opentray 0.32.0 → 0.33.1

package/README.md

@@ -124,11 +124,43 @@ completed graceful close), the SDK reaches a terminal connection-dead state:
   immediately with the same message instead of hanging on a dead socket.
 - Event delivery stops. Eventful tray handles expose
   `tray.onConnectionDead(handler)` — present on local broker transports — which
-  fires exactly once with the terminal error; treat it as the fail-loud signal
-  to exit or supervised-restart an entry whose backend is gone.
+  fires exactly once per connection generation; treat it as the fail-loud signal
+  for that generation's cleanup.
 - `destroy()` treats the sentinel as the requested end state, so a Quit issued
   after broker death still settles.
 
+### Transport robustness and supervision
+
+The `createTray` runtime path wraps the broker connection in a supervised
+transport. Consumer contract (full guidance in the public
+`skills/opentray` reference `transport-robustness.md`):
+
+- Every transport call is deadline-bounded (interactive 5 s, teardown 2 s,
+  bootstrap 10 s — exported as `INTERACTIVE_CALL_DEADLINE_MS`,
+  `TEARDOWN_CALL_DEADLINE_MS`, `BOOTSTRAP_CALL_DEADLINE_MS`; overridable per
+  call through the optional `request(frame, { deadlineMs })` transport
+  parameter). A budget that expires settles that one call with the typed
+  `TransportTimeoutError`; late replies are discarded statelessly. Deferred
+  operations follow the two-phase rule: the deadline bounds
+  dispatch-to-acceptance, and an accepted operation (a held modal dialog)
+  settles with its terminal or the typed transport-close rejection — never a
+  transport deadline.
+- An *uninvited* connection death is detected by socket close/error or an
+  idle-gated heartbeat and recovers automatically with zero consumer code:
+  cooldown backoff, broker respawn through the same identity-gated connect
+  path, declarative journal replay (tray options, last-set mutations,
+  extension mounts), registered facade rebuilds, then a full state snapshot
+  re-emit. A bounded budget (3 attempts per 10 min, in-memory) caps the
+  loop; exhaustion is the terminal `abandoned` state where every call fails
+  fast with `TransportAbandonedError` (code `transport_abandoned`) and the
+  app keeps running headless. Caller-initiated teardown never recovers.
+- Health projection: `tray.onTransportStateChange(handler)` publishes
+  edge-triggered `healthy | recovering | abandoned`. The optional
+  `runtimeOptions.recovery` object exposes the policy knobs (`enabled`,
+  `maxRestarts`, `windowMs`, `cooldownMs`, `backoffFactor`, `backoffCapMs`)
+  and the Tier 2 `restartApp` callback, which replaces in-process recovery
+  with exactly one hand-over invocation.
+
 ### Extension commands and deferred operations
 
 `tray.requestExtension(ext, data)` (and the `TrayExtensionContext.request`

package/dist/index.d.mts

@@ -98,12 +98,69 @@ declare const resolveNativeExtensionArtifact: (artifact: NativeExtensionArtifact
 declare const EMBEDDED_STAGING_MANIFEST_PATH = "platforms/manifest.json";
 //#endregion
 //#region src/client.d.ts
+/**
+ * Optional per-call transport budget (W1, harden-transport-robustness): a
+ * transport that enforces deadlines settles the call with a typed
+ * `TransportTimeoutError` when no correlated reply arrives within
+ * `deadlineMs`. The parameter is also the teardown-class marking channel
+ * later phases read to keep caller-initiated teardown out of recovery — the
+ * budget class, not a new protocol flag, distinguishes the call.
+ */
+interface TransportRequestOptions {
+  /** Per-call deadline budget in milliseconds; transports default to the interactive class. */
+  deadlineMs?: number;
+}
 interface OpenTrayTransport {
-  request(frame: ClientRequestFrame$1): Promise<ServerFrame$1>;
+  request(frame: ClientRequestFrame$1, options?: TransportRequestOptions): Promise<ServerFrame$1>;
+}
+/**
+ * Default per-call deadline classes (W1, harden-transport-robustness;
+ * field-validated against the pnpm-pub silent-wedge incident): interactive
+ * calls settle or reject within 5 s, teardown-class frames within 2 s, and
+ * bootstrap-class round-trips (connection init and first bring-up) within
+ * 10 s. They live beside `OpenTrayTransport` because they are part of the
+ * generic transport call contract, not of one broker implementation.
+ */
+declare const INTERACTIVE_CALL_DEADLINE_MS = 5000;
+declare const TEARDOWN_CALL_DEADLINE_MS = 2000;
+declare const BOOTSTRAP_CALL_DEADLINE_MS = 10000;
+/**
+ * Typed per-call deadline rejection: the transport's budget for one
+ * round-trip expired without a correlated reply. This is the third
+ * rejection class, distinct from transport-lost (the plain
+ * `BROKER_CONNECTION_CLOSED_MESSAGE` sentinel family, or the typed
+ * `extension_transport_closed` for accepted deferred operations) and from
+ * broker-rejected (`BrokerServerError` / `ExtensionOperationError`). An
+ * expiry settles exactly one call; it never declares the transport dead —
+ * death stays a socket-close/error (and, later, heartbeat) verdict.
+ */
+declare class TransportTimeoutError extends Error {
+  readonly requestId: RequestId;
+  readonly deadlineMs: number;
+  constructor(requestId: RequestId, deadlineMs: number);
 }
 type OpenTrayEventFrame = Extract<ServerFrame$1, {
   type: "event" | "app-event" | "ext-event";
 }>;
+/**
+ * Supervision state vocabulary (W6 Tier 1, harden-transport-robustness):
+ * `healthy` (a live generation is serving), `recovering` (uninvited death was
+ * declared and in-process recovery is running), `abandoned` (terminal — the
+ * recovery budget is exhausted and every later call fails fast with the
+ * typed `TransportAbandonedError`). Edge-triggered through
+ * `onTransportStateChange`; the initial `healthy` state never fires.
+ */
+type TransportState = "healthy" | "recovering" | "abandoned";
+/**
+ * Context handed to a facade rebuild callback after a supervised recovery
+ * (W4): the fresh generation number and the new generation's broker session
+ * id, so extension facades can re-create session-attributed native state
+ * against the live session instead of the dead one.
+ */
+interface TransportRebuildContext {
+  readonly generation: number;
+  readonly sessionId: string | undefined;
+}
 interface OpenTrayEventSource {
   onEvent(listener: (frame: OpenTrayEventFrame) => void): () => void;
 }
@@ -152,8 +209,8 @@ interface TrayHandle {
   setTooltip(tooltip: Tooltip$1): Promise<void>;
   setIcon(icon: Icon$1): Promise<void>;
   loadExtension(options: ExtensionLoadOptions): Promise<void>;
-  commandExtension(ext: string, data: unknown): Promise<void>;
-  requestExtension<TValue = unknown>(ext: string, data: unknown): Promise<ExtensionRequestResult<TValue>>;
+  commandExtension(ext: string, data: unknown, callOptions?: TransportRequestOptions): Promise<void>;
+  requestExtension<TValue = unknown>(ext: string, data: unknown, callOptions?: TransportRequestOptions): Promise<ExtensionRequestResult<TValue>>;
   extend<TCapability extends object, TOptions = undefined>(extension: TrayExtension<TCapability, TOptions>, options?: TOptions): TrayHandle & TCapability;
   destroy(): Promise<void>;
 }
@@ -190,6 +247,22 @@ interface EventfulTrayHandle extends TrayHandle {
    * stopped, and every later request rejects instead of hanging.
    */
   onConnectionDead?(handler: (error: Error) => void): () => void;
+  /**
+   * Tier 1 transport-supervision state projection (W6,
+   * harden-transport-robustness). Present when the underlying transport is
+   * supervised (the `createTray` runtime path always supervises): fires
+   * edge-triggered `healthy | recovering | abandoned` transitions across
+   * connection generations; the current value is not replayed.
+   */
+  onTransportStateChange?(handler: (state: TransportState) => void): () => void;
+  /**
+   * Facade rebuild registration (W4, harden-transport-robustness). Present
+   * on supervised transports: extension facades register one callback that
+   * re-creates their declarative native state (windows, styles,
+   * subscriptions) after the supervisor recovered a fresh generation.
+   * Callbacks run in registration order after the core journal replay.
+   */
+  registerTransportRebuild?(rebuild: (context: TransportRebuildContext) => Promise<void>): void;
 }
 interface ExtensionLoadOptions {
   name: string;
@@ -216,8 +289,8 @@ interface TrayExtensionContext {
   readonly artifact: NativeExtensionArtifact;
   readonly mountId: string;
   ensureLoaded(): Promise<void>;
-  command(data: unknown): Promise<void>;
-  request<TValue = unknown>(data: unknown): Promise<ExtensionRequestResult<TValue>>;
+  command(data: unknown, callOptions?: TransportRequestOptions): Promise<void>;
+  request<TValue = unknown>(data: unknown, callOptions?: TransportRequestOptions): Promise<ExtensionRequestResult<TValue>>;
 }
 interface TrayExtension<TCapability extends object, TOptions = undefined> {
   readonly name: string;
@@ -238,6 +311,367 @@ declare function createClient(transport: OpenTrayTransport, options?: CreateClie
 declare function createTrayHandle(transport: OpenTrayConnection, appId: string, trayId: TrayId$1, nextRequestId?: () => RequestId): EventfulTrayHandle;
 declare function createTrayHandle(transport: OpenTrayTransport, appId: string, trayId: TrayId$1, nextRequestId?: () => RequestId): TrayHandle;
 //#endregion
+//#region src/local-broker.d.ts
+type LocalRuntimeEventFrame = Extract<ServerFrame$1, {
+  type: "event" | "app-event" | "ext-event";
+}>;
+/**
+ * Transport-close sentinel every pending request rejects with when the
+ * broker socket closes (the broker exits once its last session closes, so a
+ * caller racing its own teardown against that exit sees this message).
+ * Exported so the tray-handle destroy path can treat it as the desired end
+ * state instead of a failure (P3.6 quit-path finding, 2026-09-12).
+ */
+declare const BROKER_CONNECTION_CLOSED_MESSAGE = "broker connection closed";
+/**
+ * Generic transport-close rejection code for every pending deferred operation
+ * (add-ext-dialog section 5.1 frozen): the core client carries no extension-specific
+ * branch. Extension facades map this shared code onto their public surface
+ * (e.g. ext-dialog's `dialog_transport_closed`) - that mapping is facade work,
+ * never core work.
+ */
+declare const EXTENSION_TRANSPORT_CLOSED_CODE = "extension_transport_closed";
+/**
+ * Typed rejection every deferred operation settles with: the `error` payload
+ * branch of an `ext-operation-terminal` frame, or the generic
+ * `extension_transport_closed` rejection when the transport dies while an
+ * operation is pending. Consumers match on `code`; the human `message` is not
+ * a contract. `details` carries the wire error's structured payload when the
+ * extension supplied one.
+ */
+declare class ExtensionOperationError extends Error {
+  readonly code: string;
+  readonly details?: unknown;
+  constructor(code: string, message: string, options?: {
+    details?: unknown;
+    cause?: unknown;
+  });
+}
+/**
+ * Typed handshake rejection for a Ready frame whose protocol version does not
+ * equal the version this client sent in its Init frame: a structurally valid
+ * Ready frame alone must never accept the session (add-ext-dialog batch A
+ * review P1-9). The message names both sides; consumers may match
+ * `instanceof` or the two numeric fields.
+ */
+declare class BrokerProtocolVersionError extends Error {
+  readonly clientProtocolVersion: number;
+  readonly brokerProtocolVersion: number;
+  constructor(clientProtocolVersion: number, brokerProtocolVersion: number);
+}
+interface LocalBrokerClient extends OpenTrayTransport {
+  readonly endpoint: string;
+  readonly callerLabel: string;
+  readonly sessionId: string;
+  /**
+   * Terminal connection-death state (D3, harden-lifecycle-ownership): true
+   * once the broker socket errored or closed. Pending and future requests
+   * reject; event delivery has stopped.
+   */
+  readonly connectionDead: boolean;
+  /**
+   * Terminal connection-death notification; fires exactly once, either for a
+   * transport error or the transport-close sentinel, and also after a
+   * caller-initiated graceful `close()` completes.
+   */
+  onConnectionDead(listener: (error: Error) => void): () => void;
+  /**
+   * Internal deadline-expiry observation seam (W1, harden-transport-robustness):
+   * not consumer API. A supervision layer (Phase C heartbeat) subscribes to
+   * attribute probe failures — an expiry settles one call and never declares
+   * the transport dead, but it counts as one liveness-failure signal.
+   */
+  onDeadlineExpiry(listener: (expiry: TransportDeadlineExpiry) => void): () => void;
+  onEvent(listener: (frame: LocalRuntimeEventFrame) => void): () => void;
+  close(): Promise<void>;
+}
+/** Payload of the internal deadline-expiry seam: which call class budget expired. */
+interface TransportDeadlineExpiry {
+  readonly requestId: RequestId;
+  readonly deadlineMs: number;
+}
+//#endregion
+//#region src/transport-supervision.d.ts
+/**
+ * Typed fail-fast rejection for every call issued after supervision reached
+ * its terminal `abandoned` state: the recovery budget is exhausted and the
+ * runtime stays headless by design (the consumer process keeps running).
+ * Consumers match on `code` (`transport_abandoned`); `details` carries the
+ * budget facts `{ recoveries, windowMs }`.
+ */
+declare class TransportAbandonedError extends Error {
+  readonly code = "transport_abandoned";
+  readonly details: {
+    readonly recoveries: number;
+    readonly windowMs: number;
+  };
+  constructor(recoveries: number, windowMs: number);
+}
+/**
+ * Tier 0/2 recovery policy (W6). Every key has a working default; the whole
+ * object is optional — not configuring it means full default protection.
+ * Policy stays in the app; mechanism stays in the SDK.
+ */
+interface TransportRecoveryOptions {
+  /**
+   * Master switch (default `true`). `false` degrades supervision to today's
+   * behavior plus heartbeat death detection: declared death stays terminal
+   * per connection, no respawn, no `recovering`/`abandoned` transitions.
+   */
+  enabled?: boolean;
+  /** Recovery attempts allowed per sliding `windowMs` (default 3). */
+  maxRestarts?: number;
+  /** Sliding budget window in milliseconds (default 600_000 = 10 min). */
+  windowMs?: number;
+  /** Cooldown before the first respawn attempt (default 1_000). */
+  cooldownMs?: number;
+  /** Multiplier applied to the cooldown after each failed attempt (default 2). */
+  backoffFactor?: number;
+  /** Backoff ceiling in milliseconds (default 30_000). */
+  backoffCapMs?: number;
+  /**
+   * Budget for one reconnect attempt (default 10 s). A connect factory that
+   * never settles counts as a failed attempt instead of parking the
+   * recovery loop; its late-resolving connection is closed on arrival.
+   */
+  connectTimeoutMs?: number;
+  /**
+   * Tier 2 hand-over (default: absent). When provided, an uninvited death
+   * performs a bounded teardown, invokes this callback exactly once, and goes
+   * terminal — the supervisor never performs in-process rebuild and never
+   * loops. The SDK never embeds app-process restart vectors itself.
+   */
+  restartApp?: () => void | Promise<void>;
+}
+/** Constructor tuning for {@link createTransportSupervisor}. */
+interface CreateTransportSupervisorOptions {
+  /**
+   * Establishes one broker connection generation. Production callers close
+   * over `connectLocalBroker` with the caller's original options so a
+   * respawn is exactly a reconnect: daemon lifecycle, identity gates, and
+   * lock reclaim all reapply unchanged.
+   */
+  connect(): Promise<LocalBrokerClient>;
+  /** Idle gap before a health probe is sent (default 30 s). */
+  heartbeatIntervalMs?: number;
+  /** Per-probe deadline budget (default 3 s). */
+  probeDeadlineMs?: number;
+  /** Consecutive probe failures that declare death (default 3). */
+  heartbeatFailureThreshold?: number;
+  /** Recovery policy; every key defaulted (Tier 0). */
+  recovery?: TransportRecoveryOptions;
+}
+/**
+ * Supervised transport (W2/W4/W5/W6): a stable `OpenTrayConnection`-shaped
+ * proxy for the layers above (createClient, tray handles) that owns one
+ * broker connection per generation underneath. Consumer event subscriptions
+ * and the supervision state machine survive generation changes;
+ * per-connection surfaces (`onConnectionDead`) stay per-generation truth.
+ */
+declare class SupervisedLocalBrokerConnection {
+  private readonly connectFactory;
+  private readonly heartbeatIntervalMs;
+  private readonly probeDeadlineMs;
+  private readonly heartbeatFailureThreshold;
+  private readonly recoveryEnabled;
+  private readonly maxRestarts;
+  private readonly recoveryWindowMs;
+  private readonly cooldownMs;
+  private readonly backoffFactor;
+  private readonly backoffCapMs;
+  private readonly connectTimeoutMs;
+  private readonly restartApp;
+  private connection;
+  private generation;
+  private state;
+  private journal;
+  private readonly eventListeners;
+  private readonly deadListeners;
+  private readonly stateListeners;
+  private readonly rebuildCallbacks;
+  private unwireGeneration;
+  private heartbeatTimer;
+  private heartbeatOrdinal;
+  private heartbeatInFlight;
+  private consecutiveHeartbeatFailures;
+  private lastSettledAt;
+  private restartTimestamps;
+  private callerInitiated;
+  /**
+   * Monotonic teardown epoch: `shutdown()` bumps it so an in-flight recovery
+   * attempt can detect that it raced caller-initiated teardown and abort
+   * instead of resurrecting a destroyed runtime (no candidate adoption, no
+   * `healthy` transition, no restarted heartbeat).
+   */
+  private teardownEpoch;
+  private shutdownPromise;
+  constructor(connectFactory: () => Promise<LocalBrokerClient>, options: CreateTransportSupervisorOptions);
+  /** Current supervision state; edge events go to {@link onTransportStateChange}. */
+  get transportState(): TransportState;
+  /** Monotonic generation counter; each respawn/replay increments it once. */
+  get transportGeneration(): number;
+  /** Current generation's endpoint (proxy; absent before the first connect). */
+  get endpoint(): string;
+  /** Current generation's caller label (proxy; absent before the first connect). */
+  get callerLabel(): string;
+  /**
+   * Current generation's broker session id. Read dynamically so extension
+   * contexts and rebuild callbacks can attribute session-owned state to the
+   * live generation (the id changes on every respawn).
+   */
+  get sessionId(): string;
+  /** True once the current generation's connection died (or none exists). */
+  get connectionDead(): boolean;
+  /**
+   * Establishes generation 0. A failure here propagates to the caller
+   * unchanged — supervision (heartbeat, recovery) only guards a connection
+   * that once existed; an app that never started is a plain startup failure.
+   */
+  connect(): Promise<void>;
+  /**
+   * Forwards one request to the current generation. After the terminal
+   * `abandoned` state every call fails fast with {@link TransportAbandonedError}.
+   * A teardown-budget call (`deadlineMs === TEARDOWN_CALL_DEADLINE_MS`) marks
+   * the supervision caller-initiated: Phase A froze the budget class as the
+   * caller-intent channel, so a socket close racing caller-initiated destroy
+   * can never be misread as uninvited death.
+   */
+  request(frame: ClientRequestFrame$1, options?: TransportRequestOptions): Promise<ServerFrame$1>;
+  /**
+   * Consumer event subscription that survives generation changes: each new
+   * generation's event stream fans out to the same listeners.
+   */
+  onEvent(listener: (frame: OpenTrayEventFrame) => void): () => void;
+  /**
+   * Per-connection death notification, forwarded for every generation (D3
+   * semantics preserved: consumers using it for per-connection cleanup keep
+   * working; the supervision state machine is the new higher-level truth).
+   */
+  onConnectionDead(listener: (error: Error) => void): () => void;
+  /**
+   * Tier 1 health projection (W6): edge-triggered `healthy | recovering |
+   * abandoned` transitions. The initial `healthy` state never fires —
+   * consumers reading the current state use `transportState`.
+   */
+  onTransportStateChange(listener: (state: TransportState) => void): () => void;
+  /**
+   * Registers one facade rebuild callback (W4). Callbacks run in
+   * registration order after the core journal replay on every successful
+   * recovery, receiving the fresh generation number and session id so
+   * session-attributed native state can be re-created against the live
+   * broker session.
+   */
+  registerTransportRebuild(rebuild: (context: TransportRebuildContext) => Promise<void>): void;
+  /**
+   * Graceful teardown channel (W4/W3): idempotent, marks the supervision
+   * caller-initiated synchronously (so the close-driven death event can
+   * never trigger recovery), bumps the teardown epoch (so an in-flight
+   * recovery attempt aborts instead of resurrecting the runtime), stops the
+   * heartbeat, then closes the current generation — including an
+   * adoption-in-progress candidate routed through `this.connection` —
+   * within its bounded graceful-close budget.
+   */
+  shutdown(): Promise<void>;
+  /** LocalBrokerClient structural compatibility: graceful close == shutdown. */
+  close(): Promise<void>;
+  private startHeartbeat;
+  private stopHeartbeat;
+  /**
+   * Idle-gated heartbeat (W2): a transport that keeps settling requests
+   * proves its own liveness, so the probe budget is spent only on silence.
+   * A probe failure of any rejection class (typed timeout, transport-lost,
+   * broker error frame) counts; a successful settlement resets the streak.
+   * Single-flight with a generation token: at most one probe per generation
+   * is outstanding (a configured interval shorter than the probe deadline
+   * must not run concurrent probes whose completions double-count), and a
+   * probe that outlives its generation settles nothing.
+   */
+  private heartbeatTick;
+  private noteSuccessfulSettlement;
+  /**
+   * Subscribes this supervisor's stable listener sets to one generation.
+   * Event fanout and the death/expiry seams are wired before the generation
+   * becomes `this.connection` (recovery candidates are wired before replay)
+   * so no observable event window opens between adoption steps.
+   */
+  private wireGeneration;
+  /**
+   * Death funnel: forwards the per-connection event first (D3 truth), stops
+   * this generation's wiring, then decides the supervision reaction. The
+   * state guard makes the reaction single-flight — deaths of candidates
+   * during an ongoing recovery only forward, they never nest recoveries.
+   */
+  private handleGenerationDeath;
+  /**
+   * Tier 2 hand-over: bounded teardown of the current generation, the app's
+   * restart vector invoked exactly once, then terminal. No in-process
+   * rebuild, no loop — restart ownership belongs to the callback.
+   */
+  private handOverToRestartApp;
+  /**
+   * In-process recovery (W4/W5): cooldown backoff → reconnect through the
+   * original connect options → journal replay → facade rebuilds → healthy.
+   * Every attempt consumes budget up front; a failed attempt (connect,
+   * replay, or rebuild — including artifact identity mismatches) retries
+   * inside the remaining budget until exhaustion abandons the runtime. Each
+   * reconnect attempt is bounded by the connect budget, and every step
+   * re-checks the teardown epoch so a shutdown racing the loop aborts it
+   * instead of resurrecting the runtime.
+   */
+  private runRecovery;
+  /**
+   * One reconnect attempt under the connect budget. A factory that never
+   * settles counts as a failed attempt; a connection arriving after the
+   * budget expired is closed on arrival so no orphan generation leaks.
+   */
+  private connectWithBudget;
+  private cooldownForBackoff;
+  /**
+   * Sliding-window budget: one timestamp per respawn attempt (successful or
+   * not — both are respawns the consumer experienced). In-memory per
+   * supervisor by ruling; a fresh `createTray` starts a fresh budget.
+   */
+  private consumeRestartBudget;
+  /**
+   * Wires the candidate generation, replays the journal, and runs the
+   * facade rebuild callbacks. The candidate becomes `this.connection` for
+   * the adoption's duration — facade rebuild callbacks route their
+   * re-creation commands through this supervisor, so they must reach the
+   * candidate, not the dead generation (the rebuild-routing law). A failure
+   * rolls the candidate back out (unwired, closed) and restores the dead
+   * previous connection so consumer calls keep failing fast; a teardown
+   * racing the adoption aborts without resurrecting anything.
+   */
+  private adoptGeneration;
+  /**
+   * Removes a failed (or torn-down) adoption candidate: stop its wiring,
+   * close it bounded, and restore the previous dead connection unless a
+   * caller-initiated shutdown already dissolved the runtime (shutdown's own
+   * close handled the candidate in that window; the restore must not undo
+   * the torn-down state).
+   */
+  private rollbackAdoption;
+  /**
+   * Replays the declarative journal in record order with fresh request ids
+   * under the bootstrap deadline class. The resolved default app of the new
+   * generation becomes the appId authority: replayed frames are rewritten
+   * onto it, so app-scoped state follows broker truth instead of a stale
+   * generation's identity.
+   */
+  private replayJournal;
+  private setState;
+  private commitJournalEntry;
+  /**
+   * Keyed entries replace in place at first-occurrence position (last-write-
+   * wins value, stable ordering); first occurrences append. Tray creations
+   * and mount declarations keep their creation order by construction.
+   */
+  private upsertJournal;
+  private evictJournalTray;
+}
+/** Constructs a supervised transport around one connect factory. */
+declare const createTransportSupervisor: (options: CreateTransportSupervisorOptions) => SupervisedLocalBrokerConnection;
+//#endregion
 //#region src/menu-input.d.ts
 type CreateTrayMenuClickHandler = (event: TrayEventByType<"menuClick">) => void;
 /** App-facing menu input accepted by top-level createTray and setMenu. */
@@ -296,6 +730,15 @@ interface OpenTrayRuntimeOptions {
   /** Stable app-entry launch vector. Omitted/null snapshots the current invocation. */
   appLaunch?: OpenTrayAppLaunchOptions$1 | null;
   autoStart?: boolean;
+  /**
+   * Optional transport supervision policy (Tier 0/2,
+   * harden-transport-robustness). Every key has a working default; omitting
+   * the object entirely means full default protection: heartbeat death
+   * detection, automatic in-process recovery with journal replay, and a
+   * bounded restart budget. `enabled: false` keeps death detection but
+   * degrades to today's fail-fast behavior.
+   */
+  recovery?: TransportRecoveryOptions;
 }
 /** App-facing tray options accepted by top-level createTray. */
 interface CreateTrayOptions {
@@ -312,52 +755,6 @@ interface CreateTrayHandle extends Omit<EventfulTrayHandle, "setMenu" | "extend"
 }
 declare const createTray: (options: CreateTrayOptions, runtimeOptions?: OpenTrayRuntimeOptions) => Promise<CreateTrayHandle>;
 //#endregion
-//#region src/local-broker.d.ts
-/**
- * Transport-close sentinel every pending request rejects with when the
- * broker socket closes (the broker exits once its last session closes, so a
- * caller racing its own teardown against that exit sees this message).
- * Exported so the tray-handle destroy path can treat it as the desired end
- * state instead of a failure (P3.6 quit-path finding, 2026-09-12).
- */
-declare const BROKER_CONNECTION_CLOSED_MESSAGE = "broker connection closed";
-/**
- * Generic transport-close rejection code for every pending deferred operation
- * (add-ext-dialog section 5.1 frozen): the core client carries no extension-specific
- * branch. Extension facades map this shared code onto their public surface
- * (e.g. ext-dialog's `dialog_transport_closed`) - that mapping is facade work,
- * never core work.
- */
-declare const EXTENSION_TRANSPORT_CLOSED_CODE = "extension_transport_closed";
-/**
- * Typed rejection every deferred operation settles with: the `error` payload
- * branch of an `ext-operation-terminal` frame, or the generic
- * `extension_transport_closed` rejection when the transport dies while an
- * operation is pending. Consumers match on `code`; the human `message` is not
- * a contract. `details` carries the wire error's structured payload when the
- * extension supplied one.
- */
-declare class ExtensionOperationError extends Error {
-  readonly code: string;
-  readonly details?: unknown;
-  constructor(code: string, message: string, options?: {
-    details?: unknown;
-    cause?: unknown;
-  });
-}
-/**
- * Typed handshake rejection for a Ready frame whose protocol version does not
- * equal the version this client sent in its Init frame: a structurally valid
- * Ready frame alone must never accept the session (add-ext-dialog batch A
- * review P1-9). The message names both sides; consumers may match
- * `instanceof` or the two numeric fields.
- */
-declare class BrokerProtocolVersionError extends Error {
-  readonly clientProtocolVersion: number;
-  readonly brokerProtocolVersion: number;
-  constructor(clientProtocolVersion: number, brokerProtocolVersion: number);
-}
-//#endregion
 //#region src/app-icon.d.ts
 declare const DEFAULT_APP_ICON_VARIANT: "default";
 declare class InvalidAppIconError extends Error {
@@ -373,5 +770,5 @@ declare class AppIconVariantNotFoundError extends Error {
 /** Validate an explicit AppIcon, including native file signatures, before broker startup. */
 declare const validateAppIcon: (icon: unknown, platform?: NodeJS.Platform) => Promise<void>;
 //#endregion
-export { type AppEvent, type AppHandle, type AppIcon, type AppIconAsset, type AppIconSource, type AppIconVariant, AppIconVariantNotFoundError, type AppIconVariantOf, type AppId, type AppIdentity, type AppOptions, type AppRef, BROKER_CONNECTION_CLOSED_MESSAGE, type BrokerEndpointIdentity, type BrokerEndpointIdentityOptions, BrokerProtocolVersionError, BrokerServerError, type ClientFrame, type ClientRequestFrame, type CommandScope, type CreateClientOptions, type CreateTrayCheckItem, type CreateTrayHandle, type CreateTrayItem, type CreateTrayMenu, type CreateTrayMenu as TrayMenu, type CreateTrayMenuClickHandler, type CreateTrayMenuItem, type CreateTrayOptions, type CreateTrayRadioItem, type CreateTraySeparatorItem, type CreateTraySubmenuItem, DEFAULT_APP_ICON_VARIANT, type DarwinIcon, type DarwinIconText, EMBEDDED_STAGING_MANIFEST_PATH, EXTENSION_EVENT_RECORD_MAX_BYTES, EXTENSION_TRANSPORT_CLOSED_CODE, type EventfulTrayHandle, type ExpectedExtensionIdentity, type ExtOperationPayload, type ExtensionArtifactTarget, type ExtensionEnvelope, type ExtensionLoadOptions, ExtensionOperationError, type ExtensionRequestResult, type Icon, type IconCandidates, type IconImage, type IconText, InvalidAppIconError, type LinuxIcon, type Menu, type MenuItem, type MenuItemId, type MouseButton, NATIVE_EXTENSION_EMBEDDED_ERROR_CODES, NATIVE_EXTENSION_EMBEDDED_TARGET_MATRIX, type NativeExtensionArch, type NativeExtensionArtifact, NativeExtensionArtifactResolutionError, type NativeExtensionEmbeddedArtifact, NativeExtensionEmbeddedArtifactError, type NativeExtensionEmbeddedErrorReason, type NativeExtensionEmbeddedMatrixTarget, type NativeExtensionEmbeddedTarget, type NativeExtensionExpectedIdentity, type NativeExtensionFileArtifact, type NativeExtensionIdentitySource, type NativeExtensionPackageArtifact, type NativeExtensionPackageTarget, type NativeExtensionTarget, type OpenTrayAppBundleOptions, type OpenTrayAppLaunchOptions, type OpenTrayClient, type OpenTrayConnection, type OpenTrayEventFrame, type OpenTrayEventSource, type OpenTrayRuntimeOptions, type OpenTrayTransport, PROTOCOL_VERSION, type Rect, type ResolvedNativeExtensionArtifact, type ServerFrame, type SimpleIcon, type Tooltip, type TrayBoundsKind, type TrayBoundsResult, type TrayEvent, type TrayEventByType, type TrayEventType, type TrayExtension, type TrayExtensionContext, type TrayExtensionMountSpec, type TrayHandle, type TrayIcon, type TrayId, type TrayOptions, type TrayTooltip, type TypedExtensionError, type Win32Icon, createBrokerEndpointIdentity, createClient, createInitFrame, createTray, createTrayHandle, formatBrokerEndpointName, formatBrokerStateRoot, formatUnixSocketPath, formatWindowsPipeName, isSupportedProtocolVersion, resolveNativeExtensionArtifact, validateAppIcon };
+export { type AppEvent, type AppHandle, type AppIcon, type AppIconAsset, type AppIconSource, type AppIconVariant, AppIconVariantNotFoundError, type AppIconVariantOf, type AppId, type AppIdentity, type AppOptions, type AppRef, BOOTSTRAP_CALL_DEADLINE_MS, BROKER_CONNECTION_CLOSED_MESSAGE, type BrokerEndpointIdentity, type BrokerEndpointIdentityOptions, BrokerProtocolVersionError, BrokerServerError, type ClientFrame, type ClientRequestFrame, type CommandScope, type CreateClientOptions, type CreateTransportSupervisorOptions, type CreateTrayCheckItem, type CreateTrayHandle, type CreateTrayItem, type CreateTrayMenu, type CreateTrayMenu as TrayMenu, type CreateTrayMenuClickHandler, type CreateTrayMenuItem, type CreateTrayOptions, type CreateTrayRadioItem, type CreateTraySeparatorItem, type CreateTraySubmenuItem, DEFAULT_APP_ICON_VARIANT, type DarwinIcon, type DarwinIconText, EMBEDDED_STAGING_MANIFEST_PATH, EXTENSION_EVENT_RECORD_MAX_BYTES, EXTENSION_TRANSPORT_CLOSED_CODE, type EventfulTrayHandle, type ExpectedExtensionIdentity, type ExtOperationPayload, type ExtensionArtifactTarget, type ExtensionEnvelope, type ExtensionLoadOptions, ExtensionOperationError, type ExtensionRequestResult, INTERACTIVE_CALL_DEADLINE_MS, type Icon, type IconCandidates, type IconImage, type IconText, InvalidAppIconError, type LinuxIcon, type Menu, type MenuItem, type MenuItemId, type MouseButton, NATIVE_EXTENSION_EMBEDDED_ERROR_CODES, NATIVE_EXTENSION_EMBEDDED_TARGET_MATRIX, type NativeExtensionArch, type NativeExtensionArtifact, NativeExtensionArtifactResolutionError, type NativeExtensionEmbeddedArtifact, NativeExtensionEmbeddedArtifactError, type NativeExtensionEmbeddedErrorReason, type NativeExtensionEmbeddedMatrixTarget, type NativeExtensionEmbeddedTarget, type NativeExtensionExpectedIdentity, type NativeExtensionFileArtifact, type NativeExtensionIdentitySource, type NativeExtensionPackageArtifact, type NativeExtensionPackageTarget, type NativeExtensionTarget, type OpenTrayAppBundleOptions, type OpenTrayAppLaunchOptions, type OpenTrayClient, type OpenTrayConnection, type OpenTrayEventFrame, type OpenTrayEventSource, type OpenTrayRuntimeOptions, type OpenTrayTransport, PROTOCOL_VERSION, type Rect, type ResolvedNativeExtensionArtifact, type ServerFrame, type SimpleIcon, type SupervisedLocalBrokerConnection, TEARDOWN_CALL_DEADLINE_MS, type Tooltip, TransportAbandonedError, type TransportRebuildContext, type TransportRecoveryOptions, type TransportRequestOptions, type TransportState, TransportTimeoutError, type TrayBoundsKind, type TrayBoundsResult, type TrayEvent, type TrayEventByType, type TrayEventType, type TrayExtension, type TrayExtensionContext, type TrayExtensionMountSpec, type TrayHandle, type TrayIcon, type TrayId, type TrayOptions, type TrayTooltip, type TypedExtensionError, type Win32Icon, createBrokerEndpointIdentity, createClient, createInitFrame, createTransportSupervisor, createTray, createTrayHandle, formatBrokerEndpointName, formatBrokerStateRoot, formatUnixSocketPath, formatWindowsPipeName, isSupportedProtocolVersion, resolveNativeExtensionArtifact, validateAppIcon };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/native-extension-artifact.ts","../src/client.ts","../src/menu-input.ts","../src/sdk.ts","../src/local-broker.ts","../src/app-icon.ts"],"mappings":";;;;KAcY,mBAAA;AAAA,KACA,qBAAA,MAA2B,MAAA,CAAO,QAAA,IAAY,mBAAmB;AAAA,UAE5D,4BAAA;EACf,WAAA;EACA,WAAW;AAAA;AAAA,UAGI,6BAAA;EACf,cAAA;EACA,mBAAmB;AAAA;AAAA,UAGJ,8BAAA,SACP,6BAAA;EACR,IAAA;EACA,OAAA,EAAS,OAAA,CAAQ,MAAA,CAAO,qBAAA,EAAuB,4BAAA;AAAA;;UAIhC,6BAAA;EACf,WAAW;AAAA;;;;AAhBA;AAGb;;;;cAwBa,uCAAA;AAnBb;AAAA,KA2BY,mCAAA,WACF,uCAAuC;;;;;;;;;;UAWhC,+BAAA,SACP,6BAAA;EACR,IAAA;EACA,OAAA,EAAS,MAAA,CACP,mCAAA,EACA,6BAAA;AAAA;AAAA,UAIM,+BAAA;EACR,IAAA;EACA,IAAI;AAAA;AAAA,KAGM,2BAAA,GAA8B,+BAAA;EAGlC,gBAAA,EAAkB,+BAAA;EAClB,cAAA;AAAA;EAGA,gBAAA;EACA,cAAA,EAAgB,6BAAA;AAAA;AAAA,KAIZ,uBAAA,GACR,8BAAA,GACA,2BAAA,GACA,+BAAA;AAAA,KAEQ,+BAAA,GAAkC,2BAAyB;AAAA,UAEtD,+BAAA;EACf,IAAA;EACA,WAAA;EACA,cAAA;EACA,gBAAA,EAAkB,+BAAA;EAClB,MAAA,EAAQ,qBAAqB;AAAA;AAAA,cAGlB,sCAAA,SAA+C,KAAA;EAAA,SAO/C,MAAA,EAAQ,qBAAA;EAAA,SANV,IAAA;EAAA,SACA,WAAA;EAAA,SACA,oBAAA;cAGP,OAAA,UACS,MAAA,EAAQ,qBAAA,EACjB,OAAA,GAAS,YAAA;IACP,WAAA;IACA,oBAAA;EAAA;AAAA;;;;;;KAmBM,kCAAA;AA/DX;AAAA,cAsEY,qCAAA,EAAuC,MAAM,CACxD,kCAAA;AAAA,cASW,oCAAA,SAA6C,KAAA;EAAA,SAC/C,MAAA,EAAQ,kCAAA;EAAA,SACR,IAAA;EAAA,SACA,MAAA,EAAQ,qBAAA;EAAA,SACR,oBAAA;cAGP,MAAA,EAAQ,kCAAA,EACR,OAAA,UACA,OAAA,EAAS,YAAA;IACP,MAAA,EAAQ,qBAAA;IACR,oBAAA;EAAA;AAAA;;cAeO,8BAAA,GACX,QAAA,EAAU,uBAAA,EACV,QAAA,GAAU,MAAA,CAAO,QAAA,EACjB,IAAA,cACC,OAAA,CAAQ,+BAAA;;cAuFE,8BAAA;;;UChPI,iBAAA;EACf,OAAA,CAAQ,KAAA,EAAO,oBAAA,GAAqB,OAAA,CAAQ,aAAA;AAAA;AAAA,KAGlC,kBAAA,GAAqB,OAAO,CACtC,aAAA;EACE,IAAA;AAAA;AAAA,UAGa,mBAAA;EACf,OAAA,CAAQ,QAAA,GAAW,KAAA,EAAO,kBAAkB;AAAA;AAAA,UAG7B,kBAAA,SACP,iBAAA,EACN,mBAAmB;AAAA,UAEN,cAAA;EACf,UAAA,CAAW,OAAA,EAAS,aAAA,GAAc,OAAA,CAAQ,UAAA;AAAA;;ADjCiC;AAE7E;;;;AAEa;KCuCD,sBAAA;EACN,IAAA;EAAmB,MAAA,EAAQ,mBAAA;AAAA;EAC3B,IAAA;EAAkB,WAAA;EAAqB,KAAA,EAAO,MAAM;AAAA;;;;;;;;cAS7C,iBAAA,SAA0B,KAAK;EAAA,SACjC,IAAA;EAAA,SACA,OAAA;cAGP,IAAA,UACA,OAAA,UACA,OAAA;IAAW,OAAA;IAAmB,KAAA;EAAA;AAAA;AAAA,UAWjB,sBAAA,SAA+B,cAAA;EAC9C,UAAA,CAAW,OAAA,EAAS,aAAA,GAAc,OAAA,CAAQ,kBAAA;AAAA;AAAA,UAG3B,UAAA;EACf,MAAA,EAAQ,QAAA;EACR,GAAA,EAAK,SAAA;EACL,SAAA,IAAa,OAAA,CAAQ,kBAAA;EACrB,OAAA,CAAQ,IAAA,EAAM,MAAA,GAAO,OAAA;EACrB,UAAA,CAAW,OAAA,EAAS,SAAA,GAAU,OAAA;EAC9B,OAAA,CAAQ,IAAA,EAAM,MAAA,GAAO,OAAA;EACrB,aAAA,CAAc,OAAA,EAAS,oBAAA,GAAuB,OAAA;EAC9C,gBAAA,CAAiB,GAAA,UAAa,IAAA,YAAgB,OAAA;EAC9C,gBAAA,mBACE,GAAA,UACA,IAAA,YACC,OAAA,CAAQ,sBAAA,CAAuB,MAAA;EAClC,MAAA,mDACE,SAAA,EAAW,aAAA,CAAc,WAAA,EAAa,QAAA,GACtC,OAAA,GAAU,QAAA,GACT,UAAA,GAAa,WAAA;EAChB,OAAA,IAAW,OAAA;AAAA;AAAA,UAGI,SAAA;EAAA,SACN,KAAA;EACT,OAAA,IAAW,OAAA;EACX,OAAA,CAAQ,IAAA,WAAe,OAAA;EACvB,UAAA,IAAc,OAAA,CAAQ,SAAA;EACtB,iBAAA,IAAqB,OAAA;EACrB,UAAA,CAAW,aAAA,EAAe,SAAA,mBAA0B,OAAA;AAAA;AAAA,KAG1C,eAAA,GAAkB,OAAO,CAAC,WAAA;EAAa,IAAA;AAAA;AAAA,KACvC,aAAA,GAAgB,eAAe;AAAA,KAC/B,eAAA,gBAA+B,aAAA,IAAiB,OAAA,CAC1D,eAAA;EACE,IAAA,EAAM,MAAA;AAAA;AAAA,UAGO,kBAAA,SAA2B,UAAA;EAC1C,MAAA,mDACE,SAAA,EAAW,aAAA,CAAc,WAAA,EAAa,QAAA,GACtC,OAAA,GAAU,QAAA,GACT,kBAAA,GAAqB,WAAA;EACxB,eAAA,kBACE,GAAA,UACA,OAAA,GAAU,KAAA,EAAO,mBAAA,CAAkB,KAAA;EAErC,MAAA,gBAAsB,aAAA,EACpB,KAAA,EAAO,MAAA,EACP,OAAA,GAAU,KAAA,EAAO,eAAA,CAAgB,MAAA;EAEnC,WAAA,CACE,OAAA,GAAU,KAAA,EAAO,eAAA;EAEnB,WAAA,CACE,OAAA,GAAU,KAAA,EAAO,eAAA;EAEnB,iBAAA,CACE,OAAA,GAAU,KAAA,EAAO,eAAA;EAEnB,oBAAA,CACE,OAAA,GAAU,KAAA,EAAO,OAAA,CAAQ,UAAA;IAAY,IAAA;EAAA;EDtEC;;;;;;;EC+ExC,gBAAA,EAAkB,OAAA,GAAU,KAAA,EAAO,KAAA;AAAA;AAAA,UAGpB,oBAAA;EACf,IAAA;EACA,QAAA,EAAU,uBAAuB;EACjC,OAAA;AAAA;AAAA,UAGe,sBAAA;EACf,IAAA;EACA,QAAA,GAAW,uBAAuB;EAClC,OAAA;AAAA;AAAA,UAGe,oBAAA;EAAA,SACN,KAAA;EAAA,SACA,MAAA,EAAQ,QAAA;EDnFf;;;;AAE+B;AAEnC;;EAJI,SC2FO,SAAA;EAAA,SACA,IAAA;EAAA,SACA,QAAA,EAAU,uBAAA;EAAA,SACV,OAAA;EACT,YAAA,IAAgB,OAAA;EAChB,OAAA,CAAQ,IAAA,YAAgB,OAAA;EACxB,OAAA,mBAA0B,IAAA,YAAgB,OAAA,CAAQ,sBAAA,CAAuB,MAAA;AAAA;AAAA,UAG1D,aAAA;EAAA,SAIN,IAAA;EAAA,SACA,QAAA,EAAU,uBAAA;EACnB,YAAA,EAAc,OAAA,EAAS,QAAA,eAAuB,sBAAA;EAC9C,MAAA,CACE,IAAA,EAAM,UAAA,EACN,OAAA,EAAS,oBAAA,EACT,OAAA,EAAS,QAAA,eACR,WAAA;AAAA;AAAA,cAGQ,eAAA,GAAmB,aAAA,aAAwB,aAItD;AAAA,UAEe,mBAAA;EACf,eAAA;EACA,UAAA;IACE,IAAA;IACA,OAAA,GAAU,SAAO;EAAA;AAAA;AAAA,iBAIL,YAAA,CACd,SAAA,EAAW,kBAAA,EACX,OAAA,GAAU,mBAAA,GACT,sBAAA;AAAA,iBACa,YAAA,CACd,SAAA,EAAW,iBAAA,EACX,OAAA,GAAU,mBAAA,GACT,cAAA;AAAA,iBAoDa,gBAAA,CACd,SAAA,EAAW,kBAAA,EACX,KAAA,UACA,MAAA,EAAQ,QAAA,EACR,aAAA,SAAsB,SAAA,GACrB,kBAAA;AAAA,iBACa,gBAAA,CACd,SAAA,EAAW,iBAAA,EACX,KAAA,UACA,MAAA,EAAQ,QAAA,EACR,aAAA,SAAsB,SAAA,GACrB,UAAA;;;KC/RS,0BAAA,IACV,KAAmC,EAA5B,eAAe;;KAIZ,cAAA;EACV,KAAA,EAAO,kBAAkB;AAAA;;KAIf,kBAAA,sBAEE,KAAA,UAAe,KAAA,WAAgB,kBAAA,MACzC,cAAA,GACA,mBAAA,GACA,mBAAA,GACA,uBAAA,GACA,qBAAA;AAAA,KAEQ,cAAA;EACV,IAAA;EACA,EAAA,GAAK,YAAA;EACL,KAAA;EACA,YAAA;EACA,OAAA;EACA,QAAA;EACA,WAAA,GAAc,0BAA0B;AAAA;AAAA,KAG9B,mBAAA;EACV,IAAA;EACA,EAAA,GAAK,YAAA;EACL,KAAA;EACA,OAAA;EACA,OAAA;EACA,WAAA,GAAc,0BAA0B;AAAA;AAAA,KAG9B,mBAAA;EACV,IAAA;EACA,EAAA,GAAK,YAAA;EACL,KAAA;EACA,OAAA;EACA,OAAA;EACA,KAAA;EACA,WAAA,GAAc,0BAA0B;AAAA;AAAA,KAG9B,uBAAA;EACV,IAAI;AAAA;AAAA,KAGM,qBAAA;EACV,IAAA;EACA,KAAA;EACA,OAAA;EACA,KAAA,WAAgB,kBAAkB;AAAA;;;UChCnB,sBAAA;EACf,QAAA;EACA,OAAA;EACA,cAAA;EACA,eAAA;EACA,aAAA;EACA,KAAA;EACA,OAAA;EACA,OAAA,GAAU,SAAA;EACV,SAAA,GAAY,0BAAA;EHtBgC;EGwB5C,SAAA,GAAY,0BAAA;EACZ,SAAA;AAAA;AHvBF;AAAA,UG2BiB,iBAAA;EACf,EAAA;EACA,OAAA,GAAU,SAAA;EACV,IAAA,GAAO,MAAA;EACP,IAAA,GAAO,cAAA;AAAA;;UAIQ,gBAAA,SACP,IAAA,CAAK,kBAAA;EACb,OAAA,CAAQ,IAAA,EAAM,cAAA,GAAiB,OAAA;EAC/B,MAAA,mDACE,SAAA,EAAW,aAAA,CAAc,WAAA,EAAa,QAAA,GACtC,OAAA,GAAU,QAAA,GACT,gBAAA,GAAmB,WAAA;EACtB,OAAA,IAAW,OAAA;AAAA;AAAA,cAGA,UAAA,GACX,OAAA,EAAS,iBAAA,EACT,cAAA,GAAgB,sBAAA,KACf,OAAA,CAAQ,gBAAA;;;;AHnDoB;AAC/B;;;;;cIyCa,gCAAA;;;AJzCgE;AAE7E;;;;cIgDa,+BAAA;AJ3Cb;;;;AAEqB;AAGrB;;;AALA,cIqDa,uBAAA,SAAgC,KAAK;EAAA,SACvC,IAAA;EAAA,SACA,OAAA;cAGP,IAAA,UACA,OAAA,UACA,OAAA;IAAW,OAAA;IAAmB,KAAA;EAAA;AAAA;;;;;;;;cAyBrB,0BAAA,SAAmC,KAAK;EAAA,SAC1C,qBAAA;EAAA,SACA,qBAAA;cAEG,qBAAA,UAA+B,qBAAA;AAAA;;;cC/FhC,wBAAA;AAAA,cAGA,mBAAA,SAA4B,KAAK;EAAA,SACnC,IAAA;EAAA,SACA,MAAA;cAEG,MAAA,UAAgB,QAAA,GAAU,MAAA,CAAO,QAAA;AAAA;AAAA,cAOlC,2BAAA,SAAoC,KAAK;EAAA,SAC3C,IAAA;EAAA,SACA,OAAA;cAEG,OAAA,UAAiB,QAAA,GAAU,MAAA,CAAO,QAAA;AAAA;;cAQnC,eAAA,GACX,IAAA,WACA,QAAA,GAAU,MAAA,CAAO,QAAA,KAChB,OAAO"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/native-extension-artifact.ts","../src/client.ts","../src/local-broker.ts","../src/transport-supervision.ts","../src/menu-input.ts","../src/sdk.ts","../src/app-icon.ts"],"mappings":";;;;KAcY,mBAAA;AAAA,KACA,qBAAA,MAA2B,MAAA,CAAO,QAAA,IAAY,mBAAmB;AAAA,UAE5D,4BAAA;EACf,WAAA;EACA,WAAW;AAAA;AAAA,UAGI,6BAAA;EACf,cAAA;EACA,mBAAmB;AAAA;AAAA,UAGJ,8BAAA,SACP,6BAAA;EACR,IAAA;EACA,OAAA,EAAS,OAAA,CAAQ,MAAA,CAAO,qBAAA,EAAuB,4BAAA;AAAA;;UAIhC,6BAAA;EACf,WAAW;AAAA;;;;AAhBA;AAGb;;;;cAwBa,uCAAA;AAnBb;AAAA,KA2BY,mCAAA,WACF,uCAAuC;;;;;;;;;;UAWhC,+BAAA,SACP,6BAAA;EACR,IAAA;EACA,OAAA,EAAS,MAAA,CACP,mCAAA,EACA,6BAAA;AAAA;AAAA,UAIM,+BAAA;EACR,IAAA;EACA,IAAI;AAAA;AAAA,KAGM,2BAAA,GAA8B,+BAAA;EAGlC,gBAAA,EAAkB,+BAAA;EAClB,cAAA;AAAA;EAGA,gBAAA;EACA,cAAA,EAAgB,6BAAA;AAAA;AAAA,KAIZ,uBAAA,GACR,8BAAA,GACA,2BAAA,GACA,+BAAA;AAAA,KAEQ,+BAAA,GAAkC,2BAAyB;AAAA,UAEtD,+BAAA;EACf,IAAA;EACA,WAAA;EACA,cAAA;EACA,gBAAA,EAAkB,+BAAA;EAClB,MAAA,EAAQ,qBAAqB;AAAA;AAAA,cAGlB,sCAAA,SAA+C,KAAA;EAAA,SAO/C,MAAA,EAAQ,qBAAA;EAAA,SANV,IAAA;EAAA,SACA,WAAA;EAAA,SACA,oBAAA;cAGP,OAAA,UACS,MAAA,EAAQ,qBAAA,EACjB,OAAA,GAAS,YAAA;IACP,WAAA;IACA,oBAAA;EAAA;AAAA;;;;;;KAmBM,kCAAA;AA/DX;AAAA,cAsEY,qCAAA,EAAuC,MAAM,CACxD,kCAAA;AAAA,cASW,oCAAA,SAA6C,KAAA;EAAA,SAC/C,MAAA,EAAQ,kCAAA;EAAA,SACR,IAAA;EAAA,SACA,MAAA,EAAQ,qBAAA;EAAA,SACR,oBAAA;cAGP,MAAA,EAAQ,kCAAA,EACR,OAAA,UACA,OAAA,EAAS,YAAA;IACP,MAAA,EAAQ,qBAAA;IACR,oBAAA;EAAA;AAAA;;cAeO,8BAAA,GACX,QAAA,EAAU,uBAAA,EACV,QAAA,GAAU,MAAA,CAAO,QAAA,EACjB,IAAA,cACC,OAAA,CAAQ,+BAAA;;cAuFE,8BAAA;;;;;AAhQb;;;;AAA+B;AAC/B;UCuBiB,uBAAA;;EAEf,UAAU;AAAA;AAAA,UAGK,iBAAA;EACf,OAAA,CAAQ,KAAA,EAAO,oBAAA,EAAoB,OAAA,GAAU,uBAAA,GAA0B,OAAA,CAAQ,aAAA;AAAA;AD7BJ;AAE7E;;;;AAEa;AAGb;;AAP6E,cCwChE,4BAAA;AAAA,cACA,yBAAA;AAAA,cACA,0BAAA;AD9Bb;;;;;;;;;;AAAA,cC0Ca,qBAAA,SAA8B,KAAA;EAAA,SAChC,SAAA,EAAW,SAAA;EAAA,SACX,UAAA;cAEG,SAAA,EAAW,SAAA,EAAW,UAAA;AAAA;AAAA,KAQxB,kBAAA,GAAqB,OAAO,CACtC,aAAA;EACE,IAAA;AAAA;ADrDyE;AAI7E;;;;AACa;AAWb;;AAhB6E,KCgEjE,cAAA;;AD3CF;AAGV;;;;UCgDiB,uBAAA;EAAA,SACN,UAAA;EAAA,SACA,SAAS;AAAA;AAAA,UAGH,mBAAA;EACf,OAAA,CAAQ,QAAA,GAAW,KAAA,EAAO,kBAAkB;AAAA;AAAA,UAG7B,kBAAA,SACP,iBAAA,EACN,mBAAmB;AAAA,UAEN,cAAA;EACf,UAAA,CAAW,OAAA,EAAS,aAAA,GAAc,OAAA,CAAQ,UAAA;AAAA;;;;;;AD7CX;AAEhC;KCqDW,sBAAA;EACN,IAAA;EAAmB,MAAA,EAAQ,mBAAA;AAAA;EAC3B,IAAA;EAAkB,WAAA;EAAqB,KAAA,EAAO,MAAM;AAAA;;;;;;;;cAS7C,iBAAA,SAA0B,KAAK;EAAA,SACjC,IAAA;EAAA,SACA,OAAA;cAGP,IAAA,UACA,OAAA,UACA,OAAA;IAAW,OAAA;IAAmB,KAAA;EAAA;AAAA;AAAA,UAWjB,sBAAA,SAA+B,cAAA;EAC9C,UAAA,CAAW,OAAA,EAAS,aAAA,GAAc,OAAA,CAAQ,kBAAA;AAAA;AAAA,UAG3B,UAAA;EACf,MAAA,EAAQ,QAAA;EACR,GAAA,EAAK,SAAA;EACL,SAAA,IAAa,OAAA,CAAQ,kBAAA;EACrB,OAAA,CAAQ,IAAA,EAAM,MAAA,GAAO,OAAA;EACrB,UAAA,CAAW,OAAA,EAAS,SAAA,GAAU,OAAA;EAC9B,OAAA,CAAQ,IAAA,EAAM,MAAA,GAAO,OAAA;EACrB,aAAA,CAAc,OAAA,EAAS,oBAAA,GAAuB,OAAA;EAC9C,gBAAA,CAAiB,GAAA,UAAa,IAAA,WAAe,WAAA,GAAc,uBAAA,GAA0B,OAAA;EACrF,gBAAA,mBACE,GAAA,UACA,IAAA,WACA,WAAA,GAAc,uBAAA,GACb,OAAA,CAAQ,sBAAA,CAAuB,MAAA;EAClC,MAAA,mDACE,SAAA,EAAW,aAAA,CAAc,WAAA,EAAa,QAAA,GACtC,OAAA,GAAU,QAAA,GACT,UAAA,GAAa,WAAA;EAChB,OAAA,IAAW,OAAA;AAAA;AAAA,UAGI,SAAA;EAAA,SACN,KAAA;EACT,OAAA,IAAW,OAAA;EACX,OAAA,CAAQ,IAAA,WAAe,OAAA;EACvB,UAAA,IAAc,OAAA,CAAQ,SAAA;EACtB,iBAAA,IAAqB,OAAA;EACrB,UAAA,CAAW,aAAA,EAAe,SAAA,mBAA0B,OAAA;AAAA;AAAA,KAG1C,eAAA,GAAkB,OAAO,CAAC,WAAA;EAAa,IAAA;AAAA;AAAA,KACvC,aAAA,GAAgB,eAAe;AAAA,KAC/B,eAAA,gBAA+B,aAAA,IAAiB,OAAA,CAC1D,eAAA;EACE,IAAA,EAAM,MAAA;AAAA;AAAA,UAGO,kBAAA,SAA2B,UAAA;EAC1C,MAAA,mDACE,SAAA,EAAW,aAAA,CAAc,WAAA,EAAa,QAAA,GACtC,OAAA,GAAU,QAAA,GACT,kBAAA,GAAqB,WAAA;EACxB,eAAA,kBACE,GAAA,UACA,OAAA,GAAU,KAAA,EAAO,mBAAA,CAAkB,KAAA;EAErC,MAAA,gBAAsB,aAAA,EACpB,KAAA,EAAO,MAAA,EACP,OAAA,GAAU,KAAA,EAAO,eAAA,CAAgB,MAAA;EAEnC,WAAA,CACE,OAAA,GAAU,KAAA,EAAO,eAAA;EAEnB,WAAA,CACE,OAAA,GAAU,KAAA,EAAO,eAAA;EAEnB,iBAAA,CACE,OAAA,GAAU,KAAA,EAAO,eAAA;EAEnB,oBAAA,CACE,OAAA,GAAU,KAAA,EAAO,OAAA,CAAQ,UAAA;IAAY,IAAA;EAAA;ED/G9B;;;;;;;ECwHT,gBAAA,EAAkB,OAAA,GAAU,KAAA,EAAO,KAAA;EDhH/B;;;;AAEI;AAkBV;;ECoGE,sBAAA,EAAwB,OAAA,GAAU,KAAA,EAAO,cAAA;EDpGG;AAAA;AAO9C;;;;AACoC;ECoGlC,wBAAA,EACE,OAAA,GAAU,OAAA,EAAS,uBAAA,KAA4B,OAAA;AAAA;AAAA,UAIlC,oBAAA;EACf,IAAA;EACA,QAAA,EAAU,uBAAuB;EACjC,OAAA;AAAA;AAAA,UAGe,sBAAA;EACf,IAAA;EACA,QAAA,GAAW,uBAAuB;EAClC,OAAA;AAAA;AAAA,UAGe,oBAAA;EAAA,SACN,KAAA;EAAA,SACA,MAAA,EAAQ,QAAA;ED3GR;;;;;;;EAAA,SCmHA,SAAA;EAAA,SACA,IAAA;EAAA,SACA,QAAA,EAAU,uBAAA;EAAA,SACV,OAAA;EACT,YAAA,IAAgB,OAAA;EAChB,OAAA,CAAQ,IAAA,WAAe,WAAA,GAAc,uBAAA,GAA0B,OAAA;EAC/D,OAAA,mBAA0B,IAAA,WAAe,WAAA,GAAc,uBAAA,GAA0B,OAAA,CAAQ,sBAAA,CAAuB,MAAA;AAAA;AAAA,UAGjG,aAAA;EAAA,SAIN,IAAA;EAAA,SACA,QAAA,EAAU,uBAAA;EACnB,YAAA,EAAc,OAAA,EAAS,QAAA,eAAuB,sBAAA;EAC9C,MAAA,CACE,IAAA,EAAM,UAAA,EACN,OAAA,EAAS,oBAAA,EACT,OAAA,EAAS,QAAA,eACR,WAAA;AAAA;AAAA,cAGQ,eAAA,GAAmB,aAAA,aAAwB,aAItD;AAAA,UAEe,mBAAA;EACf,eAAA;EACA,UAAA;IACE,IAAA;IACA,OAAA,GAAU,SAAO;EAAA;AAAA;AAAA,iBAIL,YAAA,CACd,SAAA,EAAW,kBAAA,EACX,OAAA,GAAU,mBAAA,GACT,sBAAA;AAAA,iBACa,YAAA,CACd,SAAA,EAAW,iBAAA,EACX,OAAA,GAAU,mBAAA,GACT,cAAA;AAAA,iBAoDa,gBAAA,CACd,SAAA,EAAW,kBAAA,EACX,KAAA,UACA,MAAA,EAAQ,QAAA,EACR,aAAA,SAAsB,SAAA,GACrB,kBAAA;AAAA,iBACa,gBAAA,CACd,SAAA,EAAW,iBAAA,EACX,KAAA,UACA,MAAA,EAAQ,QAAA,EACR,aAAA,SAAsB,SAAA,GACrB,UAAA;;;KCxUS,sBAAA,GAAyB,OAAO,CAC1C,aAAA;EACE,IAAA;AAAA;;AFtC2B;AAC/B;;;;;cE+Ca,gCAAA;;;AF/CgE;AAE7E;;;;cEsDa,+BAAA;AFjDb;;;;AAEqB;AAGrB;;;AALA,cE2Da,uBAAA,SAAgC,KAAK;EAAA,SACvC,IAAA;EAAA,SACA,OAAA;cAGP,IAAA,UACA,OAAA,UACA,OAAA;IAAW,OAAA;IAAmB,KAAA;EAAA;AAAA;;;;;;;;cAgCrB,0BAAA,SAAmC,KAAK;EAAA,SAC1C,qBAAA;EAAA,SACA,qBAAA;cAEG,qBAAA,UAA+B,qBAAA;AAAA;AAAA,UAU5B,iBAAA,SAA0B,iBAAA;EAAA,SAChC,QAAA;EAAA,SACA,WAAA;EAAA,SACA,SAAA;EFtFD;AAAA;AAGV;;;EAHU,SE4FC,cAAA;EFxFsC;AAWjD;;;;EEmFE,gBAAA,CAAiB,QAAA,GAAW,KAAA,EAAO,KAAA;EFhF1B;;;;;;EEuFT,gBAAA,CAAiB,QAAA,GAAW,MAAA,EAAQ,uBAAA;EACpC,OAAA,CAAQ,QAAA,GAAW,KAAA,EAAO,sBAAA;EAC1B,KAAA,IAAS,OAAA;AAAA;;UAIM,uBAAA;EAAA,SACN,SAAA,EAAW,SAAS;EAAA,SACpB,UAAA;AAAA;;;;;;AF5IU;AAGrB;;;cGgDa,uBAAA,SAAgC,KAAK;EAAA,SACvC,IAAA;EAAA,SACA,OAAA;IAAA,SAAoB,UAAA;IAAA,SAA6B,QAAA;EAAA;cAE9C,UAAA,UAAoB,QAAA;AAAA;;;;;;UAcjB,wBAAA;EH/D4D;AAAA;AAI7E;;;EGiEE,OAAA;EHhEW;EGkEX,WAAA;EHlDQ;EGoDR,QAAA;EHpDQ;EGsDR,UAAA;EHnDU;EGqDV,aAAA;;EAEA,YAAA;EHtD+C;AAWjD;;;;EGiDE,gBAAA;EH9CS;;;;;;EGqDT,UAAA,gBAA0B,OAAO;AAAA;;UAIlB,gCAAA;EHvDgB;AAAA;AAEhC;;;;EG4DC,OAAA,IAAW,OAAA,CAAQ,iBAAA;EHrDT;EGuDV,mBAAA;;EAEA,eAAA;EHtDwB;EGwDxB,yBAAA;EHnDmD;EGqDnD,QAAA,GAAW,wBAAA;AAAA;;;;;;;;cA2FA,+BAAA;EAAA,iBAyCQ,cAAA;EAAA,iBAxCF,mBAAA;EAAA,iBACA,eAAA;EAAA,iBACA,yBAAA;EAAA,iBACA,eAAA;EAAA,iBACA,WAAA;EAAA,iBACA,gBAAA;EAAA,iBACA,UAAA;EAAA,iBACA,aAAA;EAAA,iBACA,YAAA;EAAA,iBACA,gBAAA;EAAA,iBACA,UAAA;EAAA,QAET,UAAA;EAAA,QACA,UAAA;EAAA,QACA,KAAA;EAAA,QACA,OAAA;EAAA,iBACS,cAAA;EAAA,iBACA,aAAA;EAAA,iBACA,cAAA;EAAA,iBACA,gBAAA;EAAA,QAGT,gBAAA;EAAA,QACA,cAAA;EAAA,QACA,gBAAA;EAAA,QACA,iBAAA;EAAA,QACA,4BAAA;EAAA,QACA,aAAA;EAAA,QACA,iBAAA;EAAA,QACA,eAAA;EH9JA;;AAAqB;AAG/B;;;EAHU,QGqKA,aAAA;EAAA,QACA,eAAA;cAGW,cAAA,QAAsB,OAAA,CAAQ,iBAAA,GAC/C,OAAA,EAAS,gCAAA;EHvK+C;EAAA,IGyLtD,cAAA,IAAkB,cAAA;EHzLyC;EAAA,IG8L3D,mBAAA;EHvLO;EAAA,IG4LP,QAAA;EHlMK;EAAA,IGuML,WAAA;EHrMK;;;;;EAAA,IG8ML,SAAA;EHxMA;EAAA,IG6MA,cAAA;EH9MF;;AAGM;AAkBV;;EGkMQ,OAAA,IAAW,OAAA;EHlM2B;AAAA;AAO9C;;;;AACoC;AASpC;EGkMQ,OAAA,CACJ,KAAA,EAAO,oBAAA,EACP,OAAA,GAAS,uBAAA,GACR,OAAA,CAAQ,aAAA;;;;;EA6BX,OAAA,CAAQ,QAAA,GAAW,KAAA,EAAO,kBAAA;EHxNd;;;;;EGoOZ,gBAAA,CAAiB,QAAA,GAAW,KAAA,EAAO,KAAA;EH7OlB;;;;;EGyPjB,sBAAA,CAAuB,QAAA,GAAW,KAAA,EAAO,cAAA;EHnP/B;;;;;;;EGiQV,wBAAA,CACE,OAAA,GAAU,OAAA,EAAS,uBAAA,KAA4B,OAAA;EH7P9C;AAAA;AAcL;;;;;;;EG6PQ,QAAA,IAAY,OAAA;EHzPV;EG0QR,KAAA,IAAS,OAAA;EAAA,QAID,cAAA;EAAA,QAWA,aAAA;EH3RS;;;;;;AAEuB;AAuF1C;;;EAzFmB,QG4SH,aAAA;EAAA,QAmDN,wBAAA;;;;AF9eV;;;UEyfU,cAAA;EFvfE;AAGZ;;;;;EAHY,QEujBF,qBAAA;EFnjB+D;;;;;EAAA,QEilBzD,oBAAA;EFjlB+B;;;;;AAA6C;AAW5F;;;;EAX+C,QEgnB/B,WAAA;EFpmBH;;;;AAAyB;EAAzB,QE8oBG,iBAAA;EAAA,QAoCN,kBAAA;;;AFjrB6B;AAYvC;;UEirBU,oBAAA;EFhrBY;;;;;;;;;;EAAA,QEssBN,eAAA;EFnsBF;;;AAAwC;AAQtD;;;EARc,QEwuBJ,gBAAA;EFhuBuB;;;;AAEzB;AAWR;;EAbiC,QEmvBjB,aAAA;EAAA,QAoGN,QAAA;EAAA,QAkBA,kBAAA;EFp1BO;;;;AAEG;EAFH,QEw6BP,aAAA;EAAA,QAgBA,gBAAA;AAAA;;cAwCG,yBAAA,GACX,OAAA,EAAS,gCAAA,KACR,+BAC4D;;;KCrkCnD,0BAAA,IACV,KAAmC,EAA5B,eAAe;;KAIZ,cAAA;EACV,KAAA,EAAO,kBAAkB;AAAA;;KAIf,kBAAA,sBAEE,KAAA,UAAe,KAAA,WAAgB,kBAAA,MACzC,cAAA,GACA,mBAAA,GACA,mBAAA,GACA,uBAAA,GACA,qBAAA;AAAA,KAEQ,cAAA;EACV,IAAA;EACA,EAAA,GAAK,YAAA;EACL,KAAA;EACA,YAAA;EACA,OAAA;EACA,QAAA;EACA,WAAA,GAAc,0BAA0B;AAAA;AAAA,KAG9B,mBAAA;EACV,IAAA;EACA,EAAA,GAAK,YAAA;EACL,KAAA;EACA,OAAA;EACA,OAAA;EACA,WAAA,GAAc,0BAA0B;AAAA;AAAA,KAG9B,mBAAA;EACV,IAAA;EACA,EAAA,GAAK,YAAA;EACL,KAAA;EACA,OAAA;EACA,OAAA;EACA,KAAA;EACA,WAAA,GAAc,0BAA0B;AAAA;AAAA,KAG9B,uBAAA;EACV,IAAI;AAAA;AAAA,KAGM,qBAAA;EACV,IAAA;EACA,KAAA;EACA,OAAA;EACA,KAAA,WAAgB,kBAAkB;AAAA;;;UC5BnB,sBAAA;EACf,QAAA;EACA,OAAA;EACA,cAAA;EACA,eAAA;EACA,aAAA;EACA,KAAA;EACA,OAAA;EACA,OAAA,GAAU,SAAA;EACV,SAAA,GAAY,0BAAA;EL1B4C;EK4BxD,SAAA,GAAY,0BAAA;EACZ,SAAA;EL3Be;;;;AAEJ;AAGb;;;EK+BE,QAAA,GAAW,wBAAA;AAAA;AL1Bb;AAAA,UK8BiB,iBAAA;EACf,EAAA;EACA,OAAA,GAAU,SAAA;EACV,IAAA,GAAO,MAAA;EACP,IAAA,GAAO,cAAA;AAAA;;UAIQ,gBAAA,SACP,IAAA,CAAK,kBAAA;EACb,OAAA,CAAQ,IAAA,EAAM,cAAA,GAAiB,OAAA;EAC/B,MAAA,mDACE,SAAA,EAAW,aAAA,CAAc,WAAA,EAAa,QAAA,GACtC,OAAA,GAAU,QAAA,GACT,gBAAA,GAAmB,WAAA;EACtB,OAAA,IAAW,OAAA;AAAA;AAAA,cAGA,UAAA,GACX,OAAA,EAAS,iBAAA,EACT,cAAA,GAAgB,sBAAA,KACf,OAAA,CAAQ,gBAAA;;;cC9DE,wBAAA;AAAA,cAGA,mBAAA,SAA4B,KAAK;EAAA,SACnC,IAAA;EAAA,SACA,MAAA;cAEG,MAAA,UAAgB,QAAA,GAAU,MAAA,CAAO,QAAA;AAAA;AAAA,cAOlC,2BAAA,SAAoC,KAAK;EAAA,SAC3C,IAAA;EAAA,SACA,OAAA;cAEG,OAAA,UAAiB,QAAA,GAAU,MAAA,CAAO,QAAA;AAAA;;cAQnC,eAAA,GACX,IAAA,WACA,QAAA,GAAU,MAAA,CAAO,QAAA,KAChB,OAAO"}