@lloyal-labs/desktop 0.1.0-alpha.10

package/LICENSE

@@ -0,0 +1,107 @@
+# Functional Source License, Version 1.1, Apache 2.0 Future License
+
+## Abbreviation
+
+FSL-1.1-Apache-2.0
+
+## Notice
+
+Copyright 2026 Lloyal Labs
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publish, and distribute the
+Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A "Permitted Purpose" is any purpose other than a Competing Use. A
+"Competing Use" means making the Software available to others in a
+commercial product or service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software
+   that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a Licensee
+   using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to
+the infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives
+of the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND,
+INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE,
+MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO
+THE SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL
+DAMAGES, EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software
+under the Apache License, Version 2.0 that is effective on the second
+anniversary of the date we make the Software available. On or after that
+date, you may use the Software under the Apache License, Version 2.0, in
+which case the following will apply:
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not
+use this file except in compliance with the License.
+
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+
+See the License for the specific language governing permissions and
+limitations under the License.

package/dist/content.d.ts

@@ -0,0 +1,20 @@
+import type { Descriptor } from '@lloyal-labs/media';
+/** The scheme's authority: `standard` schemes require one. Every route lives under the path, as on HTTP. */
+export declare const CONTENT_ORIGIN = "attachment://store";
+/**
+ * Must run BEFORE app ready — afterwards the registration is ignored SILENTLY.
+ * All four privileges are load-bearing: `standard` gives the scheme an origin
+ * so CSP can name it, `secure` keeps it out of the mixed-content rules,
+ * `supportFetchAPI` lets `fetch` address it, and without `corsEnabled` the
+ * scheme takes no part in CORS at all, so the handler's allow-origin header
+ * is never consulted and every fetch fails before reaching it.
+ */
+export declare function registerContentScheme(): void;
+/**
+ * Serve reads from the project store; hand an upload to `ingest`. Reading needs
+ * no lock: OCI blobs are content-addressed and immutable. Writing is not ours —
+ * `ingest` belongs to whichever process owns the store, and takes a signal so a
+ * deadline here can actually stop it.
+ */
+export declare function serveContentScheme(projectRoot: string, ingest: (bytes: Uint8Array, signal: AbortSignal) => Promise<Descriptor>): void;
+//# sourceMappingURL=content.d.ts.map

package/dist/content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../src/content.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGrD,4GAA4G;AAC5G,eAAO,MAAM,cAAc,uBAAuB,CAAC;AAEnD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAI5C;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,UAAU,CAAC,GACtE,IAAI,CAuCN"}

package/dist/content.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONTENT_ORIGIN = void 0;
+exports.registerContentScheme = registerContentScheme;
+exports.serveContentScheme = serveContentScheme;
+/**
+ * The content plane on a desktop: a custom scheme, not a port.
+ *
+ * A loopback server would be reachable by every process on the machine, and
+ * these routes authenticate nothing by design — a digest is identity, not
+ * authorization. `attachment://` is reachable only from this app's own
+ * renderers and opens no socket at all. The routes are rig's `resolveContent`,
+ * the same table the served host answers over HTTP, so a route added there
+ * arrives here for free and the two targets cannot answer one URL differently.
+ *
+ * @category Desktop
+ */
+const electron_1 = require("electron");
+const node_1 = require("@lloyal-labs/rig/node");
+const node_2 = require("@lloyal-labs/media/node");
+const read_bounded_1 = require("./read-bounded");
+/** The scheme's authority: `standard` schemes require one. Every route lives under the path, as on HTTP. */
+exports.CONTENT_ORIGIN = 'attachment://store';
+/**
+ * Must run BEFORE app ready — afterwards the registration is ignored SILENTLY.
+ * All four privileges are load-bearing: `standard` gives the scheme an origin
+ * so CSP can name it, `secure` keeps it out of the mixed-content rules,
+ * `supportFetchAPI` lets `fetch` address it, and without `corsEnabled` the
+ * scheme takes no part in CORS at all, so the handler's allow-origin header
+ * is never consulted and every fetch fails before reaching it.
+ */
+function registerContentScheme() {
+    electron_1.protocol.registerSchemesAsPrivileged([
+        { scheme: 'attachment', privileges: { standard: true, secure: true, supportFetchAPI: true, corsEnabled: true, stream: true } },
+    ]);
+}
+/**
+ * Serve reads from the project store; hand an upload to `ingest`. Reading needs
+ * no lock: OCI blobs are content-addressed and immutable. Writing is not ours —
+ * `ingest` belongs to whichever process owns the store, and takes a signal so a
+ * deadline here can actually stop it.
+ */
+function serveContentScheme(projectRoot, ingest) {
+    const media = (0, node_1.createProjectMediaStore)(projectRoot);
+    // The renderer is cross-origin to this scheme — a dev server in development,
+    // `file://` in a build — so it has no origin to echo. `*` grants nothing
+    // further: only this app's own renderers can address the scheme.
+    const cors = { 'Access-Control-Allow-Origin': '*' };
+    electron_1.protocol.handle('attachment', async (request) => {
+        const path = new URL(request.url).pathname;
+        // The plane's one WRITE, and the only route not answerable from the store.
+        if (request.method === 'POST' && path === '/v1/media/ingress') {
+            // ONE deadline over BOTH halves — the transfer and the ingest — and the same bounds the served host
+            // passes its route, so both targets admit the same thing.
+            const ctrl = new AbortController();
+            const timer = setTimeout(() => ctrl.abort(), node_2.DOCUMENT_UPLOAD_TIMEOUT_MS);
+            try {
+                const declared = Number(request.headers.get('content-length') ?? NaN);
+                if (Number.isFinite(declared) && declared > node_2.MAX_DOCUMENT_BYTES)
+                    throw new read_bounded_1.TooLarge(`upload exceeds ${node_2.MAX_DOCUMENT_BYTES} bytes`);
+                const bytes = await (0, read_bounded_1.readBounded)(request.body, node_2.MAX_DOCUMENT_BYTES, ctrl.signal);
+                const root = await ingest(bytes, ctrl.signal);
+                return Response.json(root, { status: 201, headers: cors });
+            }
+            catch (err) {
+                // The same statuses the HTTP route answers with: 413 too large, 408 too slow, else refused.
+                const late = err instanceof read_bounded_1.TooSlow || ctrl.signal.aborted;
+                const status = err instanceof read_bounded_1.TooLarge ? 413 : late ? 408 : 400;
+                const error = late
+                    ? `upload exceeded ${node_2.DOCUMENT_UPLOAD_TIMEOUT_MS}ms end to end`
+                    : err instanceof Error ? err.message : 'ingest failed';
+                return Response.json({ error }, { status, headers: cors });
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        }
+        const reply = (0, node_1.resolveContent)({ method: request.method, path, ifNoneMatch: request.headers.get('if-none-match') ?? undefined }, media);
+        if (!reply)
+            return new Response(null, { status: 404 });
+        return new Response(reply.body ?? null, { status: reply.status, headers: { ...reply.headers, ...cors } });
+    });
+}
+//# sourceMappingURL=content.js.map

package/dist/content.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content.js","sourceRoot":"","sources":["../src/content.ts"],"names":[],"mappings":";;;AA6BA,sDAIC;AAQD,gDA0CC;AAnFD;;;;;;;;;;;GAWG;AACH,uCAAoC;AACpC,gDAAgF;AAChF,kDAAyF;AAEzF,iDAAgE;AAEhE,4GAA4G;AAC/F,QAAA,cAAc,GAAG,oBAAoB,CAAC;AAEnD;;;;;;;GAOG;AACH,SAAgB,qBAAqB;IACnC,mBAAQ,CAAC,2BAA2B,CAAC;QACnC,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;KAC/H,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAChC,WAAmB,EACnB,MAAuE;IAEvE,MAAM,KAAK,GAAG,IAAA,8BAAuB,EAAC,WAAW,CAAC,CAAC;IACnD,6EAA6E;IAC7E,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,IAAI,GAAG,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC;IAEpD,mBAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAE3C,2EAA2E;QAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;YAC9D,oGAAoG;YACpG,0DAA0D;YAC1D,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,iCAA0B,CAAC,CAAC;YACzE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;gBACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,yBAAkB;oBAAE,MAAM,IAAI,uBAAQ,CAAC,kBAAkB,yBAAkB,QAAQ,CAAC,CAAC;gBACjI,MAAM,KAAK,GAAG,MAAM,IAAA,0BAAW,EAAC,OAAO,CAAC,IAAI,EAAE,yBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC/E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC9C,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,4FAA4F;gBAC5F,MAAM,IAAI,GAAG,GAAG,YAAY,sBAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC3D,MAAM,MAAM,GAAG,GAAG,YAAY,uBAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBAChE,MAAM,KAAK,GAAG,IAAI;oBAChB,CAAC,CAAC,mBAAmB,iCAA0B,eAAe;oBAC9D,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACzD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,IAAA,qBAAc,EAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC;QACtI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACvD,OAAO,IAAI,QAAQ,CAAE,KAAK,CAAC,IAAwC,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC;IACjJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/engine.d.ts

@@ -0,0 +1,62 @@
+import type { Descriptor } from '@lloyal-labs/media';
+import type { Frame, SessionState, Snapshot } from '@lloyal-labs/binding';
+/** The slice of Electron's `UtilityProcess` the engine uses, structurally — a test hands in a fake. */
+export interface EngineProcess {
+    postMessage(message: unknown): void;
+    on(event: 'message', listener: (message: unknown) => void): this;
+    on(event: 'exit', listener: (code: number) => void): this;
+    kill(): boolean;
+    stdout?: {
+        on(event: 'data', listener: (chunk: {
+            toString(): string;
+        }) => void): unknown;
+    } | null;
+    stderr?: {
+        on(event: 'data', listener: (chunk: {
+            toString(): string;
+        }) => void): unknown;
+    } | null;
+}
+export interface CreateEngineOpts<E, S> {
+    /** The engine binary — this project's own built cli boot, e.g. `join(process.cwd(), 'bin', 'run.js')`. */
+    bin: string;
+    /** Added to the engine's environment. `RR_BRIDGE` is set for you: it is what makes the cli boot mount the ipc binding. */
+    env?: Record<string, string>;
+    initialState: S;
+    reduce: (state: S, ev: E) => S;
+    /** Where a frame goes: the renderer, when its window is alive. */
+    forward: (frame: Frame<E>) => void;
+    /** The engine's own stdout/stderr lines. */
+    log?: (stream: 'stdout' | 'stderr' | 'exit', text: string) => void;
+    /** Fork it yourself. The default forks `bin` as an Electron utility process; a test hands in a fake. */
+    fork?: (bin: string, env: NodeJS.ProcessEnv) => EngineProcess;
+}
+export interface Engine<C, S> {
+    /** Post a command to the engine. False when the engine is not running. */
+    send(command: C): boolean;
+    /** The shell's fold as of the last frame forwarded: the renderer's seed on (re)load. */
+    snapshot(): Snapshot<S>;
+    /** Hand bytes to the engine and wait for the root descriptor it commits. `signal` carries the deadline across. */
+    ingest(bytes: Uint8Array, signal: AbortSignal): Promise<Descriptor>;
+    /** Stop the engine. */
+    kill(): void;
+    /** This session's life, as the renderer's view reads it. */
+    session(): SessionState;
+    /** Subscribe to it: the current state at once, then every change. Returns the unsubscribe. */
+    onSession(cb: (state: SessionState) => void): () => void;
+    /**
+     * Replace the engine with a fresh one — the reader's way back from a session
+     * that ended.
+     *
+     * The replacement is not forked until the old process has actually gone:
+     * `draining` says work cannot be taken, never that the model has been freed.
+     * Settles when the replacement is USABLE or has failed to start, and a request
+     * made in the meantime reuses the one in flight — what the reader asked for is
+     * a working harness, and between the fork and `ready` there is not one yet, so
+     * a second press would otherwise kill an engine still loading its model.
+     */
+    restart(): Promise<void>;
+    readonly running: boolean;
+}
+export declare function createEngine<E, C, S>(opts: CreateEngineOpts<E, S>): Engine<C, S>;
+//# sourceMappingURL=engine.d.ts.map

package/dist/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../src/engine.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAE1E,uGAAuG;AACvG,MAAM,WAAW,aAAa;IAC5B,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACpC,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,IAAI,CAAC;IACjE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IAC1D,IAAI,IAAI,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE;YAAE,QAAQ,IAAI,MAAM,CAAA;SAAE,KAAK,IAAI,GAAG,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAClG,MAAM,CAAC,EAAE;QAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE;YAAE,QAAQ,IAAI,MAAM,CAAA;SAAE,KAAK,IAAI,GAAG,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;CACnG;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,EAAE,CAAC;IACpC,0GAA0G;IAC1G,GAAG,EAAE,MAAM,CAAC;IACZ,0HAA0H;IAC1H,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,YAAY,EAAE,CAAC,CAAC;IAChB,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IAC/B,kEAAkE;IAClE,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;IACnC,4CAA4C;IAC5C,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnE,wGAAwG;IACxG,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,aAAa,CAAC;CAC/D;AASD,MAAM,WAAW,MAAM,CAAC,CAAC,EAAE,CAAC;IAC1B,0EAA0E;IAC1E,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;IAC1B,wFAAwF;IACxF,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;IACxB,kHAAkH;IAClH,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACpE,uBAAuB;IACvB,IAAI,IAAI,IAAI,CAAC;IACb,4DAA4D;IAC5D,OAAO,IAAI,YAAY,CAAC;IACxB,8FAA8F;IAC9F,SAAS,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IACzD;;;;;;;;;;OAUG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CA4KhF"}

package/dist/engine.js

@@ -0,0 +1,233 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createEngine = createEngine;
+/**
+ * The engine: the project's own cli bin, forked as an Electron utility process
+ * with the `ipc` binding mounted, and the shell's fold over what it says.
+ *
+ * Streaming model, the same as every target: the engine emits raw events; the
+ * shell numbers each one (`seq` within this engine's `epoch`) and forwards the
+ * frame to the renderer, which folds it through the SAME pure reduce — only
+ * the small event crosses IPC, never the growing transcript. The shell also
+ * folds every event itself, purely to answer ONE snapshot per (re)load: the
+ * renderer seeds from it and applies only frames after the cut. An engine
+ * respawn is a new epoch, so a renderer that outlives one cannot mix two.
+ *
+ * The shell relays uploads to the engine and waits for the root descriptor it
+ * commits: the engine is the store's single writer.
+ *
+ * **It also owns the session's life, in the platform's own words.** A desktop
+ * shell has a host in every sense that matters to a reader — something that
+ * starts the harness, knows when it is usable and knows when it is gone — so it
+ * reports {@link SessionState} rather than inventing a second vocabulary for
+ * the same facts. `warming` at the fork, `live` at the child's own `ready`
+ * (which means the command channel is attached, and is the earliest honest
+ * boundary — a child exists while it is still loading a model), `draining`
+ * once a stop is asked for, then `reaped` or `died`. The renderer's IPC link
+ * stays up throughout, which is exactly why the session's state and the
+ * transport's are two facts and not one.
+ *
+ * @category Desktop
+ */
+const node_fs_1 = require("node:fs");
+const electron_1 = require("electron");
+/** The default: this project's cli boot as a utility process, with the bridge flag set and its output piped. */
+function forkUtilityProcess(bin, env) {
+    // A missing binary is the one failure worth naming: the window would otherwise open onto an engine that never speaks.
+    if (!(0, node_fs_1.existsSync)(bin))
+        throw new Error(`engine not built: ${bin} not found — build the cli target first.`);
+    return electron_1.utilityProcess.fork(bin, [], { serviceName: 'harness-engine', stdio: 'pipe', env });
+}
+function createEngine(opts) {
+    const fork = opts.fork ?? forkUtilityProcess;
+    let epoch = Date.now();
+    let seq = 0;
+    let state = opts.initialState;
+    let child = null;
+    /** Which fork we own. A dead child's listeners stay attached to its own process object. */
+    let generation = 0;
+    let stopping = false; // we asked it to go
+    let replacing = false; // …and something is taking its place, so its end is not the session's
+    let awaitExit = null;
+    /** Armed across a replacement's startup: settled when it is usable, or when it failed to start. */
+    let awaitStartup = null;
+    let restarting = null;
+    let session = { phase: 'warming' };
+    const sessionListeners = new Set();
+    const pending = new Map();
+    let ingestId = 0;
+    const announce = (next) => {
+        session = next;
+        // A startup is over at its first outcome, either way. `warming` is not one.
+        if (next.phase === 'live' || next.phase === 'died') {
+            const up = awaitStartup;
+            awaitStartup = null;
+            up?.();
+        }
+        for (const cb of sessionListeners)
+            cb(next);
+    };
+    const post = (message) => {
+        if (!child)
+            return false;
+        try {
+            child.postMessage(message);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    const failPending = (why) => {
+        for (const [, waiting] of pending)
+            waiting.reject(new Error(why));
+        pending.clear();
+    };
+    function start() {
+        const mine = ++generation;
+        stopping = false;
+        replacing = false;
+        announce({ phase: 'warming' });
+        let proc;
+        try {
+            proc = fork(opts.bin, { ...process.env, ...opts.env, RR_BRIDGE: '1' });
+        }
+        catch (err) {
+            // A shell whose engine will not start must still open and say so; throwing here would take
+            // the main process down before the window that could report it exists.
+            child = null;
+            opts.log?.('exit', err instanceof Error ? err.message : String(err));
+            announce({ phase: 'died' });
+            return;
+        }
+        child = proc;
+        proc.stdout?.on('data', (d) => opts.log?.('stdout', d.toString().trimEnd()));
+        proc.stderr?.on('data', (d) => opts.log?.('stderr', d.toString().trimEnd()));
+        proc.on('message', (raw) => {
+            if (mine !== generation)
+                return; // a child we no longer own, still talking
+            const msg = raw;
+            if (msg?.t === 'ready') {
+                // The command channel is attached. Not a promise that the harness has finished booting —
+                // it is simply the first moment anything the reader does can reach it.
+                announce({ phase: 'live' });
+                return;
+            }
+            if (msg?.t === 'event' && msg.payload !== undefined) {
+                seq += 1;
+                state = opts.reduce(state, msg.payload);
+                opts.forward({ epoch, seq, ev: msg.payload });
+                return;
+            }
+            if (typeof msg?.id !== 'number')
+                return;
+            const waiting = pending.get(msg.id);
+            if (!waiting)
+                return;
+            pending.delete(msg.id);
+            if (msg.t === 'ingested' && msg.root)
+                waiting.resolve(msg.root);
+            else if (msg.t === 'ingestFailed')
+                waiting.reject(new Error(msg.error ?? 'ingest failed'));
+        });
+        proc.on('exit', (code) => {
+            if (mine !== generation)
+                return;
+            opts.log?.('exit', String(code));
+            // Drop the handle FIRST: a stale one passes `if (!child)`, and a message to a dead process is discarded
+            // silently. An ingest in flight must FAIL, not hang.
+            child = null;
+            failPending('the engine stopped before the file was ingested');
+            const wake = awaitExit;
+            awaitExit = null;
+            // A replacement is coming: the reader is between engines, not without one, so nothing terminal
+            // is said and the banner does not flash "ended" on the way to a working session.
+            if (replacing)
+                return wake?.();
+            announce(stopping ? { phase: 'reaped' } : { phase: 'died', ...(code != null ? { code } : {}) });
+            wake?.();
+        });
+    }
+    start();
+    return {
+        send: (command) => post({ t: 'command', payload: command }),
+        snapshot: () => ({ state, epoch, seq }),
+        session: () => session,
+        onSession(cb) {
+            sessionListeners.add(cb);
+            cb(session); // a renderer that loads mid-session is told where things stand
+            return () => { sessionListeners.delete(cb); };
+        },
+        ingest(bytes, signal) {
+            // An already-aborted signal fires no `abort` event, so the entry would sit in `pending` for the life of the process.
+            if (signal.aborted)
+                return Promise.reject(new Error('the ingest was cancelled'));
+            if (!child)
+                return Promise.reject(new Error('the engine is not running'));
+            const id = ++ingestId;
+            const answer = new Promise((resolve, reject) => pending.set(id, { resolve, reject }));
+            const settle = (fail) => {
+                const waiting = pending.get(id);
+                if (!waiting)
+                    return;
+                pending.delete(id);
+                waiting.reject(fail);
+            };
+            signal.addEventListener('abort', () => {
+                post({ t: 'ingestCancel', id });
+                settle(new Error('the ingest was cancelled'));
+            }, { once: true });
+            if (!post({ t: 'ingest', id, bytes }))
+                settle(new Error('the engine is not running'));
+            return answer;
+        },
+        kill() {
+            if (!child)
+                return;
+            stopping = true;
+            announce({ phase: 'draining' });
+            try {
+                child.kill();
+            }
+            catch { /* already gone; its exit still arrives */ }
+        },
+        restart() {
+            if (restarting)
+                return restarting; // the reader pressed it twice; one engine, one promise
+            const done = (async () => {
+                if (child) {
+                    stopping = true;
+                    replacing = true;
+                    announce({ phase: 'draining' });
+                    const gone = new Promise((resolve) => { awaitExit = resolve; });
+                    try {
+                        child.kill();
+                    }
+                    catch { /* already gone; its exit still arrives */ }
+                    await gone; // the model is resident until the process is gone: never two at once
+                }
+                // A fresh stream. The renderer compares frames only within an epoch, so the replacement
+                // must not reuse one — `Date.now()` alone can repeat inside a millisecond.
+                epoch = Math.max(Date.now(), epoch + 1);
+                seq = 0;
+                state = opts.initialState;
+                // Stay in flight until the replacement is usable or has failed, so a reader who presses
+                // again a moment later REUSES this one. Clearing at the fork would let the second press
+                // kill an engine that is still loading its model, throwing away the wait and starting it
+                // over — and the second press is exactly what an unresponsive-looking startup invites.
+                // It ends at `died` too, so a startup that failed leaves recovery available again.
+                const up = new Promise((resolve) => { awaitStartup = resolve; });
+                start();
+                await up;
+            })();
+            restarting = done;
+            void done.finally(() => { if (restarting === done)
+                restarting = null; });
+            return done;
+        },
+        get running() {
+            return child !== null;
+        },
+    };
+}
+//# sourceMappingURL=engine.js.map

package/dist/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../src/engine.ts"],"names":[],"mappings":";;AA6FA,oCA4KC;AAzQD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qCAAqC;AACrC,uCAA0C;AA6B1C,gHAAgH;AAChH,SAAS,kBAAkB,CAAC,GAAW,EAAE,GAAsB;IAC7D,sHAAsH;IACtH,IAAI,CAAC,IAAA,oBAAU,EAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,0CAA0C,CAAC,CAAC;IAC1G,OAAO,yBAAc,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAA6B,CAAC;AACzH,CAAC;AA8BD,SAAgB,YAAY,CAAU,IAA4B;IAChE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,kBAAkB,CAAC;IAC7C,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9B,IAAI,KAAK,GAAyB,IAAI,CAAC;IACvC,2FAA2F;IAC3F,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAG,oBAAoB;IAC5C,IAAI,SAAS,GAAG,KAAK,CAAC,CAAE,sEAAsE;IAC9F,IAAI,SAAS,GAAwB,IAAI,CAAC;IAC1C,mGAAmG;IACnG,IAAI,YAAY,GAAwB,IAAI,CAAC;IAC7C,IAAI,UAAU,GAAyB,IAAI,CAAC;IAC5C,IAAI,OAAO,GAAiB,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACjD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAiC,CAAC;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4E,CAAC;IACpG,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,MAAM,QAAQ,GAAG,CAAC,IAAkB,EAAQ,EAAE;QAC5C,OAAO,GAAG,IAAI,CAAC;QACf,4EAA4E;QAC5E,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YACnD,MAAM,EAAE,GAAG,YAAY,CAAC;YACxB,YAAY,GAAG,IAAI,CAAC;YACpB,EAAE,EAAE,EAAE,CAAC;QACT,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,gBAAgB;YAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,OAAgB,EAAW,EAAE;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,GAAW,EAAQ,EAAE;QACxC,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,OAAO;YAAE,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC;IAEF,SAAS,KAAK;QACZ,MAAM,IAAI,GAAG,EAAE,UAAU,CAAC;QAC1B,QAAQ,GAAG,KAAK,CAAC;QACjB,SAAS,GAAG,KAAK,CAAC;QAClB,QAAQ,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/B,IAAI,IAAmB,CAAC;QACxB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2FAA2F;YAC3F,uEAAuE;YACvE,KAAK,GAAG,IAAI,CAAC;YACb,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACrE,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,KAAK,GAAG,IAAI,CAAC;QACb,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,UAAU;gBAAE,OAAO,CAAG,0CAA0C;YAC7E,MAAM,GAAG,GAAG,GAAkF,CAAC;YAC/F,IAAI,GAAG,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC;gBACvB,yFAAyF;gBACzF,uEAAuE;gBACvE,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,IAAI,GAAG,EAAE,CAAC,KAAK,OAAO,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBACpD,GAAG,IAAI,CAAC,CAAC;gBACT,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBACxC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YACD,IAAI,OAAO,GAAG,EAAE,EAAE,KAAK,QAAQ;gBAAE,OAAO;YACxC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpC,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvB,IAAI,GAAG,CAAC,CAAC,KAAK,UAAU,IAAI,GAAG,CAAC,IAAI;gBAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;iBAC3D,IAAI,GAAG,CAAC,CAAC,KAAK,cAAc;gBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,eAAe,CAAC,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACvB,IAAI,IAAI,KAAK,UAAU;gBAAE,OAAO;YAChC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACjC,wGAAwG;YACxG,qDAAqD;YACrD,KAAK,GAAG,IAAI,CAAC;YACb,WAAW,CAAC,iDAAiD,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,SAAS,CAAC;YACvB,SAAS,GAAG,IAAI,CAAC;YACjB,+FAA+F;YAC/F,iFAAiF;YACjF,IAAI,SAAS;gBAAE,OAAO,IAAI,EAAE,EAAE,CAAC;YAC/B,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAChG,IAAI,EAAE,EAAE,CAAC;QACX,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,EAAE,CAAC;IAER,OAAO;QACL,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC3D,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACvC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO;QACtB,SAAS,CAAC,EAAE;YACV,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAG,+DAA+D;YAC9E,OAAO,GAAG,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,MAAM;YAClB,qHAAqH;YACrH,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;YACjF,IAAI,CAAC,KAAK;gBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;YAC1E,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC;YACtB,MAAM,MAAM,GAAG,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YAClG,MAAM,MAAM,GAAG,CAAC,IAAW,EAAQ,EAAE;gBACnC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChC,IAAI,CAAC,OAAO;oBAAE,OAAO;gBACrB,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC,CAAC;YACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;gBACpC,IAAI,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;gBAChC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;YAChD,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;YACtF,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI;YACF,IAAI,CAAC,KAAK;gBAAE,OAAO;YACnB,QAAQ,GAAG,IAAI,CAAC;YAChB,QAAQ,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;YAChC,IAAI,CAAC;gBAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,0CAA0C,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO;YACL,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAC,CAAG,uDAAuD;YAC5F,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE;gBACvB,IAAI,KAAK,EAAE,CAAC;oBACV,QAAQ,GAAG,IAAI,CAAC;oBAChB,SAAS,GAAG,IAAI,CAAC;oBACjB,QAAQ,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;oBAChC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;oBACtE,IAAI,CAAC;wBAAC,KAAK,CAAC,IAAI,EAAE,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,0CAA0C,CAAC,CAAC;oBAC1E,MAAM,IAAI,CAAC,CAAG,qEAAqE;gBACrF,CAAC;gBACD,wFAAwF;gBACxF,2EAA2E;gBAC3E,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACxC,GAAG,GAAG,CAAC,CAAC;gBACR,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;gBAC1B,wFAAwF;gBACxF,wFAAwF;gBACxF,yFAAyF;gBACzF,uFAAuF;gBACvF,mFAAmF;gBACnF,MAAM,EAAE,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvE,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;YACX,CAAC,CAAC,EAAE,CAAC;YACL,UAAU,GAAG,IAAI,CAAC;YAClB,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,UAAU,KAAK,IAAI;gBAAE,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACzE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO;YACT,OAAO,KAAK,KAAK,IAAI,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `@lloyal-labs/desktop` — a harness in a native window. The Electron main
+ * process is a thin host: it owns the window and forks the project's own cli
+ * bin as the engine; heavy work (native inference, the harness) lives there,
+ * so the UI thread never blocks.
+ *
+ * @packageDocumentation
+ * @category Desktop
+ */
+export { createEngine } from './engine';
+export type { Engine, EngineProcess, CreateEngineOpts } from './engine';
+export { registerContentScheme, serveContentScheme, CONTENT_ORIGIN } from './content';
+export { readBounded, TooLarge, TooSlow } from './read-bounded';
+export { createWindow } from './window';
+export type { CreateWindowOpts } from './window';
+export { CHANNELS } from './preload-channels';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,YAAY,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CHANNELS = exports.createWindow = exports.TooSlow = exports.TooLarge = exports.readBounded = exports.CONTENT_ORIGIN = exports.serveContentScheme = exports.registerContentScheme = exports.createEngine = void 0;
+/**
+ * `@lloyal-labs/desktop` — a harness in a native window. The Electron main
+ * process is a thin host: it owns the window and forks the project's own cli
+ * bin as the engine; heavy work (native inference, the harness) lives there,
+ * so the UI thread never blocks.
+ *
+ * @packageDocumentation
+ * @category Desktop
+ */
+var engine_1 = require("./engine");
+Object.defineProperty(exports, "createEngine", { enumerable: true, get: function () { return engine_1.createEngine; } });
+var content_1 = require("./content");
+Object.defineProperty(exports, "registerContentScheme", { enumerable: true, get: function () { return content_1.registerContentScheme; } });
+Object.defineProperty(exports, "serveContentScheme", { enumerable: true, get: function () { return content_1.serveContentScheme; } });
+Object.defineProperty(exports, "CONTENT_ORIGIN", { enumerable: true, get: function () { return content_1.CONTENT_ORIGIN; } });
+var read_bounded_1 = require("./read-bounded");
+Object.defineProperty(exports, "readBounded", { enumerable: true, get: function () { return read_bounded_1.readBounded; } });
+Object.defineProperty(exports, "TooLarge", { enumerable: true, get: function () { return read_bounded_1.TooLarge; } });
+Object.defineProperty(exports, "TooSlow", { enumerable: true, get: function () { return read_bounded_1.TooSlow; } });
+var window_1 = require("./window");
+Object.defineProperty(exports, "createWindow", { enumerable: true, get: function () { return window_1.createWindow; } });
+var preload_channels_1 = require("./preload-channels");
+Object.defineProperty(exports, "CHANNELS", { enumerable: true, get: function () { return preload_channels_1.CHANNELS; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;GAQG;AACH,mCAAwC;AAA/B,sGAAA,YAAY,OAAA;AAErB,qCAAsF;AAA7E,gHAAA,qBAAqB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,yGAAA,cAAc,OAAA;AAClE,+CAAgE;AAAvD,2GAAA,WAAW,OAAA;AAAE,wGAAA,QAAQ,OAAA;AAAE,uGAAA,OAAO,OAAA;AACvC,mCAAwC;AAA/B,sGAAA,YAAY,OAAA;AAErB,uDAA8C;AAArC,4GAAA,QAAQ,OAAA"}

package/dist/preload-channels.d.ts

@@ -0,0 +1,13 @@
+/** The IPC channel names the shell and the preload agree on — importable without `electron`. */
+export declare const CHANNELS: {
+    readonly event: "harness:event";
+    readonly command: "harness:command";
+    readonly snapshot: "harness:snapshot";
+    /** Main pushes each {@link SessionState} change here. */
+    readonly session: "harness:session";
+    /** …and answers with the current one here, so a renderer that loads mid-session is not left guessing. */
+    readonly sessionNow: "harness:session-now";
+    /** The reader asking for a working engine. Main owns what that means. */
+    readonly recover: "harness:recover";
+};
+//# sourceMappingURL=preload-channels.d.ts.map

package/dist/preload-channels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preload-channels.d.ts","sourceRoot":"","sources":["../src/preload-channels.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,eAAO,MAAM,QAAQ;;;;IAInB,yDAAyD;;IAEzD,yGAAyG;;IAEzG,yEAAyE;;CAEjE,CAAC"}

package/dist/preload-channels.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CHANNELS = void 0;
+/** The IPC channel names the shell and the preload agree on — importable without `electron`. */
+exports.CHANNELS = {
+    event: 'harness:event',
+    command: 'harness:command',
+    snapshot: 'harness:snapshot',
+    /** Main pushes each {@link SessionState} change here. */
+    session: 'harness:session',
+    /** …and answers with the current one here, so a renderer that loads mid-session is not left guessing. */
+    sessionNow: 'harness:session-now',
+    /** The reader asking for a working engine. Main owns what that means. */
+    recover: 'harness:recover',
+};
+//# sourceMappingURL=preload-channels.js.map

package/dist/preload-channels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preload-channels.js","sourceRoot":"","sources":["../src/preload-channels.ts"],"names":[],"mappings":";;;AAAA,gGAAgG;AACnF,QAAA,QAAQ,GAAG;IACtB,KAAK,EAAE,eAAe;IACtB,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,kBAAkB;IAC5B,yDAAyD;IACzD,OAAO,EAAE,iBAAiB;IAC1B,yGAAyG;IACzG,UAAU,EAAE,qBAAqB;IACjC,yEAAyE;IACzE,OAAO,EAAE,iBAAiB;CAClB,CAAC"}

package/dist/preload.d.ts

@@ -0,0 +1,4 @@
+import { CHANNELS } from './preload-channels';
+export { CHANNELS };
+export declare function preloadBridge<E, C, S>(contentOrigin?: string): void;
+//# sourceMappingURL=preload.d.ts.map

package/dist/preload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preload.d.ts","sourceRoot":"","sources":["../src/preload.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAAE,QAAQ,EAAE,CAAC;AAEpB,wBAAgB,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,aAAa,SAAuB,GAAG,IAAI,CAwCjF"}

package/dist/preload.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CHANNELS = void 0;
+exports.preloadBridge = preloadBridge;
+/**
+ * The preload bridge: `window.harness` for the renderer over Electron's
+ * contextBridge, the same {@link Bridge} shape the web target backs with
+ * `createBridge`, so the view is transport-agnostic. Frames come down on
+ * `harness:event`, commands go up on `harness:command`, the snapshot is one
+ * `harness:snapshot` round trip, and the content plane is the custom scheme.
+ *
+ * Import from `@lloyal-labs/desktop/preload` in the preload script only.
+ *
+ * @category Desktop
+ */
+const electron_1 = require("electron");
+const preload_channels_1 = require("./preload-channels");
+Object.defineProperty(exports, "CHANNELS", { enumerable: true, get: function () { return preload_channels_1.CHANNELS; } });
+function preloadBridge(contentOrigin = 'attachment://store') {
+    const api = {
+        onEvent(cb) {
+            const h = (_e, frame) => cb(frame);
+            electron_1.ipcRenderer.on(preload_channels_1.CHANNELS.event, h);
+            return () => {
+                electron_1.ipcRenderer.removeListener(preload_channels_1.CHANNELS.event, h);
+            };
+        },
+        send(command) {
+            electron_1.ipcRenderer.send(preload_channels_1.CHANNELS.command, command);
+        },
+        requestSnapshot() {
+            return electron_1.ipcRenderer.invoke(preload_channels_1.CHANNELS.snapshot);
+        },
+        onSession(cb) {
+            // A renderer that has just loaded needs where things stand, not only what changes next: a
+            // session can sit at `live` for hours. The push wins a race with the answer, because the
+            // answer was true when it was asked and the push is true now.
+            let heard = false;
+            const h = (_e, state) => { heard = true; cb(state); };
+            electron_1.ipcRenderer.on(preload_channels_1.CHANNELS.session, h);
+            void electron_1.ipcRenderer.invoke(preload_channels_1.CHANNELS.sessionNow).then((now) => {
+                if (heard)
+                    return;
+                heard = true;
+                cb(now);
+            });
+            return () => {
+                electron_1.ipcRenderer.removeListener(preload_channels_1.CHANNELS.session, h);
+            };
+        },
+        recover() {
+            // What a working session costs is the placement's business: here, a new engine process.
+            void electron_1.ipcRenderer.invoke(preload_channels_1.CHANNELS.recover);
+        },
+        contentOrigin() {
+            return contentOrigin;
+        },
+    };
+    electron_1.contextBridge.exposeInMainWorld('harness', api);
+}
+//# sourceMappingURL=preload.js.map

package/dist/preload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preload.js","sourceRoot":"","sources":["../src/preload.ts"],"names":[],"mappings":";;;AAiBA,sCAwCC;AAzDD;;;;;;;;;;GAUG;AACH,uCAAsD;AAEtD,yDAA8C;AAErC,yFAFA,2BAAQ,OAEA;AAEjB,SAAgB,aAAa,CAAU,aAAa,GAAG,oBAAoB;IACzE,MAAM,GAAG,GAAoB;QAC3B,OAAO,CAAC,EAA6B;YACnC,MAAM,CAAC,GAAG,CAAC,EAAW,EAAE,KAAe,EAAQ,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;YAC5D,sBAAW,CAAC,EAAE,CAAC,2BAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAClC,OAAO,GAAG,EAAE;gBACV,sBAAW,CAAC,cAAc,CAAC,2BAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAChD,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAU;YACb,sBAAW,CAAC,IAAI,CAAC,2BAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QACD,eAAe;YACb,OAAO,sBAAW,CAAC,MAAM,CAAC,2BAAQ,CAAC,QAAQ,CAAyB,CAAC;QACvE,CAAC;QACD,SAAS,CAAC,EAAiC;YACzC,0FAA0F;YAC1F,yFAAyF;YACzF,8DAA8D;YAC9D,IAAI,KAAK,GAAG,KAAK,CAAC;YAClB,MAAM,CAAC,GAAG,CAAC,EAAW,EAAE,KAAmB,EAAQ,EAAE,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,sBAAW,CAAC,EAAE,CAAC,2BAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACpC,KAAM,sBAAW,CAAC,MAAM,CAAC,2BAAQ,CAAC,UAAU,CAA2B,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;gBACnF,IAAI,KAAK;oBAAE,OAAO;gBAClB,KAAK,GAAG,IAAI,CAAC;gBACb,EAAE,CAAC,GAAG,CAAC,CAAC;YACV,CAAC,CAAC,CAAC;YACH,OAAO,GAAG,EAAE;gBACV,sBAAW,CAAC,cAAc,CAAC,2BAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC,CAAC;QACJ,CAAC;QACD,OAAO;YACL,wFAAwF;YACxF,KAAK,sBAAW,CAAC,MAAM,CAAC,2BAAQ,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QACD,aAAa;YACX,OAAO,aAAa,CAAC;QACvB,CAAC;KACF,CAAC;IACF,wBAAa,CAAC,iBAAiB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC"}

package/dist/read-bounded.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Reading an upload under a ceiling and a deadline.
+ *
+ * Nothing here knows about Electron or the content plane — it is a stream, a
+ * cap and a signal — which is what lets it be tested against a stalled stream
+ * instead of a three-minute wait.
+ *
+ * @category Desktop
+ */
+/** Over the cap. Separate from a refusal so the client is told which limit. */
+export declare class TooLarge extends Error {
+}
+/** Past the deadline — the transfer, the ingest, or both together. */
+export declare class TooSlow extends Error {
+}
+/**
+ * Read the body, refusing AT the cap rather than after it, and giving up the
+ * moment the signal says so. The abort is RACED against each read rather than
+ * checked between them: a stalled stream is precisely the case where no read
+ * resolves. Cancellation is started, never awaited: on a stream whose `read()`
+ * is stuck, `cancel()` can be stuck too.
+ */
+export declare function readBounded(body: ReadableStream<Uint8Array> | null, cap: number, signal: AbortSignal): Promise<Uint8Array>;
+//# sourceMappingURL=read-bounded.d.ts.map

package/dist/read-bounded.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-bounded.d.ts","sourceRoot":"","sources":["../src/read-bounded.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,+EAA+E;AAC/E,qBAAa,QAAS,SAAQ,KAAK;CAAG;AACtC,sEAAsE;AACtE,qBAAa,OAAQ,SAAQ,KAAK;CAAG;AAErC;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,EACvC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,UAAU,CAAC,CAoCrB"}

package/dist/read-bounded.js

@@ -0,0 +1,70 @@
+"use strict";
+/**
+ * Reading an upload under a ceiling and a deadline.
+ *
+ * Nothing here knows about Electron or the content plane — it is a stream, a
+ * cap and a signal — which is what lets it be tested against a stalled stream
+ * instead of a three-minute wait.
+ *
+ * @category Desktop
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TooSlow = exports.TooLarge = void 0;
+exports.readBounded = readBounded;
+/** Over the cap. Separate from a refusal so the client is told which limit. */
+class TooLarge extends Error {
+}
+exports.TooLarge = TooLarge;
+/** Past the deadline — the transfer, the ingest, or both together. */
+class TooSlow extends Error {
+}
+exports.TooSlow = TooSlow;
+/**
+ * Read the body, refusing AT the cap rather than after it, and giving up the
+ * moment the signal says so. The abort is RACED against each read rather than
+ * checked between them: a stalled stream is precisely the case where no read
+ * resolves. Cancellation is started, never awaited: on a stream whose `read()`
+ * is stuck, `cancel()` can be stuck too.
+ */
+async function readBounded(body, cap, signal) {
+    if (signal.aborted)
+        throw new TooSlow('the upload was cancelled');
+    if (!body)
+        return new Uint8Array();
+    const reader = body.getReader();
+    let reject;
+    const cancelled = new Promise((_, rej) => { reject = rej; });
+    const abort = () => reject(new TooSlow('the upload was cancelled'));
+    signal.addEventListener('abort', abort, { once: true });
+    const chunks = [];
+    let seen = 0;
+    try {
+        for (;;) {
+            const { done, value } = await Promise.race([reader.read(), cancelled]);
+            if (done)
+                break;
+            seen += value.byteLength;
+            if (seen > cap)
+                throw new TooLarge(`upload exceeds ${cap} bytes`);
+            chunks.push(value);
+        }
+        // Reaching EOF is not safety: the deadline can pass as the last chunk lands.
+        if (signal.aborted)
+            throw new TooSlow('the upload was cancelled');
+    }
+    catch (err) {
+        void reader.cancel().catch(() => { });
+        throw err;
+    }
+    finally {
+        signal.removeEventListener('abort', abort);
+    }
+    const out = new Uint8Array(seen);
+    let at = 0;
+    for (const c of chunks) {
+        out.set(c, at);
+        at += c.byteLength;
+    }
+    return out;
+}
+//# sourceMappingURL=read-bounded.js.map

package/dist/read-bounded.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-bounded.js","sourceRoot":"","sources":["../src/read-bounded.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAcH,kCAwCC;AApDD,+EAA+E;AAC/E,MAAa,QAAS,SAAQ,KAAK;CAAG;AAAtC,4BAAsC;AACtC,sEAAsE;AACtE,MAAa,OAAQ,SAAQ,KAAK;CAAG;AAArC,0BAAqC;AAErC;;;;;;GAMG;AACI,KAAK,UAAU,WAAW,CAC/B,IAAuC,EACvC,GAAW,EACX,MAAmB;IAEnB,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAClE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,UAAU,EAAE,CAAC;IAEnC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,IAAI,MAA2B,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC;IAC1E,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAExD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;YACvE,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;YACzB,IAAI,IAAI,GAAG,GAAG;gBAAE,MAAM,IAAI,QAAQ,CAAC,kBAAkB,GAAG,QAAQ,CAAC,CAAC;YAClE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,6EAA6E;QAC7E,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrC,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACf,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/window.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The window: one `BrowserWindow` over the preload bridge, links kept out of
+ * the renderer. The renderer loads the dev server's URL when electron-vite
+ * provides one, else the built page.
+ *
+ * @category Desktop
+ */
+import { BrowserWindow } from 'electron';
+import type { BrowserWindowConstructorOptions } from 'electron';
+export interface CreateWindowOpts {
+    /** The preload bundle. electron-vite names it after its entry and emits `.mjs`. */
+    preload: string;
+    /** The built page, loaded when no dev server URL is set (`ELECTRON_RENDERER_URL`). */
+    page: string;
+    title: string;
+    /** Window options over the defaults (size, colours). */
+    window?: Partial<BrowserWindowConstructorOptions>;
+}
+export declare function createWindow(opts: CreateWindowOpts): BrowserWindow;
+//# sourceMappingURL=window.d.ts.map

package/dist/window.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"window.d.ts","sourceRoot":"","sources":["../src/window.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,aAAa,EAAS,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,UAAU,CAAC;AAYhE,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,MAAM,CAAC,EAAE,OAAO,CAAC,+BAA+B,CAAC,CAAC;CACnD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,aAAa,CAsBlE"}

package/dist/window.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createWindow = createWindow;
+/**
+ * The window: one `BrowserWindow` over the preload bridge, links kept out of
+ * the renderer. The renderer loads the dev server's URL when electron-vite
+ * provides one, else the built page.
+ *
+ * @category Desktop
+ */
+const electron_1 = require("electron");
+/** Only http(s) links may leave the app. */
+function isExternalUrl(url) {
+    try {
+        const p = new URL(url).protocol;
+        return p === 'http:' || p === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
+function createWindow(opts) {
+    const win = new electron_1.BrowserWindow({
+        width: 1100, height: 760, minWidth: 800, minHeight: 520, show: false, title: opts.title,
+        ...opts.window,
+        webPreferences: { preload: opts.preload, contextIsolation: true, sandbox: false, ...(opts.window?.webPreferences ?? {}) },
+    });
+    win.once('ready-to-show', () => win.show());
+    // Links open in the system browser; the renderer never navigates away.
+    win.webContents.setWindowOpenHandler(({ url }) => {
+        if (isExternalUrl(url))
+            void electron_1.shell.openExternal(url);
+        return { action: 'deny' };
+    });
+    win.webContents.on('will-navigate', (e, url) => {
+        if (url !== win.webContents.getURL()) {
+            e.preventDefault();
+            if (isExternalUrl(url))
+                void electron_1.shell.openExternal(url);
+        }
+    });
+    const dev = process.env.ELECTRON_RENDERER_URL;
+    if (dev)
+        void win.loadURL(dev);
+    else
+        void win.loadFile(opts.page);
+    return win;
+}
+//# sourceMappingURL=window.js.map

package/dist/window.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"window.js","sourceRoot":"","sources":["../src/window.ts"],"names":[],"mappings":";;AA8BA,oCAsBC;AApDD;;;;;;GAMG;AACH,uCAAgD;AAGhD,4CAA4C;AAC5C,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAChC,OAAO,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,QAAQ,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAYD,SAAgB,YAAY,CAAC,IAAsB;IACjD,MAAM,GAAG,GAAG,IAAI,wBAAa,CAAC;QAC5B,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK;QACvF,GAAG,IAAI,CAAC,MAAM;QACd,cAAc,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,IAAI,EAAE,CAAC,EAAE;KAC1H,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,uEAAuE;IACvE,GAAG,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;QAC/C,IAAI,aAAa,CAAC,GAAG,CAAC;YAAE,KAAK,gBAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACrD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,GAAG,KAAK,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YACrC,CAAC,CAAC,cAAc,EAAE,CAAC;YACnB,IAAI,aAAa,CAAC,GAAG,CAAC;gBAAE,KAAK,gBAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAC9C,IAAI,GAAG;QAAE,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;;QAC1B,KAAK,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC;AACb,CAAC"}

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@lloyal-labs/desktop",
+  "version": "0.1.0-alpha.10",
+  "description": "A harness in a native window: the Electron shell's main-process pieces — the engine over the project's own cli bin, the content scheme, the preload bridge and the window",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./preload": {
+      "types": "./dist/preload.d.ts",
+      "default": "./dist/preload.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/lloyal-ai/hdk.git",
+    "directory": "packages/desktop"
+  },
+  "homepage": "https://github.com/lloyal-ai/hdk/tree/main/packages/desktop#readme",
+  "bugs": {
+    "url": "https://github.com/lloyal-ai/hdk/issues"
+  },
+  "keywords": [
+    "desktop",
+    "electron",
+    "harness",
+    "shell"
+  ],
+  "license": "SEE LICENSE IN LICENSE",
+  "type": "commonjs",
+  "scripts": {
+    "build": "tsc -b"
+  },
+  "dependencies": {
+    "@lloyal-labs/binding": "0.2.0-alpha.6",
+    "@lloyal-labs/media": "0.2.0-alpha.6",
+    "@lloyal-labs/rig": "5.6.0-alpha.10"
+  },
+  "peerDependencies": {
+    "electron": ">=38"
+  },
+  "devDependencies": {
+    "electron": "^44.0.0"
+  },
+  "files": [
+    "dist/",
+    "LICENSE"
+  ]
+}