@ifc-lite/viewer 1.23.0 → 1.25.0

package/src/lib/desktop-product.ts

@@ -12,7 +12,8 @@ export type DesktopFeature =
   | 'exports'
   | 'ids_validation'
   | 'bcf_issue_management'
-  | 'ai_assistant';
+  | 'ai_assistant'
+  | 'extensions';
 
 export interface DesktopEntitlement {
   tier: DesktopPlanTier;
@@ -69,6 +70,11 @@ const DESKTOP_FEATURES: Record<DesktopFeature, DesktopFeatureDefinition> = {
     description: 'Optional host-provided AI integrations.',
     free: true,
   },
+  extensions: {
+    label: 'Extensions & flavors',
+    description: 'Install user-authored extensions, manage flavors, and access the authoring loop.',
+    free: true,
+  },
 };
 
 export function isDesktopBillingEnforced(): boolean {

package/src/lib/lens/adapter.ts

@@ -25,6 +25,7 @@ import type { FederatedModel } from '@/store/types';
 
 interface ModelEntry {
   id: string;
+  name: string;
   ifcDataStore: IfcDataStore;
   idOffset: number;
   maxExpressId: number;
@@ -58,6 +59,7 @@ export function createLensDataProvider(
       if (model.ifcDataStore) {
         entries.push({
           id: model.id,
+          name: model.name,
           ifcDataStore: model.ifcDataStore,
           idOffset: model.idOffset ?? 0,
           maxExpressId: model.maxExpressId ?? 0,
@@ -67,6 +69,7 @@ export function createLensDataProvider(
   } else if (legacyDataStore) {
     entries.push({
       id: 'legacy',
+      name: 'Model',
       ifcDataStore: legacyDataStore,
       idOffset: 0,
       maxExpressId: computeMaxExpressId(legacyDataStore),
@@ -285,6 +288,17 @@ export function createLensDataProvider(
       if (info.materials?.length) return info.materials[0]?.name;
       return undefined;
     },
+
+    getModelId(globalId: number): string | undefined {
+      const resolved = resolveGlobalId(globalId, entries);
+      if (!resolved) return undefined;
+      return resolved.entry.id;
+    },
+
+    getModelName(modelId: string): string | undefined {
+      const entry = entries.find(e => e.id === modelId);
+      return entry?.name ?? modelId;
+    },
   };
 }
 

package/src/lib/llm/prompt-cache.ts

@@ -0,0 +1,77 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+/**
+ * Prompt-cache shaping helpers shared by `stream-direct.ts` (BYOK
+ * Anthropic SDK path) and `stream-client.ts` (proxy path).
+ *
+ * Anthropic supports a `cache_control: { type: 'ephemeral' }` marker
+ * on system-prompt blocks that pins the prefix into a 5-minute server
+ * cache. Subsequent calls with the same prefix hit the cache and pay
+ * a 10% read cost instead of the full input price.
+ *
+ * Threshold: 4096 chars (~1024 tokens at 4 chars/token) — Anthropic's
+ * documented minimum cacheable size. Below the threshold the wrapper
+ * returns the raw string, so cheap one-shot turns don't get the array
+ * shape.
+ *
+ * The contract: callers send the result as `system` in the
+ * Messages.create payload. The Anthropic SDK and the proxy both
+ * accept both `string` and the array form, so this is safe on both
+ * paths.
+ *
+ * Observability: when caching kicks in we log to console under
+ * `[ext:prompt-cache]`. The Anthropic response carries usage fields
+ * `cache_creation_input_tokens` and `cache_read_input_tokens` —
+ * stream callers that surface these via `onUsageInfo` get the hit
+ * rate visible in dev tools.
+ */
+
+const CACHE_THRESHOLD_CHARS = 4096;
+
+export interface CacheableTextBlock {
+  type: 'text';
+  text: string;
+  cache_control?: { type: 'ephemeral' };
+}
+
+/**
+ * Build the `system` argument for an Anthropic call. Returns:
+ *   - `undefined` when the input is empty
+ *   - the raw string when below threshold
+ *   - a single-element array with `cache_control: { type: 'ephemeral' }`
+ *     when the prompt is long enough to be worth caching
+ */
+export function buildCacheableSystem(
+  system: string | undefined,
+): string | CacheableTextBlock[] | undefined {
+  if (!system) return undefined;
+  if (system.length < CACHE_THRESHOLD_CHARS) return system;
+  if (typeof console !== 'undefined' && console.debug) {
+    console.debug(
+      `[ext:prompt-cache] wrapping ${system.length}-char system prompt in ephemeral cache block`,
+    );
+  }
+  return [{ type: 'text', text: system, cache_control: { type: 'ephemeral' } }];
+}
+
+/**
+ * Log a cache-hit summary from a usage payload when present. Callers
+ * forward this from the stream completion event so we can see the
+ * cache_read / cache_creation token split per turn in dev tools.
+ */
+export function logCacheHit(usage: {
+  cache_creation_input_tokens?: number;
+  cache_read_input_tokens?: number;
+} | null | undefined): void {
+  if (!usage) return;
+  const creation = usage.cache_creation_input_tokens ?? 0;
+  const read = usage.cache_read_input_tokens ?? 0;
+  if (creation === 0 && read === 0) return;
+  if (typeof console !== 'undefined' && console.debug) {
+    console.debug(
+      `[ext:prompt-cache] cache_read=${read} cache_creation=${creation}`,
+    );
+  }
+}

package/src/lib/llm/stream-client.ts

@@ -9,6 +9,8 @@
  * back as SSE. Extracts usage headers from the response for UI display.
  */
 
+import { buildCacheableSystem, logCacheHit } from './prompt-cache.js';
+
 /** A text content part in a multimodal message */
 export interface TextContentPart {
   type: 'text';
@@ -213,7 +215,17 @@ export async function streamChat(options: StreamOptions): Promise<void> {
     'Content-Type': 'application/json',
   };
 
-  const requestBody = JSON.stringify({ messages, model, system });
+  // Shape the system prompt with cache_control markers when it's
+  // long enough to be worth caching. The proxy passes the body
+  // through to Anthropic, which accepts both string and array forms.
+  // Authoring turns (which ship the ~5 KiB manifest/widget/capability
+  // contract) hit this path; one-shot turns fall under the threshold
+  // and pass through as plain string.
+  const requestBody = JSON.stringify({
+    messages,
+    model,
+    system: buildCacheableSystem(system),
+  });
   const fetchChat = async (url: string) => {
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(new Error('Chat request timed out. Please try again.')), STREAM_REQUEST_TIMEOUT_MS);
@@ -343,7 +355,10 @@ export async function streamChat(options: StreamOptions): Promise<void> {
 
   const ok = await readSseStream(response.body, signal, (data) => {
     const parsed = JSON.parse(data) as {
-      __ifcLiteUsage?: UsageInfo;
+      __ifcLiteUsage?: UsageInfo & {
+        cache_creation_input_tokens?: number;
+        cache_read_input_tokens?: number;
+      };
       choices?: Array<{
         delta?: { content?: string };
         finish_reason?: string | null;
@@ -353,6 +368,9 @@ export async function streamChat(options: StreamOptions): Promise<void> {
     // Final usage update emitted by proxy after stream-end reconciliation.
     if (parsed.__ifcLiteUsage && onUsageInfo) {
       onUsageInfo(parsed.__ifcLiteUsage);
+      // Surface cache hit/miss numbers under the same logger as the
+      // direct path; observability stays consistent across both flows.
+      logCacheHit(parsed.__ifcLiteUsage);
       return;
     }
 

package/src/lib/llm/stream-direct.ts

@@ -16,6 +16,7 @@
 import Anthropic from '@anthropic-ai/sdk';
 import { readSseStream, type StreamMessage, type StreamOptions } from './stream-client.js';
 import { getModelById } from './models.js';
+import { buildCacheableSystem, logCacheHit } from './prompt-cache.js';
 
 const STREAM_REQUEST_TIMEOUT_MS = 45_000;
 
@@ -85,7 +86,12 @@ export async function streamAnthropicChat(
       model,
       max_tokens: 8192,
       ...(sendSamplingParams ? { temperature: 0.3 } : {}),
-      system: system || undefined,
+      // Wrap the system prompt in an ephemeral cache block when it's
+      // long enough to be worth caching (Anthropic's minimum is ~1024
+      // tokens, ≈ 4 KiB). Authoring turns ship the manifest schema +
+      // widget DSL contract which is well over the threshold; one-shot
+      // turns fall under it and pass through as plain string.
+      system: buildCacheableSystem(system),
       messages: toAnthropicMessages(messages),
     });
 
@@ -105,6 +111,10 @@ export async function streamAnthropicChat(
 
     if (signal?.aborted) return;
 
+    // Surface cache hit/miss numbers in dev tools so we can see
+    // whether the authoring contract is paying off.
+    logCacheHit(finalMessage.usage as { cache_creation_input_tokens?: number; cache_read_input_tokens?: number });
+
     const stopReason = finalMessage.stop_reason;
     onFinishReason?.(stopReason === 'end_turn' ? 'stop' : stopReason);
     onComplete(fullText);

package/src/lib/llm/system-prompt.ts

@@ -19,6 +19,7 @@ import {
 import type { FileAttachment } from './types.js';
 import type { ScriptEditorSelection } from './types.js';
 import { formatDiagnosticsForPrompt, type ScriptDiagnostic } from './script-diagnostics.js';
+import { buildAuthoringContract } from '@ifc-lite/extensions';
 
 const MAX_ATTACHMENT_ROWS_IN_PROMPT = 5;
 const MAX_ATTACHMENT_TEXT_PREVIEW_CHARS = 1200;
@@ -54,6 +55,21 @@ export interface ScriptEditorPromptContext {
 export interface PromptTaskContext {
   userPrompt?: string;
   diagnostics?: ScriptDiagnostic[];
+  /**
+   * Personal prompt overlay from the active flavor (RFC §06.4). When
+   * present, it's appended at the very end of the system prompt
+   * inside a clearly-delimited block so we can cache the everything-
+   * else portion across users and only invalidate the tail.
+   */
+  personalOverlay?: string;
+  /**
+   * When set, append the AI authoring contract from
+   * `@ifc-lite/extensions` (manifest schema + widget DSL + capability
+   * catalogue + style rules). Used when the chat classifier flags an
+   * authoring intent. Cached separately so non-authoring turns don't
+   * pay for the extra tokens.
+   */
+  includeAuthoringContract?: boolean;
 }
 
 interface NamespacedMethod {
@@ -350,6 +366,13 @@ export function buildSystemPrompt(
   let prompt = `You are an IFC/BIM scripting assistant embedded in ifc-lite, a web-based IFC viewer with a live 3D viewport.
 You write JavaScript code that executes in a sandboxed environment with a global \`bim\` object.
 
+## SANDBOX CONSTRAINTS (read first)
+Scripts run inside a QuickJS-WASM sandbox, NOT in a browser context.
+You DO have: \`bim\`, \`console\` (log/info/warn/error).
+You do NOT have: \`document\`, \`window\`, \`navigator\`, \`location\`, \`globalThis.*\`, \`fetch\`, \`XMLHttpRequest\`, \`localStorage\`, \`indexedDB\`, \`setTimeout\`/\`setInterval\`, \`eval\`, \`Function(...)\`, dynamic \`import()\`, ES module \`import\`/\`export\`, or any DOM API.
+For UI side-effects use \`bim.viewer.*\` (colorize, isolate, fly, section). For data use \`bim.query\`, \`bim.properties\`, \`bim.export\`. For chat-attached files use \`bim.files.*\`.
+If a previous attempt referenced \`document\`, \`window\`, or \`fetch\`, rewrite using the sandbox APIs above. The sandbox will reject those globals at runtime with a "not defined" error.
+
 ## YOUR CAPABILITIES
 - Create complete IFC buildings from scratch (walls, slabs, columns, beams, stairs, roofs)
 - Query and analyze loaded IFC models
@@ -762,5 +785,24 @@ if (!rows) {
     prompt += `\n${formatDiagnosticsForPrompt(task.diagnostics)}`;
   }
 
+  if (task?.includeAuthoringContract) {
+    // AI extension authoring contract (RFC §04.5/§11). Deterministic
+    // for a given SDK version so a hosted cache layer hits cleanly.
+    // Inject the live SDK version so the AI emits a compatible
+    // `engines.ifcLiteSdk` range instead of guessing a future major.
+    const sdkVersion = typeof __APP_VERSION__ === 'string' && __APP_VERSION__.length > 0
+      ? __APP_VERSION__
+      : undefined;
+    prompt += `\n\n${buildAuthoringContract({ currentSdkVersion: sdkVersion })}`;
+  }
+
+  if (task?.personalOverlay && task.personalOverlay.trim().length > 0) {
+    // Personal prompt overlay — durable user preferences captured by
+    // the memory loop (RFC §06.4). Cached separately so the rest of
+    // the prompt stays cacheable across users.
+    prompt += `\n\n## PERSONAL CONTEXT (from the user's flavor)`;
+    prompt += `\n${task.personalOverlay.trim()}`;
+  }
+
   return prompt;
 }

package/src/lib/safe-mode.ts

@@ -0,0 +1,30 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+/**
+ * Safe-mode entry point.
+ *
+ * The user reaches safe mode by appending `?safe=1` (or `?safe=true`)
+ * to the URL. The desktop Shift-launch wiring referenced in the spec
+ * is a follow-up — the Tauri side needs to append the same query
+ * parameter to the loaded URL when Shift is held; until that lands,
+ * desktop users use the same URL flag from the address bar.
+ *
+ * In safe mode the host:
+ *   - Skips automatic activation of the currently-active flavor.
+ *   - Disables installed extensions for the session — they remain on
+ *     disk but do not load.
+ *   - Surfaces a banner so the user knows the rest of the UI is
+ *     deliberately minimal.
+ *
+ * Spec: docs/architecture/ai-customization/05-flavors-and-sharing.md §6.4.
+ */
+
+/** Returns true if the current page should boot in safe mode. */
+export function isSafeMode(): boolean {
+  if (typeof window === 'undefined') return false;
+  const params = new URLSearchParams(window.location.search);
+  const v = params.get('safe');
+  return v === '1' || v === 'true';
+}

package/src/sdk/ExtensionHostProvider.tsx

@@ -0,0 +1,103 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+/**
+ * `ExtensionHostProvider` — React context for the viewer's extension
+ * host service.
+ *
+ * Sits inside `<BimProvider>` so it can pull the live `BimContext`
+ * out of the existing SDK plumbing. The service is constructed once
+ * on mount, initialised lazily (we kick `init()` on the first commit
+ * and surface the loaded statuses to listeners), and disposed on
+ * unmount — though in practice the viewer lives for the whole tab
+ * session so unmount is rare.
+ *
+ * Components consume the service via `useExtensionHost()` (everything
+ * the user can do) or the specialised hooks
+ * `useSlotContributions(slot)` and `useInstalledExtensions()`.
+ */
+
+import { createContext, useContext, useEffect, useMemo, useState, type ReactNode } from 'react';
+import { useBim } from './BimProvider.js';
+import { ExtensionHostService } from '@/services/extensions/host.js';
+import { isSafeMode } from '@/lib/safe-mode';
+import { toast } from '@/components/ui/toast';
+
+const ExtensionHostContext = createContext<ExtensionHostService | null>(null);
+
+interface ExtensionHostProviderProps {
+  children: ReactNode;
+}
+
+export function ExtensionHostProvider({ children }: ExtensionHostProviderProps) {
+  const bim = useBim();
+  // Service identity must be stable across renders so subscribers don't
+  // tear themselves down on every commit.
+  const service = useMemo(() => new ExtensionHostService({ sdk: bim }), [bim]);
+
+  const [, forceRender] = useState(0);
+  useEffect(() => {
+    if (isSafeMode()) {
+      // Safe mode: skip auto-activation. Service still constructs so
+      // the user can run uninstall / disable / repair from the UI; we
+      // just don't fire onStartup or load extension code.
+      console.info('[ExtensionHostProvider] safe mode — skipping init().');
+      return service.onChange(() => forceRender((n) => n + 1));
+    }
+    service.init()
+      .then((statuses) => {
+        // Partial-failure path: init() succeeded overall but one or
+        // more extensions failed to load. Surface a single toast that
+        // points at the Repair queue — repeated per-extension toasts
+        // would be noisy on a cold boot with many extensions.
+        const failed = statuses.filter((s) => !s.ok);
+        if (failed.length > 0) {
+          const label = failed.length === 1
+            ? `Extension "${failed[0].id}" failed to load.`
+            : `${failed.length} extensions failed to load.`;
+          toast.error(`${label} Open the Extensions panel → Repair queue to retry.`);
+        }
+      })
+      .catch((err) => {
+        console.error('[ExtensionHostProvider] init failed:', err);
+        const message = err instanceof Error ? err.message : String(err);
+        toast.error(
+          `Extension system failed to start: ${message}. Installed extensions ` +
+          `may be unavailable — open the Extensions panel to recover.`,
+        );
+      });
+    return service.onChange(() => forceRender((n) => n + 1));
+  }, [service]);
+
+  useEffect(() => {
+    return () => {
+      service.dispose().catch((err) => {
+        console.error('[ExtensionHostProvider] dispose failed:', err);
+      });
+    };
+  }, [service]);
+
+  return (
+    <ExtensionHostContext.Provider value={service}>
+      {children}
+    </ExtensionHostContext.Provider>
+  );
+}
+
+/**
+ * Access the extension host service. Throws if used outside
+ * `<ExtensionHostProvider>`.
+ */
+export function useExtensionHost(): ExtensionHostService {
+  const ctx = useContext(ExtensionHostContext);
+  if (!ctx) {
+    throw new Error('useExtensionHost() must be used within an <ExtensionHostProvider>');
+  }
+  return ctx;
+}
+
+/** Same as useExtensionHost but returns null instead of throwing. Useful for code paths that may or may not be inside the provider. */
+export function useOptionalExtensionHost(): ExtensionHostService | null {
+  return useContext(ExtensionHostContext);
+}

package/src/services/extensions/flavor-service.ts

@@ -0,0 +1,183 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+/**
+ * `FlavorService` — viewer-side façade for the flavor library.
+ *
+ * Defaults to the IDB-backed storage adapter so flavors persist across
+ * reloads. Tests can pass `InMemoryFlavorStorage` via options. The
+ * service owns the active-flavor pointer, list/CRUD, switch logic,
+ * and snapshot management.
+ *
+ * Spec: docs/architecture/ai-customization/05-flavors-and-sharing.md.
+ */
+
+import {
+  DEFAULT_FLAVOR_ID,
+  flavorImportedId,
+  packFlavor,
+  switchFlavor,
+  unpackFlavor,
+  validateFlavor,
+  type Flavor,
+  type FlavorExtensionState,
+  type FlavorStorage,
+  type FlavorSwitcherCallbacks,
+  type FlavorSwitchResult,
+  type UnpackedFlavor,
+} from '@ifc-lite/extensions';
+import { IdbFlavorStorage } from './idb-flavor-storage.js';
+
+export interface FlavorServiceOptions {
+  storage?: FlavorStorage;
+  /**
+   * Optional callback the service fires on every lifecycle event
+   * (activate, export, import) so the host can mirror them into the
+   * action log for the pattern miner. Content-free: the callback
+   * only sees the flavor id, never any flavor data.
+   */
+  onLifecycle?: (event: 'activate' | 'export' | 'import', id?: string) => void;
+}
+
+export class FlavorService {
+  private readonly storage: FlavorStorage;
+  private readonly onLifecycle?: FlavorServiceOptions['onLifecycle'];
+  private listeners = new Set<() => void>();
+
+  constructor(opts: FlavorServiceOptions = {}) {
+    this.storage = opts.storage ?? new IdbFlavorStorage();
+    this.onLifecycle = opts.onLifecycle;
+  }
+
+  async list(): Promise<Flavor[]> {
+    return this.storage.listFlavors();
+  }
+
+  async getActive(): Promise<Flavor | undefined> {
+    const id = await this.storage.getActiveId();
+    return id ? this.storage.getFlavor(id) : undefined;
+  }
+
+  async put(flavor: Flavor, reason?: string): Promise<void> {
+    await this.storage.putFlavor(flavor, reason);
+    this.emit();
+  }
+
+  async delete(id: string): Promise<void> {
+    await this.storage.deleteFlavor(id);
+    this.emit();
+  }
+
+  async activate(id: string | undefined): Promise<void> {
+    await this.storage.setActiveId(id);
+    if (id) this.onLifecycle?.('activate', id);
+    this.emit();
+  }
+
+  /**
+   * Switch to a target flavor, enabling its extension list and
+   * disabling anything the prior flavor had that this one doesn't.
+   * Callers wire the `callbacks` to their extension loader/runtime.
+   */
+  async switchTo(
+    target: Flavor,
+    installed: readonly FlavorExtensionState[],
+    callbacks: FlavorSwitcherCallbacks,
+  ): Promise<FlavorSwitchResult> {
+    const current = await this.getActive();
+    const result = await switchFlavor({
+      target,
+      installed,
+      current,
+      callbacks,
+    });
+    // Always emit — even on failure the rollback ran and the in-memory
+    // extension state likely moved. The UI needs to refresh either way.
+    this.emit();
+    return result;
+  }
+
+  /** Serialise the active (or named) flavor to a `.iflv` byte array. */
+  async exportFlavor(id?: string, summary?: string): Promise<Uint8Array> {
+    const flavorId = id ?? (await this.storage.getActiveId());
+    if (!flavorId) throw new Error('No active flavor to export.');
+    const flavor = await this.storage.getFlavor(flavorId);
+    if (!flavor) throw new Error(`Unknown flavor: ${flavorId}`);
+    const bytes = packFlavor(flavor, { summary });
+    this.onLifecycle?.('export', flavorId);
+    return bytes;
+  }
+
+  /** Parse + validate a `.iflv` byte array. Does NOT install. */
+  async preview(bytes: Uint8Array): Promise<UnpackedFlavor> {
+    const result = unpackFlavor(bytes);
+    if (!result.ok) {
+      throw new Error(
+        `Flavor did not unpack: ${result.errors[0]?.message ?? 'unknown error'}`,
+      );
+    }
+    return result.value;
+  }
+
+  /** Save a previewed flavor, optionally as a new id. */
+  async importFlavor(
+    unpacked: UnpackedFlavor,
+    opts: { strategy?: 'replace' | 'save-as-new'; newId?: string } = {},
+  ): Promise<Flavor> {
+    const validated = validateFlavor(unpacked.flavor);
+    if (!validated.ok) {
+      throw new Error(
+        `Imported flavor did not validate: ${validated.errors[0]?.message ?? 'unknown'}`,
+      );
+    }
+    let flavor = validated.value;
+    if (opts.strategy === 'save-as-new') {
+      flavor = {
+        ...flavor,
+        id: opts.newId ?? flavorImportedId(flavor.id),
+        updatedAt: new Date().toISOString(),
+      };
+    }
+    await this.storage.putFlavor(flavor, 'imported');
+    this.onLifecycle?.('import', flavor.id);
+    this.emit();
+    return flavor;
+  }
+
+  /** Reset to a clean baseline flavor. */
+  async resetToDefaults(): Promise<Flavor> {
+    const id = DEFAULT_FLAVOR_ID;
+    const now = new Date().toISOString();
+    const flavor: Flavor = {
+      schemaVersion: 1,
+      id,
+      name: 'Default',
+      description: 'Baseline flavor — no extensions, no overrides.',
+      createdAt: now,
+      updatedAt: now,
+      extensions: [],
+      lenses: [],
+      savedQueries: [],
+      keybindings: [],
+      layout: { state: {} },
+      settings: {},
+    };
+    await this.storage.putFlavor(flavor, 'reset to defaults');
+    await this.storage.setActiveId(id);
+    this.emit();
+    return flavor;
+  }
+
+  /** Subscribe to flavor changes. Returns unsubscribe. */
+  onChange(listener: () => void): () => void {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  }
+
+  private emit(): void {
+    for (const l of this.listeners) l();
+  }
+}