@vielzeug/codex 26.10.2 → 26.10.4

package/data/packages/tandem.json

@@ -1,9 +1,9 @@
 {
-  "apiSource": "// Public root surface of @vielzeug/tandem. Every public export goes through this file.\nexport { createSync } from './tandem';\nexport type {\n  SyncDeletion,\n  SyncEnvelope,\n  SyncGateway,\n  SyncHandle,\n  SyncOptions,\n  SyncPort,\n  SyncPullResult,\n  SyncRecordBase,\n  SyncState,\n  TandemEvent,\n} from './types';\n",
+  "apiSource": "// Public root surface of @vielzeug/tandem. Every public export goes through this file.\n\nexport { TandemDisposedError, TandemError } from './errors';\nexport { createSync } from './tandem';\nexport type {\n  SyncDeletion,\n  SyncEnvelope,\n  SyncGateway,\n  SyncHandle,\n  SyncOptions,\n  SyncPort,\n  SyncPullResult,\n  SyncRecordBase,\n  SyncState,\n  TandemEvent,\n} from './types';\n",
   "docs": {
-    "index": "---\ntitle: 'Tandem: Offline-first sync engine'\ndescription: Offline-first sync engine with rev baselines, tombstoned deletions, and idle-batched pushes for browser applications.\npackage: tandem\ncategory: sync\nkeywords: [sync, offline, conflict, tombstone, rev, replication, last-write-wins]\nrelated: [vault, postmaster, sentinel, ripple]\nexports: [createSync, SyncPort, SyncGateway, SyncHandle, TandemEvent]\nenvironments: [browser, node]\n---\n\n<!-- markdownlint-disable MD025 MD033 MD060 -->\n\n<PackageHero package=\"tandem\" />\n\n## Why Tandem?\n\nA local-first app keeps its records in IndexedDB but must still reach a server: batch bursts of edits into one upload, propagate deletions that a plain pull would resurrect, and reconcile two devices that edited the same record while offline. Tandem drives that round trip against any backend, tracking a per-record write counter so a push carries only what actually changed.\n\n```ts\n// Before\n// Hand-rolled: debounce each save, POST the whole table, hope deletions survive.\nlet timer;\nfunction onSave(record) {\n  clearTimeout(timer);\n  timer = setTimeout(() => fetch('/sync', { method: 'POST', body: JSON.stringify(allRecords()) }), 3000);\n}\n\n// After\nimport { createSync } from '@vielzeug/tandem';\n\nconst sync = createSync({ gateway, port, idleDelayMs: 3000 });\nsync.changed(); // a local edit happened: the engine batches and pushes dirty records\n```\n\n| Feature                              | Tandem                                     | RxSync              | PowerSync            |\n| ------------------------------------ | ------------------------------------------ | ------------------- | -------------------- |\n| Bundle size                          | <PackageInfo package=\"tandem\" type=\"size\" /> | <ore-icon name=\"x\" size=\"16\" /> | <ore-icon name=\"x\" size=\"16\" /> |\n| Zero runtime dependencies            | <ore-icon name=\"check\" size=\"16\" />        | <ore-icon name=\"x\" size=\"16\" /> | <ore-icon name=\"x\" size=\"16\" /> |\n| Backend-agnostic (bring your `port`) | <ore-icon name=\"check\" size=\"16\" />        | <ore-icon name=\"x\" size=\"16\" /> | <ore-icon name=\"x\" size=\"16\" /> |\n| Storage-agnostic (bring your `gateway`) | <ore-icon name=\"check\" size=\"16\" />     | <ore-icon name=\"x\" size=\"16\" /> | <ore-icon name=\"check\" size=\"16\" /> |\n| Tombstoned deletions + rev conflicts | <ore-icon name=\"check\" size=\"16\" />        | <ore-icon name=\"check\" size=\"16\" /> | <ore-icon name=\"check\" size=\"16\" /> |\n\n<div class=\"decision-callout\">\n\n**Use `tandem` when** you already own a local store and a backend and want the sync scheduler: dirty tracking, batching, hide-flows, and conflict reconcile: without adopting a database or a server.\n\n**Consider `PowerSync` when** you want a managed sync service with its own SQLite client and server component rather than a scheduler over your existing storage.\n\n</div>\n\n## Installation\n\n::: code-group\n\n```sh [pnpm]\npnpm add @vielzeug/tandem\n```\n\n```sh [npm]\nnpm install @vielzeug/tandem\n```\n\n```sh [yarn]\nyarn add @vielzeug/tandem\n```\n\n:::\n\n## Quick Start\n\nImplement the two seams: a `SyncPort` for the server and a `SyncGateway` for local storage: then start the scheduler. Records are opaque to Tandem; it reads only `id` and `rev`, and every rev comparison is the engine's: the gateway upserts, validates, and tombstones.\n\n```ts\nimport { createSync, type SyncGateway, type SyncPort } from '@vielzeug/tandem';\n\nconst port: SyncPort = {\n  pull: (since) => fetch(`/sync?since=${since ?? ''}`).then((r) => r.json()),\n  push: async (records, deletions) => {\n    const response = await fetch('/sync', { method: 'POST', body: JSON.stringify({ records, deletions }) });\n    if (!response.ok) throw new Error(await response.text()); // divergence → the engine pulls to reconcile\n  },\n};\n\nconst gateway: SyncGateway = {\n  records: () => localRecords.map((record) => ({ entity: 'docs', record })),\n  pendingDeletions: () => readTombstones(),\n  applyRecords: (pulled) => upsert(pulled), // the engine pre-filters; you validate untrusted records\n  applyDeletions: (deletions) => removeLocal(deletions),\n  clearDeletions: (deletions) => dropTombstones(deletions),\n  loadState: () => readSyncState(),\n  saveState: (state) => writeSyncState(state),\n};\n\nconst sync = createSync({ gateway, port });\nsync.tap((event) => console.debug('sync', event)); // observe pushes, pulls, warnings\nmyStore.subscribe(() => sync.changed()); // a local write happened\n\n// On account switch or teardown: after flushing this account's work:\nawait sync.flush();\nsync.dispose();\n```\n\n## Features\n\n<div class=\"features-grid\">\n\n- **`createSync()`**: drives a port against a gateway with a serialized push queue.\n- **`SyncPort`**: the server seam: `pull(since)` and `push(records, deletions)`.\n- **`SyncGateway`**: the storage seam: upserts, tombstones, and the persisted baseline: the engine owns every rev comparison.\n- **`rev` baselines**: a record is dirty exactly when its rev is above the last-synced one, across reloads.\n- **`changed()`**: wire it to your write path; the engine debounces a burst into one push.\n- **`flush()`**: a full cycle on demand: pull remote changes, then push dirty records; rejects on failure.\n- **Hide-flows**: flushes with `keepalive` on `pagehide`/`hidden`, runs a full cycle on return to the foreground.\n- **`tap()`**: typed `TandemEvent`s for pushes, pulls, invalid records, and warnings.\n- **Lifecycle-owned**: `dispose()`, `disposed`, `disposalSignal`, and `[Symbol.dispose]`.\n\n</div>\n\n## Documentation\n\n<div class=\"doc-links\">\n\n- [Usage Guide](./usage.md)\n- [API Reference](./api.md)\n- [Examples](./examples.md)\n\n</div>\n\n## See Also\n\n<div class=\"see-also\">\n\n- [Vault](/vault/): the typed storage core most gateways wrap; its IndexedDB adapter is a natural `records()`/`applyRecords()` backend.\n- [Postmaster](/postmaster/): the durable outbox half of offline sync; pair it with Tandem for at-least-once mutations alongside state sync.\n- [Sentinel](/sentinel/): subscribable browser state; its network signal can gate when you call `flush()`.\n- [Ripple](/ripple/): signals and effects; `store.subscribe(() => sync.changed())` is the usual wiring.\n\n</div>\n\n<!-- markdownlint-enable MD025 MD033 MD060 -->\n",
-    "api": "---\ntitle: 'Tandem: API Reference'\ndescription: Factory, port and gateway contracts, events, and types for Tandem.\n---\n\n[[toc]]\n\n## API Overview\n\n| Symbol | Purpose | Execution mode | Common gotcha |\n| --- | --- | --- | --- |\n| `createSync()` | Scheduler driving a port against a gateway | Sync (queues async work) | Boot runs pull-then-push; dispose before switching accounts |\n\n## Package Entry Point\n\n| Import | Purpose |\n| --- | --- |\n| `@vielzeug/tandem` | `createSync`, port/gateway contracts, events, and types |\n\n## Factories\n\n### `createSync()`\n\n```ts\nfunction createSync<TRecord extends SyncRecordBase = SyncRecordBase>(\n  options: SyncOptions<TRecord>,\n): SyncHandle;\n```\n\nStarts a sync scheduler: it loads the persisted baseline, pulls remote changes, pushes anything dirty, then flushes on `changed()`, on tab hide, and on foreground return.\n\n| Parameter | Type | Description |\n| --- | --- | --- |\n| `options.gateway` | `SyncGateway<TRecord>` | The device's storage seam |\n| `options.idleDelayMs` | `number \\| undefined` | Quiet period before a flush (default `3000`) |\n| `options.port` | `SyncPort<TRecord>` | The server seam |\n\n**Returns** a `SyncHandle`. Ambient flushes never reject: they surface failures as `warning` events through `tap()`. An explicit `flush()` rejects when its cycle fails.\n\n**Example**\n\n```ts\nimport { createSync } from '@vielzeug/tandem';\n\nconst sync = createSync({ gateway, idleDelayMs: 1500, port });\nsync.changed();\nawait sync.flush();\nsync.dispose();\n```\n\n#### `SyncHandle` methods\n\n| Member | Description |\n| --- | --- |\n| `changed()` | Notes a local change and (re)starts the idle flush timer |\n| `dispose()` | Stops the scheduler, clears the timer, removes document/window listeners |\n| `disposed` | `true` once disposed |\n| `disposalSignal` | `AbortSignal` aborted on dispose |\n| `flush()` | Runs a full cycle: pull, then push; resolves when it completes, rejects when it fails, and is a no-op after `dispose` |\n| `tap(handler, options?)` | Observes `TandemEvent`s; returns an unsubscribe function |\n| `[Symbol.dispose]()` | Calls `dispose()` for `using` scopes |\n\n## Contracts\n\n### `SyncPort`\n\nThe server seam. `pull(since)` returns remote records, remote deletions, and the next cursor. `push(records, deletions, options)` sends local changes; reject it when the server diverged so the engine pulls to reconcile. `options.keepalive` marks a flush that must survive the tab closing.\n\n### `SyncGateway`\n\nThe storage seam. The engine owns every rev comparison: it calls your gateway with the decisions already made.\n\n| Member | Contract |\n| --- | --- |\n| `records()` | This device's own records, remote mirrors excluded |\n| `pendingDeletions()` | Tombstones the server has not acknowledged |\n| `applyRecords(records)` | Upsert the given records: already filtered to what the server is ahead on; return the ids that failed validation |\n| `applyDeletions(deletions)` | Remove records deleted remotely |\n| `clearDeletions(deletions)` | Drop the given tombstones a successful push carried |\n| `loadState()` | The persisted `SyncState`, or `null` on a fresh device |\n| `saveState(state)` | Persist the baseline after a completed pull or push |\n\n## Events\n\n### `TandemEvent`\n\n```ts\ntype TandemEvent =\n  | { readonly records: number; readonly type: 'pull' }\n  | { readonly records: number; readonly type: 'push' }\n  | { readonly message: string; readonly skipped: readonly string[]; readonly type: 'invalid' }\n  | { readonly message: string; readonly type: 'warning' }\n  | { readonly type: 'dispose' };\n```\n\n`invalid` reports record ids `applyRecords` refused; `warning` reports a rejected push or transport failure; `pull` and `push` report the record counts applied and pushed. `dispose` fires once, before tappers are cleared.\n\n## Types\n\n### `SyncRecordBase`\n\n```ts\ninterface SyncRecordBase {\n  readonly id: string;\n  readonly rev: number;\n}\n```\n\nThe only shape Tandem reads from a record: identity and a write counter. `rev` is required: the dirty model is a rev comparison, so every synced record carries one from birth.\n\n### `SyncEnvelope`\n\n```ts\ninterface SyncEnvelope<TRecord extends SyncRecordBase = SyncRecordBase> {\n  readonly entity: string;\n  readonly record: TRecord;\n}\n```\n\nA record paired with the entity (table or kind) it belongs to.\n\n### `SyncDeletion`\n\n```ts\ninterface SyncDeletion {\n  readonly deletedAt: string;\n  readonly entity: string;\n  readonly id: string;\n}\n```\n\nA tombstone: a deletion that travels to the server on the next push.\n\n### `SyncState`\n\n```ts\ninterface SyncState {\n  cursor: string | null;\n  revs: Record<string, number>;\n}\n```\n\nThe persisted baseline. `revs` maps `\"${entity}:${id}\"` to the newest rev the server has seen.\n\n### `SyncPullResult`\n\n```ts\ninterface SyncPullResult<TRecord extends SyncRecordBase = SyncRecordBase> {\n  readonly cursor: string | null;\n  readonly deletions: readonly SyncDeletion[];\n  readonly records: readonly SyncEnvelope<TRecord>[];\n}\n```\n\n### `SyncOptions`\n\n```ts\ninterface SyncOptions<TRecord extends SyncRecordBase = SyncRecordBase> {\n  gateway: SyncGateway<TRecord>;\n  idleDelayMs?: number;\n  port: SyncPort<TRecord>;\n}\n```\n\n## Errors\n\nTandem defines no error classes. A rejected `push` is expected input, not a failure: the engine pulls to reconcile and reports it as a `warning` event. `flush()` additionally rejects with the underlying port or gateway error; dirty records survive the failure and retry on the next cycle.\n",
-    "usage": "---\ntitle: 'Tandem: Usage Guide'\ndescription: 'How to drive offline sync with @vielzeug/tandem: ports, gateways, rev baselines, tombstones, and reconciliation.'\n---\n\n[[toc]]\n\n## Basic Usage\n\nTandem sits between your storage and your server. You implement two interfaces and call `createSync`; the engine handles batching, dirty tracking, hide-flows, and conflict reconcile.\n\n```ts\nimport { createSync, type SyncGateway, type SyncPort } from '@vielzeug/tandem';\n\ninterface Doc {\n  id: string;\n  rev: number;\n  title: string;\n}\n\nconst port: SyncPort<Doc> = {\n  async pull(since) {\n    return fetch(`/sync/pull?since=${since ?? ''}`).then((response) => response.json());\n  },\n  async push(records, deletions, options) {\n    const response = await fetch('/sync/push', {\n      body: JSON.stringify({ records, deletions }),\n      headers: { 'Content-Type': 'application/json' },\n      keepalive: options?.keepalive,\n      method: 'POST',\n    });\n    if (!response.ok) throw new Error(`server diverged: ${await response.text()}`);\n  },\n};\n\nconst gateway: SyncGateway<Doc> = {\n  records: () => docs.map((record) => ({ entity: 'docs', record })),\n  pendingDeletions: () => readTombstones(),\n  async applyRecords(pulled) {\n    // The engine already filtered these to records the server is ahead on;\n    // validate the untrusted remotes and upsert the rest.\n    const skipped: string[] = [];\n    for (const { record } of pulled) {\n      if (!isValid(record)) skipped.push(record.id);\n      else upsert(record);\n    }\n    return skipped;\n  },\n  applyDeletions: (deletions) => Promise.all(deletions.map((d) => remove(d.id))),\n  clearDeletions: (deletions) => Promise.all(deletions.map((d) => dropTombstone(d.id))),\n  loadState: () => readRow('syncState'),\n  saveState: (state) => writeRow('syncState', state),\n};\n\nconst sync = createSync<Doc>({ gateway, port });\n```\n\n## Track Dirty Records with Revs\n\nTandem never diffs record contents. Each record carries a `rev` counting its committed writes, and the gateway persists a baseline of the newest rev the server has seen. A record is dirty exactly when its current rev is above that baseline.\n\n```ts\n// Your write path bumps the rev on every committed change.\nfunction saveDoc(id: string, patch: Partial<Doc>): void {\n  const current = docs.find((doc) => doc.id === id)!;\n  upsert({ ...current, ...patch, rev: current.rev + 1 });\n  sync.changed(); // schedule a flush\n}\n```\n\nBecause the baseline is persisted, dirtiness survives a reload: a record edited while offline is still above the baseline when the app restarts, and the boot sequence pushes it. The engine never asks your gateway to compare revs: ahead, dirty, and deletion precedence are all its decisions.\n\n## Propagate Deletions with Tombstones\n\nA plain pull cannot carry a deletion: the record is gone. Record a tombstone when you delete locally; Tandem pushes it and clears it only once the server acknowledges.\n\n```ts\nfunction deleteDoc(id: string): void {\n  remove(id);\n  writeTombstone({ deletedAt: new Date().toISOString(), entity: 'docs', id });\n  sync.changed();\n}\n```\n\nA remote deletion loses to a local record with unpushed changes: if your local rev is above the baseline, Tandem keeps your edit and pushes it instead of applying the deletion. The guard runs both ways: a pulled record whose id is locally tombstoned, or deleted in the same pull, never applies, so a backend without an incremental cursor cannot resurrect your deletions.\n\n## Batch Changes and Flush\n\nCall `changed()` on every local write. The engine debounces a burst into one push after `idleDelayMs` (default 3000), and serializes pushes so two never overlap.\n\n```ts\nconst sync = createSync({ gateway, idleDelayMs: 1500, port });\n\n// Force a full cycle now: on a save button, or before navigating away.\ntry {\n  await sync.flush();\n} catch {\n  // the cycle failed: edits stay local and dirty; the next cycle retries them\n}\n```\n\n`flush()` pulls remote changes and then pushes dirty records, so it is also the wiring point for a returning network connection. It rejects when either half fails; the records stay dirty and the next cycle retries them. A `flush()` after `dispose()` resolves as a no-op.\n\nTandem also flushes on its own: it pushes with `keepalive: true` when the tab hides or closes, and runs a full cycle when the tab returns to the foreground. Serve the keepalive push with `navigator.sendBeacon` or a `keepalive` fetch so it survives the tab closing.\n\n## Reconcile a Rejected Push\n\nWhen the server is ahead of the lineage you pushed, reject the push. Tandem immediately pulls to reconcile, then the next flush retries with the merged state. Ambient flushes (debounce, hide) report the failure as a `warning` event; `flush()` additionally rejects with the port's error.\n\n```ts\nasync push(records, deletions) {\n  const response = await fetch('/sync/push', { body: JSON.stringify({ records, deletions }), method: 'POST' });\n  if (response.status === 409) throw new Error('server ahead'); // triggers a reconcile pull\n}\n```\n\n## Observe with tap()\n\n`tap()` is the observation seam: pushes, pulls, refused records, and warnings. Handler errors are swallowed, so an observer never breaks sync.\n\n```ts\nconst unsubscribe = sync.tap((event) => {\n  switch (event.type) {\n    case 'push':\n    case 'pull':\n      console.debug(`sync ${event.type}: ${event.records} records`);\n      break;\n    case 'invalid':\n      console.warn(event.message, event.skipped);\n      break;\n    case 'warning':\n      console.warn(event.message); // push rejected, network failure, etc.\n      break;\n  }\n});\n```\n\n## Lifecycle and Disposal\n\nDispose before switching accounts: the baseline is per-account state and a running scheduler would push into the wrong port.\n\n```ts\nconst sync = createSync({ gateway, port });\n// ...\nsync.dispose(); // stops the scheduler, clears the timer, removes document/window listeners\n```\n\n`disposed` and `disposalSignal` report the state; `[Symbol.dispose]` lets you scope it with `using`.\n\n```ts\n{\n  using sync = createSync({ gateway, port });\n  sync.changed();\n} // disposed here\n```\n\n## Testing\n\nDrive the engine against in-memory doubles. A `SyncPort` double records pushes and returns scripted pulls; a `SyncGateway` double is a record array plus a tombstone list plus a state row.\n\n```ts\nimport { createSync } from '@vielzeug/tandem';\n\nconst pushes: unknown[][] = [];\nconst port: SyncPort = {\n  pull: async () => ({ cursor: null, deletions: [], records: [] }),\n  push: async (records, deletions) => void pushes.push([records, deletions]),\n};\n\nconst sync = createSync({ gateway: fakeGateway, idleDelayMs: 10, port });\nawait vi.waitFor(() => expect(pushes.length).toBe(1)); // startup push\nsync.dispose();\n```\n\n## Framework Integration\n\nTandem is framework-neutral. Wire `changed()` to your reactive layer and `dispose()` to the component or scope lifecycle.\n\n::: code-group\n\n```ts [Vue 3]\nimport { onScopeDispose, watch } from 'vue';\n\nconst sync = createSync({ gateway, port });\nwatch(store.records, () => sync.changed(), { deep: true });\nonScopeDispose(() => sync.dispose());\n```\n\n```tsx [React]\nimport { useEffect, useRef } from 'react';\n\nconst syncRef = useRef(createSync({ gateway, port }));\nuseEffect(() => {\n  const sync = syncRef.current;\n  return () => sync.dispose();\n}, []);\n```\n\n```svelte [Svelte]\n<script lang=\"ts\">\n  import { onDestroy } from 'svelte';\n  const sync = createSync({ gateway, port });\n  $effect(() => { $records; sync.changed(); });\n  onDestroy(() => sync.dispose());\n</script>\n```\n\n:::\n\n## Working with Other Vielzeug Libraries\n\n- **Vault**: the usual `gateway` backend. Its IndexedDB adapter stores records and the sync-state row; `records()` reads the in-memory mirror, `applyRecords()` writes through the codec.\n- **Postmaster**: complementary, not overlapping. Postmaster guarantees at-least-once delivery of discrete mutations; Tandem keeps whole-record state in step. Apps that need both run them side by side.\n- **Sentinel**: subscribe to `createNetwork()` and call `sync.flush()` when the connection returns; the cycle pulls and pushes, so remote changes land without waiting for the next foreground return.\n- **Ripple**: `store.subscribe(() => sync.changed())` is the idiomatic wiring for a signal-backed store.\n\n## Best Practices\n\n- Bump `rev` on every committed write: the whole dirty model depends on it.\n- Validate remote records in `applyRecords()` and return the ids you refuse; never trust a pulled record.\n- Keep `records()` free of remote session mirrors: it must return only this device's own records.\n- Dispose on account switch; a stale scheduler pushes into the wrong port.\n- Serve `keepalive` pushes with `sendBeacon` or a `keepalive` fetch so they survive tab close.\n- Reject a push on divergence instead of silently overwriting; let the reconcile pull merge.\n- Persist the sync-state row per account, alongside the records it describes.\n- Call `flush()` before actions that assume both sides are current, such as a share or export, and handle its rejection.\n",
+    "index": "---\ntitle: 'Tandem: Offline-first sync engine'\ndescription: Offline-first sync engine with rev baselines, tombstoned deletions, and idle-batched pushes for browser applications.\npackage: tandem\ncategory: sync\nkeywords: [sync, offline, conflict, tombstone, rev, replication, last-write-wins]\nrelated: [vault, postmaster, sentinel, ripple]\nexports: [createSync, SyncPort, SyncGateway, SyncHandle, TandemEvent, TandemError, TandemDisposedError]\nenvironments: [browser, node]\n---\n\n<!-- markdownlint-disable MD025 MD033 MD060 -->\n\n<PackageHero package=\"tandem\" />\n\n## Why Tandem?\n\nA local-first app keeps its records in IndexedDB but must still reach a server: batch bursts of edits into one upload, propagate deletions that a plain pull would resurrect, and reconcile two devices that edited the same record while offline. Tandem drives that round trip against any backend, tracking a per-record write counter so a push carries only what actually changed.\n\n```ts\n// Before\n// Hand-rolled: debounce each save, POST the whole table, hope deletions survive.\nlet timer;\nfunction onSave(record) {\n  clearTimeout(timer);\n  timer = setTimeout(() => fetch('/sync', { method: 'POST', body: JSON.stringify(allRecords()) }), 3000);\n}\n\n// After\nimport { createSync } from '@vielzeug/tandem';\n\nconst sync = createSync({ gateway, port, idleDelayMs: 3000 });\nsync.changed(); // a local edit happened: the engine batches and pushes dirty records\n```\n\n| Feature                              | Tandem                                     | RxSync              | PowerSync            |\n| ------------------------------------ | ------------------------------------------ | ------------------- | -------------------- |\n| Bundle size                          | <PackageInfo package=\"tandem\" type=\"size\" /> | <ore-icon name=\"x\" size=\"16\" /> | <ore-icon name=\"x\" size=\"16\" /> |\n| Zero runtime dependencies            | <ore-icon name=\"check\" size=\"16\" />        | <ore-icon name=\"x\" size=\"16\" /> | <ore-icon name=\"x\" size=\"16\" /> |\n| Backend-agnostic (bring your `port`) | <ore-icon name=\"check\" size=\"16\" />        | <ore-icon name=\"x\" size=\"16\" /> | <ore-icon name=\"x\" size=\"16\" /> |\n| Storage-agnostic (bring your `gateway`) | <ore-icon name=\"check\" size=\"16\" />     | <ore-icon name=\"x\" size=\"16\" /> | <ore-icon name=\"check\" size=\"16\" /> |\n| Tombstoned deletions + rev conflicts | <ore-icon name=\"check\" size=\"16\" />        | <ore-icon name=\"check\" size=\"16\" /> | <ore-icon name=\"check\" size=\"16\" /> |\n\n<div class=\"decision-callout\">\n\n**Use `tandem` when** you already own a local store and a backend and want the sync scheduler: dirty tracking, batching, hide-flows, and conflict reconcile: without adopting a database or a server.\n\n**Consider `PowerSync` when** you want a managed sync service with its own SQLite client and server component rather than a scheduler over your existing storage.\n\n</div>\n\n## Installation\n\n::: code-group\n\n```sh [pnpm]\npnpm add @vielzeug/tandem\n```\n\n```sh [npm]\nnpm install @vielzeug/tandem\n```\n\n```sh [yarn]\nyarn add @vielzeug/tandem\n```\n\n:::\n\n## Quick Start\n\nImplement the two seams: a `SyncPort` for the server and a `SyncGateway` for local storage: then start the scheduler. Records are opaque to Tandem; it reads only `id` and `rev`, and every rev comparison is the engine's: the gateway upserts, validates, and tombstones.\n\n```ts\nimport { createSync, type SyncGateway, type SyncPort } from '@vielzeug/tandem';\n\nconst port: SyncPort = {\n  pull: (since) => fetch(`/sync?since=${since ?? ''}`).then((r) => r.json()),\n  push: async (records, deletions) => {\n    const response = await fetch('/sync', { method: 'POST', body: JSON.stringify({ records, deletions }) });\n    if (!response.ok) throw new Error(await response.text()); // divergence → the engine pulls to reconcile\n  },\n};\n\nconst gateway: SyncGateway = {\n  records: () => localRecords.map((record) => ({ entity: 'docs', record })),\n  pendingDeletions: () => readTombstones(),\n  applyRecords: (pulled) => upsert(pulled), // the engine pre-filters; you validate untrusted records\n  applyDeletions: (deletions) => removeLocal(deletions),\n  clearDeletions: (deletions) => dropTombstones(deletions),\n  loadState: () => readSyncState(),\n  saveState: (state) => writeSyncState(state),\n};\n\nconst sync = createSync({ gateway, port });\nsync.tap((event) => console.debug('sync', event)); // observe pushes, pulls, warnings\nmyStore.subscribe(() => sync.changed()); // a local write happened\n\n// On account switch or teardown: after flushing this account's work:\nawait sync.flush();\nsync.dispose();\n```\n\n## Features\n\n<div class=\"features-grid\">\n\n- **`createSync()`**: drives a port against a gateway with a serialized push queue.\n- **`SyncPort`**: the server seam: `pull(since)` and `push(records, deletions)`.\n- **`SyncGateway`**: the storage seam: upserts, tombstones, and the persisted baseline: the engine owns every rev comparison.\n- **`rev` baselines**: a record is dirty exactly when its rev is above the last-synced one, across reloads.\n- **`changed()`**: wire it to your write path; the engine debounces a burst into one push.\n- **`flush()`**: a full cycle on demand: pull remote changes, then push dirty records; rejects on failure.\n- **Hide-flows**: flushes with `keepalive` on `pagehide`/`hidden`, runs a full cycle on return to the foreground.\n- **`tap()`**: typed `TandemEvent`s for pushes, pulls, invalid records, and warnings.\n- **Lifecycle-owned**: `dispose()`, `disposed`, `disposalSignal`, and `[Symbol.dispose]`; post-dispose `changed()`/`flush()` fail with `TandemDisposedError`.\n\n</div>\n\n## Documentation\n\n<div class=\"doc-links\">\n\n- [Usage Guide](./usage.md)\n- [API Reference](./api.md)\n- [Examples](./examples.md)\n\n</div>\n\n## See Also\n\n<div class=\"see-also\">\n\n- [Vault](/vault/): the typed storage core most gateways wrap; its IndexedDB adapter is a natural `records()`/`applyRecords()` backend.\n- [Postmaster](/postmaster/): the durable outbox half of offline sync; pair it with Tandem for at-least-once mutations alongside state sync.\n- [Sentinel](/sentinel/): subscribable browser state; its network signal can gate when you call `flush()`.\n- [Ripple](/ripple/): signals and effects; `store.subscribe(() => sync.changed())` is the usual wiring.\n\n</div>\n\n<!-- markdownlint-enable MD025 MD033 MD060 -->\n",
+    "api": "---\ntitle: 'Tandem: API Reference'\ndescription: Factory, port and gateway contracts, events, and types for Tandem.\n---\n\n[[toc]]\n\n## API Overview\n\n| Symbol | Purpose | Execution mode | Common gotcha |\n| --- | --- | --- | --- |\n| `createSync()` | Scheduler driving a port against a gateway | Sync (queues async work) | Boot runs pull-then-push; dispose before switching accounts |\n\n## Package Entry Point\n\n| Import | Purpose |\n| --- | --- |\n| `@vielzeug/tandem` | `createSync`, `TandemError`, `TandemDisposedError`, port/gateway contracts, events, and types |\n\n## Factories\n\n### `createSync()`\n\n```ts\nfunction createSync<TRecord extends SyncRecordBase = SyncRecordBase>(\n  options: SyncOptions<TRecord>,\n): SyncHandle;\n```\n\nStarts a sync scheduler: it loads the persisted baseline, pulls remote changes, pushes anything dirty, then flushes on `changed()`, on tab hide, and on foreground return.\n\n| Parameter | Type | Description |\n| --- | --- | --- |\n| `options.gateway` | `SyncGateway<TRecord>` | The device's storage seam |\n| `options.idleDelayMs` | `number \\| undefined` | Quiet period before a flush (default `3000`) |\n| `options.port` | `SyncPort<TRecord>` | The server seam |\n\n**Returns** a `SyncHandle`. Ambient flushes never reject: they surface failures as `warning` events through `tap()`. An explicit `flush()` rejects when its cycle fails.\n\n**Example**\n\n```ts\nimport { createSync } from '@vielzeug/tandem';\n\nconst sync = createSync({ gateway, idleDelayMs: 1500, port });\nsync.changed();\nawait sync.flush();\nsync.dispose();\n```\n\n#### `SyncHandle` methods\n\n| Member | Description |\n| --- | --- |\n| `changed()` | Notes a local change and (re)starts the idle flush timer; throws `TandemDisposedError` after `dispose` |\n| `dispose()` | Stops the scheduler, clears the timer, removes document/window listeners |\n| `disposed` | `true` once disposed |\n| `disposalSignal` | `AbortSignal` aborted on dispose |\n| `flush()` | Runs a full cycle: pull, then push; resolves when it completes, rejects when it fails, and rejects with `TandemDisposedError` after `dispose` |\n| `tap(handler, options?)` | Observes `TandemEvent`s; returns an unsubscribe function |\n| `[Symbol.dispose]()` | Calls `dispose()` for `using` scopes |\n\n## Contracts\n\n### `SyncPort`\n\nThe server seam. `pull(since)` returns remote records, remote deletions, and the next cursor. `push(records, deletions, options)` sends local changes; reject it when the server diverged so the engine pulls to reconcile. `options.keepalive` marks a flush that must survive the tab closing.\n\n### `SyncGateway`\n\nThe storage seam. The engine owns every rev comparison: it calls your gateway with the decisions already made.\n\n| Member | Contract |\n| --- | --- |\n| `records()` | This device's own records, remote mirrors excluded; sync or async, so a disk-backed gateway can read from storage instead of holding a mirror |\n| `pendingDeletions()` | Tombstones the server has not acknowledged |\n| `applyRecords(records)` | Upsert the given records: already filtered to what the server is ahead on; return the ids that failed validation |\n| `applyDeletions(deletions)` | Remove records deleted remotely |\n| `clearDeletions(deletions)` | Drop the given tombstones a successful push carried |\n| `loadState()` | The persisted `SyncState`, or `null` on a fresh device |\n| `saveState(state)` | Persist the baseline after a completed pull or push |\n\n## Events\n\n### `TandemEvent`\n\n```ts\ntype TandemEvent =\n  | { readonly records: number; readonly type: 'pull' }\n  | { readonly records: number; readonly type: 'push' }\n  | { readonly message: string; readonly skipped: readonly string[]; readonly type: 'invalid' }\n  | { readonly error: unknown; readonly message: string; readonly type: 'warning' }\n  | { readonly type: 'dispose' };\n```\n\n`invalid` reports record ids `applyRecords` refused; `warning` reports a rejected push or transport failure and carries the original cause in `error` beside its `message`; `pull` and `push` report the record counts applied and pushed. `dispose` fires once, before tappers are cleared.\n\n## Types\n\n### `SyncRecordBase`\n\n```ts\ninterface SyncRecordBase {\n  readonly id: string;\n  readonly rev: number;\n}\n```\n\nThe only shape Tandem reads from a record: identity and a write counter. `rev` is required: the dirty model is a rev comparison, so every synced record carries one from birth.\n\n### `SyncEnvelope`\n\n```ts\ninterface SyncEnvelope<TRecord extends SyncRecordBase = SyncRecordBase> {\n  readonly entity: string;\n  readonly record: TRecord;\n}\n```\n\nA record paired with the entity (table or kind) it belongs to.\n\n### `SyncDeletion`\n\n```ts\ninterface SyncDeletion {\n  readonly deletedAt?: string;\n  readonly entity: string;\n  readonly id: string;\n}\n```\n\nA tombstone: a deletion that travels to the server on the next push. `deletedAt` is set by whoever recorded the deletion and the engine never reads it: include it when your server wants the timestamp, omit it otherwise.\n\n### `SyncState`\n\n```ts\ninterface SyncState {\n  cursor: string | null;\n  revs: Record<string, number>;\n}\n```\n\nThe persisted baseline. `revs` maps `\"${entity}:${id}\"` to the newest rev the server has seen.\n\n### `SyncPullResult`\n\n```ts\ninterface SyncPullResult<TRecord extends SyncRecordBase = SyncRecordBase> {\n  readonly cursor: string | null;\n  readonly deletions: readonly SyncDeletion[];\n  readonly records: readonly SyncEnvelope<TRecord>[];\n}\n```\n\n### `SyncOptions`\n\n```ts\ninterface SyncOptions<TRecord extends SyncRecordBase = SyncRecordBase> {\n  gateway: SyncGateway<TRecord>;\n  idleDelayMs?: number;\n  port: SyncPort<TRecord>;\n}\n```\n\n## Errors\n\n### `TandemError`\n\n```ts\nclass TandemError extends Error {}\n```\n\nBase class for every error Tandem throws; `instanceof TandemError` catches them all in one branch.\n\n### `TandemDisposedError`\n\n```ts\nclass TandemDisposedError extends TandemError {}\n```\n\nThrown by `changed()` and rejected by `flush()` after `dispose()`. A scheduler that stops silently is a sync engine's worst failure: the device keeps editing while nothing uploads, so a leaked handle fails loudly instead.\n\nBeyond disposal, Tandem defines no error classes. A rejected `push` is expected input, not a failure: the engine pulls to reconcile and reports it as a `warning` event. `flush()` additionally rejects with the underlying port or gateway error; dirty records survive the failure and retry on the next cycle.\n",
+    "usage": "---\ntitle: 'Tandem: Usage Guide'\ndescription: 'How to drive offline sync with @vielzeug/tandem: ports, gateways, rev baselines, tombstones, and reconciliation.'\n---\n\n[[toc]]\n\n## Basic Usage\n\nTandem sits between your storage and your server. You implement two interfaces and call `createSync`; the engine handles batching, dirty tracking, hide-flows, and conflict reconcile.\n\n```ts\nimport { createSync, type SyncGateway, type SyncPort } from '@vielzeug/tandem';\n\ninterface Doc {\n  id: string;\n  rev: number;\n  title: string;\n}\n\nconst port: SyncPort<Doc> = {\n  async pull(since) {\n    return fetch(`/sync/pull?since=${since ?? ''}`).then((response) => response.json());\n  },\n  async push(records, deletions, options) {\n    const response = await fetch('/sync/push', {\n      body: JSON.stringify({ records, deletions }),\n      headers: { 'Content-Type': 'application/json' },\n      keepalive: options?.keepalive,\n      method: 'POST',\n    });\n    if (!response.ok) throw new Error(`server diverged: ${await response.text()}`);\n  },\n};\n\nconst gateway: SyncGateway<Doc> = {\n  records: () => docs.map((record) => ({ entity: 'docs', record })),\n  pendingDeletions: () => readTombstones(),\n  async applyRecords(pulled) {\n    // The engine already filtered these to records the server is ahead on;\n    // validate the untrusted remotes and upsert the rest.\n    const skipped: string[] = [];\n    for (const { record } of pulled) {\n      if (!isValid(record)) skipped.push(record.id);\n      else upsert(record);\n    }\n    return skipped;\n  },\n  applyDeletions: (deletions) => Promise.all(deletions.map((d) => remove(d.id))),\n  clearDeletions: (deletions) => Promise.all(deletions.map((d) => dropTombstone(d.id))),\n  loadState: () => readRow('syncState'),\n  saveState: (state) => writeRow('syncState', state),\n};\n\nconst sync = createSync<Doc>({ gateway, port });\n```\n\n## Track Dirty Records with Revs\n\nTandem never diffs record contents. Each record carries a `rev` counting its committed writes, and the gateway persists a baseline of the newest rev the server has seen. A record is dirty exactly when its current rev is above that baseline.\n\n```ts\n// Your write path bumps the rev on every committed change.\nfunction saveDoc(id: string, patch: Partial<Doc>): void {\n  const current = docs.find((doc) => doc.id === id)!;\n  upsert({ ...current, ...patch, rev: current.rev + 1 });\n  sync.changed(); // schedule a flush\n}\n```\n\nBecause the baseline is persisted, dirtiness survives a reload: a record edited while offline is still above the baseline when the app restarts, and the boot sequence pushes it. The engine never asks your gateway to compare revs: ahead, dirty, and deletion precedence are all its decisions.\n\n## Propagate Deletions with Tombstones\n\nA plain pull cannot carry a deletion: the record is gone. Record a tombstone when you delete locally; Tandem pushes it and clears it only once the server acknowledges.\n\n```ts\nfunction deleteDoc(id: string): void {\n  remove(id);\n  writeTombstone({ deletedAt: new Date().toISOString(), entity: 'docs', id });\n  sync.changed();\n}\n```\n\nA remote deletion loses to a local record with unpushed changes: if your local rev is above the baseline, Tandem keeps your edit and pushes it instead of applying the deletion. The guard runs both ways: a pulled record whose id is locally tombstoned, or deleted in the same pull, never applies, so a backend without an incremental cursor cannot resurrect your deletions.\n\n## Batch Changes and Flush\n\nCall `changed()` on every local write. The engine debounces a burst into one push after `idleDelayMs` (default 3000), and serializes pushes so two never overlap.\n\n```ts\nconst sync = createSync({ gateway, idleDelayMs: 1500, port });\n\n// Force a full cycle now: on a save button, or before navigating away.\ntry {\n  await sync.flush();\n} catch {\n  // the cycle failed: edits stay local and dirty; the next cycle retries them\n}\n```\n\n`flush()` pulls remote changes and then pushes dirty records, so it is also the wiring point for a returning network connection. It rejects when either half fails; the records stay dirty and the next cycle retries them. After `dispose()`, `flush()` rejects with `TandemDisposedError` and `changed()` throws it: a leaked scheduler fails loudly instead of silently stopping. If your reactive wiring can fire after disposal, unsubscribe from your store before disposing the handle, or guard with `sync.disposed`.\n\nTandem also flushes on its own: it pushes with `keepalive: true` when the tab hides or closes, and runs a full cycle when the tab returns to the foreground. Serve the keepalive push with `navigator.sendBeacon` or a `keepalive` fetch so it survives the tab closing.\n\n## Reconcile a Rejected Push\n\nWhen the server is ahead of the lineage you pushed, reject the push. Tandem immediately pulls to reconcile, then the next flush retries with the merged state. Ambient flushes (debounce, hide) report the failure as a `warning` event; `flush()` additionally rejects with the port's error.\n\n```ts\nasync push(records, deletions) {\n  const response = await fetch('/sync/push', { body: JSON.stringify({ records, deletions }), method: 'POST' });\n  if (response.status === 409) throw new Error('server ahead'); // triggers a reconcile pull\n}\n```\n\n## Observe with tap()\n\n`tap()` is the observation seam: pushes, pulls, refused records, and warnings. Handler errors are swallowed, so an observer never breaks sync.\n\n```ts\nconst unsubscribe = sync.tap((event) => {\n  switch (event.type) {\n    case 'push':\n    case 'pull':\n      console.debug(`sync ${event.type}: ${event.records} records`);\n      break;\n    case 'invalid':\n      console.warn(event.message, event.skipped);\n      break;\n    case 'warning':\n      console.warn(event.message, event.error); // push rejected, network failure, etc.\n      break;\n  }\n});\n```\n\n## Lifecycle and Disposal\n\nDispose before switching accounts: the baseline is per-account state and a running scheduler would push into the wrong port.\n\n```ts\nconst sync = createSync({ gateway, port });\n// ...\nsync.dispose(); // stops the scheduler, clears the timer, removes document/window listeners\n```\n\n`disposed` and `disposalSignal` report the state; `[Symbol.dispose]` lets you scope it with `using`.\n\n```ts\n{\n  using sync = createSync({ gateway, port });\n  sync.changed();\n} // disposed here\n```\n\n## Testing\n\nDrive the engine against in-memory doubles. A `SyncPort` double records pushes and returns scripted pulls; a `SyncGateway` double is a record array plus a tombstone list plus a state row.\n\n```ts\nimport { createSync } from '@vielzeug/tandem';\n\nconst pushes: unknown[][] = [];\nconst port: SyncPort = {\n  pull: async () => ({ cursor: null, deletions: [], records: [] }),\n  push: async (records, deletions) => void pushes.push([records, deletions]),\n};\n\nconst sync = createSync({ gateway: fakeGateway, idleDelayMs: 10, port });\nawait vi.waitFor(() => expect(pushes.length).toBe(1)); // startup push\nsync.dispose();\n```\n\n## Framework Integration\n\nTandem is framework-neutral. Wire `changed()` to your reactive layer and `dispose()` to the component or scope lifecycle.\n\n::: code-group\n\n```ts [Vue 3]\nimport { onScopeDispose, watch } from 'vue';\n\nconst sync = createSync({ gateway, port });\nwatch(store.records, () => sync.changed(), { deep: true });\nonScopeDispose(() => sync.dispose());\n```\n\n```tsx [React]\nimport { useEffect, useRef } from 'react';\n\nconst syncRef = useRef(createSync({ gateway, port }));\nuseEffect(() => {\n  const sync = syncRef.current;\n  return () => sync.dispose();\n}, []);\n```\n\n```svelte [Svelte]\n<script lang=\"ts\">\n  import { onDestroy } from 'svelte';\n  const sync = createSync({ gateway, port });\n  $effect(() => { $records; sync.changed(); });\n  onDestroy(() => sync.dispose());\n</script>\n```\n\n:::\n\n## Working with Other Vielzeug Libraries\n\n- **Vault**: the usual `gateway` backend. Its IndexedDB adapter stores records and the sync-state row; `records()` reads them from storage (it may be async), `applyRecords()` writes through the codec.\n- **Postmaster**: complementary, not overlapping. Postmaster guarantees at-least-once delivery of discrete mutations; Tandem keeps whole-record state in step. Apps that need both run them side by side.\n- **Sentinel**: subscribe to `createNetwork()` and call `sync.flush()` when the connection returns; the cycle pulls and pushes, so remote changes land without waiting for the next foreground return.\n- **Ripple**: `store.subscribe(() => sync.changed())` is the idiomatic wiring for a signal-backed store.\n\n## Best Practices\n\n- Bump `rev` on every committed write: the whole dirty model depends on it.\n- Validate remote records in `applyRecords()` and return the ids you refuse; never trust a pulled record.\n- Keep `records()` free of remote session mirrors: it must return only this device's own records.\n- Dispose on account switch; a stale scheduler pushes into the wrong port.\n- Serve `keepalive` pushes with `sendBeacon` or a `keepalive` fetch so they survive tab close.\n- Reject a push on divergence instead of silently overwriting; let the reconcile pull merge.\n- Persist the sync-state row per account, alongside the records it describes.\n- Call `flush()` before actions that assume both sides are current, such as a share or export, and handle its rejection.\n",
     "examples": "---\ntitle: 'Tandem: Examples'\ndescription: Offline sync recipes for two-device editing, deletions, and account switching.\n---\n\n## Examples\n\n- [Sync a Vault Store](./examples/sync-a-vault-store.md)\n- [Keep Deletions from Resurrecting](./examples/keep-deletions-from-resurrecting.md)\n- [Switch Accounts Safely](./examples/switch-accounts-safely.md)\n"
   },
   "examples": [
@@ -14,6 +14,8 @@
     }
   ],
   "typeSignatures": {
+    "TandemDisposedError": "export { TandemDisposedError, TandemError } from './errors';",
+    "TandemError": "export { TandemDisposedError, TandemError } from './errors';",
     "createSync": "export { createSync } from './tandem';",
     "SyncDeletion": "export type {\n  SyncDeletion,\n  SyncEnvelope,\n  SyncGateway,\n  SyncHandle,\n  SyncOptions,\n  SyncPort,\n  SyncPullResult,\n  SyncRecordBase,\n  SyncState,\n  TandemEvent,\n} from './types';",
     "SyncEnvelope": "export type {\n  SyncDeletion,\n  SyncEnvelope,\n  SyncGateway,\n  SyncHandle,\n  SyncOptions,\n  SyncPort,\n  SyncPullResult,\n  SyncRecordBase,\n  SyncState,\n  TandemEvent,\n} from './types';",

package/data/packages/tavern.json

@@ -1,23 +1,26 @@
 {
-  "apiSource": "import {\n  createMeshGuest,\n  createMeshHost,\n  type MeshAnswer,\n  type MeshInvitation,\n  MeshPairingError,\n  type MeshPeer,\n  type MeshProtocol,\n  type MeshRtcFactory,\n  meshQrCodec,\n} from '@vielzeug/mesh';\n\nimport { TavernError, TavernPairingError } from './errors';\n\nexport { TavernError, TavernPairingError };\n\n/**\n * Reclassifies a mesh pairing failure as the tavern-level user mistake it is:\n * the code the consumer pasted could not be used. The message is preserved and\n * the original error is chained as `cause`.\n */\nfunction toPairingError(error: unknown): TavernPairingError {\n  const message = error instanceof Error ? error.message : 'That code could not be read.';\n  return new TavernPairingError(message, { cause: error });\n}\n\n/**\n * Table sessions over `@vielzeug/mesh`: one host owns the canonical state of a subject, guests\n * mirror it and forward every command through the host's command table, so guest actions follow\n * exactly the same code path as host actions.\n *\n * The consumer supplies the seams, which commands exist, how subject state is read and mounted,\n * how notices cross between the wire and the local UI. Tavern owns the pairing, the protocol,\n * command validation, snapshot broadcasting, notice relaying, and presence.\n */\n\n/** What the host can do on behalf of a guest. */\nexport interface TavernCommands {\n  /** Applies the command; throwing rejects the guest with the error's message. */\n  apply(name: string, args: readonly unknown[]): unknown;\n  /** Whether a command name is known; unknown names reject without applying. */\n  has(name: string): boolean;\n}\n\n/**\n * How the host reads and watches the subject it is sharing. All three close over whatever\n * subject state the consumer owns: the host routes by `subjectId`, not by a subject object.\n */\nexport interface TavernSubjects {\n  /** Subscribes to local changes of the hosted subject: the re-broadcast trigger. */\n  onChanged(listener: () => void): () => void;\n  /** Subscribes to the hosted subject's removal: hosting ends when it fires. */\n  onRemoved(listener: () => void): () => void;\n  /** Reads the snapshot to broadcast; null while the subject is missing. */\n  snapshot(): unknown;\n}\n\n/**\n * Notice relay between host and guests. Notices cross the wire as opaque values: each client\n * translates locally.\n *\n * **Echo guard**: a tab that both hosts and guests must guard against re-broadcasting a\n * wire-originated notice back to its own guests: `fromWire` emits locally, the host's local\n * subscription picks it up, and without a guard it would loop. The consumer owns this guard\n * because only they know their local event system; one boolean set during `fromWire` and\n * checked in `toWire` is sufficient.\n */\nexport interface TavernNotices {\n  /** Re-emits a received wire notice locally. */\n  fromWire(wire: unknown): void;\n  /** Serializes a local notice for the wire; null skips this one. */\n  toWire(notice: unknown): unknown | null;\n}\n\ninterface WireProtocol extends MeshProtocol {\n  toGuest: {\n    notice: unknown;\n    rejected: { commandId: string; message: string };\n    snapshot: unknown;\n  };\n  toHost: {\n    command: { args: unknown[]; id: string; name: string; subjectId: string };\n  };\n}\n\n/** Snapshots can be large; the default mesh frame cap is too tight for whole documents. */\nconst DEFAULT_MAX_MESSAGE_BYTES = 512 * 1024;\n\nconst commandId = (): string => `cmd-${Math.random().toString(36).slice(2, 10)}${Date.now().toString(36)}`;\n\n/** Runtime guard for the wire command shape: the protocol is Tavern's, so Tavern validates it. */\nfunction parseWireCommand(raw: unknown): { args: unknown[]; id: string; name: string; subjectId: string } | null {\n  if (typeof raw !== 'object' || raw === null) return null;\n  const { args, id, name, subjectId } = raw as Record<string, unknown>;\n  if (typeof id !== 'string' || typeof name !== 'string' || typeof subjectId !== 'string' || !Array.isArray(args)) {\n    return null;\n  }\n  return { args, id, name, subjectId };\n}\n\n// ---------------------------------------------------------------------------\n// Host\n// ---------------------------------------------------------------------------\n\nexport interface TavernHostOptions {\n  commands: TavernCommands;\n  notices?: TavernNotices;\n  /** Hosting ended: the subject was removed or the host was disposed. Fires exactly once. */\n  onEnded?(): void;\n  onPeerJoined?(peer: MeshPeer): void;\n  onPeerLeft?(peer: MeshPeer): void;\n  onPeersChanged?(peers: MeshPeer[]): void;\n  onWarning?(message: string): void;\n  rtc?: MeshRtcFactory;\n  /** The id of the subject being hosted: guest commands targeting anything else reject. */\n  subjectId: string;\n  subjects: TavernSubjects;\n}\n\nexport interface TavernHost {\n  /** Consumes a guest's answer code; resolves with the peer once the channel is open. */\n  acceptAnswerText(text: string): Promise<MeshPeer>;\n  /** Produces a single-use invitation code, QR-compact when the environment allows. */\n  createInvitationText(): Promise<string>;\n  /** `AbortSignal` aborted when hosting ends. */\n  readonly disposalSignal: AbortSignal;\n  /** Stops hosting: closes every channel and detaches all subscriptions. */\n  dispose(): void;\n  /** Whether hosting has ended: the subject was removed or `dispose()` ran. */\n  readonly disposed: boolean;\n  kick(peerId: string): void;\n  /** Relays one local notice to every guest; the serializer decides what crosses. */\n  relayNotice(notice: unknown): void;\n  /** Delegates to `dispose()`. Enables `using` declarations. */\n  [Symbol.dispose](): void;\n}\n\n/**\n * Starts hosting one subject. Every guest command is validated and applied through the\n * command table; local changes re-broadcast the snapshot (coalesced on a microtask); removal\n * ends the session.\n */\nexport function hostTavern(options: TavernHostOptions): TavernHost {\n  const host = createMeshHost<WireProtocol>({\n    maxMessageBytes: DEFAULT_MAX_MESSAGE_BYTES,\n    rtc: options.rtc,\n  });\n  let closed = false;\n  let flushScheduled = false;\n\n  const close = (): void => {\n    if (closed) return;\n    closed = true;\n    for (const off of detach.splice(0)) off();\n    host.dispose();\n    options.onEnded?.();\n  };\n\n  /** Reads the snapshot for a broadcast; a throwing read warns instead of crashing the host. */\n  const readSnapshot = (): unknown => {\n    try {\n      return options.subjects.snapshot();\n    } catch (error) {\n      options.onWarning?.(error instanceof Error ? error.message : 'Reading the snapshot failed.');\n      return null;\n    }\n  };\n\n  /** Coalesces broadcasts on a microtask so bursts of local changes ship one snapshot. */\n  const broadcastSnapshot = (): void => {\n    if (closed || flushScheduled) return;\n    flushScheduled = true;\n    queueMicrotask(() => {\n      flushScheduled = false;\n      if (closed) return;\n      const snapshot = readSnapshot();\n      if (snapshot !== null && snapshot !== undefined) host.broadcast('snapshot', snapshot);\n    });\n  };\n\n  /**\n   * Applies a guest command through the command table: the same table the host's own UI\n   * calls, so an unknown name, a foreign subject id or a rule violation is all the host\n   * can ever reject with.\n   */\n  const handleGuestCommand = (peerId: string, raw: unknown): void => {\n    const command = parseWireCommand(raw);\n    if (!command || !options.commands.has(command.name) || command.subjectId !== options.subjectId) {\n      host.send(peerId, 'rejected', {\n        commandId: command?.id ?? '',\n        message: 'The host rejected an unknown or out-of-session command.',\n      });\n      return;\n    }\n    try {\n      options.commands.apply(command.name, command.args);\n    } catch (error) {\n      host.send(peerId, 'rejected', {\n        commandId: command.id,\n        message: error instanceof Error ? error.message : 'The host could not apply the command.',\n      });\n    }\n  };\n\n  const detach = [\n    host.on('command', ({ peerId, payload }) => handleGuestCommand(peerId, payload)),\n    options.subjects.onChanged(broadcastSnapshot),\n    options.subjects.onRemoved(close),\n    host.tap((event) => {\n      if (event.type === 'peer-joined' || event.type === 'peer-left') {\n        options.onPeersChanged?.([...host.peers.values()]);\n      }\n      if (event.type === 'peer-joined') {\n        const snapshot = readSnapshot();\n        if (snapshot !== null && snapshot !== undefined) host.send(event.peer.id, 'snapshot', snapshot);\n        options.onPeerJoined?.(event.peer);\n      }\n      if (event.type === 'peer-left') options.onPeerLeft?.(event.peer);\n      if (event.type === 'error') options.onWarning?.(event.error.message);\n    }),\n  ];\n\n  return {\n    acceptAnswerText: async (text: string): Promise<MeshPeer> => {\n      let decoded: MeshInvitation | MeshAnswer;\n      try {\n        decoded = await meshQrCodec.decode(text);\n      } catch (error) {\n        throw error instanceof MeshPairingError ? toPairingError(error) : error;\n      }\n      if (!('proof' in decoded)) {\n        throw new TavernPairingError('That code is an invitation, not a guest answer.');\n      }\n      try {\n        return await host.acceptAnswer(decoded);\n      } catch (error) {\n        throw error instanceof MeshPairingError ? toPairingError(error) : error;\n      }\n    },\n    createInvitationText: async () => meshQrCodec.encode(await host.createInvitation()),\n    get disposalSignal() {\n      return host.disposalSignal;\n    },\n    dispose: close,\n    get disposed() {\n      return closed;\n    },\n    kick: (peerId: string): void => {\n      host.kick(peerId);\n    },\n    relayNotice: (notice: unknown): void => {\n      if (closed) return;\n      const wire = options.notices ? options.notices.toWire(notice) : null;\n      if (wire !== null && wire !== undefined) host.broadcast('notice', wire);\n    },\n    [Symbol.dispose]() {\n      close();\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Guest\n// ---------------------------------------------------------------------------\n\nexport interface TavernGuestOptions<Mounted> {\n  /** The invitation code the host produced. */\n  invitationText: string;\n  /**\n   * Mounts a received snapshot; the mounted value, or null to ignore. The snapshot arrives\n   * as parsed JSON: validate before trusting it.\n   */\n  mount(snapshot: unknown): Mounted | null;\n  /** The guest's display name on the channel. */\n  name: string;\n  notices?: TavernNotices;\n  /** The channel ended after joining; the mounted value is passed for unmounting. */\n  onEnded?(subject: Mounted): void;\n  /** The host never accepted the answer in time. */\n  onFailed?(reason: string): void;\n  /** The mounted value once the first snapshot arrives. */\n  onJoined?(subject: Mounted): void;\n  /** The host rejected a forwarded command. */\n  onRejected?(message: string): void;\n  onWarning?(message: string): void;\n  rtc?: MeshRtcFactory;\n}\n\nexport interface TavernGuest {\n  /** `AbortSignal` aborted when the session ends. */\n  readonly disposalSignal: AbortSignal;\n  /** Leaves the session and drops the channel. */\n  dispose(): void;\n  /** Whether the session has ended: the channel dropped or `dispose()` ran. */\n  readonly disposed: boolean;\n  /**\n   * Forwards a command to the host. The subject id is the consumer's routing key: the host\n   * rejects commands that do not name the subject it is hosting.\n   */\n  sendCommand(subjectId: string, name: string, args: readonly unknown[]): void;\n  /** Delegates to `dispose()`. Enables `using` declarations. */\n  [Symbol.dispose](): void;\n}\n\n/**\n * Joins a session as a guest: consumes the host's invitation and returns the answer code to\n * show back. The session goes live once the host accepts the answer and the first snapshot\n * mounts; disposing the guest (or the channel dropping) ends it exactly once.\n */\nexport async function joinTavern<Mounted>(\n  options: TavernGuestOptions<Mounted>,\n): Promise<{ answerText: string; guest: TavernGuest }> {\n  let decoded: MeshInvitation | MeshAnswer;\n  try {\n    decoded = await meshQrCodec.decode(options.invitationText);\n  } catch (error) {\n    throw error instanceof MeshPairingError ? toPairingError(error) : error;\n  }\n  if (!('secret' in decoded)) {\n    throw new TavernPairingError('That code is not a session invitation.');\n  }\n\n  const guest = createMeshGuest<WireProtocol>({\n    maxMessageBytes: DEFAULT_MAX_MESSAGE_BYTES,\n    rtc: options.rtc,\n  });\n  let mounted: Mounted | null = null;\n  let ended = false;\n\n  /** Ends the session exactly once: from the channel dropping or an explicit dispose. */\n  const endSession = (): void => {\n    if (ended) return;\n    ended = true;\n    const subject = mounted;\n    mounted = null;\n    for (const off of detach.splice(0)) off();\n    guest.dispose();\n    if (subject !== null) options.onEnded?.(subject);\n  };\n\n  const detach = [\n    guest.on('snapshot', ({ payload }) => {\n      const subject = options.mount(payload);\n      if (subject === null || ended) return;\n      if (mounted === null) {\n        mounted = subject;\n        options.onJoined?.(subject);\n      }\n    }),\n    guest.on('notice', ({ payload }) => {\n      options.notices?.fromWire(payload);\n    }),\n    guest.on('rejected', ({ payload }) => {\n      options.onRejected?.(payload.message || 'The host rejected the action.');\n    }),\n    guest.tap((event) => {\n      if (event.type !== 'status-change' && event.type !== 'peer-status-change') return;\n      if (event.type === 'peer-status-change' && event.peerId !== guest.host?.id) return;\n      if (event.status === 'failed' && mounted === null && !ended) {\n        options.onFailed?.('The host did not accept the answer in time.');\n      }\n      if (event.status === 'disconnected' || event.status === 'failed') endSession();\n    }),\n    guest.tap((event) => {\n      if (event.type === 'error') options.onWarning?.(event.error.message);\n    }),\n  ];\n\n  try {\n    const answer = await guest.acceptInvitation(decoded, { name: options.name });\n    return {\n      answerText: await meshQrCodec.encode(answer),\n      guest: {\n        get disposalSignal() {\n          return guest.disposalSignal;\n        },\n        dispose: endSession,\n        get disposed() {\n          return ended;\n        },\n        sendCommand: (subjectId: string, name: string, args: readonly unknown[]): void => {\n          if (ended) throw new TavernError('The session has ended.');\n          guest.send('command', { args: [...args], id: commandId(), name, subjectId });\n        },\n        [Symbol.dispose]() {\n          endSession();\n        },\n      },\n    };\n  } catch (error) {\n    // A failed join must not leave the node and its subscriptions behind.\n    endSession();\n    throw error instanceof MeshPairingError ? toPairingError(error) : error;\n  }\n}\n",
+  "apiSource": "import {\n  createMeshGuest,\n  createMeshHost,\n  type MeshAnswer,\n  type MeshInvitation,\n  MeshPairingError,\n  type MeshPeer,\n  type MeshProtocol,\n  type MeshRtcFactory,\n  meshQrCodec,\n} from '@vielzeug/mesh';\n\nimport { createTappers } from './_tappers';\nimport { TavernDisposedError, TavernError, TavernPairingError } from './errors';\n\nexport { TavernDisposedError, TavernError, TavernPairingError };\n\n/**\n * Reclassifies a mesh pairing failure as the tavern-level user mistake it is:\n * the code the consumer pasted could not be used. The message is preserved and\n * the original error is chained as `cause`.\n */\nfunction toPairingError(error: unknown): TavernPairingError {\n  const message = error instanceof Error ? error.message : 'That code could not be read.';\n  return new TavernPairingError(message, { cause: error });\n}\n\n/**\n * Table sessions over `@vielzeug/mesh`: one host owns the canonical state of a subject, guests\n * mirror it and forward every command through the host's command table, so guest actions follow\n * exactly the same code path as host actions.\n *\n * The consumer supplies the seams, which commands exist, how subject state is read and mounted,\n * how notices cross between the wire and the local UI. Tavern owns the pairing, the protocol,\n * command validation, snapshot broadcasting, notice relaying, and presence.\n */\n\n/** What the host can do on behalf of a guest. */\nexport interface TavernCommands {\n  /** Applies the command; throwing rejects the guest with the error's message. */\n  apply(name: string, args: readonly unknown[]): unknown;\n  /** Whether a command name is known; unknown names reject without applying. */\n  has(name: string): boolean;\n}\n\n/**\n * How the host reads and watches the subject it is sharing. All three close over whatever\n * subject state the consumer owns: the host routes by `subjectId`, not by a subject object.\n */\nexport interface TavernSubjects {\n  /** Subscribes to local changes of the hosted subject: the re-broadcast trigger. */\n  onChanged(listener: () => void): () => void;\n  /** Subscribes to the hosted subject's removal: hosting ends when it fires. */\n  onRemoved(listener: () => void): () => void;\n  /** Reads the snapshot to broadcast; null while the subject is missing. */\n  snapshot(): unknown;\n}\n\n/**\n * Notice relay between host and guests. Notices cross the wire as opaque values: each client\n * translates locally.\n *\n * **Echo guard**: a tab that both hosts and guests must guard against re-broadcasting a\n * wire-originated notice back to its own guests: `fromWire` emits locally, the host's local\n * subscription picks it up, and without a guard it would loop. The consumer owns this guard\n * because only they know their local event system; one boolean set during `fromWire` and\n * checked in `toWire` is sufficient.\n */\nexport interface TavernNotices {\n  /** Re-emits a received wire notice locally. */\n  fromWire(wire: unknown): void;\n  /** Serializes a local notice for the wire; null skips this one. */\n  toWire(notice: unknown): unknown | null;\n}\n\ninterface WireProtocol extends MeshProtocol {\n  toGuest: {\n    notice: unknown;\n    rejected: { commandId: string; message: string };\n    snapshot: unknown;\n  };\n  toHost: {\n    command: { args: unknown[]; id: string; name: string; subjectId: string };\n  };\n}\n\n/** Notable host moments reported through {@link TavernHost.tap}. */\nexport type TavernHostEvent =\n  | { readonly peer: MeshPeer; readonly type: 'peer-joined' }\n  | { readonly peer: MeshPeer; readonly reason?: string; readonly type: 'peer-left' }\n  | { readonly error: unknown; readonly message: string; readonly type: 'warning' };\n\n/** Notable guest moments reported through {@link TavernGuest.tap}. */\nexport type TavernGuestEvent =\n  | { readonly commandId: string; readonly message: string; readonly type: 'rejected' }\n  | { readonly error: unknown; readonly message: string; readonly type: 'warning' };\n\n/** Snapshots can be large; the default mesh frame cap is too tight for whole documents. */\nconst DEFAULT_MAX_MESSAGE_BYTES = 512 * 1024;\n\nconst commandId = (): string => `cmd-${Math.random().toString(36).slice(2, 10)}${Date.now().toString(36)}`;\n\n/** Runtime guard for the wire command shape: the protocol is Tavern's, so Tavern validates it. */\nfunction parseWireCommand(raw: unknown): { args: unknown[]; id: string; name: string; subjectId: string } | null {\n  if (typeof raw !== 'object' || raw === null) return null;\n  const { args, id, name, subjectId } = raw as Record<string, unknown>;\n  if (typeof id !== 'string' || typeof name !== 'string' || typeof subjectId !== 'string' || !Array.isArray(args)) {\n    return null;\n  }\n  return { args, id, name, subjectId };\n}\n\n// ---------------------------------------------------------------------------\n// Host\n// ---------------------------------------------------------------------------\n\nexport interface TavernHostOptions {\n  commands: TavernCommands;\n  notices?: TavernNotices;\n  /**\n   * Hosting ended: the subject was removed or the host was disposed. Fires exactly\n   * once. This is a lifecycle transition, not observability: presence, transport\n   * warnings, and the peer list all belong to {@link TavernHost.tap} and\n   * {@link TavernHost.peers}.\n   */\n  onEnded?(): void;\n  rtc?: MeshRtcFactory;\n  /** The id of the subject being hosted: guest commands targeting anything else reject. */\n  subjectId: string;\n  subjects: TavernSubjects;\n}\n\nexport interface TavernHost {\n  /** Consumes a guest's answer code; resolves with the peer once the channel is open. */\n  acceptAnswerText(text: string): Promise<MeshPeer>;\n  /** Produces a single-use invitation code, QR-compact when the environment allows. */\n  createInvitationText(): Promise<string>;\n  /** `AbortSignal` aborted when hosting ends. */\n  readonly disposalSignal: AbortSignal;\n  /** Stops hosting: closes every channel and detaches all subscriptions. */\n  dispose(): void;\n  /** Whether hosting has ended: the subject was removed or `dispose()` ran. */\n  readonly disposed: boolean;\n  kick(peerId: string): void;\n  /** The guests currently connected: read it from a `peer-joined`/`peer-left` tap event. */\n  readonly peers: readonly MeshPeer[];\n  /** Relays one local notice to every guest; the serializer decides what crosses.\n   *  A notice relayed after hosting ended is dropped, not thrown: it is ephemeral\n   *  UI state with no audience left, unlike the control-plane methods, which fail\n   *  with `TavernDisposedError` so a leaked handle surfaces. */\n  relayNotice(notice: unknown): void;\n  /** Subscribes to {@link TavernHostEvent}s. Handler errors are swallowed; the\n   *  subscription detaches when `signal` aborts or hosting ends. */\n  tap(handler: (event: TavernHostEvent) => void, options?: { readonly signal?: AbortSignal }): () => void;\n  /** Delegates to `dispose()`. Enables `using` declarations. */\n  [Symbol.dispose](): void;\n}\n\n/**\n * Starts hosting one subject. Every guest command is validated and applied through the\n * command table; local changes re-broadcast the snapshot (coalesced on a microtask); removal\n * ends the session.\n */\nexport function hostTavern(options: TavernHostOptions): TavernHost {\n  const host = createMeshHost<WireProtocol>({\n    maxMessageBytes: DEFAULT_MAX_MESSAGE_BYTES,\n    rtc: options.rtc,\n  });\n  const tappers = createTappers<TavernHostEvent>();\n  let closed = false;\n  let flushScheduled = false;\n\n  const close = (): void => {\n    if (closed) return;\n    closed = true;\n    for (const off of detach.splice(0)) off();\n    host.dispose();\n    tappers.stop();\n    options.onEnded?.();\n  };\n  const disposedError = (): TavernDisposedError => new TavernDisposedError('This host has stopped.');\n  const warn = (error: unknown): void => {\n    tappers.emit({ error, message: error instanceof Error ? error.message : String(error), type: 'warning' });\n  };\n\n  /** Reads the snapshot for a broadcast; a throwing read warns instead of crashing the host. */\n  const readSnapshot = (): unknown => {\n    try {\n      return options.subjects.snapshot();\n    } catch (error) {\n      warn(error);\n      return null;\n    }\n  };\n\n  /** Coalesces broadcasts on a microtask so bursts of local changes ship one snapshot. */\n  const broadcastSnapshot = (): void => {\n    if (closed || flushScheduled) return;\n    flushScheduled = true;\n    queueMicrotask(() => {\n      flushScheduled = false;\n      if (closed) return;\n      const snapshot = readSnapshot();\n      if (snapshot !== null && snapshot !== undefined) host.broadcast('snapshot', snapshot);\n    });\n  };\n\n  /**\n   * Applies a guest command through the command table: the same table the host's own UI\n   * calls, so an unknown name, a foreign subject id or a rule violation is all the host\n   * can ever reject with.\n   */\n  const handleGuestCommand = (peerId: string, raw: unknown): void => {\n    const command = parseWireCommand(raw);\n    if (!command || !options.commands.has(command.name) || command.subjectId !== options.subjectId) {\n      host.send(peerId, 'rejected', {\n        commandId: command?.id ?? '',\n        message: 'The host rejected an unknown or out-of-session command.',\n      });\n      return;\n    }\n    try {\n      options.commands.apply(command.name, command.args);\n    } catch (error) {\n      host.send(peerId, 'rejected', {\n        commandId: command.id,\n        message: error instanceof Error ? error.message : 'The host could not apply the command.',\n      });\n    }\n  };\n\n  const detach = [\n    host.on('command', ({ peerId, payload }) => handleGuestCommand(peerId, payload)),\n    options.subjects.onChanged(broadcastSnapshot),\n    options.subjects.onRemoved(close),\n    host.tap((event) => {\n      if (event.type === 'peer-joined') {\n        const snapshot = readSnapshot();\n        if (snapshot !== null && snapshot !== undefined) host.send(event.peer.id, 'snapshot', snapshot);\n        tappers.emit({ peer: event.peer, type: 'peer-joined' });\n      }\n      if (event.type === 'peer-left') tappers.emit({ peer: event.peer, reason: event.reason, type: 'peer-left' });\n      if (event.type === 'error') warn(event.error);\n    }),\n  ];\n\n  return {\n    acceptAnswerText: async (text: string): Promise<MeshPeer> => {\n      if (closed) throw disposedError();\n      let decoded: MeshInvitation | MeshAnswer;\n      try {\n        decoded = await meshQrCodec.decode(text);\n      } catch (error) {\n        throw error instanceof MeshPairingError ? toPairingError(error) : error;\n      }\n      if (!('proof' in decoded)) {\n        throw new TavernPairingError('That code is an invitation, not a guest answer.');\n      }\n      try {\n        return await host.acceptAnswer(decoded);\n      } catch (error) {\n        throw error instanceof MeshPairingError ? toPairingError(error) : error;\n      }\n    },\n    createInvitationText: async () => {\n      if (closed) throw disposedError();\n      return meshQrCodec.encode(await host.createInvitation());\n    },\n    get disposalSignal() {\n      return host.disposalSignal;\n    },\n    dispose: close,\n    get disposed() {\n      return closed;\n    },\n    kick: (peerId: string): void => {\n      if (closed) throw disposedError();\n      host.kick(peerId);\n    },\n    get peers(): readonly MeshPeer[] {\n      return [...host.peers.values()];\n    },\n    relayNotice: (notice: unknown): void => {\n      if (closed) return;\n      const wire = options.notices ? options.notices.toWire(notice) : null;\n      if (wire !== null && wire !== undefined) host.broadcast('notice', wire);\n    },\n    tap: tappers.tap,\n    [Symbol.dispose]() {\n      close();\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Guest\n// ---------------------------------------------------------------------------\n\nexport interface TavernGuestOptions<Mounted> {\n  /** The invitation code the host produced. */\n  invitationText: string;\n  /**\n   * Mounts a received snapshot; the mounted value, or null to ignore. The snapshot arrives\n   * as parsed JSON: validate before trusting it.\n   */\n  mount(snapshot: unknown): Mounted | null;\n  /** The guest's display name on the channel. */\n  name: string;\n  notices?: TavernNotices;\n  /**\n   * The channel ended after joining; the mounted value is passed for unmounting.\n   * Lifecycle, not observability: rejections and transport warnings belong to\n   * {@link TavernGuest.tap}. `onJoined` and `onFailed` stay callbacks for the same\n   * reason: they fire while {@link joinTavern} is still resolving, before the\n   * consumer can hold the handle and register a tapper.\n   */\n  onEnded?(subject: Mounted): void;\n  /** The host never accepted the answer in time. */\n  onFailed?(reason: string): void;\n  /** The mounted value once the first snapshot arrives. */\n  onJoined?(subject: Mounted): void;\n  rtc?: MeshRtcFactory;\n}\n\nexport interface TavernGuest {\n  /** `AbortSignal` aborted when the session ends. */\n  readonly disposalSignal: AbortSignal;\n  /** Leaves the session and drops the channel. */\n  dispose(): void;\n  /** Whether the session has ended: the channel dropped or `dispose()` ran. */\n  readonly disposed: boolean;\n  /**\n   * Forwards a command to the host. The subject id is the consumer's routing key: the host\n   * rejects commands that do not name the subject it is hosting.\n   * Throws `TavernDisposedError` after the session has ended.\n   */\n  sendCommand(subjectId: string, name: string, args: readonly unknown[]): void;\n  /** Subscribes to {@link TavernGuestEvent}s. Handler errors are swallowed; the\n   *  subscription detaches when `signal` aborts or the session ends. */\n  tap(handler: (event: TavernGuestEvent) => void, options?: { readonly signal?: AbortSignal }): () => void;\n  /** Delegates to `dispose()`. Enables `using` declarations. */\n  [Symbol.dispose](): void;\n}\n\n/**\n * Joins a session as a guest: consumes the host's invitation and returns the answer code to\n * show back. The session goes live once the host accepts the answer and the first snapshot\n * mounts; disposing the guest (or the channel dropping) ends it exactly once.\n */\nexport async function joinTavern<Mounted>(\n  options: TavernGuestOptions<Mounted>,\n): Promise<{ answerText: string; guest: TavernGuest }> {\n  let decoded: MeshInvitation | MeshAnswer;\n  try {\n    decoded = await meshQrCodec.decode(options.invitationText);\n  } catch (error) {\n    throw error instanceof MeshPairingError ? toPairingError(error) : error;\n  }\n  if (!('secret' in decoded)) {\n    throw new TavernPairingError('That code is not a session invitation.');\n  }\n\n  const guest = createMeshGuest<WireProtocol>({\n    maxMessageBytes: DEFAULT_MAX_MESSAGE_BYTES,\n    rtc: options.rtc,\n  });\n  const tappers = createTappers<TavernGuestEvent>();\n  let mounted: Mounted | null = null;\n  let ended = false;\n\n  /** Ends the session exactly once: from the channel dropping or an explicit dispose. */\n  const endSession = (): void => {\n    if (ended) return;\n    ended = true;\n    const subject = mounted;\n    mounted = null;\n    for (const off of detach.splice(0)) off();\n    guest.dispose();\n    tappers.stop();\n    if (subject !== null) options.onEnded?.(subject);\n  };\n\n  const detach = [\n    guest.on('snapshot', ({ payload }) => {\n      const subject = options.mount(payload);\n      if (subject === null || ended) return;\n      if (mounted === null) {\n        mounted = subject;\n        options.onJoined?.(subject);\n      }\n    }),\n    guest.on('notice', ({ payload }) => {\n      options.notices?.fromWire(payload);\n    }),\n    guest.on('rejected', ({ payload }) => {\n      tappers.emit({\n        commandId: payload.commandId,\n        message: payload.message || 'The host rejected the action.',\n        type: 'rejected',\n      });\n    }),\n    guest.tap((event) => {\n      if (event.type !== 'status-change' && event.type !== 'peer-status-change') return;\n      if (event.type === 'peer-status-change' && event.peerId !== guest.host?.id) return;\n      if (event.status === 'failed' && mounted === null && !ended) {\n        options.onFailed?.('The host did not accept the answer in time.');\n      }\n      if (event.status === 'disconnected' || event.status === 'failed') endSession();\n    }),\n    guest.tap((event) => {\n      if (event.type === 'error') {\n        tappers.emit({ error: event.error, message: event.error.message, type: 'warning' });\n      }\n    }),\n  ];\n\n  try {\n    const answer = await guest.acceptInvitation(decoded, { name: options.name });\n    return {\n      answerText: await meshQrCodec.encode(answer),\n      guest: {\n        get disposalSignal() {\n          return guest.disposalSignal;\n        },\n        dispose: endSession,\n        get disposed() {\n          return ended;\n        },\n        sendCommand: (subjectId: string, name: string, args: readonly unknown[]): void => {\n          if (ended) throw new TavernDisposedError('The session has ended.');\n          guest.send('command', { args: [...args], id: commandId(), name, subjectId });\n        },\n        tap: tappers.tap,\n        [Symbol.dispose]() {\n          endSession();\n        },\n      },\n    };\n  } catch (error) {\n    // A failed join must not leave the node and its subscriptions behind.\n    endSession();\n    throw error instanceof MeshPairingError ? toPairingError(error) : error;\n  }\n}\n",
   "docs": {
-    "index": "---\ntitle: Tavern\ndescription: \"Table sessions over mesh: host-owned state replication with guest command forwarding\"\npackage: tavern\ncategory: utilities\nkeywords: [session, host, guest, replication, mesh, commands, snapshots, collaboration, peer-to-peer]\nexports: [hostTavern, joinTavern, TavernHost, TavernGuest, TavernCommands, TavernNotices, TavernError, TavernPairingError]\nrelated: [mesh, ledger, herald]\nenvironments: [browser, node]\n---\n\n<!-- markdownlint-disable MD025 MD033 MD060 -->\n\n<PackageHero package=\"tavern\" />\n\n## Why Tavern?\n\nPeer-to-peer apps share one arrangement problem: the canonical state of something: a document, a dashboard, a record: lives on exactly one device, while every other participant should see it and be able to change it from their own. Tavern turns that arrangement into a session: **one host owns the canonical state, guests mirror it, and every guest command is forwarded through the host's own command table**, so remote actions follow exactly the same code path as local ones.\n\n```ts\n// Before: hand-rolled session orchestration: pairing, protocol validation,\n// command routing, snapshot broadcasting, notice relaying, presence tracking.\nconst host = createMeshHost({ /* ... */ });\nhost.on('command', ({ peerId, payload }) => {\n  const command = mySchema.safeParse(payload);\n  if (!command.success) { host.send(peerId, 'rejected', { /* ... */ }); return; }\n  try { applySubjectCommand(command.data.name, subject, command.data.args); }\n  catch (error) { host.send(peerId, 'rejected', { /* ... */ }); }\n});\nbus.on('subject:updated', () => { host.broadcast('snapshot', snapshotFor(subject)); });\n// ... 40+ more lines of plumbing\n\n// After: tavern owns the protocol, the validation, the broadcasting.\nconst host = hostTavern({\n  commands: { apply: (name, args) => store.apply(name, args), has: (name) => name in store },\n  subjectId: 'doc-1',\n  subjects: {\n    onChanged: (listener) => store.onUpdated('doc-1', listener),\n    onRemoved: (listener) => store.onRemoved('doc-1', listener),\n    snapshot: () => store.read('doc-1'),\n  },\n});\n```\n\n| Feature | Tavern | Raw mesh | Socket.io rooms |\n| --- | --- | --- | --- |\n| Bundle size | <PackageInfo package=\"tavern\" type=\"size\" /> | <PackageInfo package=\"mesh\" type=\"size\" /> | N/A |\n| Zero dependencies | <ore-icon name=\"check\" size=\"16\"></ore-icon> | <ore-icon name=\"check\" size=\"16\"></ore-icon> | <ore-icon name=\"x\" size=\"16\"></ore-icon> |\n| Host-authoritative commands | <ore-icon name=\"check\" size=\"16\"></ore-icon>: same table as local UI | <ore-icon name=\"triangle-alert\" size=\"16\"></ore-icon>: wire it yourself | <ore-icon name=\"triangle-alert\" size=\"16\"></ore-icon>: wire it yourself |\n| Snapshot replication | <ore-icon name=\"check\" size=\"16\"></ore-icon>: microtask-coalesced | <ore-icon name=\"x\" size=\"16\"></ore-icon> | <ore-icon name=\"x\" size=\"16\"></ore-icon> |\n| Out-of-band pairing (QR / copy-paste) | <ore-icon name=\"check\" size=\"16\"></ore-icon> | <ore-icon name=\"check\" size=\"16\"></ore-icon> | <ore-icon name=\"x\" size=\"16\"></ore-icon>: needs a server |\n| Notice relaying | <ore-icon name=\"check\" size=\"16\"></ore-icon>: consumer-defined wire shape | <ore-icon name=\"x\" size=\"16\"></ore-icon> | <ore-icon name=\"triangle-alert\" size=\"16\"></ore-icon>: server-mediated |\n\n<div class=\"decision-callout\">\n\n**Use Tavern when** one device should own the canonical state of something: a shared document, a live dashboard, a record under review, and every other device should mirror it and send commands back through the host's own command table, which stays the single validation path.\n\n**Consider raw `@vielzeug/mesh` when** you need P2P messaging without the host-authoritative replication model: chat, whiteboards, file transfer, or custom topologies.\n\n</div>\n\n## Installation\n\n::: code-group\n\n```sh [pnpm]\npnpm add @vielzeug/tavern\n```\n\n```sh [npm]\nnpm install @vielzeug/tavern\n```\n\n```sh [yarn]\nyarn add @vielzeug/tavern\n```\n\n:::\n\n## Quick Start\n\n```ts\nimport { hostTavern, joinTavern } from '@vielzeug/tavern';\n\n// Host: pick a subject, wire the command table and snapshot access.\nconst host = hostTavern({\n  commands: {\n    apply: (name, args) => myStore.apply(name, args),\n    has: (name) => name in myStore,\n  },\n  subjectId: 'doc-1',\n  subjects: {\n    onChanged: (listener) => myStore.onUpdated('doc-1', listener),\n    onRemoved: (listener) => myStore.onRemoved('doc-1', listener),\n    snapshot: () => myStore.read('doc-1'),\n  },\n});\n\n// Produce a single-use invitation; deliver it out-of-band (QR, copy/paste).\nconst invitation = await host.createInvitationText();\n\n// Guest: consume the invitation, produce an answer for the host.\nconst { answerText, guest } = await joinTavern({\n  invitationText: invitation,\n  mount: (snapshot) => parseAndMount(snapshot),\n  name: 'Alex',\n});\nawait host.acceptAnswerText(answerText);\n\n// The guest's commands run through the host's own table.\nguest.sendCommand('doc-1', 'rename', ['Quarterly report']);\n\n// Cleanup: hosting ends for every guest; onEnded fires exactly once on both sides.\nhost.dispose();\nguest.dispose();\n```\n\n## Features\n\n<div class=\"features-grid\">\n\n- **`hostTavern`**: host one subject: pairing, protocol validation, command application, coalesced snapshot broadcasts\n- **`joinTavern`**: join as a guest: consume the invitation, produce the answer, mirror the host's snapshots\n- **`TavernCommands`**: the host's command table: the same object the host's own UI calls, so remote actions cannot bypass validation\n- **`TavernNotices`**: consumer-defined notice serialization: catalog keys cross the wire, each client translates locally\n- **Coalesced snapshots**: bursts of local changes ship one snapshot per microtask, not one per change\n- **`onEnded` fires exactly once**: on both handles: channel drops, subject removal, and explicit disposal share a single idempotent cleanup path\n- **Typed errors**: `TavernPairingError` covers every unusable pasted code with the mesh failure chained as `cause`\n\n</div>\n\n## Documentation\n\n<div class=\"doc-links\">\n\n- [Usage Guide](./usage.md)\n- [API Reference](./api.md)\n- [Examples](./examples.md)\n\n</div>\n\n## See Also\n\n<div class=\"see-also\">\n\n- [Mesh](/mesh/): the P2P transport underneath: WebRTC pairing, data channels, QR-optimized codecs.\n- [Ledger](/ledger/): undo/redo history for the commands the host applies.\n- [Herald](/herald/): typed event bus for the local notice stream tavern relays.\n\n</div>\n\n<!-- markdownlint-enable MD025 MD033 MD060 -->\n",
-    "api": "---\ntitle: 'Tavern: API Reference'\ndescription: Public API of @vielzeug/tavern.\n---\n\n[[toc]]\n\n## API Overview\n\n| Symbol | Purpose | Execution | Common gotcha |\n| --- | --- | --- | --- |\n| `hostTavern()` | Host a subject: pairing, command validation, snapshot broadcast | Sync factory | Disposing ends hosting for every guest |\n| `joinTavern()` | Join a session: consume invitation, produce answer | Async | The session lives only after the host accepts and the first snapshot mounts |\n| `TavernHost` | Host handle: invitation, answer acceptance, kick, notice relay | N/A | `dispose()` is idempotent |\n| `TavernGuest` | Guest handle: command forwarding, disposal | N/A | `dispose()` fires `onEnded` exactly once |\n| `TavernCommands` | The host's command table | N/A | Unknown names and foreign subject ids reject without applying |\n| `TavernSubjects` | Snapshot reading, change and removal subscriptions | N/A | `snapshot` returning `null` skips the broadcast |\n| `TavernNotices` | Wire serialization of local notices | N/A | `toWire` returning `null` skips that notice |\n| `TavernError` | Base error for every Tavern failure | N/A | N/A |\n| `TavernPairingError` | The consumer pasted the wrong kind of pairing code | N/A | N/A |\n\n## Package Entry Point\n\n| Import | Purpose |\n| --- | --- |\n| `@vielzeug/tavern` | Complete public Tavern API |\n\n## `hostTavern(options)`\n\nCreates a mesh host for one subject. Guest commands are validated against the wire shape (Tavern's own protocol), checked against `commands.has` and the `subjectId`, then applied through `commands.apply`: throwing rejects the guest with the error's message. Local changes (via `subjects.onChanged`) re-broadcast `subjects.snapshot()`: coalesced on a microtask; `subjects.onRemoved` ends hosting. Peers are reported through `onPeersChanged`, `onPeerJoined`, and `onPeerLeft`; hosting ending: from removal or `dispose()`: fires `onEnded` exactly once. `relayNotice` serializes through `notices.toWire` and broadcasts to every guest.\n\n**Returns:** `TavernHost`: the host handle.\n\n| Option | Type | Description |\n| --- | --- | --- |\n| `commands` | `TavernCommands` | The host's command table: the same object the host's own UI calls |\n| `notices?` | `TavernNotices` | Notice relay; omit to disable notice broadcasting |\n| `onEnded?` | `() => void` | Hosting ended: the subject was removed or `dispose()` ran. Fires exactly once |\n| `onPeersChanged?` | `(peers: MeshPeer[]) => void` | The full peer list, whenever it changes |\n| `onPeerJoined?` | `(peer: MeshPeer) => void` | A peer joined |\n| `onPeerLeft?` | `(peer: MeshPeer) => void` | A peer left |\n| `onWarning?` | `(message: string) => void` | A transport-level warning |\n| `rtc?` | `MeshRtcFactory` | WebRTC factory: the injection point for tests and non-browser runtimes |\n| `subjectId` | `string` | The id of the hosted subject: guest commands targeting anything else reject |\n| `subjects` | `TavernSubjects` | Snapshot reading, change and removal subscriptions |\n\n**Example**\n\n```ts\nimport { hostTavern } from '@vielzeug/tavern';\n\nconst host = hostTavern({\n  commands: {\n    apply: (name, args) => myStore.apply(name, args),\n    has: (name) => name in myStore,\n  },\n  subjectId: 'doc-1',\n  subjects: {\n    onChanged: (listener) => myStore.onUpdated('doc-1', listener),\n    onRemoved: (listener) => myStore.onRemoved('doc-1', listener),\n    snapshot: () => myStore.read('doc-1'),\n  },\n});\n```\n\n### `TavernHost` members\n\n| Member | Returns | Description |\n| --- | --- | --- |\n| `acceptAnswerText(text)` | `Promise<MeshPeer>` | Consumes a guest's answer code; resolves with the peer once the channel opens. Throws `TavernPairingError` for any unusable code: wrong kind, malformed, expired: with the underlying error as `cause` |\n| `createInvitationText()` | `Promise<string>` | Produces a single-use invitation code, QR-compact when the environment allows |\n| `disposalSignal` | `AbortSignal` | Aborted when hosting ends |\n| `dispose()` | `void` | Stops hosting: closes every channel and detaches all subscriptions. Idempotent; fires `onEnded` exactly once |\n| `disposed` | `boolean` | Whether hosting has ended |\n| `kick(peerId)` | `void` | Disconnects a peer; the guest observes a disconnect |\n| `relayNotice(notice)` | `void` | Relays one local notice to every guest; the serializer decides what crosses |\n| `[Symbol.dispose]()` | `void` | Delegates to `dispose()`. Enables `using` declarations |\n\n---\n\n## `joinTavern(options)`\n\nConsumes an invitation and returns `{ answerText, guest }`. The guest mounts snapshots through `mount(snapshot)`: the first successful mount fires `onJoined`; wire notices are relayed through `notices.fromWire`; rejections through `onRejected`. Channel failures before the first mount fire `onFailed` (once); afterwards, a disconnect or `guest.dispose()` fires `onEnded` with the mounted subject exactly once. `guest.sendCommand` forwards a command to the host with the subject id the consumer routes by. An unusable invitation: wrong kind, malformed, expired: rejects with `TavernPairingError` and leaves no node or subscriptions behind.\n\n**Returns:** `Promise<{ answerText: string; guest: TavernGuest }>`: the answer code to show back and the guest handle.\n\n| Option | Type | Description |\n| --- | --- | --- |\n| `invitationText` | `string` | The invitation code the host produced |\n| `mount` | `(snapshot: unknown) => Mounted \\| null` | Mounts a received snapshot; the mounted value, or `null` to ignore |\n| `name` | `string` | The guest's display name on the channel |\n| `notices?` | `TavernNotices` | Notice relay; wire notices re-emit locally through `fromWire` |\n| `onEnded?` | `(subject: Mounted) => void` | The channel ended after joining; the mounted value is passed for unmounting |\n| `onFailed?` | `(reason: string) => void` | The host never accepted the answer in time |\n| `onJoined?` | `(subject: Mounted) => void` | The mounted value once the first snapshot arrives |\n| `onRejected?` | `(message: string) => void` | The host rejected a forwarded command |\n| `onWarning?` | `(message: string) => void` | A transport-level warning |\n| `rtc?` | `MeshRtcFactory` | WebRTC factory: the injection point for tests and non-browser runtimes |\n\n**Example**\n\n```ts\nimport { joinTavern } from '@vielzeug/tavern';\n\nconst { answerText, guest } = await joinTavern({\n  invitationText: invitation,\n  mount: (snapshot) => sanitizeAndMount(snapshot),\n  name: 'Alex',\n  onEnded: (subject) => unmountMirror(subject.id),\n  onJoined: (subject) => mountMirror(subject),\n});\n\nguest.sendCommand('doc-1', 'rename', ['New name']);\nguest.dispose();\n```\n\n### `TavernGuest` members\n\n| Member | Returns | Description |\n| --- | --- | --- |\n| `disposalSignal` | `AbortSignal` | Aborted when the session ends |\n| `dispose()` | `void` | Leaves the session and drops the channel. Fires `onEnded` exactly once |\n| `disposed` | `boolean` | Whether the session has ended: the channel dropped or `dispose()` ran |\n| `sendCommand(subjectId, name, args)` | `void` | Forwards a command to the host. Throws `TavernError` if the session has ended |\n| `[Symbol.dispose]()` | `void` | Delegates to `dispose()`. Enables `using` declarations |\n\n---\n\n## Types\n\n```ts\n/** What the host can do on behalf of a guest. */\ninterface TavernCommands {\n  /** Whether a command name is known; unknown names reject without applying. */\n  has(name: string): boolean;\n  /** Applies the command; throwing rejects the guest with the error's message. */\n  apply(name: string, args: readonly unknown[]): unknown;\n}\n\n/**\n * How the host reads and watches the subject it is sharing. All three close over\n * whatever subject state the consumer owns: the host routes by `subjectId`,\n * not by a subject object.\n */\ninterface TavernSubjects {\n  /** Reads the snapshot to broadcast; null while the subject is missing. */\n  snapshot(): unknown;\n  /** Subscribes to local changes of the hosted subject: the re-broadcast trigger. */\n  onChanged(listener: () => void): () => void;\n  /** Subscribes to the hosted subject's removal: hosting ends when it fires. */\n  onRemoved(listener: () => void): () => void;\n}\n\n/**\n * Notice relay between host and guests. Notices cross the wire as opaque\n * values: each client translates locally.\n */\ninterface TavernNotices {\n  /** Serializes a local notice for the wire; null skips this one. */\n  toWire(notice: unknown): unknown | null;\n  /** Re-emits a received wire notice locally. */\n  fromWire(wire: unknown): void;\n}\n\n/** Options for `hostTavern`. */\ninterface TavernHostOptions {\n  commands: TavernCommands;\n  notices?: TavernNotices;\n  /** Hosting ended: the subject was removed or `dispose()` ran. Fires exactly once. */\n  onEnded?(): void;\n  onPeersChanged?(peers: MeshPeer[]): void;\n  onPeerJoined?(peer: MeshPeer): void;\n  onPeerLeft?(peer: MeshPeer): void;\n  onWarning?(message: string): void;\n  rtc?: MeshRtcFactory;\n  subjectId: string;\n  subjects: TavernSubjects;\n}\n\n/** Options for `joinTavern`. */\ninterface TavernGuestOptions<Mounted> {\n  invitationText: string;\n  /** Mounts a received snapshot; the mounted value, or null to ignore. */\n  mount(snapshot: unknown): Mounted | null;\n  name: string;\n  notices?: TavernNotices;\n  onEnded?(subject: Mounted): void;\n  onFailed?(reason: string): void;\n  onJoined?(subject: Mounted): void;\n  onRejected?(message: string): void;\n  onWarning?(message: string): void;\n  rtc?: MeshRtcFactory;\n}\n\n/** Host handle returned by `hostTavern`. */\ninterface TavernHost {\n  acceptAnswerText(text: string): Promise<MeshPeer>;\n  createInvitationText(): Promise<string>;\n  readonly disposalSignal: AbortSignal;\n  dispose(): void;\n  readonly disposed: boolean;\n  kick(peerId: string): void;\n  relayNotice(notice: unknown): void;\n  [Symbol.dispose](): void;\n}\n\n/** Guest handle returned by `joinTavern`. */\ninterface TavernGuest {\n  readonly disposalSignal: AbortSignal;\n  dispose(): void;\n  readonly disposed: boolean;\n  sendCommand(subjectId: string, name: string, args: readonly unknown[]): void;\n  [Symbol.dispose](): void;\n}\n```\n\n## Errors\n\n| Error | Triggered by | Notable properties |\n| --- | --- | --- |\n| `TavernError` | Base class for every Tavern failure: catch this to handle all Tavern errors in one branch | N/A |\n| `TavernPairingError` | A pairing code the consumer pasted could not be used: wrong kind, malformed, expired, or refused by the host. The mesh-level failure is chained as `cause` | `cause` |\n\n`TavernPairingError` extends `TavernError`. Every user-input pairing mistake: a garbage code, the wrong code kind, an expired invitation, a refused answer: surfaces as `TavernPairingError` from `acceptAnswerText` and `joinTavern`; transport-level failures (timeouts, connection errors) propagate unchanged. `TavernGuest.sendCommand` throws `TavernError` when the session has already ended.\n",
-    "usage": "---\ntitle: 'Tavern: Usage Guide'\ndescription: How to use @vielzeug/tavern.\n---\n\n[[toc]]\n\n## Basic Usage\n\nHost one subject per session; guests join through the invitation/answer pair. Both sides share one command table, so remote actions run the same code as local ones.\n\n```ts\nimport { hostTavern, joinTavern } from '@vielzeug/tavern';\n\nconst host = hostTavern({\n  commands: { apply: (name, args) => myStore.apply(name, args), has: (name) => name in myStore },\n  subjectId: 'doc-1',\n  subjects: {\n    onChanged: (listener) => myStore.onUpdated('doc-1', listener),\n    onRemoved: (listener) => myStore.onRemoved('doc-1', listener),\n    snapshot: () => myStore.read('doc-1'),\n  },\n});\nconst invitation = await host.createInvitationText();\n\nconst { answerText, guest } = await joinTavern({\n  invitationText: invitation,\n  mount: (snapshot) => parseAndMount(snapshot),\n  name: 'Alex',\n});\nawait host.acceptAnswerText(answerText);\n\nguest.sendCommand('doc-1', 'rename', ['Quarterly report']);\n```\n\n## Host a Subject\n\nThe host validates every guest command through the command table and broadcasts the snapshot on every local change: coalesced on a microtask, so bursts of changes ship one snapshot, not many. `onEnded` fires exactly once when hosting ends, whether the subject was removed or the host was disposed: reset your session UI there instead of intercepting your own `onRemoved` seam.\n\n```ts\nimport { hostTavern } from '@vielzeug/tavern';\n\nconst host = hostTavern({\n  commands: {\n    apply: (name, args) => myStore.apply(name, args),\n    has: (name) => name in myStore,\n  },\n  onEnded: () => updateSessionUi(), // hosting ended: subject removed or disposed\n  onPeersChanged: (peers) => updatePeerList(peers),\n  onPeerJoined: (peer) => toast(`${peer.name ?? 'A guest'} joined`),\n  onPeerLeft: (peer) => toast(`${peer.name ?? 'A guest'} left`),\n  onWarning: (message) => log.warn(message),\n  subjectId: 'doc-1',\n  subjects: {\n    onChanged: (listener) => myStore.onUpdated('doc-1', listener),\n    onRemoved: (listener) => myStore.onRemoved('doc-1', listener),\n    snapshot: () => myStore.read('doc-1'),\n  },\n});\n\nconst invitation = await host.createInvitationText();\n// Show the invitation (QR or copy/paste); the guest returns an answer code.\nawait host.acceptAnswerText(answerCode);\n\n// Kick a peer; the guest observes a disconnect and fires onEnded.\nhost.kick(peerId);\n\nhost.dispose(); // stop hosting: every guest disconnects\n```\n\n## Join as a Guest\n\nJoining consumes the invitation and produces the answer code to show back. The session goes live once the host accepts the answer and the first snapshot arrives.\n\n```ts\nimport { joinTavern } from '@vielzeug/tavern';\n\nconst { answerText, guest } = await joinTavern({\n  invitationText: invitation,\n  mount: (snapshot) => sanitizeAndMount(snapshot),\n  name: 'Alex',\n  onEnded: (subject) => unmountMirror(subject.id),\n  onFailed: (reason) => showError(reason),\n  onJoined: (subject) => mountMirror(subject),\n  onRejected: (message) => showToast(message),\n});\n\nguest.sendCommand('doc-1', 'rename', ['New name']);\nguest.dispose(); // leave; onEnded fires with the mounted subject exactly once\n```\n\nThe snapshot arrives as parsed JSON: `mount` receives `unknown` and should validate before trusting it. Returning `null` ignores the snapshot; returning the mounted value fires `onJoined` (first time only) and passes it to `onEnded` when the session ends.\n\n## Relay Notices\n\nGive both sides a notice seam: catalog keys rather than prose, so each client translates locally, and the host relays its own notices to every guest.\n\n```ts\nimport type { TavernNotices } from '@vielzeug/tavern';\n\nconst notices: TavernNotices = {\n  fromWire: (wire) => bus.emit('notify', wire),\n  toWire: (notice) => (isLocalNotice(notice) ? toWireShape(notice) : null),\n};\n\n// Host side: forward every local notice through the session.\nhost.relayNotice(localNotice);\n```\n\n**Echo guard**: a tab that both hosts and guests must prevent re-broadcasting a wire-originated notice back to its own guests. One boolean set during `fromWire` and checked in `toWire` is sufficient: the consumer owns this because only they know their local event system.\n\n## Handle Pairing Mistakes\n\nEvery user-input pairing failure surfaces as `TavernPairingError` from both `acceptAnswerText` and `joinTavern`: a garbage code, the wrong code kind, an expired invitation, or an answer the host refuses. Catch it to show a helpful message instead of a raw error; the underlying mesh failure is chained as `cause` when you need it.\n\n```ts\nimport { hostTavern, TavernPairingError } from '@vielzeug/tavern';\n\ntry {\n  await host.acceptAnswerText(pastedCode);\n} catch (error) {\n  if (error instanceof TavernPairingError) {\n    showToast(error.message); // \"That code is an invitation, not a guest answer.\"\n  } else {\n    throw error;\n  }\n}\n```\n\n## Working with Other Vielzeug Libraries\n\nTavern builds on `@vielzeug/mesh` for the WebRTC transport, pairing codes, and QR-optimized codecs. You do not interact with mesh directly: tavern owns the protocol, but the `rtc` option accepts a `MeshRtcFactory` for testing or non-browser runtimes, and the peer and status types in callbacks are mesh types.\n\n```ts\nimport type { MeshRtcFactory } from '@vielzeug/mesh';\nimport { hostTavern } from '@vielzeug/tavern';\n\nconst host = hostTavern({\n  // ... commands, subjects\n  rtc: myTestRtcFactory, // inject an in-memory WebRTC fake\n  subjectId: 'doc-1',\n});\n```\n\nPair `@vielzeug/ledger` on the host to give the commands tavern applies an undo history: commands applied through the table land in the ledger like local ones.\n\n## Best Practices\n\n- Keep the command table the same object the host's own UI calls, so guest actions cannot bypass local validation.\n- Return `null` from `snapshot` while the subject is missing: the broadcast simply skips.\n- Reset host-side session UI in `onEnded`: it fires exactly once for subject removal and explicit disposal alike, so you never need to double-wire your own `onRemoved` seam.\n- Treat notices as catalog keys, not prose: each client translates locally.\n- Guard against notice echo if a tab can both host and guest: one boolean in `toWire` is sufficient.\n- Dispose guests and hosts when their screen unmounts; channels also clean up on disconnect through `onEnded`, which fires exactly once on both sides.\n- Catch `TavernPairingError` separately from other errors: it means the pasted code could not be used, not that something is broken.\n",
+    "index": "---\ntitle: Tavern\ndescription: \"Table sessions over mesh: host-owned state replication with guest command forwarding\"\npackage: tavern\ncategory: utilities\nkeywords: [session, host, guest, replication, mesh, commands, snapshots, collaboration, peer-to-peer]\nexports: [hostTavern, joinTavern, TavernHost, TavernGuest, TavernHostEvent, TavernGuestEvent, TavernCommands, TavernNotices, TavernError, TavernPairingError, TavernDisposedError]\nrelated: [mesh, ledger, herald]\nenvironments: [browser, node]\n---\n\n<!-- markdownlint-disable MD025 MD033 MD060 -->\n\n<PackageHero package=\"tavern\" />\n\n## Why Tavern?\n\nPeer-to-peer apps share one arrangement problem: the canonical state of something: a document, a dashboard, a record: lives on exactly one device, while every other participant should see it and be able to change it from their own. Tavern turns that arrangement into a session: **one host owns the canonical state, guests mirror it, and every guest command is forwarded through the host's own command table**, so remote actions follow exactly the same code path as local ones.\n\n```ts\n// Before: hand-rolled session orchestration: pairing, protocol validation,\n// command routing, snapshot broadcasting, notice relaying, presence tracking.\nconst host = createMeshHost({ /* ... */ });\nhost.on('command', ({ peerId, payload }) => {\n  const command = mySchema.safeParse(payload);\n  if (!command.success) { host.send(peerId, 'rejected', { /* ... */ }); return; }\n  try { applySubjectCommand(command.data.name, subject, command.data.args); }\n  catch (error) { host.send(peerId, 'rejected', { /* ... */ }); }\n});\nbus.on('subject:updated', () => { host.broadcast('snapshot', snapshotFor(subject)); });\n// ... 40+ more lines of plumbing\n\n// After: tavern owns the protocol, the validation, the broadcasting.\nconst host = hostTavern({\n  commands: { apply: (name, args) => store.apply(name, args), has: (name) => name in store },\n  subjectId: 'doc-1',\n  subjects: {\n    onChanged: (listener) => store.onUpdated('doc-1', listener),\n    onRemoved: (listener) => store.onRemoved('doc-1', listener),\n    snapshot: () => store.read('doc-1'),\n  },\n});\n```\n\n| Feature | Tavern | Raw mesh | Socket.io rooms |\n| --- | --- | --- | --- |\n| Bundle size | <PackageInfo package=\"tavern\" type=\"size\" /> | <PackageInfo package=\"mesh\" type=\"size\" /> | N/A |\n| Zero dependencies | <ore-icon name=\"check\" size=\"16\"></ore-icon> | <ore-icon name=\"check\" size=\"16\"></ore-icon> | <ore-icon name=\"x\" size=\"16\"></ore-icon> |\n| Host-authoritative commands | <ore-icon name=\"check\" size=\"16\"></ore-icon>: same table as local UI | <ore-icon name=\"triangle-alert\" size=\"16\"></ore-icon>: wire it yourself | <ore-icon name=\"triangle-alert\" size=\"16\"></ore-icon>: wire it yourself |\n| Snapshot replication | <ore-icon name=\"check\" size=\"16\"></ore-icon>: microtask-coalesced | <ore-icon name=\"x\" size=\"16\"></ore-icon> | <ore-icon name=\"x\" size=\"16\"></ore-icon> |\n| Out-of-band pairing (QR / copy-paste) | <ore-icon name=\"check\" size=\"16\"></ore-icon> | <ore-icon name=\"check\" size=\"16\"></ore-icon> | <ore-icon name=\"x\" size=\"16\"></ore-icon>: needs a server |\n| Notice relaying | <ore-icon name=\"check\" size=\"16\"></ore-icon>: consumer-defined wire shape | <ore-icon name=\"x\" size=\"16\"></ore-icon> | <ore-icon name=\"triangle-alert\" size=\"16\"></ore-icon>: server-mediated |\n\n<div class=\"decision-callout\">\n\n**Use Tavern when** one device should own the canonical state of something: a shared document, a live dashboard, a record under review, and every other device should mirror it and send commands back through the host's own command table, which stays the single validation path.\n\n**Consider raw `@vielzeug/mesh` when** you need P2P messaging without the host-authoritative replication model: chat, whiteboards, file transfer, or custom topologies.\n\n</div>\n\n## Installation\n\n::: code-group\n\n```sh [pnpm]\npnpm add @vielzeug/tavern\n```\n\n```sh [npm]\nnpm install @vielzeug/tavern\n```\n\n```sh [yarn]\nyarn add @vielzeug/tavern\n```\n\n:::\n\n## Quick Start\n\n```ts\nimport { hostTavern, joinTavern } from '@vielzeug/tavern';\n\n// Host: pick a subject, wire the command table and snapshot access.\nconst host = hostTavern({\n  commands: {\n    apply: (name, args) => myStore.apply(name, args),\n    has: (name) => name in myStore,\n  },\n  subjectId: 'doc-1',\n  subjects: {\n    onChanged: (listener) => myStore.onUpdated('doc-1', listener),\n    onRemoved: (listener) => myStore.onRemoved('doc-1', listener),\n    snapshot: () => myStore.read('doc-1'),\n  },\n});\n\n// Produce a single-use invitation; deliver it out-of-band (QR, copy/paste).\nconst invitation = await host.createInvitationText();\n\n// Guest: consume the invitation, produce an answer for the host.\nconst { answerText, guest } = await joinTavern({\n  invitationText: invitation,\n  mount: (snapshot) => parseAndMount(snapshot),\n  name: 'Alex',\n});\nawait host.acceptAnswerText(answerText);\n\n// The guest's commands run through the host's own table.\nguest.sendCommand('doc-1', 'rename', ['Quarterly report']);\n\n// Cleanup: hosting ends for every guest; onEnded fires exactly once on both sides.\nhost.dispose();\nguest.dispose();\n```\n\n## Features\n\n<div class=\"features-grid\">\n\n- **`hostTavern`**: host one subject: pairing, protocol validation, command application, coalesced snapshot broadcasts\n- **`joinTavern`**: join as a guest: consume the invitation, produce the answer, mirror the host's snapshots\n- **`TavernCommands`**: the host's command table: the same object the host's own UI calls, so remote actions cannot bypass validation\n- **`TavernNotices`**: consumer-defined notice serialization: catalog keys cross the wire, each client translates locally\n- **Coalesced snapshots**: bursts of local changes ship one snapshot per microtask, not one per change\n- **`onEnded` fires exactly once**: on both handles: channel drops, subject removal, and explicit disposal share a single idempotent cleanup path\n- **Typed errors**: `TavernPairingError` covers every unusable pasted code with the mesh failure chained as `cause`\n\n</div>\n\n## Documentation\n\n<div class=\"doc-links\">\n\n- [Usage Guide](./usage.md)\n- [API Reference](./api.md)\n- [Examples](./examples.md)\n\n</div>\n\n## See Also\n\n<div class=\"see-also\">\n\n- [Mesh](/mesh/): the P2P transport underneath: WebRTC pairing, data channels, QR-optimized codecs.\n- [Ledger](/ledger/): undo/redo history for the commands the host applies.\n- [Herald](/herald/): typed event bus for the local notice stream tavern relays.\n\n</div>\n\n<!-- markdownlint-enable MD025 MD033 MD060 -->\n",
+    "api": "---\ntitle: 'Tavern: API Reference'\ndescription: Public API of @vielzeug/tavern.\n---\n\n[[toc]]\n\n## API Overview\n\n| Symbol | Purpose | Execution | Common gotcha |\n| --- | --- | --- | --- |\n| `hostTavern()` | Host a subject: pairing, command validation, snapshot broadcast | Sync factory | Disposing ends hosting for every guest |\n| `joinTavern()` | Join a session: consume invitation, produce answer | Async | The session lives only after the host accepts and the first snapshot mounts |\n| `TavernHost` | Host handle: invitation, answer acceptance, kick, notice relay, presence tap | N/A | `dispose()` is idempotent; control-plane methods throw `TavernDisposedError` after |\n| `TavernGuest` | Guest handle: command forwarding, rejection tap, disposal | N/A | `dispose()` fires `onEnded` exactly once |\n| `TavernHostEvent` | Host observability union for `tap()`: presence and warnings | N/A | Lifecycle transitions are callbacks, not events |\n| `TavernGuestEvent` | Guest observability union for `tap()`: rejections and warnings | N/A | `onJoined`/`onFailed` fire before the handle exists, so they stay callbacks |\n| `TavernCommands` | The host's command table | N/A | Unknown names and foreign subject ids reject without applying |\n| `TavernSubjects` | Snapshot reading, change and removal subscriptions | N/A | `snapshot` returning `null` skips the broadcast |\n| `TavernNotices` | Wire serialization of local notices | N/A | `toWire` returning `null` skips that notice |\n| `TavernError` | Base error for every Tavern failure | N/A | N/A |\n| `TavernPairingError` | The consumer pasted the wrong kind of pairing code | N/A | N/A |\n| `TavernDisposedError` | A stopped host or ended guest was used again | N/A | N/A |\n\n## Package Entry Point\n\n| Import | Purpose |\n| --- | --- |\n| `@vielzeug/tavern` | Complete public Tavern API |\n\n## `hostTavern(options)`\n\nCreates a mesh host for one subject. Guest commands are validated against the wire shape (Tavern's own protocol), checked against `commands.has` and the `subjectId`, then applied through `commands.apply`: throwing rejects the guest with the error's message. Local changes (via `subjects.onChanged`) re-broadcast `subjects.snapshot()`: coalesced on a microtask; `subjects.onRemoved` ends hosting. Presence and transport warnings are reported through `tap()` as `TavernHostEvent`s, and the live peer list is the `peers` getter; hosting ending: from removal or `dispose()`: fires `onEnded` exactly once. `relayNotice` serializes through `notices.toWire` and broadcasts to every guest.\n\n**Returns:** `TavernHost`: the host handle.\n\n| Option | Type | Description |\n| --- | --- | --- |\n| `commands` | `TavernCommands` | The host's command table: the same object the host's own UI calls |\n| `notices?` | `TavernNotices` | Notice relay; omit to disable notice broadcasting |\n| `onEnded?` | `() => void` | Hosting ended: the subject was removed or `dispose()` ran. Fires exactly once |\n| `rtc?` | `MeshRtcFactory` | WebRTC factory: the injection point for tests and non-browser runtimes |\n| `subjectId` | `string` | The id of the hosted subject: guest commands targeting anything else reject |\n| `subjects` | `TavernSubjects` | Snapshot reading, change and removal subscriptions |\n\n**Example**\n\n```ts\nimport { hostTavern } from '@vielzeug/tavern';\n\nconst host = hostTavern({\n  commands: {\n    apply: (name, args) => myStore.apply(name, args),\n    has: (name) => name in myStore,\n  },\n  subjectId: 'doc-1',\n  subjects: {\n    onChanged: (listener) => myStore.onUpdated('doc-1', listener),\n    onRemoved: (listener) => myStore.onRemoved('doc-1', listener),\n    snapshot: () => myStore.read('doc-1'),\n  },\n});\n```\n\n### `TavernHost` members\n\n| Member | Returns | Description |\n| --- | --- | --- |\n| `acceptAnswerText(text)` | `Promise<MeshPeer>` | Consumes a guest's answer code; resolves with the peer once the channel opens. Throws `TavernPairingError` for any unusable code: wrong kind, malformed, expired: with the underlying error as `cause`. Throws `TavernDisposedError` after `dispose()` |\n| `createInvitationText()` | `Promise<string>` | Produces a single-use invitation code, QR-compact when the environment allows. Throws `TavernDisposedError` after `dispose()` |\n| `disposalSignal` | `AbortSignal` | Aborted when hosting ends |\n| `dispose()` | `void` | Stops hosting: closes every channel and detaches all subscriptions. Idempotent; fires `onEnded` exactly once |\n| `disposed` | `boolean` | Whether hosting has ended |\n| `kick(peerId)` | `void` | Disconnects a peer; the guest observes a disconnect. Throws `TavernDisposedError` after `dispose()` |\n| `peers` | `readonly MeshPeer[]` | The guests currently connected; current inside a `peer-joined`/`peer-left` tap event |\n| `relayNotice(notice)` | `void` | Relays one local notice to every guest; the serializer decides what crosses. A notice relayed after `dispose()` is dropped: ephemeral UI state with no audience left |\n| `tap(handler, options?)` | `() => void` | Observes `TavernHostEvent`s; returns an unsubscribe function |\n| `[Symbol.dispose]()` | `void` | Delegates to `dispose()`. Enables `using` declarations |\n\n---\n\n## `joinTavern(options)`\n\nConsumes an invitation and returns `{ answerText, guest }`. The guest mounts snapshots through `mount(snapshot)`: the first successful mount fires `onJoined`; wire notices are relayed through `notices.fromWire`; host rejections and transport warnings arrive through `tap()` as `TavernGuestEvent`s. Channel failures before the first mount fire `onFailed` (once); afterwards, a disconnect or `guest.dispose()` fires `onEnded` with the mounted subject exactly once. `guest.sendCommand` forwards a command to the host with the subject id the consumer routes by. An unusable invitation: wrong kind, malformed, expired: rejects with `TavernPairingError` and leaves no node or subscriptions behind.\n\n**Returns:** `Promise<{ answerText: string; guest: TavernGuest }>`: the answer code to show back and the guest handle.\n\n| Option | Type | Description |\n| --- | --- | --- |\n| `invitationText` | `string` | The invitation code the host produced |\n| `mount` | `(snapshot: unknown) => Mounted \\| null` | Mounts a received snapshot; the mounted value, or `null` to ignore |\n| `name` | `string` | The guest's display name on the channel |\n| `notices?` | `TavernNotices` | Notice relay; wire notices re-emit locally through `fromWire` |\n| `onEnded?` | `(subject: Mounted) => void` | The channel ended after joining; the mounted value is passed for unmounting |\n| `onFailed?` | `(reason: string) => void` | The host never accepted the answer in time |\n| `onJoined?` | `(subject: Mounted) => void` | The mounted value once the first snapshot arrives |\n| `rtc?` | `MeshRtcFactory` | WebRTC factory: the injection point for tests and non-browser runtimes |\n\n**Example**\n\n```ts\nimport { joinTavern } from '@vielzeug/tavern';\n\nconst { answerText, guest } = await joinTavern({\n  invitationText: invitation,\n  mount: (snapshot) => sanitizeAndMount(snapshot),\n  name: 'Alex',\n  onEnded: (subject) => unmountMirror(subject.id),\n  onJoined: (subject) => mountMirror(subject),\n});\nguest.tap((event) => {\n  if (event.type === 'rejected') console.warn(event.commandId, event.message);\n});\n\nguest.sendCommand('doc-1', 'rename', ['New name']);\nguest.dispose();\n```\n\n### `TavernGuest` members\n\n| Member | Returns | Description |\n| --- | --- | --- |\n| `disposalSignal` | `AbortSignal` | Aborted when the session ends |\n| `dispose()` | `void` | Leaves the session and drops the channel. Fires `onEnded` exactly once |\n| `disposed` | `boolean` | Whether the session has ended: the channel dropped or `dispose()` ran |\n| `sendCommand(subjectId, name, args)` | `void` | Forwards a command to the host. Throws `TavernDisposedError` if the session has ended |\n| `tap(handler, options?)` | `() => void` | Observes `TavernGuestEvent`s; returns an unsubscribe function |\n| `[Symbol.dispose]()` | `void` | Delegates to `dispose()`. Enables `using` declarations |\n\n---\n\n## Types\n\n```ts\n/** What the host can do on behalf of a guest. */\ninterface TavernCommands {\n  /** Whether a command name is known; unknown names reject without applying. */\n  has(name: string): boolean;\n  /** Applies the command; throwing rejects the guest with the error's message. */\n  apply(name: string, args: readonly unknown[]): unknown;\n}\n\n/**\n * How the host reads and watches the subject it is sharing. All three close over\n * whatever subject state the consumer owns: the host routes by `subjectId`,\n * not by a subject object.\n */\ninterface TavernSubjects {\n  /** Reads the snapshot to broadcast; null while the subject is missing. */\n  snapshot(): unknown;\n  /** Subscribes to local changes of the hosted subject: the re-broadcast trigger. */\n  onChanged(listener: () => void): () => void;\n  /** Subscribes to the hosted subject's removal: hosting ends when it fires. */\n  onRemoved(listener: () => void): () => void;\n}\n\n/**\n * Notice relay between host and guests. Notices cross the wire as opaque\n * values: each client translates locally.\n */\ninterface TavernNotices {\n  /** Serializes a local notice for the wire; null skips this one. */\n  toWire(notice: unknown): unknown | null;\n  /** Re-emits a received wire notice locally. */\n  fromWire(wire: unknown): void;\n}\n\n/** Notable host moments reported through `TavernHost.tap`. */\ntype TavernHostEvent =\n  | { readonly peer: MeshPeer; readonly type: 'peer-joined' }\n  | { readonly peer: MeshPeer; readonly reason?: string; readonly type: 'peer-left' }\n  | { readonly error: unknown; readonly message: string; readonly type: 'warning' };\n\n/** Notable guest moments reported through `TavernGuest.tap`. */\ntype TavernGuestEvent =\n  | { readonly commandId: string; readonly message: string; readonly type: 'rejected' }\n  | { readonly error: unknown; readonly message: string; readonly type: 'warning' };\n\n/** Options for `hostTavern`. */\ninterface TavernHostOptions {\n  commands: TavernCommands;\n  notices?: TavernNotices;\n  /** Hosting ended: the subject was removed or `dispose()` ran. Fires exactly once. */\n  onEnded?(): void;\n  rtc?: MeshRtcFactory;\n  subjectId: string;\n  subjects: TavernSubjects;\n}\n\n/** Options for `joinTavern`. */\ninterface TavernGuestOptions<Mounted> {\n  invitationText: string;\n  /** Mounts a received snapshot; the mounted value, or null to ignore. */\n  mount(snapshot: unknown): Mounted | null;\n  name: string;\n  notices?: TavernNotices;\n  onEnded?(subject: Mounted): void;\n  onFailed?(reason: string): void;\n  onJoined?(subject: Mounted): void;\n  rtc?: MeshRtcFactory;\n}\n\n/** Host handle returned by `hostTavern`. */\ninterface TavernHost {\n  acceptAnswerText(text: string): Promise<MeshPeer>;\n  createInvitationText(): Promise<string>;\n  readonly disposalSignal: AbortSignal;\n  dispose(): void;\n  readonly disposed: boolean;\n  kick(peerId: string): void;\n  readonly peers: readonly MeshPeer[];\n  relayNotice(notice: unknown): void;\n  tap(handler: (event: TavernHostEvent) => void, options?: { readonly signal?: AbortSignal }): () => void;\n  [Symbol.dispose](): void;\n}\n\n/** Guest handle returned by `joinTavern`. */\ninterface TavernGuest {\n  readonly disposalSignal: AbortSignal;\n  dispose(): void;\n  readonly disposed: boolean;\n  sendCommand(subjectId: string, name: string, args: readonly unknown[]): void;\n  tap(handler: (event: TavernGuestEvent) => void, options?: { readonly signal?: AbortSignal }): () => void;\n  [Symbol.dispose](): void;\n}\n```\n\n## Errors\n\n| Error | Triggered by | Notable properties |\n| --- | --- | --- |\n| `TavernError` | Base class for every Tavern failure: catch this to handle all Tavern errors in one branch | N/A |\n| `TavernPairingError` | A pairing code the consumer pasted could not be used: wrong kind, malformed, expired, or refused by the host. The mesh-level failure is chained as `cause` | `cause` |\n| `TavernDisposedError` | A stopped host (`kick`, `createInvitationText`, `acceptAnswerText`) or an ended guest (`sendCommand`) was used again | N/A |\n\n`TavernPairingError` and `TavernDisposedError` extend `TavernError`. Every user-input pairing mistake: a garbage code, the wrong code kind, an expired invitation, a refused answer: surfaces as `TavernPairingError` from `acceptAnswerText` and `joinTavern`; transport-level failures (timeouts, connection errors) propagate unchanged. Post-dispose use fails loudly with `TavernDisposedError`, mirroring mesh inside the Tavern error hierarchy.\n",
+    "usage": "---\ntitle: 'Tavern: Usage Guide'\ndescription: How to use @vielzeug/tavern.\n---\n\n[[toc]]\n\n## Basic Usage\n\nHost one subject per session; guests join through the invitation/answer pair. Both sides share one command table, so remote actions run the same code as local ones.\n\n```ts\nimport { hostTavern, joinTavern } from '@vielzeug/tavern';\n\nconst host = hostTavern({\n  commands: { apply: (name, args) => myStore.apply(name, args), has: (name) => name in myStore },\n  subjectId: 'doc-1',\n  subjects: {\n    onChanged: (listener) => myStore.onUpdated('doc-1', listener),\n    onRemoved: (listener) => myStore.onRemoved('doc-1', listener),\n    snapshot: () => myStore.read('doc-1'),\n  },\n});\nconst invitation = await host.createInvitationText();\n\nconst { answerText, guest } = await joinTavern({\n  invitationText: invitation,\n  mount: (snapshot) => parseAndMount(snapshot),\n  name: 'Alex',\n});\nawait host.acceptAnswerText(answerText);\n\nguest.sendCommand('doc-1', 'rename', ['Quarterly report']);\n```\n\n## Host a Subject\n\nThe host validates every guest command through the command table and broadcasts the snapshot on every local change: coalesced on a microtask, so bursts of changes ship one snapshot, not many. `onEnded` fires exactly once when hosting ends, whether the subject was removed or the host was disposed: reset your session UI there instead of intercepting your own `onRemoved` seam.\n\n```ts\nimport { hostTavern } from '@vielzeug/tavern';\n\nconst host = hostTavern({\n  commands: {\n    apply: (name, args) => myStore.apply(name, args),\n    has: (name) => name in myStore,\n  },\n  onEnded: () => updateSessionUi(), // hosting ended: subject removed or disposed\n  subjectId: 'doc-1',\n  subjects: {\n    onChanged: (listener) => myStore.onUpdated('doc-1', listener),\n    onRemoved: (listener) => myStore.onRemoved('doc-1', listener),\n    snapshot: () => myStore.read('doc-1'),\n  },\n});\n\n// Presence and transport warnings arrive through tap(); the peer list is a getter.\nhost.tap((event) => {\n  if (event.type === 'peer-joined') toast(`${event.peer.name ?? 'A guest'} joined`);\n  if (event.type === 'peer-left') toast(`${event.peer.name ?? 'A guest'} left`);\n  if (event.type === 'warning') log.warn(event.message, event.error);\n  updatePeerList(host.peers); // always current inside a presence event\n});\n\nconst invitation = await host.createInvitationText();\n// Show the invitation (QR or copy/paste); the guest returns an answer code.\nawait host.acceptAnswerText(answerCode);\n\n// Kick a peer; the guest observes a disconnect and fires onEnded.\nhost.kick(peerId);\n\nhost.dispose(); // stop hosting: every guest disconnects\n```\n\n## Join as a Guest\n\nJoining consumes the invitation and produces the answer code to show back. The session goes live once the host accepts the answer and the first snapshot arrives.\n\n```ts\nimport { joinTavern } from '@vielzeug/tavern';\n\nconst { answerText, guest } = await joinTavern({\n  invitationText: invitation,\n  mount: (snapshot) => sanitizeAndMount(snapshot),\n  name: 'Alex',\n  onEnded: (subject) => unmountMirror(subject.id),\n  onFailed: (reason) => showError(reason),\n  onJoined: (subject) => mountMirror(subject),\n});\nguest.tap((event) => {\n  if (event.type === 'rejected') showToast(event.message); // event.commandId names the command it answers\n  if (event.type === 'warning') log.warn(event.message, event.error);\n});\n\nguest.sendCommand('doc-1', 'rename', ['New name']);\nguest.dispose(); // leave; onEnded fires with the mounted subject exactly once\n```\n\nThe snapshot arrives as parsed JSON: `mount` receives `unknown` and should validate before trusting it. Returning `null` ignores the snapshot; returning the mounted value fires `onJoined` (first time only) and passes it to `onEnded` when the session ends.\n\n## Relay Notices\n\nGive both sides a notice seam: catalog keys rather than prose, so each client translates locally, and the host relays its own notices to every guest.\n\n```ts\nimport type { TavernNotices } from '@vielzeug/tavern';\n\nconst notices: TavernNotices = {\n  fromWire: (wire) => bus.emit('notify', wire),\n  toWire: (notice) => (isLocalNotice(notice) ? toWireShape(notice) : null),\n};\n\n// Host side: forward every local notice through the session.\nhost.relayNotice(localNotice);\n```\n\n**Echo guard**: a tab that both hosts and guests must prevent re-broadcasting a wire-originated notice back to its own guests. One boolean set during `fromWire` and checked in `toWire` is sufficient: the consumer owns this because only they know their local event system.\n\n## Observe with tap()\n\nBoth handles expose `tap()` for observability: presence and warnings on the host, rejections and warnings on the guest. Handler errors are swallowed, and the subscription detaches when its signal aborts or the session ends. Lifecycle transitions stay callbacks (`onEnded`, `onJoined`, `onFailed`) because they fire while `joinTavern` is still resolving, before you can hold the handle.\n\n```ts\nimport type { TavernGuestEvent, TavernHostEvent } from '@vielzeug/tavern';\n\nhost.tap((event: TavernHostEvent) => {\n  if (event.type === 'warning') log.warn(event.message, event.error); // the original error, not just text\n});\nguest.tap((event: TavernGuestEvent) => {\n  if (event.type === 'rejected') log.info(`command ${event.commandId} rejected: ${event.message}`);\n});\n```\n\n## Handle Pairing Mistakes\n\nEvery user-input pairing failure surfaces as `TavernPairingError` from both `acceptAnswerText` and `joinTavern`: a garbage code, the wrong code kind, an expired invitation, or an answer the host refuses. Catch it to show a helpful message instead of a raw error; the underlying mesh failure is chained as `cause` when you need it.\n\n```ts\nimport { hostTavern, TavernPairingError } from '@vielzeug/tavern';\n\ntry {\n  await host.acceptAnswerText(pastedCode);\n} catch (error) {\n  if (error instanceof TavernPairingError) {\n    showToast(error.message); // \"That code is an invitation, not a guest answer.\"\n  } else {\n    throw error;\n  }\n}\n```\n\n## Working with Other Vielzeug Libraries\n\nTavern builds on `@vielzeug/mesh` for the WebRTC transport, pairing codes, and QR-optimized codecs. You do not interact with mesh directly: tavern owns the protocol, but the `rtc` option accepts a `MeshRtcFactory` for testing or non-browser runtimes, and the peers carried by tap events and the {@link TavernHost.peers} getter are mesh types.\n\n```ts\nimport type { MeshRtcFactory } from '@vielzeug/mesh';\nimport { hostTavern } from '@vielzeug/tavern';\n\nconst host = hostTavern({\n  // ... commands, subjects\n  rtc: myTestRtcFactory, // inject an in-memory WebRTC fake\n  subjectId: 'doc-1',\n});\n```\n\nPair `@vielzeug/ledger` on the host to give the commands tavern applies an undo history: commands applied through the table land in the ledger like local ones.\n\n## Best Practices\n\n- Keep the command table the same object the host's own UI calls, so guest actions cannot bypass local validation.\n- Return `null` from `snapshot` while the subject is missing: the broadcast simply skips.\n- Reset host-side session UI in `onEnded`: it fires exactly once for subject removal and explicit disposal alike, so you never need to double-wire your own `onRemoved` seam.\n- Treat notices as catalog keys, not prose: each client translates locally.\n- Guard against notice echo if a tab can both host and guest: one boolean in `toWire` is sufficient.\n- Dispose guests and hosts when their screen unmounts; channels also clean up on disconnect through `onEnded`, which fires exactly once on both sides.\n- Catch `TavernPairingError` separately from other errors: it means the pasted code could not be used, not that something is broken.\n",
     "examples": "---\ntitle: 'Tavern: Examples'\ndescription: Practical examples and recipes for @vielzeug/tavern.\n---\n\n## Examples\n\n- [Share State Across Devices](./examples/share-state-across-devices.md)\n"
   },
   "examples": [],
   "typeSignatures": {
-    "TavernError": "export { TavernError, TavernPairingError };",
-    "TavernPairingError": "export { TavernError, TavernPairingError };",
+    "TavernDisposedError": "export { TavernDisposedError, TavernError, TavernPairingError };",
+    "TavernError": "export { TavernDisposedError, TavernError, TavernPairingError };",
+    "TavernPairingError": "export { TavernDisposedError, TavernError, TavernPairingError };",
     "TavernCommands": "export interface TavernCommands {\n  /** Applies the command; throwing rejects the guest with the error's message. */\n  apply(name: string, args: readonly unknown[]): unknown;\n  /** Whether a command name is known; unknown names reject without applying. */\n  has(name: string): boolean;\n}",
     "TavernSubjects": "export interface TavernSubjects {\n  /** Subscribes to local changes of the hosted subject: the re-broadcast trigger. */\n  onChanged(listener: () => void): () => void;\n  /** Subscribes to the hosted subject's removal: hosting ends when it fires. */\n  onRemoved(listener: () => void): () => void;\n  /** Reads the snapshot to broadcast; null while the subject is missing. */\n  snapshot(): unknown;\n}",
     "TavernNotices": "export interface TavernNotices {\n  /** Re-emits a received wire notice locally. */\n  fromWire(wire: unknown): void;\n  /** Serializes a local notice for the wire; null skips this one. */\n  toWire(notice: unknown): unknown | null;\n}",
-    "TavernHostOptions": "export interface TavernHostOptions {\n  commands: TavernCommands;\n  notices?: TavernNotices;\n  /** Hosting ended: the subject was removed or the host was disposed. Fires exactly once. */\n  onEnded?(): void;\n  onPeerJoined?(peer: MeshPeer): void;\n  onPeerLeft?(peer: MeshPeer): void;\n  onPeersChanged?(peers: MeshPeer[]): void;\n  onWarning?(message: string): void;\n  rtc?: MeshRtcFactory;\n  /** The id of the subject being hosted: guest commands targeting anything else reject. */\n  subjectId: string;\n  subjects: TavernSubjects;\n}",
-    "TavernHost": "export interface TavernHost {\n  /** Consumes a guest's answer code; resolves with the peer once the channel is open. */\n  acceptAnswerText(text: string): Promise<MeshPeer>;\n  /** Produces a single-use invitation code, QR-compact when the environment allows. */\n  createInvitationText(): Promise<string>;\n  /** `AbortSignal` aborted when hosting ends. */\n  readonly disposalSignal: AbortSignal;\n  /** Stops hosting: closes every channel and detaches all subscriptions. */\n  dispose(): void;\n  /** Whether hosting has ended: the subject was removed or `dispose()` ran. */\n  readonly disposed: boolean;\n  kick(peerId: string): void;\n  /** Relays one local notice to every guest; the serializer decides what crosses. */\n  relayNotice(notice: unknown): void;\n  /** Delegates to `dispose()`. Enables `using` declarations. */\n  [Symbol.dispose](): void;\n}",
-    "hostTavern": "export function hostTavern(options: TavernHostOptions): TavernHost {\n  const host = createMeshHost<WireProtocol>({\n    maxMessageBytes: DEFAULT_MAX_MESSAGE_BYTES,\n    rtc: options.rtc,\n  });\n  let closed = false;\n  let flushScheduled = false;\n\n  const close = (): void => {\n    if (closed) return;\n    closed = true;\n    for (const off of detach.splice(0)) off();\n    host.dispose();\n    options.onEnded?.();\n  };\n\n  /** Reads the snapshot for a broadcast; a throwing read warns instead of crashing the host. */\n  const readSnapshot = (): unknown => {\n    try {\n      return options.subjects.snapshot();\n    } catch (error) {\n      options.onWarning?.(error instanceof Error ? error.message : 'Reading the snapshot failed.');\n      return null;\n    }\n  };\n\n  /** Coalesces broadcasts on a microtask so bursts of local changes ship one snapshot. */\n  const broadcastSnapshot = (): void => {\n    if (closed || flushScheduled) return;\n    flushScheduled = true;\n    queueMicrotask(() => {\n      flushScheduled = false;\n      if (closed) return;\n      const snapshot = readSnapshot();\n      if (snapshot !== null && snapshot !== undefined) host.broadcast('snapshot', snapshot);\n    });\n  };\n\n  /**\n   * Applies a guest command through the command table: the same table the host's own UI\n   * calls, so an unknown name, a foreign subject id or a rule violation is all the host\n   * can ever reject with.\n   */\n  const handleGuestCommand = (peerId: string, raw: unknown): void => {\n    const command = parseWireCommand(raw);\n    if (!command || !options.commands.has(command.name) || command.subjectId !== options.subjectId) {\n      host.send(peerId, 'rejected', {\n        commandId: command?.id ?? '',\n        message: 'The host rejected an unknown or out-of-session command.',\n      });\n      return;\n    }\n    try {\n      options.commands.apply(command.name, command.args);\n    } catch (error) {\n      host.send(peerId, 'rejected', {\n        commandId: command.id,\n        message: error instanceof Error ? error.message : 'The host could not apply the command.',\n      });\n    }\n  };\n\n  const detach = [\n    host.on('command', ({ peerId, payload }) => handleGuestCommand(peerId, payload)),\n    options.subjects.onChanged(broadcastSnapshot),\n    options.subjects.onRemoved(close),\n    host.tap((event) => {\n      if (event.type === 'peer-joined' || event.type === 'peer-left') {\n        options.onPeersChanged?.([...host.peers.values()]);\n      }\n      if (event.type === 'peer-joined') {\n        const snapshot = readSnapshot();\n        if (snapshot !== null && snapshot !== undefined) host.send(event.peer.id, 'snapshot', snapshot);\n        options.onPeerJoined?.(event.peer);\n      }\n      if (event.type === 'peer-left') options.onPeerLeft?.(event.peer);\n      if (event.type === 'error') options.onWarning?.(event.error.message);\n    }),\n  ];\n\n  return {\n    acceptAnswerText: async (text: string): Promise<MeshPeer> => {\n      let decoded: MeshInvitation | MeshAnswer;\n      try {\n        decoded = await meshQrCodec.decode(text);\n      } catch (error) {\n        throw error instanceof MeshPairingError ? toPairingError(error) : error;\n      }\n      if (!('proof' in decoded)) {\n        throw new TavernPairingError('That code is an invitation, not a guest answer.');\n      }\n      try {\n        return await host.acceptAnswer(decoded);\n      } catch (error) {\n        throw error instanceof MeshPairingError ? toPairingError(error) : error;\n      }\n    },\n    createInvitationText: async () => meshQrCodec.encode(await host.createInvitation()),\n    get disposalSignal() {\n      return host.disposalSignal;\n    },\n    dispose: close,\n    get disposed() {\n      return closed;\n    },\n    kick: (peerId: string): void => {\n      host.kick(peerId);\n    },\n    relayNotice: (notice: unknown): void => {\n      if (closed) return;\n      const wire = options.notices ? options.notices.toWire(notice) : null;\n      if (wire !== null && wire !== undefined) host.broadcast('notice', wire);\n    },\n    [Symbol.dispose]() {\n      close();\n    },\n  };\n}",
-    "TavernGuestOptions": "export interface TavernGuestOptions<Mounted> {\n  /** The invitation code the host produced. */\n  invitationText: string;\n  /**\n   * Mounts a received snapshot; the mounted value, or null to ignore. The snapshot arrives\n   * as parsed JSON: validate before trusting it.\n   */\n  mount(snapshot: unknown): Mounted | null;\n  /** The guest's display name on the channel. */\n  name: string;\n  notices?: TavernNotices;\n  /** The channel ended after joining; the mounted value is passed for unmounting. */\n  onEnded?(subject: Mounted): void;\n  /** The host never accepted the answer in time. */\n  onFailed?(reason: string): void;\n  /** The mounted value once the first snapshot arrives. */\n  onJoined?(subject: Mounted): void;\n  /** The host rejected a forwarded command. */\n  onRejected?(message: string): void;\n  onWarning?(message: string): void;\n  rtc?: MeshRtcFactory;\n}",
-    "TavernGuest": "export interface TavernGuest {\n  /** `AbortSignal` aborted when the session ends. */\n  readonly disposalSignal: AbortSignal;\n  /** Leaves the session and drops the channel. */\n  dispose(): void;\n  /** Whether the session has ended: the channel dropped or `dispose()` ran. */\n  readonly disposed: boolean;\n  /**\n   * Forwards a command to the host. The subject id is the consumer's routing key: the host\n   * rejects commands that do not name the subject it is hosting.\n   */\n  sendCommand(subjectId: string, name: string, args: readonly unknown[]): void;\n  /** Delegates to `dispose()`. Enables `using` declarations. */\n  [Symbol.dispose](): void;\n}",
-    "joinTavern": "export async function joinTavern<Mounted>(\n  options: TavernGuestOptions<Mounted>,\n): Promise<{ answerText: string; guest: TavernGuest }> {\n  let decoded: MeshInvitation | MeshAnswer;\n  try {\n    decoded = await meshQrCodec.decode(options.invitationText);\n  } catch (error) {\n    throw error instanceof MeshPairingError ? toPairingError(error) : error;\n  }\n  if (!('secret' in decoded)) {\n    throw new TavernPairingError('That code is not a session invitation.');\n  }\n\n  const guest = createMeshGuest<WireProtocol>({\n    maxMessageBytes: DEFAULT_MAX_MESSAGE_BYTES,\n    rtc: options.rtc,\n  });\n  let mounted: Mounted | null = null;\n  let ended = false;\n\n  /** Ends the session exactly once: from the channel dropping or an explicit dispose. */\n  const endSession = (): void => {\n    if (ended) return;\n    ended = true;\n    const subject = mounted;\n    mounted = null;\n    for (const off of detach.splice(0)) off();\n    guest.dispose();\n    if (subject !== null) options.onEnded?.(subject);\n  };\n\n  const detach = [\n    guest.on('snapshot', ({ payload }) => {\n      const subject = options.mount(payload);\n      if (subject === null || ended) return;\n      if (mounted === null) {\n        mounted = subject;\n        options.onJoined?.(subject);\n      }\n    }),\n    guest.on('notice', ({ payload }) => {\n      options.notices?.fromWire(payload);\n    }),\n    guest.on('rejected', ({ payload }) => {\n      options.onRejected?.(payload.message || 'The host rejected the action.');\n    }),\n    guest.tap((event) => {\n      if (event.type !== 'status-change' && event.type !== 'peer-status-change') return;\n      if (event.type === 'peer-status-change' && event.peerId !== guest.host?.id) return;\n      if (event.status === 'failed' && mounted === null && !ended) {\n        options.onFailed?.('The host did not accept the answer in time.');\n      }\n      if (event.status === 'disconnected' || event.status === 'failed') endSession();\n    }),\n    guest.tap((event) => {\n      if (event.type === 'error') options.onWarning?.(event.error.message);\n    }),\n  ];\n\n  try {\n    const answer = await guest.acceptInvitation(decoded, { name: options.name });\n    return {\n      answerText: await meshQrCodec.encode(answer),\n      guest: {\n        get disposalSignal() {\n          return guest.disposalSignal;\n        },\n        dispose: endSession,\n        get disposed() {\n          return ended;\n        },\n        sendCommand: (subjectId: string, name: string, args: readonly unknown[]): void => {\n          if (ended) throw new TavernError('The session has ended.');\n          guest.send('command', { args: [...args], id: commandId(), name, subjectId });\n        },\n        [Symbol.dispose]() {\n          endSession();\n        },\n      },\n    };\n  } catch (error) {\n    // A failed join must not leave the node and its subscriptions behind.\n    endSession();\n    throw error instanceof MeshPairingError ? toPairingError(error) : error;\n  }\n}"
+    "TavernHostEvent": "export type TavernHostEvent =\n  | { readonly peer: MeshPeer; readonly type: 'peer-joined' }\n  | { readonly peer: MeshPeer; readonly reason?: string; readonly type: 'peer-left' }\n  | { readonly error: unknown; readonly message: string; readonly type: 'warning' };",
+    "TavernGuestEvent": "export type TavernGuestEvent =\n  | { readonly commandId: string; readonly message: string; readonly type: 'rejected' }\n  | { readonly error: unknown; readonly message: string; readonly type: 'warning' };",
+    "TavernHostOptions": "export interface TavernHostOptions {\n  commands: TavernCommands;\n  notices?: TavernNotices;\n  /**\n   * Hosting ended: the subject was removed or the host was disposed. Fires exactly\n   * once. This is a lifecycle transition, not observability: presence, transport\n   * warnings, and the peer list all belong to {@link TavernHost.tap} and\n   * {@link TavernHost.peers}.\n   */\n  onEnded?(): void;\n  rtc?: MeshRtcFactory;\n  /** The id of the subject being hosted: guest commands targeting anything else reject. */\n  subjectId: string;\n  subjects: TavernSubjects;\n}",
+    "TavernHost": "export interface TavernHost {\n  /** Consumes a guest's answer code; resolves with the peer once the channel is open. */\n  acceptAnswerText(text: string): Promise<MeshPeer>;\n  /** Produces a single-use invitation code, QR-compact when the environment allows. */\n  createInvitationText(): Promise<string>;\n  /** `AbortSignal` aborted when hosting ends. */\n  readonly disposalSignal: AbortSignal;\n  /** Stops hosting: closes every channel and detaches all subscriptions. */\n  dispose(): void;\n  /** Whether hosting has ended: the subject was removed or `dispose()` ran. */\n  readonly disposed: boolean;\n  kick(peerId: string): void;\n  /** The guests currently connected: read it from a `peer-joined`/`peer-left` tap event. */\n  readonly peers: readonly MeshPeer[];\n  /** Relays one local notice to every guest; the serializer decides what crosses.\n   *  A notice relayed after hosting ended is dropped, not thrown: it is ephemeral\n   *  UI state with no audience left, unlike the control-plane methods, which fail\n   *  with `TavernDisposedError` so a leaked handle surfaces. */\n  relayNotice(notice: unknown): void;\n  /** Subscribes to {@link TavernHostEvent}s. Handler errors are swallowed; the\n   *  subscription detaches when `signal` aborts or hosting ends. */\n  tap(handler: (event: TavernHostEvent) => void, options?: { readonly signal?: AbortSignal }): () => void;\n  /** Delegates to `dispose()`. Enables `using` declarations. */\n  [Symbol.dispose](): void;\n}",
+    "hostTavern": "export function hostTavern(options: TavernHostOptions): TavernHost {\n  const host = createMeshHost<WireProtocol>({\n    maxMessageBytes: DEFAULT_MAX_MESSAGE_BYTES,\n    rtc: options.rtc,\n  });\n  const tappers = createTappers<TavernHostEvent>();\n  let closed = false;\n  let flushScheduled = false;\n\n  const close = (): void => {\n    if (closed) return;\n    closed = true;\n    for (const off of detach.splice(0)) off();\n    host.dispose();\n    tappers.stop();\n    options.onEnded?.();\n  };\n  const disposedError = (): TavernDisposedError => new TavernDisposedError('This host has stopped.');\n  const warn = (error: unknown): void => {\n    tappers.emit({ error, message: error instanceof Error ? error.message : String(error), type: 'warning' });\n  };\n\n  /** Reads the snapshot for a broadcast; a throwing read warns instead of crashing the host. */\n  const readSnapshot = (): unknown => {\n    try {\n      return options.subjects.snapshot();\n    } catch (error) {\n      warn(error);\n      return null;\n    }\n  };\n\n  /** Coalesces broadcasts on a microtask so bursts of local changes ship one snapshot. */\n  const broadcastSnapshot = (): void => {\n    if (closed || flushScheduled) return;\n    flushScheduled = true;\n    queueMicrotask(() => {\n      flushScheduled = false;\n      if (closed) return;\n      const snapshot = readSnapshot();\n      if (snapshot !== null && snapshot !== undefined) host.broadcast('snapshot', snapshot);\n    });\n  };\n\n  /**\n   * Applies a guest command through the command table: the same table the host's own UI\n   * calls, so an unknown name, a foreign subject id or a rule violation is all the host\n   * can ever reject with.\n   */\n  const handleGuestCommand = (peerId: string, raw: unknown): void => {\n    const command = parseWireCommand(raw);\n    if (!command || !options.commands.has(command.name) || command.subjectId !== options.subjectId) {\n      host.send(peerId, 'rejected', {\n        commandId: command?.id ?? '',\n        message: 'The host rejected an unknown or out-of-session command.',\n      });\n      return;\n    }\n    try {\n      options.commands.apply(command.name, command.args);\n    } catch (error) {\n      host.send(peerId, 'rejected', {\n        commandId: command.id,\n        message: error instanceof Error ? error.message : 'The host could not apply the command.',\n      });\n    }\n  };\n\n  const detach = [\n    host.on('command', ({ peerId, payload }) => handleGuestCommand(peerId, payload)),\n    options.subjects.onChanged(broadcastSnapshot),\n    options.subjects.onRemoved(close),\n    host.tap((event) => {\n      if (event.type === 'peer-joined') {\n        const snapshot = readSnapshot();\n        if (snapshot !== null && snapshot !== undefined) host.send(event.peer.id, 'snapshot', snapshot);\n        tappers.emit({ peer: event.peer, type: 'peer-joined' });\n      }\n      if (event.type === 'peer-left') tappers.emit({ peer: event.peer, reason: event.reason, type: 'peer-left' });\n      if (event.type === 'error') warn(event.error);\n    }),\n  ];\n\n  return {\n    acceptAnswerText: async (text: string): Promise<MeshPeer> => {\n      if (closed) throw disposedError();\n      let decoded: MeshInvitation | MeshAnswer;\n      try {\n        decoded = await meshQrCodec.decode(text);\n      } catch (error) {\n        throw error instanceof MeshPairingError ? toPairingError(error) : error;\n      }\n      if (!('proof' in decoded)) {\n        throw new TavernPairingError('That code is an invitation, not a guest answer.');\n      }\n      try {\n        return await host.acceptAnswer(decoded);\n      } catch (error) {\n        throw error instanceof MeshPairingError ? toPairingError(error) : error;\n      }\n    },\n    createInvitationText: async () => {\n      if (closed) throw disposedError();\n      return meshQrCodec.encode(await host.createInvitation());\n    },\n    get disposalSignal() {\n      return host.disposalSignal;\n    },\n    dispose: close,\n    get disposed() {\n      return closed;\n    },\n    kick: (peerId: string): void => {\n      if (closed) throw disposedError();\n      host.kick(peerId);\n    },\n    get peers(): readonly MeshPeer[] {\n      return [...host.peers.values()];\n    },\n    relayNotice: (notice: unknown): void => {\n      if (closed) return;\n      const wire = options.notices ? options.notices.toWire(notice) : null;\n      if (wire !== null && wire !== undefined) host.broadcast('notice', wire);\n    },\n    tap: tappers.tap,\n    [Symbol.dispose]() {\n      close();\n    },\n  };\n}",
+    "TavernGuestOptions": "export interface TavernGuestOptions<Mounted> {\n  /** The invitation code the host produced. */\n  invitationText: string;\n  /**\n   * Mounts a received snapshot; the mounted value, or null to ignore. The snapshot arrives\n   * as parsed JSON: validate before trusting it.\n   */\n  mount(snapshot: unknown): Mounted | null;\n  /** The guest's display name on the channel. */\n  name: string;\n  notices?: TavernNotices;\n  /**\n   * The channel ended after joining; the mounted value is passed for unmounting.\n   * Lifecycle, not observability: rejections and transport warnings belong to\n   * {@link TavernGuest.tap}. `onJoined` and `onFailed` stay callbacks for the same\n   * reason: they fire while {@link joinTavern} is still resolving, before the\n   * consumer can hold the handle and register a tapper.\n   */\n  onEnded?(subject: Mounted): void;\n  /** The host never accepted the answer in time. */\n  onFailed?(reason: string): void;\n  /** The mounted value once the first snapshot arrives. */\n  onJoined?(subject: Mounted): void;\n  rtc?: MeshRtcFactory;\n}",
+    "TavernGuest": "export interface TavernGuest {\n  /** `AbortSignal` aborted when the session ends. */\n  readonly disposalSignal: AbortSignal;\n  /** Leaves the session and drops the channel. */\n  dispose(): void;\n  /** Whether the session has ended: the channel dropped or `dispose()` ran. */\n  readonly disposed: boolean;\n  /**\n   * Forwards a command to the host. The subject id is the consumer's routing key: the host\n   * rejects commands that do not name the subject it is hosting.\n   * Throws `TavernDisposedError` after the session has ended.\n   */\n  sendCommand(subjectId: string, name: string, args: readonly unknown[]): void;\n  /** Subscribes to {@link TavernGuestEvent}s. Handler errors are swallowed; the\n   *  subscription detaches when `signal` aborts or the session ends. */\n  tap(handler: (event: TavernGuestEvent) => void, options?: { readonly signal?: AbortSignal }): () => void;\n  /** Delegates to `dispose()`. Enables `using` declarations. */\n  [Symbol.dispose](): void;\n}",
+    "joinTavern": "export async function joinTavern<Mounted>(\n  options: TavernGuestOptions<Mounted>,\n): Promise<{ answerText: string; guest: TavernGuest }> {\n  let decoded: MeshInvitation | MeshAnswer;\n  try {\n    decoded = await meshQrCodec.decode(options.invitationText);\n  } catch (error) {\n    throw error instanceof MeshPairingError ? toPairingError(error) : error;\n  }\n  if (!('secret' in decoded)) {\n    throw new TavernPairingError('That code is not a session invitation.');\n  }\n\n  const guest = createMeshGuest<WireProtocol>({\n    maxMessageBytes: DEFAULT_MAX_MESSAGE_BYTES,\n    rtc: options.rtc,\n  });\n  const tappers = createTappers<TavernGuestEvent>();\n  let mounted: Mounted | null = null;\n  let ended = false;\n\n  /** Ends the session exactly once: from the channel dropping or an explicit dispose. */\n  const endSession = (): void => {\n    if (ended) return;\n    ended = true;\n    const subject = mounted;\n    mounted = null;\n    for (const off of detach.splice(0)) off();\n    guest.dispose();\n    tappers.stop();\n    if (subject !== null) options.onEnded?.(subject);\n  };\n\n  const detach = [\n    guest.on('snapshot', ({ payload }) => {\n      const subject = options.mount(payload);\n      if (subject === null || ended) return;\n      if (mounted === null) {\n        mounted = subject;\n        options.onJoined?.(subject);\n      }\n    }),\n    guest.on('notice', ({ payload }) => {\n      options.notices?.fromWire(payload);\n    }),\n    guest.on('rejected', ({ payload }) => {\n      tappers.emit({\n        commandId: payload.commandId,\n        message: payload.message || 'The host rejected the action.',\n        type: 'rejected',\n      });\n    }),\n    guest.tap((event) => {\n      if (event.type !== 'status-change' && event.type !== 'peer-status-change') return;\n      if (event.type === 'peer-status-change' && event.peerId !== guest.host?.id) return;\n      if (event.status === 'failed' && mounted === null && !ended) {\n        options.onFailed?.('The host did not accept the answer in time.');\n      }\n      if (event.status === 'disconnected' || event.status === 'failed') endSession();\n    }),\n    guest.tap((event) => {\n      if (event.type === 'error') {\n        tappers.emit({ error: event.error, message: event.error.message, type: 'warning' });\n      }\n    }),\n  ];\n\n  try {\n    const answer = await guest.acceptInvitation(decoded, { name: options.name });\n    return {\n      answerText: await meshQrCodec.encode(answer),\n      guest: {\n        get disposalSignal() {\n          return guest.disposalSignal;\n        },\n        dispose: endSession,\n        get disposed() {\n          return ended;\n        },\n        sendCommand: (subjectId: string, name: string, args: readonly unknown[]): void => {\n          if (ended) throw new TavernDisposedError('The session has ended.');\n          guest.send('command', { args: [...args], id: commandId(), name, subjectId });\n        },\n        tap: tappers.tap,\n        [Symbol.dispose]() {\n          endSession();\n        },\n      },\n    };\n  } catch (error) {\n    // A failed join must not leave the node and its subscriptions behind.\n    endSession();\n    throw error instanceof MeshPairingError ? toPairingError(error) : error;\n  }\n}"
   }
 }