@driftengine/package 3.61.0

package/dist/macCrossSign.js

@@ -0,0 +1,298 @@
+import { spawn } from 'node:child_process';
+import { open, readdir, rm } from 'node:fs/promises';
+import { basename, dirname, join } from 'node:path';
+/**
+ * The macOS code signature, applied from a machine that is not a Mac.
+ *
+ * **Why this exists at all.** electron-builder's own refusal to build a Mac target fires on
+ * Windows and nowhere else, so a `.app` packs perfectly well on Linux — and then
+ * `isSignAllowed()` returns false off darwin, one warning is logged, and the artifact is finished
+ * and unsigned. Apple Silicon's loader refuses an unsigned binary outright, which is not
+ * Gatekeeper and which no user gesture works around, so that artifact is one that looks complete
+ * and cannot start. `rcodesign` is the one implementation of Apple's signature format that runs
+ * anywhere, and this module is the step that puts a signature back on.
+ *
+ * **Everything here is checked rather than assumed, because nothing on this side can launch the
+ * result.** A Mac is the only thing that can prove the app runs; what a Linux host *can* prove is
+ * that every binary in the bundle carries a signature, that every nested bundle was sealed, and
+ * that the slice inside is the architecture that was asked for. Those are the three ways this step
+ * fails silently, and each one below is a refusal rather than a warning.
+ */
+/**
+ * The line rcodesign prints when a nested bundle's main executable cannot be resolved.
+ *
+ * **Measured rather than guessed, and it is not cosmetic.** A stock Electron distribution ships
+ * its helper apps with no `CFBundleExecutable` key; Apple's `codesign` infers the executable from
+ * the bundle's own name and rcodesign does not. When it cannot resolve one, it signs the Mach-O
+ * inside and then leaves that bundle out of the outer app's `CodeResources` — so the app's
+ * signature does not cover its own helpers, and nothing about the build says so.
+ *
+ * electron-builder rewrites every helper plist with a `CFBundleExecutable` before this runs, which
+ * is why a real build does not hit this. That is a fact about a dependency's current behaviour,
+ * not a guarantee, so it is checked here instead of trusted.
+ */
+const UNRESOLVED_NESTED = 'could not find main executable of presumed nested bundle';
+/**
+ * Ad-hoc sign a `.app` in place, then refuse it if the result is not what was asked for.
+ *
+ * Ad-hoc is the only mode offered: a Developer ID would need a certificate this host cannot use,
+ * and `planSigning` refuses that combination before a build gets this far.
+ */
+export async function crossSignMacApp(options) {
+    /* No identity argument at all is rcodesign's spelling of an ad-hoc signature, and a bundle path
+       is signed recursively: nested bundles and loose Mach-O binaries included. */
+    const output = await run(options.rcodesign, ['sign', options.app]);
+    if (output.includes(UNRESOLVED_NESTED)) {
+        const bundles = output
+            .split('\n')
+            .filter((line) => line.includes(UNRESOLVED_NESTED))
+            .map((line) => line.slice(line.indexOf(UNRESOLVED_NESTED) + UNRESOLVED_NESTED.length + 2))
+            .join(', ');
+        throw new Error(`rcodesign could not resolve the main executable of ${bundles}, so the app's signature ` +
+            "does not cover it. That is a bundle whose Info.plist has no CFBundleExecutable: Apple's " +
+            'codesign infers one from the bundle name and rcodesign does not. The artifact would ' +
+            'look signed and fail validation on a Mac.');
+    }
+    await assertEverySealed(options.app);
+    await assertArch(options.app, options.arch);
+}
+/**
+ * The `.zip` a cross-built Mac artifact ships as, archived here rather than by electron-builder.
+ *
+ * **electron-builder cannot produce this one correctly off a Mac, and says so in its own source**:
+ * its archiver picks 7-Zip everywhere except macOS, guarded by a comment reading *"7zip
+ * dereferences symlinks, corrupting .framework structure and breaking codesign"*. The guard is
+ * written as `process.platform === "darwin"`, so on Linux it takes the 7-Zip path regardless.
+ *
+ * **A `.framework` is symlinks by construction.** `Electron Framework` points into
+ * `Versions/Current`, which points at `Versions/A`. Dereferenced, the archive carries the
+ * framework's 192 MB payload twice and no links at all, and macOS rejects that layout as
+ * unrecognised — the signature that was correct on disk no longer validates against it. Measured
+ * on this repository before this function existed: a 404 MB archive with zero symlink entries,
+ * against 353 MB on disk.
+ *
+ * `zip -y` stores a symlink as a symlink, `-r` recurses, and Unix permission bits are kept, which
+ * every executable inside the bundle depends on.
+ */
+export async function zipMacApp(app, into) {
+    /* `zip` updates an existing archive in place rather than replacing it, so a rebuild would
+       otherwise leave files from the previous one in the artifact. */
+    await rm(into, { force: true });
+    try {
+        await run('zip', ['-y', '-r', '-q', into, basename(app)], { cwd: dirname(app) });
+    }
+    catch (cause) {
+        throw new Error(`could not archive the app with \`zip\`: ${String(cause)}. This build needs it because ` +
+            "electron-builder's own zip dereferences symlinks off a Mac, which corrupts every " +
+            'framework in the bundle. Install it (`apt install zip`) and build again.');
+    }
+    const symlinks = await countSymlinkEntries(into);
+    if (symlinks === 0) {
+        throw new Error(`${into} contains no symlinks, and a macOS app bundle is built out of them — every ` +
+            'framework links its top level into `Versions/Current`. An archive without them holds ' +
+            'each framework twice and is rejected by macOS as an unrecognised bundle format. That ' +
+            'is what `zip` without `-y` produces.');
+    }
+    console.log(`[drift-package] archived ${into} with ${String(symlinks)} symlinks preserved`);
+}
+/* The three fields of the zip format this needs, from APPNOTE.TXT. */
+const EOCD_SIGNATURE = 0x06054b50;
+const CENTRAL_SIGNATURE = 0x02014b50;
+/** `S_IFLNK`, in the Unix mode that lives in the high half of the external attributes field. */
+const S_IFMT = 0xf000;
+const S_IFLNK = 0xa000;
+/**
+ * How many entries in an archive are symlinks, read from its central directory.
+ *
+ * **The archive is inspected rather than the tool trusted**, because the failure this guards
+ * against is silent by nature: an archiver that dereferences links produces a larger file that
+ * unpacks into something that looks complete. Reading the central directory is exact, needs no
+ * `zipinfo` on the host, and answers the one question that matters.
+ */
+async function countSymlinkEntries(zip) {
+    const handle = await open(zip, 'r');
+    try {
+        const { size } = await handle.stat();
+        /* The end-of-central-directory record is last, after a comment of up to 64 KiB. */
+        const tailLength = Math.min(size, 0x10000 + 22);
+        const tail = Buffer.alloc(tailLength);
+        await handle.read(tail, 0, tailLength, size - tailLength);
+        let eocd = -1;
+        for (let at = tail.length - 22; at >= 0; at -= 1) {
+            if (tail.readUInt32LE(at) === EOCD_SIGNATURE) {
+                eocd = at;
+                break;
+            }
+        }
+        if (eocd < 0)
+            throw new Error(`${zip} has no end-of-central-directory record`);
+        const entries = tail.readUInt16LE(eocd + 10);
+        const directoryLength = tail.readUInt32LE(eocd + 12);
+        const directoryStart = tail.readUInt32LE(eocd + 16);
+        const directory = Buffer.alloc(directoryLength);
+        await handle.read(directory, 0, directoryLength, directoryStart);
+        let at = 0;
+        let symlinks = 0;
+        for (let index = 0; index < entries && at + 46 <= directory.length; index += 1) {
+            if (directory.readUInt32LE(at) !== CENTRAL_SIGNATURE)
+                break;
+            /* The high half of the external attributes is the Unix mode, for an archive written on
+               Unix — which is the only kind this function is ever pointed at. */
+            const mode = directory.readUInt32LE(at + 38) >>> 16;
+            if ((mode & S_IFMT) === S_IFLNK)
+                symlinks += 1;
+            at +=
+                46 +
+                    directory.readUInt16LE(at + 28) +
+                    directory.readUInt16LE(at + 30) +
+                    directory.readUInt16LE(at + 32);
+        }
+        return symlinks;
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * Every bundle in the artifact carries its own signature.
+ *
+ * A signed bundle has a `_CodeSignature/CodeResources` beside its contents — the outer app under
+ * `Contents/`, a framework under `Versions/A/`. Checking the directory rather than parsing the
+ * seal is deliberate: this catches the failure that actually happens, which is a bundle rcodesign
+ * walked past, and it does not pretend to be the validation only a Mac can do.
+ */
+async function assertEverySealed(app) {
+    const missing = [];
+    if (!(await exists(join(app, 'Contents', '_CodeSignature', 'CodeResources')))) {
+        missing.push('the app itself');
+    }
+    const frameworks = join(app, 'Contents', 'Frameworks');
+    for (const entry of await list(frameworks)) {
+        const nested = join(frameworks, entry);
+        /* A `.app` seals under `Contents/`; a `.framework` under the version it points `Current` at,
+           which is `A` for everything Electron ships. */
+        const seal = entry.endsWith('.framework')
+            ? join(nested, 'Versions', 'A', '_CodeSignature', 'CodeResources')
+            : join(nested, 'Contents', '_CodeSignature', 'CodeResources');
+        if (entry.endsWith('.app') || entry.endsWith('.framework')) {
+            if (!(await exists(seal)))
+                missing.push(entry);
+        }
+    }
+    if (missing.length > 0) {
+        throw new Error(`these parts of the app were not signed: ${missing.join(', ')}. An unsigned binary inside ` +
+            'a signed app is refused by the loader at the moment it is needed, which for a helper is ' +
+            'the first window rather than the launch.');
+    }
+}
+/**
+ * The artifact carries the slice it was asked for.
+ *
+ * **The failure this prevents is a build that produced the wrong architecture and said nothing.**
+ * electron-builder picks the Electron distribution from the target's arch, so a `mac-x64` asked
+ * for should never contain arm64 — but a cache with the wrong download in it, or a default that
+ * inherited the host's arch, both end as an app that refuses to start on the machine it was made
+ * for, with no error that names the cause.
+ */
+async function assertArch(app, expected) {
+    const executable = await mainExecutable(app);
+    const found = await machoArch(executable);
+    if (found === null) {
+        throw new Error(`${executable} is not a Mach-O binary; the app did not pack correctly`);
+    }
+    if (found !== expected) {
+        throw new Error(`this build asked for ${expected} and the binary inside is ${found}. That artifact does ` +
+            'not run on the machine it was built for, and nothing about it says so until it is opened.');
+    }
+}
+/** The one file under `Contents/MacOS`, which is the app's entry point whatever it is named. */
+async function mainExecutable(app) {
+    const dir = join(app, 'Contents', 'MacOS');
+    const [entry] = await list(dir);
+    if (entry === undefined)
+        throw new Error(`${dir} is empty; the app did not pack correctly`);
+    return join(dir, entry);
+}
+/* Mach-O's own constants, from `mach-o/loader.h` and `mach/machine.h`. */
+const MACHO_64_LE = 0xfeedfacf;
+const FAT_BE = 0xcafebabe;
+const CPU_X86_64 = 0x01000007;
+const CPU_ARM64 = 0x0100000c;
+/**
+ * Which architecture a Mach-O binary holds, read from its header.
+ *
+ * Sixteen bytes of file rather than a tool: `file` and `lipo` both answer this and neither is on
+ * a Linux host by default, and the header is four fields that have not moved in twenty years.
+ * A universal binary answers with what it contains only when that is unambiguous — one slice.
+ */
+async function machoArch(path) {
+    const handle = await open(path, 'r');
+    try {
+        const header = Buffer.alloc(8);
+        await handle.read(header, 0, 8, 0);
+        if (header.readUInt32LE(0) === MACHO_64_LE)
+            return cpuName(header.readUInt32LE(4));
+        if (header.readUInt32BE(0) === FAT_BE) {
+            /* A fat header is a count and then 20-byte entries whose first field is the cpu type. */
+            const count = header.readUInt32BE(4);
+            const names = new Set();
+            for (let index = 0; index < count; index += 1) {
+                const entry = Buffer.alloc(4);
+                await handle.read(entry, 0, 4, 8 + index * 20);
+                const name = cpuName(entry.readUInt32BE(0));
+                if (name !== null)
+                    names.add(name);
+            }
+            return names.size === 1 ? [...names][0] : null;
+        }
+        return null;
+    }
+    finally {
+        await handle.close();
+    }
+}
+function cpuName(cpu) {
+    if (cpu === CPU_ARM64)
+        return 'arm64';
+    if (cpu === CPU_X86_64)
+        return 'x64';
+    return null;
+}
+async function list(dir) {
+    try {
+        return await readdir(dir);
+    }
+    catch {
+        return [];
+    }
+}
+async function exists(path) {
+    try {
+        await (await import('node:fs/promises')).access(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Run a command and return everything it said, on both streams.
+ *
+ * rcodesign narrates to stderr and the warning this module refuses on arrives there, so the two
+ * are merged rather than one being watched — a check that read only stdout would pass every time.
+ */
+async function run(command, args, options = {}) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, [...args], {
+            cwd: options.cwd,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        let output = '';
+        child.stdout.on('data', (chunk) => (output += chunk.toString()));
+        child.stderr.on('data', (chunk) => (output += chunk.toString()));
+        child.on('error', reject);
+        child.on('close', (code) => code === 0
+            ? resolve(output)
+            : reject(new Error(`${command} exited with ${String(code)}:\n${output}`)));
+    });
+}

package/dist/main/consoleForward.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Reading a renderer's console line off an event whose shape has changed, and deciding whether it
+ * is worth forwarding.
+ *
+ * **Pure, and tested, because the failure of getting it wrong is silence.** A packaged game has no
+ * developer tools and no console a player can open, so this forwarding is the only way anything the
+ * renderer says reaches a bug report. Reading the wrong argument does not throw and does not warn:
+ * it compares `undefined` against a string for every message, forwards none of them, and is
+ * indistinguishable from a game that never logged.
+ *
+ * The two shapes, both of which are `console-message` on `WebContents`:
+ *
+ *   - **Electron 35 and newer.** One object first, carrying `message` and a string `level` of
+ *     `debug`, `info`, `warning` or `error`. The old positional arguments follow it, deprecated.
+ *   - **Before that, fully positional**: `(event, level: 0..3, message, line, sourceId)`, where the
+ *     event itself carries neither. **Its own typings say otherwise** — `electron.d.ts` at 33.4.11
+ *     declares `(event, messageDetails)` with the details as an object — and reading them is what
+ *     produced a first version of this module that handled two object shapes and forwarded nothing
+ *     on the runtime it was written to rescue. The positional form below is what a probe against
+ *     that binary actually received. The object-second shape is still accepted, because it is what
+ *     the typings promise and costs one branch to keep.
+ */
+export type ConsoleLevel = 'debug' | 'verbose' | 'info' | 'warning' | 'error';
+export interface ConsoleLine {
+    readonly level: ConsoleLevel;
+    readonly message: string;
+}
+/**
+ * The line a listener was handed, whichever shape it came in, or `null` when neither carried one.
+ *
+ * The first argument is preferred when it carries a level, which is the newer shape; the second is
+ * read otherwise. The third is the positional message the newer shape also passes, used only when
+ * an object carried a level without a message.
+ */
+export declare function consoleLine(first: unknown, second: unknown, third: unknown): ConsoleLine | null;
+/**
+ * Whether a line at this level is forwarded.
+ *
+ * Errors in both kinds of build: an error nobody can quote is an error nobody can fix. Warnings in
+ * development only — they are where a framework's advice and a game's own diagnostics live, and a
+ * shipped game printing them to a terminal nobody is watching buries the line that matters.
+ */
+export declare function forwardsConsole(level: ConsoleLevel, development: boolean): boolean;

package/dist/main/consoleForward.js

@@ -0,0 +1,63 @@
+/** 0 to 3, as the older event numbers them. */
+const BY_NUMBER = ['verbose', 'info', 'warning', 'error'];
+const NAMED = ['debug', 'verbose', 'info', 'warning', 'error'];
+function levelOf(value) {
+    if (typeof value === 'string' && NAMED.includes(value))
+        return value;
+    if (typeof value === 'number' && Number.isInteger(value))
+        return BY_NUMBER[value] ?? null;
+    return null;
+}
+function fieldsOf(value) {
+    if (value === null || typeof value !== 'object')
+        return null;
+    const record = value;
+    return { level: record.level, message: record.message };
+}
+/**
+ * The line a listener was handed, whichever shape it came in, or `null` when neither carried one.
+ *
+ * The first argument is preferred when it carries a level, which is the newer shape; the second is
+ * read otherwise. The third is the positional message the newer shape also passes, used only when
+ * an object carried a level without a message.
+ */
+export function consoleLine(first, second, third) {
+    /*
+     * The positional form first, because it is unambiguous: a number where an object would be is the
+     * older event, and no newer one puts a level there without also putting one on its first
+     * argument — which the loop below would have taken anyway.
+     */
+    if (typeof second === 'number' &&
+        typeof third === 'string' &&
+        fieldsOf(first)?.level === undefined) {
+        const level = levelOf(second);
+        if (level !== null)
+            return { level, message: third };
+    }
+    for (const candidate of [fieldsOf(first), fieldsOf(second)]) {
+        if (candidate === null)
+            continue;
+        const level = levelOf(candidate.level);
+        if (level === null)
+            continue;
+        const message = typeof candidate.message === 'string'
+            ? candidate.message
+            : typeof third === 'string'
+                ? third
+                : '';
+        return { level, message };
+    }
+    return null;
+}
+/**
+ * Whether a line at this level is forwarded.
+ *
+ * Errors in both kinds of build: an error nobody can quote is an error nobody can fix. Warnings in
+ * development only — they are where a framework's advice and a game's own diagnostics live, and a
+ * shipped game printing them to a terminal nobody is watching buries the line that matters.
+ */
+export function forwardsConsole(level, development) {
+    if (level === 'error')
+        return true;
+    return development && level === 'warning';
+}

package/dist/main/csp.d.ts

@@ -0,0 +1,4 @@
+/** The header value, as one string. */
+export declare const CSP: string;
+/** The source list for one directive, or an empty array when the policy does not carry it. */
+export declare function sourcesFor(directive: string): readonly string[];

package/dist/main/csp.js

@@ -0,0 +1,55 @@
+/**
+ * What the game is allowed to load, and it is deliberately not strict about very much.
+ *
+ * **The one thing it forbids is a script from somewhere else.** That is the attack this is for: a
+ * renderer that fetches a script over `http:` is a renderer whose network can hand it code, and it
+ * runs beside a bridge to the filesystem. Everything a game legitimately does — inline module
+ * preloads, a WebAssembly module, a blob worker, a texture from a data URL, a socket to its own
+ * server — is allowed, because a policy that breaks an ordinary bundle is a policy somebody
+ * switches off.
+ *
+ * **What would make this wrong** is a game that loads code from a CDN, which this refuses. That is
+ * the intended refusal and the answer is to bundle it.
+ *
+ * **Its own module, and tested, because a directive missing one scheme is invisible.** This lived
+ * as a constant in `window.ts`, which is Electron lifecycle and is not unit-tested — and it shipped
+ * allowing `wss:` without `ws:`, so a packaged game could not reach a relay on its own network. The
+ * shape of that failure is what makes it worth a test rather than a careful read: Chromium blocks
+ * the connection before a packet leaves, so the relay logs nothing and the game reports only that
+ * it did not connect. The two together point at the network. Seeing the actual line took a remote
+ * debugging session against the packaged binary, and a packaged build has no developer tools.
+ */
+const DIRECTIVES = [
+    "default-src 'self' drift: blob: data:",
+    "script-src 'self' drift: blob: 'unsafe-inline' 'wasm-unsafe-eval'",
+    "style-src 'self' drift: 'unsafe-inline'",
+    "img-src 'self' drift: blob: data: https:",
+    "media-src 'self' drift: blob: data: https:",
+    "font-src 'self' drift: data: https:",
+    "worker-src 'self' drift: blob:",
+    /*
+     * **`ws:` beside `wss:`, because a relay on a local network cannot hold a certificate.**
+     *
+     * `ws://192.168.1.20:8787` is the ordinary case for a desktop game with its own server, and no
+     * certificate authority issues for a private address — so the secure scheme is not an
+     * alternative there, it is a refusal. A public relay needs `wss:` regardless and is unaffected.
+     *
+     * **What this widens, stated rather than waved past.** Reaching an arbitrary host was already
+     * permitted: `https:` and `wss:` are both open, so a compromised asset could already talk to a
+     * server of its choosing. What `ws:` adds is plaintext, which is the developer's own choice about
+     * their own traffic, and sockets to services on the machine itself, which `http:` being absent
+     * still denies to everything else. Neither is the attack `script-src` is here for.
+     *
+     * **A manifest field was the other option and is not taken.** `drift.package.json` says nothing
+     * about the policy today, and the first thing it said should not be a security surface a consumer
+     * has to get right — particularly when the value it would carry is the one this line now has.
+     */
+    "connect-src 'self' drift: blob: data: https: wss: ws:",
+];
+/** The header value, as one string. */
+export const CSP = DIRECTIVES.join('; ');
+/** The source list for one directive, or an empty array when the policy does not carry it. */
+export function sourcesFor(directive) {
+    const found = DIRECTIVES.find((entry) => entry.startsWith(`${directive} `));
+    return found === undefined ? [] : found.slice(directive.length + 1).split(' ');
+}

package/dist/main/entry.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/main/entry.js

@@ -0,0 +1,56 @@
+import { app } from 'electron';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parseManifest } from '../manifest.js';
+import { startApp } from './window.js';
+/**
+ * What the packaged application actually starts.
+ *
+ * The layout beside this file is fixed by the builder and is worth stating once, because three
+ * files depend on it agreeing:
+ *
+ *     main.cjs                this, bundled
+ *     preload.cjs             the bridge, bundled
+ *     drift.package.json      the manifest, copied verbatim from the consumer's project
+ *     app/                    the game's built web bundle, with index.html at its root
+ *
+ * **The target is derived rather than baked in.** A build produces one artifact per target and
+ * each runs on exactly one platform, so asking the process it is running in cannot be wrong —
+ * where a value written at build time can be, and would be discovered as the wrong Chromium flags
+ * on somebody else's machine.
+ */
+function hostTarget() {
+    if (process.platform === 'win32')
+        return 'win-x64';
+    if (process.platform === 'darwin')
+        return process.arch === 'x64' ? 'mac-x64' : 'mac-arm64';
+    return 'linux-x64';
+}
+const here = __dirname;
+const manifest = parseManifest(JSON.parse(readFileSync(join(here, 'drift.package.json'), 'utf8')));
+/**
+ * Whether this is a development run, which decides what a person can open.
+ *
+ * **Absent means production, and that direction is the whole point.** A shipped artifact whose
+ * marker file was lost must not fall back to exposing developer tools; a development run whose
+ * marker is missing merely loses a convenience.
+ */
+function isDevelopment() {
+    try {
+        const raw = JSON.parse(readFileSync(join(here, 'build.json'), 'utf8'));
+        return raw.development === true;
+    }
+    catch {
+        return false;
+    }
+}
+startApp(manifest, join(here, 'app'), hostTarget(), { development: isDevelopment() }).catch((cause) => {
+    /*
+     * A failure here is a failure to open a window at all, and there is nothing on screen to show
+     * it on. The console is what a player can be asked to copy, and a non-zero exit is what a Steam
+     * launch reports.
+     */
+    console.error('[drift-package] the application could not start:', cause);
+    process.exitCode = 1;
+    app.quit();
+});

package/dist/main/ipc.d.ts

@@ -0,0 +1,28 @@
+import { BrowserWindow } from 'electron';
+import type { SteamRuntime } from '../steam/main.ts';
+/**
+ * What the game starts with, read from wherever this build's saves live.
+ *
+ * Steam Cloud first where a store answered, because a player who moved machines expects their
+ * settings to have travelled — and falling back to the local file when the cloud has nothing is
+ * what makes the first launch after enabling Steam keep the saves it already had.
+ */
+export declare function readStoreSnapshot(steam?: SteamRuntime | null): Record<string, string>;
+/** What the window half needs back from here, so quitting is one decision in one place. */
+export interface QuitProtocol {
+    /** True once the game has said it wants to be told before the window closes. */
+    wantsNotice(): boolean;
+    /** True when the close should proceed rather than be deferred. */
+    mayClose(): boolean;
+    /** Called from the window's `close` handler when it defers, to arm the grace timer. */
+    deferClose(window: BrowserWindow): void;
+}
+export declare function installIpc(snapshot: Record<string, string>, windowOf: () => BrowserWindow | null, steam?: SteamRuntime | null): QuitProtocol;
+/**
+ * The refresh rate of the display this window is on, which the browser implementation of
+ * `DisplayControl` has to answer null for.
+ *
+ * Null rather than a plausible 60 where the platform withholds it, matching the engine's rule:
+ * something will divide by this.
+ */
+export declare function refreshHzFor(window: BrowserWindow | null): number | null;