- Make app.json the default manifest with a published versioned schema.
- Add registered-image source cropping and harden installed TypeScript toolchain resolution.
- Synchronize v0.9.5 package metadata and release notes.
* feat(schema): redirect non-schema paths to native-sdk.dev
- schema.native-sdk.dev now serves only /app/v1.json and its /app.json alias
- Every other path catches and redirects (302) to https://native-sdk.dev
- Update pinned docs check and schema README to match the new routing
* fix(schema): redirect non-schema paths
- Resolve scriptc through npm package resolution so nested, hoisted, and global sibling installs work.
- Generate a complete SQLite SDK module family and validate library imports against their actual directory.
- Cover global compiler lookup, documented event imports, and generated-core loading with regressions.
- Synchronize CLI, core, platform package, and example versions to 0.9.4.
- Add release notes for model-driven window restore policies and iterative rebuild improvements.
- Document the ScriptC 0.0.33 and Node 24 toolchain update.
* chore(core): upgrade scriptc to 0.0.33
- Pin scriptc 0.0.33 across Native packages and refresh compiler surface and calibration artifacts.
- Require Node 24 and route check/build tooling through scriptc's published compile-cache bootstrap.
- Enable and verify dev/release library profiles with synchronized docs, tests, and package mirrors.
* fix(ci): use Node 24 for TypeScript builds
* fix(build): keep iterative app rebuilds local
- Stabilize generated core and service ABI artifacts by content so implementation-only service edits never rebuild the app core.
- Split primary markup and app code into independently cached objects, reducing warm markup rebuilds to data compilation plus linking.
- Add rebuild explanations, phase timing/RSS summaries, and forward-compatible scriptc dev profiles through its published binary.
* fix(build): launch ScriptC correctly on Windows
* fix(build): address PR review findings
* fix(build): preserve cached app link inputs
* fix(build): invalidate cores on SDK module edits
* feat(windows): expose model restore policy
- Forward restore policy from model-declared windows into platform options.
- Expose matching TypeScript types, defaults, validation, and documentation.
- Cover fresh center-on-primary windows through the null platform.
* docs(windows): clarify restore policy support
* feat: add model-driven theme state
- Add the TypeScript themeState helper across checker, generated ABI, and UiApp runtime.
- Preserve system accessibility behavior while supporting model pack, scheme, and accent precedence.
- Document the API and migrate gpu-components with runtime and replay coverage.
Co-authored-by: MohakBajaj <77928693+MohakBajaj@users.noreply.github.com>
* fix: constrain theme state optional fields
---------
Co-authored-by: MohakBajaj <77928693+MohakBajaj@users.noreply.github.com>
- Render span underlines only when explicitly enabled.
- Preserve conventional underlines for Markdown-generated links.
- Cover linked spans with and without underline decoration.
Co-authored-by: Sepehr Safari <25853688+sepehr-safari@users.noreply.github.com>
* Implement logical canvas radio groups
- Scope nested radios as one roving-focus, single-selection group.
- Align radio keyboard, pointer, and handler dispatch behavior.
- Expose radiogroup accessibility semantics and document the contract.
* Fix radio group accessibility edge cases
* Fix radio group focus traversal edge cases
* Fix radio group keyboard and naming semantics
* fix: preserve radio selection semantics
* Add configurable accessory startup
- Add manifest, runner, and macOS host support for flash-free Accessory startup.\n- Require a tray affordance and cover launch/runtime composition with tests.\n- Update the TypeScript menu-bar example and lifecycle documentation.
* Fix flash-free accessory startup
* Enforce tray requirement when packaging accessories
- Upgrade Native SDK compiler dependencies and generated references to scriptc 0.0.31.
- Add a real compiled-core ABI regression for bare-model and effect-tuple returns.
- Centralize test pin lookup and remove release numbers from comments and prose.
Co-authored-by: John Lindquist <36073+johnlindquist@users.noreply.github.com>
* feat(examples): make the feed reader the end-to-end services showcase
* fix(examples): contain feed results in scroll pane
* fix(core): preserve service facade unbound metadata
* feat(files): add delete file effects
- Expose Cmd.deleteFile as the primary TypeScript API with checked routing and documentation.
- Add real, fake, permission, journal, and replay support through the shared file-effect engine.
- Cover compiled cores across macOS, Linux, and Windows, including reliable Windows append behavior.
* fix(files): await Windows append completion
* fix(files): preserve final symlink on delete
* feat(mobile): compile TypeScript cores and services for mobile targets
The external core and service compile drivers admit the pinned
compiler's three mobile triples — aarch64 iOS device and simulator
(macOS build host, iOS 15.0 floor) and aarch64 Android (any desktop
host, API 26 floor) — as library archives only, mapping the build
graph's Zig triples onto the compiler's own spellings and threading
the Android NDK location the way the graph already threads its zig.
The service executable lane refuses mobile targets with the
in-process pointer: no child process exists there, so the carrier
resolution turns "auto" into the in-process pool on iOS/Android and
teaches on an explicit "child", while desktop behavior is unchanged.
Mobile app builds stage a generated mobile entry beside the desktop
wiring: it satisfies the embed host's AppDef contract over the same
mirror, markup, and registry, drives the canonical mobile scene plus
the manifest's declared chrome, owns the service pool (markers and
stream relays live in the shim-installed app-data directory), and
delivers that directory through envMsgs. The compiled archives merge
into the embed static library the host tiers already link — flattened
to plain objects on Android, where Zig's ELF static-library emission
stores archive inputs as nested members the NDK link would skip.
A mobile execution lane (scripts/mobile-e2e.sh, NATIVE_SDK_MOBILE=1
in either gate tier) stages a battery over the service fixture's
compiled core and service archives, packages the fixture app for both
mobile targets and a services-free example for Android, then executes
the battery on a booted iPhone simulator and a headless arm64
emulator: typed pool results across update round trips, trap
isolation poisoning exactly one instance, and a journal replay that
reproduces the recorded model without initializing the archive. All
checks pass on both device classes. The TypeScript and services
chapters and the ts-core/ts-services skills state the mobile matrix;
persistence, boot images, and URL media caching remain unwired on
mobile.
* fix mobile TypeScript app wiring
* fix(mobile): validate TypeScript package outputs
- Expose UiApp.WindowDescriptor.close_policy and forward it through window creation.
- Preserve hide/reopen identity while retaining existing platform safety gates.
- Document and test quit, hide, and unsupported-host lifecycle behavior.
* feat: add actionable notifications
- Add stable replacement identifiers and paired notification actions across SDK APIs.
- Dispatch activations through the normal command path on macOS, Windows, and Linux.
- Advance the TypeScript wire generation and cover validation, test platforms, and docs.
* fix: secure notification action dispatch
Every NS rule in the diagnostics catalogue carries class: "guarantee" |
"deferred". Guarantee rules protect a core invariant (determinism and
replay, fixed shapes, immutability of shared data, the one text
representation) and are permanent; deferred rules (NS1011, NS1019,
NS1040, NS1042, NS1044) wait on an easing decision and their
diagnostics say the capability is deliberately deferred, not
impossible.
Fix text names the concrete service alternative where one exists:
NS1002 (network via the generated client), NS1005 (clock reads),
NS1011 (Map/Set transforms), NS1040 (regex matching), NS1041 (JSON
parsing returning a typed record).
Docs and skills frame the core and services by role: the core is the
app's deterministic logic; services do the app's imperative work.
- Pin scriptc and its compiler/runtime lock data to 0.0.29.
- Refresh service contracts, compatibility fixtures, calibration, and documentation.
- Regenerate the service compile-surface reference; the 0.0.29 surface manifest carries no entry changes from 0.0.28 and adds a coverage statement for the mobile library targets (aarch64-apple-ios, aarch64-apple-ios-simulator, aarch64-linux-android).
- Add keyed status-item lifecycle and independent live updates across the runtime and macOS hosts.
- Expose model-driven TypeScript and Zig collection APIs with status-item-aware events.
- Extend automation, journaling, documentation, and regression coverage.
- Add complete v0.9.0 release notes and contributor credits.
- Synchronize CLI, core, platform, tool, and example version pins.
- Discover every TypeScript example during version synchronization.
The external core compile driver now enforces the same host/target
pairing matrix as the service compile lane: same-triple compiles keep
the native lane, Linux and Windows GNU targets cross-compile from any
macOS/Linux/Windows build host over the compiler's zig-cc lane, macOS
targets need a macOS build host, and every refused pairing teaches
before compiler work starts. The co-emitted contract sidecar is
target-independent: a macOS-native, x86_64-windows-gnu, and
x86_64-linux-musl compile of one staged tree emit byte-identical
documents with identical integer-class decisions, and the COFF and ELF
archives declare the same nsc_core_* symbol surface as the Mach-O one.
The SDK's fixture graph compiles corewire for the build host, so the
battery lanes configure under a cross -Dtarget, and a new
stage-cross-e2e step installs the host-fixture, markup, and in-process
service pool batteries under <prefix>/e2e for execution on the target
machine. scripts/cross-e2e.sh drives the lane end to end: it
cross-builds the batteries, the kanban example, and the service fixture
app (in-process carrier — the core and service archives linked into one
executable, with no defined-symbol overlap between the localized
service archive and the core's contract surface) for x86_64-windows-gnu
and x86_64-linux-musl, then executes the batteries on the Windows box
over ssh and in an amd64 Alpine container. gate.sh runs the lane in
either tier when NATIVE_SDK_CROSS=1 is set and skips it otherwise.
All three batteries pass on both targets: 29 host-fixture, 10 markup,
and 19 in-process pool tests on Windows (the three posix-spawn tests
skip there), and 32/10/19 in the musl container. The TypeScript chapter
and ts-core skill state the supported build matrix, including the Linux
glibc spelling and the unchanged desktop-only scope for mobile.
* feat(services): extend the in-process carrier opt-in to Windows and cross targets
scriptc 0.0.28 localizes archive runtime symbols format-aware (ELF,
COFF, Mach-O) on every desktop host and for cross targets, so the
explicit `.service_carrier = "in_process"` opt-in no longer needs the
host-native macOS/Linux gate. Carrier resolution and the SDK fixture
lane's archive gate now admit the compiler's build matrix: Linux and
Windows targets from any macOS/Linux/Windows build host, and macOS
targets from a macOS host. Auto still resolves to the isolated child
carrier everywhere, and child stays selectable on every shape.
The service compile lane replaces its build-host-only refusal with the
same matrix. Same-triple compiles keep the native lane; admitted cross
pairings run the compiler's zig-cc lane (SCRIPTC_CC=zigcc,
SCRIPTC_TARGET=<triple>, and the build's own zig at the front of PATH
through the new --zig-exe argument); refused pairings keep a precise
teaching. The child executable's name follows the target OS instead of
the host's.
Cross Linux targets carry one encoded caveat: a bare `-gnu` spelling
lands on Zig's default glibc floor, which predates arc4random_buf — a
symbol the compiled service runtime references — so carrier resolution
teaches the `-gnu.2.36`+ (or `-musl`) spelling at configure time, and a
stated glibc version now rides the platform triple into the compile.
Windows targets link ws2_32, iphlpapi, and advapi32 beside the compiled
archives: the fixture modules get a shared helper, and the app lane's
Windows platform block adds advapi32 for the archive's CSPRNG.
Both carrier e2e suites pass natively on Windows (14 child-carrier
tests, 19 in-process pool tests: parallel keys, per-key FIFO,
cooperative cancellation and deadlines, trap isolation, streaming, and
replay), a macOS-built x86_64-windows-gnu service archive links and
initializes on Windows, and the linux-musl child executable and archive
cross-compile from macOS. The docs services chapter, packages page, and
ts-services skill state the widened opt-in and the cross-target scope.
* fix(services): align cross-target ScriptC archives
* fix(services): gate in-process archive architectures
* fix(build): keep ScriptC floor checks step-local
* fix(services): tighten cross-target toolchain gates
/docs returned 404 while every page beneath it resolved and every legacy
URL form already redirected into /docs/*. docsSlugs() only yields nested
slugs, so the /docs segment itself had neither a route nor a generated
redirect, and /docs/ compounded it by 308ing into that dead end.
/docs is the parent of every documentation link on the site and the
likeliest hand-typed entry point, so open it on the Introduction. The
.md sibling keeps the Markdown surface whole for agents that reach for
it, matching the pairing legacyDocsRedirects applies to every slug.
Fixes#331
Co-authored-by: Cris <cristian.correa.cs@gmail.com>
* Upgrade scriptc to 0.0.28
- Pin scriptc and its compiler/runtime lock data to 0.0.28.
- Refresh service contracts, compatibility fixtures, calibration, and documentation.
- Regenerate the service compile-surface reference; the 0.0.28 surface manifest carries no entry changes from 0.0.27.
* docs: state the carrier default correctly on the packages page
* feat(services): add the in-process TypeScript service carrier
Compile src/services into a thread-instanced, runtime-localized library
archive (scriptc 0.0.27 library mode) linked into the app binary, and run
it on a small worker-thread pool: one archive instance per pool thread,
same-key requests strictly FIFO, distinct keys in parallel across
instances. The carrier preserves the child-process seam exactly — the
same HostCallBinding, poll-based completion delivery, journaled results,
lazy start, and replay that never initializes the archive.
Cancellation and deadlines ride the same cooperative marker-file token
the child publishes, with the same grace; an operation that ignores its
token is abandoned (thread detached, timeout routed, pool refilled), and
a detected trap routes kind service_trap through the per-instance panic
sink while other instances keep answering. Streaming chunks relay live
through a per-request framed file the pool's supervisor thread tails, so
chunks keep preceding the typed terminal mid-operation.
In-process is the default carrier on host-native macOS/Linux builds;
app.zon .service_carrier (and -Dservice-carrier) select explicitly, with
.service_pool_size (-Dservice-pool-size) setting the pool width (default
min(4, cores)). Windows and cross builds keep the child carrier.
corewire grows the two in-process projections (library facade entry and
compiler profile), the service compile script grows an --out-archive
lane, and bench-service-host now measures both carriers. The new pool
e2e suite covers success/throw routing, duplicate and unkeyed keys,
live streaming with cancellation, queued deadlines, parallelism,
per-key FIFO, trap isolation, the registry/archive pairing fence, and
journal replay against the pool.
* test(services): absorb runner load in the pool parallelism proof
One retry of the parallel batch keeps the timing assertion meaningful
on saturated runners; a pool that serialized distinct keys fails both
attempts deterministically.
* fix(services): harden in-process carrier supervision
* fix(services): harden pool queue scheduling
Wake the supervisor when newly admitted work can move the next deadline earlier, and scan the full queue so large busy-key bursts cannot hide runnable independent work.
* fix(services): drain streams after grace race
Let completion-owned requests remain in the supervisor stream polling path when the grace poison CAS loses, and cover the boundary with a deterministic regression.
- Pin scriptc and its compiler/runtime lock data to 0.0.27.
- Refresh service contracts, compatibility fixtures, calibration, and documentation.
- Regenerate the service compile-surface reference; the 0.0.27 surface manifest carries no entry changes from 0.0.26.
Chris Tate