 @@ export type EdytorAwarenessState = {
  * Structural awareness surface used by `publishPresence` — the real
  * `Awareness` satisfies it; tests may substitute stubs.
  */
-type AwarenessLike = {
+export type AwarenessLike = {
     getLocalState: () => Record<string, unknown> | null;
     setLocalState: (state: Record<string, unknown> | null) => void;
 };
@@ -130,4 +130,3 @@ export declare const resolvePeerSelection: (edytor: Edytor, state: unknown) => {
 } | {
     blocks: string[];
 } | null;
-export {};