edytor 1.0.0-rc.1 → 1.0.0-rc.2

package/README.md

@@ -17,7 +17,7 @@
 
 Edytor aims to be for Svelte what Slate.js is for React: a heavily customizable editor with an API to build any kind of collaborative rich text editor.
 
-> **Release candidate.** Edytor `1.0.0-rc.1` is the 1.0 release candidate (`edytor` on npm): its API is frozen, and a change to it before 1.0 is a listed breaking change. It has no production track record yet: read the [limitations](https://edytor.dev/docs/reference/limitations) before you build on it. Issues and PRs are welcome: when you report a bug, include the document's JSON value.
+> **Release candidate.** Edytor `1.0.0-rc.2` is the 1.0 release candidate (`edytor` on npm): its API is frozen, and a change to it before 1.0 is a listed breaking change. It has no production track record yet: read the [limitations](https://edytor.dev/docs/reference/limitations) before you build on it. Issues and PRs are welcome: when you report a bug, include the document's JSON value.
 
 ## Features
 

package/dist/cloudflare/DocumentRoom.d.ts

@@ -47,7 +47,7 @@
  *   replace: those deletes wait with them, in memory); compaction keeps
  *   the pending records apart, and rewrites them as the deletes still
  *   waiting; a frame that discards a forged stamp drops them. At most
- *   {@link MAX_WAITING_DELETES} ranges wait, stored or in memory: a frame
+ *   `MAX_WAITING_DELETES` ranges wait, stored or in memory: a frame
  *   that would pass it has its waiting deletes dropped (refusal `waiting`,
  *   left out of the ack), the rest applied. Compaction reclaims the
  *   waiting deletes of client ids no user registered and no socket holds;
@@ -112,6 +112,7 @@ import type { CommitResult, ExportedBlocks, ImportReceipt, ImportRequest, LateEd
 import type { AwarenessEntry } from '../crdt/protocol.js';
 import type { DocumentSemanticsConfig, DocumentOperations, JSONBlock, JSONDoc, YDoc } from '../crdt/index.js';
 import type { CommentActor, CommentChange, CommentOutcome, CommentRequest, CommentSnapshot } from '../crdt/protocols/comments.js';
+export { closedSocket, COMMENTS_HEADER, DEFAULT_MAX_COMMENT_BYTES, DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND, HISTORY_HEADER, HISTORY_KEY_HEADER, IDENTITY_HEADERS, MAX_REFUSALS, MAX_WAITING_DELETES, noTimers, PROBE_HEADER, PURGE_ORIGIN, RESTORE_ORIGIN, ROOM_ORIGIN, SOCKET_TAG } from './room/shared.js';
 /** Under SQLite-backed Durable Objects' 2 MB row cap, with room for the other columns. */
 export declare const DEFAULT_MAX_ROW_BYTES: number;
 /** Update records before the rows are merged into one snapshot. */
@@ -166,14 +167,6 @@ export declare const DEFAULT_MAX_PRESENCE_PER_SECOND = 50;
  * would send 50,000 frames a second.
  */
 export declare const DEFAULT_MAX_PRESENCE_FANOUT = 2000;
-/**
- * Delete ranges the room keeps waiting for items it does not hold (a
- * relayer's delete of an author's edit a restore lost). Every update the
- * engine applies re-reads them, so they are capped.
- */
-export declare const MAX_WAITING_DELETES = 1024;
-/** Refusals kept in `refusals` (the newest); `refusalCounts` counts every one. */
-export declare const MAX_REFUSALS = 100;
 /**
  * A client id and the user who owns it (the room's replica registry). An
  * empty `user` marks an id a restore without a registry left unowned: its
@@ -208,33 +201,6 @@ export type SavedDocument = {
 };
 /** What `onLoad` may return: JSON, a bare v14 update, or `{ update, replicas }` (a `SavedDocument`). */
 export type LoadedDocument = JSONDoc | Uint8Array | Pick<SavedDocument, 'update' | 'replicas'>;
-/** The header `routeDocumentSocket` sets on an authorized probe: `lastUpdated` or `snapshot`. */
-export declare const PROBE_HEADER = "X-Edytor-Probe";
-/** The transaction origin of the room's own edits (`transact`, `onLoad` seeds). */
-export declare const ROOM_ORIGIN: unique symbol;
-/** The transaction origin of a history restore: the room's restore history tracks it. */
-export declare const RESTORE_ORIGIN: unique symbol;
-/** The transaction origin of the room's purge: tracked by no history. */
-export declare const PURGE_ORIGIN: unique symbol;
-/** The header `routeDocumentHistory` sets on an authorized history request. */
-export declare const HISTORY_HEADER = "X-Edytor-History";
-/** The version key of a history `read` or `restore` request. */
-export declare const HISTORY_KEY_HEADER = "X-Edytor-History-Key";
-/** The header `routeDocumentComments` sets on an authorized comments request: `list` or `post`. */
-export declare const COMMENTS_HEADER = "X-Edytor-Comments";
-/**
- * Headers carrying the identity `routeDocumentSocket` verified — never the
- * client's. The user id is percent-encoded (`encodeURIComponent`): a header
- * value is trimmed and cannot carry every character, and a user id is any
- * string.
- */
-export declare const IDENTITY_HEADERS: {
-    readonly user: "X-Edytor-User";
-    readonly replica: "X-Edytor-Replica";
-    readonly access: "X-Edytor-Access";
-    /** When the credential expires, ms since the epoch (absent: never). */
-    readonly expires: "X-Edytor-Expires";
-};
 /**
  * Optional knobs (strings, as `vars` arrive): row size, outgoing frame
  * limit and compaction threshold. The defaults are the platform limits.
@@ -434,15 +400,6 @@ export type RoomLogEntry = {
 };
 /** `pending`: deletes of items the room does not hold yet (they wait for them). */
 type RowKind = 'generation' | 'update' | 'snapshot' | 'pending';
-/**
- * An upgrade accepted and closed at once, so the client reads `code`: a
- * browser sees an HTTP error at the upgrade only as `1006`, which a
- * provider cannot tell from a network failure. Refuse a dial your Worker
- * turns away itself with it: the provider stops at `1008` or `4xxx`
- * (except `4401`, redialed), and redials after anything else (`CLOSE`,
- * `isRefusal` in `crdt/providers/room.ts`).
- */
-export declare const closedSocket: (code: number, reason: string) => Response;
 /** A stored record, reassembled: its kind, record number, bytes, and whether they are v2 (a v2 container's snapshot). */
 export type StoredRecord = {
     kind: RowKind;
@@ -450,8 +407,6 @@ export type StoredRecord = {
     bytes: Uint8Array<ArrayBuffer>;
     v2: boolean;
 };
-/** Run an entry point with timers forbidden — a pending timer keeps a Durable Object from hibernating. */
-export declare const noTimers: <T>(fn: () => T) => T;
 /** A block as `validate` reads it, before or after a frame. */
 export type ValidatedBlock = {
     id: string;
@@ -496,24 +451,20 @@ export type CommentOptions = {
     maxLength?: number;
     /**
      * The bytes the room's comments may hold (default
-     * {@link DEFAULT_MAX_COMMENT_BYTES}, 4 MiB): each body and quote in UTF-8
+     * `DEFAULT_MAX_COMMENT_BYTES`, 4 MiB): each body and quote in UTF-8
      * plus 128 a comment. A thread or reply past it is refused `413`; a
      * delete frees its bytes.
      */
     maxBytes?: number;
     /**
      * Comment requests per second (default
-     * {@link DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND}, a ten-second burst):
+     * `DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND`, a ten-second burst):
      * over HTTP per verified user (past it, `429`), and a socket's comment
      * messages per socket (past it, dropped). RPC calls are the host's own and
      * are not counted.
      */
     maxRequestsPerSecond?: number;
 };
-/** The bytes a room's comments hold at most, by default (4 MiB). */
-export declare const DEFAULT_MAX_COMMENT_BYTES: number;
-/** Comment requests per second and user (or socket), by default. */
-export declare const DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND = 2;
 /** What {@link attachRoom} (and `DocumentRoom`) takes. */
 export type AttachRoomOptions = {
     /**
@@ -599,7 +550,8 @@ export type AttachRoomOptions = {
      */
     semantics?: DocumentSemanticsConfig;
     /**
-     * Version history in KV (`room.history.*`): the room writes its
+     * Version history, in the store `HistoryOptions.store` names (a KV namespace, an R2 bucket or
+     * the room's own storage): the room writes its
      * state twice a day — the morning's at local noon, the evening's at
      * midnight, in `timeZone` — when it changed, for `retentionDays`; read
      * and restore them with `listHistory`, `readHistory`, `restoreHistory`
@@ -622,8 +574,6 @@ export type AttachRoomOptions = {
      */
     comments?: CommentOptions | false;
 };
-/** The tag of the document's sockets: other sockets of the object are left to you. */
-export declare const SOCKET_TAG = "edytor";
 /**
  * One edytor document living in a Durable Object's storage: the room
  * logic, independent of the class that hosts it. Create it with
@@ -648,7 +598,7 @@ export declare class AttachedDocument {
     failure: Error | null;
     /** Latest presence entry per replica, for join snapshots (memory: refills after a wake). */
     presence: Map<number, E.AwarenessEntry>;
-    /** The newest {@link MAX_REFUSALS} refusals since this instance started (diagnostics; memory only). */
+    /** The newest `MAX_REFUSALS` refusals since this instance started (diagnostics; memory only). */
     refusals: Refusal[];
     /** Every refusal since this instance started, by reason. */
     refusalCounts: Partial<Record<Refusal['reason'], number>>;
@@ -746,7 +696,7 @@ export declare class AttachedDocument {
     };
     /**
      * When the room last stored a change (ms since the epoch), or `null`
-     * for a room that stored none since 0.1.0-next.23. Cheap: one
+     * for a room that stored none since it records the time. Cheap: one
      * row, no document. `routeDocumentSocket` answers it over HTTP
      * (`GET <room>?lastUpdated`), also over RPC.
      */
@@ -857,7 +807,7 @@ export declare class AttachedDocument {
     metrics(): RoomMetrics;
     /**
      * Drop every waiting delete, stored or in memory (callable over RPC):
-     * the way out when a writer filled {@link MAX_WAITING_DELETES} with
+     * the way out when a writer filled `MAX_WAITING_DELETES` with
      * deletes of registered ids' items, which compaction keeps. A dropped
      * delete's item shows if it ever arrives — but for an entry a waiting
      * rewrite replaces, which that rewrite deletes should it integrate.
@@ -1056,4 +1006,3 @@ export declare class DocumentRoom<Env = DocumentRoomEnv> extends DurableObject<E
     get origin(): AttachedDocument['origin'];
     records(): ReturnType<AttachedDocument['records']>;
 }
-export {};

package/dist/cloudflare/DocumentRoom.js

@@ -47,7 +47,7 @@
  *   replace: those deletes wait with them, in memory); compaction keeps
  *   the pending records apart, and rewrites them as the deletes still
  *   waiting; a frame that discards a forged stamp drops them. At most
- *   {@link MAX_WAITING_DELETES} ranges wait, stored or in memory: a frame
+ *   `MAX_WAITING_DELETES` ranges wait, stored or in memory: a frame
  *   that would pass it has its waiting deletes dropped (refusal `waiting`,
  *   left out of the ack), the rest applied. Compaction reclaims the
  *   waiting deletes of client ids no user registered and no socket holds;
@@ -120,6 +120,8 @@ import { ReplicaRegistry } from './room/replicas.js';
 import { Scheduler } from './room/scheduler.js';
 import { RoomStorage } from './room/storage.js';
 import { RoomValidation } from './room/validation.js';
+import { noTimers, SOCKET_TAG } from './room/shared.js';
+export { closedSocket, COMMENTS_HEADER, DEFAULT_MAX_COMMENT_BYTES, DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND, HISTORY_HEADER, HISTORY_KEY_HEADER, IDENTITY_HEADERS, MAX_REFUSALS, MAX_WAITING_DELETES, noTimers, PROBE_HEADER, PURGE_ORIGIN, RESTORE_ORIGIN, ROOM_ORIGIN, SOCKET_TAG } from './room/shared.js';
 /** Under SQLite-backed Durable Objects' 2 MB row cap, with room for the other columns. */
 export const DEFAULT_MAX_ROW_BYTES = 2_000_000 - 4096;
 /** Update records before the rows are merged into one snapshot. */
@@ -177,75 +179,6 @@ export const DEFAULT_MAX_PRESENCE_FANOUT = 2000;
 /** Seconds of the update rate a socket may spend at once. */
 /** The ceiling of a quota knob (a host may raise the defaults up to it). */
 const QUOTA_CEILING = 2 ** 40;
-/**
- * Delete ranges the room keeps waiting for items it does not hold (a
- * relayer's delete of an author's edit a restore lost). Every update the
- * engine applies re-reads them, so they are capped.
- */
-export const MAX_WAITING_DELETES = 1024;
-/** Refusals kept in `refusals` (the newest); `refusalCounts` counts every one. */
-export const MAX_REFUSALS = 100;
-/** The header `routeDocumentSocket` sets on an authorized probe: `lastUpdated` or `snapshot`. */
-export const PROBE_HEADER = 'X-Edytor-Probe';
-/** The transaction origin of the room's own edits (`transact`, `onLoad` seeds). */
-export const ROOM_ORIGIN = Symbol('edytor-room');
-/** The transaction origin of a history restore: the room's restore history tracks it. */
-export const RESTORE_ORIGIN = Symbol('edytor-restore');
-/** The transaction origin of the room's purge: tracked by no history. */
-export const PURGE_ORIGIN = Symbol('edytor-purge');
-/** The header `routeDocumentHistory` sets on an authorized history request. */
-export const HISTORY_HEADER = 'X-Edytor-History';
-/** The version key of a history `read` or `restore` request. */
-export const HISTORY_KEY_HEADER = 'X-Edytor-History-Key';
-/** The header `routeDocumentComments` sets on an authorized comments request: `list` or `post`. */
-export const COMMENTS_HEADER = 'X-Edytor-Comments';
-/**
- * Headers carrying the identity `routeDocumentSocket` verified — never the
- * client's. The user id is percent-encoded (`encodeURIComponent`): a header
- * value is trimmed and cannot carry every character, and a user id is any
- * string.
- */
-export const IDENTITY_HEADERS = {
-    user: 'X-Edytor-User',
-    replica: 'X-Edytor-Replica',
-    access: 'X-Edytor-Access',
-    /** When the credential expires, ms since the epoch (absent: never). */
-    expires: 'X-Edytor-Expires'
-};
-/**
- * An upgrade accepted and closed at once, so the client reads `code`: a
- * browser sees an HTTP error at the upgrade only as `1006`, which a
- * provider cannot tell from a network failure. Refuse a dial your Worker
- * turns away itself with it: the provider stops at `1008` or `4xxx`
- * (except `4401`, redialed), and redials after anything else (`CLOSE`,
- * `isRefusal` in `crdt/providers/room.ts`).
- */
-export const closedSocket = (code, reason) => {
-    const [client, server] = Object.values(new WebSocketPair());
-    server.accept();
-    server.close(code, reason);
-    return new Response(null, { status: 101, webSocket: client });
-};
-/** Run an entry point with timers forbidden — a pending timer keeps a Durable Object from hibernating. */
-export const noTimers = (fn) => {
-    const g = globalThis;
-    const saved = [g.setTimeout, g.setInterval];
-    const forbidden = () => {
-        throw new Error('room scheduled a timer (a Durable Object could not hibernate)');
-    };
-    g.setTimeout = forbidden;
-    g.setInterval = forbidden;
-    try {
-        return fn();
-    }
-    finally {
-        [g.setTimeout, g.setInterval] = saved;
-    }
-};
-/** The bytes a room's comments hold at most, by default (4 MiB). */
-export const DEFAULT_MAX_COMMENT_BYTES = 4 * 1024 * 1024;
-/** Comment requests per second and user (or socket), by default. */
-export const DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND = 2;
 /** `EDYTOR_PURGE_AFTER_DAYS`: `off` (or `false`) never purges; a number of days; anything else the default. */
 const purgeAfterDays = (value) => {
     if (value === 'off' || value === 'false' || value === false)
@@ -253,8 +186,6 @@ const purgeAfterDays = (value) => {
     const n = Number(value);
     return Number.isInteger(n) && n > 0 ? n : undefined;
 };
-/** The tag of the document's sockets: other sockets of the object are left to you. */
-export const SOCKET_TAG = 'edytor';
 /**
  * One edytor document living in a Durable Object's storage: the room
  * logic, independent of the class that hosts it. Create it with
@@ -279,7 +210,7 @@ export class AttachedDocument {
     failure = null;
     /** Latest presence entry per replica, for join snapshots (memory: refills after a wake). */
     presence = new Map();
-    /** The newest {@link MAX_REFUSALS} refusals since this instance started (diagnostics; memory only). */
+    /** The newest `MAX_REFUSALS` refusals since this instance started (diagnostics; memory only). */
     refusals = [];
     /** Every refusal since this instance started, by reason. */
     refusalCounts = {};
@@ -427,7 +358,7 @@ export class AttachedDocument {
     }
     /**
      * When the room last stored a change (ms since the epoch), or `null`
-     * for a room that stored none since 0.1.0-next.23. Cheap: one
+     * for a room that stored none since it records the time. Cheap: one
      * row, no document. `routeDocumentSocket` answers it over HTTP
      * (`GET <room>?lastUpdated`), also over RPC.
      */
@@ -582,7 +513,7 @@ export class AttachedDocument {
     }
     /**
      * Drop every waiting delete, stored or in memory (callable over RPC):
-     * the way out when a writer filled {@link MAX_WAITING_DELETES} with
+     * the way out when a writer filled `MAX_WAITING_DELETES` with
      * deletes of registered ids' items, which compaction keeps. A dropped
      * delete's item shows if it ever arrives — but for an entry a waiting
      * rewrite replaces, which that rewrite deletes should it integrate.

package/dist/cloudflare/history.d.ts

@@ -200,8 +200,8 @@ export declare const historyEntry: (room: string, name: string, metadata: unknow
  * Versions in a Workers KV namespace (the room history's first store): KV's
  * TTL expires them (`nativeTtl`, `expirationTtl` = the retention, at least
  * KV's 60 s), its listing's `expiration` is each one's `expiresAt`, its
- * metadata the room's. Values up to KV's 25 MiB. Versions written by
- * 0.1.0-next.24 and next.25 (a bare namespace as the store) read as they are.
+ * metadata the room's. Values up to KV's 25 MiB. Versions written by the
+ * pre-releases that took a bare namespace as the store read as they are.
  */
 export declare const kvHistory: (namespace: KVLike) => HistoryStore;
 /**

package/dist/cloudflare/history.js

@@ -145,8 +145,8 @@ const finite = (value) => {
  * Versions in a Workers KV namespace (the room history's first store): KV's
  * TTL expires them (`nativeTtl`, `expirationTtl` = the retention, at least
  * KV's 60 s), its listing's `expiration` is each one's `expiresAt`, its
- * metadata the room's. Values up to KV's 25 MiB. Versions written by
- * 0.1.0-next.24 and next.25 (a bare namespace as the store) read as they are.
+ * metadata the room's. Values up to KV's 25 MiB. Versions written by the
+ * pre-releases that took a bare namespace as the store read as they are.
  */
 export const kvHistory = (namespace) => ({
     maxValueBytes: HISTORY_MAX_VALUE_BYTES,

package/dist/cloudflare/room/access.js

@@ -6,7 +6,7 @@
  * revocation, a changed access, an expired credential.
  */
 import { CLOSE } from '../../crdt/providers/room.js';
-import { COMMENTS_HEADER, HISTORY_HEADER, HISTORY_KEY_HEADER, IDENTITY_HEADERS, PROBE_HEADER, SOCKET_TAG, closedSocket, noTimers } from '../DocumentRoom.js';
+import { COMMENTS_HEADER, HISTORY_HEADER, HISTORY_KEY_HEADER, IDENTITY_HEADERS, PROBE_HEADER, SOCKET_TAG, closedSocket, noTimers } from './shared.js';
 import { STORAGE_FAILURE } from './context.js';
 import { readOnlyFrame, step1Frame } from './frames.js';
 import { StorageFault } from './replicas.js';

package/dist/cloudflare/room/admission.js

@@ -12,7 +12,7 @@
 import { Y } from '../../crdt/engine.js';
 import * as E from '../../crdt/protocol.js';
 import { ChunkLimitError, ChunkSequenceError, CLOSE } from '../../crdt/providers/room.js';
-import { MAX_WAITING_DELETES, noTimers } from '../DocumentRoom.js';
+import { MAX_WAITING_DELETES, noTimers } from './shared.js';
 import { STORAGE_FAILURE, now, sync, tally } from './context.js';
 import { attributionWrites, BINDING_PREFIX, forgedAttributionDeletes, forgedDeletes, forgedWriters } from './forged.js';
 import { MalformedFrame, decode, readOnlyDenialFrame, savedFrame, step1Frame, storedStep2, updateFrame } from './frames.js';

package/dist/cloudflare/room/comments.d.ts

@@ -8,7 +8,7 @@
  */
 import * as E from '../../crdt/protocol.js';
 import { type CommentActor, type CommentOutcome, type CommentRequest, type CommentSnapshot } from '../../crdt/protocols/comments.js';
-import { type Attachment, type SocketIdentity } from '../DocumentRoom.js';
+import type { Attachment, SocketIdentity } from '../DocumentRoom.js';
 import { type RoomContext } from './context.js';
 /** The largest request body `routeDocumentComments` forwards, in bytes. */
 export declare const MAX_COMMENT_REQUEST_BYTES: number;

package/dist/cloudflare/room/comments.js

@@ -8,7 +8,7 @@
  */
 import * as E from '../../crdt/protocol.js';
 import { COMMENT_MARK, COMMENT_ROW_BYTES, COMMENT_STATUS, commentAnchors, decideComment, OVER_BYTE_QUOTA, parseCommentRequest, validCommentId } from '../../crdt/protocols/comments.js';
-import { DEFAULT_MAX_COMMENT_BYTES, DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND, SOCKET_TAG, noTimers } from '../DocumentRoom.js';
+import { DEFAULT_MAX_COMMENT_BYTES, DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND, SOCKET_TAG, noTimers } from './shared.js';
 import { allowance } from './admission.js';
 import { knob } from './context.js';
 import { decode } from './frames.js';

package/dist/cloudflare/room/context.d.ts

@@ -10,7 +10,7 @@
 import { Y } from '../../crdt/engine.js';
 import * as E from '../../crdt/protocol.js';
 import type { DocumentSemanticsConfig, EdytorDoc, JSONDoc, YDoc } from '../../crdt/index.js';
-import { type AttachRoomOptions, type AttachedDocument, type Refusal, type RoomLogEntry, type Timing } from '../DocumentRoom.js';
+import type { AttachRoomOptions, AttachedDocument, Refusal, RoomLogEntry, Timing } from '../DocumentRoom.js';
 import type { RoomAccess } from './access.js';
 import type { Admission } from './admission.js';
 import type { RoomComments } from './comments.js';

package/dist/cloudflare/room/context.js

@@ -12,7 +12,7 @@ import * as E from '../../crdt/protocol.js';
 import { CLOSE } from '../../crdt/providers/room.js';
 import { asEngineDoc } from '../../crdt/structs.js';
 import { defaultSemantics, facadeConfigOf, semanticsDigest } from '../../crdt/semantics.js';
-import { MAX_REFUSALS, ROOM_ORIGIN, SOCKET_TAG, noTimers } from '../DocumentRoom.js';
+import { MAX_REFUSALS, ROOM_ORIGIN, SOCKET_TAG, noTimers } from './shared.js';
 /** The engine API the room is built on (the Worker-safe CRDT entry). */
 export const crdt = E.bindCrdt(Y);
 export const sync = crdt.sync;

package/dist/cloudflare/room/history.d.ts

@@ -1,5 +1,5 @@
 import type { JSONDoc } from '../../crdt/index.js';
-import { type RestoreResult, type SocketIdentity } from '../DocumentRoom.js';
+import type { RestoreResult, SocketIdentity } from '../DocumentRoom.js';
 import { type HistoryEntry, type HistoryOptions, type HistoryStore } from '../history.js';
 import { type Decoded, type RoomContext } from './context.js';
 /** The history settings, resolved. */

package/dist/cloudflare/room/history.js

@@ -8,7 +8,7 @@ import { Y } from '../../crdt/engine.js';
 import * as E from '../../crdt/protocol.js';
 import { gunzip, packed } from '../../crdt/storage.js';
 import { asEngineDoc, collectable, collectNow, collects, engineOps, stepsOf } from '../../crdt/structs.js';
-import { PURGE_ORIGIN, RESTORE_ORIGIN, noTimers } from '../DocumentRoom.js';
+import { PURGE_ORIGIN, RESTORE_ORIGIN, noTimers } from './shared.js';
 import { DEFAULT_RETENTION_DAYS, HISTORY_MAX_VALUE_BYTES, fitMetadata, historyEntry, historyKey, historyPrefix, parseHistoryKey, resolveHistoryStore, slotAt, slotEnd, validTimeZone } from '../history.js';
 import { DAY, crdt, knob } from './context.js';
 import { admit, deletesUpdate, liveState } from './updates.js';

package/dist/cloudflare/room/moves.js

@@ -8,7 +8,7 @@ import { Y } from '../../crdt/engine.js';
 import { DEL_PREFIX, REGISTRY_KEY } from '../../crdt/schema.js';
 import { asEngineDoc, attrItems } from '../../crdt/structs.js';
 import { toBlockSpec } from '../../utils/json.js';
-import { noTimers } from '../DocumentRoom.js';
+import { noTimers } from './shared.js';
 import { DEFAULT_MOVE_GRACE_DAYS, contentOf, flattenMoved, hunk, mergeData, subtreesOf, threeWay, unitsOf } from '../move.js';
 import { DAY, crdt } from './context.js';
 /** A forward of late edits that failed runs again this much later (`room.move.late`). */

package/dist/cloudflare/room/presence.d.ts

@@ -1,6 +1,6 @@
 import type { AwarenessEntry } from '../../crdt/protocol.js';
 import type { YDoc } from '../../crdt/index.js';
-import { type Attachment } from '../DocumentRoom.js';
+import type { Attachment } from '../DocumentRoom.js';
 import { type RoomContext } from './context.js';
 export declare class RoomPresence {
     private readonly room;

package/dist/cloudflare/room/presence.js

@@ -7,7 +7,7 @@
  * the socket goes.
  */
 import { semanticsMismatch } from '../../crdt/semantics.js';
-import { SOCKET_TAG } from '../DocumentRoom.js';
+import { SOCKET_TAG } from './shared.js';
 import { allowance } from './admission.js';
 import { encodeJSON } from './context.js';
 import { encodePresenceEntry, presenceFrame, presenceFrameOf } from './frames.js';

package/dist/cloudflare/room/purge.js

@@ -6,7 +6,7 @@
  */
 import { Y } from '../../crdt/engine.js';
 import { asEngineDoc } from '../../crdt/structs.js';
-import { PURGE_ORIGIN, noTimers } from '../DocumentRoom.js';
+import { PURGE_ORIGIN, noTimers } from './shared.js';
 import { DEFAULT_RETENTION_DAYS } from '../history.js';
 import { DAY, crdt, knob } from './context.js';
 import { sameBytes } from './updates.js';

package/dist/cloudflare/room/replicas.d.ts

@@ -1,5 +1,5 @@
 import type { YDoc } from '../../crdt/index.js';
-import { type Attachment } from '../DocumentRoom.js';
+import type { Attachment } from '../DocumentRoom.js';
 import type { RoomContext } from './context.js';
 /** A SQLite fault outside the append path (the replica registry). */
 export declare class StorageFault extends Error {

package/dist/cloudflare/room/replicas.js

@@ -7,7 +7,7 @@
  */
 import { ATTRIBUTION_ROOT } from '../../crdt/schema.js';
 import { asEngineDoc } from '../../crdt/structs.js';
-import { ROOM_ORIGIN } from '../DocumentRoom.js';
+import { ROOM_ORIGIN } from './shared.js';
 import { BINDING_PREFIX } from './forged.js';
 import { stateVector } from './updates.js';
 /** A SQLite fault outside the append path (the replica registry). */

package/dist/cloudflare/room/scheduler.d.ts

@@ -34,6 +34,6 @@ export declare class Scheduler {
     unschedule(task: Task): void;
     /** Set the alarm to the earliest due time (none due: the alarm set is left, and finds nothing). */
     private arm;
-    /** The due times stored (`due.<task>`); an alarm armed by 0.1.0-next.23 (none stored) is a due save. */
+    /** The due times stored (`due.<task>`); an alarm armed before the scheduler (none stored) is a due save. */
     readDues(): void;
 }

package/dist/cloudflare/room/scheduler.js

@@ -4,7 +4,7 @@
  * earliest. The tasks themselves are their owners' (`AttachedDocument`
  * wires them): this module decides only when each runs.
  */
-import { noTimers } from '../DocumentRoom.js';
+import { noTimers } from './shared.js';
 const TASKS = ['history', 'save', 'purge', 'retention', 'forward', 'expiry'];
 export class Scheduler {
     room;
@@ -103,7 +103,7 @@ export class Scheduler {
         this.armed = next;
         void this.room.ctx.storage.setAlarm(next);
     }
-    /** The due times stored (`due.<task>`); an alarm armed by 0.1.0-next.23 (none stored) is a due save. */
+    /** The due times stored (`due.<task>`); an alarm armed before the scheduler (none stored) is a due save. */
     readDues() {
         const rows = this.room.sql
             .exec(`SELECT key, value FROM ${this.room.tables.meta} WHERE key LIKE 'due.%'`)

package/dist/cloudflare/room/shared.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The room's shared constants and two helpers every room module reads:
+ * the headers the router sets, the transaction origins, the socket tag,
+ * the refusal caps and the comment defaults, `noTimers` and
+ * `closedSocket`. A leaf: it imports nothing of the room, so the room's
+ * modules read it without importing `DocumentRoom.ts` (which re-exports
+ * every name here). Worker-safe.
+ */
+/**
+ * Delete ranges the room keeps waiting for items it does not hold (a
+ * relayer's delete of an author's edit a restore lost). Every update the
+ * engine applies re-reads them, so they are capped.
+ */
+export declare const MAX_WAITING_DELETES = 1024;
+/** Refusals kept in `refusals` (the newest); `refusalCounts` counts every one. */
+export declare const MAX_REFUSALS = 100;
+/** The header `routeDocumentSocket` sets on an authorized probe: `lastUpdated` or `snapshot`. */
+export declare const PROBE_HEADER = "X-Edytor-Probe";
+/** The transaction origin of the room's own edits (`transact`, `onLoad` seeds). */
+export declare const ROOM_ORIGIN: unique symbol;
+/** The transaction origin of a history restore: the room's restore history tracks it. */
+export declare const RESTORE_ORIGIN: unique symbol;
+/** The transaction origin of the room's purge: tracked by no history. */
+export declare const PURGE_ORIGIN: unique symbol;
+/** The header `routeDocumentHistory` sets on an authorized history request. */
+export declare const HISTORY_HEADER = "X-Edytor-History";
+/** The version key of a history `read` or `restore` request. */
+export declare const HISTORY_KEY_HEADER = "X-Edytor-History-Key";
+/** The header `routeDocumentComments` sets on an authorized comments request: `list` or `post`. */
+export declare const COMMENTS_HEADER = "X-Edytor-Comments";
+/**
+ * Headers carrying the identity `routeDocumentSocket` verified — never the
+ * client's. The user id is percent-encoded (`encodeURIComponent`): a header
+ * value is trimmed and cannot carry every character, and a user id is any
+ * string.
+ */
+export declare const IDENTITY_HEADERS: {
+    readonly user: "X-Edytor-User";
+    readonly replica: "X-Edytor-Replica";
+    readonly access: "X-Edytor-Access";
+    /** When the credential expires, ms since the epoch (absent: never). */
+    readonly expires: "X-Edytor-Expires";
+};
+/**
+ * An upgrade accepted and closed at once, so the client reads `code`: a
+ * browser sees an HTTP error at the upgrade only as `1006`, which a
+ * provider cannot tell from a network failure. Refuse a dial your Worker
+ * turns away itself with it: the provider stops at `1008` or `4xxx`
+ * (except `4401`, redialed), and redials after anything else (`CLOSE`,
+ * `isRefusal` in `crdt/providers/room.ts`).
+ */
+export declare const closedSocket: (code: number, reason: string) => Response;
+/** Run an entry point with timers forbidden — a pending timer keeps a Durable Object from hibernating. */
+export declare const noTimers: <T>(fn: () => T) => T;
+/** The bytes a room's comments hold at most, by default (4 MiB). */
+export declare const DEFAULT_MAX_COMMENT_BYTES: number;
+/** Comment requests per second and user (or socket), by default. */
+export declare const DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND = 2;
+/** The tag of the document's sockets: other sockets of the object are left to you. */
+export declare const SOCKET_TAG = "edytor";

package/dist/cloudflare/room/shared.js

@@ -0,0 +1,79 @@
+/**
+ * The room's shared constants and two helpers every room module reads:
+ * the headers the router sets, the transaction origins, the socket tag,
+ * the refusal caps and the comment defaults, `noTimers` and
+ * `closedSocket`. A leaf: it imports nothing of the room, so the room's
+ * modules read it without importing `DocumentRoom.ts` (which re-exports
+ * every name here). Worker-safe.
+ */
+/**
+ * Delete ranges the room keeps waiting for items it does not hold (a
+ * relayer's delete of an author's edit a restore lost). Every update the
+ * engine applies re-reads them, so they are capped.
+ */
+export const MAX_WAITING_DELETES = 1024;
+/** Refusals kept in `refusals` (the newest); `refusalCounts` counts every one. */
+export const MAX_REFUSALS = 100;
+/** The header `routeDocumentSocket` sets on an authorized probe: `lastUpdated` or `snapshot`. */
+export const PROBE_HEADER = 'X-Edytor-Probe';
+/** The transaction origin of the room's own edits (`transact`, `onLoad` seeds). */
+export const ROOM_ORIGIN = Symbol('edytor-room');
+/** The transaction origin of a history restore: the room's restore history tracks it. */
+export const RESTORE_ORIGIN = Symbol('edytor-restore');
+/** The transaction origin of the room's purge: tracked by no history. */
+export const PURGE_ORIGIN = Symbol('edytor-purge');
+/** The header `routeDocumentHistory` sets on an authorized history request. */
+export const HISTORY_HEADER = 'X-Edytor-History';
+/** The version key of a history `read` or `restore` request. */
+export const HISTORY_KEY_HEADER = 'X-Edytor-History-Key';
+/** The header `routeDocumentComments` sets on an authorized comments request: `list` or `post`. */
+export const COMMENTS_HEADER = 'X-Edytor-Comments';
+/**
+ * Headers carrying the identity `routeDocumentSocket` verified — never the
+ * client's. The user id is percent-encoded (`encodeURIComponent`): a header
+ * value is trimmed and cannot carry every character, and a user id is any
+ * string.
+ */
+export const IDENTITY_HEADERS = {
+    user: 'X-Edytor-User',
+    replica: 'X-Edytor-Replica',
+    access: 'X-Edytor-Access',
+    /** When the credential expires, ms since the epoch (absent: never). */
+    expires: 'X-Edytor-Expires'
+};
+/**
+ * An upgrade accepted and closed at once, so the client reads `code`: a
+ * browser sees an HTTP error at the upgrade only as `1006`, which a
+ * provider cannot tell from a network failure. Refuse a dial your Worker
+ * turns away itself with it: the provider stops at `1008` or `4xxx`
+ * (except `4401`, redialed), and redials after anything else (`CLOSE`,
+ * `isRefusal` in `crdt/providers/room.ts`).
+ */
+export const closedSocket = (code, reason) => {
+    const [client, server] = Object.values(new WebSocketPair());
+    server.accept();
+    server.close(code, reason);
+    return new Response(null, { status: 101, webSocket: client });
+};
+/** Run an entry point with timers forbidden — a pending timer keeps a Durable Object from hibernating. */
+export const noTimers = (fn) => {
+    const g = globalThis;
+    const saved = [g.setTimeout, g.setInterval];
+    const forbidden = () => {
+        throw new Error('room scheduled a timer (a Durable Object could not hibernate)');
+    };
+    g.setTimeout = forbidden;
+    g.setInterval = forbidden;
+    try {
+        return fn();
+    }
+    finally {
+        [g.setTimeout, g.setInterval] = saved;
+    }
+};
+/** The bytes a room's comments hold at most, by default (4 MiB). */
+export const DEFAULT_MAX_COMMENT_BYTES = 4 * 1024 * 1024;
+/** Comment requests per second and user (or socket), by default. */
+export const DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND = 2;
+/** The tag of the document's sockets: other sockets of the object are left to you. */
+export const SOCKET_TAG = 'edytor';