edytor 3.0.0 → 5.0.0

package/README.md

@@ -17,7 +17,7 @@
 
 Edytor aims to be for Svelte what Slate.js is for React: a heavily customizable editor with an API to build any kind of collaborative rich text editor.
 
-> **3.0.** Edytor `3.0.0` is on npm as `edytor`: its API follows semantic versioning, and every change is listed in the changelog. It has no production track record yet: read the [limitations](https://edytor.dev/docs/reference/limitations) before you build on it. Issues and PRs are welcome: when you report a bug, include the document's JSON value.
+> **5.0.** Edytor `5.0.0` is on npm as `edytor`: its API follows semantic versioning, and every change is listed in the changelog. It has no production track record yet: read the [limitations](https://edytor.dev/docs/reference/limitations) before you build on it. Issues and PRs are welcome: when you report a bug, include the document's JSON value.
 
 ## Features
 
@@ -40,7 +40,7 @@ Edytor aims to be for Svelte what Slate.js is for React: a heavily customizable
 
 ## Install
 
-Edytor `3.0.0` is on npm under `latest`:
+Edytor `5.0.0` is on npm under `latest`:
 
 ```bash
 pnpm add edytor

package/dist/block/block.svelte.js

@@ -1,5 +1,6 @@
 import { cleanups } from '../utils.js';
 import { Text } from '../text/text.svelte.js';
+import { segmentAt } from '../crdt/parts.js';
 /** Mark an element inside a block's markup as non-editable chrome (`block.void`, a preview's too). */
 export const voidChrome = (node) => {
     node.setAttribute('data-edytor-void', `true`);
@@ -63,12 +64,9 @@ export class Block {
     get content() {
         this.#track();
         const handles = this.edytor.idToBlock;
-        let ordinal = 0;
         return handles
             .parts(this.id)
-            .map((part) => part.kind === 'text'
-            ? handles.text(this.id, ordinal++)
-            : handles.atom(this.id, part.item.id));
+            .map((part) => part.kind === 'text' ? handles.text(this.id, part.segOrd) : handles.atom(this.id, part.id));
     }
     get type() {
         if (this.isRoot)
@@ -299,23 +297,10 @@ export class Block {
      * last text's end).
      */
     textAtOffset = (offset) => {
-        let at = 0;
-        let hit = null;
-        for (const part of this.content) {
-            if (!(part instanceof Text)) {
-                if (offset <= at)
-                    return hit;
-                at += 1;
-            }
-            else if (offset <= at + part.length) {
-                return { text: part, offset: Math.max(0, offset - at) };
-            }
-            else {
-                hit = { text: part, offset: part.length };
-                at += part.length;
-            }
-        }
-        return hit;
+        this.#track();
+        const { start, end, segOrd } = segmentAt(this.edytor.idToBlock.parts(this.id), offset);
+        const text = this.edytor.idToBlock.text(this.id, segOrd);
+        return { text, offset: Math.min(Math.max(0, offset - start), end - start) };
     };
     /** The declared view state (`open` on a `details`) the block's last element held. */
     #viewState = [];

package/dist/block/inlineBlock.svelte.js

@@ -27,9 +27,9 @@ export class InlineBlock {
     get #item() {
         if ($effect.tracking())
             this.edytor.cells?.get(this.blockId);
-        const parts = this.edytor.idToBlock.parts(this.blockId);
-        const part = parts.find((part) => part.kind === 'inline' && part.item.id === this.id);
-        return part?.kind === 'inline' ? part.item : undefined;
+        return this.edytor.idToBlock
+            .parts(this.blockId)
+            .find((part) => part.kind === 'inline' && part.id === this.id);
     }
     get selected() {
         return this.edytor.selection.selectedInlineBlock.has(this);
@@ -66,9 +66,8 @@ export class InlineBlock {
         node.dataset.edytorId = this.id;
         node.dataset.edytorInlineBlock = this.type;
         this.#attachedNodes.add(node);
-        this.edytor.nodeToInlineBlock.set(node, this);
         this.node = node;
-        const release = this.edytor.surface.register(node, 'atom', this.blockId);
+        const release = this.edytor.surface.register(node, 'atom', this.blockId, undefined, undefined, this);
         const selectInlineBlock = (event) => {
             if (event.button !== 0)
                 return;
@@ -100,7 +99,6 @@ export class InlineBlock {
                 if (this.node === node) {
                     this.node = this.#attachedNodes.values().next().value;
                 }
-                this.edytor.nodeToInlineBlock.delete(node);
                 release();
             }
         };

package/dist/clipboard/moveText.js

@@ -74,14 +74,12 @@ export const dropText = (edytor, drag, to) => {
     /** The text and offset an anchor resolves to. */
     const point = (anchor) => {
         const hit = anchor && facade.resolveAnchor(anchor);
-        const at = hit && edytor.idToBlock.get(hit.blockId)?.textAtOffset(hit.offset);
-        return at ? [at.text, at.offset] : [null, 0];
+        return hit && edytor.idToBlock.has(hit.blockId)
+            ? { block: hit.blockId, offset: hit.offset }
+            : null;
     };
-    const [startText, startOffset] = point(placed.from);
-    const [endText, endOffset] = point(placed.to);
-    if (startText && endText)
-        edytor.selection.selectText(startText, startOffset, endText, endOffset);
-    else if (endText)
-        edytor.selection.selectText(endText, endOffset);
+    const [from, at] = [point(placed.from), point(placed.to)];
+    if (at)
+        edytor.selection.selectAt(from ?? at, at);
     return true;
 };

package/dist/cloudflare/DocumentRoom.d.ts

@@ -106,6 +106,7 @@ import * as E from '../crdt/protocol.js';
 import type { PurgeReport } from '../crdt/purge.js';
 import { type HistoryEntry, type HistoryOptions, type KVLike, type R2BucketLike } from './history.js';
 import type { LockOptions } from './locks.js';
+import type { DocumentAccessLevel } from './routeDocumentSocket.js';
 import type { CommitResult, ExportedBlocks, ImportReceipt, ImportRequest, LateEditBatch, MoveNamespace } from './move.js';
 import type { AwarenessEntry } from '../crdt/protocol.js';
 import type { DocumentSemanticsConfig, DocumentOperations, JSONBlock, JSONDoc, YDoc } from '../crdt/index.js';
@@ -121,9 +122,11 @@ export declare const DEFAULT_SAVE_AFTER = 2000;
  * Room quotas, each refused with `4413` (`quota: <name>`). The
  * document's size: what its records hold (uncompressed) and the updates the
  * engine holds waiting. An isolate has 128 MB, and the live document takes
- * 18 to 46 bytes of heap per stored byte (prose to one short line per
- * block, its index included; `bench/room-memory.mjs`): 2 MiB is
- * about 100 MB at worst. Raise it for documents of long text.
+ * 15 to 77 bytes of heap per stored byte in Node (prose to one short line
+ * per block, its index included; `bench/room-memory.mjs`; a Worker takes
+ * less): 2 MiB is about 150 to 160 MB at worst, a list of some 23,000 short
+ * blocks (1.25 MiB keeps that near 100 MB). Raise it for documents of long
+ * text, lower it for long lists of short blocks.
  */
 export declare const DEFAULT_MAX_DOCUMENT_BYTES: number;
 /** The share of the document quota past which the room logs its size, by default. */
@@ -256,7 +259,13 @@ export type SocketIdentity = {
     user: string;
     /** `null` until bound — by `authorize`, or by the socket's first presence entry. */
     replica: number | null;
+    /** It writes nothing to the document (a `read` or `comment` access). */
     readOnly: boolean;
+    /**
+     * Less than `write`, more than `read`: `suggest` writes only suggestions
+     * (`room.access.suggest`), `comment` only comments (`room.access.comment`).
+     */
+    access?: 'suggest' | 'comment';
     /**
      * When its credential expires (ms since the epoch, the room's clock):
      * the room closes it `4401` then (`room.access`). `null` or absent: never.
@@ -272,7 +281,7 @@ export type Attachment = SocketIdentity & {
     comments?: boolean;
 };
 export type Refusal = {
-    reason: 'generation' | 'schema' | 'malformed' | 'container' | 'identity' | 'replica' | 'read-only' | 'waiting' | 'storage' | 'internal' | 'quota' | 'access' | 'presence' | 'comments' | 'mark' | 'forged' | 'denied' | 'orphan' | 'relayed' | 'history';
+    reason: 'generation' | 'schema' | 'malformed' | 'container' | 'identity' | 'replica' | 'read-only' | 'waiting' | 'storage' | 'internal' | 'quota' | 'access' | 'presence' | 'comments' | 'mark' | 'suggest-only' | 'forged' | 'denied' | 'orphan' | 'relayed' | 'history';
     detail: unknown;
 };
 /** A duration series: how many, their total and longest (ms; see {@link RoomMetrics}). */
@@ -364,7 +373,7 @@ export type RoomLogEntry = {
     user: string;
 } | ({
     edytor: 'purge';
-    horizon: number;
+    horizon: number | null;
     bytes: number;
 } & PurgeReport) | {
     edytor: 'quota';
@@ -801,12 +810,14 @@ export declare class AttachedDocument {
      * The purge task, also over RPC (`room.purge.timing`): record an epoch
      * (the state vector, now) when the document changed since the last one,
      * purge what was deleted before the horizon — the newest epoch at least
-     * `purgeAfterDays` old — when it is newer than the last purged, and
-     * re-arm for the next epoch to pass it. Returns what the purge wrote, or
-     * `null` when nothing was past the horizon.
+     * `purgeAfterDays` old — when it is newer than the last purged, with what
+     * the sessions whose history ended deleted (`hist.release.end`; with no
+     * epoch due, those alone, `horizon: null`), and re-arm for the next epoch
+     * to pass it. Returns what the purge wrote, or `null` when nothing was
+     * past the horizon and no session had ended.
      */
     purge(): (PurgeReport & {
-        horizon: number;
+        horizon: number | null;
     }) | null;
     /** The room's counters, also over RPC — see {@link RoomMetrics}. */
     metrics(): RoomMetrics;
@@ -845,7 +856,7 @@ export declare class AttachedDocument {
      * socket `4403` (`access revoked`), as {@link closeUser}. Your `authorize` must decide the
      * same from then on. Returns how many sockets it changed.
      */
-    setAccess(userId: string, access: 'write' | 'read' | 'none'): {
+    setAccess(userId: string, access: DocumentAccessLevel | 'none'): {
         sockets: number;
     };
     /** Is `ws` one of this document's sockets? */
@@ -968,7 +979,7 @@ export declare class DocumentRoom<Env = DocumentRoomEnv> extends DurableObject<E
     };
     /** Run the purge task now, also over RPC — see {@link AttachedDocument.purge}. */
     purge(): (PurgeReport & {
-        horizon: number;
+        horizon: number | null;
     }) | null;
     /** Every comment thread, also over RPC — see {@link AttachedDocument.listComments}. */
     listComments(): CommentSnapshot;
@@ -979,7 +990,7 @@ export declare class DocumentRoom<Env = DocumentRoomEnv> extends DurableObject<E
         sockets: number;
     };
     /** Change a user's access on its sockets, also over RPC — see {@link AttachedDocument.setAccess}. */
-    setAccess(userId: string, access: 'write' | 'read' | 'none'): {
+    setAccess(userId: string, access: DocumentAccessLevel | 'none'): {
         sockets: number;
     };
     /** Compaction, also over RPC. */

package/dist/cloudflare/DocumentRoom.js

@@ -130,9 +130,11 @@ export const DEFAULT_SAVE_AFTER = 2000;
  * Room quotas, each refused with `4413` (`quota: <name>`). The
  * document's size: what its records hold (uncompressed) and the updates the
  * engine holds waiting. An isolate has 128 MB, and the live document takes
- * 18 to 46 bytes of heap per stored byte (prose to one short line per
- * block, its index included; `bench/room-memory.mjs`): 2 MiB is
- * about 100 MB at worst. Raise it for documents of long text.
+ * 15 to 77 bytes of heap per stored byte in Node (prose to one short line
+ * per block, its index included; `bench/room-memory.mjs`; a Worker takes
+ * less): 2 MiB is about 150 to 160 MB at worst, a list of some 23,000 short
+ * blocks (1.25 MiB keeps that near 100 MB). Raise it for documents of long
+ * text, lower it for long lists of short blocks.
  */
 export const DEFAULT_MAX_DOCUMENT_BYTES = 2 * 1024 * 1024;
 /** The share of the document quota past which the room logs its size, by default. */
@@ -480,9 +482,11 @@ export class AttachedDocument {
      * The purge task, also over RPC (`room.purge.timing`): record an epoch
      * (the state vector, now) when the document changed since the last one,
      * purge what was deleted before the horizon — the newest epoch at least
-     * `purgeAfterDays` old — when it is newer than the last purged, and
-     * re-arm for the next epoch to pass it. Returns what the purge wrote, or
-     * `null` when nothing was past the horizon.
+     * `purgeAfterDays` old — when it is newer than the last purged, with what
+     * the sessions whose history ended deleted (`hist.release.end`; with no
+     * epoch due, those alone, `horizon: null`), and re-arm for the next epoch
+     * to pass it. Returns what the purge wrote, or `null` when nothing was
+     * past the horizon and no session had ended.
      */
     purge() {
         return this.room.purge.tick();

package/dist/cloudflare/index.d.ts

@@ -10,4 +10,4 @@ export { type PurgeReport } from '../crdt/purge.js';
 export { COMMENT_ROW_BYTES, COMMENT_STATUS, MAX_COMMENT_LENGTH, MAX_COMMENTS_PER_THREAD, MAX_THREADS, commentAnchors, commentBytes, decideComment, type ThreadComment, type CommentActor, type CommentChange, type CommentOutcome, type CommentRefusal, type CommentRequest, type CommentRun, type CommentSnapshot, type CommentThread } from '../crdt/protocols/comments.js';
 export { lockedBlocks, type LockOptions } from './locks.js';
 export { moveBlocksBetweenRooms, forwardLateEdits, DEFAULT_MOVE_GRACE_DAYS, type CommitResult, type ExportedBlocks, type ImportReceipt, type ImportRequest, type LateEdit, type LateEditBatch, type MoveDestination, type MovedState, type MoveNamespace, type MoveRoom } from './move.js';
-export { routeDocumentSocket, routeDocumentHistory, routeDocumentComments, requestedReplica, type AuthorizeDocumentSocket, type ExpiredCredential, type DocumentNamespace, type DocumentIdentity, type RouteDocumentOptions } from './routeDocumentSocket.js';
+export { routeDocumentSocket, routeDocumentHistory, routeDocumentComments, requestedReplica, type AuthorizeDocumentSocket, type ExpiredCredential, type DocumentNamespace, type DocumentAccessLevel, type DocumentIdentity, type RouteDocumentOptions } from './routeDocumentSocket.js';

package/dist/cloudflare/room/access.d.ts

@@ -1,4 +1,5 @@
 import { type RoomContext } from './context.js';
+import type { DocumentAccessLevel } from '../routeDocumentSocket.js';
 /** A Yjs client id (a non-negative safe integer), or `null`. */
 export declare const parseReplica: (raw: unknown) => number | null;
 export declare class RoomAccess {
@@ -11,15 +12,19 @@ export declare class RoomAccess {
     /** The open sockets of `user`. */
     private socketsOf;
     /** Close `sockets` with `code`, their departure announced, the change logged (`access`). */
-    endAccess(sockets: WebSocket[], access: 'expired' | 'closed' | 'write' | 'none', code: number, reason: string): void;
+    endAccess(sockets: WebSocket[], access: 'expired' | 'closed' | 'none' | DocumentAccessLevel, code: number, reason: string): void;
     /** Revoke: close every socket of `userId` (`AttachedDocument.closeUser`). */
     closeUser(userId: string, code?: number, reason?: string): {
         sockets: number;
     };
     /** Close every socket of `userId`, logged as `access`. */
     private revoke;
-    /** Change `userId`'s access on its open sockets (`AttachedDocument.setAccess`). */
-    setAccess(userId: string, access: 'write' | 'read' | 'none'): {
+    /**
+     * Change `userId`'s access on its open sockets (`AttachedDocument.setAccess`):
+     * a downgrade to `read` in place, any other change by a `1012` close
+     * the provider redials (so `authorize` grants the new access).
+     */
+    setAccess(userId: string, access: DocumentAccessLevel | 'none'): {
         sockets: number;
     };
     /**

package/dist/cloudflare/room/access.js

@@ -8,7 +8,7 @@
 import { CLOSE } from '../../crdt/providers/room.js';
 import { COMMENTS_HEADER, HISTORY_HEADER, HISTORY_KEY_HEADER, IDENTITY_HEADERS, PROBE_HEADER, SOCKET_TAG, closedSocket, noTimers } from './shared.js';
 import { STORAGE_FAILURE } from './context.js';
-import { readOnlyFrame, step1Frame } from './frames.js';
+import { accessFrame, readOnlyFrame, step1Frame } from './frames.js';
 import { StorageFault } from './replicas.js';
 import { stateVector } from './updates.js';
 /** The longest close reason the WebSocket API accepts, in UTF-8 bytes. */
@@ -22,6 +22,14 @@ export const parseReplica = (raw) => {
     const n = typeof raw === 'string' && /^\d{1,16}$/.test(raw) ? Number(raw) : raw;
     return typeof n === 'number' && Number.isSafeInteger(n) && n >= 0 ? n : null;
 };
+const LEVELS = ['read', 'comment', 'suggest', 'write'];
+/** An access level as a socket's identity carries it (`readOnly`, and `access` between read and write). */
+const levelOf = (level) => ({
+    readOnly: level === 'read' || level === 'comment',
+    ...((level === 'suggest' || level === 'comment') && { access: level })
+});
+/** A socket identity's level. */
+const levelIn = (identity) => identity.access ?? (identity.readOnly ? 'read' : 'write');
 /** The user id `routeDocumentSocket` encoded into its header, or `null`. */
 const readUser = (raw) => {
     try {
@@ -40,14 +48,16 @@ const readIdentity = (headers) => {
     const expiresAt = rawExpires === null ? null : Number(rawExpires);
     if (!user || user.length > 256 || (rawReplica && replica === null))
         return null;
-    if (access !== 'read' && access !== 'write')
+    if (!LEVELS.includes(access))
         return null;
     if (expiresAt !== null && !Number.isFinite(expiresAt))
         return null;
-    const identity = { user, replica, readOnly: access === 'read' };
-    if (expiresAt !== null)
-        identity.expiresAt = expiresAt;
-    return identity;
+    return {
+        user,
+        replica,
+        ...levelOf(access),
+        ...(expiresAt !== null && { expiresAt })
+    };
 };
 export class RoomAccess {
     room;
@@ -131,10 +141,20 @@ export class RoomAccess {
             room.refuseContainer(server);
         }
         else {
-            // A read-only socket is never asked for its state: it has nothing
-            // to give. It gets the read-only notice instead (not a refusal),
-            // so its provider tracks nothing.
-            room.send(server, identity.readOnly ? readOnlyFrame() : step1Frame(doc));
+            // Every socket is told its access as it joins (`room.access.suggest`),
+            // before anything else it reads. A read-only socket is never asked
+            // for its state: it has nothing to give. It gets the read-only
+            // notice instead (not a refusal), so its provider tracks nothing,
+            // and its level after it.
+            const level = levelIn(identity);
+            if (identity.readOnly) {
+                room.send(server, readOnlyFrame());
+                room.send(server, accessFrame(level));
+            }
+            else {
+                room.send(server, accessFrame(level));
+                room.send(server, step1Frame(doc));
+            }
             if (room.state.presence.size > 0)
                 room.send(server, room.presence.snapshot());
         }
@@ -183,26 +203,30 @@ export class RoomAccess {
             return { sockets: sockets.length };
         });
     }
-    /** Change `userId`'s access on its open sockets (`AttachedDocument.setAccess`). */
+    /**
+     * Change `userId`'s access on its open sockets (`AttachedDocument.setAccess`):
+     * a downgrade to `read` in place, any other change by a `1012` close
+     * the provider redials (so `authorize` grants the new access).
+     */
     setAccess(userId, access) {
         const room = this.room;
-        if (access !== 'write' && access !== 'read' && access !== 'none') {
+        if (access !== 'none' && !LEVELS.includes(access)) {
             throw new RangeError(`setAccess: unknown access ${String(access)}`);
         }
         if (access === 'none')
             return this.revoke(userId, 'none', CLOSE.denied, 'access revoked');
         return noTimers(() => {
-            const sockets = this.socketsOf(userId).filter(({ attachment }) => attachment.readOnly !== (access === 'read'));
-            if (access === 'write') {
-                this.endAccess(sockets.map(({ ws }) => ws), 'write', CLOSE.accessChanged, 'access changed');
-                return { sockets: sockets.length };
-            }
-            for (const { ws, attachment } of sockets) {
+            const sockets = this.socketsOf(userId).filter(({ attachment }) => levelIn(attachment) !== access);
+            const inPlace = sockets.filter(({ attachment }) => access === 'read' && levelIn(attachment) === 'write');
+            const closed = sockets.filter((socket) => !inPlace.includes(socket));
+            this.endAccess(closed.map(({ ws }) => ws), access, CLOSE.accessChanged, 'access changed');
+            for (const { ws, attachment } of inPlace) {
                 ws.serializeAttachment({ ...attachment, readOnly: true });
                 room.send(ws, readOnlyFrame());
+                room.send(ws, accessFrame('read'));
             }
-            if (sockets.length > 0) {
-                room.note({ reason: 'access', detail: { user: userId, access, sockets: sockets.length } });
+            if (inPlace.length > 0) {
+                room.note({ reason: 'access', detail: { user: userId, access, sockets: inPlace.length } });
             }
             return { sockets: sockets.length };
         });

package/dist/cloudflare/room/admission.js

@@ -14,8 +14,9 @@ import * as E from '../../crdt/protocol.js';
 import { ChunkError, CLOSE } from '../../crdt/providers/room.js';
 import { MAX_WAITING_DELETES, noTimers } from './shared.js';
 import { STORAGE_FAILURE, now, sync, tally } from './context.js';
-import { attributionWrites, BINDING_PREFIX, forgedAttributionDeletes, forgedDeletes, forgedWriters } from './forged.js';
-import { MalformedFrame, decode, readOnlyDenialFrame, savedFrame, step1Frame, storedStep2, updateFrame } from './frames.js';
+import { attributionWrites, BINDING_PREFIX, forgedAttributionDeletes, forgedDeletes, forgedWriters, selfBound } from './forged.js';
+import { suggestOnly } from './suggest.js';
+import { MalformedFrame, decode, readOnlyDenialFrame, savedFrame, suggestOnlyDenialFrame, step1Frame, storedStep2, updateFrame } from './frames.js';
 import { StorageFault } from './replicas.js';
 import { addIds, deletesUpdate, forgetWaiting, freedBy, heldDeletes, newWriters, pendingDeletes, rangeCount, releasedWaiting, replacedEntries, stateVector, storedStruct, unheldDeletes, withoutClients } from './updates.js';
 /**
@@ -350,7 +351,8 @@ export class Admission {
         }
         const sv = stateVector(doc);
         const orphans = new Set();
-        const stripped = replicas.attribute(attachment, newWriters(decoded, sv), sv, orphans);
+        const bound = selfBound(doc, decoded.structs, attachment.user);
+        const stripped = replicas.attribute(attachment, newWriters(decoded, sv), sv, orphans, bound);
         // Per-writer block marks: only `n` writes or deletes `del.<n>` /
         // `wd.<n>`. A client writing another's is stripped whole, as a client
         // under another user's id is; a delete of another's mark is dropped.
@@ -374,6 +376,23 @@ export class Admission {
                 detail: { user: attachment.user, writers: [...forgers], ranges: rangeCount(forgedMarks) }
             });
         }
+        // A user who may only suggest writes only suggestions (`room.access.suggest`).
+        const suggest = attachment.access === 'suggest'
+            ? suggestOnly(doc, decoded, stripped, (client) => mayDelete(client), attachment.replica)
+            : null;
+        if (suggest && (suggest.strip.size > 0 || !suggest.deletes.isEmpty())) {
+            for (const client of suggest.strip)
+                stripped.add(client);
+            room.note({
+                reason: 'suggest-only',
+                detail: {
+                    user: attachment.user,
+                    writers: [...suggest.strip],
+                    ranges: rangeCount(suggest.deletes)
+                }
+            });
+            room.send(ws, suggestOnlyDenialFrame());
+        }
         // Attribution (`room.attribution.trust`): a replica binds only
         // itself, to its verified user, and a user writes only its own
         // profile. Another's entry is collected (its clock kept as a GC), a
@@ -405,9 +424,13 @@ export class Admission {
                 detail: { user: attachment.user, ranges: rangeCount(overflow) }
             });
         }
-        const dropped = overflow === null && forgedMarks.isEmpty() && forgedEntries.ids.isEmpty()
+        const suggestDeletes = suggest?.deletes ?? Y.createIdSet();
+        const dropped = overflow === null &&
+            forgedMarks.isEmpty() &&
+            forgedEntries.ids.isEmpty() &&
+            suggestDeletes.isEmpty()
             ? null
-            : addIds(addIds(addIds(Y.createIdSet(), overflow ?? Y.createIdSet()), forgedMarks), forgedEntries.ids);
+            : addIds(addIds(addIds(addIds(Y.createIdSet(), overflow ?? Y.createIdSet()), forgedMarks), forgedEntries.ids), suggestDeletes);
         const admitted = stripped.size === 0 && dropped === null && attribution.collected.size === 0
             ? update
             : withoutClients(decoded, stripped, doc, dropped ?? undefined, attribution.collected);

package/dist/cloudflare/room/comments.js

@@ -213,6 +213,9 @@ export class RoomComments {
             this.broadcast(decided.change);
             if (decided.change.type === 'removed')
                 this.#removeAnchors(decided.change.thread.id);
+            // A user who may comment but not write: the room writes the thread's anchor (`room.access.comment`).
+            if (decided.change.type === 'added' && actor.anchors && request.op === 'add')
+                this.#writeAnchors(decided.change.thread.id, request.anchors ?? []);
             room.log({
                 edytor: 'comment',
                 type: decided.change.type,
@@ -232,6 +235,27 @@ export class RoomComments {
         }
         return outcome;
     }
+    /** A new thread's anchor over `spans` (anchors), written by the room: one room transaction. */
+    #writeAnchors(id, spans) {
+        const room = this.room;
+        if (room.live === null || room.busy || spans.length === 0)
+            return;
+        try {
+            const mark = `${COMMENT_MARK}:${id}`;
+            room.transact((facade) => {
+                for (const { start, end } of spans) {
+                    const [from, to] = [start, end].map((a) => facade.resolveAnchor(a));
+                    if (from && to && from.blockId === to.blockId && to.offset > from.offset)
+                        facade.formatRange(from.blockId, from.offset, to.offset - from.offset, {
+                            [mark]: { id }
+                        });
+                }
+            });
+        }
+        catch (error) {
+            room.log({ edytor: 'fault', reason: 'internal', detail: `comment anchor: ${String(error)}` });
+        }
+    }
     /** A removed thread's anchor: its marks leave the document, as one room transaction. */
     #removeAnchors(id) {
         const room = this.room;
@@ -322,9 +346,12 @@ export class RoomComments {
             const request = parseCommentRequest(json);
             if (request === null)
                 return new Response('invalid request', { status: 400 });
+            // A user who may comment but not write: the room writes what its view may not (the anchor).
+            const anchors = identity.access === 'comment' || identity.access === 'suggest';
             const outcome = await this.apply(request, {
                 user: identity.user,
-                readOnly: identity.readOnly
+                readOnly: identity.readOnly && !anchors,
+                ...(anchors && { anchors })
             });
             if (outcome.status === 'refused')
                 return new Response(outcome.message, { status: COMMENT_STATUS[outcome.reason] });