* feat(tooling): gate capability claims on the compiler surface manifest
- Add surface_manifest_diff.mjs: mechanical diff of two scriptc surface
manifests keyed by stable entry ids — flips to static (with the
staging-transform/caveat retirements each flip makes due), tier
regressions, easings, added/removed entries, SC-code and semantic
note changes; human-readable and --json output.
- Add gen_service_surface.mjs: generate the author-facing service
compile-surface reference (skill-data/ts-services/references/
service-surface.md) byte-derived from the pinned compiler's manifest,
plus a --check mode that fails on a stale or hand-edited reference,
a manifest/pin version mismatch, any hand-written SC-code claim in
docs/skills/skill-data prose, or a compiler version literal that does
not match the pin.
- Wire the check into scripts/gate.sh as the surface-claims step:
fast tier when docs/, skills/, skill-data/, or packages/core/ change;
always in full.
- Point skill-data/ts-services/SKILL.md at the generated reference and
cover the tooling in packages/core/test/surface_tools.test.ts.
* fix(tooling): harden service surface checks
* fix(tooling): close service surface audit gaps
* fix(tooling): close manifest review gaps
* fix(tooling): harden surface claim auditing
* fix(tooling): keep surface audits layer-aware
Measure the out-of-process TypeScript service carrier through its
production HostCallBinding against a bytes-echo service compiled by the
production service lane (frontend contract -> corewire host/registry ->
exact-pinned plain-scriptc executable). The echo operation returns its
request unchanged, so the numbers are the carrier's — lazy child spawn,
hello fence, framing, pipes, worker-thread queueing — not a workload's.
Scenarios: cold start (fresh host, first keyed request from admission to
polled completion, including the lazy spawn), warm round trips for 64 B
and 256 KiB payloads (p50/p90/p99), and queued throughput for N keyed
requests drained through the single worker thread.
Run: zig build bench-service-host -Doptimize=ReleaseFast
(requires node and npm ci in packages/core, like the services e2e lane).
* docs: add the TypeScript Services chapter
Give TypeScript services their own documentation page covering the
two-tier split, service authority and the sanitized environment,
operation authoring and kind-tagged errors, the generated typed client
with keys/timeouts/cancellation/streaming, exact vendored npm with the
calibrated coverage results, and the runtime behavior (lazy start,
supervision, replay without the service child, desktop scope).
Condense the inline services section on the TypeScript Cores page to a
summary that links the chapter, point the packages page at the new
route, wire navigation and page titles, and correct the keyed-effect
note: service requests reject duplicate live keys rather than
replacing them.
* docs: restyle the TypeScript Services chapter as reference documentation
Rewrite the chapter in a terse reference style: noun-phrase sections,
short declarative paragraphs, code examples and tables first. All
technical content is unchanged: the two tiers, service authority and
the environment allowlist, operation rules and boundary types,
kind-tagged errors, the generated client, keys/timeouts/cancellation,
streaming, exact vendored npm with the calibration results, runtime
behavior, the dev loop, and the NS1065-NS1067 teachings.
Replace vague failure-mode wording on the cores page with the precise
outcomes: dropped requests dispatch no message, stream cancellation
routes cancelled to err, and truncated streaming fetches end with
err: truncated.
- Pin scriptc and its compiler/runtime lock data to 0.0.26.
- Refresh service contracts, compatibility fixtures, calibration, and documentation.
- Invalidate cached service frontends whenever the compiler manifest changes.
* feat(storage): add SQLite-backed record store
- add capability-shed SQLite storage with deterministic effects, replay, and atomic record operations
- expose matching TypeScript and Zig APIs across desktop and mobile hosts
- add hermetic coverage, devhost support, documentation, and a worked example
Co-authored-by: carvalab <1446654+carvalab@users.noreply.github.com>
* fix(storage): restore pristine SQLite amalgamation
- restore the upstream byte removed during whitespace cleanup so the vendored source matches its documented checksum
Co-authored-by: carvalab <1446654+carvalab@users.noreply.github.com>
* fix(storage): harden store result delivery
* fix(storage): align devhost store semantics
* fix(storage): address review findings
---------
Co-authored-by: carvalab <1446654+carvalab@users.noreply.github.com>
* Implement the TypeScript service seam
- Classify src/services as ordinary static-tier TypeScript and generate a checked service contract.
- Compile, package, and supervise a pinned out-of-process service host behind Cmd.request.
- Cover service authority, failures, restart, timeout, replay, docs, skills, and showcase fixtures.
* fix service boundary validation and staging
* fix TypeScript service packaging and validation
* fix TypeScript service review findings
* Implement model persistence
- Add atomic engine-owned snapshots with generated codecs, restore and migration routes, backup recovery, debounce, and replay support.
- Gate persistence through app manifests and native check while keeping the TypeScript, Zig, and devhost surfaces in parity.
- Add store and end-to-end coverage, documentation, and a persisted TypeScript example.
Co-authored-by: carvalab <1446654+carvalab@users.noreply.github.com>
* Address model persistence review findings
* Address remaining model persistence review findings
* Fix persistence identity and restore route checks
* fix persistence replay and rollback safety
---------
Co-authored-by: carvalab <1446654+carvalab@users.noreply.github.com>
* Improve retained desktop frame performance
1. Fix retained animation pumping and Windows frame wake scheduling.
2. Make latency and frame profiling monotonic, observable, and regression-tested.
3. Add physical-display-aware macOS and Windows performance gates.
* Fix PR performance and package checks
- Align NativeSdkViewInfo declarations with runtime GPU telemetry.
- Calibrate hosted macOS animation budgets without weakening physical-device defaults.
* Harden Windows performance sampling and shutdown
- Correlate physical hover samples with their responding visual frames.
- Stop due-frame callbacks immediately when the Windows host exits.
* Polish component gallery interactions
- Fix keyboard navigation, scrolling, and focus-visible behavior across interactive canvas widgets.
- Rebuild gpu-components as an isolated TypeScript and Native markup gallery with complete interactive specimens.
- Add live model-driven Default and Geist theme switching with validation, documentation, and smoke coverage.
* fix component gallery focus and controls
* Fix TypeScript setup for component smoke CI
- Align echoed PTY keys with the byte-text host and facade contract.
- Regenerate SDK declarations and update PTY conformance coverage.
- Compile the PTY event arm through the external-core E2E fixture.
Co-authored-by: NyxTools-M <243123737+NyxTools-M@users.noreply.github.com>
* feat(core): support streaming fetch responses
- Add a typed line-streaming Cmd.fetch overload and carry it through the command wire and runtime host.
- Keep stream lifecycle deterministic with loud cancellation and duplicate-key rejection.
- Cover the feature with contract, conformance, runtime, compiled-core, harness, example, and documentation updates.
* feat: stream AI chat through Vercel gateway
- Render chat-completion SSE deltas as they arrive.
- Pin the example to Vercel AI Gateway with official key config.
- Cover streaming, failure, and replay paths end to end.
* feat: add streaming fetch and chatbot example
* feat(chatbot): refine streaming chat experience
- Add a compact live model picker and immediate Stop action.
- Improve conversation layout, prompt focus, and caret retention.
- Expand chatbot documentation and end-to-end regression coverage.
* fix: harden streaming fetch limits
* fix: harden streaming fetch and textarea behavior
* fix(canvas): render lifted rich text
* fix(macos): smooth dialog backdrop blur
- Replace the flat box blur with an optimized three-pass Gaussian approximation.
- Preserve shadcn-compatible blur and scrim values while covering the host path with a build check.
* Fix macOS backdrop blur invalidation
- Add release notes for packaged assets, drag landing polish, and the expanded Kanban showcase.
- Synchronize CLI, core, platform package, and TypeScript example versions.
- Bump CLI, core, platform packages, and TypeScript examples to v0.8.2.
- Add complete release notes and contributors for the v0.8.2 range.
- Keep the Kanban core pin covered by release version sync and validation.
* feat(examples): make kanban an agent ticket board
- Add numbered agent tickets with OpenAI and Claude avatars from SVGL.
- Simplify the titlebar to an icon-only add action.
- Keep drag geometry and end-to-end coverage aligned.
* fix(examples): make kanban columns scrollable
* Make TypeScript the clear authoring default
- Route agents to TypeScript cores and Native markup for new apps.
- Put TypeScript examples and code first across human-facing entry points.
- Keep Zig clearly documented as an explicit alternative and extension tier.
* Clarify TypeScript authoring guidance
* docs: clarify TypeScript native UI guidance
- Synchronize CLI, core, platform, and example package versions to 0.8.1.
- Add complete release notes for Markdown HTML, image handling, and payload-free HTTP writes.
- Record release-process improvements and contributor attribution.
`runFetch` routed every request without a payload to
`std.http.Client.sendBodiless`, which asserts the method carries no
body. A POST, PUT or PATCH with no payload therefore panicked on
`unreachable` and aborted the process in Debug builds; in ReleaseFast
the assert is compiled out and the request went out with no
Content-Length at all.
Send an explicit `content-length: 0` body for those methods instead.
The regression test drives a payload-free POST through the fixture
server and asserts the request head carries `content-length: 0`.
Without the fix it terminates with SIGABRT in `sendBodilessUnflushed`.
- Synchronize SDK, core, platform, and example package versions
- Merge pending release notes into the v0.8.0 changelog
- Record release markers and contributor attribution
* feat: native check ends with the compiler-truth pass
- A TypeScript core's check now finishes by running the pinned external core compiler's analyzer over the entry with the shipped SDK declarations mapped, so the check verdict and the build verdict come from one compiler.
- Analyzer type errors fail the check with the compiler's diagnostics verbatim; an analyzer that cannot reach a verdict defers to the build instead of wedging check.
- The in-process 6.x provider remains the teachings engine, and its adapter header now states the split (the 7.x line ships no in-process API).
* fix: resolve the typecheck driver's own path portably
- fileURLToPath instead of URL.pathname, which percent-encodes spaces and mangles Windows drive paths — install locations with either broke the check pass.
* feat: add a check-only frontend mode
- The @native-sdk/core CLI without -o checks the core (and writes the contract when asked) and emits nothing.
- native check runs the frontend in check-only mode; no scratch emission under .native/check.
* feat: TypeScript cores compile through the external core compiler by default
- The transpiled lane is gone: src/core.ts builds through the external core compiler with nothing stated, and core_compiler = "transpiler" is refused with a teaching naming the release that removed it.
- Mobile targets with a TypeScript core are taught before lane selection: TS cores are desktop-only until the external toolchain grows mobile targets; Zig/markup cores stay fully supported on mobile.
* feat: retarget the TypeScript-core suites to the compiled lane
- test-ts-core-e2e compiles every fixture core through the external core compiler in the build graph (no env gating; the compiler is a package dependency), with the markup battery in its own binary — one archive per process is the C-ABI contract.
- The paired/byte-compare machinery is gone (paired_core, gen_paired, extract.zig, test-contract-equivalence, test-compiled-core-parity); the conformance suite pins mirrors over frontend contracts and committed goldens, and the new test-external-core-abi suite holds the ABI laws over a real archive.
- The soundboard core-only dispatch budget is re-measured for the compiled lane (~5.3us on an M-class laptop, Debug; the C ABI crossing plus snapshot decode) and stays pinned at 1ms.
* feat: carry the mixed pair-return idiom on the compiled lane
- The contract sidecar gains additive init_returns_bare/update_returns_bare facts, and the generated facade narrows `Model | [Model, Cmd<Msg>]` returns (a tuple carries its command; a bare model the empty buffer).
- The scaffold starter bounds its counters with literal comparisons so the compiler's integer range proof takes them.
* feat: delete the TS-to-Zig emitter
- The transpiled lane's machinery is gone: emitter.ts (11.9k lines), the rt.zig kernel, the run1k gate, and the emitter/effects/run-fidelity suites; execution truth lives in the ts-core e2e batteries over real compiled archives.
- The frontend (transpile.ts -> frontend.ts) checks and emits the contract sidecar only; the CLI refuses -o with a teaching naming the release that removed the emitter.
- The conformance corpus and grammar matrices re-adjudicate: emitter-only gates (97 corpus cases, 7 matrix rows) are marked as accepted with their former emit-time rules kept readable.
* fix: ship the compiled lane in the npm CLI payload
- copy-framework mirrors packages/core/compile-surface + scripts and tools/corewire (the build compiles corewire from the dependency); the sync and files lists follow.
- scriptc rides as a regular dependency of @native-sdk/cli, pinned equal to packages/core by check-version-sync, and the build graph resolves its entry by node's ancestor walk from packages/core.
* ci: the compiled lane rides the package dependency
- Every ts-core-building job gets the compiler with the one npm ci in packages/core; the separate compiler install, the archive/sidecar env plumbing, and the opt-in example step are gone.
- The parity job becomes Core Compiler Fences: stage-core-contracts plus the determinism-fence negative control (the positive batteries ride zig build test in the Zig Core job).
- No compiler cache action on purpose: hosted runners are ephemeral, so runs stay hermetic by machine lifecycle.
* docs: the compiled lane is the documented truth
- The TypeScript docs, quick start, component pages, example READMEs, the scaffold templates, and the ts-core skill describe the check-and-compile pipeline; the eject-story and rt-kernel/frame-cap claims are gone, and the core dev loop is stated as restart-shaped with native dev --core for fast logic iteration.
- The evals grader checks cores with the frontend and grades ts harnesses against externally compiled archives through generated mirrors.
- The changelog fragment states the breaks deliberately: default lane switch, transpiled lane removed, mobile teaching, dev-loop latency, and the compiler dependency.
* fix: ownership.ts joins the frontend staleness set
- The checker, inference, and type layers import ownership.ts, so an edit there must re-run every cached check and contract step; the staleness array now carries it.
* chore: drop the unused TypeScript compat wrapper dependency (#274)
- Nothing imports the @typescript/typescript6 wrapper at run time — the frontend loads the exactly pinned @typescript/old alias directly — so the wrapper leaves both manifests and the lockfile.
- The version-sync check pins the alias on its own, the toolchain doctrine comments describe a stray consumer-tree wrapper (which resolution still ignores, as the twins' fixtures keep proving), and the prose pins follow the reworded doctrine.
* feat: emit the contract sidecar from the frontend
- packages/core emits core.contract.json directly from checked analysis (--contract), byte-identical to the extraction path, Wyhash identities included
- every corewire consumer (conformance shims, stage-core-contracts projections) now reads the frontend document
- test-contract-equivalence pins the two producers byte-identical per ts-core fixture
* feat: ship SDK declarations and the pinned external compiler
- generate and ship sdk/*.d.ts with the real tsc (freshness-pinned, ambient-clean), never hand-written
- add the external core compiler as the package's one exact-pinned runtime dependency and bump the compiled-core pin to 0.0.22
- promote the static compile surface into the shipped package (compile-surface/core.ts), one copy for fixtures and apps
* feat: opt-in external core compiler lane
- ts-core apps opt in via app.zon .core_compiler = "external" or -Dcore-compiler=external; the frontend still checks and emits the contract, corewire projects the compile entry/profile, the exact-pinned toolchain builds the archive, and the app links the generated mirror over it
- the staged module keeps the transpiler lane's exact shape, so the generated wiring runs unchanged over either lane
- env-gated example pin: soundboard-ts builds and tests on the lane in the compiled-core parity CI job
* fix: accept an argument-carrying external compiler command
- The compile driver took --compiler as one executable filename, so an interpreter-plus-script override failed with the missing-version teaching; a path that exists is taken whole, anything else splits on whitespace.
* fix: ship the compiled lane in the npm CLI payload
- copy-framework mirrors packages/core/compile-surface + scripts and tools/corewire (the build compiles corewire from the dependency); the sync and files lists follow.
- scriptc rides as a regular dependency of @native-sdk/cli, pinned equal to packages/core by check-version-sync, and the build graph resolves its entry by node's ancestor walk from packages/core.
* Add diff annotations to code component
- Add Geist-style added and removed line annotations across the Zig and markup APIs.
- Preserve diff rendering through layout, editing, scrolling, and retained invalidation with focused tests.
- Ship dedicated light/dark docs previews, rebuilt live WASM, documentation, and a changelog fragment.
* Fix code diff metadata and selection layering
* fix: align Geist tabs with design system
- Match Geist primary-tab sizing, spacing, icon treatment, and full-width rails while preserving default-theme pills.
- Add a scrollable component explorer with focused specimen views and a content-hugging default theme picker.
- Expand layout, rendering, semantics, interaction, and pixel-regression coverage for both themes.
* build: refresh docs WASM preview
- Recompile the checked-in component preview module against the updated Geist tab renderer.
- Verify the production docs build and live WASM scene instantiation.
* fix: extend Geist tab rails in flow layouts
- Let primary Geist tab lists claim available row and column width while preserving default-theme flex behavior.
- Add flow-layout regression coverage and refresh the docs WASM preview.
* docs: correct tabs markup example
- Compare the tab enum against quoted tag literals and show content for every tab.
- Use the cross-theme row and spacer composition for compact house tabs and full-width Geist rails.
* fix(canvas): correct tree, scroll, and tab layout
* fix(canvas): keep tree indentation author-owned
* fix(canvas): align Geist tab underlines with content
* fix(canvas): preserve wide Geist tab rails
* fix: preserve tab layout intent across themes
* fix(canvas): bound indented Geist tab rails
* fix: preserve Geist tab layout contracts
* fix: keep Windows effect spawns hidden
- Pass CREATE_NO_WINDOW for background Effects.spawn children on Windows.
- Verify redirected child output remains available without an attached console.
- Document the user-visible Windows fix in a changelog fragment.
Co-authored-by: Omer Shatzberg <131801941+oshtz@users.noreply.github.com>
* test: run Windows effect spawn probe in CI
---------
Co-authored-by: Omer Shatzberg <131801941+oshtz@users.noreply.github.com>
- Synchronize the CLI, core, platform, and example package versions.
- Merge pending changelog fragments into the marked v0.7.1 release notes.
- Credit release contributors and retire the v0.7.0 release markers.
* compiled-core builds pin the external toolchain release
- tests/compiled-core/core_compiler_pin is the one place the release pin lives
- build_core.sh verifies the supplied command reports that release and refuses any other, because the profile's fence table is release-pinned data
* determinism fences get a pinned negative control
- fence_check.sh compiles the pristine markup fixture and asserts its co-emitted sidecar attests deterministic: true
- the same fixture with one injected ambient read (Date.now() in update) must refuse, naming the fenced surface id, with no archive or sidecar emitted
- skip-clean when no external toolchain is supplied, like the parity battery
* CI: compiled-core parity battery runs on every PR
- new ubuntu job installs the pinned external core compiler, stages the contract artifacts, and builds all five fixture cores through build_core.sh
- runs the determinism-fence negative control, then the full test-compiled-core-parity battery over the compiled archives
- the release pin is read from tests/compiled-core/core_compiler_pin, so a bump stays a one-line change
* comments carry prose unwrapped
- one line per comment paragraph across the new CI job, the pin check, and the fence-check script
* ci: isolate the dispatch-budget measurement from runner contention
- The parity battery runs its test binaries serially in CI: five suites racing on a two-core runner turn scheduler contention into dispatch-budget failures the budgets were never meant to catch.
- A budget failure now prints the measured whole-pipeline and core-only nanoseconds, so a real regression and a noisy runner are distinguishable from the log alone.
* test: the paired lane budgets a paired dispatch
- The paired-core module declares paired_lanes, the staged root re-exports it, and the soundboard dispatch pin reads it: a dispatch that runs both lanes and byte-compares every seam gets half the frame budget, while the single-lane suite keeps the strict microseconds-class pin.
- The measured CI shape that set the number: core-only paired dispatch at just over the single-core budget on a shared runner, with the whole pipeline well inside its frame.
* Contract sidecar: carry authored payload member names and type origins
- The transpiler emits payload_members on each union (the authored member name of every single-payload arm) and a module-level type_origins table (the declaring module of every named contract-table type).
- The sidecar extractor reads both tables into additive fields: "member" on message and union arms, "origin" on type-table entries.
- The sidecar reader parses both as optional facts, so older sidecars keep reading clean.
* corewire --facade emits the complete compiled-core entry module
- The facade is now the generated twin of a hand-written adapter: it imports the author's core module, re-exports every named contract type from its declaring module, wraps init/update/subscriptions and the model helpers, and implements the full ABI dispatch surface (boot_cmd, the nine dispatch entries, the wired channel entries, subscriptions, model_snapshot, helper_call) over one committed model, with the inline wire codec and the guard-and-trunc wholeness proof at every i64-classed ingress.
- The profile designates the facade's own entries (init/coreUpdate, coreSubscriptions only when the contract subscribes), maps plain export names to prefixed symbols, and carries the contract's integer_slots through; --f64-slot demotes a named record slot to f64 across the whole invocation for values that reach the f64-exact boundary.
- The sidecar reader accepts the external compiler's additive synthesized marker on struct entries.
* Compiled-core lane builds from generated facades and profiles
- build_core.sh stages the generated entry module and compiler profile from zig-out/core-contracts (stage-core-contracts now installs core_profile.json beside the sidecar and facade, with the host fixture's Model.pastBytes carried as f64 — it holds 2^53 by design, past the honest i64 window).
- The five hand adapters, the shared wire codec, and the hand profiles are deleted: the generated facade carries the whole surface, and the parity batteries hold every byte to the transpiler lane.
- The conformance suite keeps the mirror axes (fingerprints, contract artifacts, envelope unpacking); the compiled side's encodings are proven at full behavioral depth by the parity batteries, whose entry the generated facade now is. The hand markup contract gains the member and origin facts.
* fix(corewire): harden generated facade contracts
* fix(corewire): harden facade dispatch projection
* fix(corewire): harden generated facade contracts
* fix: accept legacy sidecars in parity tests
* fix: close corewire facade gaps
* fix(corewire): avoid false subscription inference
* fix(corewire): preserve unbound name precedence
* fix(corewire): align effective facade contracts
* test: declare i64 slots in the markup and host-fixture core profiles
- The shared wire codec, the markup adapter, and the markup frame channel prove decoded integer slots in place: bind the value, range-guard it with ordered comparisons, and state wholeness with Math.trunc at the write.
- Fixture counter bumps saturate at the i64 class's provable ceiling, ±(2^53 − 1), so range discharges.
- Model.pastBytes stays f64-classed: it holds 2^53 by design, past the provable window.
* test: declare i64 slots in the ai-chat core profile
- The text SDK gains one provable selection constructor: every editor-produced selection is range-guarded and stated whole with Math.trunc, keeping the proof local to the construction site.
- The ai-chat composer binds composition bounds and proves them at the write; -1 stays the no-composition sentinel.
- The chat_response status and nextId bumps prove in place with the same guard-and-trunc idiom.
* test: declare i64 slots in the system-monitor core profile
- Samples, probe results, and ps rows bind, range-guard, and Math.trunc their counts at each classed write; unprovable values keep the previous sample or skip the line like any other malformed row.
- The adapter proves dispatch values and classed helper returns in place with the same guard-and-trunc idiom.
- Structurally identical union arms lower to one record shape, so one code slot and one pid slot carry the class for their siblings (SC4009 keeps colliding declarations out).
* test: declare i64 slots in the soundboard core profile
- Catalog ids, playback clocks, and queue counters bind, range-guard, and Math.trunc at each classed write; the clock-tick cap comparison replaces Math.min so the proof stays in view.
- The adapter proves its ten classed helper returns in place with the same guard-and-trunc idiom.
- The id-carrying Msg arms share one lowered record shape with QueueEntry, which carries the class for all of them (SC4009 keeps colliding declarations out).
* test: carry i64-classed slots on the i64 wire encoding
- Snapshot, helper-result, record, and channel encoders write classed slots with wI64 (optionals via wOptionalI64), matching the contract each adapter now attests.
- Text-input decoding reads selection offsets and composition cursors as i64; selection offsets ride a saturating reader because select-all sends the maxInt to-the-end sentinel, which every consumer snaps to the text's length.
- Classed helper results route through their proven wrappers and encode with wI64.
* test: declare the coalesced arm slots and prove the decode ingress
- The ten same-shaped Msg arm slots join the soundboard and system-monitor profiles, so the declared set covers every provable reference slot and only the deliberate 2^53 boundary probe stays f64.
- Decode ingress proves in place where synthesized record slots carry write obligations: soundboard's id dispatches and audio clocks, and the shared composition-cursor decode, each range-guarded with wholeness stated by Math.trunc.
- The ai-chat and markup profiles drop a subscriptions_export naming a function their entry modules never exported; a dangling name refuses instead of resolving silently.
* test: preserve compiled-core numeric dispatch classes
Chris Tate