@dimina-kit/electron-deck 0.1.0-dev.20260701083540 → 0.1.0-dev.20260702145840

package/dist/{electron-deck-C9_Yu3fd.js → electron-deck-B9fun93z.js}

@@ -1,6 +1,7 @@
 import { n as DeckRemoteError, r as EventNotBoundError } from "./errors-NE2ig7L5.js";
-import { i as DeckChannel, t as BRIDGE_PROTOCOL_VERSION } from "./protocol-BJqo-vP2.js";
-import { i as createScope, r as createCompositor, t as createViewHandle } from "./view-handle-CR-yWNfr.js";
+import { i as DeckChannel, t as BRIDGE_PROTOCOL_VERSION } from "./protocol-B6TOT9AP.js";
+import { i as createScope, r as createCompositor, t as createViewHandle } from "./view-handle-DDhpBuW-.js";
+import { i as reconcile, n as dispatchOps, r as createInitialState, t as cleanSnapshot } from "./layout-ByOiOdnc.js";
 import { randomUUID } from "node:crypto";
 //#region src/events.ts
 var internals = /* @__PURE__ */ new WeakMap();
@@ -395,15 +396,15 @@ var WireTransport = class {
 	deps;
 	state = "idle";
 	busSubscription = null;
-	/** Whether the optional Place / LayoutSubscribe handlers were registered
+	/** Whether the optional Snapshot / LayoutSubscribe handlers were registered
 	*  (either eagerly at start() via deps, or lazily via armSlotChannels) — so
 	*  dispose() only removes channels it actually registered. */
-	placeRegistered = false;
+	snapshotRegistered = false;
 	layoutSubscribeRegistered = false;
 	/** Effective slot callbacks. Populated from deps at start() (eager path, used
 	*  by the wire unit tests) OR by {@link armSlotChannels} (lazy path, used by
 	*  deck-app so an app with no anchored views registers only Invoke + Probe). */
-	onPlaceCb = null;
+	onSnapshotCb = null;
 	onLayoutSubscribeCb = null;
 	constructor(deps) {
 		this.deps = deps;
@@ -418,10 +419,10 @@ var WireTransport = class {
 			cleanups.push(() => this.tryRemoveHandler(DeckChannel.Probe));
 			this.deps.ipcMain.handle(DeckChannel.Invoke, (event, ...args) => this.handleInvoke(event?.sender?.id, event?.senderFrame, event?.sender?.mainFrame, args[0]));
 			cleanups.push(() => this.tryRemoveHandler(DeckChannel.Invoke));
-			if (this.deps.onPlace) {
-				this.onPlaceCb = this.deps.onPlace;
-				this.registerPlaceHandler();
-				cleanups.push(() => this.unregisterPlaceHandler());
+			if (this.deps.onSnapshot) {
+				this.onSnapshotCb = this.deps.onSnapshot;
+				this.registerSnapshotHandler();
+				cleanups.push(() => this.unregisterSnapshotHandler());
 			}
 			if (this.deps.onLayoutSubscribe) {
 				this.onLayoutSubscribeCb = this.deps.onLayoutSubscribe;
@@ -454,15 +455,15 @@ var WireTransport = class {
 			console.error(`[electron-deck] removeHandler(${channel}) failed:`, e);
 		}
 	}
-	registerPlaceHandler() {
-		if (this.placeRegistered) return;
-		this.deps.ipcMain.handle(DeckChannel.Place, (event, ...args) => this.handlePlace(event?.sender?.id, event?.senderFrame, event?.sender?.mainFrame, args[0]));
-		this.placeRegistered = true;
+	registerSnapshotHandler() {
+		if (this.snapshotRegistered) return;
+		this.deps.ipcMain.handle(DeckChannel.Snapshot, (event, ...args) => this.handleSnapshot(event?.sender?.id, event?.senderFrame, event?.sender?.mainFrame, args[0]));
+		this.snapshotRegistered = true;
 	}
-	unregisterPlaceHandler() {
-		if (!this.placeRegistered) return;
-		this.placeRegistered = false;
-		this.tryRemoveHandler(DeckChannel.Place);
+	unregisterSnapshotHandler() {
+		if (!this.snapshotRegistered) return;
+		this.snapshotRegistered = false;
+		this.tryRemoveHandler(DeckChannel.Snapshot);
 	}
 	registerLayoutSubscribeHandler() {
 		if (this.layoutSubscribeRegistered) return;
@@ -482,11 +483,11 @@ var WireTransport = class {
 	* no anchored views never registers these channels (keeping the wire's
 	* handler footprint at Invoke + Probe until a slot is actually minted).
 	*/
-	armSlotChannels(onPlace, onLayoutSubscribe) {
-		this.onPlaceCb = onPlace;
+	armSlotChannels(onSnapshot, onLayoutSubscribe) {
+		this.onSnapshotCb = onSnapshot;
 		this.onLayoutSubscribeCb = onLayoutSubscribe;
 		if (this.state !== "started") return;
-		this.registerPlaceHandler();
+		this.registerSnapshotHandler();
 		this.registerLayoutSubscribeHandler();
 	}
 	dispose() {
@@ -505,12 +506,12 @@ var WireTransport = class {
 		} catch (e) {
 			console.error("[electron-deck] removeHandler(probe) failed:", e);
 		}
-		if (this.placeRegistered) {
-			this.placeRegistered = false;
+		if (this.snapshotRegistered) {
+			this.snapshotRegistered = false;
 			try {
-				this.deps.ipcMain.removeHandler(DeckChannel.Place);
+				this.deps.ipcMain.removeHandler(DeckChannel.Snapshot);
 			} catch (e) {
-				console.error("[electron-deck] removeHandler(place) failed:", e);
+				console.error("[electron-deck] removeHandler(snapshot) failed:", e);
 			}
 		}
 		if (this.layoutSubscribeRegistered) {
@@ -576,17 +577,16 @@ var WireTransport = class {
 		}
 	}
 	/**
-	* `__electron-deck:place` inbound. Same gate as {@link handleInvoke}
-	* (trust + main-frame). On any failure (malformed payload, untrusted sender,
-	* sub-frame) → DROP silently (return undefined; never call `onPlace`).
+	* `__electron-deck:snapshot` inbound. Same gate as {@link handleInvoke} (trust +
+	* main-frame). On any gate failure (non-object payload, untrusted sender,
+	* sub-frame) → DROP silently. The payload's inner shape is opaque to the wire —
+	* authorized + validated downstream.
 	*/
-	handlePlace(senderId, senderFrame, mainFrame, rawMsg) {
-		if (rawMsg === null || typeof rawMsg !== "object" || Array.isArray(rawMsg)) return;
-		const msg = rawMsg;
-		if (typeof msg.slotToken !== "string") return;
+	handleSnapshot(senderId, senderFrame, mainFrame, rawSnapshot) {
+		if (rawSnapshot === null || typeof rawSnapshot !== "object" || Array.isArray(rawSnapshot)) return;
 		if (typeof senderId !== "number" || !this.deps.senderPolicy.isTrusted(senderId)) return;
 		if (!this.isMainFrameSender(senderFrame, mainFrame)) return;
-		this.onPlaceCb?.(senderId, msg.slotToken, msg.placement);
+		this.onSnapshotCb?.(senderId, rawSnapshot);
 	}
 	/**
 	* `__electron-deck:layout-subscribe` inbound. Same gate as {@link handleInvoke}.
@@ -875,12 +875,31 @@ var DeckApp = class {
 	/**
 	* slot-token registry (view-handle.md「slot-token 握手」/ capability-and-lifecycle.md「anchor slotToken 原子下发」):
 	* each anchored `placeIn` mints an unguessable token bound to (viewId, slotId,
-	* authorizedWcId). The `__electron-deck:place` apply path looks the token up,
-	* checks the sender is the authorized wc (anti-spoof), validates the placement,
-	* then `apply`s it. `resend` re-pushes the slot-grant (layout-subscribe replay).
+	* authorizedWcId, zone). The `__electron-deck:snapshot` apply path authorizes
+	* each of the renderer's per-view tokens (token known AND authorized to the
+	* sender wc), DERIVES the view's identity (viewId) + z-order (zone→layer) from
+	* this registry (never trusting the renderer-reported fields), reconciles the
+	* cleaned window-level table, and drives each view's `apply`. `resend` re-pushes
+	* the slot-grant (layout-subscribe replay).
 	*/
 	slotTokens = /* @__PURE__ */ new Map();
 	slotSeq = 0;
+	/**
+	* Per-control-wc level-triggered reconciler state (keyed by authorizedWcId).
+	* The renderer publishes a whole window-level desired-placement table each
+	* frame; `reconcile` diffs it against the last-applied actual and emits ops, so
+	* a lost or spurious per-view edge self-corrects instead of sticking a view
+	* detached (the white-screen failure mode). Reset on layout-subscribe (reload)
+	* and dropped on wc revoke.
+	*/
+	reconcileStates = /* @__PURE__ */ new Map();
+	/**
+	* Per-control-wc strictly-monotonic generation counter. Bumped on every
+	* layout-subscribe and stamped into each slot-grant, so a reload's higher
+	* generation resets the reconciler regardless of IPC ordering (a late in-flight
+	* pre-reload snapshot carries a lower generation → rejected).
+	*/
+	perWcGeneration = /* @__PURE__ */ new Map();
 	_runtime = null;
 	startCalled = false;
 	shutdownPromise = null;
@@ -1627,32 +1646,58 @@ var DeckApp = class {
 	* builds can't serve a renderer slot anyway).
 	*/
 	ensureSlotChannelsArmed() {
-		this.wireTransport?.armSlotChannels((senderId, slotToken, placement) => this.handleSlotPlace(senderId, slotToken, placement), (senderId) => this.handleLayoutSubscribe(senderId));
+		this.wireTransport?.armSlotChannels((senderId, rawSnapshot) => this.handleSnapshot(senderId, rawSnapshot), (senderId) => this.handleLayoutSubscribe(senderId));
 	}
 	/**
-	* slot-token apply path (`__electron-deck:place`). The token is the credential:
-	* look it up, verify the sender IS the wc the token was granted to (anti-spoof),
-	* validate the placement, then apply. Any failure → DROP (silent).
+	* slot-token apply path (`__electron-deck:snapshot`). The renderer publishes a
+	* whole window-level desired-placement table; each entry's slotToken is the
+	* credential. Steps:
+	*   1. AUTHORIZE + clean: `cleanSnapshot` keeps only views whose token is known
+	*      AND authorized to `senderId` (anti-spoof), deriving each view's identity
+	*      (viewId) + z-order (zone→layer) from the registry — never from the
+	*      renderer-reported fields. A non-empty snapshot that fully fails
+	*      authorization is rejected wholesale (returns null) so a transient token
+	*      failure is NOT read as "detach everything".
+	*   2. RECONCILE the cleaned table against this wc's last-applied actual state
+	*      → an ordered op list (level-triggered; a lost/spurious frame self-heals).
+	*   3. DISPATCH the ops onto each view's `applyPlacement` sink.
 	*/
-	handleSlotPlace(senderId, slotToken, placement) {
-		const entry = this.slotTokens.get(slotToken);
-		if (!entry) return;
-		if (entry.authorizedWcId !== senderId) return;
-		if (!isValidPlacement(placement)) return;
-		entry.apply(placement);
+	handleSnapshot(senderId, rawSnapshot) {
+		const clean = cleanSnapshot(rawSnapshot, (slotToken) => {
+			const entry = this.slotTokens.get(slotToken);
+			if (!entry || entry.authorizedWcId !== senderId) return null;
+			return {
+				viewId: entry.viewId,
+				layer: entry.zone
+			};
+		});
+		if (!clean) return;
+		const { state, ops } = reconcile(this.reconcileStates.get(senderId) ?? createInitialState(), clean);
+		this.reconcileStates.set(senderId, state);
+		const applyByViewId = /* @__PURE__ */ new Map();
+		for (const entry of this.slotTokens.values()) if (entry.authorizedWcId === senderId) applyByViewId.set(entry.viewId, entry.apply);
+		dispatchOps(ops, state, (viewId) => applyByViewId.get(viewId) ?? null);
 	}
 	/**
 	* Per-wc layout-subscribe replay (`__electron-deck:layout-subscribe`). When the
-	* authorized control wc (re)subscribes (e.g. after reload), re-push every grant
-	* it owns so it can re-bind its DOM slots. A DIFFERENT wc's subscribe never
-	* receives another wc's grants.
+	* authorized control wc (re)subscribes (e.g. after reload), BUMP its generation
+	* and RESET its reconciler (a reload restarts the renderer's epoch at 0; without
+	* the reset the fresh low-epoch snapshots would be rejected as stale), then
+	* re-push every grant it owns — now carrying the bumped generation — so it can
+	* re-bind its DOM slots. A DIFFERENT wc's subscribe never touches another wc's
+	* state or grants.
 	*/
 	handleLayoutSubscribe(senderId) {
+		this.perWcGeneration.set(senderId, (this.perWcGeneration.get(senderId) ?? 0) + 1);
+		this.reconcileStates.delete(senderId);
 		for (const entry of this.slotTokens.values()) if (entry.authorizedWcId === senderId) entry.resend();
 	}
-	/** Drop every slot token authorized to `wcId` (window-close / shutdown hygiene). */
+	/** Drop every slot token + reconciler/generation state authorized to `wcId`
+	*  (window-close / shutdown hygiene). */
 	revokeSlotTokensForWc(wcId) {
 		for (const [token, entry] of this.slotTokens) if (entry.authorizedWcId === wcId) this.slotTokens.delete(token);
+		this.reconcileStates.delete(wcId);
+		this.perWcGeneration.delete(wcId);
 	}
 	handleSubWindowClosed(win, wc) {
 		this.trackedWindows.delete(win);
@@ -1934,24 +1979,26 @@ var DeckApp = class {
 				let placedSubstrate = null;
 				let slotToken;
 				let placed = false;
-				const mintSlotToken = (controlWc, anchor) => {
+				const mintSlotToken = (controlWc, anchor, zone) => {
 					this.ensureSlotChannelsArmed();
 					const authorizedWcId = controlWc.id;
 					const token = randomUUID();
 					slotToken = token;
 					++this.slotSeq;
-					const grant = {
-						viewId,
-						slotId: anchor,
-						slotToken: token
-					};
 					const resend = () => {
+						const grant = {
+							viewId,
+							slotId: anchor,
+							slotToken: token,
+							generation: this.perWcGeneration.get(authorizedWcId) ?? 0
+						};
 						controlWc.send(DeckChannel.SlotGrant, grant);
 					};
 					this.slotTokens.set(token, {
 						viewId,
 						slotId: anchor,
 						authorizedWcId,
+						zone,
 						resend,
 						apply: (p) => {
 							hostHandle.applyPlacement(p);
@@ -1975,7 +2022,7 @@ var DeckApp = class {
 						placed = true;
 						disarmRootClose();
 						const anchor = placeOpts.anchor;
-						if (typeof anchor === "string" && anchor.length > 0) mintSlotToken(controlWc, anchor);
+						if (typeof anchor === "string" && anchor.length > 0) mintSlotToken(controlWc, anchor, placeOpts.zone ?? 0);
 						return hostHandle;
 					},
 					moveTo: async (win, moveOpts) => {
@@ -2024,7 +2071,7 @@ var DeckApp = class {
 							slotToken = void 0;
 						}
 						const anchor = moveOpts.anchor;
-						if (typeof anchor === "string" && anchor.length > 0) mintSlotToken(destControlWc, anchor);
+						if (typeof anchor === "string" && anchor.length > 0) mintSlotToken(destControlWc, anchor, moveOpts.zone ?? 0);
 					},
 					applyPlacement: (p) => {
 						inner.applyPlacement(p);
@@ -2111,26 +2158,6 @@ var DeckApp = class {
 		};
 	}
 };
-/**
-* Validate an inbound `__electron-deck:place` placement before applying it.
-* `{visible:false}` is always OK; `{visible:true, bounds:{x,y,width,height}}`
-* requires width≥0 && height≥0 — x/y may be ANY finite number (negative origin
-* is legitimate for scroll-follow). Anything else is rejected.
-*/
-function isValidPlacement(placement) {
-	if (placement === null || typeof placement !== "object") return false;
-	const p = placement;
-	if (p.visible === false) return true;
-	if (p.visible !== true) return false;
-	const b = p.bounds;
-	if (b === null || typeof b !== "object") return false;
-	const { x, y, width, height } = b;
-	if (typeof x !== "number" || !Number.isFinite(x)) return false;
-	if (typeof y !== "number" || !Number.isFinite(y)) return false;
-	if (typeof width !== "number" || !Number.isFinite(width) || width < 0) return false;
-	if (typeof height !== "number" || !Number.isFinite(height) || height < 0) return false;
-	return true;
-}
 async function runWithTimeout(work, timeoutMs) {
 	let timer;
 	const timeout = new Promise((_, rej) => {
@@ -2286,4 +2313,4 @@ function validateHandlerMap(fieldName, value) {
 //#endregion
 export { WireTransport as a, InMemoryTypedIpcRegistry as c, createControlBus as i, EventBus as l, startElectronDeck as n, createCapabilityRegistry as o, validateConfig as r, createTrustSet as s, electronDeck as t, defineEvent as u };
 
-//# sourceMappingURL=electron-deck-C9_Yu3fd.js.map
+//# sourceMappingURL=electron-deck-B9fun93z.js.map