rfc6902

rfc6902 is a focused, dependency-free TypeScript library that implements two related IETF specifications: RFC 6902 (JSON Patch) and RFC 6901 (JSON Pointer). It gives you two complementary capabilities — computing a patch (a list of add/remove/replace/move/copy/test operations) that transforms one JavaScript object into another, and applying such a patch in place to mutate an object deterministically. Because both directions follow the same spec, patches produced by this library (or any other RFC 6902-compliant implementation) can be applied by it, and vice versa.

The library exposes a small, well-documented surface: createPatch(input, output, diff?) to compute a diff, applyPatch(object, patch, options?) to apply one, createTests(input, patch) to generate verification test operations, and a standalone Pointer class for working directly with JSON Pointer strings. It also hardens JSON Pointer traversal against prototype-pollution paths (__proto__, constructor, prototype), a defensive deviation from the strict spec that most other implementations lack.

What You Get

• createPatch(input, output) to compute the list of add/remove/replace/move/copy operations needed to transform one object into another
• applyPatch(object, patch, options?) to apply a patch array to an object in place, returning per-operation success/error results
• createTests(input, patch) to generate test operations that assert pre-existing values before a patch is applied
• A standalone Pointer class implementing RFC 6901 JSON Pointer parsing, escaping, and evaluation
• Typed Operation interfaces (AddOperation, RemoveOperation, ReplaceOperation, MoveOperation, CopyOperation, TestOperation) for full compile-time safety
• Built-in protection against prototype-pollution via __proto__/constructor/prototype pointer segments

Common Use Cases

• Computing and shipping minimal diffs between client and server object states instead of re-sending whole documents
• Implementing application/json-patch+json HTTP PATCH endpoints per RFC 6902
• Building undo/redo or change-tracking systems on top of typed JSON operations
• Validating that an object still matches expected values before applying a mutation, via createTests
• Synchronizing structured configuration or state documents between processes with auditable, replayable diffs

Under The Hood

Architecture The library is organized as three small, layered modules re-exported from a single index.ts entry point: pointer.ts defines the Pointer class (RFC 6901 JSON Pointer parsing, escaping, and evaluation) with no dependency on the other modules; diff.ts builds on Pointer to compute structural diffs (diffAny and its array/object specializations) and defines the typed Operation union; patch.ts builds on both to apply operations to a target object and defines the MissingError/TestError classes. This is a clean, acyclic dependency chain — Pointer at the base, diff and patch as independent consumers of it — with index.ts acting purely as a composition/export layer with no logic of its own. Changing the core Operation union would ripple through both diff and patch, but the modules otherwise have narrow, well-defined boundaries.

Tech Stack Written entirely in TypeScript (5.9) targeting ES5/CommonJS via tsc, with zero runtime dependencies. Tests run on ava with nyc for coverage, reporting to Coveralls; a browser-ready UMD bundle is produced with Rollup. Build/test/dist steps are plain npm scripts rather than a dedicated task runner, and CI is configured via a minimal .travis.yml.

Code Quality A substantial test suite under test/ exercises edge cases directly (broken adds, root-pointer operations, array splicing) and also runs the official cross-implementation json-patch-test-suite fixtures via test/json-patch-tests.ts, giving strong confidence in spec conformance beyond the library’s own hand-written cases. Errors are typed classes (MissingError, TestError) rather than generic thrown strings, and applyPatch returns a parallel results array so callers get structured per-operation outcomes instead of a single exception. tsconfig.json has strict enabled. There is no dedicated linter/formatter config (no ESLint/Prettier files) — style consistency relies on convention and the TypeScript compiler alone.

What Makes It Unique Most of the library is a faithful, unremarkable implementation of two IETF specs, which is itself valuable given how few JSON Patch libraries also implement JSON Pointer as a reusable standalone class. The one genuinely distinguishing choice is the deliberate, documented deviation from strict RFC 6901 compliance to block prototype-pollution: pointer segments matching __proto__, constructor, or prototype are short-circuited rather than followed, a defensive measure the author added specifically because most other JSON Patch implementations do not guard against it.