arcane-os 0.73.0 → 0.75.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 0.75.0
+
+- Advertise whole-image `img2img` alongside `txt2img` for the built-in
+  `sdxl-base-1.0` selection. Use the existing public `images.edit()` operation
+  with the original PNG, complete prompt and explicit strength.
+- Reuse the complete SDXL Base checkpoint, embedded VAE and existing retained
+  native context. Preserve 1024-by-1024 defaults, caller-selected canvas,
+  progress, cancellation and complete separate PNG results. No additional
+  model resource, runtime, adapter or dependency is introduced.
+- Document the pinned engine's encoding/sampling path and whole-image editing
+  semantics. Masked/reference editing and pixel or output-quality guarantees
+  remain outside this selection; source review is not native execution proof.
+
+## 0.74.0
+
+- Add optional `longPaths` to `createRepositoryWorkspace()` for newly cloned
+  Windows repositories. Explicit true or false selects clone-local
+  `core.longpaths` before the first checkout and persists it in the new target.
+- Preserve inherited and template configuration when the option is omitted,
+  existing repositories, non-Windows commands, and the ordinary single-clone
+  identity, progress, cancellation and hook lifecycle. No global setting,
+  repository migration, filename transformation or dependency change is added.
+
 ## 0.73.0
 
 - Add public `resolvePwaRetirementResponse({workspaceRoot, appId})` for existing

package/README.md

@@ -20,7 +20,7 @@ selected SDK projection or an explicit live SDK source mount. Both profiles
 share the theme, packaging, event, cancellation,
 and browser run contracts while retaining their selected application layout.
 
-This checkout defines the `0.73.0` SDK contract. Development applications declare
+This checkout defines the `0.75.0` SDK contract. Development applications declare
 `arcane-os` as `latest` and retain their lockfile. Exact SDK pins begin when Roshi
 designates a production build. Follow [Consumer updates](docs/consumer-updates.md)
 to refresh and compare the installed SDK and lockfile with the published channel;

package/docs/reference/README.md

@@ -44,6 +44,7 @@ alone does not make bare module names resolve in a browser.
 | Install an app and cache selected resources offline | [Progressive web applications](pwa.md) |
 | Disable source PWA generation or explicitly retire confirmed generated output | [Source PWA retirement](pwa.md#disable-source-pwa-generation-and-retire-generated-output) |
 | Retire the prior worker after explicitly disabling standalone source PWA | [Disabled-worker browser lifecycle](pwa.md#disabled-worker-retirement-on-the-source-server) |
+| Retire a disabled worker through an existing custom source host | [Public PWA retirement response](pwa.md#retirement-through-an-existing-custom-host) |
 | Generate named browser imports or inspect the selected physical runtime | [`arcane import-map`](cli.md#arcane-import-map) and [browser runtime delivery](protocols.md#browser-runtime-delivery) |
 | Connect an application through the shared WebSocket transport | [Shared WebSocket clients](websocket-client.md) |
 | Choose browser, native, cloud, or cross-host behavior | [Availability and normalization](availability-and-normalization.md) |
@@ -71,7 +72,7 @@ alone does not make bare module names resolve in a browser.
 | Run application-selected llama.cpp, Ollama or ONNX through Core | [Local AI through Core](local-ai.md) |
 | Generate complete local PNG images with a retained native model | [Local image generation](local-image-generation.md) |
 | Select FLUX.2 Klein 4B and its three complementary model resources | [FLUX.2 Klein 4B through Core](local-image-flux.md) |
-| Select the complete SDXL Base 1.0 checkpoint for text-to-image generation | [SDXL Base 1.0 through Core](local-image-sdxl.md) |
+| Select the complete SDXL Base 1.0 checkpoint for generation and whole-image editing | [SDXL Base 1.0 through Core](local-image-sdxl.md) |
 | Compose independently loaded transcription and synthesis engines | [Native speech service](native-speech.md) |
 | Keep a native Whisper model loaded across complete recordings | [Native Whisper transcription](local-whisper.md) |
 | Select the optional Intel NPU encoder with independent CUDA or CPU decoding | [Intel NPU Whisper](../guides/native-whisper-openvino.md) |
@@ -81,7 +82,7 @@ alone does not make bare module names resolve in a browser.
 | Retain a Nemotron model and diarize caller-fed audio streams | [Native speaker diarization](diarization.md) |
 | Persist application-selected preferences through Core | [Core preferences service](core-preferences.md) |
 | Read complete selected Git text without changing a checkout | [Git text snapshots](git-text-snapshot.md) |
-| Own a native working checkout under per-user ArcaneData/Repos | [Native repository workspaces](core-repositories.md) |
+| Own a native working checkout under per-user ArcaneData/Repos, with optional Windows long paths for new clones | [Native repository workspaces](core-repositories.md) and [Windows clone configuration](core-repositories.md#windows-long-paths-for-a-new-checkout) |
 | Read Git identity defaults or select child-only author and credential hints | [Git identity configuration](core-repositories.md#git-identity-configuration) |
 | Write, commit and push complete selected repository text | [Selected-text repository writing](core-repositories.md#write-commit-and-push-selected-text) |
 | Observe existing checkout configuration and capture an explicit remote/ref | [Repository configuration and selected targets](core-repositories.md#existing-checkout-configuration-and-selected-targets) |

package/docs/reference/core-repositories.md

@@ -47,7 +47,7 @@ const status = await repository.status({signal});
 await repository.close();
 ```
 
-`createRepositoryWorkspace({name,directory,dataRoot,remote,branch,gitIdentity,onEvent,run}={})`
+`createRepositoryWorkspace({name,directory,dataRoot,remote,branch,longPaths,gitIdentity,onEvent,run}={})`
 returns `{directory,open,status,configuration,pull,push,write,close,drain,dispose}`. The `directory`
 property is the absolute selected working path.
 
@@ -63,6 +63,11 @@ property is the absolute selected working path.
   `branch`, when supplied, is passed unchanged to Git's `clone --branch` option;
   otherwise Git selects the remote's default branch. Existing checkouts keep
   their own branch, remote, tracked files, untracked files and local changes.
+- Optional `longPaths` is a boolean for newly cloned Windows checkouts. Explicit
+  `true` or `false` supplies `clone --config core.longpaths=<value>`, so Git
+  writes that choice to the new repository before its first checkout. Omission
+  leaves Git's configuration unchanged. The option does not rewrite an existing
+  checkout, change a global setting, or alter non-Windows clone commands.
 - `onEvent` and optional `run` use the existing SDK process owner. The default
   adapter is `runProcess`; Git must be available on PATH. Credentials and
   authentication remain with Git and the native host. The SDK adds no download,
@@ -90,6 +95,38 @@ A failed or cancelled clone reports the actual failure; any remaining directory
 is retained for application-owned inspection. There is no automatic deletion or
 destructive retry. Filesystem failures and complete Git diagnostics propagate.
 
+### Windows long paths for a new checkout
+
+Select the option in the application's native repository connection:
+
+```javascript
+const repository = createRepositoryWorkspace({
+    name: 'moon-cheese-dispatches',
+    remote: applicationConnection.remote,
+    longPaths: true
+});
+await repository.open({signal});
+```
+
+This remains one ordinary Git clone, including its branch/tag selection,
+progress, hooks, cancellation and empty-remote behavior. It does not clone
+without checkout and run a second initialization sequence. The boolean is
+captured when the owner is constructed; later edits to the options object
+cannot change an accepted connection.
+
+An explicit value intentionally selects the new repository's local
+`core.longpaths` setting. Git's ordinary configuration precedence still applies,
+including higher-priority command-scope settings supplied by the native host.
+Omit the option to retain inherited or template configuration without an SDK
+override. Existing repositories retain their settings even if this option is
+supplied; there is no configuration migration or repair pass.
+
+[Git documents clone-local configuration before the initial checkout](https://git-scm.com/docs/git-clone#OPTIONS).
+[Git for Windows describes long-path support](https://gitforwindows.org/git-cannot-create-a-file-or-directory-with-a-long-path.html)
+for its native commands; unrelated editors, scripts and host tools may have
+their own path limitations. This option changes no filenames or payloads and
+does not change the SDK's persistent directory selection.
+
 ## Existing checkout configuration and selected targets
 
 `configuration({signal}={})` observes an existing checkout without invoking

package/docs/reference/inventory/package-api.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sdkVersion": "0.72.0",
+  "sdkVersion": "0.74.0",
   "environment": {
     "runtime": "Node.js for Node entrypoints; browser for browser-only entrypoints",
     "minimumVersion": "22.23.2 for Node entrypoints",
@@ -199,14 +199,14 @@
       "name": "createRepositoryWorkspace",
       "displayName": "createRepositoryWorkspace()",
       "kind": "function",
-      "signature": "createRepositoryWorkspace({name,directory,dataRoot,remote,branch,gitIdentity,onEvent,run=runProcess}={})",
+      "signature": "createRepositoryWorkspace({name,directory,dataRoot,remote,branch,longPaths,gitIdentity,onEvent,run=runProcess}={})",
       "entrypoints": ["arcane-os/core/repositories"],
       "primaryImport": "arcane-os/core/repositories",
       "group": "Native repository workspaces",
       "summary": "Owns one selected native working checkout with ArcaneData/Repos defaults and existing Git/process lifecycle.",
       "availability": "Node with Git on Windows, Linux and macOS; Android requires host process adaptation",
       "protocol": "Git working repository and SDK process adapter",
-      "normalization": "Returns directory, open, status, configuration, pull, push, write and identical close/drain/dispose hooks. Only missing or empty destinations clone; existing roots are preserved. configuration observes the existing root, symbolic HEAD, origin URL/pushURL arrays and branch remote/merge/upstream URL arrays without clone/init/fetch, preserving unset, empty and repeated values. Explicit paths remain selected. Same-directory operations serialize within the process; cancellation and shutdown join accepted process work. pull/push/write accept a captured target {remote,ref} for current-branch fast-forward pull or non-force current-HEAD selected-ref push; omission retains ordinary configured behavior. write snapshots exact text and paths, stages/commits only literal owned paths and preserves unrelated staged files and Git filters. Complete outputs and causal failures retain confirmed local/committed/pushed and uncertain outcomes plus the supplied target. Optional gitIdentity captures name/email/username for child Git operations only; omitted fields remain inherited and no config file is written."
+      "normalization": "Returns directory, open, status, configuration, pull, push, write and identical close/drain/dispose hooks. Only missing or empty destinations clone; existing roots are preserved. Optional longPaths captures a boolean: explicit Windows true/false supplies clone-local core.longpaths before the first checkout, persisting only in the new repository under ordinary Git configuration precedence. Omission preserves configuration; existing repositories and non-Windows clone commands remain unchanged. No global setting or migration. configuration observes the existing root, symbolic HEAD, origin URL/pushURL arrays and branch remote/merge/upstream URL arrays without clone/init/fetch, preserving unset, empty and repeated values. Explicit paths remain selected. Same-directory operations serialize within the process; cancellation and shutdown join accepted process work. pull/push/write accept a captured target {remote,ref} for current-branch fast-forward pull or non-force current-HEAD selected-ref push; omission retains ordinary configured behavior. write snapshots exact text and paths, stages/commits only literal owned paths and preserves unrelated staged files and Git filters. Complete outputs and causal failures retain confirmed local/committed/pushed and uncertain outcomes plus the supplied target. Optional gitIdentity captures name/email/username for child Git operations only; omitted fields remain inherited and identity selection writes no config file."
     },
     {
       "id": "core-repositories:readGitIdentity",

package/docs/reference/local-image-editing.md

@@ -1,8 +1,9 @@
 # Local image editing through Core
 
 `createCoreImageRuntime()` exposes whole-image img2img through `edit()`, using
-the same retained native context as generation. The selected SD1.4 model
-advertises `txt2img` and `img2img`. Applications supply the original PNG, the
+the same retained native context as generation. The built-in SD1.4 and
+[SDXL Base 1.0](local-image-sdxl.md#edit-a-whole-image) models advertise
+`txt2img` and `img2img`. Applications supply the original PNG, the
 complete prompt and explicit strength, retain the original, and decide whether
 to save the separate generated result.
 
@@ -149,6 +150,8 @@ own model-specific contracts and are outside this PNG img2img operation.
 Ordinary img2img does not require LoRA training. The selected engine documents
 this directly with its base SD1.4 model in the
 [tagged img2img example](https://github.com/leejet/stable-diffusion.cpp/blob/master-929-3f8527a/docs/sd.md#img2img-example).
+The complete SDXL Base checkpoint uses its embedded VAE through the same
+image pipeline; see the [SDXL model and operation guide](local-image-sdxl.md).
 
 Source dimensions are decoder output, not an implicit request to change the
 generation dimensions. The engine center-crops and resizes temporary initial
@@ -157,7 +160,7 @@ Caller images remain unchanged;
 even `mode=none` does not suppress all later model adaptation. See the
 [native preprocessing contract](https://github.com/leejet/stable-diffusion.cpp/blob/master-929-3f8527a/docs/image_preprocessing.md).
 
-An RGB-only model such as the selected SD1.4 consumes the stored RGB
+An RGB-only model such as the selected SD1.4 or SDXL consumes the stored RGB
 and does not preserve alpha. The SDK must not silently choose a compositing
 background or claim that passing RGBA preserves its displayed appearance.
 Strength zero is also not an exact-copy operation: native img2img still uses

package/docs/reference/local-image-generation.md

@@ -50,7 +50,8 @@ editing or imply the same input path as SD1.4 img2img.
 `sdxl-base-1.0` selects the complete SDXL Base checkpoint, including its text
 encoders and original VAE. Its [family guide](local-image-sdxl.md) covers the
 single model resource, 1024-by-1024 default canvas and native sampling defaults.
-It advertises `txt2img`; selecting it does not enable an editing operation.
+It advertises `txt2img` and whole-image `img2img` through the same public
+`edit()` operation, using the checkpoint's embedded VAE and retained context.
 
 The first published distribution path selects CPU on Windows and Linux.
 On macOS, `auto` selects the same upstream universal runtime's built-in Metal

package/docs/reference/local-image-sdxl.md

@@ -1,8 +1,8 @@
 # SDXL Base 1.0 through Core
 
 The `sdxl-base-1.0` model definition selects Stability AI's complete SDXL Base
-1.0 checkpoint for text-to-image generation through the shared
-[local image runtime](local-image-generation.md). Applications supply their
+1.0 checkpoint for text-to-image generation and whole-image img2img through the
+shared [local image runtime](local-image-generation.md). Applications supply their
 own complete prompts and own the resulting images and saved associations.
 The model uses the shared retained native context, progress, cancellation
 and complete PNG result contract.
@@ -40,8 +40,8 @@ selection alone does not establish actual execution on any device.
 The single `model` resource is the official
 [`sd_xl_base_1.0.safetensors` checkpoint](https://huggingface.co/stabilityai/stable-diffusion-xl-base-1.0/resolve/462165984030d82259a11f4367a4eed129e94a7b/sd_xl_base_1.0.safetensors)
 at revision `462165984030d82259a11f4367a4eed129e94a7b`. It includes the text
-encoders, denoiser and original VAE. Standalone base generation uses this one
-resource; a refiner, separate VAE, LoRA or Python converter is unnecessary for
+encoders, denoiser and original VAE. Generation and whole-image editing use this
+one resource; a refiner, separate VAE, LoRA or Python converter is unnecessary for
 this selection. The upstream model carries the
 [CreativeML Open RAIL++-M license](https://huggingface.co/stabilityai/stable-diffusion-xl-base-1.0/blob/462165984030d82259a11f4367a4eed129e94a7b/LICENSE.md).
 
@@ -107,6 +107,39 @@ Repeated generation reuses the loaded context; unload it when the application
 no longer needs it. Follow the shared lifecycle contract for request
 cancellation, state subscriptions, unloading and accessor closure.
 
+## Edit a whole image
+
+After loading the same model, pass an original PNG and an explicit strength to
+the existing public accessor. `originalPNG` is the application's PNG Blob or
+File; the application retains it and decides whether to save the new result.
+
+```javascript
+const edited = await images.edit({
+    model: 'sdxl-base-1.0',
+    image: originalPNG,
+    prompt: 'The octopus librarian now wears a purple knitted diving helmet.',
+    strength: 0.6,
+    signal
+});
+// Display edited.images using the same complete PNG Blob result contract.
+```
+
+This is whole-image img2img, using the checkpoint's embedded VAE encoder,
+denoiser and decoder. It needs no additional model resource, adapter or engine.
+The operation reuses the same loaded context and progress/cancellation owners
+as generation. The SDK forwards the complete prompt and original PNG; it does
+not add style instructions or save either the request or result.
+
+The model still defaults to a 1024-by-1024 canvas. Supply
+`parameters: {width, height}` when choosing another output canvas; input
+dimensions do not silently replace that selection. The native engine adapts
+the initial raster to the selected canvas and denoises the whole image.
+Framing, texture, identity and individual pixels are model results, not
+preservation guarantees. Strength zero is not an exact-copy operation, and
+the RGB model does not preserve alpha. See the shared
+[editing contract](local-image-editing.md) for supported PNG encodings,
+native preprocessing, full-result handling and cancellation.
+
 ## Defaults and operation scope
 
 Only canvas dimensions are model-specific defaults here. Sampling parameters
@@ -127,9 +160,9 @@ applies its own text conditioning and prompt-weighting syntax; see the shared
 guide for native string-boundary limitations. The SDK adds no avatar wording,
 style instructions or application-specific content.
 
-This definition advertises `txt2img`. Whole-image editing, masked editing and
-reference-image editing are separate operations with their own model and
-runtime requirements. This base selection does not advertise those operations.
+This definition advertises `txt2img` and `img2img`. Masked and reference-image
+editing are separate operations with their own model and runtime requirements;
+this base selection does not advertise them.
 
 The model resource and standalone use follow the
 [official model card](https://huggingface.co/stabilityai/stable-diffusion-xl-base-1.0/blob/462165984030d82259a11f4367a4eed129e94a7b/README.md).
@@ -137,3 +170,7 @@ Native defaults and embedded-VAE behavior follow the selected engine's
 [request implementation](https://github.com/leejet/stable-diffusion.cpp/blob/master-929-3f8527a/src/pipeline/request.cpp),
 [parameter initialization](https://github.com/leejet/stable-diffusion.cpp/blob/master-929-3f8527a/src/stable-diffusion.cpp)
 and [model construction](https://github.com/leejet/stable-diffusion.cpp/blob/master-929-3f8527a/src/pipeline/model_builders.cpp).
+The pinned [image pipeline](https://github.com/leejet/stable-diffusion.cpp/blob/3f8527a/src/pipeline/image.cpp)
+encodes the initial image, samples its latent and decodes the result. That
+implementation establishes the operation path; source inspection alone does
+not establish execution, output quality or device performance.

package/docs/reference/sdk-api.md

@@ -319,6 +319,7 @@ The remaining data-only subpaths are eight JSON Schemas and package metadata.
 | `repositoryPush()` | function | `arcane-os` | Workspace, doctor, repository, and server | Node; network-assisted Git |
 | `repositoryStatus()` | function | `arcane-os` | Workspace, doctor, repository, and server | Node |
 | `resolveNativeBuildOutputRoot()` | function | `arcane-os` | Targets, native plans, and providers | Node; selected browser/native target or provider as documented |
+| `resolvePwaRetirementResponse()` | function | `arcane-os` | Workspace, doctor, repository, and server | Node; browser service-worker lifecycle remains browser-owned |
 | `resolveWorkspace()` | function | `arcane-os` | Workspace, doctor, repository, and server | Node |
 | `ROOT_CONFIG_NAME` | constant | `arcane-os/packager` | Packaging and release bundles | Node |
 | `discoverApps()` | function | `arcane-os` | Workspace, doctor, repository, and server | Node |
@@ -8095,7 +8096,7 @@ explicit existing path. The application owns the remote, branch and Core API.
 ### Signature and result
 
 ```text
-createRepositoryWorkspace({name,directory,dataRoot,remote,branch,gitIdentity,onEvent,run=runProcess}={})
+createRepositoryWorkspace({name,directory,dataRoot,remote,branch,longPaths,gitIdentity,onEvent,run=runProcess}={})
 ```
 
 Returns `{directory,open,status,configuration,pull,push,write,close,drain,dispose}`. Construction does
@@ -8106,6 +8107,14 @@ work and preserves the checkout. No CLI cwd, launch state, preference, snapshot
 cache or existing user-data location changes. See the [complete inputs, results,
 errors and lifecycle](core-repositories.md#one-connected-working-checkout).
 
+Optional `longPaths` captures a boolean for new Windows clones. Explicit true
+or false supplies clone-local `core.longpaths` before the first checkout and
+persists it only in the new repository. Omission preserves inherited/template
+configuration. Existing repositories and non-Windows clone commands remain
+unchanged; no global setting or data migration is performed. Git's ordinary
+configuration precedence, hooks and single-clone lifecycle remain in effect.
+See [Windows long paths](core-repositories.md#windows-long-paths-for-a-new-checkout).
+
 Optional `gitIdentity:{name?,email?,username?}` captures explicit non-secret
 settings for child Git operations without writing global/local configuration.
 Selected author fields override inherited child author/committer fields;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.73.0",
+  "version": "0.75.0",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",

package/src/core/repositories.mjs

@@ -45,7 +45,7 @@ export function resolveArcaneDataPaths({dataRoot} = {}) {
 
 /** One connected checkout, composed into an application's own Core service. */
 export function createRepositoryWorkspace(
-    {name, directory, dataRoot, remote, branch, gitIdentity, onEvent, run = runProcess} = {}
+    {name, directory, dataRoot, remote, branch, longPaths, gitIdentity, onEvent, run = runProcess} = {}
 ) {
     let selected = directory;
     if (selected === undefined) {
@@ -58,6 +58,9 @@ export function createRepositoryWorkspace(
     requireString(selected, 'directory');
     if (remote !== undefined) requireString(remote, 'remote');
     if (branch !== undefined) requireString(branch, 'branch');
+    if (longPaths !== undefined && !is.boolean(longPaths)) {
+        throw new TypeError('longPaths must be a boolean when supplied.');
+    }
     if (!is.function(run)) throw new TypeError('run must implement the SDK process adapter.');
     const execute = createGitIdentityRunner(run, gitIdentity);
     const repositoryDirectory = path.resolve(selected);
@@ -100,6 +103,11 @@ export function createRepositoryWorkspace(
         await mkdir(path.dirname(repositoryDirectory), {recursive: true});
         throwIfAborted(signal);
         const arguments_ = ['clone', '--progress'];
+        // Clone-local configuration persists before the first checkout. Omission
+        // leaves inherited settings alone; existing repositories never reach here.
+        if (process.platform === 'win32' && longPaths !== undefined) {
+            arguments_.push('--config', `core.longpaths=${longPaths}`);
+        }
         if (branch !== undefined) arguments_.push('--branch', branch);
         arguments_.push('--', remote, repositoryDirectory);
         const result = await prepareRun(

package/src/local-ai/image-models/sdxl.mjs

@@ -14,5 +14,5 @@ export const SDXL_BASE_1_0_MODEL = {
         width: 1024,
         height: 1024
     },
-    operations: ['txt2img']
+    operations: ['txt2img', 'img2img']
 };