@dimina-kit/devtools 0.4.0 → 0.5.0

package/dist/main/services/workspace/workspace-service.js

@@ -1,16 +1,11 @@
-import { z } from 'zod';
+import { createCompileModeManager, openCompileModeStoreAfterCompile } from './workspace-compile-modes.js';
+import { rejectInvalidAppId, validateProjectDirSafe } from './open-project-guards.js';
 import * as repo from '../projects/project-repository.js';
-import { DEFAULT_COMPILE_CONFIG } from '../projects/types.js';
-import { clearSimulatorServicewechatReferer, setSimulatorServicewechatReferer, } from '../simulator/referer.js';
+import { reportRebuildStatus } from './rebuild-status.js';
+import { applyRefererForSession, clearRefererForSession } from './workspace-referer.js';
 import { loadWorkbenchSettings } from '../settings/index.js';
 import { createOpLock } from './op-lock.js';
-/**
- * Runtime guard for the adapter-return boundary: `session.appInfo` must carry a
- * NON-EMPTY string `appId` (the renderer scopes IPC by it; the bridge's
- * handleSpawn also rejects empty appIds, so accepting `''` would desync layers).
- * Loose: extra fields pass through — only the contract-critical `appId` is enforced.
- */
-const SessionAppInfoSchema = z.looseObject({ appId: z.string().min(1) });
+import { createThumbnailOps } from './workspace-thumbnails.js';
 /** Build a workspace service bound to the given workbench context. */
 export function createWorkspaceService(ctx) {
     let currentSession = null;
@@ -75,7 +70,7 @@ export function createWorkspaceService(ctx) {
         try {
             if (!opLock.isOwner(mySeq))
                 return true;
-            clearSimulatorServicewechatReferer();
+            clearRefererForSession(currentSession, currentProjectPath);
             // Switching projects tears down the embedded workbench editor (mirrors one
             // project's disk; saves would else hit the wrong project) AND the native
             // simulator (its 'destroyed' hook owns the bridge session). Back-to-list
@@ -87,6 +82,8 @@ export function createWorkspaceService(ctx) {
             // Invalidate the outgoing onLog generation before teardown so the dying
             // worker's buffered lines can't pollute the incoming compile timeline.
             logGeneration++;
+            // Dies with the outgoing session — no-op when none is open.
+            compileModes.disposeCurrent();
             await disposeSession();
             currentProjectPath = '';
             lastClosedProjectPath = '';
@@ -97,17 +94,22 @@ export function createWorkspaceService(ctx) {
         }
     }
     /**
-     * openProject critical section 2 — commit the new session under the lock, only
-     * if still the latest request. Returns false when superseded (caller discards
-     * the freshly-opened session instead of clobbering the newer one).
+     * openProject critical section 2 — commit the new session (and its
+     * compile-mode store handle) under the lock, only if still the latest
+     * request. Returns false when superseded (caller discards the
+     * freshly-opened session and store instead of clobbering the newer
+     * request's). `compileModes.adopt` must only run here, alongside
+     * `currentSession`/`currentProjectPath`, so the "current store" and
+     * "current session" always switch together.
      */
-    async function runOpenCommit(mySeq, session, projectPath) {
+    async function runOpenCommit(mySeq, session, projectPath, store) {
         const release = await opLock.acquire();
         try {
             if (!opLock.isOwner(mySeq))
                 return false;
             currentSession = session;
             currentProjectPath = projectPath;
+            compileModes.adopt(store);
             return true;
         }
         finally {
@@ -120,21 +122,16 @@ export function createWorkspaceService(ctx) {
      * a superseded session's buffered lines.
      */
     async function runCompile(projectPath, sessionGeneration) {
-        const { compile } = loadWorkbenchSettings();
+        const { compile, preview } = loadWorkbenchSettings();
         try {
             const session = await ctx.adapter.openProject({
                 projectPath,
                 sourcemap: true,
                 fileTypes: ctx.fileTypes,
-                watch: compile.watch,
-                onRebuild: () => {
-                    // getProjectPages never throws — failure yields the empty-pages
-                    // shape. Empty means "read failed or degenerate project" (a valid
-                    // app.json names ≥1 page) and is withheld so the renderer keeps its
-                    // previous dropdown instead of blanking; the push is never blocked.
-                    const { pages } = repo.getProjectPages(projectPath);
-                    sendStatus('ready', '编译完成，已重启', true, pages.length ? pages : undefined);
-                },
+                // Two independent gates: autoBuild = recompile on save; autoReload = reflect the rebuild in the simulator afterwards (off ⇒ page/form state survives). A style-only rebuild takes the in-place stylesheet hot-swap path (see reportRebuildStatus); any other change does a full reload.
+                watch: compile.autoBuild,
+                autoReload: preview.autoReload,
+                onRebuild: info => reportRebuildStatus(info, { projectPath, repo, autoReload: preview.autoReload, refreshSimulatorStyles: ctx.views.refreshSimulatorStyles, sendStatus }),
                 onBuildError: (err) => sendStatus('error', String(err)),
                 // Watcher died mid-session (EMFILE, permission loss, …): non-fatal, so 'ready' stays but `watcher: 'dead'` flags that saves no longer auto-rebuild.
                 onWatcherError: () => sendStatus('ready', '文件监听已停止，保存不再触发自动编译', false, undefined, true),
@@ -147,46 +144,46 @@ export function createWorkspaceService(ctx) {
             return { session };
         }
         catch (err) {
-            clearSimulatorServicewechatReferer();
+            // No appId resolved for this attempt; the outgoing project's own entry
+            // was already cleared by runOpenTeardown, so there is nothing to clear.
             return { error: String(err) };
         }
     }
-    /**
-     * Adapter-return boundary: a session without a string appId can't be driven by
-     * the renderer, so it must never become active. Close the live resources the
-     * adapter already spun up (best-effort) and return the error message; null when
-     * valid.
-     */
-    async function rejectInvalidAppId(session) {
-        if (SessionAppInfoSchema.safeParse(session.appInfo).success)
-            return null;
-        try {
-            await session.close();
-        }
-        catch (closeErr) {
-            console.warn('[workspace] closing appId-less adapter session failed (non-fatal):', closeErr);
-        }
-        return 'adapter returned session.appInfo without a string appId — '
-            + 'the CompilationAdapter must supply appInfo.appId';
-    }
-    function applyRefererFromSession(session) {
-        const appInfo = session.appInfo;
-        if (appInfo && typeof appInfo.appId === 'string' && appInfo.appId.length > 0) {
-            setSimulatorServicewechatReferer(appInfo.appId, typeof appInfo.version === 'string' ? appInfo.version : undefined);
-        }
-    }
     // Delegate to the host-injected (or default LocalProjectsProvider)
     // ProjectsProvider on the context. When the host omits an optional method,
     // we apply a safe documented default — never silently fall back to
     // `repo.*`, because a remote provider's project paths are not on the local
     // filesystem.
     const provider = ctx.projectsProvider;
+    // Owner of whichever project's compile modes are currently open; disposed/
+    // replaced alongside the session (teardown, openProject failures, close).
+    const compileModes = createCompileModeManager(provider, (change) => ctx.notify.compileModesChanged(change));
+    const thumbnails = createThumbnailOps({
+        ctx,
+        provider,
+        getSession: () => currentSession,
+        getProjectPath: () => currentProjectPath,
+    });
     return {
         listProjects: async () => provider.listProjects(),
         addProject: async (dirPath) => provider.addProject(dirPath),
         removeProject: async (dirPath) => {
             await provider.removeProject(dirPath);
         },
+        updateProject: async (dirPath, patch) => {
+            const projects = await provider.listProjects();
+            const existing = projects.find((p) => p.path === dirPath);
+            if (!existing)
+                throw new Error(`No such project: ${dirPath}`);
+            // A provider without `updateProject` cannot persist the edit. Returning
+            // the record unchanged would look like a successful save to the
+            // renderer (dialog closes, list reloads) while silently discarding the
+            // user's input, so this must fail loudly instead.
+            if (!provider.updateProject) {
+                throw new Error('当前宿主不支持编辑项目');
+            }
+            return provider.updateProject(dirPath, patch);
+        },
         hasProject: async (dirPath) => {
             const projects = await provider.listProjects();
             return projects.some((p) => p.path === dirPath);
@@ -215,7 +212,14 @@ export function createWorkspaceService(ctx) {
             // in-flight one; ownerSeq only grows, so a late-resolving earlier request
             // can't clobber a later one that already took over).
             opLock.takeOwnership(mySeq);
+            // Defer the workbench editor's heavy attach while this open's
+            // boot-critical window (old-session teardown + first compile) runs.
+            // The release is idempotent and bound to this hold, so every exit path
+            // below releases unconditionally; the gate's own cap timer backstops
+            // any future path that forgets to.
+            const releaseWorkbenchHold = ctx.views.holdWorkbenchAttach();
             if (await runOpenTeardown(mySeq)) {
+                releaseWorkbenchHold();
                 return { success: false, error: 'superseded by a newer project open/close' };
             }
             // Reject obviously broken projects up front so we never spin up a
@@ -225,10 +229,9 @@ export function createWorkspaceService(ctx) {
             // `fetch(…).then(r=>r.text()).then(JSON.parse)` pipeline dies on the
             // dev server's HTML SPA fallback with
             // `SyntaxError: Unexpected token '<', "<!doctype "…`.
-            const dirError = provider.validateProjectDir
-                ? await provider.validateProjectDir(projectPath)
-                : null;
+            const dirError = await validateProjectDirSafe(provider, projectPath);
             if (dirError) {
+                releaseWorkbenchHold();
                 sendStatus('error', dirError);
                 return { success: false, error: dirError };
             }
@@ -237,20 +240,35 @@ export function createWorkspaceService(ctx) {
             // generation — runCompile's onLog closure checks it per line.
             const sessionGeneration = ++logGeneration;
             const compiled = await runCompile(projectPath, sessionGeneration);
+            // The compile settling — success OR failure — ends the boot-critical
+            // window (a failed compile is when the user needs the editor most).
+            releaseWorkbenchHold();
             if ('error' in compiled) {
                 sendStatus('error', compiled.error);
                 return { success: false, error: compiled.error };
             }
             const session = compiled.session;
+            // Opened right after compile as a standalone handle — not yet current;
+            // every failure branch below disposes THIS handle, never the current
+            // store, since this open may no longer own "current" by the time it
+            // gets here.
+            const opened = await openCompileModeStoreAfterCompile(compileModes, projectPath, session);
+            if ('error' in opened) {
+                sendStatus('error', opened.error);
+                return { success: false, error: opened.error };
+            }
+            const store = opened.store;
             const appIdError = await rejectInvalidAppId(session);
             if (appIdError) {
+                store.dispose();
                 sendStatus('error', appIdError);
                 return { success: false, error: appIdError };
             }
-            if (!(await runOpenCommit(mySeq, session, projectPath))) {
-                // Superseded during the compile above — discard the freshly-opened
-                // session (close its live compile/dev-server) rather than clobber the
-                // newer request.
+            if (!(await runOpenCommit(mySeq, session, projectPath, store))) {
+                // Superseded — discard the freshly-opened session and its own store
+                // handle rather than clobber the newer request's (already-adopted)
+                // current store.
+                store.dispose();
                 try {
                     await session.close();
                 }
@@ -264,7 +282,7 @@ export function createWorkspaceService(ctx) {
                     provider.updateLastOpened(projectPath);
             });
             bestEffort('sendStatus', () => sendStatus('ready', '编译完成'));
-            bestEffort('applyReferer', () => applyRefererFromSession(session));
+            bestEffort('applyReferer', () => applyRefererForSession(session, projectPath));
             return {
                 success: true,
                 port: session.port,
@@ -273,9 +291,9 @@ export function createWorkspaceService(ctx) {
         },
         async closeProject() {
             // Claim a request seq and take ownership immediately (close has no veto),
-            // then serialize against a concurrent openProject: disposeAll() must not
-            // run while an open is mid-teardown/commit (it would tear down the views
-            // the open is building).
+            // then serialize against a concurrent openProject: disposeProjectViews()
+            // must not run while an open is mid-teardown/commit (it would tear down
+            // the views the open is building).
             const mySeq = opLock.nextSeq();
             opLock.takeOwnership(mySeq);
             const release = await opLock.acquire();
@@ -286,6 +304,11 @@ export function createWorkspaceService(ctx) {
                 // we meant to close.
                 if (!opLock.isOwner(mySeq))
                     return;
+                // Void any in-flight open's workbench attach hold BEFORE the teardown
+                // awaits below: the superseded open's compile can settle mid-close, and
+                // its release (or the gate's cap) must not rebuild the editor view for
+                // a project that is being closed.
+                ctx.views.cancelWorkbenchAttachHold();
                 // Mark the close in progress BEFORE disposeSession nulls currentSession,
                 // so bridge getters refuse to resolve the dying session during the
                 // session.close() await (cleared in the finally once views are gone).
@@ -293,14 +316,18 @@ export function createWorkspaceService(ctx) {
                 // Invalidate the active session's onLog BEFORE teardown starts — lines
                 // flushed by the dying compile worker must not reach the panel.
                 logGeneration++;
-                clearSimulatorServicewechatReferer();
+                compileModes.disposeCurrent(); // dies with the session
+                clearRefererForSession(currentSession, currentProjectPath);
                 await disposeSession();
                 // Record the root being torn down BEFORE clearing it, so a teardown/
                 // debounced write already in flight can still be accepted against it.
                 if (currentProjectPath !== '')
                     lastClosedProjectPath = currentProjectPath;
                 currentProjectPath = '';
-                ctx.views.disposeAll();
+                // Project-scoped views only. The host toolbar is HOST-scoped and must
+                // survive closing a project — its full teardown (disposeAll) runs from
+                // the context registry at app teardown instead.
+                ctx.views.disposeProjectViews();
             }
             finally {
                 closing = false;
@@ -312,85 +339,19 @@ export function createWorkspaceService(ctx) {
         getLastClosedProjectPath: () => lastClosedProjectPath,
         hasActiveSession: () => currentSession !== null,
         isClosing: () => closing,
-        async captureThumbnail(projectPath) {
-            if (!currentSession || projectPath !== currentProjectPath)
-                return null;
-            const simulatorWc = ctx.views.getSimulatorWebContents();
-            if (!simulatorWc)
-                return null;
-            if (ctx.views.getSimulatorProjectPath() !== projectPath)
-                return null;
-            const session = currentSession;
-            // Capture the active render-host guest (the mini-program content); the
-            // simulator WCV only holds the device-shell chrome. In native-host with no
-            // active guest (not mounted / mid page-switch / destroyed) return null
-            // rather than persist a device-shell frame as the page — that wrong-content
-            // frame is the bug this path exists to avoid. Non-native-host: the sim WCV.
-            const bridge = ctx.bridge;
-            const nativeHost = bridge?.isNativeHost() ?? false;
-            const renderGuest = nativeHost ? (bridge?.getActiveRenderWc() ?? null) : null;
-            if (nativeHost && !renderGuest)
-                return null;
-            const captureTarget = renderGuest ?? simulatorWc;
-            // A destroyed target means teardown is in flight (no valid frame) — return
-            // null rather than let capturePage() throw indistinguishably into the catch.
-            if (captureTarget.isDestroyed())
-                return null;
-            try {
-                const image = await captureTarget.capturePage();
-                if (currentSession !== session
-                    || currentProjectPath !== projectPath
-                    || ctx.views.getSimulatorWebContents() !== simulatorWc
-                    || ctx.views.getSimulatorProjectPath() !== projectPath
-                    // Captured target must still be the live one: a guest that navigated
-                    // mid-capture would otherwise persist a frame from the wrong page.
-                    || (nativeHost ? (bridge?.getActiveRenderWc() ?? null) : simulatorWc) !== captureTarget) {
-                    return null;
-                }
-                const dataUrl = `data:image/png;base64,${image.toPNG().toString('base64')}`;
-                if (provider.saveThumbnail) {
-                    await provider.saveThumbnail(projectPath, dataUrl);
-                }
-                // Always hand the renderer back the freshly-captured frame so the
-                // UI updates immediately even if the host's saveThumbnail is
-                // async or stores out-of-band.
-                return dataUrl;
-            }
-            catch {
-                return null;
-            }
-        },
-        async getThumbnail(projectPath) {
-            if (provider.getThumbnail) {
-                return (await provider.getThumbnail(projectPath)) ?? null;
-            }
-            return null;
-        },
+        captureThumbnail: thumbnails.captureThumbnail,
+        getThumbnail: thumbnails.getThumbnail,
         // `getProjectPages` reads the project's own `app.json` from disk and is
         // independent of the project registry — it stays on the repo helper.
         getProjectPages: (projectPath) => repo.getProjectPages(projectPath),
-        getCompileConfig: async (projectPath) => (provider.getCompileConfig
-            ? await provider.getCompileConfig(projectPath)
-            : DEFAULT_COMPILE_CONFIG),
-        saveCompileConfig: async (projectPath, config) => {
-            if (provider.saveCompileConfig) {
-                await provider.saveCompileConfig(projectPath, config);
-            }
-            // No persistence when the host opts out; the renderer's edits then
-            // do not survive a reload, matching the documented contract.
-        },
+        getCompileConfig: (projectPath) => compileModes.getCompileConfig(projectPath),
+        saveCompileConfig: (projectPath, config) => compileModes.saveCompileConfig(projectPath, config),
+        getCompileModeState: (projectPath) => compileModes.getCompileModeState(projectPath),
+        applyCompileModeCommand: (command) => compileModes.applyCompileModeCommand(command),
         // Per-project settings (uploadWithSourceMap etc.) live in the project's
         // own `project.config.json`, not the registry — keep direct repo calls.
         getProjectSettings: (projectPath) => repo.getProjectSettings(projectPath),
         updateProjectSettings: (projectPath, patch) => repo.updateProjectSettings(projectPath, patch),
-        getLaunchConfigs: async (p) => (provider.getLaunchConfigs ? await provider.getLaunchConfigs(p) : []),
-        saveLaunchConfigs: async (p, c) => { if (provider.saveLaunchConfigs)
-            await provider.saveLaunchConfigs(p, c); },
-        getActiveLaunchConfigId: async (p) => provider.getActiveLaunchConfigId ? await provider.getActiveLaunchConfigId(p) : null,
-        saveActiveLaunchConfigId: async (p, id) => {
-            if (provider.saveActiveLaunchConfigId)
-                await provider.saveActiveLaunchConfigId(p, id);
-        },
     };
 }
 //# sourceMappingURL=workspace-service.js.map

package/dist/main/services/workspace/workspace-thumbnails.d.ts

@@ -0,0 +1,22 @@
+import type { ProjectSession } from '../../../shared/types.js';
+import type { BridgeRouterHandle } from '../../ipc/bridge-router.js';
+import type { ViewManager } from '../views/view-manager.js';
+import type { ProjectsProvider } from '../projects/types.js';
+import type { WorkspaceService } from './workspace-service.js';
+/**
+ * `captureThumbnail`/`getThumbnail` split out of WorkspaceService purely to keep
+ * workspace-service.ts under the repo's file-length gate — the semantics (session/
+ * project-path ownership, provider round-trip) still belong entirely to that service.
+ * Takes a narrow slice of WorkbenchContext (views + bridge) rather than the whole
+ * grab-bag type, so this split doesn't grow the WorkbenchContext-import ratchet.
+ */
+export declare function createThumbnailOps(input: {
+    ctx: {
+        views: Pick<ViewManager, 'getSimulatorWebContents' | 'getSimulatorProjectPath'>;
+        bridge?: BridgeRouterHandle;
+    };
+    provider: ProjectsProvider;
+    getSession(): ProjectSession | null;
+    getProjectPath(): string;
+}): Pick<WorkspaceService, 'captureThumbnail' | 'getThumbnail'>;
+//# sourceMappingURL=workspace-thumbnails.d.ts.map

package/dist/main/services/workspace/workspace-thumbnails.js

@@ -0,0 +1,67 @@
+/**
+ * `captureThumbnail`/`getThumbnail` split out of WorkspaceService purely to keep
+ * workspace-service.ts under the repo's file-length gate — the semantics (session/
+ * project-path ownership, provider round-trip) still belong entirely to that service.
+ * Takes a narrow slice of WorkbenchContext (views + bridge) rather than the whole
+ * grab-bag type, so this split doesn't grow the WorkbenchContext-import ratchet.
+ */
+export function createThumbnailOps(input) {
+    const { ctx, provider, getSession, getProjectPath } = input;
+    return {
+        async captureThumbnail(projectPath) {
+            if (!getSession() || projectPath !== getProjectPath())
+                return null;
+            const simulatorWc = ctx.views.getSimulatorWebContents();
+            if (!simulatorWc)
+                return null;
+            if (ctx.views.getSimulatorProjectPath() !== projectPath)
+                return null;
+            const session = getSession();
+            // Capture the active render-host guest (the mini-program content); the
+            // simulator WCV only holds the device-shell chrome. In native-host with no
+            // active guest (not mounted / mid page-switch / destroyed) return null
+            // rather than persist a device-shell frame as the page — that wrong-content
+            // frame is the bug this path exists to avoid. Non-native-host: the sim WCV.
+            const bridge = ctx.bridge;
+            const nativeHost = bridge?.isNativeHost() ?? false;
+            const renderGuest = nativeHost ? (bridge?.getActiveRenderWc() ?? null) : null;
+            if (nativeHost && !renderGuest)
+                return null;
+            const captureTarget = renderGuest ?? simulatorWc;
+            // A destroyed target means teardown is in flight (no valid frame) — return
+            // null rather than let capturePage() throw indistinguishably into the catch.
+            if (captureTarget.isDestroyed())
+                return null;
+            try {
+                const image = await captureTarget.capturePage();
+                if (getSession() !== session
+                    || getProjectPath() !== projectPath
+                    || ctx.views.getSimulatorWebContents() !== simulatorWc
+                    || ctx.views.getSimulatorProjectPath() !== projectPath
+                    // Captured target must still be the live one: a guest that navigated
+                    // mid-capture would otherwise persist a frame from the wrong page.
+                    || (nativeHost ? (bridge?.getActiveRenderWc() ?? null) : simulatorWc) !== captureTarget) {
+                    return null;
+                }
+                const dataUrl = `data:image/png;base64,${image.toPNG().toString('base64')}`;
+                if (provider.saveThumbnail) {
+                    await provider.saveThumbnail(projectPath, dataUrl);
+                }
+                // Always hand the renderer back the freshly-captured frame so the
+                // UI updates immediately even if the host's saveThumbnail is
+                // async or stores out-of-band.
+                return dataUrl;
+            }
+            catch {
+                return null;
+            }
+        },
+        async getThumbnail(projectPath) {
+            if (provider.getThumbnail) {
+                return (await provider.getThumbnail(projectPath)) ?? null;
+            }
+            return null;
+        },
+    };
+}
+//# sourceMappingURL=workspace-thumbnails.js.map

package/dist/main/utils/ipc-context-source.d.ts

@@ -0,0 +1,40 @@
+import type { WebContents } from 'electron';
+import type { SenderPolicy } from './ipc-registry.js';
+/**
+ * Resolves which window context owns an incoming IPC sender.
+ *
+ * `register*Ipc` takes one of these instead of a bare context so a single
+ * handler body serves both shapes: one window (every accepted sender maps to
+ * that window's context) and several windows (each message is answered by the
+ * context of the window it actually came from).
+ */
+export interface IpcContextSource<T> {
+    /**
+     * Set only by the adapter over a context that carries no `senderPolicy` —
+     * narrow test contexts. It keeps {@link IpcRegistry} in its policy-less mode
+     * (accept every sender, skip the main-frame check), so wrapping such a
+     * context in a source is not itself a trust change.
+     */
+    readonly ungated?: boolean;
+    /** The context owning `sender`, or null when no context claims it. */
+    resolve(sender: WebContents): T | null;
+    /** Every context this source can hand out. */
+    list(): T[];
+}
+/**
+ * What every `register*Ipc` accepts: a router covering all live windows, or a
+ * single context standing in for itself.
+ */
+export type IpcInput<T> = T | IpcContextSource<T>;
+/** Structural test: a source exposes both members, a context exposes neither. */
+export declare function isIpcContextSource<T>(value: unknown): value is IpcContextSource<T>;
+/**
+ * Accept either a source or a single context. A single context gates on its
+ * own `senderPolicy` — the same predicate a policy-only registry applies — and
+ * owns every sender that predicate accepts. A context without a policy stays
+ * ungated so narrow test contexts keep the behaviour a bare registry gave them.
+ */
+export declare function toIpcContextSource<T extends {
+    senderPolicy?: SenderPolicy;
+}>(input: T | IpcContextSource<T>): IpcContextSource<T>;
+//# sourceMappingURL=ipc-context-source.d.ts.map

package/dist/main/utils/ipc-context-source.js

@@ -0,0 +1,23 @@
+/** Structural test: a source exposes both members, a context exposes neither. */
+export function isIpcContextSource(value) {
+    if (value == null || typeof value !== 'object')
+        return false;
+    const candidate = value;
+    return typeof candidate.resolve === 'function' && typeof candidate.list === 'function';
+}
+/**
+ * Accept either a source or a single context. A single context gates on its
+ * own `senderPolicy` — the same predicate a policy-only registry applies — and
+ * owns every sender that predicate accepts. A context without a policy stays
+ * ungated so narrow test contexts keep the behaviour a bare registry gave them.
+ */
+export function toIpcContextSource(input) {
+    if (isIpcContextSource(input))
+        return input;
+    const ctx = input;
+    const policy = ctx.senderPolicy;
+    if (!policy)
+        return { ungated: true, resolve: () => ctx, list: () => [ctx] };
+    return { resolve: (sender) => (policy(sender) ? ctx : null), list: () => [ctx] };
+}
+//# sourceMappingURL=ipc-context-source.js.map

package/dist/main/utils/ipc-registry.d.ts

@@ -1,6 +1,7 @@
-import type { IpcMainEvent, WebContents } from 'electron';
+import type { IpcMainEvent, IpcMainInvokeEvent } from 'electron';
 import { ipcMain } from 'electron';
-import { type Disposable } from '@dimina-kit/electron-deck/main';
+import { type Disposable, type IpcSenderPolicy } from '@dimina-kit/electron-deck/main';
+import type { IpcContextSource } from './ipc-context-source.js';
 type HandleFn = Parameters<typeof ipcMain.handle>[1];
 type ListenerFn = Parameters<typeof ipcMain.on>[1];
 /**
@@ -9,39 +10,63 @@ type ListenerFn = Parameters<typeof ipcMain.on>[1];
  * Returns true when the calling WebContents is allowed to invoke / emit on
  * the channel, false otherwise.
  */
-export type SenderPolicy = (sender: WebContents) => boolean;
+export type SenderPolicy = IpcSenderPolicy;
 /**
  * Tiny fluent helper that wraps every `ipcMain.handle` / `ipcMain.on` with a
  * matching removeHandler/removeListener registered into an internal registry.
  *
- * Each `register*Ipc(ctx)` returns one of these as a Disposable so the
+ * Each `register*Ipc(...)` returns one of these as a Disposable so the
  * workbench-level registry can dispose all built-in handlers in one shot.
  *
- * If a {@link SenderPolicy} is provided, every incoming invocation is gated:
- * - `handle`: rejected senders cause the invoke promise to reject with
- *   `Error('IPC sender rejected for channel <channel>')`.
- * - `on`: rejected senders are silently dropped (the original listener is
- *   never called).
- * In both cases a single `console.warn` is emitted with the channel name
- * and a short sender summary. Without a policy the wrapper is a no-op,
- * preserving backwards compatibility for unit tests and callers that
- * opted out.
+ * The constructor takes either a {@link SenderPolicy} (trust only: is this
+ * sender allowed?) or an {@link IpcContextSource} (trust plus ownership: which
+ * window context does this sender belong to?). With either, every incoming
+ * invocation is gated:
+ * - `handle` / `handleRouted`: rejected senders cause the invoke promise to
+ *   reject with `Error('IPC sender rejected for channel <channel>')`.
+ * - `on` / `onRouted`: rejected senders are silently dropped (the original
+ *   listener is never called).
+ * - `handleSync` / `handleSyncRouted`: rejected senders get a structured
+ *   `{ ok: false, code: 'EREJECTED', … }` returnValue, because sendSync blocks
+ *   the renderer until one is set.
+ * In every case a single `console.warn` is emitted with the channel name and a
+ * short sender summary. With no policy — or a source that declares itself
+ * `ungated` — the wrapper is a pass-through, preserving backwards
+ * compatibility for unit tests and callers that opted out.
+ *
+ * The `*Routed` variants hand the owning context to the handler as its first
+ * argument. `TCtx` is `never` unless the registry was built from a source, so
+ * they are unusable (and unreachable) on a policy-only registry.
  */
-export declare class IpcRegistry implements Disposable {
-    private policy?;
-    private registry;
-    constructor(policy?: SenderPolicy | undefined);
+export declare class IpcRegistry<TCtx = never> implements Disposable {
+    private cleanups;
+    private _disposed;
+    private readonly policy;
+    private readonly source;
+    /** False reproduces the policy-less pass-through exactly: no main-frame
+     * check, and a synchronous handler keeps its synchronous return value. */
+    private readonly gated;
+    constructor(policyOrSource?: SenderPolicy | IpcContextSource<TCtx>);
+    /** Trust gate and owner resolution for one incoming message. */
+    private admit;
+    private warnRejected;
+    private addInvokeHandler;
     handle(channel: string, fn: HandleFn): this;
+    /** {@link handle} answered by the context that owns the calling sender. */
+    handleRouted(channel: string, fn: (ctx: TCtx, event: IpcMainInvokeEvent, ...args: unknown[]) => unknown): this;
+    private addSyncHandler;
     /**
      * Register a SYNCHRONOUS `ipcRenderer.sendSync` handler. Unlike {@link on}
      * (fire-and-forget), the renderer is blocked until we set `event.returnValue`,
-     * so `fn` MUST be synchronous and return the value to hand back. The sender
-     * policy gates it like {@link handle}; a rejected sender or a thrown error
-     * yields a structured `{ ok: false, code, message }` returnValue instead of
-     * the silent drop `on` uses, so the blocked renderer always gets an answer.
+     * so `fn` MUST be synchronous and return the value to hand back.
      */
     handleSync(channel: string, fn: (event: IpcMainEvent, ...args: unknown[]) => unknown): this;
+    /** {@link handleSync} answered by the context that owns the calling sender. */
+    handleSyncRouted(channel: string, fn: (ctx: TCtx, event: IpcMainEvent, ...args: unknown[]) => unknown): this;
+    private addListener;
     on(channel: string, fn: ListenerFn): this;
+    /** {@link on} answered by the context that owns the calling sender. */
+    onRouted(channel: string, fn: (ctx: TCtx, event: IpcMainEvent, ...args: unknown[]) => unknown): this;
     dispose(): Promise<void>;
 }
 export {};