edytor 5.0.0 → 7.0.0

package/README.md

@@ -17,7 +17,7 @@
 
 Edytor aims to be for Svelte what Slate.js is for React: a heavily customizable editor with an API to build any kind of collaborative rich text editor.
 
-> **5.0.** Edytor `5.0.0` is on npm as `edytor`: its API follows semantic versioning, and every change is listed in the changelog. It has no production track record yet: read the [limitations](https://edytor.dev/docs/reference/limitations) before you build on it. Issues and PRs are welcome: when you report a bug, include the document's JSON value.
+> **7.0.** Edytor `7.0.0` is on npm as `edytor`: its API follows semantic versioning, and every change is listed in the changelog. It has no production track record yet: read the [limitations](https://edytor.dev/docs/reference/limitations) before you build on it. Issues and PRs are welcome: when you report a bug, include the document's JSON value.
 
 ## Features
 
@@ -34,13 +34,13 @@ Edytor aims to be for Svelte what Slate.js is for React: a heavily customizable
 - **Plugins that can veto anything.** Every command is prepared before it writes; plugins see the command and each planned step and can refuse or replace it.
 - **Real-time collaboration.** One `EdytorDocument` shared by any number of views, or none (headless). Presence cursors, identity-preserving moves, splits and merges, and undo that only takes back your own edits.
 - **Offline first.** A local IndexedDB copy and cross-tab sync; offline edits survive reloads and reach the server on reconnect.
-- **A Cloudflare Durable Object room.** `edytor/cloudflare` stores in SQLite, acknowledges after the write, binds identity to the socket and hibernates.
+- **A Cloudflare Durable Object room.** `edytor/cloudflare` stores in SQLite, acknowledges after the write, binds identity to the socket and hibernates. A busy document is [re-seeded](https://edytor.dev/docs/server/room#re-seeding) from its content when it grows, offline edits merged when their device comes back.
 - **Import and export.** `edytor/export` turns a document into HTML or Markdown and back (`toHTML`, `toMarkdown`, `fromHTML`, `textToBlocks`), by each kind's own forms, in the browser, Node or a Worker; HTML import is sanitized ([Import and export](https://edytor.dev/docs/editor/import-export)).
 - **Headless and Worker-safe.** `edytor/crdt/edytor` runs in Node and Workers without Svelte.
 
 ## Install
 
-Edytor `5.0.0` is on npm under `latest`:
+Edytor `7.0.0` is on npm under `latest`:
 
 ```bash
 pnpm add edytor

package/dist/cloudflare/DocumentRoom.d.ts

@@ -111,7 +111,7 @@ import type { CommitResult, ExportedBlocks, ImportReceipt, ImportRequest, LateEd
 import type { AwarenessEntry } from '../crdt/protocol.js';
 import type { DocumentSemanticsConfig, DocumentOperations, JSONBlock, JSONDoc, YDoc } from '../crdt/index.js';
 import type { CommentActor, CommentChange, CommentOutcome, CommentRequest, CommentSnapshot } from '../crdt/protocols/comments.js';
-export { closedSocket, COMMENTS_HEADER, DEFAULT_MAX_COMMENT_BYTES, DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND, HISTORY_HEADER, HISTORY_KEY_HEADER, IDENTITY_HEADERS, MAX_REFUSALS, MAX_WAITING_DELETES, noTimers, PROBE_HEADER, PURGE_ORIGIN, RESTORE_ORIGIN, ROOM_ORIGIN, SOCKET_TAG } from './room/shared.js';
+export { closedSocket, COMMENTS_HEADER, DEFAULT_MAX_COMMENT_BYTES, DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND, DEFAULT_RESEED_FORCE, DEFAULT_RESEED_GAIN, DEFAULT_RESEED_GRACE_DAYS, DEFAULT_RESEED_IDLE, HISTORY_HEADER, HISTORY_KEY_HEADER, IDENTITY_HEADERS, MAX_REFUSALS, MAX_WAITING_DELETES, noTimers, PROBE_HEADER, PURGE_ORIGIN, RESTORE_ORIGIN, ROOM_ORIGIN, SOCKET_TAG } from './room/shared.js';
 /** Under SQLite-backed Durable Objects' 2 MB row cap, with room for the other columns. */
 export declare const DEFAULT_MAX_ROW_BYTES: number;
 /** Update records before the rows are merged into one snapshot. */
@@ -224,6 +224,8 @@ export type DocumentRoomEnv = {
     EDYTOR_MAX_PRESENCE_FANOUT?: string | number;
     /** `off`: the room logs nothing (default: one JSON line per compaction, quota hit, denial, fault). */
     EDYTOR_LOG?: string;
+    /** `off`: the room never re-seeds its document ({@link AttachRoomOptions.reseed}). */
+    EDYTOR_RESEED?: string;
     /**
      * Days after which deleted content is purged (default: the history
      * retention, else 30); `off` never purges.
@@ -279,9 +281,11 @@ export type SocketIdentity = {
 export type Attachment = SocketIdentity & {
     clock: number | null;
     comments?: boolean;
+    /** The older epoch the socket dialed: it may only hand over its old document (`room.reseed.protocol`). */
+    epoch?: number;
 };
 export type Refusal = {
-    reason: 'generation' | 'schema' | 'malformed' | 'container' | 'identity' | 'replica' | 'read-only' | 'waiting' | 'storage' | 'internal' | 'quota' | 'access' | 'presence' | 'comments' | 'mark' | 'suggest-only' | 'forged' | 'denied' | 'orphan' | 'relayed' | 'history';
+    reason: 'generation' | 'schema' | 'malformed' | 'container' | 'identity' | 'replica' | 'read-only' | 'waiting' | 'storage' | 'internal' | 'quota' | 'access' | 'presence' | 'comments' | 'mark' | 'suggest-only' | 'forged' | 'denied' | 'orphan' | 'relayed' | 'history' | 'epoch';
     detail: unknown;
 };
 /** A duration series: how many, their total and longest (ms; see {@link RoomMetrics}). */
@@ -346,6 +350,8 @@ export type RoomMetrics = {
         runs: number;
         horizon: number | null;
     };
+    /** The room's epoch (`room.reseed.protocol`): how many times its document was re-seeded. */
+    epoch: number;
     /** When this instance started (ms since the epoch). */
     since: number;
 };
@@ -402,6 +408,31 @@ export type RoomLogEntry = {
     role: 'out' | 'in';
     peer: string;
     blocks: number;
+} | {
+    edytor: 'reseed';
+    epoch: number;
+    before: number;
+    after: number;
+    suggestions: number;
+    ms: number;
+} | {
+    edytor: 'reseed';
+    skipped: 'suggestions';
+    bytes: number;
+    pending: number;
+} | {
+    edytor: 'reseed';
+    skipped: 'gain';
+    bytes: number;
+    estimate: number;
+} | {
+    edytor: 'rebase';
+    user: string;
+    from: number;
+    epoch: number;
+    status: 'noop' | 'applied' | 'refused' | 'failed';
+    bytes: number;
+    ms: number;
 } | {
     edytor: 'late';
     moveId: string;
@@ -476,6 +507,22 @@ export type CommentOptions = {
      */
     maxRequestsPerSecond?: number;
 };
+/** When the room re-seeds its document (`AttachRoomOptions.reseed`, `room.reseed.timing`). */
+export type ReseedOptions = {
+    /** Stored bytes past which a re-seed is due (default half of `maxDocumentBytes`). */
+    at?: number;
+    /** ms nobody may write before it runs (default {@link DEFAULT_RESEED_IDLE}, ten minutes). */
+    idleMs?: number;
+    /** The share of the stored bytes it must give back (default {@link DEFAULT_RESEED_GAIN}, 0.4). */
+    gain?: number;
+    /**
+     * The share of `maxDocumentBytes` past which it waits for no idle period
+     * and drops the pending suggestions (default {@link DEFAULT_RESEED_FORCE}, 0.8).
+     */
+    force?: number;
+    /** Days a cut is kept, so an offline client's edits still merge (default {@link DEFAULT_RESEED_GRACE_DAYS}, 30). */
+    graceDays?: number;
+};
 /** What {@link attachRoom} (and `DocumentRoom`) takes. */
 export type AttachRoomOptions = {
     /**
@@ -583,6 +630,16 @@ export type AttachRoomOptions = {
     purgeAfterDays?: number | false;
     /** The room's clock, ms since the epoch (default `Date.now`): its slots, epochs and alarm read it. */
     now?: () => number;
+    /**
+     * Re-seed (`room.reseed.*`): a document that grew past `at` of its stored
+     * bytes (default half of `maxDocumentBytes`) is rebuilt from its content,
+     * with fresh identities, once nobody wrote for `idleMs` (default ten
+     * minutes) and when that gives back at least `gain` (0.4) of it; past
+     * `force` (0.8) of the quota at once. Every client reloads it; an offline
+     * client's unsaved edits are rebased onto it for `graceDays` (30). On by
+     * default; `false` never re-seeds.
+     */
+    reseed?: ReseedOptions | false;
     /**
      * Comment threads (`room.comments`): kept in the room's `threads` and
      * `comments` tables, read and written through `routeDocumentComments`
@@ -821,6 +878,15 @@ export declare class AttachedDocument {
     }) | null;
     /** The room's counters, also over RPC — see {@link RoomMetrics}. */
     metrics(): RoomMetrics;
+    /** The room's epoch (`room.reseed.protocol`): how many times its document was re-seeded. */
+    get epoch(): number;
+    /**
+     * Re-seed the document now (`room.reseed.cut`), whatever it gives back
+     * and whether a suggestion is pending (they are dropped): every socket
+     * is closed `4410` and reloads it. Answers the new epoch, or `null`
+     * when re-seeding is off or the room is inside a transaction.
+     */
+    reseed(): number | null;
     /**
      * Drop every waiting delete, stored or in memory (callable over RPC):
      * the way out when a writer filled `MAX_WAITING_DELETES` with
@@ -925,6 +991,11 @@ export declare class DocumentRoom<Env = DocumentRoomEnv> extends DurableObject<E
      * Read once, at the first frame.
      */
     protected locks(): LockOptions | undefined;
+    /**
+     * When the room re-seeds — see {@link AttachRoomOptions.reseed}. Default:
+     * on, with its default thresholds; `false` when `EDYTOR_RESEED` is `off`.
+     */
+    protected reseeding(): ReseedOptions | false | undefined;
     /**
      * The rooms blocks move to — see {@link AttachRoomOptions.rooms}.
      * Default: the `EDYTOR_ROOMS` binding; none without it.
@@ -946,6 +1017,10 @@ export declare class DocumentRoom<Env = DocumentRoomEnv> extends DurableObject<E
     restoreHistory(key: string, options?: {
         user?: string;
     }): Promise<RestoreResult>;
+    /** Re-seed the document now, also over RPC — see {@link AttachedDocument.reseed}. */
+    reseed(): number | null;
+    /** The room's epoch — see {@link AttachedDocument.epoch}. */
+    get epoch(): number;
     /** Undo the last restore, also over RPC — see {@link AttachedDocument.undoRestore}. */
     undoRestore(options?: {
         user?: string;

package/dist/cloudflare/DocumentRoom.js

@@ -114,12 +114,13 @@ import { RoomHistory } from './room/history.js';
 import { RoomMoves } from './room/moves.js';
 import { RoomPresence } from './room/presence.js';
 import { RoomPurge } from './room/purge.js';
+import { RoomReseed } from './room/reseed.js';
 import { ReplicaRegistry } from './room/replicas.js';
 import { Scheduler } from './room/scheduler.js';
 import { RoomStorage } from './room/storage.js';
 import { RoomValidation } from './room/validation.js';
 import { noTimers, SOCKET_TAG } from './room/shared.js';
-export { closedSocket, COMMENTS_HEADER, DEFAULT_MAX_COMMENT_BYTES, DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND, HISTORY_HEADER, HISTORY_KEY_HEADER, IDENTITY_HEADERS, MAX_REFUSALS, MAX_WAITING_DELETES, noTimers, PROBE_HEADER, PURGE_ORIGIN, RESTORE_ORIGIN, ROOM_ORIGIN, SOCKET_TAG } from './room/shared.js';
+export { closedSocket, COMMENTS_HEADER, DEFAULT_MAX_COMMENT_BYTES, DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND, DEFAULT_RESEED_FORCE, DEFAULT_RESEED_GAIN, DEFAULT_RESEED_GRACE_DAYS, DEFAULT_RESEED_IDLE, HISTORY_HEADER, HISTORY_KEY_HEADER, IDENTITY_HEADERS, MAX_REFUSALS, MAX_WAITING_DELETES, noTimers, PROBE_HEADER, PURGE_ORIGIN, RESTORE_ORIGIN, ROOM_ORIGIN, SOCKET_TAG } from './room/shared.js';
 /** Under SQLite-backed Durable Objects' 2 MB row cap, with room for the other columns. */
 export const DEFAULT_MAX_ROW_BYTES = 2_000_000 - 4096;
 /** Update records before the rows are merged into one snapshot. */
@@ -245,6 +246,7 @@ export class AttachedDocument {
             purge: () => {
                 room.purge.tick();
             },
+            reseed: () => room.reseed.task(),
             retention: () => room.history.expireVersions(),
             forward: () => room.moves.forwardMoves(),
             expiry: () => noTimers(() => room.access.expireSockets())
@@ -258,6 +260,7 @@ export class AttachedDocument {
         room.presence = new RoomPresence(room);
         room.access = new RoomAccess(room);
         room.comments = new RoomComments(room);
+        room.reseed = new RoomReseed(room);
         // The provider pings a silent socket: answer without waking the object.
         if (ctx.setWebSocketAutoResponse && !ctx.getWebSocketAutoResponse?.()) {
             ctx.setWebSocketAutoResponse(new WebSocketRequestResponsePair(PING, PONG));
@@ -515,10 +518,24 @@ export class AttachedDocument {
                 refusals: { ...this.refusalCounts },
                 history: { ...counters.history },
                 purge: { ...counters.purge },
+                epoch: room.reseed.epoch,
                 since: counters.since
             };
         });
     }
+    /** The room's epoch (`room.reseed.protocol`): how many times its document was re-seeded. */
+    get epoch() {
+        return this.room.reseed.epoch;
+    }
+    /**
+     * Re-seed the document now (`room.reseed.cut`), whatever it gives back
+     * and whether a suggestion is pending (they are dropped): every socket
+     * is closed `4410` and reloads it. Answers the new epoch, or `null`
+     * when re-seeding is off or the room is inside a transaction.
+     */
+    reseed() {
+        return this.room.reseed.run('manual');
+    }
     /**
      * Drop every waiting delete, stored or in memory (callable over RPC):
      * the way out when a writer filled `MAX_WAITING_DELETES` with
@@ -644,6 +661,7 @@ export class DocumentRoom extends DurableObject {
         const semantics = () => this.semantics();
         const history = () => this.history();
         const locks = () => this.locks();
+        const reseeding = () => this.reseeding();
         const comments = () => String(knobs.EDYTOR_COMMENTS ?? '') === 'off'
             ? false
             : {
@@ -677,6 +695,9 @@ export class DocumentRoom extends DurableObject {
             get locks() {
                 return locks();
             },
+            get reseed() {
+                return reseeding();
+            },
             get comments() {
                 return comments();
             },
@@ -755,6 +776,13 @@ export class DocumentRoom extends DurableObject {
         const key = this.env.EDYTOR_LOCKS;
         return typeof key === 'string' && key !== '' ? { key } : undefined;
     }
+    /**
+     * When the room re-seeds — see {@link AttachRoomOptions.reseed}. Default:
+     * on, with its default thresholds; `false` when `EDYTOR_RESEED` is `off`.
+     */
+    reseeding() {
+        return String(this.env.EDYTOR_RESEED ?? '') === 'off' ? false : undefined;
+    }
     /**
      * The rooms blocks move to — see {@link AttachRoomOptions.rooms}.
      * Default: the `EDYTOR_ROOMS` binding; none without it.
@@ -794,6 +822,14 @@ export class DocumentRoom extends DurableObject {
     restoreHistory(key, options) {
         return this.room.restoreHistory(key, options);
     }
+    /** Re-seed the document now, also over RPC — see {@link AttachedDocument.reseed}. */
+    reseed() {
+        return this.room.reseed();
+    }
+    /** The room's epoch — see {@link AttachedDocument.epoch}. */
+    get epoch() {
+        return this.room.epoch;
+    }
     /** Undo the last restore, also over RPC — see {@link AttachedDocument.undoRestore}. */
     undoRestore(options) {
         return this.room.undoRestore(options);

package/dist/cloudflare/index.d.ts

@@ -4,7 +4,7 @@
  * `cloudflare:workers`); built on the Worker-safe CRDT entry. Documented in
  * the site's `server/` section (room, authorization, extending, protocol).
  */
-export { DocumentRoom, AttachedDocument, attachRoom, SOCKET_TAG, closedSocket, type AttachRoomOptions, type CommentOptions, DEFAULT_COMPACT_AFTER, DEFAULT_MAX_ROW_BYTES, DEFAULT_SAVE_AFTER, DEFAULT_MAX_DOCUMENT_BYTES, DEFAULT_DOCUMENT_WARNING, DEFAULT_MAX_INBOUND_FRAME_BYTES, DEFAULT_MAX_BUFFERED_BYTES, DEFAULT_MAX_UPDATES_PER_SECOND, DEFAULT_MAX_PRESENCE_BYTES, DEFAULT_MAX_PRESENCE_PER_SECOND, DEFAULT_MAX_PRESENCE_FANOUT, DEFAULT_MAX_COMMENT_BYTES, DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND, MAX_REFUSALS, MAX_WAITING_DELETES, ROOM_ORIGIN, RESTORE_ORIGIN, PURGE_ORIGIN, IDENTITY_HEADERS, PROBE_HEADER, noTimers, type Attachment, type DocumentRoomEnv, type LoadedDocument, type Refusal, type ReplicaOwner, type SavedDocument, type SocketIdentity, type StoredRecord, type FrameValidation, type ValidatedBlock, type RoomMetrics, type RoomLogEntry, type RestoreResult, type Timing } from './DocumentRoom.js';
+export { DocumentRoom, AttachedDocument, attachRoom, SOCKET_TAG, closedSocket, type AttachRoomOptions, type CommentOptions, DEFAULT_COMPACT_AFTER, DEFAULT_MAX_ROW_BYTES, DEFAULT_SAVE_AFTER, DEFAULT_MAX_DOCUMENT_BYTES, DEFAULT_DOCUMENT_WARNING, DEFAULT_MAX_INBOUND_FRAME_BYTES, DEFAULT_MAX_BUFFERED_BYTES, DEFAULT_MAX_UPDATES_PER_SECOND, DEFAULT_MAX_PRESENCE_BYTES, DEFAULT_MAX_PRESENCE_PER_SECOND, DEFAULT_MAX_PRESENCE_FANOUT, DEFAULT_MAX_COMMENT_BYTES, DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND, DEFAULT_RESEED_FORCE, DEFAULT_RESEED_GAIN, DEFAULT_RESEED_GRACE_DAYS, DEFAULT_RESEED_IDLE, MAX_REFUSALS, MAX_WAITING_DELETES, ROOM_ORIGIN, RESTORE_ORIGIN, PURGE_ORIGIN, IDENTITY_HEADERS, PROBE_HEADER, noTimers, type Attachment, type DocumentRoomEnv, type LoadedDocument, type Refusal, type ReplicaOwner, type SavedDocument, type SocketIdentity, type StoredRecord, type FrameValidation, type ValidatedBlock, type RoomMetrics, type RoomLogEntry, type ReseedOptions, type RestoreResult, type Timing } from './DocumentRoom.js';
 export { DEFAULT_RETENTION_DAYS, HISTORY_MAX_VALUE_BYTES, R2_HISTORY_MAX_VALUE_BYTES, ROOM_HISTORY_MAX_BYTES, ROOM_HISTORY_MAX_VALUE_BYTES, kvHistory, r2History, roomHistory, type HistoryEntry, type HistoryMetadata, type HistoryOptions, type HistoryRoomStorage, type HistoryStore, type HistoryStoreFactory, type HistoryStoreRecord, type KVLike, type R2BucketLike } from './history.js';
 export { type PurgeReport } from '../crdt/purge.js';
 export { COMMENT_ROW_BYTES, COMMENT_STATUS, MAX_COMMENT_LENGTH, MAX_COMMENTS_PER_THREAD, MAX_THREADS, commentAnchors, commentBytes, decideComment, type ThreadComment, type CommentActor, type CommentChange, type CommentOutcome, type CommentRefusal, type CommentRequest, type CommentRun, type CommentSnapshot, type CommentThread } from '../crdt/protocols/comments.js';

package/dist/cloudflare/index.js

@@ -4,7 +4,7 @@
  * `cloudflare:workers`); built on the Worker-safe CRDT entry. Documented in
  * the site's `server/` section (room, authorization, extending, protocol).
  */
-export { DocumentRoom, AttachedDocument, attachRoom, SOCKET_TAG, closedSocket, DEFAULT_COMPACT_AFTER, DEFAULT_MAX_ROW_BYTES, DEFAULT_SAVE_AFTER, DEFAULT_MAX_DOCUMENT_BYTES, DEFAULT_DOCUMENT_WARNING, DEFAULT_MAX_INBOUND_FRAME_BYTES, DEFAULT_MAX_BUFFERED_BYTES, DEFAULT_MAX_UPDATES_PER_SECOND, DEFAULT_MAX_PRESENCE_BYTES, DEFAULT_MAX_PRESENCE_PER_SECOND, DEFAULT_MAX_PRESENCE_FANOUT, DEFAULT_MAX_COMMENT_BYTES, DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND, MAX_REFUSALS, MAX_WAITING_DELETES, ROOM_ORIGIN, RESTORE_ORIGIN, PURGE_ORIGIN, IDENTITY_HEADERS, PROBE_HEADER, noTimers } from './DocumentRoom.js';
+export { DocumentRoom, AttachedDocument, attachRoom, SOCKET_TAG, closedSocket, DEFAULT_COMPACT_AFTER, DEFAULT_MAX_ROW_BYTES, DEFAULT_SAVE_AFTER, DEFAULT_MAX_DOCUMENT_BYTES, DEFAULT_DOCUMENT_WARNING, DEFAULT_MAX_INBOUND_FRAME_BYTES, DEFAULT_MAX_BUFFERED_BYTES, DEFAULT_MAX_UPDATES_PER_SECOND, DEFAULT_MAX_PRESENCE_BYTES, DEFAULT_MAX_PRESENCE_PER_SECOND, DEFAULT_MAX_PRESENCE_FANOUT, DEFAULT_MAX_COMMENT_BYTES, DEFAULT_MAX_COMMENT_REQUESTS_PER_SECOND, DEFAULT_RESEED_FORCE, DEFAULT_RESEED_GAIN, DEFAULT_RESEED_GRACE_DAYS, DEFAULT_RESEED_IDLE, MAX_REFUSALS, MAX_WAITING_DELETES, ROOM_ORIGIN, RESTORE_ORIGIN, PURGE_ORIGIN, IDENTITY_HEADERS, PROBE_HEADER, noTimers } from './DocumentRoom.js';
 export { DEFAULT_RETENTION_DAYS, HISTORY_MAX_VALUE_BYTES, R2_HISTORY_MAX_VALUE_BYTES, ROOM_HISTORY_MAX_BYTES, ROOM_HISTORY_MAX_VALUE_BYTES, kvHistory, r2History, roomHistory } from './history.js';
 export {} from '../crdt/purge.js';
 export { COMMENT_ROW_BYTES, COMMENT_STATUS, MAX_COMMENT_LENGTH, MAX_COMMENTS_PER_THREAD, MAX_THREADS, commentAnchors, commentBytes, decideComment } from '../crdt/protocols/comments.js';

package/dist/cloudflare/room/access.d.ts

@@ -7,7 +7,12 @@ export declare class RoomAccess {
     constructor(room: RoomContext);
     /** A request forwarded by the host Worker (`AttachedDocument.fetch`). */
     fetch(request: Request): Promise<Response>;
-    /** Accept a verified socket: its replica bound to its user, then the join (Step1, presence). */
+    /**
+     * Accept a verified socket: its replica bound to its user, then the join
+     * (Step1, presence). A dial of another epoch than the room's is the
+     * re-seed's (`room.reseed.protocol`): closed, or joined as stale (no
+     * replica bound, no Step1: the room asks for its old document).
+     */
     private accept;
     /** The open sockets of `user`. */
     private socketsOf;

package/dist/cloudflare/room/access.js

@@ -6,10 +6,11 @@
  * revocation, a changed access, an expired credential.
  */
 import { CLOSE } from '../../crdt/providers/room.js';
-import { COMMENTS_HEADER, HISTORY_HEADER, HISTORY_KEY_HEADER, IDENTITY_HEADERS, PROBE_HEADER, SOCKET_TAG, closedSocket, noTimers } from './shared.js';
+import { COMMENTS_HEADER, HISTORY_HEADER, HISTORY_KEY_HEADER, IDENTITY_HEADERS, PROBE_HEADER, SOCKET_TAG, STALE_TAG, closedSocket, noTimers } from './shared.js';
 import { STORAGE_FAILURE } from './context.js';
 import { accessFrame, readOnlyFrame, step1Frame } from './frames.js';
 import { StorageFault } from './replicas.js';
+import { parseEpoch } from './reseed.js';
 import { stateVector } from './updates.js';
 /** The longest close reason the WebSocket API accepts, in UTF-8 bytes. */
 const MAX_CLOSE_REASON_BYTES = 123;
@@ -107,13 +108,38 @@ export class RoomAccess {
         if (identity === null)
             return new Response('verified identity required', { status: 401 });
         await room.storage.retryStart();
-        return noTimers(() => this.accept(identity));
+        const epoch = parseEpoch(new URL(request.url).searchParams.get('epoch'));
+        return noTimers(() => this.accept(identity, epoch));
     }
-    /** Accept a verified socket: its replica bound to its user, then the join (Step1, presence). */
-    accept(identity) {
+    /**
+     * Accept a verified socket: its replica bound to its user, then the join
+     * (Step1, presence). A dial of another epoch than the room's is the
+     * re-seed's (`room.reseed.protocol`): closed, or joined as stale (no
+     * replica bound, no Step1: the room asks for its old document).
+     */
+    accept(identity, epoch) {
         const room = this.room;
         room.storage.heal();
         const doc = room.live;
+        const door = doc === null ? 'current' : room.reseed.door(epoch);
+        if (typeof door === 'object') {
+            room.note({
+                reason: 'epoch',
+                detail: { user: identity.user, epoch, room: room.reseed.epoch }
+            });
+            return closedSocket(door.code, door.reason);
+        }
+        if (door === 'stale') {
+            const pair = new WebSocketPair();
+            room.ctx.acceptWebSocket(pair[1], [SOCKET_TAG, STALE_TAG]);
+            pair[1].serializeAttachment({
+                ...identity,
+                clock: null,
+                epoch: epoch
+            });
+            room.reseed.join(pair[1], identity);
+            return new Response(null, { status: 101, webSocket: pair[0] });
+        }
         if (doc !== null && identity.replica !== null) {
             let bound;
             try {

package/dist/cloudflare/room/admission.d.ts

@@ -1,7 +1,11 @@
+import type { YDoc } from '../../crdt/index.js';
+import type { Attachment } from '../DocumentRoom.js';
 import { type RoomContext } from './context.js';
 /** The provider's keepalive text frame, and the room's answer. */
 export declare const PING = "ping";
 export declare const PONG = "pong";
+/** Seconds of the update rate a socket may spend at once. */
+export declare const BURST_SECONDS = 10;
 /** A token bucket: its tokens, refilled since `at` (ms). */
 export type Bucket = {
     tokens: number;
@@ -40,6 +44,13 @@ export declare class Admission {
         sequences: number;
         bytes: number;
     };
+    /**
+     * A stale socket's rebase (`room.reseed.rebase`): `update`, the writes
+     * of a copy of the document under a client id of their own, admitted as
+     * its user's update, from that id. `true` once applied; refused (a
+     * quota, a read-only socket, a fault), `false`.
+     */
+    admitRebase(ws: WebSocket, attachment: Attachment, doc: YDoc, update: Uint8Array, writer: number): boolean;
     /**
      * The update rate quota: a token bucket per socket, refilled at
      * `maxUpdatesPerSecond` up to ten seconds' worth. `false`: over it.

package/dist/cloudflare/room/admission.js

@@ -31,7 +31,7 @@ const writes = (doc, decoded) => newWriters(decoded, stateVector(doc)).size > 0
 export const PING = 'ping';
 export const PONG = 'pong';
 /** Seconds of the update rate a socket may spend at once. */
-const BURST_SECONDS = 10;
+export const BURST_SECONDS = 10;
 /**
  * A token bucket per key (a socket, a user), refilled at `perSecond` up to
  * ten seconds' worth: takes one token. `false`: over the rate.
@@ -106,10 +106,10 @@ export class Admission {
     /** One frame: whole as it came, or reassembled from its chunks. */
     onFrame(ws, attachment, doc, bytes) {
         const room = this.room;
-        const limit = room.limits.maxInboundFrameBytes;
+        const limit = this.#frameLimit(attachment);
         // The frame quota: never decoded past it.
         if (bytes.length > limit) {
-            return this.#overQuota(ws, attachment.user, 'frame', { bytes: bytes.length, limit });
+            return this.#overQuota(ws, attachment, 'frame', { bytes: bytes.length, limit });
         }
         const decoder = E.createDecoder(bytes);
         // 1 · Admission: the generation word, before anything is decoded.
@@ -120,6 +120,9 @@ export class Admission {
             const type = decode(() => E.readVarUint(decoder));
             if (type === E.messageChunk)
                 return this.#onChunk(ws, attachment, doc, decoder);
+            // A socket of an older epoch hands over its old document, nothing else (`room.reseed.protocol`).
+            if (attachment.epoch != null)
+                return room.reseed.onStale(ws, attachment, type, decoder);
             if (type === E.messageSync)
                 return this.onSync(ws, attachment, doc, decoder);
             if (type === E.messageAwareness) {
@@ -160,7 +163,7 @@ export class Admission {
         const room = this.room;
         let read = this.#chunkReaders.get(ws);
         if (read === undefined) {
-            read = E.createChunkReader(room.limits.maxInboundFrameBytes, (total) => this.admitChunks(ws, total));
+            read = E.createChunkReader(this.#frameLimit(attachment), (total) => this.admitChunks(ws, total));
             this.#chunkReaders.set(ws, read);
         }
         let whole;
@@ -170,14 +173,14 @@ export class Admission {
         catch (error) {
             this.#chunkReaders.delete(ws);
             if (error instanceof ChunkError && error.limit !== undefined) {
-                return this.#overQuota(ws, attachment.user, 'frame', {
+                return this.#overQuota(ws, attachment, 'frame', {
                     bytes: error.total,
                     limit: error.limit
                 });
             }
             if (error instanceof ChunksRefused) {
                 if (error.quota === 'rate') {
-                    return this.#overQuota(ws, attachment.user, 'rate', error.detail);
+                    return this.#overQuota(ws, attachment, 'rate', error.detail);
                 }
                 // The room's buffer is full, not the sender at fault: it redials.
                 room.note({
@@ -243,16 +246,39 @@ export class Admission {
      * reports (`onSyncRefused`) and does not redial. Never a dropped frame
      * on a live socket: the sender's later frames would build on it and
      * wait in the room's memory for good, unstored and unacknowledged; and
-     * a redial would resend it and meet the same quota.
+     * a redial would resend it and meet the same quota. A socket of an older
+     * epoch whose hand-over is past the frame quota is closed `4410`: the
+     * room cannot read it, its client loads the room's document.
      */
-    #overQuota(ws, user, quota, detail) {
+    #overQuota(ws, { user, epoch }, quota, detail) {
         const room = this.room;
         room.note({ reason: 'quota', detail: { user, quota, ...detail } });
         room.log({ edytor: 'quota', user, quota });
         this.#chunkReaders.delete(ws);
         room.presence.depart(ws);
+        if (epoch != null && quota === 'frame')
+            return room.close(ws, CLOSE.reseeded, String(room.reseed.epoch));
         room.close(ws, CLOSE.quota, `quota: ${quota}`);
     }
+    /** The frame quota of `attachment`'s socket: a stale one's hand-over is its whole old document. */
+    #frameLimit(attachment) {
+        const room = this.room;
+        return attachment.epoch != null
+            ? room.reseed.staleFrameBytes
+            : room.limits.maxInboundFrameBytes;
+    }
+    /**
+     * A stale socket's rebase (`room.reseed.rebase`): `update`, the writes
+     * of a copy of the document under a client id of their own, admitted as
+     * its user's update, from that id. `true` once applied; refused (a
+     * quota, a read-only socket, a fault), `false`.
+     */
+    admitRebase(ws, attachment, doc, update, writer) {
+        if (attachment.readOnly)
+            return false;
+        this.onUpdate(ws, { ...attachment, replica: writer }, doc, update);
+        return ws.readyState === WebSocket.OPEN;
+    }
     /**
      * The update rate quota: a token bucket per socket, refilled at
      * `maxUpdatesPerSecond` up to ten seconds' worth. `false`: over it.
@@ -296,7 +322,7 @@ export class Admission {
         const syncType = decode(() => E.readVarUint(decoder));
         // The rate quota counts every sync message, a Step1 too (it costs a Step2).
         if (!this.allow(ws)) {
-            return this.#overQuota(ws, attachment.user, 'rate', {
+            return this.#overQuota(ws, attachment, 'rate', {
                 perSecond: room.limits.maxUpdatesPerSecond
             });
         }
@@ -335,6 +361,13 @@ export class Admission {
         // 3 · Attribution: new structs only under client ids this user may
         // write under; another user's are stripped, the rest applied.
         const decoded = decode(() => Y.decodeUpdate(update));
+        // An older epoch's content (`room.reseed.protocol`): the socket's
+        // document took it from another tab; it loads the room's again.
+        if (room.reseed.holdsOld(decoded, doc)) {
+            room.note({ reason: 'epoch', detail: { user: attachment.user, epoch: room.reseed.epoch } });
+            room.presence.depart(ws);
+            return room.close(ws, CLOSE.reseeded, String(room.reseed.epoch));
+        }
         // A storage outage (`room.storage.outage`): a frame that would write
         // waits for storage to answer, unapplied, so the outage rebuilds once.
         if (storage.outage !== null && writes(doc, decoded) && !storage.answers()) {
@@ -343,7 +376,7 @@ export class Admission {
         // The document quota, net of what the frame deletes.
         if (decoded.structs.some((struct) => !(struct instanceof Y.Skip)) &&
             this.#overDocument(update.length, freedBy(doc, decoded.ds))) {
-            return this.#overQuota(ws, attachment.user, 'document', {
+            return this.#overQuota(ws, attachment, 'document', {
                 bytes: storage.documentBytes,
                 incoming: update.length,
                 limit: room.limits.maxDocumentBytes