@dabble/patches 0.9.2 → 0.9.6

package/README.md

@@ -16,6 +16,26 @@ doc.change(state => (state.title = 'New Title'));
 
 Changes apply immediately for snappy UIs, then sync to the server in the background. Offline? No problem. Changes queue up and sync when you're back online.
 
+## Scope: what Patches is and is not
+
+Patches is a **generic primitives library**. It provides the building blocks (OT, LWW, sync transport, doc-store interfaces) for realtime systems. Compose it into your own backend and frontend.
+
+Patches knows about:
+
+- JSON documents, JSON Patch operations, and snapshots
+- Operational Transformation and Last-Write-Wins conflict resolution
+- A transport surface (WebSocket, SSE+REST, WebRTC) that moves changes between clients and a server
+- HTTP status codes propagated as `StatusError` (401, 403, 404, 410) — so consuming apps can branch on the response
+
+Patches does **not** know about:
+
+- Users, roles, invites, memberships, or any access-control model
+- Apps, projects, books, documents-as-products, or any app-specific terminology
+- Email sending, name/email lookups, or any identity service
+- UX policy for what to do when access is lost (consuming apps decide whether a 403 means "show a banner", "kick out of the doc", or anything else)
+
+If a feature feels like it belongs in Patches but mentions an app concept (e.g. "an invite for a project"), it doesn't belong here — it belongs one level up, in the app's own client SDK or in the consuming app itself. The Patches surface should stay generic enough to back any realtime system.
+
 ## Two Sync Strategies
 
 Patches gives you two conflict resolution approaches. Pick the right tool for the job.

package/dist/{BaseDoc-rCKMFV6B.d.ts → BaseDoc-CXHXcW18.d.ts}

@@ -246,4 +246,4 @@ declare abstract class BaseDoc<T extends object = object> extends ReadonlyStoreC
     abstract import(snapshot: PatchesSnapshot<T>): void;
 }
 
-export { BaseDoc as B, OTDoc as O, type PatchesDoc as P, type PatchesDocOptions as a };
+export { BaseDoc as B, OTDoc as O, type PatchesDocOptions as P, type PatchesDoc as a };

package/dist/algorithms/ot/server/createVersion.d.ts

@@ -1,5 +1,5 @@
 import { OTStoreBackend } from '../../../server/types.js';
-import { EditableVersionMetadata, Change, VersionMetadata } from '../../../types.js';
+import { EditableVersionMetadata, VersionMetadata, Change } from '../../../types.js';
 import '../../../json-patch/types.js';
 import '../../../json-patch/JSONPatch.js';
 import '@dabble/delta';

package/dist/client/BaseDoc.d.ts

@@ -1,6 +1,6 @@
 import 'easy-signal';
 import '../json-patch/types.js';
 import '../types.js';
-export { B as BaseDoc } from '../BaseDoc-rCKMFV6B.js';
+export { B as BaseDoc } from '../BaseDoc-CXHXcW18.js';
 import '../json-patch/JSONPatch.js';
 import '@dabble/delta';

package/dist/client/ClientAlgorithm.d.ts

@@ -1,6 +1,6 @@
 import { JSONPatchOp } from '../json-patch/types.js';
 import { PatchesSnapshot, Change } from '../types.js';
-import { P as PatchesDoc } from '../BaseDoc-rCKMFV6B.js';
+import { a as PatchesDoc } from '../BaseDoc-CXHXcW18.js';
 import { PatchesStore, TrackedDoc } from './PatchesStore.js';
 import '../json-patch/JSONPatch.js';
 import '@dabble/delta';

package/dist/client/LWWAlgorithm.d.ts

@@ -2,7 +2,7 @@ import { JSONPatchOp } from '../json-patch/types.js';
 import { PatchesSnapshot, Change } from '../types.js';
 import { ClientAlgorithm } from './ClientAlgorithm.js';
 import { LWWClientStore } from './LWWClientStore.js';
-import { P as PatchesDoc } from '../BaseDoc-rCKMFV6B.js';
+import { a as PatchesDoc } from '../BaseDoc-CXHXcW18.js';
 import { TrackedDoc } from './PatchesStore.js';
 import '../json-patch/JSONPatch.js';
 import '@dabble/delta';

package/dist/client/LWWDoc.d.ts

@@ -1,6 +1,6 @@
 import { JSONPatchOp } from '../json-patch/types.js';
 import { PatchesSnapshot, Change } from '../types.js';
-import { B as BaseDoc } from '../BaseDoc-rCKMFV6B.js';
+import { B as BaseDoc } from '../BaseDoc-CXHXcW18.js';
 import '../json-patch/JSONPatch.js';
 import '@dabble/delta';
 import 'easy-signal';

package/dist/client/OTAlgorithm.d.ts

@@ -2,7 +2,7 @@ import { JSONPatchOp } from '../json-patch/types.js';
 import { PatchesSnapshot, Change } from '../types.js';
 import { ClientAlgorithm } from './ClientAlgorithm.js';
 import { OTClientStore } from './OTClientStore.js';
-import { a as PatchesDocOptions, P as PatchesDoc } from '../BaseDoc-rCKMFV6B.js';
+import { P as PatchesDocOptions, a as PatchesDoc } from '../BaseDoc-CXHXcW18.js';
 import { TrackedDoc } from './PatchesStore.js';
 import '../json-patch/JSONPatch.js';
 import '@dabble/delta';

package/dist/client/OTDoc.d.ts

@@ -1,5 +1,5 @@
 import '../types.js';
-export { O as OTDoc } from '../BaseDoc-rCKMFV6B.js';
+export { O as OTDoc } from '../BaseDoc-CXHXcW18.js';
 import '../json-patch/JSONPatch.js';
 import '@dabble/delta';
 import '../json-patch/types.js';

package/dist/client/Patches.d.ts

@@ -3,7 +3,7 @@ import { Unsubscriber } from 'easy-signal';
 import { JSONPatchOp } from '../json-patch/types.js';
 import { Change } from '../types.js';
 import { ClientAlgorithm } from './ClientAlgorithm.js';
-import { a as PatchesDocOptions, P as PatchesDoc } from '../BaseDoc-rCKMFV6B.js';
+import { P as PatchesDocOptions, a as PatchesDoc } from '../BaseDoc-CXHXcW18.js';
 import { AlgorithmName } from './PatchesStore.js';
 import '../json-patch/JSONPatch.js';
 import '@dabble/delta';

package/dist/client/PatchesBranchClient.d.ts

@@ -8,7 +8,7 @@ import '../json-patch/JSONPatch.js';
 import '@dabble/delta';
 import '../json-patch/types.js';
 import './ClientAlgorithm.js';
-import '../BaseDoc-rCKMFV6B.js';
+import '../BaseDoc-CXHXcW18.js';
 
 interface PatchesBranchClientOptions {
     /** Algorithm to use for the branch document (defaults to the Patches instance default). */

package/dist/client/PatchesDoc.d.ts

@@ -1,6 +1,6 @@
 import 'easy-signal';
 import '../json-patch/types.js';
 import '../types.js';
-export { O as OTDoc, P as PatchesDoc, a as PatchesDocOptions } from '../BaseDoc-rCKMFV6B.js';
+export { O as OTDoc, a as PatchesDoc, P as PatchesDocOptions } from '../BaseDoc-CXHXcW18.js';
 import '../json-patch/JSONPatch.js';
 import '@dabble/delta';

package/dist/client/factories.d.ts

@@ -1,6 +1,6 @@
 import { AlgorithmName } from './PatchesStore.js';
 import { Patches } from './Patches.js';
-import { a as PatchesDocOptions } from '../BaseDoc-rCKMFV6B.js';
+import { P as PatchesDocOptions } from '../BaseDoc-CXHXcW18.js';
 import '../types.js';
 import '../json-patch/JSONPatch.js';
 import '@dabble/delta';

package/dist/client/index.d.ts

@@ -1,4 +1,4 @@
-export { B as BaseDoc, O as OTDoc, P as PatchesDoc, a as PatchesDocOptions } from '../BaseDoc-rCKMFV6B.js';
+export { B as BaseDoc, O as OTDoc, a as PatchesDoc, P as PatchesDocOptions } from '../BaseDoc-CXHXcW18.js';
 export { IndexedDBFactoryOptions, MultiAlgorithmFactoryOptions, MultiAlgorithmIndexedDBFactoryOptions, PatchesFactoryOptions, createLWWIndexedDBPatches, createLWWPatches, createMultiAlgorithmExternalDBPatches, createMultiAlgorithmIndexedDBPatches, createMultiAlgorithmPatches, createOTIndexedDBPatches, createOTPatches, upgradePatchesDB } from './factories.js';
 export { IDBStoreWrapper, IDBTransactionWrapper, IndexedDBStore } from './IndexedDBStore.js';
 export { OTIndexedDBStore } from './OTIndexedDBStore.js';

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { Delta } from '@dabble/delta';
-export { B as BaseDoc, O as OTDoc, P as PatchesDoc, a as PatchesDocOptions } from './BaseDoc-rCKMFV6B.js';
+export { B as BaseDoc, O as OTDoc, a as PatchesDoc, P as PatchesDocOptions } from './BaseDoc-CXHXcW18.js';
 export { IndexedDBFactoryOptions, MultiAlgorithmFactoryOptions, MultiAlgorithmIndexedDBFactoryOptions, PatchesFactoryOptions, createLWWIndexedDBPatches, createLWWPatches, createMultiAlgorithmExternalDBPatches, createMultiAlgorithmIndexedDBPatches, createMultiAlgorithmPatches, createOTIndexedDBPatches, createOTPatches, upgradePatchesDB } from './client/factories.js';
 export { IDBStoreWrapper, IDBTransactionWrapper, IndexedDBStore } from './client/IndexedDBStore.js';
 export { OTIndexedDBStore } from './client/OTIndexedDBStore.js';

package/dist/json-patch/JSONPatch.d.ts

@@ -86,6 +86,9 @@ declare class JSONPatch {
     bit(path: PathLike, index: number, on: boolean): this;
     /**
      * Applies a delta to a text document.
+     *
+     * `value` is stored as a bare `Op[]` array (the canonical `@txt` shape).
+     * Accepts a `Delta` instance, a serialized `{ ops }` form, or the array directly.
      */
     text(path: PathLike, value: Delta | Delta['ops']): this;
     /**

package/dist/json-patch/JSONPatch.js

@@ -22,6 +22,7 @@ import { applyPatch } from "./applyPatch.js";
 import { composePatch } from "./composePatch.js";
 import { invertPatch } from "./invertPatch.js";
 import { bitmask } from "./ops/bitmask.js";
+import { toOps } from "./ops/text.js";
 import { transformPatch } from "./transformPatch.js";
 class JSONPatch {
   ops;
@@ -120,16 +121,14 @@ class JSONPatch {
   }
   /**
    * Applies a delta to a text document.
+   *
+   * `value` is stored as a bare `Op[]` array (the canonical `@txt` shape).
+   * Accepts a `Delta` instance, a serialized `{ ops }` form, or the array directly.
    */
   text(path, value) {
-    if (Array.isArray(value)) {
-      value = new Delta(value);
-    } else if (!(value instanceof Delta) && Array.isArray(value?.ops)) {
-      value = new Delta(value.ops);
-    } else if (!(value instanceof Delta)) {
-      throw new Error("Invalid Delta");
-    }
-    return this.op("@txt", path, value);
+    const ops = toOps(value);
+    if (!ops) throw new Error("Invalid Delta");
+    return this.op("@txt", path, ops);
   }
   /**
    * Creates a patch from an object partial, updating each field. Set a field to undefined to delete it.

package/dist/json-patch/ops/text.d.ts

@@ -1,5 +1,15 @@
+import { Op } from '@dabble/delta';
 import { JSONPatchOpHandler } from '../types.js';
 
+/**
+ * Normalize a `@txt` op's `value` to a bare `Op[]` array.
+ *
+ * The canonical form is an array of Delta ops, but historically `JSONPatch.text()`,
+ * `text.compose()`, and `text.invert()` produced `Delta` instances. Those serialize
+ * via `JSON.stringify` to `{ ops: [...] }`, so any rehydrated op may land in either
+ * shape. Accept all three; return `null` if the input isn't a recognizable Delta.
+ */
+declare function toOps(value: unknown): Op[] | null;
 declare const text: JSONPatchOpHandler;
 
-export { text };
+export { text, toOps };

package/dist/json-patch/ops/text.js

@@ -4,13 +4,21 @@ import { replace } from "../ops/replace.js";
 import { get } from "../utils/get.js";
 import { log } from "../utils/log.js";
 import { updateRemovedOps } from "../utils/ops.js";
+function toOps(value) {
+  if (Array.isArray(value)) return value;
+  if (value && typeof value === "object" && Array.isArray(value.ops)) {
+    return value.ops;
+  }
+  return null;
+}
 const text = {
   like: "replace",
   apply(state, path, value) {
-    const delta = Array.isArray(value) ? new Delta(value) : value;
-    if (!delta || !Array.isArray(delta.ops)) {
+    const ops = toOps(value);
+    if (!ops) {
       return "Invalid delta";
     }
+    const delta = new Delta(ops);
     const existingData = get(state, path);
     let doc;
     if (Array.isArray(existingData)) {
@@ -29,22 +37,24 @@ const text = {
   },
   transform(state, thisOp, otherOps) {
     log("Transforming ", otherOps, ' against "@txt"', thisOp);
+    const thisOps = toOps(thisOp.value);
     return updateRemovedOps(state, thisOp.path, otherOps, false, true, thisOp.op, (op) => {
       if (op.path !== thisOp.path) return null;
-      if (!op.value || !Array.isArray(op.value)) return null;
-      const thisDelta = new Delta(thisOp.value);
-      let otherDelta = new Delta(op.value);
+      const otherOpsArr = toOps(op.value);
+      if (!thisOps || !otherOpsArr) return null;
+      const thisDelta = new Delta(thisOps);
+      let otherDelta = new Delta(otherOpsArr);
       otherDelta = thisDelta.transform(otherDelta, true);
       return { ...op, value: otherDelta.ops };
     });
   },
   invert(state, { path, value }, oldValue, changedObj) {
     if (path.endsWith("/-")) path = path.replace("-", changedObj.length);
-    const delta = new Delta(value);
-    return oldValue === void 0 ? { op: "remove", path } : { op: "@txt", path, value: delta.invert(oldValue) };
+    const delta = new Delta(toOps(value) ?? []);
+    return oldValue === void 0 ? { op: "remove", path } : { op: "@txt", path, value: delta.invert(oldValue).ops };
   },
   compose(state, delta1, delta2) {
-    return new Delta(delta1).compose(new Delta(delta2));
+    return new Delta(toOps(delta1) ?? []).compose(new Delta(toOps(delta2) ?? [])).ops;
   }
 };
 function fixBadDeltaDoc(delta) {
@@ -72,5 +82,6 @@ function fixBadDeltaDoc(delta) {
   return newDelta;
 }
 export {
-  text
+  text,
+  toOps
 };

package/dist/net/PatchesSync.d.ts

@@ -13,7 +13,7 @@ import { WebSocketOptions } from './websocket/WebSocketTransport.js';
 import '../json-patch/JSONPatch.js';
 import '@dabble/delta';
 import '../json-patch/types.js';
-import '../BaseDoc-rCKMFV6B.js';
+import '../BaseDoc-CXHXcW18.js';
 import '../utils/deferred.js';
 
 interface PatchesSyncState {
@@ -84,19 +84,6 @@ declare class PatchesSync extends ReadonlyStoreClass<PatchesSyncState> {
      * Provides the pending changes that were discarded so the application can handle them.
      */
     readonly onRemoteDocDeleted: easy_signal.Signal<(docId: string, pendingChanges: Change[]) => void>;
-    /**
-     * Signal emitted when the server reports the caller is no longer authorised
-     * to read/write a tracked document (e.g. a co-author was revoked, removed
-     * from a shared collection, or never had access in the first place).
-     *
-     * Local cleanup mirrors `onRemoteDocDeleted` — untrack, drop the local
-     * cache, return any pending changes that were lost — but the doc itself
-     * still exists server-side. Consumers that maintain a workspace listing
-     * (e.g. a "Shared with Me" dashboard) should remove the doc from their
-     * own state when this fires; otherwise it would resurface on next start
-     * and immediately re-fail with the same 403.
-     */
-    readonly onRemoteDocAccessRevoked: easy_signal.Signal<(docId: string, pendingChanges: Change[]) => void>;
     /**
      * Signal emitted after pending branch metas have been synced to the server.
      * Consumers should use this to refresh in-memory branch state (e.g. call `loadCached()`
@@ -196,21 +183,6 @@ declare class PatchesSync extends ReadonlyStoreClass<PatchesSyncState> {
      * Cleans up local state and notifies the application with any pending changes that were lost.
      */
     protected _handleRemoteDocDeleted(docId: string): Promise<void>;
-    /**
-     * Sibling of `_handleRemoteDocDeleted` for the access-revoked path.
-     * Same local cleanup (close, untrack, drop cache, clear sync state) but
-     * the doc is not tombstoned server-side — it just isn't ours anymore.
-     * Emitted as a distinct signal so consumers can show different UX
-     * ("Your access was revoked" vs. "Project was deleted") without having
-     * to inspect error codes themselves.
-     */
-    protected _handleRemoteDocAccessRevoked(docId: string): Promise<void>;
-    /**
-     * Local cleanup shared by `_handleRemoteDocDeleted` and
-     * `_handleRemoteDocAccessRevoked`. Returns pending changes that were
-     * lost so the caller can include them in the application-facing signal.
-     */
-    protected _cleanupAfterAccessLoss(docId: string): Promise<Change[]>;
     /**
      * Adds, updates, or removes a doc state entry immutably and notifies via store.
      * - Pass a full DocSyncState to add a new entry or overwrite an existing one.
@@ -239,14 +211,6 @@ declare class PatchesSync extends ReadonlyStoreClass<PatchesSyncState> {
      * Helper to detect DOC_DELETED (410) errors from the server.
      */
     protected _isDocDeletedError(err: unknown): boolean;
-    /**
-     * Helper to detect ACCESS_REVOKED (403) errors from the server. Used by
-     * the sync/flush catch blocks to short-circuit straight into the
-     * `_handleRemoteDocAccessRevoked` cleanup path rather than latching the
-     * error onto `docStates[docId].syncError` (which would surface as a
-     * permanent "Unable to Sync" pill in the UI).
-     */
-    protected _isAccessRevokedError(err: unknown): boolean;
 }
 
 export { PatchesSync, type PatchesSyncOptions, type PatchesSyncState };

package/dist/net/PatchesSync.js

@@ -52,19 +52,6 @@ class PatchesSync extends (_a = ReadonlyStoreClass, _syncDoc_dec = [serialGate],
      * Provides the pending changes that were discarded so the application can handle them.
      */
     __publicField(this, "onRemoteDocDeleted", signal());
-    /**
-     * Signal emitted when the server reports the caller is no longer authorised
-     * to read/write a tracked document (e.g. a co-author was revoked, removed
-     * from a shared collection, or never had access in the first place).
-     *
-     * Local cleanup mirrors `onRemoteDocDeleted` — untrack, drop the local
-     * cache, return any pending changes that were lost — but the doc itself
-     * still exists server-side. Consumers that maintain a workspace listing
-     * (e.g. a "Shared with Me" dashboard) should remove the doc from their
-     * own state when this fires; otherwise it would resurface on next start
-     * and immediately re-fail with the same 403.
-     */
-    __publicField(this, "onRemoteDocAccessRevoked", signal());
     /**
      * Signal emitted after pending branch metas have been synced to the server.
      * Consumers should use this to refresh in-memory branch state (e.g. call `loadCached()`
@@ -373,10 +360,6 @@ class PatchesSync extends (_a = ReadonlyStoreClass, _syncDoc_dec = [serialGate],
         await this._handleRemoteDocDeleted(docId);
         return;
       }
-      if (this._isAccessRevokedError(err)) {
-        await this._handleRemoteDocAccessRevoked(docId);
-        return;
-      }
       const syncError = err instanceof Error ? err : new Error(String(err));
       this._updateDocSyncState(docId, { syncStatus: "error", syncError });
       console.error(`Error syncing doc ${docId}:`, err);
@@ -438,10 +421,6 @@ class PatchesSync extends (_a = ReadonlyStoreClass, _syncDoc_dec = [serialGate],
         await this._handleRemoteDocDeleted(docId);
         return;
       }
-      if (this._isAccessRevokedError(err)) {
-        await this._handleRemoteDocAccessRevoked(docId);
-        return;
-      }
       const flushError = err instanceof Error ? err : new Error(String(err));
       this._updateDocSyncState(docId, { syncStatus: "error", syncError: flushError });
       console.error(`Flush failed for doc ${docId}:`, err);
@@ -583,27 +562,6 @@ class PatchesSync extends (_a = ReadonlyStoreClass, _syncDoc_dec = [serialGate],
    * Cleans up local state and notifies the application with any pending changes that were lost.
    */
   async _handleRemoteDocDeleted(docId) {
-    const pendingChanges = await this._cleanupAfterAccessLoss(docId);
-    await this.onRemoteDocDeleted.emit(docId, pendingChanges);
-  }
-  /**
-   * Sibling of `_handleRemoteDocDeleted` for the access-revoked path.
-   * Same local cleanup (close, untrack, drop cache, clear sync state) but
-   * the doc is not tombstoned server-side — it just isn't ours anymore.
-   * Emitted as a distinct signal so consumers can show different UX
-   * ("Your access was revoked" vs. "Project was deleted") without having
-   * to inspect error codes themselves.
-   */
-  async _handleRemoteDocAccessRevoked(docId) {
-    const pendingChanges = await this._cleanupAfterAccessLoss(docId);
-    await this.onRemoteDocAccessRevoked.emit(docId, pendingChanges);
-  }
-  /**
-   * Local cleanup shared by `_handleRemoteDocDeleted` and
-   * `_handleRemoteDocAccessRevoked`. Returns pending changes that were
-   * lost so the caller can include them in the application-facing signal.
-   */
-  async _cleanupAfterAccessLoss(docId) {
     const algorithm = this._getAlgorithm(docId);
     const pendingChanges = await algorithm.getPendingToSend(docId) ?? [];
     const doc = this.patches.getOpenDoc(docId);
@@ -613,7 +571,7 @@ class PatchesSync extends (_a = ReadonlyStoreClass, _syncDoc_dec = [serialGate],
     this.trackedDocs.delete(docId);
     this._updateDocSyncState(docId, void 0);
     await algorithm.confirmDeleteDoc(docId);
-    return pendingChanges;
+    await this.onRemoteDocDeleted.emit(docId, pendingChanges);
   }
   /**
    * Adds, updates, or removes a doc state entry immutably and notifies via store.
@@ -676,16 +634,6 @@ class PatchesSync extends (_a = ReadonlyStoreClass, _syncDoc_dec = [serialGate],
   _isDocDeletedError(err) {
     return err instanceof StatusError && err.code === ErrorCodes.DOC_DELETED;
   }
-  /**
-   * Helper to detect ACCESS_REVOKED (403) errors from the server. Used by
-   * the sync/flush catch blocks to short-circuit straight into the
-   * `_handleRemoteDocAccessRevoked` cleanup path rather than latching the
-   * error onto `docStates[docId].syncError` (which would surface as a
-   * permanent "Unable to Sync" pill in the UI).
-   */
-  _isAccessRevokedError(err) {
-    return err instanceof StatusError && err.code === ErrorCodes.ACCESS_REVOKED;
-  }
 }
 _init = __decoratorStart(_a);
 __decorateElement(_init, 1, "syncDoc", _syncDoc_dec, PatchesSync);

package/dist/net/error.d.ts

@@ -5,21 +5,21 @@ declare class StatusError extends Error {
 }
 /**
  * Standard error codes for Patches operations.
+ *
+ * Patches is permission-agnostic; these codes are surfaced verbatim from
+ * `StatusError.code` so consuming apps can branch on the HTTP status without
+ * reaching for string matching. Permission *policy* (what to do with a 403)
+ * lives in the consuming app.
  */
 declare const ErrorCodes: {
     /** Document was deleted (tombstone exists). */
     readonly DOC_DELETED: 410;
     /** Document not found (never existed). */
     readonly DOC_NOT_FOUND: 404;
-    /**
-     * Caller is no longer authorized to read/write the document.
-     * Distinct from DOC_DELETED — the doc still exists, the caller just lost
-     * membership (revoked, or removed from a shared collection). The sync
-     * loop treats it like a soft delete: untrack, drop local cache, emit
-     * `onRemoteDocAccessRevoked` so the application can remove the doc from
-     * its own workspace state.
-     */
-    readonly ACCESS_REVOKED: 403;
+    /** Caller is not authenticated (no/invalid credentials). */
+    readonly DOC_UNAUTHORIZED: 401;
+    /** Caller is authenticated but not authorized for this doc. */
+    readonly DOC_FORBIDDEN: 403;
 };
 /**
  * Error thrown when the JSON-RPC client receives a message that cannot be parsed as JSON.

package/dist/net/error.js

@@ -11,15 +11,10 @@ const ErrorCodes = {
   DOC_DELETED: 410,
   /** Document not found (never existed). */
   DOC_NOT_FOUND: 404,
-  /**
-   * Caller is no longer authorized to read/write the document.
-   * Distinct from DOC_DELETED — the doc still exists, the caller just lost
-   * membership (revoked, or removed from a shared collection). The sync
-   * loop treats it like a soft delete: untrack, drop local cache, emit
-   * `onRemoteDocAccessRevoked` so the application can remove the doc from
-   * its own workspace state.
-   */
-  ACCESS_REVOKED: 403
+  /** Caller is not authenticated (no/invalid credentials). */
+  DOC_UNAUTHORIZED: 401,
+  /** Caller is authenticated but not authorized for this doc. */
+  DOC_FORBIDDEN: 403
 };
 class JSONRPCParseError extends Error {
   rawMessage;

package/dist/net/index.d.ts

@@ -1,4 +1,3 @@
-export { Invite, InviteProjectBookMeta, InviteProjectMetaSnapshot, InviteRole, InviteTo } from './invite.js';
 export { FetchTransport } from './http/FetchTransport.js';
 export { PatchesClient } from './PatchesClient.js';
 export { PatchesConnection } from './PatchesConnection.js';
@@ -25,7 +24,7 @@ import '../algorithms/ot/shared/changeBatching.js';
 import '../client/BranchClientStore.js';
 import '../client/ClientAlgorithm.js';
 import '../json-patch/types.js';
-import '../BaseDoc-rCKMFV6B.js';
+import '../BaseDoc-CXHXcW18.js';
 import '../client/PatchesStore.js';
 import '../client/Patches.js';
 import '../server/types.js';

package/dist/net/index.js

@@ -1,5 +1,4 @@
 import "../chunk-IZ2YBCUP.js";
-export * from "./invite.js";
 export * from "./http/FetchTransport.js";
 export * from "./PatchesClient.js";
 export * from "./PatchesConnection.js";

package/dist/net/protocol/JSONRPCServer.js

@@ -162,7 +162,7 @@ class JSONRPCServer {
     }
     const ok = await this.auth.canAccess(ctx, docId, access, method);
     if (!ok) {
-      throw new StatusError(401, `${access.toUpperCase()}_FORBIDDEN:${docId}`);
+      throw new StatusError(403, `${access.toUpperCase()}_FORBIDDEN:${docId}`);
     }
   }
   /**

package/dist/net/rest/PatchesREST.d.ts

@@ -2,7 +2,6 @@ import * as easy_signal from 'easy-signal';
 import { Change, CommitChangesOptions, PatchesState, ChangeInput, DeleteDocOptions, EditableVersionMetadata, ListVersionsOptions, VersionMetadata, PatchesSnapshot, Branch, CreateBranchMetadata, EditableBranchMetadata } from '../../types.js';
 import { PatchesConnection } from '../PatchesConnection.js';
 import { ConnectionState } from '../protocol/types.js';
-import { Invite } from '../invite.js';
 import '../../json-patch/JSONPatch.js';
 import '@dabble/delta';
 import '../../json-patch/types.js';
@@ -76,28 +75,6 @@ declare class PatchesREST implements PatchesConnection {
     updateBranch(docId: string, branchId: string, metadata: EditableBranchMetadata): Promise<void>;
     deleteBranch(docId: string, branchId: string): Promise<void>;
     mergeBranch(docId: string, branchId: string): Promise<void>;
-    /**
-     * Fetch a single invite addressed to the authenticated user.
-     * `GET /docs/:docId/_invites/:inviteId`
-     */
-    getInvite(docId: string, inviteId: string): Promise<Invite>;
-    /**
-     * Accept or decline an invite. Returns whether the server applied a role
-     * change (`ok` from `{ ok: boolean }`).
-     * `POST /docs/:docId/_invites/:inviteId` body `{ accept: boolean }`
-     */
-    acceptInvite(docId: string, inviteId: string, accept: boolean): Promise<boolean>;
-    /**
-     * Remove the authenticated user from `roles.users` (non-owners only).
-     * `POST /docs/:docId/_self/leave`
-     */
-    leaveProject(docId: string): Promise<boolean>;
-    /**
-     * Owner/co-author revokes another member. `targetUid` is removed from
-     * `roles.users` and tombstoned under `roles.formerUsers.revokedAt`.
-     * `POST /docs/:docId/_members/:uid/revoke`
-     */
-    revokeMember(docId: string, targetUid: string): Promise<boolean>;
     /**
      * POSTs a raw JSON-RPC string to `/signal/:clientId`. Used as the upstream
      * half of the multiplexed signaling channel: receive happens via the `signal`

package/dist/net/rest/PatchesREST.js

@@ -202,52 +202,6 @@ class PatchesREST {
   async mergeBranch(docId, branchId) {
     await this._fetch(`/docs/${docId}/_branches/${encodeURIComponent(branchId)}/_merge`, { method: "POST" });
   }
-  // --- Invites & membership (pup REST) ---
-  /**
-   * Fetch a single invite addressed to the authenticated user.
-   * `GET /docs/:docId/_invites/:inviteId`
-   */
-  async getInvite(docId, inviteId) {
-    return this._fetch(`/docs/${docId}/_invites/${encodeURIComponent(inviteId)}`);
-  }
-  /**
-   * Accept or decline an invite. Returns whether the server applied a role
-   * change (`ok` from `{ ok: boolean }`).
-   * `POST /docs/:docId/_invites/:inviteId` body `{ accept: boolean }`
-   */
-  async acceptInvite(docId, inviteId, accept) {
-    const result = await this._fetch(`/docs/${docId}/_invites/${encodeURIComponent(inviteId)}`, {
-      method: "POST",
-      body: { accept }
-    });
-    return Boolean(result?.ok);
-  }
-  /**
-   * Remove the authenticated user from `roles.users` (non-owners only).
-   * `POST /docs/:docId/_self/leave`
-   */
-  async leaveProject(docId) {
-    const result = await this._fetch(`/docs/${docId}/_self/leave`, {
-      method: "POST",
-      body: {}
-    });
-    return Boolean(result?.ok);
-  }
-  /**
-   * Owner/co-author revokes another member. `targetUid` is removed from
-   * `roles.users` and tombstoned under `roles.formerUsers.revokedAt`.
-   * `POST /docs/:docId/_members/:uid/revoke`
-   */
-  async revokeMember(docId, targetUid) {
-    const result = await this._fetch(
-      `/docs/${docId}/_members/${encodeURIComponent(targetUid)}/revoke`,
-      {
-        method: "POST",
-        body: {}
-      }
-    );
-    return Boolean(result?.ok);
-  }
   // --- WebRTC Signaling ---
   /**
    * POSTs a raw JSON-RPC string to `/signal/:clientId`. Used as the upstream

package/dist/net/rest/PatchesRESTSignalingTransport.d.ts

@@ -7,7 +7,6 @@ import '../../json-patch/JSONPatch.js';
 import '@dabble/delta';
 import '../../json-patch/types.js';
 import '../PatchesConnection.js';
-import '../invite.js';
 
 /**
  * Adapter that exposes a {@link PatchesREST} connection as a {@link SignalingTransport}

package/dist/net/rest/index.d.ts

@@ -10,7 +10,6 @@ import '@dabble/delta';
 import '../../json-patch/types.js';
 import '../PatchesConnection.js';
 import '../protocol/types.js';
-import '../invite.js';
 import '../websocket/AuthorizationProvider.js';
 import '../../server/types.js';
 import '../signaling/SignalingService.js';

package/dist/net/signaling/SignalingService.js

@@ -70,9 +70,10 @@ class SignalingService {
     } catch {
       return false;
     }
-    if (parsed.jsonrpc !== "2.0" || parsed.method !== "peer-signal" || !parsed.params?.to) return false;
-    const { params, id } = parsed;
-    const { to, data } = params;
+    if (parsed.jsonrpc !== "2.0" || parsed.method !== "peer-signal" || !Array.isArray(parsed.params)) return false;
+    const { id } = parsed;
+    const [to, data] = parsed.params;
+    if (typeof to !== "string" || !to) return false;
     const clients = await this.getClients();
     if (!clients.has(to)) {
       this.respondError(fromId, id, "Target not connected");

package/dist/net/webrtc/WebRTCTransport.js

@@ -20,7 +20,7 @@ class WebRTCTransport {
       this.rpc.on("peer-disconnected", ({ id }) => {
         this._removePeer(id);
       }),
-      this.rpc.on("peer-signal", ({ from, data }) => {
+      this.rpc.on("signal", ({ from, data }) => {
         if (!this.peers.has(from)) {
           this._connectToPeer(from, false);
         }
@@ -113,7 +113,7 @@ class WebRTCTransport {
   _connectToPeer(peerId, initiator) {
     const peer = new Peer({ initiator, trickle: false });
     peer.on("signal", (data) => {
-      this.rpc.call("peer-signal", peerId, data);
+      this.rpc.notify("peer-signal", peerId, data);
     });
     peer.on("connect", () => {
       this.peers.set(peerId, { id: peerId, peer, connected: true });

package/dist/server/branchUtils.d.ts

@@ -1,5 +1,5 @@
 import { ApiDefinition } from '../net/protocol/JSONRPCServer.js';
-import { EditableBranchMetadata, Branch, CreateBranchMetadata } from '../types.js';
+import { EditableBranchMetadata, CreateBranchMetadata, Branch } from '../types.js';
 import 'easy-signal';
 import '../net/websocket/AuthorizationProvider.js';
 import './types.js';

package/dist/shared/doc-manager.d.ts

@@ -1,5 +1,5 @@
 import { Patches, OpenDocOptions } from '../client/Patches.js';
-import { P as PatchesDoc } from '../BaseDoc-rCKMFV6B.js';
+import { a as PatchesDoc } from '../BaseDoc-CXHXcW18.js';
 import 'easy-signal';
 import '../json-patch/types.js';
 import '../types.js';

package/dist/solid/context.d.ts

@@ -7,7 +7,7 @@ import '../types.js';
 import '../json-patch/JSONPatch.js';
 import '@dabble/delta';
 import '../client/ClientAlgorithm.js';
-import '../BaseDoc-rCKMFV6B.js';
+import '../BaseDoc-CXHXcW18.js';
 import '../client/PatchesStore.js';
 import '../algorithms/ot/shared/changeBatching.js';
 import '../client/BranchClientStore.js';

package/dist/solid/doc-manager.d.ts

@@ -6,5 +6,5 @@ import '../types.js';
 import '../json-patch/JSONPatch.js';
 import '@dabble/delta';
 import '../client/ClientAlgorithm.js';
-import '../BaseDoc-rCKMFV6B.js';
+import '../BaseDoc-CXHXcW18.js';
 import '../client/PatchesStore.js';

package/dist/solid/index.d.ts

@@ -11,7 +11,7 @@ import '../types.js';
 import '../json-patch/JSONPatch.js';
 import '@dabble/delta';
 import '../client/ClientAlgorithm.js';
-import '../BaseDoc-rCKMFV6B.js';
+import '../BaseDoc-CXHXcW18.js';
 import '../client/PatchesStore.js';
 import '../net/PatchesSync.js';
 import '../algorithms/ot/shared/changeBatching.js';

package/dist/solid/primitives.d.ts

@@ -1,6 +1,6 @@
 import { Accessor } from 'solid-js';
 import { OpenDocOptions } from '../client/Patches.js';
-import { P as PatchesDoc } from '../BaseDoc-rCKMFV6B.js';
+import { a as PatchesDoc } from '../BaseDoc-CXHXcW18.js';
 import { ChangeMutator } from '../types.js';
 import 'easy-signal';
 import '../json-patch/types.js';

package/dist/vue/composables.d.ts

@@ -1,6 +1,6 @@
-import { ShallowRef, Ref, MaybeRef, MaybeRefOrGetter } from 'vue';
+import { ShallowRef, Ref, MaybeRefOrGetter, MaybeRef } from 'vue';
 import { OpenDocOptions } from '../client/Patches.js';
-import { P as PatchesDoc } from '../BaseDoc-rCKMFV6B.js';
+import { a as PatchesDoc } from '../BaseDoc-CXHXcW18.js';
 import { ChangeMutator } from '../types.js';
 import 'easy-signal';
 import '../json-patch/types.js';

package/dist/vue/doc-manager.d.ts

@@ -6,5 +6,5 @@ import '../types.js';
 import '../json-patch/JSONPatch.js';
 import '@dabble/delta';
 import '../client/ClientAlgorithm.js';
-import '../BaseDoc-rCKMFV6B.js';
+import '../BaseDoc-CXHXcW18.js';
 import '../client/PatchesStore.js';

package/dist/vue/index.d.ts

@@ -11,7 +11,7 @@ import '../types.js';
 import '../json-patch/JSONPatch.js';
 import '@dabble/delta';
 import '../client/ClientAlgorithm.js';
-import '../BaseDoc-rCKMFV6B.js';
+import '../BaseDoc-CXHXcW18.js';
 import '../client/PatchesStore.js';
 import '../net/PatchesSync.js';
 import '../algorithms/ot/shared/changeBatching.js';

package/dist/vue/managed-docs.d.ts

@@ -1,4 +1,4 @@
-import { ShallowRef, Ref } from 'vue';
+import { Ref, ShallowRef } from 'vue';
 import { OpenDocOptions } from '../client/Patches.js';
 import 'easy-signal';
 import '../json-patch/types.js';
@@ -6,7 +6,7 @@ import '../types.js';
 import '../json-patch/JSONPatch.js';
 import '@dabble/delta';
 import '../client/ClientAlgorithm.js';
-import '../BaseDoc-rCKMFV6B.js';
+import '../BaseDoc-CXHXcW18.js';
 import '../client/PatchesStore.js';
 
 /**

package/dist/vue/provider.d.ts

@@ -7,7 +7,7 @@ import '../types.js';
 import '../json-patch/JSONPatch.js';
 import '@dabble/delta';
 import '../client/ClientAlgorithm.js';
-import '../BaseDoc-rCKMFV6B.js';
+import '../BaseDoc-CXHXcW18.js';
 import '../client/PatchesStore.js';
 import '../algorithms/ot/shared/changeBatching.js';
 import '../client/BranchClientStore.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dabble/patches",
-  "version": "0.9.2",
+  "version": "0.9.6",
   "description": "Immutable JSON Patch implementation based on RFC 6902 supporting operational transformation and last-writer-wins",
   "author": "Jacob Wright <jacwright@gmail.com>",
   "bugs": {

package/dist/net/invite.d.ts

@@ -1,55 +0,0 @@
-/**
- * Shapes returned by pup's invite endpoints (`GET /docs/:docId/_invites/:inviteId`)
- * and embedded in roles documents. Kept in sync with pup's `Invite` / `UserAccess`
- * surface so clients deserialize with correct field names.
- */
-type InviteRole = 'owner' | 'write' | 'edit' | 'comment' | 'view';
-/** Invite addressee payload (`invite.to`). */
-interface InviteTo {
-    role: InviteRole;
-    private?: boolean;
-    doc?: string;
-    /** Optional client-side id echoed from legacy creation paths; stripped on accept server-side. */
-    id?: string;
-    name?: string;
-    email: string;
-}
-/**
- * Minimal book-row shape stored on invites for dashboard-style previews.
- * Mirrors writer `NovelBookMeta` / pup-embedded JSON (extra keys are ignored).
- */
-interface InviteProjectBookMeta {
-    id?: string;
-    title?: string;
-    subtitle?: string;
-    author?: string;
-    coverArt?: string;
-    coverArtRatio?: unknown;
-    pattern?: number;
-    backgroundColor?: unknown;
-}
-/** Novel project meta snapshot on an invite (writer `InviteProjectMetaSnapshot`). */
-interface InviteProjectMetaSnapshot {
-    title?: string;
-    modifiedAt?: string;
-    books: InviteProjectBookMeta[];
-    isTemplate?: boolean;
-    templateCount?: number;
-    type?: string;
-}
-interface Invite {
-    from: string;
-    to: InviteTo;
-    createdAt: number;
-    expiresAt: number;
-    /** Cached project title at invite creation (writer/pup roles doc). */
-    projectName?: string;
-    /** @deprecated Prefer `projectMetaSnapshot.books`. */
-    projectBooks?: InviteProjectBookMeta[];
-    /** @deprecated Prefer `projectMetaSnapshot.modifiedAt`. */
-    projectModifiedAt?: string;
-    /** Full project meta snapshot for accept-modal preview. */
-    projectMetaSnapshot?: InviteProjectMetaSnapshot;
-}
-
-export type { Invite, InviteProjectBookMeta, InviteProjectMetaSnapshot, InviteRole, InviteTo };