@dabble/patches 0.5.22 → 0.7.0

package/dist/net/PatchesSync.d.ts

@@ -1,18 +1,19 @@
+import { JSONRPCClient } from './protocol/JSONRPCClient.js';
 import { Signal } from '../event-signal.js';
-import { ConnectionState } from './protocol/types.js';
+import { SizeCalculator } from '../algorithms/shared/changeBatching.js';
+import { Patches } from '../client/Patches.js';
+import { AlgorithmName, ClientAlgorithm } from '../client/ClientAlgorithm.js';
 import { SyncingState, Change } from '../types.js';
-import { JSONRPCClient } from './protocol/JSONRPCClient.js';
+import { ConnectionState } from './protocol/types.js';
 import { PatchesWebSocket } from './websocket/PatchesWebSocket.js';
 import { WebSocketOptions } from './websocket/WebSocketTransport.js';
-import { SizeCalculator } from '../algorithms/shared/changeBatching.js';
-import { Patches } from '../client/Patches.js';
-import { PatchesStore } from '../client/PatchesStore.js';
+import '../json-patch/types.js';
+import '../BaseDoc-DkP3tUhT.js';
 import '../json-patch/JSONPatch.js';
 import '@dabble/delta';
-import '../json-patch/types.js';
+import '../client/PatchesStore.js';
 import './PatchesClient.js';
 import '../utils/deferred.js';
-import '../client/PatchesDoc.js';
 
 interface PatchesSyncState {
     online: boolean;
@@ -32,16 +33,22 @@ interface PatchesSyncOptions {
 /**
  * Handles WebSocket connection, document subscriptions, and syncing logic between
  * the Patches instance and the server.
+ *
+ * PatchesSync is algorithm-agnostic. It delegates to algorithm methods for:
+ * - Getting pending changes to send
+ * - Applying server changes
+ * - Confirming sent changes
  */
 declare class PatchesSync {
     protected options?: PatchesSyncOptions | undefined;
     protected ws: PatchesWebSocket;
     protected patches: Patches;
-    protected store: PatchesStore;
     protected maxPayloadBytes?: number;
     protected maxStorageBytes?: number;
     protected sizeCalculator?: SizeCalculator;
     protected trackedDocs: Set<string>;
+    /** Maps docId to the algorithm name used for that doc */
+    protected docAlgorithms: Map<string, AlgorithmName>;
     protected _state: PatchesSyncState;
     /**
      * Signal emitted when the sync state changes.
@@ -59,6 +66,11 @@ declare class PatchesSync {
      */
     readonly onRemoteDocDeleted: Signal<(docId: string, pendingChanges: Change[]) => void>;
     constructor(patches: Patches, url: string, options?: PatchesSyncOptions | undefined);
+    /**
+     * Gets the algorithm for a document. Uses the open doc's algorithm if available,
+     * otherwise falls back to the default algorithm.
+     */
+    protected _getAlgorithm(docId: string): ClientAlgorithm;
     /**
      * Gets the URL of the WebSocket connection.
      */
@@ -112,10 +124,10 @@ declare class PatchesSync {
      */
     protected _receiveCommittedChanges(docId: string, serverChanges: Change[]): Promise<void>;
     /**
-     * Applies server changes to a document using the centralized sync algorithm.
-     * This ensures consistent OT behavior regardless of whether the doc is open in memory.
+     * Applies server changes to a document using the algorithm.
+     * The algorithm handles all algorithm-specific logic (OT rebasing, LWW merging, etc).
      */
-    protected _applyServerChangesToDoc(docId: string, serverChanges: Change[], sentPendingRange?: [number, number]): Promise<Change[]>;
+    protected _applyServerChangesToDoc(docId: string, serverChanges: Change[]): Promise<void>;
     /**
      * Initiates the deletion process for a document both locally and on the server.
      * This now delegates the local tombstone marking to Patches.
@@ -124,7 +136,7 @@ declare class PatchesSync {
     protected _handleConnectionChange(connectionState: ConnectionState): void;
     protected _handleDocsTracked(docIds: string[]): Promise<void>;
     protected _handleDocsUntracked(docIds: string[]): Promise<void>;
-    protected _handleDocChange(docId: string, _changes: Change[]): Promise<void>;
+    protected _handleDocChange(docId: string): Promise<void>;
     /**
      * Unified handler for remote document deletion (both real-time notifications and offline discovery).
      * Cleans up local state and notifies the application with any pending changes that were lost.

package/dist/net/PatchesSync.js

@@ -7,9 +7,8 @@ import {
 } from "../chunk-IZ2YBCUP.js";
 var __receiveCommittedChanges_dec, _syncDoc_dec, _init;
 import { isEqual } from "@dabble/delta";
-import { applyCommittedChanges } from "../algorithms/client/applyCommittedChanges.js";
-import { collapsePendingChanges } from "../algorithms/client/collapsePendingChanges.js";
 import { breakChangesIntoBatches } from "../algorithms/shared/changeBatching.js";
+import { BaseDoc } from "../client/BaseDoc.js";
 import { Patches } from "../client/Patches.js";
 import { signal } from "../event-signal.js";
 import { blockable } from "../utils/concurrency.js";
@@ -22,11 +21,12 @@ class PatchesSync {
     __runInitializers(_init, 5, this);
     __publicField(this, "ws");
     __publicField(this, "patches");
-    __publicField(this, "store");
     __publicField(this, "maxPayloadBytes");
     __publicField(this, "maxStorageBytes");
     __publicField(this, "sizeCalculator");
     __publicField(this, "trackedDocs");
+    /** Maps docId to the algorithm name used for that doc */
+    __publicField(this, "docAlgorithms", /* @__PURE__ */ new Map());
     __publicField(this, "_state", { online: false, connected: false, syncing: null });
     /**
      * Signal emitted when the sync state changes.
@@ -42,7 +42,6 @@ class PatchesSync {
      */
     __publicField(this, "onRemoteDocDeleted", signal());
     this.patches = patches;
-    this.store = patches.store;
     this.maxPayloadBytes = options?.maxPayloadBytes;
     this.maxStorageBytes = options?.maxStorageBytes ?? patches.docOptions?.maxStorageBytes;
     this.sizeCalculator = options?.sizeCalculator ?? patches.docOptions?.sizeCalculator;
@@ -58,6 +57,20 @@ class PatchesSync {
     patches.onDeleteDoc(this._handleDocDeleted.bind(this));
     patches.onChange(this._handleDocChange.bind(this));
   }
+  /**
+   * Gets the algorithm for a document. Uses the open doc's algorithm if available,
+   * otherwise falls back to the default algorithm.
+   */
+  _getAlgorithm(docId) {
+    const docAlgorithm = this.patches.getDocAlgorithm(docId);
+    if (docAlgorithm) return docAlgorithm;
+    const algorithmName = this.docAlgorithms.get(docId) ?? this.patches.defaultAlgorithm;
+    const algorithm = this.patches.algorithms[algorithmName];
+    if (!algorithm) {
+      throw new Error(`Algorithm '${algorithmName}' not found for doc ${docId}`);
+    }
+    return algorithm;
+  }
   /**
    * Gets the URL of the WebSocket connection.
    */
@@ -125,7 +138,11 @@ class PatchesSync {
     if (!this.state.connected) return;
     this.updateState({ syncing: "updating" });
     try {
-      const tracked = await this.store.listDocs(true);
+      const defaultAlgorithm = this.patches.algorithms[this.patches.defaultAlgorithm];
+      if (!defaultAlgorithm) {
+        throw new Error("Default algorithm not found");
+      }
+      const tracked = await defaultAlgorithm.listDocs(true);
       const activeDocs = tracked.filter((t) => !t.deleted);
       const deletedDocs = tracked.filter((t) => t.deleted);
       const activeDocIds = activeDocs.map((t) => t.docId);
@@ -146,7 +163,8 @@ class PatchesSync {
         try {
           console.info(`Attempting server delete for tombstoned doc: ${docId}`);
           await this.ws.deleteDoc(docId);
-          await this.store.confirmDeleteDoc(docId);
+          const algorithm = this._getAlgorithm(docId);
+          await algorithm.confirmDeleteDoc(docId);
           console.info(`Successfully deleted and untracked doc: ${docId}`);
         } catch (err) {
           console.warn(`Server delete failed for ${docId}, keeping tombstone:`, err);
@@ -164,15 +182,17 @@ class PatchesSync {
   async syncDoc(docId) {
     if (!this.state.connected) return;
     const doc = this.patches.getOpenDoc(docId);
-    if (doc) {
-      doc.updateSyncing("updating");
+    const algorithm = this._getAlgorithm(docId);
+    const baseDoc = doc;
+    if (baseDoc) {
+      baseDoc.updateSyncing("updating");
     }
     try {
-      const pending = await this.store.getPendingChanges(docId);
-      if (pending.length > 0) {
+      const pending = await algorithm.getPendingToSend(docId);
+      if (pending && pending.length > 0) {
         await this.flushDoc(docId, pending);
       } else {
-        const [committedRev] = await this.store.getLastRevs(docId);
+        const committedRev = await algorithm.getCommittedRev(docId);
         if (committedRev) {
           const serverChanges = await this.ws.getChangesSince(docId, committedRev);
           if (serverChanges.length > 0) {
@@ -180,14 +200,14 @@ class PatchesSync {
           }
         } else {
           const snapshot = await this.ws.getDoc(docId);
-          await this.store.saveDoc(docId, snapshot);
-          if (doc) {
-            doc.import({ ...snapshot, changes: [] });
+          await algorithm.store.saveDoc(docId, snapshot);
+          if (baseDoc) {
+            baseDoc.import({ ...snapshot, changes: [] });
           }
         }
       }
-      if (doc) {
-        doc.updateSyncing(null);
+      if (baseDoc) {
+        baseDoc.updateSyncing(null);
       }
     } catch (err) {
       if (this._isDocDeletedError(err)) {
@@ -196,8 +216,8 @@ class PatchesSync {
       }
       console.error(`Error syncing doc ${docId}:`, err);
       this.onError.emit(err, { docId });
-      if (doc) {
-        doc.updateSyncing(err instanceof Error ? err : new Error(String(err)));
+      if (baseDoc) {
+        baseDoc.updateSyncing(err instanceof Error ? err : new Error(String(err)));
       }
     }
   }
@@ -213,18 +233,14 @@ class PatchesSync {
     if (!this.state.connected) {
       throw new Error("Not connected to server");
     }
+    const algorithm = this._getAlgorithm(docId);
     try {
-      if (!pending) pending = await this.store.getPendingChanges(docId);
+      if (!pending) {
+        pending = await algorithm.getPendingToSend(docId) ?? [];
+      }
       if (!pending.length) {
         return;
       }
-      if (this.store.getLastAttemptedSubmissionRev && this.store.setLastAttemptedSubmissionRev) {
-        const afterRev = await this.store.getLastAttemptedSubmissionRev(docId);
-        pending = collapsePendingChanges(pending, afterRev);
-        if (!pending.length) {
-          return;
-        }
-      }
       const batches = breakChangesIntoBatches(pending, {
         maxPayloadBytes: this.maxPayloadBytes,
         maxStorageBytes: this.maxStorageBytes,
@@ -234,14 +250,10 @@ class PatchesSync {
         if (!this.state.connected) {
           throw new Error("Disconnected during flush");
         }
-        if (this.store.setLastAttemptedSubmissionRev) {
-          const lastRevInBatch = batch[batch.length - 1].rev;
-          await this.store.setLastAttemptedSubmissionRev(docId, lastRevInBatch);
-        }
-        const range = [batch[0].rev, batch[batch.length - 1].rev];
         const committed = await this.ws.commitChanges(docId, batch);
-        await this._applyServerChangesToDoc(docId, committed, range);
-        pending = await this.store.getPendingChanges(docId);
+        await this._applyServerChangesToDoc(docId, committed);
+        await algorithm.confirmSent(docId, batch);
+        pending = await algorithm.getPendingToSend(docId) ?? [];
       }
     } catch (err) {
       if (this._isDocDeletedError(err)) {
@@ -261,35 +273,13 @@ class PatchesSync {
     }
   }
   /**
-   * Applies server changes to a document using the centralized sync algorithm.
-   * This ensures consistent OT behavior regardless of whether the doc is open in memory.
+   * Applies server changes to a document using the algorithm.
+   * The algorithm handles all algorithm-specific logic (OT rebasing, LWW merging, etc).
    */
-  async _applyServerChangesToDoc(docId, serverChanges, sentPendingRange) {
-    const currentSnapshot = await this.store.getDoc(docId);
-    if (!currentSnapshot) {
-      console.warn(`Cannot apply server changes to non-existent doc: ${docId}`);
-      return [];
-    }
+  async _applyServerChangesToDoc(docId, serverChanges) {
     const doc = this.patches.getOpenDoc(docId);
-    if (doc) {
-      const inMemoryPendingChanges = doc?.getPendingChanges();
-      const latestRev = currentSnapshot.changes[currentSnapshot.changes.length - 1]?.rev || currentSnapshot.rev;
-      const newChanges = inMemoryPendingChanges.filter((change) => change.rev > latestRev);
-      currentSnapshot.changes.push(...newChanges);
-    }
-    const { state, rev, changes: rebasedPendingChanges } = applyCommittedChanges(currentSnapshot, serverChanges);
-    if (doc) {
-      if (doc.committedRev === serverChanges[0].rev - 1) {
-        doc.applyCommittedChanges(serverChanges, rebasedPendingChanges);
-      } else {
-        doc.import({ state, rev, changes: rebasedPendingChanges });
-      }
-    }
-    await Promise.all([
-      this.store.saveCommittedChanges(docId, serverChanges, sentPendingRange),
-      this.store.replacePendingChanges(docId, rebasedPendingChanges)
-    ]);
-    return rebasedPendingChanges;
+    const algorithm = this._getAlgorithm(docId);
+    await algorithm.applyServerChanges(docId, serverChanges, doc);
   }
   /**
    * Initiates the deletion process for a document both locally and on the server.
@@ -298,8 +288,9 @@ class PatchesSync {
   async _handleDocDeleted(docId) {
     if (this.state.connected) {
       try {
+        const algorithm = this._getAlgorithm(docId);
         await this.ws.deleteDoc(docId);
-        await this.store.confirmDeleteDoc(docId);
+        await algorithm.confirmDeleteDoc(docId);
       } catch (err) {
         console.error(`Server delete failed for doc ${docId}, will retry on reconnect/resync.`, err);
         this.onError.emit(err, { docId });
@@ -351,7 +342,7 @@ class PatchesSync {
       }
     }
   }
-  async _handleDocChange(docId, _changes) {
+  async _handleDocChange(docId) {
     if (!this.state.connected) return;
     if (!this.trackedDocs.has(docId)) return;
     await this.flushDoc(docId);
@@ -361,13 +352,14 @@ class PatchesSync {
    * Cleans up local state and notifies the application with any pending changes that were lost.
    */
   async _handleRemoteDocDeleted(docId) {
-    const pendingChanges = await this.store.getPendingChanges(docId);
+    const algorithm = this._getAlgorithm(docId);
+    const pendingChanges = await algorithm.getPendingToSend(docId) ?? [];
     const doc = this.patches.getOpenDoc(docId);
     if (doc) {
       await this.patches.closeDoc(docId);
     }
     this.trackedDocs.delete(docId);
-    await this.store.confirmDeleteDoc(docId);
+    await algorithm.confirmDeleteDoc(docId);
     await this.onRemoteDocDeleted.emit(docId, pendingChanges);
   }
   /**

package/dist/net/index.d.ts

@@ -2,30 +2,26 @@ export { FetchTransport } from './http/FetchTransport.js';
 export { PatchesClient } from './PatchesClient.js';
 export { PatchesSync, PatchesSyncOptions, PatchesSyncState } from './PatchesSync.js';
 export { JSONRPCClient } from './protocol/JSONRPCClient.js';
-export { ConnectionSignalSubscriber, JSONRPCServer, MessageHandler } from './protocol/JSONRPCServer.js';
+export { AccessLevel, ApiDefinition, ConnectionSignalSubscriber, JSONRPCServer, JSONRPCServerOptions, MessageHandler } from './protocol/JSONRPCServer.js';
+export { getAuthContext, getClientId } from './serverContext.js';
 export { AwarenessUpdateNotificationParams, ClientTransport, ConnectionState, JsonRpcNotification, JsonRpcRequest, JsonRpcResponse, ListOptions, Message, PatchesAPI, PatchesNotificationParams, ServerTransport, SignalNotificationParams } from './protocol/types.js';
 export { rpcError, rpcNotification, rpcResponse } from './protocol/utils.js';
 export { PatchesState, SyncingState } from './types.js';
 export { Access, AuthContext, AuthorizationProvider, allowAll, assertNotDeleted, denyAll } from './websocket/AuthorizationProvider.js';
 export { onlineState } from './websocket/onlineState.js';
 export { PatchesWebSocket } from './websocket/PatchesWebSocket.js';
-export { RPCServer, RPCServerOptions } from './websocket/RPCServer.js';
 export { JsonRpcMessage, SignalingService } from './websocket/SignalingService.js';
-export { WebSocketServer } from './websocket/WebSocketServer.js';
+export { WebSocketServer, WebSocketServerOptions } from './websocket/WebSocketServer.js';
 export { WebSocketOptions, WebSocketTransport } from './websocket/WebSocketTransport.js';
 export { CommitChangesOptions } from '../types.js';
 import '../event-signal.js';
 import '../algorithms/shared/changeBatching.js';
 import '../client/Patches.js';
-import '../client/PatchesDoc.js';
+import '../json-patch/types.js';
+import '../client/ClientAlgorithm.js';
+import '../BaseDoc-DkP3tUhT.js';
 import '../client/PatchesStore.js';
 import '../server/types.js';
-import '../server/PatchesBranchManager.js';
-import '../server/PatchesServer.js';
-import '../compression/index.js';
-import '../algorithms/shared/lz.js';
-import '../json-patch/types.js';
-import '../server/PatchesHistoryManager.js';
 import '../utils/deferred.js';
 import '../json-patch/JSONPatch.js';
 import '@dabble/delta';

package/dist/net/index.js

@@ -1,13 +1,18 @@
+import "../chunk-IZ2YBCUP.js";
 export * from "./http/FetchTransport.js";
 export * from "./PatchesClient.js";
 export * from "./PatchesSync.js";
 export * from "./protocol/JSONRPCClient.js";
 export * from "./protocol/JSONRPCServer.js";
+import { getAuthContext, getClientId } from "./serverContext.js";
 export * from "./protocol/utils.js";
 export * from "./websocket/AuthorizationProvider.js";
 export * from "./websocket/onlineState.js";
 export * from "./websocket/PatchesWebSocket.js";
-export * from "./websocket/RPCServer.js";
 export * from "./websocket/SignalingService.js";
 export * from "./websocket/WebSocketServer.js";
 export * from "./websocket/WebSocketTransport.js";
+export {
+  getAuthContext,
+  getClientId
+};

package/dist/net/protocol/JSONRPCClient.d.ts

@@ -25,18 +25,18 @@ declare class JSONRPCClient {
      * Sends a JSON-RPC request to the server and returns a promise for the response.
      *
      * @param method - The name of the remote procedure to call
-     * @param params - The parameters to pass to the remote procedure (optional)
+     * @param args - The arguments to pass to the remote procedure (sent as array)
      * @returns A promise that resolves with the result of the procedure call or rejects with an error
      * @template T - The expected return type of the remote procedure
      */
-    call<T = any>(method: string, params?: any): Promise<T>;
+    call<T = any>(method: string, ...args: any[]): Promise<T>;
     /**
      * Sends a JSON-RPC notification to the server (no response expected).
      *
      * @param method - The name of the remote procedure to call
-     * @param params - The parameters to pass to the remote procedure (optional)
+     * @param args - The arguments to pass to the remote procedure (sent as array)
      */
-    notify(method: string, params?: any): void;
+    notify(method: string, ...args: any[]): void;
     /**
      * Subscribes to server-sent notifications for a specific method.
      *

package/dist/net/protocol/JSONRPCClient.js

@@ -18,12 +18,13 @@ class JSONRPCClient {
    * Sends a JSON-RPC request to the server and returns a promise for the response.
    *
    * @param method - The name of the remote procedure to call
-   * @param params - The parameters to pass to the remote procedure (optional)
+   * @param args - The arguments to pass to the remote procedure (sent as array)
    * @returns A promise that resolves with the result of the procedure call or rejects with an error
    * @template T - The expected return type of the remote procedure
    */
-  async call(method, params) {
+  async call(method, ...args) {
     const id = this.nextId++;
+    const params = args.length > 0 ? args : void 0;
     const message = { jsonrpc: "2.0", id, method, params };
     return new Promise((resolve, reject) => {
       this.pending.set(id, { resolve, reject });
@@ -34,9 +35,10 @@ class JSONRPCClient {
    * Sends a JSON-RPC notification to the server (no response expected).
    *
    * @param method - The name of the remote procedure to call
-   * @param params - The parameters to pass to the remote procedure (optional)
+   * @param args - The arguments to pass to the remote procedure (sent as array)
    */
-  notify(method, params) {
+  notify(method, ...args) {
+    const params = args.length > 0 ? args : void 0;
     const message = { jsonrpc: "2.0", method, params };
     this.transport.send(JSON.stringify(message));
   }

package/dist/net/protocol/JSONRPCServer.d.ts

@@ -1,14 +1,23 @@
 import { Signal, Unsubscriber } from '../../event-signal.js';
-import { AuthContext } from '../websocket/AuthorizationProvider.js';
+import { AuthorizationProvider, AuthContext } from '../websocket/AuthorizationProvider.js';
 import { JsonRpcNotification, Message, JsonRpcResponse } from './types.js';
 import '../../server/types.js';
+import '../../json-patch/types.js';
 import '../../types.js';
 import '../../json-patch/JSONPatch.js';
 import '@dabble/delta';
-import '../../json-patch/types.js';
 
 type ConnectionSignalSubscriber = (params: any, clientId?: string) => any;
-type MessageHandler<P = any, R = any> = (params: P, ctx?: AuthContext) => Promise<R> | R;
+type MessageHandler<R = any> = (...args: any[]) => Promise<R> | R;
+/** Access level for API methods */
+type AccessLevel = 'read' | 'write';
+/** Static API definition mapping method names to access levels */
+type ApiDefinition = Record<string, AccessLevel>;
+/** Options for creating a JSONRPCServer */
+interface JSONRPCServerOptions {
+    /** Authorization provider for document access control */
+    auth?: AuthorizationProvider;
+}
 /**
  * Lightweight JSON-RPC 2.0 server adapter for {@link PatchesServer}.
  *
@@ -30,15 +39,31 @@ declare class JSONRPCServer {
     private readonly handlers;
     /** Allow external callers to emit server-initiated notifications. */
     private readonly notificationSignals;
+    /** Authorization provider for document access control */
+    readonly auth?: AuthorizationProvider;
     /** Allow external callers to emit server-initiated notifications. */
     readonly onNotify: Signal<(msg: JsonRpcNotification, exceptConnectionId?: string) => void>;
+    /**
+     * Creates a new JSONRPCServer instance.
+     * @param options - Configuration options
+     */
+    constructor(options?: JSONRPCServerOptions);
     /**
      * Registers a JSON-RPC method.
      *
      * @param method   Fully-qualified method name (e.g. "patches.subscribe").
      * @param handler  Function that performs the work and returns the result.
+     *                 Receives spread arguments followed by AuthContext.
      */
-    registerMethod<TParams = any, TResult = any>(method: string, handler: MessageHandler<TParams, TResult>): void;
+    registerMethod<TResult = any>(method: string, handler: MessageHandler<TResult>): void;
+    /**
+     * Registers all methods from an object that has a static `api` property.
+     * The `api` property should map method names to access levels ('read' | 'write').
+     *
+     * @param obj - Object instance with methods to register
+     * @throws Error if the object's constructor doesn't have a static `api` property
+     */
+    register<T extends object>(obj: T): void;
     /**
      * Subscribes to server-sent notifications for a specific method.
      *
@@ -68,13 +93,24 @@ declare class JSONRPCServer {
     processMessage(raw: string, ctx?: AuthContext): Promise<string | undefined>;
     processMessage(message: Message, ctx?: AuthContext): Promise<JsonRpcResponse | undefined>;
     /**
-     * Maps JSON-RPC method names to {@link PatchesServer} calls.
-     * @param connectionId - The WebSocket transport object.
+     * Checks access control before method invocation.
+     * Called before each method invocation when using `register()`.
+     *
+     * @param access - The required access level ('read' or 'write')
+     * @param ctx - The authentication context
+     * @param method - The method being called
+     * @param args - The method arguments (first arg is typically docId)
+     * @throws StatusError if access is denied
+     */
+    protected assertAccess(access: AccessLevel, ctx: AuthContext | undefined, method: string, args?: any[]): Promise<void>;
+    /**
+     * Maps JSON-RPC method names to handler calls.
      * @param method - The JSON-RPC method name.
-     * @param params - The JSON-RPC parameters.
-     * @returns The result of the {@link PatchesServer} call.
+     * @param params - The JSON-RPC parameters (array of arguments).
+     * @param ctx - The authentication context.
+     * @returns The result of the handler call.
      */
     protected _dispatch(method: string, params: any, ctx?: AuthContext): Promise<any>;
 }
 
-export { type ConnectionSignalSubscriber, JSONRPCServer, type MessageHandler };
+export { type AccessLevel, type ApiDefinition, type ConnectionSignalSubscriber, JSONRPCServer, type JSONRPCServerOptions, type MessageHandler };

package/dist/net/protocol/JSONRPCServer.js

@@ -1,13 +1,24 @@
 import "../../chunk-IZ2YBCUP.js";
 import { signal } from "../../event-signal.js";
+import { StatusError } from "../error.js";
+import { clearAuthContext, getAuthContext, setAuthContext } from "../serverContext.js";
 import { rpcError, rpcNotification, rpcResponse } from "./utils.js";
 class JSONRPCServer {
   /** Map of fully-qualified JSON-RPC method → handler function */
   handlers = /* @__PURE__ */ new Map();
   /** Allow external callers to emit server-initiated notifications. */
   notificationSignals = /* @__PURE__ */ new Map();
+  /** Authorization provider for document access control */
+  auth;
   /** Allow external callers to emit server-initiated notifications. */
   onNotify = signal();
+  /**
+   * Creates a new JSONRPCServer instance.
+   * @param options - Configuration options
+   */
+  constructor(options = {}) {
+    this.auth = options.auth;
+  }
   // -------------------------------------------------------------------------
   // Registration API
   // -------------------------------------------------------------------------
@@ -16,6 +27,7 @@ class JSONRPCServer {
    *
    * @param method   Fully-qualified method name (e.g. "patches.subscribe").
    * @param handler  Function that performs the work and returns the result.
+   *                 Receives spread arguments followed by AuthContext.
    */
   registerMethod(method, handler) {
     if (this.handlers.has(method)) {
@@ -23,6 +35,29 @@ class JSONRPCServer {
     }
     this.handlers.set(method, handler);
   }
+  /**
+   * Registers all methods from an object that has a static `api` property.
+   * The `api` property should map method names to access levels ('read' | 'write').
+   *
+   * @param obj - Object instance with methods to register
+   * @throws Error if the object's constructor doesn't have a static `api` property
+   */
+  register(obj) {
+    const api = obj.constructor.api;
+    if (!api) {
+      throw new Error("Object must have static api property");
+    }
+    for (const [method, access] of Object.entries(api)) {
+      if (typeof obj[method] !== "function") {
+        throw new Error(`Method '${method}' not found on object`);
+      }
+      this.registerMethod(method, async (...args) => {
+        const ctx = getAuthContext();
+        await this.assertAccess(access, ctx, method, args);
+        return obj[method](...args);
+      });
+    }
+  }
   // -------------------------------------------------------------------------
   // Public helpers
   // -------------------------------------------------------------------------
@@ -85,21 +120,41 @@ class JSONRPCServer {
     }
   }
   /**
-   * Maps JSON-RPC method names to {@link PatchesServer} calls.
-   * @param connectionId - The WebSocket transport object.
+   * Checks access control before method invocation.
+   * Called before each method invocation when using `register()`.
+   *
+   * @param access - The required access level ('read' or 'write')
+   * @param ctx - The authentication context
+   * @param method - The method being called
+   * @param args - The method arguments (first arg is typically docId)
+   * @throws StatusError if access is denied
+   */
+  async assertAccess(access, ctx, method, args) {
+    if (!this.auth) return;
+    const docId = args?.[0];
+    if (typeof docId !== "string") return;
+    const ok = await this.auth.canAccess(ctx, docId, access, method);
+    if (!ok) {
+      throw new StatusError(401, `${access.toUpperCase()}_FORBIDDEN:${docId}`);
+    }
+  }
+  /**
+   * Maps JSON-RPC method names to handler calls.
    * @param method - The JSON-RPC method name.
-   * @param params - The JSON-RPC parameters.
-   * @returns The result of the {@link PatchesServer} call.
+   * @param params - The JSON-RPC parameters (array of arguments).
+   * @param ctx - The authentication context.
+   * @returns The result of the handler call.
    */
   async _dispatch(method, params, ctx) {
     const handler = this.handlers.get(method);
     if (!handler) {
       throw new Error(`Unknown method '${method}'.`);
     }
-    if (!params || typeof params !== "object" || Array.isArray(params)) {
-      throw new Error(`Invalid parameters for method '${method}'.`);
-    }
-    return handler(params, ctx);
+    const args = Array.isArray(params) ? params : params === void 0 ? [] : [params];
+    setAuthContext(ctx);
+    const response = handler(...args);
+    clearAuthContext();
+    return response;
   }
 }
 export {