@driftengine/package 3.63.0 → 4.1.0

package/NOTICE

@@ -7,3 +7,23 @@ This product includes software developed at Drift Technologies
 Licensed under the Apache License, Version 2.0. Section 4(d) of that licence
 requires this NOTICE to be reproduced in any derivative work you distribute,
 in the source, the documentation, or a display generated by the work.
+
+Models run by DriftCapture
+--------------------------
+DriftCapture runs the models below. Their weights are not in this repository
+and are not distributed with it: tools/capture-weights/ fetches each at the
+revision its manifest pins, verifies it, and converts it, and a game that
+ships one ships it under that model's own licence. Each model's definition in
+this engine is written from its project's published code.
+
+- Depth Anything 3 Small and Depth Anything 3 Base. Apache License 2.0.
+  Copyright (c) 2025 ByteDance Ltd. and/or its affiliates.
+- Depth Anything V2 Small. Apache License 2.0. The University of Hong Kong
+  and TikTok; converted to the Transformers layout by The HuggingFace Team.
+- MobileSAM. Apache License 2.0. Its image encoder is TinyViT, Copyright (c)
+  2022 Microsoft; its prompt encoder and mask decoder are Segment Anything's,
+  Copyright (c) Meta Platforms, Inc. and affiliates.
+- SAM 2.1 tiny. Apache License 2.0. Copyright (c) Meta Platforms, Inc. and
+  affiliates.
+- OWLv2 base patch16. Apache License 2.0. Copyright 2023 Google AI and The
+  HuggingFace Team.

package/README.md

@@ -7,7 +7,7 @@ learning what a shell is.
 npx drift-package init                   # writes the two scripts your repository has to own
 npx drift-package doctor                 # is this project packageable, and how would it be signed
 npx drift-package run                    # the real shell, from source, no installer
-npx drift-package build --target=linux-x64
+npx drift-package build --target=native-linux-x64
 npx drift-package verify --contains=<a string from your diff>
 ```
 
@@ -64,6 +64,8 @@ Beside your `package.json`, in the project that produces the web build:
 ```
 
 `id`, `name`, `entry` and `targets` are required; every rejection names the field it is about.
+`native.entry` is required when `targets` names `native-linux-x64`, and nowhere else — see
+[the native target](#the-native-target-and-electron-as-the-compatibility-target).
 `icon` is a 1024x1024 PNG and defaults to the engine's own mark, because the alternative default is
 Electron's logo. `window.mode` is what the window is _created_ as — `borderless` makes it
 frameless — and is a different thing from the runtime mode a settings screen changes.
@@ -327,6 +329,60 @@ which is committed.
 mobile build is 20 MB rather than 200, and it is also why WebGL2 is the baseline there: what the
 device offers is what the game gets, and the acceptance probe decides.
 
+## The native target, and Electron as the compatibility target
+
+**On Linux x64, `native-linux-x64` is the target to ship.** It runs the game on
+[`@driftengine/native-host`](../native-host/README.md) — Node, Dawn and SDL, with no browser — and
+the archive carries everything that runs it:
+
+    startup/                   what the archive holds, and what a Steam depot would upload
+      startup                  the launcher: the Node beside it, running the game
+      runtime/node             the Node that ran the build
+      app/game.mjs             the game, the host and the engine, bundled for Node
+      app/modules/             each module the bundle starts by URL: workers, the thread bootstrap
+      app/node_modules/        the modules that cannot be bundled, and what they load
+      app/public/              the game's web build, which its `fetch` of a relative path reads
+      licenses/                Node's licence and every package's, with INDEX.txt
+    Startup-1.0.0-linux-x64.tar.gz
+
+Two things it needs of the game. **The host**, installed beside it at the packager's version —
+`npm install @driftengine/native-host@<version>`; `doctor` names the command when it is missing, and
+a build refuses a host from another release. **A native entry**, `native.entry` in the manifest: a
+module exporting `mount(canvas)`, since there is no page there for a game to find its canvas in.
+The game's page still builds as before, and its files are what the host serves to the game's
+`fetch`. Saves are kept where the desktop target keeps them, under the same name, so a player
+moving between the two builds keeps theirs.
+
+**Measured 2026-09-19**, one small program — the starter's lit cube — packaged both ways on one
+machine (an RX 9070 XT under COSMIC), with `npm run native:startup -- --electron` in the engine's
+repository:
+
+|                      | `native-linux-x64`            | `linux-x64` (Electron 43.4.1)         |
+| -------------------- | ----------------------------- | ------------------------------------- |
+| archive              | 61.3 MB                       | 121.7 MB tarball, 128.5 MB AppImage   |
+| unpacked             | 181.2 MB, of which Node 124.8 | 330.6 MB                              |
+| spawn to first frame | 750 ms, WebGPU                | 380 ms, WebGL2 — it offered no WebGPU |
+| build                | 7 s                           | 3 min 13 s                            |
+
+The native start is mostly the renderer's pipelines, compiled on every launch because the binding
+exposes Dawn's cache to nothing: 355 ms of the 750, where Node's own start is 17. **On that
+machine's Wayland session the Electron build did not start at all** — its main thread waits on the
+compositor's socket before `ready` — so it was timed under XWayland, where the native host's window
+is too.
+
+**The Electron targets are kept, as the compatibility target**, and nothing that shipped stops
+shipping: they are the desktop build on Windows and macOS, where there is no native host yet — it
+reaches both after 4.0.0, and the three bindings already publish binaries for them — and on
+Linux the build for a game with no native entry yet, or one that needs what the host lacks — WebGL2
+beneath WebGPU on a machine with no Vulkan device, a DOM beyond the canvas, the engine's badge, and
+a store (`steam.appId` does nothing on the host, and `doctor` says so).
+
+**No copyleft library is bundled.** The Opus decoder's Ogg parser is LGPL-3.0, so it ships as a
+file of its own in `app/node_modules`, which a person can replace, with the GPL's text beside it in
+`licenses/`; any other that would land in the bundle stops the build, naming it. `verify
+--target=native-linux-x64` looks in the native bundle, which is built from the game's source rather
+than copied from its web build.
+
 ## Where each artifact is built
 
 An artifact is built on the platform it targets, with one exception, and `build` refuses the ones
@@ -334,6 +390,7 @@ this machine cannot honestly produce.
 
 | target                 | built on                        | how                                                                                     |
 | ---------------------- | ------------------------------- | --------------------------------------------------------------------------------------- |
+| `native-linux-x64`     | Linux on x64                    | `npx drift-package build --target=native-linux-x64`                                     |
 | `linux-x64`            | Linux                           | `npx drift-package build --target=linux-x64`                                            |
 | `win-x64`              | Windows, a VM is fine           | `drift-package init` writes `scripts/build-windows.ps1` into your project; run it there |
 | `mac-arm64`, `mac-x64` | macOS, **or Linux**             | [`scripts/build-macos.sh`](scripts/build-macos.sh), or `build --target=mac-arm64`       |

package/android/.gradle/buildOutputCleanup/cache.properties

@@ -1,2 +1,2 @@
-#Tue Sep 01 09:58:03 CEST 2026
+#Sun Sep 20 15:44:54 CEST 2026
 gradle.version=8.9

package/dist/bootstrap.js

@@ -23,9 +23,15 @@ import { PINS, ensureDir, findAndroidSdk, findGradle, findJavaHome, findRcodesig
 export async function bootstrap(targets) {
     const wantsAndroid = targets.includes('android');
     const wantsIos = targets.includes('ios');
-    const wantsDesktop = targets.some((target) => target !== 'android' && target !== 'ios');
+    const wantsDesktop = targets.some((target) => target !== 'android' && target !== 'ios' && target !== 'native-linux-x64');
     if (wantsDesktop)
         await bootstrapElectron();
+    if (targets.includes('native-linux-x64')) {
+        /* A machine is ready for it as it is: the artifact carries the Node running the build, and the
+           host is a dependency of the game, which `npm install` there fetches. */
+        console.log('ok: native-linux-x64 needs nothing fetched for this machine — it ships the Node running the ' +
+            "build — and the game needs @driftengine/native-host installed, at the packager's version");
+    }
     if (targets.some((target) => needsRcodesign(target)))
         await bootstrapRcodesign();
     if (wantsAndroid)

package/dist/build.js

@@ -5,6 +5,7 @@ import { fileURLToPath } from 'node:url';
 import { buildAndroid } from './android.js';
 import { buildIos } from './ios.js';
 import { crossSignMacApp, zipMacApp } from './macCrossSign.js';
+import { buildNative } from './native.js';
 import { outFor } from './outDir.js';
 import { resourceFile } from './resources.js';
 import { ensureElectronRuntime } from './runtime.js';
@@ -41,6 +42,9 @@ const HOST_FOR = {
     'mac-arm64': 'darwin',
     'mac-x64': 'darwin',
     'linux-x64': 'linux',
+    /* The native host ships the Node that runs the build and the binaries installed beside it;
+       `native.ts` refuses the machine itself, architecture included. */
+    'native-linux-x64': 'linux',
     /* Android's toolchain is Java and it runs anywhere; iOS needs Xcode, which is a Mac. */
     android: null,
     ios: 'darwin',
@@ -68,16 +72,6 @@ function refuseHost(target, platform) {
         'Wine cannot reach a certificate store, which is the one platform where that matters.');
 }
 export async function build(manifest, cwd, targets, options = {}) {
-    const { build: run, Arch, Platform } = await import('electron-builder');
-    /* One artifact per target, and the architecture is named rather than inherited: a build on an
-       Apple Silicon machine defaults to arm64, so `mac-x64` asked for on one would quietly produce
-       the wrong slice. */
-    const targetFor = (name) => name === 'win-x64'
-        ? Platform.WINDOWS.createTarget(undefined, Arch.x64)
-        : name === 'linux-x64'
-            ? Platform.LINUX.createTarget(undefined, Arch.x64)
-            : Platform.MAC.createTarget(undefined, name === 'mac-x64' ? Arch.x64 : Arch.arm64);
-    const electronVersion = await installedElectronVersion();
     for (const target of targets) {
         if (target === 'android') {
             await buildAndroid(manifest, cwd, outFor(cwd, target, options), options);
@@ -87,9 +81,28 @@ export async function build(manifest, cwd, targets, options = {}) {
             await buildIos(manifest, cwd, outFor(cwd, target, options), options);
             continue;
         }
+        if (target === 'native-linux-x64') {
+            await buildNative(manifest, cwd, outFor(cwd, target, options));
+            continue;
+        }
         const refusal = refuseHost(target, process.platform);
         if (refusal !== null)
             throw new Error(refusal);
+        /*
+         * **Electron's builder and version are read here, for an Electron target**, rather than before
+         * the loop: a build of the native target alone needs neither.
+         *
+         * One artifact per target, and the architecture is named rather than inherited: a build on an
+         * Apple Silicon machine defaults to arm64, so `mac-x64` asked for on one would quietly produce
+         * the wrong slice.
+         */
+        const { build: run, Arch, Platform } = await import('electron-builder');
+        const targetFor = (name) => name === 'win-x64'
+            ? Platform.WINDOWS.createTarget(undefined, Arch.x64)
+            : name === 'linux-x64'
+                ? Platform.LINUX.createTarget(undefined, Arch.x64)
+                : Platform.MAC.createTarget(undefined, name === 'mac-x64' ? Arch.x64 : Arch.arm64);
+        const electronVersion = await installedElectronVersion();
         /*
          * **The runtime, before anything is staged.** `installedElectronVersion` below reads a version
          * out of `electron/package.json`, which is in the npm tarball — so it answers even when the

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { spawn } from 'node:child_process';
-import { mkdtempSync, readFileSync, readdirSync, rmSync, statSync } from 'node:fs';
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync } from 'node:fs';
 import { writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
@@ -11,6 +11,7 @@ import { refuseLyingFilesystem } from './identity.js';
 import { init } from './init.js';
 import { outFor } from './outDir.js';
 import { parseManifest } from './manifest.js';
+import { executableName, nativeHost, nativeNotes, packagerVersion } from './native.js';
 import { planSigning } from './signing.js';
 import { electronMajor } from './runtimeVersion.js';
 import { depotScripts } from './steam/depot.js';
@@ -35,7 +36,7 @@ delete process.env.ELECTRON_RUN_AS_NODE;
 /**
  * `drift-package` — the command a consumer runs to get an installable application.
  *
- * Four subcommands, and `verify` is the one that is not obvious. An artifact that was never
+ * Seven subcommands, and `verify` is the one that is not obvious. An artifact that was never
  * rebuilt is byte-identical in every respect a build log can see, so the only honest check is to
  * look inside the shipped thing for a string from the change. This repository already learned that
  * about deploys: an asset hash proves nothing.
@@ -121,6 +122,22 @@ async function doctor(cwd, options = {}) {
      * arrive twenty minutes later from Gradle.
      */
     for (const target of manifest.targets) {
+        /*
+         * **The native target asks nothing of the machine and one thing of the game**: it ships the
+         * Node running this, and it needs the host installed beside the game, which `bootstrap` cannot
+         * do because it prepares a machine rather than a project.
+         */
+        if (target === 'native-linux-x64') {
+            for (const note of nativeNotes(manifest))
+                console.log(`  ${target}: ${note}`);
+            try {
+                nativeHost(cwd, packagerVersion());
+            }
+            catch (cause) {
+                console.log(`  ${target}: ${cause instanceof Error ? cause.message : String(cause)}`);
+            }
+            continue;
+        }
         const ready = await toolchainReady(target);
         if (ready)
             continue;
@@ -129,10 +146,28 @@ async function doctor(cwd, options = {}) {
     }
     return manifest;
 }
-function verify(cwd, needle) {
+/**
+ * **The native target is looked at in its own bundle**, because the build makes that from the game's
+ * source rather than copying the web build: the web build inside it, `public/`, and the copied
+ * modules are left out, so a fresh web build cannot vouch for a stale native one.
+ */
+function verify(cwd, needle, target, options) {
     const manifest = loadManifest(cwd);
-    const root = join(cwd, dirname(manifest.entry));
-    const found = walk(root).some((file) => readFileSync(file, 'utf8').includes(needle));
+    let root = join(cwd, dirname(manifest.entry));
+    let files;
+    if (target === 'native-linux-x64') {
+        root = join(outFor(cwd, target, options), executableName(manifest), 'app');
+        if (!existsSync(root)) {
+            throw new Error(`verify: there is no native build at ${root}; \`drift-package build ` +
+                '--target=native-linux-x64` makes one.');
+        }
+        const skip = new Set([join(root, 'public'), join(root, 'node_modules')]);
+        files = walk(root).filter((file) => ![...skip].some((dir) => file.startsWith(`${dir}/`)));
+    }
+    else {
+        files = walk(root);
+    }
+    const found = files.some((file) => readFileSync(file, 'utf8').includes(needle));
     if (!found) {
         throw new Error(`verify: "${needle}" is in no file under ${root}. That is what a build that did not rerun ` +
             'looks like — the artifact exists and is stale.');
@@ -223,7 +258,13 @@ async function writeSteamScripts(cwd, args, options) {
     const depotId = depotArg === undefined ? manifest.steam.appId + 1 : Number.parseInt(depotArg.slice(8), 10);
     const branchArg = args.find((entry) => entry.startsWith('--branch='));
     const outDir = outFor(cwd, target, options);
-    const content = target === 'linux-x64' ? 'linux-unpacked' : target === 'win-x64' ? 'win-unpacked' : 'mac';
+    const content = target === 'native-linux-x64'
+        ? executableName(manifest)
+        : target === 'linux-x64'
+            ? 'linux-unpacked'
+            : target === 'win-x64'
+                ? 'win-unpacked'
+                : 'mac';
     const scripts = depotScripts({
         appId: manifest.steam.appId,
         depotId,
@@ -305,7 +346,9 @@ try {
         const arg = rest.find((entry) => entry.startsWith('--contains='));
         if (arg === undefined)
             throw new Error('verify needs --contains=<string>');
-        verify(cwd, arg.slice('--contains='.length));
+        const asked = rest.find((entry) => entry.startsWith('--target='));
+        const target = asked === undefined ? null : asked.slice('--target='.length);
+        verify(cwd, arg.slice('--contains='.length), target, resources);
     }
     else if (command === 'run') {
         process.exitCode = await run(cwd, resources);

package/dist/flags.js

@@ -25,6 +25,22 @@ export function planFlags(manifest, target, electronMajor = null) {
      */
     if (target === 'android' || target === 'ios')
         return { switches: [], refusal: null, notes: [] };
+    /*
+     * **The native host has no Chromium either, and no WebGL2 beneath its WebGPU**: Dawn is its whole
+     * renderer. So a switch is nothing there, and a manifest that turns WebGPU off asks for the one
+     * backend that target does not have — refused, rather than shipped as a window that cannot draw.
+     */
+    if (target === 'native-linux-x64') {
+        return {
+            switches: [],
+            notes: [],
+            refusal: manifest.backend.webgpu === 'off'
+                ? "native-linux-x64 draws with WebGPU alone — Dawn is the host's renderer and there is " +
+                    'no WebGL2 beneath it — so backend.webgpu "off" cannot be honoured there. Set it to ' +
+                    '"prefer" or "require", or build a desktop target for WebGL2.'
+                : null,
+        };
+    }
     const switches = [];
     const notes = [];
     const wantsWebGpu = manifest.backend.webgpu !== 'off';

package/dist/main/ipc.js

@@ -1,8 +1,8 @@
 import { BrowserWindow, app, dialog, ipcMain, screen } from 'electron';
-import { readFileSync, writeFileSync } from 'node:fs';
 import { readFile, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { SteamCloudStore } from '../steam/cloudStore.js';
+import { readStoreFile, writeStoreFile, writeStoreFileSync } from './storeFile.js';
 /**
  * The main-process half of the bridge: a file-backed store, dialogs, focus, and quit.
  *
@@ -60,22 +60,8 @@ function cloudSnapshot(steam) {
     return out;
 }
 function readLocalSnapshot() {
-    try {
-        const parsed = JSON.parse(readFileSync(storeFile(), 'utf8'));
-        if (typeof parsed !== 'object' || parsed === null)
-            return {};
-        const out = {};
-        for (const [key, value] of Object.entries(parsed)) {
-            if (typeof value === 'string')
-                out[key] = value;
-        }
-        return out;
-    }
-    catch {
-        /* No file yet, or an unreadable one. A fresh store is the right answer to both: a
-           preference is never worth failing a boot for. */
-        return {};
-    }
+    /* No file yet, or an unreadable one, reads as a fresh store: see `storeFile.ts`. */
+    return readStoreFile(storeFile());
 }
 export function installIpc(snapshot, windowOf, steam = null) {
     const entries = new Map(Object.entries(snapshot));
@@ -94,7 +80,7 @@ export function installIpc(snapshot, windowOf, steam = null) {
                 cloud.write(key, value);
             return;
         }
-        void writeFile(storeFile(), JSON.stringify(Object.fromEntries(entries)), 'utf8').catch((cause) => console.error('[driftengine] could not write the store:', cause));
+        void writeStoreFile(storeFile(), entries).catch((cause) => console.error('[driftengine] could not write the store:', cause));
     };
     const schedule = () => {
         if (pending === null)
@@ -246,7 +232,7 @@ export function installIpc(snapshot, windowOf, steam = null) {
                     cloud.write(key, value);
                 return;
             }
-            writeFileSync(storeFile(), JSON.stringify(Object.fromEntries(entries)), 'utf8');
+            writeStoreFileSync(storeFile(), entries);
         }
         catch (cause) {
             console.error('[driftengine] could not write the store on the way out:', cause);

package/dist/main/storeFile.d.ts

@@ -0,0 +1,30 @@
+/**
+ * A shell's key-value store as one JSON file, replaced whole so that nothing ever sees half of it.
+ *
+ * **Written beside the store and renamed over it.** A rename replaces a file in one step, so a
+ * reader — or the next boot, after a crash at any instant — finds the previous store or the next
+ * one and never a mixture. Written in place, as this was until 2026-09-19, the file is empty from
+ * the moment it is opened until the write lands: a test reading it during rewrites found it torn on
+ * 72 reads of 119, and a store that does not parse is read as an empty one, so a crash then costs
+ * the player every setting they ever made, with nothing said. **Synced before the rename**, so the
+ * replacement carries its bytes to the disk before the name moves: without it a power cut can
+ * leave the new name on a file whose contents never arrived.
+ *
+ * **Asynchronous writes land in the order they were asked for.** Each waits for the one before it,
+ * so a large early write finishing after a small late one cannot put the older store back.
+ *
+ * What it gives up: the directory is not synced, so a power cut straight after a rename may bring
+ * back the previous store rather than the new one — a lost second of settings, not a lost store.
+ * Both shells use this: the desktop shell's main process and the native host.
+ */
+type Entries = Iterable<readonly [string, string]>;
+/**
+ * The store, or an empty one when there is no file or the file is not a store. A value that is not a
+ * string is dropped. A preference is never worth failing a boot for.
+ */
+export declare function readStoreFile(path: string): Record<string, string>;
+/** Replace the store now, for the way out, where there is no later to wait for. */
+export declare function writeStoreFileSync(path: string, entries: Entries): void;
+/** Replace the store after every write already asked for, with `entries` as they are now. */
+export declare function writeStoreFile(path: string, entries: Entries): Promise<void>;
+export {};

package/dist/main/storeFile.js

@@ -0,0 +1,104 @@
+/**
+ * A shell's key-value store as one JSON file, replaced whole so that nothing ever sees half of it.
+ *
+ * **Written beside the store and renamed over it.** A rename replaces a file in one step, so a
+ * reader — or the next boot, after a crash at any instant — finds the previous store or the next
+ * one and never a mixture. Written in place, as this was until 2026-09-19, the file is empty from
+ * the moment it is opened until the write lands: a test reading it during rewrites found it torn on
+ * 72 reads of 119, and a store that does not parse is read as an empty one, so a crash then costs
+ * the player every setting they ever made, with nothing said. **Synced before the rename**, so the
+ * replacement carries its bytes to the disk before the name moves: without it a power cut can
+ * leave the new name on a file whose contents never arrived.
+ *
+ * **Asynchronous writes land in the order they were asked for.** Each waits for the one before it,
+ * so a large early write finishing after a small late one cannot put the older store back.
+ *
+ * What it gives up: the directory is not synced, so a power cut straight after a rename may bring
+ * back the previous store rather than the new one — a lost second of settings, not a lost store.
+ * Both shells use this: the desktop shell's main process and the native host.
+ */
+import { closeSync, fsyncSync, openSync, readFileSync, renameSync, rmSync, writeSync, } from 'node:fs';
+import { open, rename, rm } from 'node:fs/promises';
+/**
+ * The store, or an empty one when there is no file or the file is not a store. A value that is not a
+ * string is dropped. A preference is never worth failing a boot for.
+ */
+export function readStoreFile(path) {
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        if (typeof parsed !== 'object' || parsed === null)
+            return {};
+        const out = {};
+        for (const [key, value] of Object.entries(parsed)) {
+            if (typeof value === 'string')
+                out[key] = value;
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
+let temporaries = 0;
+/** One name per write, so two writes in flight never share a half-written file. */
+function temporaryFor(path) {
+    temporaries += 1;
+    return `${path}.${process.pid}.${temporaries}.tmp`;
+}
+function textOf(entries) {
+    return JSON.stringify(Object.fromEntries(entries));
+}
+/** Replace the store now, for the way out, where there is no later to wait for. */
+export function writeStoreFileSync(path, entries) {
+    const temporary = temporaryFor(path);
+    try {
+        const file = openSync(temporary, 'w');
+        try {
+            writeSync(file, textOf(entries));
+            fsyncSync(file);
+        }
+        finally {
+            closeSync(file);
+        }
+        renameSync(temporary, path);
+    }
+    catch (cause) {
+        rmSync(temporary, { force: true });
+        throw cause;
+    }
+}
+const queues = new Map();
+/** Replace the store after every write already asked for, with `entries` as they are now. */
+export function writeStoreFile(path, entries) {
+    const text = textOf(entries);
+    const before = queues.get(path) ?? Promise.resolve();
+    const next = before
+        .catch(() => undefined)
+        .then(async () => {
+        const temporary = temporaryFor(path);
+        try {
+            const file = await open(temporary, 'w');
+            try {
+                await file.writeFile(text, 'utf8');
+                await file.sync();
+            }
+            finally {
+                await file.close();
+            }
+            await rename(temporary, path);
+        }
+        catch (cause) {
+            await rm(temporary, { force: true });
+            throw cause;
+        }
+    });
+    queues.set(path, next);
+    /* Forgotten once it is the last, so the map holds nothing for a store no longer written. */
+    void next
+        .catch(() => undefined)
+        .then(() => {
+        if (queues.get(path) === next)
+            queues.delete(path);
+    });
+    return next;
+}

package/dist/main/window.js

@@ -151,7 +151,10 @@ export async function startApp(manifest, root, target, options = { development:
         window.once('ready-to-show', () => window?.show());
     }
     else {
-        const startedAt = Date.now();
+        /* Monotonic. Every reading here is subtracted from another and compared against a minimum,
+           and a wall clock that steps backwards holds the badge forever while one that steps forwards
+           flashes it and shows a white window. */
+        const startedAt = performance.now();
         let painted = false;
         let badgeShownAt = null;
         window.once('ready-to-show', () => {
@@ -163,7 +166,7 @@ export async function startApp(manifest, root, target, options = { development:
          * the time it is meant to be readable for — so it is counted from here.
          */
         splash.once('show', () => {
-            badgeShownAt ??= Date.now();
+            badgeShownAt ??= performance.now();
         });
         /*
          * And a badge that cannot load is not worth holding a game for: counting its minimum from
@@ -174,7 +177,7 @@ export async function startApp(manifest, root, target, options = { development:
             badgeShownAt ??= startedAt;
         });
         const poll = setInterval(() => {
-            const now = Date.now();
+            const now = performance.now();
             const sinceBadge = badgeShownAt === null ? null : now - badgeShownAt;
             if (splashDecision(now - startedAt, sinceBadge, manifest.splash.minMs, painted) === 'hold')
                 return;

package/dist/manifest.d.ts

@@ -1,5 +1,5 @@
 export type WebGpuPolicy = 'prefer' | 'require' | 'off';
-export type Target = 'win-x64' | 'mac-arm64' | 'mac-x64' | 'linux-x64' | 'android' | 'ios';
+export type Target = 'win-x64' | 'mac-arm64' | 'mac-x64' | 'linux-x64' | 'native-linux-x64' | 'android' | 'ios';
 /** The two that are a phone rather than a desktop, and differ in almost every way that matters. */
 export declare const MOBILE_TARGETS: readonly Target[];
 export interface PackageManifest {
@@ -21,6 +21,13 @@ export interface PackageManifest {
         readonly gamepad: boolean;
     };
     readonly targets: readonly Target[];
+    /**
+     * The module a native target mounts: it exports `mount(canvas)`, which the native host calls with
+     * its canvas, since there is no page there to find one in. Null unless a native target is built.
+     */
+    readonly native: {
+        readonly entry: string;
+    } | null;
     readonly steam: {
         readonly appId: number | null;
     };

package/dist/manifest.js

@@ -19,6 +19,7 @@ const TARGETS = [
     'mac-arm64',
     'mac-x64',
     'linux-x64',
+    'native-linux-x64',
     'android',
     'ios',
 ];
@@ -63,6 +64,12 @@ export function parseManifest(raw) {
             throw new Error(`drift.package.json: unknown target "${String(target)}" — expected one of ${TARGETS.join(', ')}`);
         }
     }
+    const nativeRaw = (source.native ?? {});
+    const nativeEntry = typeof nativeRaw.entry === 'string' && nativeRaw.entry.length > 0 ? nativeRaw.entry : null;
+    if (targetsRaw.includes('native-linux-x64') && nativeEntry === null) {
+        throw new Error('drift.package.json: the native-linux-x64 target needs "native.entry", the module whose ' +
+            '`mount(canvas)` the native host calls — there is no page there to find a canvas in');
+    }
     const windowRaw = (source.window ?? {});
     const featuresRaw = (source.features ?? {});
     const steamRaw = (source.steam ?? {});
@@ -101,6 +108,7 @@ export function parseManifest(raw) {
             gamepad: featuresRaw.gamepad !== false,
         },
         targets: targetsRaw,
+        native: nativeEntry === null ? null : { entry: nativeEntry },
         steam: { appId: typeof appId === 'number' ? appId : null },
         publisher: typeof source.publisher === 'string' && source.publisher.length > 0
             ? source.publisher