@swf2es/desktop 0.0.0-stage → 0.1.14

package/LICENSE

@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 The swf2es authors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

package/README.md

@@ -1,3 +1,133 @@
-# Temporary Holding Version
+# @swf2es/desktop
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+swf2es's desktop app: an Electron window that plays local SWFs, SWFs by
+their http or https URL, and AIR applications, with the `<swf2es-player>`
+element of `@swf2es/web`.
+
+```sh
+npx @swf2es/desktop [options] [file.swf | https://host/movie.swf]
+npx @swf2es/desktop [options] app.xml [root-dir] [-- arguments...]
+```
+
+Node 22.18 or later runs it. The first run downloads Electron's binary
+(about 100 MB), once; installed, the command is `swf2es-desktop`. A
+relative path is taken from the directory the command was run in.
+
+In a checkout of the repository:
+
+```sh
+pnpm install && pnpm build
+pnpm --filter @swf2es/desktop start [options] [file.swf | https://host/movie.swf]
+```
+
+`pnpm install` does not download Electron's binary (pnpm-workspace.yaml
+lists electron under `ignoredBuiltDependencies`), so the rest of the
+repository builds and tests without it. `start` downloads it the first
+time, as the installed command does; `pnpm --filter @swf2es/desktop
+fetch-electron` does so ahead, for the tests.
+
+- **Open** a SWF with File › Open (Ctrl+O), by dropping it on the window,
+  by its http or https URL with File › Open URL (Ctrl+L), or on the
+  command line, a path or a URL, which also hands it to an app already
+  open; File › Open Recent lists the last ten, files and URLs. The
+  window takes the SWF's name. View › Reload Movie (Ctrl+R) starts it
+  again, View › Toggle Full Screen (F11) fills the screen, and File ›
+  Close Movie (Ctrl+W) stops it. Opening another SWF destroys the
+  player before the next starts.
+- **Stage3D.** View › Stage3D (Experimental) opts in to Context3D playback.
+  It starts off, remembers the choice in `settings.json`, and restarts the
+  current movie when changed. The desktop loads the optional WebGL2 backend
+  only when enabled and uses the web element's composition, live AS3 Stage
+  layout and context recovery. If that module cannot load, playback continues
+  with the usual unavailable-context fallback and logs the cause. The saved
+  choice remains enabled. Each slot owns a separate WebGL2 context;
+  closing or reloading the movie releases its resources and browser contexts.
+  Each resource type has its own 4,096-resource count limit.
+  Buffer and texture byte allowances follow the shared backend's AIR-backed
+  limits, with separate host budgets for target attachments. Supported
+  formats and remaining gaps are in [Context3D](../../packages/context3d/README.md).
+- **Libraries.** ActionScript 3 plays on the `builtin.abc` (avmplus',
+  MPL-2.0) and playerglobal that ship with the player, with nothing to set
+  up. File › Choose playerglobal.abc… plays on another playerglobal, such
+  as Flash Player's, in place of the app's own; the app keeps its path in
+  `settings.json` in Electron's user data directory.
+- **Trace.** `--trace` prints what the page logs, a SWF's `trace()` among
+  it, to the terminal: trace lines to stdout, warnings and errors to stderr.
+- **Certificates.** `--ignore-certificate-errors` leaves every HTTPS
+  server's certificate unverified for this run, and
+  `--ignore-certificate-errors=dev.test,localhost` those hosts' alone, on
+  any port: for a server of your own whose certificate it signed itself.
+  Whoever is between you and such a host can then read and change what the
+  SWF loads from it. It is never kept in the settings, and the app says on
+  stderr, each time it starts with it, which hosts go unverified. The page
+  itself has no network (the main process makes a SWF's requests), so
+  nothing but those requests is affected.
+- **Sandbox.** A SWF plays in the sandbox Flash Player gave a local SWF,
+  by its FileAttributes' UseNetwork bit. Without it,
+  local-with-filesystem: it reads the files in its own directory and below
+  (only itself if that is your home directory, the one holding every
+  user's, a temporary directory or a drive's root; keep a SWF in a
+  directory of its own) and reaches no network, no socket and no page.
+  With it, local-with-networking: it reads no local file but itself, loads
+  content (images, sounds, SWFs) from the network, reads data only where
+  the server's `crossdomain.xml` grants every domain (`domain="*"`), as
+  Flash had it, and connects sockets as you allow. Only the SWF playing
+  has access; opening another or closing it takes it away. Its URL
+  (`loaderInfo.url`) does not tell where on the disk it is. A SWF opened
+  by its URL plays in Flash's remote sandbox: it reads no local file,
+  loads anything from its own origin, reads another's data only as that
+  site's `crossdomain.xml` grants its domain, and opens a socket only
+  where you allow it and the server's socket policy (port 843, or the
+  port itself) grants it.
+- **Network.** A SWF's http and https requests go through the main
+  process, judged by Flash's rules and policy files rather than CORS, so
+  `http:` and servers without CORS work. No request carries your cookies
+  or credentials, and none reaches this machine or your local network
+  unless the SWF came from there or a policy file there grants it. That
+  is judged by address range, as a browser judges it: this machine's own
+  public address, or a LAN device's global IPv6 address, counts as the
+  internet, which any web page could reach too.
+- **Sockets** (`flash.net.Socket`) connect over TCP through the main
+  process. The first connection to each server asks: Allow Once, Always
+  Allow for This SWF (remembered in `settings.json`) or Deny.
+- **AIR applications** run by their descriptor (`app.xml`), as adl runs
+  them: its first window's content SWF, from the descriptor's directory
+  or the root directory given after it, at the descriptor's size and with
+  its title, the arguments after `--` handed to its InvokeEvent. It plays
+  with AIR's API (NativeApplication, the window, `flash.filesystem.File`)
+  in AIR's application sandbox: it is played from `app:/`, reads any
+  local file through File, FileStream and its `app:`, `app-storage:` and
+  `file:` URLs, writes any file but through its `app:` URLs, as AIR does,
+  and reaches the network and sockets without Flash's policy files or a
+  prompt, as an installed application does. Its storage directory is
+  under the app's user data, by its id, and its `EncryptedLocalStore`
+  beside it, encrypted by the system's keychain (Electron's
+  `safeStorage`) where there is one. Only the application playing has
+  that reach, and only while it plays; run one you trust, as you would
+  install it.
+- **File dialogs** requested by AS2 or AS3 FileReference use native open
+  and save dialogs after a click or key. Uploads and downloads use the
+  same network permissions as other data requests.
+- **Pages** a SWF with the network opens with navigateToURL go to
+  the system's browser, http and https only, one for each click or key in
+  the window.
+
+## Layout
+
+```
+src/main/       the main process: window, menu, settings, swf2es://, sockets and the network
+src/preload/    window.swf2esDesktop, the page's only way to the main process, and the
+                URL dialog's window.swf2esPrompt
+src/renderer/   the page: the element, the welcome and library panels, the socket and
+                fetch hosts; and the URL dialog's page
+src/shared/     api.ts, the types of window.swf2esDesktop
+static/         index.html (with the page's import map), open-url.html and style.css
+src/launch/     the swf2es-desktop command, and `start`: finds Electron, fetching its
+                binary the first time, and runs the app
+```
+
+The page (`src/renderer`, `static`) knows the shell only through
+`window.swf2esDesktop` (`src/shared/api.ts`), so another shell, Tauri
+say, can serve the same page by giving the same API.
+[docs/architecture/desktop.md](../../docs/architecture/desktop.md) has
+the design, its security among it.

package/dist/launch/electron.d.ts

@@ -0,0 +1,14 @@
+/** The app's folder: package.json, dist/ and static/. */
+export declare const appRoot: string;
+/**
+ * The Electron binary, or null where `pnpm install` skipped its download.
+ * Read from the package's path.txt and dist/, not by requiring it: its
+ * index.js downloads the binary when it is missing, which would make a
+ * check for it the download it is meant to avoid.
+ */
+export declare function electronBinary(): string | null;
+/** The electron package's folder; throws where it is not installed. */
+export declare function electronPackage(): string;
+/** Why the app cannot start yet, or null. */
+export declare function missing(): string | null;
+//# sourceMappingURL=electron.d.ts.map

package/dist/launch/electron.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"electron.d.ts","sourceRoot":"","sources":["../../src/launch/electron.ts"],"names":[],"mappings":"AAOA,yDAAyD;AACzD,eAAO,MAAM,OAAO,QAAoD,CAAC;AAEzE;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAS9C;AAED,uEAAuE;AACvE,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,6CAA6C;AAC7C,wBAAgB,OAAO,IAAI,MAAM,GAAG,IAAI,CAUvC"}

package/dist/launch/electron.js

@@ -0,0 +1,40 @@
+// Where Electron and the built app are, for launch.ts and the tests: from the
+// checkout's src/launch or the package's dist/launch, the app two folders up.
+import { existsSync, readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+/** The app's folder: package.json, dist/ and static/. */
+export const appRoot = fileURLToPath(new URL("../../", import.meta.url));
+/**
+ * The Electron binary, or null where `pnpm install` skipped its download.
+ * Read from the package's path.txt and dist/, not by requiring it: its
+ * index.js downloads the binary when it is missing, which would make a
+ * check for it the download it is meant to avoid.
+ */
+export function electronBinary() {
+    try {
+        const root = electronPackage();
+        const name = readFileSync(join(root, "path.txt"), "utf8");
+        const path = join(root, "dist", name);
+        return existsSync(path) ? path : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The electron package's folder; throws where it is not installed. */
+export function electronPackage() {
+    return dirname(createRequire(import.meta.url).resolve("electron/package.json"));
+}
+/** Why the app cannot start yet, or null. */
+export function missing() {
+    if (!electronBinary()) {
+        return "Electron is not downloaded: run `pnpm --filter @swf2es/desktop fetch-electron` once.";
+    }
+    if (!existsSync(`${appRoot}dist/main/main.js`)) {
+        return "The app is not built: run `pnpm build`.";
+    }
+    return null;
+}
+//# sourceMappingURL=electron.js.map

package/dist/launch/electron.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"electron.js","sourceRoot":"","sources":["../../src/launch/electron.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,yDAAyD;AACzD,MAAM,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,eAAe;IAC7B,OAAO,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,OAAO;IACrB,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACtB,OAAO,sFAAsF,CAAC;IAChG,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,GAAG,OAAO,mBAAmB,CAAC,EAAE,CAAC;QAC/C,OAAO,yCAAyC,CAAC;IACnD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/launch/launch.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=launch.d.ts.map

package/dist/launch/launch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch.d.ts","sourceRoot":"","sources":["../../src/launch/launch.ts"],"names":[],"mappings":""}

package/dist/launch/launch.js

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+// Starts the desktop app in Electron, with a SWF if one is named: the
+// swf2es-desktop command of the package npm installs, and a checkout's
+// `start`.
+//
+//   npx @swf2es/desktop [--trace] [file.swf | https://host/movie.swf]
+//   npx @swf2es/desktop [--trace] app.xml [root-dir] [-- arguments...]
+//   pnpm --filter @swf2es/desktop start ...        the same, in a checkout
+//
+// A relative path is the caller's: from the directory the command was run
+// in, which pnpm and npm name in INIT_CWD where they change it.
+import { execFileSync, spawn, spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { appRoot, electronBinary, electronPackage, missing } from "./electron.js";
+// Electron's binary comes by its package's install script, which a package manager may not
+// have run: pnpm runs none it was not told to, and a checkout's install skips this one. Then
+// it is fetched now, once, as that script fetches it.
+if (!electronBinary()) {
+    let install = "";
+    try {
+        install = join(electronPackage(), "install.js");
+    }
+    catch {
+        // Not installed at all: `missing` says so.
+    }
+    if (install && existsSync(install)) {
+        console.error("swf2es: downloading Electron, once...");
+        spawnSync(process.execPath, [install], { stdio: "inherit" });
+    }
+}
+const why = missing();
+if (why) {
+    console.error(why);
+    process.exit(1);
+}
+const cwd = process.env.INIT_CWD ?? process.cwd();
+// Switches and URLs as they are; a path from where the command was run. What follows "--" is
+// an AIR application's own arguments, as they are.
+const given = process.argv.slice(2);
+const end = given.indexOf("--");
+const own = end < 0 ? given : given.slice(0, end);
+const args = [
+    ...own.map((a) => (a.startsWith("-") || /^https?:\/\//i.test(a) ? a : resolve(cwd, a))),
+    ...(end < 0 ? [] : given.slice(end)),
+];
+// What the context menu's About item names: a checkout's commit, else the package's version.
+let build = "";
+try {
+    build = execFileSync("git", ["rev-parse", "--short=12", "HEAD"], {
+        cwd: appRoot,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+}
+catch {
+    // Not a checkout, or no git.
+}
+// An installed package may sit inside some other project's checkout: its commit is not the app's.
+if (!build || appRoot.includes(`${join("node_modules", "@swf2es")}`)) {
+    build = JSON.parse(readFileSync(join(appRoot, "package.json"), "utf8")).version;
+}
+const env = { ...process.env, SWF2ES_DESKTOP_BUILD: build };
+const child = spawn(electronBinary(), [appRoot, ...args], { stdio: "inherit", env });
+child.on("exit", (code, signal) => process.exit(signal ? 1 : (code ?? 0)));
+for (const signal of ["SIGINT", "SIGTERM"]) {
+    process.on(signal, () => child.kill(signal));
+}
+//# sourceMappingURL=launch.js.map

package/dist/launch/launch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch.js","sourceRoot":"","sources":["../../src/launch/launch.ts"],"names":[],"mappings":";AACA,sEAAsE;AACtE,uEAAuE;AACvE,WAAW;AACX,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,2EAA2E;AAC3E,EAAE;AACF,0EAA0E;AAC1E,gEAAgE;AAChE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAElF,2FAA2F;AAC3F,6FAA6F;AAC7F,sDAAsD;AACtD,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;IACtB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,EAAE,YAAY,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;IAED,IAAI,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACvD,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;AACtB,IAAI,GAAG,EAAE,CAAC;IACR,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AAClD,6FAA6F;AAC7F,mDAAmD;AACnD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACpC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAChC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAClD,MAAM,IAAI,GAAG;IACX,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACvF,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;CACrC,CAAC;AACF,6FAA6F;AAC7F,IAAI,KAAK,GAAG,EAAE,CAAC;AACf,IAAI,CAAC;IACH,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE;QAC/D,GAAG,EAAE,OAAO;QACZ,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;KACpC,CAAC,CAAC,IAAI,EAAE,CAAC;AACZ,CAAC;AAAC,MAAM,CAAC;IACP,6BAA6B;AAC/B,CAAC;AAED,kGAAkG;AAClG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;IACrE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAClF,CAAC;AAED,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;AAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,EAAY,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;AAC/F,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3E,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU,EAAE,CAAC;IACpD,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/C,CAAC"}

package/dist/main/addresses.d.ts

@@ -0,0 +1,7 @@
+export type AddressClass = "public" | "private" | "loopback";
+/** How private a class is: a request to a higher rank than its SWF's needs the target's word. */
+export declare const RANK: Record<AddressClass, number>;
+/** Where `address` is; null for one no request may reach, or for what is no IP address. */
+export declare function addressClass(address: string): AddressClass | null;
+export declare function badPort(port: number): boolean;
+//# sourceMappingURL=addresses.d.ts.map

package/dist/main/addresses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"addresses.d.ts","sourceRoot":"","sources":["../../src/main/addresses.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC;AAE7D,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAA0C,CAAC;AAiJzF,2FAA2F;AAC3F,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAQjE;AAeD,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7C"}

package/dist/main/addresses.js

@@ -0,0 +1,155 @@
+// Where an IP address is, for the network the desktop app reaches for a
+// SWF: on the internet, on a private network (a LAN, a link, a cloud's
+// metadata service at 169.254.169.254), or on this machine. A SWF reaches
+// a place more private than the one it came from only as that place's own
+// policy file allows, as Chromium's Private Network Access asks a server
+// there before a public page may. Some addresses no request may reach.
+// Pure, so that node tests it (tests/desktop/network.test.ts).
+import { isIPv4, isIPv6 } from "node:net";
+/** How private a class is: a request to a higher rank than its SWF's needs the target's word. */
+export const RANK = { public: 0, private: 1, loopback: 2 };
+/** An IPv4 address as a number, or null. */
+function ipv4(text) {
+    if (!isIPv4(text)) {
+        return null;
+    }
+    return text.split(".").reduce((n, part) => n * 256 + Number(part), 0);
+}
+const inV4 = (n, base, bits) => {
+    const mask = bits === 0 ? 0 : (0xffffffff << (32 - bits)) >>> 0;
+    return (n & mask) >>> 0 === (ipv4(base) & mask) >>> 0;
+};
+function classOfV4(n) {
+    // This network, multicast, and the reserved block with broadcast: never a server.
+    if (inV4(n, "0.0.0.0", 8) || inV4(n, "224.0.0.0", 4) || inV4(n, "240.0.0.0", 4)) {
+        return null;
+    }
+    if (inV4(n, "127.0.0.0", 8)) {
+        return "loopback";
+    }
+    const special = [
+        ["10.0.0.0", 8],
+        // Carrier-grade NAT.
+        ["100.64.0.0", 10],
+        // Link-local, where clouds keep their metadata service.
+        ["169.254.0.0", 16],
+        ["172.16.0.0", 12],
+        ["192.0.0.0", 24],
+        // The documentation and benchmarking blocks, never on the internet.
+        ["192.0.2.0", 24],
+        ["192.168.0.0", 16],
+        ["198.18.0.0", 15],
+        ["198.51.100.0", 24],
+        ["203.0.113.0", 24],
+    ];
+    return special.some(([base, bits]) => inV4(n, base, bits)) ? "private" : "public";
+}
+/** An IPv6 address's 16 bytes, its zone dropped; null if it is not one. */
+function ipv6(text) {
+    const address = text.replace(/%.*$/, "");
+    if (!isIPv6(address)) {
+        return null;
+    }
+    let head = address;
+    let tail = "";
+    const bytes = new Uint8Array(16);
+    // A dotted IPv4 tail fills the last four bytes.
+    const dotted = /^(.*:)(\d+\.\d+\.\d+\.\d+)$/.exec(address);
+    let v4 = null;
+    if (dotted) {
+        v4 = ipv4(dotted[2]);
+        head = `${dotted[1]}0:0`;
+    }
+    const halves = head.split("::");
+    [head, tail] = [halves[0], halves[1] ?? ""];
+    const groups = (part) => (part === "" ? [] : part.split(":"));
+    const front = groups(head);
+    const back = groups(tail);
+    const all = [...front, ...Array(8 - front.length - back.length).fill("0"), ...back];
+    all.forEach((group, i) => {
+        const value = Number.parseInt(group, 16);
+        bytes[i * 2] = value >> 8;
+        bytes[i * 2 + 1] = value & 0xff;
+    });
+    if (v4 !== null) {
+        bytes.set([v4 >>> 24, (v4 >>> 16) & 0xff, (v4 >>> 8) & 0xff, v4 & 0xff], 12);
+    }
+    return bytes;
+}
+const v4At = (bytes, at) => ((bytes[at] << 24) | (bytes[at + 1] << 16) | (bytes[at + 2] << 8) | bytes[at + 3]) >>> 0;
+function startsWith(bytes, prefix, bits) {
+    for (let bit = 0; bit < bits; bit++) {
+        const byte = bit >> 3;
+        const mask = 0x80 >> (bit & 7);
+        if ((bytes[byte] & mask) !== ((prefix[byte] ?? 0) & mask)) {
+            return false;
+        }
+    }
+    return true;
+}
+function classOfV6(bytes) {
+    const zero = (from, to) => bytes.subarray(from, to).every((b) => b === 0);
+    if (zero(0, 16)) {
+        return null;
+    }
+    if (zero(0, 15) && bytes[15] === 1) {
+        return "loopback";
+    }
+    // An IPv4 address within, mapped, translated (RFC 2765's ::ffff:0:a.b.c.d),
+    // compatible, by NAT64 or by 6to4: that address's class.
+    if (zero(0, 10) && bytes[10] === 0xff && bytes[11] === 0xff) {
+        return classOfV4(v4At(bytes, 12));
+    }
+    if (zero(0, 8) && bytes[8] === 0xff && bytes[9] === 0xff && zero(10, 12)) {
+        return classOfV4(v4At(bytes, 12));
+    }
+    if (zero(0, 12)) {
+        return classOfV4(v4At(bytes, 12));
+    }
+    if (startsWith(bytes, [0, 0x64, 0xff, 0x9b], 96)) {
+        return classOfV4(v4At(bytes, 12));
+    }
+    if (startsWith(bytes, [0x20, 0x02], 16)) {
+        return classOfV4(v4At(bytes, 2));
+    }
+    // Multicast, and the discard block.
+    if (bytes[0] === 0xff || startsWith(bytes, [0x01, 0x00], 64)) {
+        return null;
+    }
+    const special = [
+        // Unique local, link-local and the old site-local.
+        [[0xfc], 7],
+        [[0xfe, 0x80], 10],
+        [[0xfe, 0xc0], 10],
+        // NAT64 for local use, Teredo, whose IPv4 address is hidden, and documentation.
+        [[0, 0x64, 0xff, 0x9b, 0, 1], 48],
+        [[0x20, 0x01, 0, 0], 32],
+        [[0x20, 0x01, 0x0d, 0xb8], 32],
+    ];
+    return special.some(([prefix, bits]) => startsWith(bytes, prefix, bits)) ? "private" : "public";
+}
+/** Where `address` is; null for one no request may reach, or for what is no IP address. */
+export function addressClass(address) {
+    const v4 = ipv4(address);
+    if (v4 !== null) {
+        return classOfV4(v4);
+    }
+    const v6 = ipv6(address.replace(/^\[(.*)\]$/, "$1"));
+    return v6 ? classOfV6(v6) : null;
+}
+/**
+ * The ports the Fetch standard blocks, as browsers do, so that a request
+ * cannot speak HTTP to a mail, shell or name server; Flash in a browser
+ * went through the browser's network and met the same list.
+ */
+const BAD_PORTS = new Set([
+    1, 7, 9, 11, 13, 15, 17, 19, 20, 21, 22, 23, 25, 37, 42, 43, 53, 69, 77, 79, 87, 95, 101, 102,
+    103, 104, 109, 110, 111, 113, 115, 117, 119, 123, 135, 137, 139, 143, 161, 179, 389, 427, 465,
+    512, 513, 514, 515, 526, 530, 531, 532, 540, 548, 554, 556, 563, 587, 601, 636, 989, 990, 993,
+    995, 1719, 1720, 1723, 2049, 3659, 4045, 4190, 5060, 5061, 6000, 6566, 6665, 6666, 6667, 6668,
+    6669, 6679, 6697, 10080,
+]);
+export function badPort(port) {
+    return BAD_PORTS.has(port);
+}
+//# sourceMappingURL=addresses.js.map