@dimina-kit/electron-deck 0.1.0-dev.20260610082053

package/dist/internal/deck-app.d.ts

@@ -0,0 +1,415 @@
+import type { Disposable, RuntimeBackend, Runtime, SenderPolicy, DeckConfig } from '../types.js';
+import type { MinimalBrowserWindow, MinimalElectron } from './electron-types.js';
+import type { LifecyclePhase } from './lifecycle-manager.js';
+import { type Scope } from '../main/scope.js';
+import { type CapabilityPolicy } from '../host/capability.js';
+import { type MinimalIpcMain, type MinimalWebContents } from './wire-transport.js';
+/**
+ * Optional dependencies for {@link DeckApp} —— Phase 3b 用于注入真 (或
+ * mock) Electron `ipcMain` + trusted webContents 集合，让 framework 接通跨进程
+ * wire transport。不注入则保持 Phase 2 main-internal-only 行为。
+ *
+ * @internal
+ */
+export interface DeckAppOptions {
+    readonly wireTransport?: {
+        readonly ipcMain: MinimalIpcMain;
+        /** 默认返回 framework 内部维护的 trusted set（Phase 4 由 windows.trust 填）。 */
+        readonly trustedWebContents?: () => readonly MinimalWebContents[];
+        /** 自定义 senderPolicy（默认按 trusted set 判断）。 */
+        readonly senderPolicy?: SenderPolicy;
+    };
+    /**
+     * Phase 4 — 注入真 (或 fake) Electron `BrowserWindow` / `WebContentsView`
+     * 构造器；提供后 framework 会装配 mainWindow / toolbarView / declared
+     * windows，否则保持 Phase 3b electron-unavailable 行为。
+     */
+    readonly electron?: MinimalElectron;
+    /**
+     * v2 — 领域 backend。提供后 framework 在 whenReady 前跑 `beforeReady`，
+     * 在 setup 阶段跑 `assemble(runtime)`。不提供则退化为纯框架（桩 context，
+     * 仅测试/演示用）。
+     */
+    readonly backend?: RuntimeBackend;
+}
+/**
+ * Framework-internal "app" object —— `electronDeck(config)` 顶层入口的 plain-class
+ * 形态，便于 Phase 2 测试驱动 lifecycle 转换。Phase 3b 加 wireTransport 注入
+ * 后可接真 ipcMain；Phase 4 加 electron 注入后可装配 mainWindow / toolbarView
+ * / declared windows。两者都不注入时退化为同进程内存 fake。
+ *
+ * @internal
+ */
+export declare class DeckApp {
+    readonly config: DeckConfig;
+    private readonly lifecycle;
+    private readonly registry;
+    private readonly bus;
+    private readonly ipc;
+    private readonly fwListeners;
+    private readonly trustSet;
+    /** P4 Phase B — privileged-command grant registry. The policy gates
+     *  ControlBus.dispatch; grants are minted via `runtime.grants.issue`. */
+    private readonly capability;
+    /** P4 Phase B — the grant-gated command bus for PRIVILEGED `layout.*`
+     *  commands. Constructed in `bindWireTransport` with the capability policy
+     *  injected, so `dispatch` default-DENIES any command lacking a live grant.
+     *  Privileged commands are registered via `runtime.layout.command`; ordinary
+     *  domain APIs stay on the un-gated `InMemoryTypedIpcRegistry`. */
+    private controlBus;
+    /** v2 — per-webContents backend `onWindowTrusted` Disposable, so a window's
+     *  trust mirror is undone when THAT window closes (not only at teardown). */
+    private readonly backendTrustDisposables;
+    private readonly options;
+    private wireTransport;
+    /** v2 — the live wire senderPolicy, reused by buildRuntime so
+     *  `context._senderPolicy` reflects real trust instead of a `() => true` stub. */
+    private wireSenderPolicy;
+    private mainWindow;
+    private toolbarView;
+    private readonly declaredWindows;
+    private readonly trackedWindows;
+    /**
+     * unified-lifetime P0 (observation-only, zero-regression). The root lifetime
+     * scope of the app + a shadow map mirroring `trackedWindows`, keyed by each
+     * window's webContents, carrying a per-window child Scope. P0 is PURELY
+     * OBSERVATIONAL: these windowScopes own NO resources (no destroy/trust/wire is
+     * moved onto them), so `rootScope.close()` during shutdown is a no-op for app
+     * behaviour — it exists only to lay the foundation P1 will take over. The
+     * shadow's key set is kept in lock-step with `trackedWindows` at every
+     * maintenance point.
+     */
+    private readonly rootScope;
+    private readonly lifetimeShadow;
+    /**
+     * unified-lifetime P1b: per-trusted-webContents trust record. `wcScope` is a
+     * child of the owning window's `windowScope`; it OWNS the wc's trust ref-count
+     * lease(s). When the window closes, `windowScope.close()` cascades into this
+     * `wcScope` (children-first LIFO), disposing every lease → ref-count hits 0 →
+     * the wc leaves the trust set. This replaces the imperative `deleteEntry`.
+     * A wc can be trusted more than once (framework auto-trust + host
+     * `windows.trust`), so `leases` is a Set.
+     */
+    private readonly wcRecords;
+    private readonly pendingWindowCreated;
+    private readonly pendingLoadFailed;
+    /**
+     * host-view slice 1 — per-window native-view substrate, keyed by the window's
+     * webContents (same key discipline as `lifetimeShadow`). Created at both
+     * window-construction sites; dropped in `handleSubWindowClosed`.
+     */
+    private readonly windowSubstrates;
+    /**
+     * P3 — per-adopted-window registration handle, keyed by the adopted window's
+     * webContents. `runtime.windows.adopt` is idempotent by wc identity: a second
+     * adopt of the same window returns this stored Disposable (no double-admit, no
+     * second substrate). The entry is removed when the registration is disposed
+     * (early un-adopt) or the window's windowScope closes.
+     */
+    private readonly adoptedWindows;
+    /**
+     * C1/C4 — per-registered-window {@link DeckWindow} facade + its per-window
+     * close deciders, keyed by the window's control wc. Populated by
+     * {@link registerWindow} for framework-created and adopted windows, plus the
+     * framework-built main window. `deciders` is an ORDERED list run in
+     * registration order on a close attempt; `closing` is the per-window in-flight
+     * decision latch (mirrors the main-window `closingDecisionPromise`).
+     */
+    private readonly windowRegistrations;
+    /** C1 — the framework-built main window's control wc, so `runtime.windows.main`
+     *  can resolve its {@link DeckWindow}. Null under an `ownsWindows:true` backend. */
+    private mainControlWc;
+    /** host-view slice 1 — monotonic id source for `runtime.view` native views. */
+    private viewSeq;
+    /**
+     * P2 — provenance map for `runtime.scopes.create()` sessions: maps an opaque
+     * {@link DeckSession} to its internal `rootScope.child()` Scope. A WeakMap so a
+     * dropped session is GC'd; the framework holds the scope's lifetime via
+     * rootScope anyway (the session scope is a rootScope child). `runtime.view`
+     * resolves a passed session through this map — a foreign/raw Scope is absent
+     * and therefore REJECTED.
+     */
+    private readonly sessions;
+    /**
+     * keepAlive B3.2 — opt-in per-group LRU of HIDDEN keep-alive views. Group key is
+     * `lru:${max}` (all `keepAlive:{policy:'lru',max:N}` views share one group per
+     * `max`). Each group holds an ORDERED list of HIDDEN view ids (front = least
+     * recently visible = first to evict) + a map from view id to its host handle so
+     * an eviction can dispose it (→ its WebContents is destroyed). Views created
+     * without `keepAlive` never participate.
+     */
+    private readonly keepAliveGroups;
+    /** C3: wcs that already have the `did-start-navigation` grant-reset hook bound,
+     *  so {@link bindNavigationGrantReset} is idempotent — a wc admitted to trust
+     *  more than once (e.g. constructed `autoTrust:false` then `windows.trust()`ed,
+     *  or un-adopted then re-adopted) never accumulates duplicate nav listeners. */
+    private readonly navHookBound;
+    /**
+     * slot-token registry (build-plan §2(e) / capability-and-lifecycle §A5-2):
+     * each anchored `placeIn` mints an unguessable token bound to (viewId, slotId,
+     * authorizedWcId). The `__electron-deck:place` apply path looks the token up,
+     * checks the sender is the authorized wc (anti-spoof), validates the placement,
+     * then `apply`s it. `resend` re-pushes the slot-grant (layout-subscribe replay).
+     */
+    private readonly slotTokens;
+    private slotSeq;
+    private _runtime;
+    private startCalled;
+    private shutdownPromise;
+    /** Set when shutdown is driven by the `will-quit` handler — the app is already
+     *  quitting, so `doShutdown()` must NOT re-`app.quit()` (re-entrant quit). */
+    private quitInitiated;
+    /** v2 close machine: non-null while a close decision is awaiting (in-flight latch). */
+    private closingDecisionPromise;
+    /** v2 close machine: set once a 'close' decision is committed (guards the
+     *  window between decision-resolve and the 'closed' event). Never resets. */
+    private shuttingDown;
+    /** Idempotency latch for {@link runShutdownCleanup}: the cleanup body
+     *  (beforeClose → backend.onShutdown → rootScope.close) must run AT MOST ONCE.
+     *  Both `doShutdown` (single-flight via shutdownPromise) AND `cleanupOnError`
+     *  (which bypasses that promise) reach here; and `rootScope.close()` inside the
+     *  body can synchronously fire a framework window's `'closed'` → `shutdown()`
+     *  re-entry. Without this latch that re-entry would invoke `backend.onShutdown`
+     *  a second time.
+     *
+     *  This is a JOIN, not a boolean early-return: a re-entrant caller AWAITS the
+     *  SAME in-flight cleanup promise instead of returning immediately. A plain
+     *  `if (ran) return` let a concurrent shutdown skip past an in-flight cleanup
+     *  and force `app.quit()` mid-teardown (truncation). Never resets. */
+    private cleanupPromise;
+    constructor(config: DeckConfig, options?: DeckAppOptions);
+    get phase(): LifecyclePhase;
+    get runtime(): Runtime;
+    start(): Promise<void>;
+    /**
+     * Process-level Electron lifecycle bindings (post-whenReady, independent of
+     * `ownsWindows` — these are app events, not window events):
+     * - `will-quit` → framework teardown (idempotent via `shutdownPromise`).
+     * - `window-all-closed` → bound ONLY when `quitOnAllWindowsClosed` is set
+     *   (opt-in; omitted leaves Electron's default / the consumer's own handler).
+     * - `second-instance` → backend hook, bound only under `singleInstance`.
+     */
+    private bindAppLifecycle;
+    shutdown(): Promise<void>;
+    /**
+     * @internal Phase 4 windows.trust() / framework 内部添加 trusted webContents.
+     * Backend-owned / untracked-window fallback: there is no framework windowScope
+     * for these (the backend manages their lifetime), so the trust lease is owned
+     * by `rootScope` as an app-shutdown backstop. The backend still disposes the
+     * returned handle early when it untrusts / destroys its own window.
+     */
+    _trustWebContents(wc: MinimalWebContents): Disposable;
+    /**
+     * unified-lifetime P1b: admit `wc` to the trust set under `windowScope`. Gets
+     * or creates the wc's `wcScope` (a child of `windowScope`), takes a fresh
+     * `trustSet.admit(wc, wcScope)` ref-count lease OWNED BY that wcScope, and returns a
+     * one-shot host-facing Disposable that releases just THIS lease early. On
+     * `wcScope.close()` (window-close cascade) every still-held lease is disposed
+     * → ref-count zeroes → the wc leaves the set (equivalent to the old
+     * `deleteEntry`, but driven by Scope teardown and covering partially-built
+     * windows too). Idempotent registry cleanup is owned by the wcScope.
+     */
+    private admitTrust;
+    /**
+     * C3 (P0 security) — bind the main-frame cross-document navigation grant-reset
+     * hook on a control `wc`. On a MAIN-FRAME CROSS-DOCUMENT navigation
+     * (`isMainFrame && !isInPlace`) this SYNCHRONOUSLY revokes the wc's capability
+     * grants (`capability.revokeBySenderId`) and slot tokens, so the navigated-to
+     * document can't inherit the prior page's privileges. Trust is LEFT INTACT (the
+     * wc stays the framework's control surface) — we deliberately do NOT tear down
+     * its `wcScope`, because that would dispose the trust lease and force an async
+     * re-admit gap that breaks `runtime.grants.issue`. In-place (hash/pushState) and
+     * sub-frame navigations are ignored; the initial document load is a no-op (no
+     * grants exist yet).
+     *
+     * Must be called AFTER {@link admitTrust} so the wc's `wcScope` exists. The
+     * `wc.on` guard tolerates the minimal fakes that lack an EventEmitter surface.
+     */
+    private bindNavigationGrantReset;
+    /**
+     * C1 — build the {@link DeckWindow} facade over a registered window and record
+     * it (so `runtime.windows.create()` / `runtime.windows.main` can return it and
+     * the per-window close machine can find its deciders). `newSession()` mints a
+     * window-rooted {@link DeckSession} (a `windowScope.child()` registered in the
+     * SAME provenance WeakMap as `runtime.scopes.create()`); `onClose()` appends a
+     * per-window decider.
+     */
+    private buildDeckWindow;
+    /**
+     * Resolve a window argument that may be either a raw `BrowserWindow` (the
+     * historical `runtime.view().placeIn(window)` shape) OR a {@link DeckWindow}
+     * handle (the C1 `runtime.windows.create()` return). A DeckWindow exposes the
+     * underlying window via `.window` and has no `.webContents` of its own; a raw
+     * window has `.webContents`. Unwrap so the substrate lookup keys off the real
+     * control webContents either way — keeping the `placeIn(deckWindow)` and
+     * `placeIn(deckWindow.window)` call shapes both valid (additive, no break).
+     */
+    private resolveWindowArg;
+    /**
+     * C4 — run a registered window's per-window close deciders (registration order;
+     * any `'keep'` vetoes), with an in-flight latch so a re-entrant close during a
+     * pending decision decides ONCE. A throw / rejection fails CLOSED. Returns the
+     * committed decision, or `null` when the decision is still in flight / there are
+     * no deciders (caller falls back). Mirrors the main-window decision machine.
+     */
+    private runWindowCloseDeciders;
+    /**
+     * C4 — arm the per-window cancelable close-decision machine on a CREATED /
+     * adopted window. On a `close` attempt: `preventDefault`, dispatch the
+     * per-window deciders behind an in-flight latch (re-entrant closes swallowed),
+     * and on a `'close'` decision `win.destroy()` (→ `'closed'` → revoke +
+     * windowScope cascade). A `'keep'` clears the latch so the next close re-decides.
+     * Only armed when at least one decider can exist (i.e. the window has a
+     * registration) — windows with no per-window deciders fall through to Electron's
+     * default close (the framework does not preventDefault).
+     */
+    private armSubWindowCloseMachine;
+    /**
+     * @internal unified-lifetime P0 accessors (observation-only). The live shadow
+     * map mirroring `trackedWindows`, the root Scope, and a consistency assertion.
+     */
+    __lifetimeShadow(): Map<MinimalWebContents, {
+        window: MinimalBrowserWindow;
+        windowScope: Scope;
+    }>;
+    /** @internal unified-lifetime P0: the root lifetime Scope. */
+    __rootScope(): Scope;
+    /** @internal unified-lifetime P1b: the per-trusted-wc trust records. */
+    __wcRecords(): Map<MinimalWebContents, {
+        wcScope: Scope;
+        leases: Set<Disposable>;
+        windowScope: Scope;
+    }>;
+    /** @internal P4 Phase B: the live capability policy (grant gate reads it). */
+    __capabilityPolicy(): CapabilityPolicy;
+    /**
+     * @internal unified-lifetime P0 invariant (A): the shadow's per-window set
+     * (the `window` of each entry) must equal `trackedWindows` membership. Throws
+     * if violated; no-op otherwise.
+     */
+    __assertLifetimeConsistent(): void;
+    private bindDeclarativeFields;
+    /**
+     * host-view slice 1 — build a per-window {@link ViewSubstrate}. The
+     * `ContentViewHost` adapts `win.contentView` and tracks the Compositor-managed
+     * z-order in `order` (the minimal `contentView` has no `children()`). The
+     * substrate's `detachAll` is owned on `windowScope` AFTER the window's
+     * `win.destroy` own, so LIFO teardown runs detachAll (STEP1) BEFORE destroy
+     * (STEP4) — the A4 ordering.
+     */
+    private createWindowSubstrate;
+    private assembleElectron;
+    /** Phase 4 race fix：在 wireTransport.start 之后再 loadURL/loadFile。 */
+    private loadAssembledSources;
+    /**
+     * #3 R5/C2 — load is best-effort: log + emit `load-failed` if it rejects,
+     * but never let start() reject because of a renderer load issue (we'd
+     * leave the host blocked indefinitely while the framework is otherwise
+     * happy).
+     */
+    private safeLoad;
+    /**
+     * D1 fix: load-failed 在 listener 注册之前到达时 buffer 到 pendingLoadFailed；
+     * 第一个 listener 注册时 splice 消费整个队列。已有 listener 时直接 emit。
+     */
+    private surfaceLoadFailed;
+    private bindWireTransport;
+    /**
+     * The two-route boundary's privileged-name predicate (§A5-1.2 硬约束). A
+     * PRIVILEGED command name — by convention `layout.*` — routes through the
+     * grant-gated {@link ControlBus} (`controlBus.dispatch`). Ordinary domain
+     * APIs (any other name) stay on the un-gated declarative `hostServices`
+     * route. Privileged names MUST NOT be registered in `hostServices`.
+     */
+    private isPrivilegedCommandName;
+    /**
+     * KA-4: warn ONCE about an invalid `keepAlive.max` (negative / non-integer /
+     * NaN). Such a view is not keep-alive-managed (the group is skipped); warning
+     * once avoids log spam when many views share the same bad config.
+     */
+    private warnedInvalidKeepAliveMax;
+    private warnInvalidKeepAliveMax;
+    private constructWindow;
+    /**
+     * P3 — register an EXTERNALLY-created window into the framework so
+     * `runtime.view().placeIn(win)` works for it: a `rootScope.child()`
+     * windowScope, a per-window {@link ViewSubstrate}, and the TRUST lifecycle —
+     * mirroring {@link constructWindow}'s registration, but for a window the host
+     * built (e.g. under `ownsWindows:true`). The framework holds NO windowScope /
+     * substrate / trust for such a window until this call.
+     *
+     * Ordering MIRRORS the framework's own windows (constructWindow / main-window):
+     *  1) build the windowScope (child of rootScope so shutdown cascades it),
+     *  2) build + register the per-window substrate (so placeIn can resolve it),
+     *  3) for `ownership:'transfer'` ONLY, OWN `() => win.destroy()` on the
+     *     windowScope so app shutdown destroys the window; for `'observe'` the host
+     *     keeps lifetime control (the framework never destroys it),
+     *  4) arm trust+grant+slot-token revocation as the FIRST `'closed'` listener via
+     *     `prependListener` (codex R2 — runs before any external `'closed'` listener),
+     *  5) `admitTrust` AFTER the revoke listener is registered (constructWindow order).
+     *
+     * Idempotent by webContents identity: a second adopt of the same window returns
+     * the existing registration. Throws if the window/webContents is destroyed.
+     */
+    private adoptWindow;
+    /**
+     * unified-lifetime P1b: synchronously revoke BOTH trust leases AND capability
+     * grants for every wc admitted under `windowScope` (the window's control wc +
+     * any siblings like the toolbar wc). Called from the window's 'closed' handler
+     * so both authorizations are gone the instant the window is destroyed —
+     * matching the old synchronous `deleteEntry` timing and closing every
+     * async-cascade race (a destroyed wc can never be observed trusted OR granted
+     * by a later shutdown/beforeClose, nor by a NEW window that reuses the same
+     * wc.id before the async scope cascade revokes it). The leases are ALSO owned
+     * by their wcScope, so the async `windowScope.close()` still runs (it disposes
+     * the already-disposed leases idempotently, plus win.destroy + wcRecords
+     * cleanup) and remains the teardown/partial-init fallback for paths where no
+     * 'closed' fires (cleanupOnError, shutdown of a never-closed window).
+     * `lease.dispose()` is synchronous (trustSet ref-count--) and one-shot, so no
+     * double-decrement; `revokeBySenderId` is likewise idempotent, so the grant's
+     * own async `senderScope.on('closed')` revoke later becomes a no-op.
+     */
+    private revokeWindowTrust;
+    /**
+     * Arm the wire's slot-token inbound channels (idempotent). P5 eager-arm:
+     * called once at framework start() (bindWireTransport, right after
+     * transport.start()) so a layout client can subscribe before the first
+     * anchored placeIn; the anchored `placeIn` call site is now a redundant no-op
+     * (kept for safety). No-op when there's no wire transport (main-internal-only
+     * builds can't serve a renderer slot anyway).
+     */
+    private ensureSlotChannelsArmed;
+    /**
+     * slot-token apply path (`__electron-deck:place`). The token is the credential:
+     * look it up, verify the sender IS the wc the token was granted to (anti-spoof),
+     * validate the placement, then apply. Any failure → DROP (silent).
+     */
+    private handleSlotPlace;
+    /**
+     * Per-wc layout-subscribe replay (`__electron-deck:layout-subscribe`). When the
+     * authorized control wc (re)subscribes (e.g. after reload), re-push every grant
+     * it owns so it can re-bind its DOM slots. A DIFFERENT wc's subscribe never
+     * receives another wc's grants.
+     */
+    private handleLayoutSubscribe;
+    /** Drop every slot token authorized to `wcId` (window-close / shutdown hygiene). */
+    private revokeSlotTokensForWc;
+    private handleSubWindowClosed;
+    /**
+     * v2 — notify the backend that the framework has edge-trusted one of its
+     * (framework-built) webContents, so the backend can mirror it into the domain
+     * trust set. The returned Disposable is disposed when THAT window closes
+     * ({@link handleSubWindowClosed}) — honouring the contract "framework disposes
+     * on untrust / window destroy" — and is also added to the registry as a
+     * teardown safety net (e.g. the main window, which dies with the app). The
+     * wrapper is one-shot so the two paths don't double-dispose.
+     */
+    private _notifyBackendTrusted;
+    private emitFrameworkEvent;
+    private cleanupOnError;
+    private doShutdown;
+    private runShutdownCleanup;
+    private doShutdownCleanup;
+    private buildRuntime;
+}
+//# sourceMappingURL=deck-app.d.ts.map

package/dist/internal/deck-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deck-app.d.ts","sourceRoot":"","sources":["../../src/internal/deck-app.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACX,UAAU,EAIV,cAAc,EACd,OAAO,EACP,YAAY,EAIZ,UAAU,EASV,MAAM,aAAa,CAAA;AAIpB,OAAO,KAAK,EAEX,oBAAoB,EAEpB,eAAe,EAGf,MAAM,qBAAqB,CAAA;AAM5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAE5D,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAQ1D,OAAO,EAEN,KAAK,gBAAgB,EACrB,MAAM,uBAAuB,CAAA;AAK9B,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,MAAM,qBAAqB,CAAA;AAQ5B;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE;QACxB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;QAChC,mEAAmE;QACnE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,SAAS,kBAAkB,EAAE,CAAA;QACjE,4CAA4C;QAC5C,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAA;KACpC,CAAA;IACD;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAA;IACnC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAA;CACjC;AAiDD;;;;;;;GAOG;AACH,qBAAa,OAAO;IACnB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAE3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAiB;IACrC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAiC;IACrD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoE;IAChG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD;6EACyE;IACzE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD;;;;uEAImE;IACnE,OAAO,CAAC,UAAU,CAA0B;IAC5C;iFAC6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA4C;IACpF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,aAAa,CAA6B;IAClD;sFACkF;IAClF,OAAO,CAAC,gBAAgB,CAA4B;IACpD,OAAO,CAAC,UAAU,CAAoC;IACtD,OAAO,CAAC,WAAW,CAAsC;IACzD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAC1E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAkC;IACjE;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuB;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAG5B;IACH;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAGvB;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA0B;IAC5D;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+C;IAChF;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA4C;IAC3E;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAWjC;IACH;wFACoF;IACpF,OAAO,CAAC,aAAa,CAAkC;IACvD,+EAA+E;IAC/E,OAAO,CAAC,OAAO,CAAI;IACnB;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAG7B;IACH;;;oFAGgF;IAChF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoC;IACjE;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAGxB;IACH,OAAO,CAAC,OAAO,CAAI;IACnB,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,WAAW,CAAQ;IAC3B,OAAO,CAAC,eAAe,CAA6B;IACpD;kFAC8E;IAC9E,OAAO,CAAC,aAAa,CAAQ;IAC7B,uFAAuF;IACvF,OAAO,CAAC,sBAAsB,CAAyC;IACvE;iFAC6E;IAC7E,OAAO,CAAC,YAAY,CAAQ;IAC5B;;;;;;;;;;;0EAWsE;IACtE,OAAO,CAAC,cAAc,CAA6B;gBAEvC,MAAM,EAAE,UAAU,EAAE,OAAO,GAAE,cAAmB;IAwB5D,IAAI,KAAK,IAAI,cAAc,CAE1B;IAED,IAAI,OAAO,IAAI,OAAO,CAKrB;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAiF5B;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IAwBxB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAMzB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,EAAE,kBAAkB,GAAG,UAAU;IAIrD;;;;;;;;;OASG;IACH,OAAO,CAAC,UAAU;IAkClB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,wBAAwB;IA+BhC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAmDvB;;;;;;;;OAQG;IACH,OAAO,CAAC,gBAAgB;IAQxB;;;;;;OAMG;YACW,sBAAsB;IAoBpC;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IA8BhC;;;OAGG;IACH,gBAAgB,IAAI,GAAG,CAAC,kBAAkB,EAAE;QAAE,MAAM,EAAE,oBAAoB,CAAC;QAAC,WAAW,EAAE,KAAK,CAAA;KAAE,CAAC;IAIjG,8DAA8D;IAC9D,WAAW,IAAI,KAAK;IAIpB,wEAAwE;IACxE,WAAW,IAAI,GAAG,CAAC,kBAAkB,EAAE;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAAC,WAAW,EAAE,KAAK,CAAA;KAAE,CAAC;IAIvG,8EAA8E;IAC9E,kBAAkB,IAAI,gBAAgB;IAItC;;;;OAIG;IACH,0BAA0B,IAAI,IAAI;IAiBlC,OAAO,CAAC,qBAAqB;IAoC7B;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;IAmD7B,OAAO,CAAC,gBAAgB;IAqOxB,mEAAmE;IACnE,OAAO,CAAC,oBAAoB;IAmB5B;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;IAehB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,iBAAiB;IAiGzB;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAI/B;;;;OAIG;IACH,OAAO,CAAC,yBAAyB,CAAQ;IACzC,OAAO,CAAC,uBAAuB;IAS/B,OAAO,CAAC,eAAe;IAqFvB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,WAAW;IA0GnB;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,iBAAiB;IAczB;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB;IAO/B;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IAM7B,oFAAoF;IACpF,OAAO,CAAC,qBAAqB;IAM7B,OAAO,CAAC,qBAAqB;IAuC7B;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAmB7B,OAAO,CAAC,kBAAkB;YAiBZ,cAAc;YAOd,UAAU;IA8BxB,OAAO,CAAC,kBAAkB;YAYZ,iBAAiB;IAkF/B,OAAO,CAAC,YAAY;CAupBpB"}

package/dist/internal/electron-types.d.ts

@@ -0,0 +1,131 @@
+/**
+ * Phase 4 — minimal structural typing for the Electron surface the electron-deck
+ * framework needs to assemble its real windows / views. Tests inject a plain
+ * object satisfying these shapes via {@link DeckAppOptions.electron};
+ * the framework does **not** import 'electron' directly.
+ *
+ * Mirror of {@link wire-transport.ts}'s `MinimalIpcMain` / `MinimalWebContents`
+ * style — narrow enough to express the contract, wide enough for tests to fake
+ * with `vi.fn()`.
+ *
+ * @internal
+ */
+export interface MinimalRect {
+    x: number;
+    y: number;
+    width: number;
+    height: number;
+}
+export interface MinimalBrowserWindowOptions {
+    width?: number;
+    height?: number;
+    minWidth?: number;
+    minHeight?: number;
+    title?: string;
+    icon?: string;
+    modal?: boolean;
+    show?: boolean;
+    backgroundColor?: string;
+    parent?: MinimalBrowserWindow;
+    /**
+     * Carries the merged window prefs (framework defaults + `config.app.window`
+     * + backend `mainWindowWebPreferences()`); `preload` is the one key the
+     * framework itself sets for declared/toolbar webviews.
+     */
+    webPreferences?: Record<string, unknown> & {
+        preload?: string;
+    };
+}
+export interface MinimalWebContentsLike {
+    readonly id: number;
+    loadURL(url: string): Promise<void>;
+    loadFile(path: string): Promise<void>;
+    send(channel: string, payload: unknown): void;
+    /**
+     * Destroy the backing renderer (Electron's `webContents.close()`). Guard with
+     * `isDestroyed()` for idempotence — never double-close. Optional so legacy fakes
+     * that never need it keep compiling; the real Electron `webContents` always has it.
+     * Typed as `Function` (not `() => void`) on purpose: test fakes assign a bare
+     * `vi.fn()` Mock whose `Mock<Procedure | Constructable>` carries a construct
+     * signature that is not assignable to a plain call signature — only `Function`
+     * (or `unknown`) accepts it. Callers invoke it as `close?.()`.
+     */
+    close?: Function;
+    isDestroyed(): boolean;
+}
+export interface MinimalContentView {
+    addChildView(view: MinimalWebContentsView): void;
+    removeChildView(view: MinimalWebContentsView): void;
+    /** The window's live child views (real Electron `View.children`). Used by the
+     *  moveTo rollback to guard against removing a child the dest never added
+     *  (codex P0 round-3 BUG 2). Optional so existing fakes stay valid; an absent
+     *  array is treated as "membership unknown" by the guard's `?? []`. */
+    readonly children?: readonly MinimalWebContentsView[];
+}
+export interface MinimalBrowserWindow {
+    readonly id: number;
+    readonly webContents: MinimalWebContentsLike;
+    readonly contentView: MinimalContentView;
+    getContentBounds(): MinimalRect;
+    show(): void;
+    destroy(): void;
+    isDestroyed(): boolean;
+    /** `close` is cancelable (preventDefault); `resize`/`closed` listeners ignore the arg. */
+    on(event: 'resize' | 'closed' | 'close', listener: (e?: {
+        preventDefault(): void;
+    }) => void): MinimalBrowserWindow;
+    /**
+     * Register a listener at the FRONT of the listener list (Electron's
+     * EventEmitter `prependListener` — prepended listeners run BEFORE any earlier
+     * `on`-added listener for the same event). The framework uses this to arm an
+     * adopted window's trust/grant revocation so it runs FIRST on `'closed'`,
+     * before any external `'closed'` listener the host registered earlier.
+     *
+     * Optional so legacy fakes that never adopt a window keep compiling without it;
+     * the real Electron `BrowserWindow` (an EventEmitter) always provides it, and
+     * `runtime.windows.adopt` requires it at runtime. Typed as a bare `Function`
+     * (like `close`) so a test fake can assign a plain `vi.fn()` Mock — whose
+     * `Mock<Procedure | Constructable>` carries a construct signature that a strict
+     * call signature rejects. Callers invoke it as `win.prependListener('closed', fn)`.
+     */
+    prependListener?: Function;
+}
+export interface MinimalWebContentsView {
+    readonly webContents: MinimalWebContentsLike;
+    setBounds(rect: MinimalRect): void;
+}
+/**
+ * Minimal `app` surface the framework needs to own the Electron process
+ * lifecycle as the sole orchestrator. Only methods the framework calls on the
+ * host's behalf belong here — host-specific app APIs (dock, getPath, …) go
+ * through `runtime.electron.app`. Injected via {@link MinimalElectron.app};
+ * the framework never `import`s 'electron'.
+ */
+export interface MinimalApp {
+    /** Gating: the framework must `await` this before constructing any window. */
+    whenReady(): Promise<void>;
+    /** Pre-ready: set the default app/dock name (best-effort). */
+    setName(name: string): void;
+    /** Process lifecycle: drives shutdown / quit-on-all-closed. */
+    on(event: 'will-quit' | 'before-quit' | 'window-all-closed' | 'second-instance', listener: (e?: {
+        preventDefault(): void;
+    }) => void): MinimalApp;
+    quit(): void;
+    /** Opt-in single-instance; only called when `config.app.singleInstance`. */
+    requestSingleInstanceLock?(): boolean;
+}
+export interface MinimalElectron {
+    readonly BrowserWindow: new (opts?: MinimalBrowserWindowOptions) => MinimalBrowserWindow;
+    readonly WebContentsView: new (opts?: {
+        webPreferences?: {
+            preload?: string;
+        };
+    }) => MinimalWebContentsView;
+    /**
+     * Optional `app` surface. Present on the production path (lazy-imported real
+     * electron) and when tests exercise the whenReady gate; absent in legacy
+     * fakes that only assemble windows — the gate is then skipped (back-compat).
+     */
+    readonly app?: MinimalApp;
+}
+//# sourceMappingURL=electron-types.d.ts.map

package/dist/internal/electron-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"electron-types.d.ts","sourceRoot":"","sources":["../../src/internal/electron-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,WAAW;IAC3B,CAAC,EAAE,MAAM,CAAA;IACT,CAAC,EAAE,MAAM,CAAA;IACT,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,2BAA2B;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,MAAM,CAAC,EAAE,oBAAoB,CAAA;IAC7B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/D;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IAC7C;;;;;;;;OAQG;IAEH,KAAK,CAAC,EAAE,QAAQ,CAAA;IAChB,WAAW,IAAI,OAAO,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IAClC,YAAY,CAAC,IAAI,EAAE,sBAAsB,GAAG,IAAI,CAAA;IAChD,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,IAAI,CAAA;IACnD;;;2EAGuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAA;CACrD;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAA;IAC5C,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAA;IACxC,gBAAgB,IAAI,WAAW,CAAA;IAC/B,IAAI,IAAI,IAAI,CAAA;IACZ,OAAO,IAAI,IAAI,CAAA;IACf,WAAW,IAAI,OAAO,CAAA;IACtB,0FAA0F;IAC1F,EAAE,CACD,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,EACpC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE;QAAE,cAAc,IAAI,IAAI,CAAA;KAAE,KAAK,IAAI,GAChD,oBAAoB,CAAA;IACvB;;;;;;;;;;;;;OAaG;IAEH,eAAe,CAAC,EAAE,QAAQ,CAAA;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAA;IAC5C,SAAS,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;CAClC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IAC1B,8EAA8E;IAC9E,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,8DAA8D;IAC9D,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,+DAA+D;IAC/D,EAAE,CACD,KAAK,EAAE,WAAW,GAAG,aAAa,GAAG,mBAAmB,GAAG,iBAAiB,EAC5E,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE;QAAE,cAAc,IAAI,IAAI,CAAA;KAAE,KAAK,IAAI,GAChD,UAAU,CAAA;IACb,IAAI,IAAI,IAAI,CAAA;IACZ,4EAA4E;IAC5E,yBAAyB,CAAC,IAAI,OAAO,CAAA;CACrC;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,aAAa,EAAE,KAAK,IAAI,CAAC,EAAE,2BAA2B,KAAK,oBAAoB,CAAA;IACxF,QAAQ,CAAC,eAAe,EAAE,KAAK,IAAI,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,KAAK,sBAAsB,CAAA;IAC1G;;;;OAIG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAA;CACzB"}

package/dist/internal/event-bus.d.ts

@@ -0,0 +1,29 @@
+import type { Disposable, HostEvent, JsonValue } from '../types.js';
+/**
+ * Framework-internal event bus。
+ *
+ * 责任：
+ * - `bindDeclaredEvents(events)`：在 Bind 阶段调；对每个声明的 HostEvent，调用
+ *   framework binder，让该 event 的 `publish()` 走 bus。
+ * - `publish(name, payload)`：通知 `subscribe(name, ...)` 注册的所有 listener。
+ * - `subscribe(name, listener)`：返回 `Disposable`，dispose 后停止通知。
+ * - `unbindAll()`：解绑所有 declared event publisher + 清空 subscribers。
+ *
+ * @internal
+ */
+export declare class EventBus {
+    private readonly subscribers;
+    private readonly allSubscribers;
+    private readonly inFlight;
+    private boundEvents;
+    bindDeclaredEvents(events: readonly HostEvent<JsonValue>[]): void;
+    publish(name: string, payload: JsonValue): void;
+    subscribe(name: string, listener: (payload: JsonValue) => void): Disposable;
+    /**
+     * 订阅所有 channel 的 publish —— framework wire-transport 把 declared
+     * HostEvent.publish() 桥到 webContents.send 时用。
+     */
+    subscribeAll(listener: (name: string, payload: JsonValue) => void): Disposable;
+    unbindAll(): void;
+}
+//# sourceMappingURL=event-bus.d.ts.map

package/dist/internal/event-bus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-bus.d.ts","sourceRoot":"","sources":["../../src/internal/event-bus.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEnE;;;;;;;;;;;GAWG;AACH,qBAAa,QAAQ;IACpB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuD;IACnF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwD;IACvF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAC7C,OAAO,CAAC,WAAW,CAA6B;IAEhD,kBAAkB,CAAC,MAAM,EAAE,SAAS,SAAS,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI;IAOjE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,IAAI;IAwC/C,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,KAAK,IAAI,GAAG,UAAU;IAe3E;;;OAGG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,KAAK,IAAI,GAAG,UAAU;IAS9E,SAAS,IAAI,IAAI;CAMjB"}

package/dist/internal/ipc-registry-memory.d.ts

@@ -0,0 +1,25 @@
+import type { BrowserWindow } from 'electron';
+import type { Disposable, JsonValue, MaybePromise, TypedIpcRegistry } from '../types.js';
+/**
+ * In-memory `TypedIpcRegistry` impl —— Phase 2 不接真 Electron `ipcMain`，提
+ * 供 main-process 同进程 `handle` / `on` / `send` / `invoke` 的 fake。
+ *
+ * - `handle` / `invoke` 与 `on` / `send` 是**独立 channel space**：send 只触
+ *   发 on listener；invoke 只调 handle handler；同 channel 名互不影响。
+ * - audience / validator option Phase 2 不强制，仅 accept；Phase 3 接 trusted
+ *   sender set 时再实施。
+ *
+ * @internal
+ */
+export declare class InMemoryTypedIpcRegistry implements TypedIpcRegistry {
+    private readonly handlers;
+    private readonly listeners;
+    handle<A extends JsonValue[], R extends JsonValue>(channel: string, handler: (...args: A) => MaybePromise<R>, _options?: {
+        validator?: (args: unknown[]) => A;
+    }): Disposable;
+    on<P extends JsonValue>(channel: string, listener: (payload: P) => void): Disposable;
+    send(_target: 'mainWindow' | BrowserWindow, channel: string, payload: JsonValue): void;
+    /** @internal main-internal helper used by Phase 2 setup tests / framework */
+    invoke<R extends JsonValue>(channel: string, ...args: JsonValue[]): Promise<R>;
+}
+//# sourceMappingURL=ipc-registry-memory.d.ts.map

package/dist/internal/ipc-registry-memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ipc-registry-memory.d.ts","sourceRoot":"","sources":["../../src/internal/ipc-registry-memory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,KAAK,EACX,UAAU,EACV,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,MAAM,aAAa,CAAA;AAKpB;;;;;;;;;;GAUG;AACH,qBAAa,wBAAyB,YAAW,gBAAgB;IAChE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgC;IACzD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsC;IAEhE,MAAM,CAAC,CAAC,SAAS,SAAS,EAAE,EAAE,CAAC,SAAS,SAAS,EAChD,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,EACxC,QAAQ,CAAC,EAAE;QACV,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;KAClC,GACC,UAAU;IAab,EAAE,CAAC,CAAC,SAAS,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,IAAI,GAAG,UAAU;IAgBpF,IAAI,CACH,OAAO,EAAE,YAAY,GAAG,aAAa,EACrC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,SAAS,GAChB,IAAI;IAcP,6EAA6E;IACvE,MAAM,CAAC,CAAC,SAAS,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;CAMpF"}

package/dist/internal/lifecycle-manager.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Lifecycle phase machine — see workbench-model.md §5.
+ *
+ * 8 个 phase 严格递增，无跳跃：
+ *   init → bind → setup → ready → drain → cleanup → destroy → quit
+ *
+ * @internal
+ */
+export type LifecyclePhase = 'init' | 'bind' | 'setup' | 'ready' | 'drain' | 'cleanup' | 'destroy' | 'quit';
+export declare class LifecyclePhaseError extends Error {
+    readonly from: LifecyclePhase;
+    readonly to: LifecyclePhase;
+    constructor(from: LifecyclePhase, to: LifecyclePhase);
+}
+export declare function phaseOrder(p: LifecyclePhase): number;
+export declare class LifecycleManager {
+    current: LifecyclePhase;
+    enter(to: LifecyclePhase): void;
+    assertAtLeast(p: LifecyclePhase): void;
+    /**
+     * Abnormal-path setter：setup throw / 紧急 shutdown 跳过中间 phase 直达
+     * 指定 teardown phase。不做顺序校验，仅 framework 内部使用。
+     *
+     * @internal
+     */
+    _force(to: LifecyclePhase): void;
+}
+//# sourceMappingURL=lifecycle-manager.d.ts.map

package/dist/internal/lifecycle-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle-manager.d.ts","sourceRoot":"","sources":["../../src/internal/lifecycle-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,cAAc,GACvB,MAAM,GACN,MAAM,GACN,OAAO,GACP,OAAO,GACP,OAAO,GACP,SAAS,GACT,SAAS,GACT,MAAM,CAAA;AAaT,qBAAa,mBAAoB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAA;gBACf,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,cAAc;CAMpD;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,cAAc,GAAG,MAAM,CAIpD;AAED,qBAAa,gBAAgB;IAC5B,OAAO,EAAE,cAAc,CAAS;IAEhC,KAAK,CAAC,EAAE,EAAE,cAAc,GAAG,IAAI;IAS/B,aAAa,CAAC,CAAC,EAAE,cAAc,GAAG,IAAI;IAQtC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,EAAE,cAAc,GAAG,IAAI;CAGhC"}