Crate tilo_app

Expand description

The Tilo application SDK.

The golden path is framework: declare a resource type and its actions with [tilo_resource], write views against a framework::ViewCx, and framework::run provides storage, sync, collaboration, history, undo, permissions, the action palette, the agent and script door, and search. The CRDT engine is not part of that surface.

The rendering toolkit is re-exported unchanged for widgets, custom surfaces and the imperative escape hatches.

Application manifests normally rename this package to ui:

ui = { package = "tilo-app", path = "../../crates/sdk/tilo-app" }

That one line is the whole manifest an app needs. Every OS affordance is on by default — history, undo, permissions, collaboration and device sync, the host file chooser, media controls, notifications and GPU video — so an app never picks features to get them. A headless tool that wants only the toolkit sets default-features = false.

Shell and framework internals may depend on the lower tilo-ui package directly; ordinary applications should use this facade.

Re-exports§

pub use tilo_resource;
pub use serde_json;
pub use tilo_feedback as feedback;
pub use tilo_files as files;

Modules§

a11y: Accessibility semantic model: the data layer. Defines the toolkit-ergonomic semantic types — Role, AccessNode, AccessState, and Action — that every Widget describes itself with via Widget::accessibility.
a11y_tree: The retained accessibility tree — a stable, frame-to-frame semantic model of the running UI.
accesskit
accesskit_bridge: AccessKit bridge: turns the toolkit’s per-widget semantic model (crate::a11y::AccessNode, from Widget::accessibility) into an accesskit::TreeUpdate, published over AT-SPI2.
action_palette: ActionPalette — the one Ctrl+K surface for a tilo_ui::App.
advanced: What a hand-written Widget draws and lays out with: the renderer’s scene and transforms, the layout tree and the windowing events. Views built from framework::ViewCx never name them.
agent_identity: A single, non-human identity silhouette for agents across Tilo.
animation: Shared motion system. One curve set (Curve), one wall-clock driver (Animated), one interruptible open/close driver (Transition), and one stateful velocity-carrying Spring for interactive drag.
app
app_surface: Which app surface the changes an app makes are decided against.
application: Checked application construction shared by hosts, independent of any runner.
application_view: Versioned, device/workspace-local presentation. Never contains document bytes.
auth_backdrop: Quiet current: the shared authentication artwork for the lock and greeter.
author: The one way every app draws who did something, so no app can forget to say that a bot is a bot. A person gets their round avatar; an agent its identity mark; a bot a rounded-square tile and a BOT chip that is never elided. A bot may show another name (an appearance): it is shown, the chip stays, and a name that looks like a room member’s carries its service.
automerge: Automerge
backdrop: The blurred material floating chrome is made of.
background: Background work and timers, provided by the host: tilo_rt::background under the toolkit’s module path.
bound_dispatch: Lifetime and canonical-record routing shared by retained and raw widget dispatch.
caps_lock: Heuristic Caps-Lock detection.
capture: Screen capture, as the host provides it.
chart_palette: Theme-aware reusable colour palettes for charts and data visualisation.
charts: Charts and plots
chrome: Reusable chrome — the framed UI around content. Two layers, not the same thing: application chrome (page, status_bar and the crate::widget::Toolbar) is the frame an app draws around its own content (the app owns button specs and click handling, the toolkit owns the look); shell chrome (shell) is the vocabulary the OS paints in around and between apps — top bar, window decorations, workspace disc, quick settings, collaborator surfaces (see crates/sdk/ui-core/HIG.md §9).
clipboard: Clipboard backends — how a ui process accesses the selection: tilo_clipboard under the toolkit’s module path.
clock: The clock as a person reads it: local date and time.
close_admission: Shared, device-local close admission. Saving an external document still goes through its declared action; host chrome owns only the close decision.
collaboration: Toolkit-side collab client: a synchronous, non-blocking send / poll pair trading typed CollabRequest / CollabEvent frames, stable so every downstream app keeps compiling while the transport underneath changes.
collection_transition: Bounded keyed transition snapshots for virtualized collections.
color: Colour conversions shared by the toolkit and apps: #hex parsing and formatting, HSV and HSL, and WCAG relative luminance and contrast.
color_compat: Compatibility helpers for the byte-channel accessors and f64 constructors that peniko::Color does not provide.
component_lifecycle: How a widget takes part in closing its window and components: unsaved work, persistence checkpoints, component close reports and deferred window close.
content_layout: Responsive content-width policies for app surfaces.
control_custody: Emission-time local control custody. Emission-time custody for registered local controls.
date: Proleptic-Gregorian day counts for apps that label dates, on chrono.
diag: Diagnostic output that cannot take the application down with it.
dmabuf_import: Zero-copy DMA-BUF → wgpu texture import via Vulkan external memory. Shared by the WebView’s page buffers and the video decoder’s hardware frames. DMA-BUF → wgpu texture import via Vulkan external memory.
dnd
doc: CRDT helpers: writes that keep Automerge documents from churning, and typed reads.
doc_source: Read sources for controls backed by the app document. User edits are submitted by the control owner as resource actions.
env: The toolkit’s debug, capture and benchmark knobs: TILO_UI_* variables.
evdev: Linux input-event codes (linux/input-event-codes.h), the key codes the peer protocol carries on every host.
feedback_composer: Shared private feedback presentation. Desktop hosts lend the system-owned controller into a private component; no draft is a workspace record.
floating_surface: Shared placement contract for app-bound overlays and shell-owned PiP.
font_catalog
format: Shared value formatters for system apps — byte sizes, transfer rates, media timecodes, “time ago” labels, grouped and compact counts, and month/weekday names.
framework: The app framework: a resource, its actions, and views bound to it.
fullscreen: Shared fullscreen / presentation mechanism.
gesture: Pointer-driven selection gestures — the press → move → release state machine behind click-to-place-caret, drag-to-select, double-click-word, triple-click-line, and shift-extend. App-agnostic: it tracks the gesture and reports intents (extend? what granularity?); the app maps points to its own caret/selection model. Lives in ui so every app gets consistent selection behaviour instead of re-deriving the timing/anchor rules.
gpu: wgpu state, asked for in a size this machine can give.
gpu_video: Painting decoded video on the GPU: uploading a hardware decoder’s planar output and converting YUV to RGB in a shader. Plain wgpu, so every target (WebGPU included) has it; gpu-video adds the zero-copy dmabuf import, which media::availability(Feature::ZeroCopyVideo) reports. Painting a decoded video frame on the GPU.
graph_editor: Reusable interaction model for node/graph editors.
headless: Driving a ui app without a display.
history_mode: Window-independent projection of a managed record’s historical states.
history_source: Turning a live CRDT document into the rows the history widgets render.
host: Host services — the capabilities a ui process borrows from whatever is hosting it.
host_data: Named data a host supplies on request, for builds that ship large application data (fonts, archives) beside the program instead of inside it. An application asks for a name each time it needs the bytes; a host that can fetch drains the requests, fetches each, installs the bytes or a failure, and relayouts its surfaces so the application asks again. Builds that embed their data never ask, and a host that never drains leaves every request pending.
host_notifications: Native notification scheduling where this build has none.
host_palette: Asking the host to open its palette from inside an app: a chord or a button of the app’s own (Ctrl+P for quick open, Ctrl+G for go to line) that lands in the same palette as Ctrl+K, over the same published actions and search entries, instead of a palette of the app’s own.
host_worker: Ordinary application workers shared by durable native and hosted owners. The host supplies current authority and committed bytes; this module owns only the real application runner and its original recovery custody.
i18n
icons: Lucide-icon glyphs, stroked to match the concept’s 1.5 px aesthetic.
image_store: Async image loading, decode and cache — keyed by URL. Displaying remote thumbnails on the UI thread would jank every frame, so loads run off the UI thread — fetched through a caller-supplied Fetcher and decoded as crate::background::Background jobs, or fetched by the host through a HostImageLoader — and the decoded peniko::ImageData is cached and handed back on a later frame; until then the caller paints a placeholder.
ime: Focused widget IME intent shared by native windows and browser input bridges.
input: Device-neutral action bindings and the legends shown beside controls.
interaction: Host-owned input capabilities shared by the retained widget tree.
invocation_scope: Host-local invocation custody. No wire caller can manufacture these checks.
keycaps: The words and symbols printed on the keys of the active keyboard layout.
launch: The toolkit’s launch vocabulary, with run resolved to the runner this build targets: the native event loop on Linux and macOS, registration with the page runtime in the browser.
live_collaboration: Workspace-level collaboration experience shared by every application.
local_identity: Who sits at this device, as far as undo attribution and history authors are concerned.
local_state: Small, typed process-local state for retained application views.
location: Device location, as the host provides it: tilo_location under the toolkit’s module path.
math: Shared structured mathematical typesetting.
mpris: MPRIS — org.mpris.MediaPlayer2 desktop media control, in the toolkit.
native: The native desktop side of the toolkit, behind the default-on native feature.
native_media: Closed local call controls. Identity and capture authority never come from this wire.
native_scenario: Opt-in native input timelines. These schedule delivery, not display completion.
nav_stack: A reusable, app-agnostic navigation stack with a back action and an edge-swipe back-gesture hook.
notify: User notifications: tilo_notify under the toolkit’s module path.
num: Explicit numeric conversions used at UI/model boundaries.
offscreen: Headless offscreen render harness: renders a Vello Scene into a GPU texture with no window, reads the bytes back, optionally writes a PNG.
overlay: The window’s top layer: what modal and anchored surfaces share.
owner_wake: Optional exact-component wake intake. This module does not schedule, service, freeze, or skip any component. A wake reason is not proof of model purity.
paint: Scene-painting shorthands for apps that draw their own surfaces.
paragraph: Paragraph-wide line composition.
passcode_keyboard: A keyboard drawn on the screen for entering a passcode by touch.
pen: The stylus behind the pointer event a widget is handling.
permissions: The toolkit’s permission gate.
persist: Making an app’s state survive a restart.
personal_dictionary: Current authenticated host’s shared local vocabulary. No filesystem or app-local fallback; missing/revoked channels clear personal hints.
pipeline_seed: The session’s read-only vello pipeline cache every app starts from. A pipeline cache every app starts from, written by the session.
platform: Semantic platform conventions for app-authored controls and shortcuts.
png: Lossless PNG encoding and decoding of tightly packed 8-bit RGBA frames.
pointer_replay: A still pointer over a rebuilt tree.
portable_storage: Hydrated, explicitly namespaced browser persistence. Durable writes are acknowledged by the host only after its backing transaction commits.
portal: The file-chooser and URI-opening vocabulary: requests, outcomes and the URI → path rule every backend shares.
prelude: The usual imports for application code.
presence
priority_contacts: The priority-contacts projection an address book publishes to the Tilo shell, which lets those people through Do Not Disturb.
profiling: Frame profiler and headless performance-testing harness for ui apps.
published: A published resource tree whose unchanged subtrees are shared between versions.
query_text: Shared visual/IME state for transient search and command queries.
raster: Images built from raw RGBA8 pixels.
reader_hud: Shared reading-surface chrome for the document readers (ebook, pdf_viewer), so both present the same selection affordances with the same spacing, hover, and selected-state treatment:
realtime_continuity: Transport-neutral application contract for active realtime-session handoff.
record: Records — the unit of state, collaboration and storage. A record has a type, a stable identity, and a home room. A file’s identity is its file record — the durable id the filesystem gives the file, which a rename or move keeps — and its path is only where it currently sits (see RecordId::identify_file). Records reference other records rather than nesting (annotations reference the document they mark up), so “share the book without my notes” is expressible.
remote_actions: An application’s own client for the session’s action door.
render_thread: UI render worker thread.
reorder: Shared drag/reorder state for virtualized collection widgets.
resources: Resources a widget publishes: the tree of open tilo_actions::Resources with the actions each exports to the palette, agents and scripts, and the bounded pages the broker’s pull directory reads.
retained_present: Drawing for a presenter that keeps the desktop between frames.
richtext: RichTextLayout — attributed, word-wrapped, hit-testable text layout. The toolkit’s rich-text primitive (cosmic-text under the hood): per-run bold/italic, underlines, wrapping to a width, caret geometry, selection rectangles, and point↔offset hit-testing. Render it with crate::text_render::TextRenderer::draw_rich.
rt: The one async runtime model for Tilo processes.
scale: Display-scale plumbing shared by the render loop.
scene_parts: Keyed parts of a shell scene section, so a small change inside a section damages that change’s bounds instead of the whole display.
screen_reader: Built-in screen reader.
scroll_copy: Scrolling by copying the pixels that stay on screen.
search: Search as a platform service.
secret_paint: Whether a paint put a secret on screen.
secrets: App-scoped secrets: tilo_secrets under the toolkit’s module path.
selection: Shared collection selection models.
semantic_document_read: App reader registration and the SDK’s committed-read admission.
shell_tabs: Tabs belong to the desktop, never to an application.
standalone_history_pane: Shared, read-only history presentation for standalone app hosts.
state
status_bubble: A transient floating status bubble: a small floating Panel that appears when a status changes (a page turn, a zoom step, a sync that finished) or while the pointer rests on its corner, then fades away.
storage: Where an app keeps what is not a document: one seam for app files, preferences and secrets, the same on Linux, macOS and the web.
surface: Shared surface-drawing primitives — how a card/panel casts a shadow.
synthetic_input: Deterministic window input shared by native scenarios, headless driving, test control and tests: what they deliver in place of a device.
sysdirs: Localized XDG user directories.
table_model: The editable table’s model: the document layout a Table shows, and the operations its owner applies inside its own action (apply with the widget’s TableEdits). The widget itself only reads the document.
taffy: Taffy
text_assistance: Process-local view of the shared spelling preferences: the per-user text_assistance section every app’s text fields follow.
text_break: Unicode line-break opportunities shared by shaping-adjacent layout code.
text_detect: Identifiers inside free text: links, email addresses, mentions and room aliases found in a run of prose.
text_edit: EditCore — the shared headless text-editing model.
text_input: Private completion receipts shared by native and browser text editors. These types grant no access to an embedded browser or its engine.
text_metrics: Shared text-metric arithmetic for widgets that paint a line of text themselves.
text_position: Path-free text presentation for native continuation, anchored in the CRDT. This contains view state only. Resource contents retain their existing sync route, and restoring a view neither changes focus nor grants input authority.
text_render
text_selection: Shared text-selection primitives for TextInput, NotesApp, and any future text editor (terminal scrollback selector, code editor, …).
theme
tilo_actions: Tilo ACTION model
time: The toolkit’s clock: tilo-clock, under the toolkit’s module path.
tokens
ui_graph: Versioned, serializable UI object graphs compiled into ordinary widgets.
undo: Seeing and driving undo from inside a widget.
uri: Percent-decoding for URIs, with the + question answered once.
vello: Vello is a 2d graphics rendering engine written in Rust, using wgpu. It efficiently draws large 2d scenes with interactive or near-interactive performance.
view: The View: an app’s presentation layer, distinct from its state.
virtual_viewport: Shared one-dimensional virtualization geometry for lists, trees, and tables.
wake: Instance-scoped background wake routing: tilo_rt::wake under the toolkit’s module path.
webview: Engine-agnostic embedded web view plumbing.
widget
window_icon: Resolves the raster icon named by the launcher’s TILO_APP_ICON, falling back to a generated Tilo icon when it is missing or invalid.
winit: Winit is a cross-platform window creation and event loop management library.

Macros§

android_main: Export the Android entry point for this binary’s main.
built_in_definition: The definition of the framework::ResourceApp $app for a host that runs it in its own process (the shell’s built-in apps, the web desktop, an agent’s participant host), naming the app crate’s committed surface.toml as its surface: such a host runs no package whose payload names one. An app’s library defines its definition() with it; the app’s own binary uses framework::definition, so it does not carry the file.
column: Build a retained Column from concrete child widgets without repeating push(Box::new(...)).
dev_reload_entry: Export the entry points every platform’s host enters the app library by.
diag: eprintln! that cannot kill the process. See the module docs for why that difference is load-bearing.
embedded_catalog: Define the calling crate’s EmbeddedCatalog: locales/<locale>.ftl in the crate, en-US as the source, the user’s locale when no host chose one, and source copy pinned in the crate’s own tests.
forward_to_child: The Widget methods a wrapper that keeps one child Element in self.$child — laid out as the only child of its own node, whose box it stores in self.$rect — forwards to it unchanged: placement, painting, events, child walks and its box.
forward_to_composed: The Widget methods a view owning a Composed in self.$field forwards to it unchanged: layout placement, painting, events, child walks, its box and whether it must be rebuilt.
i18n
main: The binary entry point of an app, identical on every target.
provides: Declare the capabilities a widget provides, inside its impl Widget: provides!(dyn FullscreenProvider, dyn Continuable);
rect_geometry: Implements Widget::apply_layout and Widget::get_rect for a widget that keeps the box layout gives it in self.rect.
redraw_flag: Implements Widget::needs_redraw and Widget::mark_drawn for a widget that tracks whether it needs repainting in self.dirty.
row: Build a retained Row from concrete child widgets.
stack: Build a retained Stack from overlapping concrete child widgets.

Structs§

A11ySettings: Stored in the per-user settings CRDT and mirrored into spawned sandboxes via TILO_A11Y_* env vars. Defaults are all-off so existing single-user setups are unaffected until a user opts in.
AccessBounds: Serializable absolute logical-pixel geometry for a synthetic AccessNode. This mirrors Rect without requiring widget authors to depend on its serialization feature.
AccessNode: The per-widget local accessibility semantics returned by Widget::accessibility; name/description must already be FTL-resolved strings (via i18n!), not translation keys, since AccessKit/AT-SPI consume final text.
AccessState: Tri-state fields use Option<bool> where None means “the state does not apply” (e.g. a Role::Button is never checked) — matching ARIA’s aria-checked="false" vs. absent distinction.
AccessibleTextSelection: Editable-text selection in the widget’s native UTF-8 document space.
ActionBindings
ActionPalette: The unified Ctrl+K palette: a SearchField over a SearchResultsView, fed by the focused app’s resource/action tree plus any folded-in SearchProviders.
ActionUiRoute: One visible expression of a domain action in the retained UI. The action address remains the execution identity; this route is presentation metadata for focus, presence, animation, and “show me where” behavior.
ActivityBrief
ActivityBriefAction
ActivityDigest
ActivityTimeline: Scrolling, filterable, groupable activity pane. See module-level docs.
Actor: The thing asking to reach a sandboxed resource: every Principal it can prove it is, and its signing key if it has one.
AgentRun: One instruction that spanned one or more applications.
Animated: A driver that interpolates from -> to over duration using curve, driven entirely off a wall-clock Instant. No per-frame state — just query current(now) whenever you need the value.
App
AppCommand: A command palette entry contributed by an app. Invoked with a mutable CRDT handle and the app’s root ObjId so the command can mutate state directly (matching quick-ui’s direct-mutation event model).
AppearanceIntent: Polled by crate::app::App once per frame and reconciled against the live theme. Level-triggered like fullscreen_intent: a steady value is correct, since the App only re-themes when a field differs from what’s applied, so a settings pane can return the same intent every open frame.
ArgumentSpec: When set on an entry, choosing it first collects a free-text argument before it completes: the palette switches into an argument-entry step showing prompt as a heading and an editable field seeded with prefill.
AuthorDirectory: Maps automerge actor ids to the people the chrome should name.
BandUndoRequest: What [Undo] on a band asks for: the range, not a single id like [Restore] sends. Restore means “put the document back to this moment, discarding everything after”; undo means “take this band out, leave the rest alone” — a host cannot tell the two apart from one id.
BindingConflict
BindingSet: Rebindable, app-owned actions. This intentionally stores stable action ids instead of callbacks so apps can persist the map in their ordinary state.
CapOverride: One sandbox capability.
CapsLockEstimate: A running estimate of whether Caps Lock is engaged, inferred from typed letters. Cheap to copy and to keep alive; update it by feeding each typed character (and the Shift state that produced it) through observe / observe_text.
Card: A retained card. See the module docs.
CardGrid: Reflows its cards into equal, aligned columns by width. Each row is as tall as its tallest card; cards share the row’s height so their footers line up, and a row of short cards stays short.
CaretWord: Debounces the word under the caret: it is settled once the same word (same text at the same place) has been under a collapsed caret for SUGGESTION_SETTLE. Typing into the word or moving to another one restarts the wait; moving the caret within the word does not.
ChangeRun: A contiguous run of changes, addressed by its first and last change.
CharSplice: An Edit in Automerge’s char offsets: delete removed chars at char at, then insert inserted chars there.
CollaborationExperience: State behind the universal “People” surface. It contains no model runner and no transport: hosts feed it semantic activity and a grounded candidate returned by their on-device summarizer, then publish shareable_status.
CommandEntry
CommandOutcome: The result of pressing Enter on an entry: its id plus the free-text argument (only Some for entries built with CommandEntry::with_argument). Drained via CommandPalette::take_outcome.
CommandPalette
ComposedLine: One chosen line, indexing a half-open range of the input boxes.
ContentSurface: Tokens a content surface paints with when ContentSurface::forced is set. When it is clear, a document keeps its own page palette.
ControlCoverage: This is an inventory, never an assertion that arbitrary private storage was observed. Legacy compatibility is retained until downstream migration ends.
ControlDomain
ControlOutbox: A retained producer does not keep its owner, registry or widget alive.
ControllerBinding
DocumentDiagnostics
DocumentFrontier: An explicit outbound synchronization frontier for one document route.
DragScrollFinish: Result of releasing a pointer tracked by DragScroller.
DragScrollUpdate: Result of moving a pointer tracked by DragScroller.
DragScroller: Thresholded, single-axis pointer panning shared by virtual collections. A press remains a click until it moves four logical pixels; once active, offset and release velocity are derived from the same pointer samples.
DragSelect: Tracks a text-selection drag gesture across press → move → release, including multi-click (word/line) and shift-extend.
DropCandidate
DropTarget
EdgeSwipeBack: Arms when a press starts within edge_width of the left edge, fires NavAction::Back once the pointer travels trigger_distance px right in a mostly-horizontal drag. No velocity/animation, but a complete pointer-event contract a richer recognizer can later drop into.
Edit: A splice to apply to the buffer, in byte offsets over the pre-edit text: at..at+removed is replaced by inserted. Edit::apply applies it to a String mirror; Edit::splice_automerge to a char-addressed Automerge Text.
EditCore: The caret + selection model, the IME composition in progress, and the field’s admission filter. Selection offsets are bytes into the bound text (matching text_selection and cosmic-text’s byte-indexed layout).
EditableLabel
EmbeddedCatalog: An application’s Fluent catalogues, embedded with include_str! and loaded on first use on each thread.
FileFilter: One entry in the chooser’s file-type dropdown.
FnProvider: A SearchProvider built from a closure plus its kind label — the convenient way to register a source without declaring a struct. Created via SearchRegistry::register_fn.
FocusView: The focused widget’s ephemeral presentation state, captured through the same mechanism the undo path uses to restore a caret across a rebuild. ordinal is stable exactly when the tree shape is — the condition under which restoring a caret is meaningful; ephemeral is the opaque string from [crate::widget::Widget::get_state]/set_state.
FocusedContentLane: A centered, horizontally constrained lane that remains fluid on compact viewports. Vertical bounds always match the supplied viewport.
FontVariation: One design-space coordinate for a variable font.
Fragmentation: Minimum line counts retained on either side of a page/column break.
FrameProfiler: The crate::app::App holds one of these behind an Option; the headless crate::headless::FrameHarness holds another for the perf harness. Both feed it the same way: record a pass duration, then commit_frame once per frame.
FrameTiming: This is the atom every surface shares: the HUD graphs it, the dump serialises it, and PerfReport aggregates it.
FrontierDiagnostics
FrozenApp: The versioned freeze envelope: an app’s serialized state bytes alongside its captured View. Collaboration and freeze/thaw serialize the same state; this pairs it with the presentation so a restore lands the user back where they were, not merely on the same data.
GlyphOutline: One shaped glyph as geometry: see TextRenderer::glyph_outlines.
GroundedNarrative
GroupNameRequest: What a host must write when a user names, renames, or un-names a run of changes. Both history surfaces emit this rather than writing to the document directly — neither widget has one, only the host does.
GroupingConfig
HangingPunctuation: Optical punctuation protrusion at paragraph edges.
HistoryAttribution: An author that acted for someone: an agent’s change is the agent’s, on behalf of its person, in every history (an app’s, the Files history, and what the history actions return).
HistoryAuthor: Not crypto material — just enough metadata to render a per-author colour dot, display name, and a short identity hash for disambiguation when two authors share a name.
HistoryComparison
HistoryController
HistoryEntry
HistoryEntryId: Opaque: only ever compared for equality (revert/restore callbacks pass it back to the caller). The caller picks the byte layout — UUID-v4 today, a content hash later.
HistoryFacetIndex
HistoryFilter: Empty fields are “match everything” so a freshly-constructed filter behaves like no filter at all. The chrome owns the filter (not the widget) so the host can persist it across remounts, e.g. a workspace switch, without poking at widget internals.
HistoryGroup: One collapsible band in a history surface.
HistoryResource: Full authority namespace for one historical resource.
HistoryResourceTarget
HistorySeenFrontier
HistorySelectionDetail
HistorySnapshot: Immutable Automerge bytes at one exact causal frontier.
HistorySource: Construct one, hand it an AuthorDirectory so actor ids resolve to people, and call HistorySource::entries whenever the document changes.
HostImageLoader: The loading half of a host-driven ImageStore.
HudControls: Which controls a SelectionHud offers besides the always-present Copy: the highlight swatch row, and the Note and Delete controls when enabled.
HudPlacement: Where a SelectionHud floats: anchor is the horizontal centre and top-y of the selection’s first band, bounds the area the bar must stay inside, both in the drawing transform’s space.
HudSwatch: One highlight colour offered in the HUD’s swatch row.
I18nManager
ImageStore: A cheap-to-clone handle to a shared image cache whose loads run off the UI thread — on the toolkit’s Background for ImageStore::new, or in the host for ImageStore::host_driven.
InputAvailability: A compact set of the input devices discovered for this session.
Intents: The queue a view’s controls write what they ask for to, and its app applies in one ordered place after the event: a click, a key and an accessibility action all become the same intent. Clones share the queue.
InteractionEnvironment: Runtime interaction information propagated by the host to every widget.
KeptSlot: A slot the revert declined to touch, and why.
KeySelection: Stable-key multi-selection for virtualized and mutable collections.
KeyboardBinding
KeyboardMap: Theme-aware map of an explicitly selected physical model. It observes only ordinary focused window events, never global devices or document edits.
KeyboardMapInput: Private, process-local physical press state shared across page recomposition. It contains no entered text or logical input history and never edits a document.
KeyboardMapKey: A key’s physical outline and ordered XKB levels, in model coordinates.
KeyboardMapSelection: Action-bound inspection over the shared physical map. Keyboard presses never select an inspector or publish entered text.
Keycaps: The legends of one keyboard: its layout’s language and whether it is an Apple keyboard.
KeyedRowSnapshot
KeyedTransitionSet: One active structural transition over a bounded set of visible keys.
KineticSampler: Release-velocity estimator for continuous (pixel) scrolling.
LatestRequest: UI-thread inbox for worker results where only the newest request may win.
LatestTask: Typed state for restartable background work where only the latest run may publish a result. Starting or cancelling a run invalidates every older TaskCompletion.
ListIndex: Ranks the rows of a list against a query, for surfaces that rebuild their rows on every query or change (commands, windows, actions).
LiveStatus
LiveUi: A retained host whose child is reconciled after a validated graph edit.
LocalState: A cloneable handle to typed, process-local application state.
LocalStateWriter: A background-safe LocalState mutation handle with event-loop wakeup.
MarkerDrag: A reader begins a drag when a press lands on a marker it owns, tracks the pointer while held, and reads back the marker origin on release to persist the new anchor. Agnostic of the coordinate space (page points vs. screen-y) — the caller decides how to interpret the returned origin.
ModelView: A retained subtree selected by a value projected from application state.
NameField: A one-line name field. Hosts own the placement and the lifetime; this owns the text and the keys.
NamedRange: A user’s name over a run of history, as stored in the document.
NarrativeRequest
NarrativeSource
NativeView: Retained widget adapter around a NativeViewBackend.
NativeViewGeometry: Parent-relative geometry in both toolkit-logical and native physical pixels. Backends should use physical_* for child-window APIs.
NativeViewHost: Live parent-window context supplied before a native view is shown.
NativeViewInput: Event coordinates and modifiers already normalized by the toolkit host.
NavItem: One destination. Every part but the label is optional; see docs/ui-migration.md, “Rows: what each part of a NavItem means”.
NavList: The navigation list. See the module docs.
NavSection: A group of destinations under a sentence-case title.
NavShell: The one window shell. See the module docs.
NavStack: A generic navigation history. T names a view (an app’s route/screen descriptor). Back and forward keep browser-style history; pushing after a Back clears the abandoned forward branch.
OpenTypeFeature: One explicit OpenType substitution/positioning setting.
OpenTypeTag: A four-byte OpenType feature or variation tag (kern, dlig, opsz, …).
PaintedActionMarker: One marker exported only by the action-presence painter, in surface-local logical coordinates. It grants no authority to its actor.
ParagraphBox: One shaped box in logical order. A box is usually a word or an unbreakable inline fragment; callers retain the actual glyph/style data separately.
ParagraphOptions: Tunable paragraph-composition policy. Defaults are deliberately close to TeX’s ordinary prose behavior while remaining expressed in font-relative space capacities supplied by the caller.
ParticipantPresence: One remote participant’s live presence (caret/selection), published by a multi-participant widget under that participant’s identity. Same key and payload shape as the local window’s own presence (Writer: wp_block key, byte offsets into the caret block).
PerfReport: Per-pass and total statistics over every frame a PerfScenario produced, plus how many blew the frame budget.
PerfScenario: Reusable across any app: build a crate::headless::FrameHarness over the app’s real root + state, then call run_scenario.
PermissionContext: The authority and sandbox a frame’s permission checks are decided against. Held by App, consulted by app::dispatch_gated_event before a gated widget ever sees an event.
PersonPresence
PickRequest: A portal file-chooser request, built up and then send on a worker thread.
PlatformConventions: Host-selected conventions. Copyable so it can be propagated through a retained tree and overridden by deterministic tests or a native shell.
PolygonTextLayout: Built-in layout engine that fits text into and clips it against a polygon.
PresenceCtx
QueryComposition: Retained shaping and IME state for an inline query editor. Editing goes through the shared EditCore: the owner’s Selection is loaded into it for every event and written back afterwards, so a query keeps the same grapheme, word, clipboard and composition rules as every other field.
QueryInk: The colours a QueryComposition paints with.
QueryView: The query a QueryComposition paints: the committed text and its selection, the placeholder shown while it is empty, and whether the caret is visible.
RecordCheckout: A record named together with its type — what a widget declares it is working on, and what a room index holds.
RecordId: The stable identity of a record. Encoded by prefix: file-record:<uuid> (a file, by the durable id its filesystem record carries — see RecordId::identify_file), file:<absolute path> (a file known only by where it is: a not-yet-written Save As target, or a filesystem that can’t hold the durable id), uuid:<uuid> (minted, for a record with no natural name), tab:<tab id> (a window’s scratch document until a file names it, see RecordId::for_tab) and derived:<role>@<id> (see RecordId::derived).
RecordKind: What kind of thing a record is — document, annotation-set, book, playlist. App-owned rather than system-registered, so an app can add a kind without coordinating; the cost is no cross-app library view yet (needs a system-owned type registry, not built here).
RecordRef: One record’s reference to another: annotations → the document they mark up, a duplicate → the record it was copied from.
RecordSet: The records one app process has open, and which is live. Owns per-record persistence and parking — not collaboration: routing a record’s deltas is the toolkit’s business (tilo_ui::App re-announces its channel on checkout), since a channel is a property of the connection.
RecordStore: A RecordSet several widgets share via a handle, so two tabs on the same file stay one document rather than drifting under per-widget ownership. Single-threaded on purpose — a widget tree is, and a Mutex here would guard against nothing.
RedactionDisplay: Optional on HistoryEntry — when present, the widget renders the row with the struck-through summary, suppresses the [Revert] chip, and exposes the redactor + reason on hover.
RemoteActions: An application’s client for the session’s action door. Clones share one client.
RemoteActionsGuard: Keeps a RemoteActions::enter host current on this thread.
ReorderController: Gesture controller shared by list and tree widgets. Widgets retain model mutation authority and supply their own hit-tested, validated candidates.
ReorderDrop
ReorderMotion
RequestCompletion: Single-use worker capability returned by LatestRequest::begin.
ResponsiveControlBar: Shared one-row/two-row policy for dense command and find bars. Callers declare the width their inline composition genuinely needs; the same value then drives reserved layout height and paint-time row placement, preventing controls from being clipped by a one-off app breakpoint.
RestoreReview: Opaque proof that a particular selected state was reviewed against a particular live frontier. Validation grants no authority and writes nothing; the host must separately recheck permissions before restoring.
RevertOutcome: What a revert did, and what it deliberately did not do.
Revision: One node in a document’s causal revision graph.
RevisionHistory: A causal-order snapshot of all revisions retained by a document.
RevisionId: Stable, content-addressed identifier for one document revision.
RichSpan: A styled inline run. size/family override the block defaults per run.
RichTextLayout: A laid-out block of attributed text.
RouteHandle: A cloneable controller for one router’s process-local route stack.
Router: A retained single-screen host driven by an explicit RouteHandle.
RowGeometry
RunStep: One application’s share of a run.
RunUndoReport: What a whole-run undo did, across every application it touched.
SaveStatusSurface: A document’s save status, on the framework’s status surfaces (HIG §7c): “Saving…” and “Saved” are a change worth noticing once, so they show in the transient StatusBubble; a failed save is an error the person must act on, so it is an error toast (danger icon, the reason, a “Try again” action and a close button) that stays until the save succeeds or it is dismissed. An app reports the state and routes clicks; it never pins a bubble open or paints its own save pill.
ScreenReader
ScrollMomentum: Deterministic single-axis momentum used by virtualized collection widgets. Wheel input moves immediately; line-wheel impulses additionally feed this decay curve so detented wheels can traverse long collections without requiring one event per row.
SearchGroup: A ranked bucket of results that share a SearchResult::kind. The results overlay renders one section per group, headed by kind.
SearchRegistry: The set of providers a search surface draws from. One registry can back a single app (its own providers) or, in the shell, every app’s providers at once for a global Ctrl+K.
SearchResult: One typed hit produced by a SearchProvider.
Section: An intrinsic-height group of content with an optional header. See the module docs.
Selection: Anchor + cursor pair. anchor == cursor means “no live selection”.
SelectionHud: A drawn SelectionHud: its bounding rect plus the hit rects of its controls. Built fresh each frame by SelectionHud::draw; the caller either hit-tests it directly via SelectionHud::hit or folds its buttons into its own hit list via SelectionHud::buttons.
SelectionModel: Index-based multi-selection state. Indices are opaque usizes the owning widget assigns to its items (typically the row/cell order).
SelectionRange
SemanticAction: One thing an assistive client can do to a SemanticNode, addressable by a stable name.
SemanticActivity
SemanticId: Stable identity of a semantic node, preserved across refresh as long as the backing widget or resource recurs.
SemanticNode: One node of the retained semantic tree.
SemanticTree: The retained accessibility tree. Persists node identity across frames and diffs each refresh against the previous.
Shortcut: A semantic shortcut whose display and matching use platform conventions.
SparseAnchor: Stable scroll anchor captured from a model-resolved sparse viewport.
SparseVirtualViewport: Virtual geometry for collections whose logical item count is much larger than the set of resident keys.
Spring
StatSummary: For one column of measurements (a single pass, or the total), in microseconds.
State: The unified state object that holds our CRDT document.
StatusBubble: Every method takes an explicit now: Instant, so a test drives the whole show → linger → fade → hide cycle without a wall clock.
StepOutcome: One application’s outcome within a run undo.
TaskCompletion: A single-use capability returned by LatestTask::begin.
TextEdit: The splice splice_text_diffed applied, in characters — Automerge Text is char-addressed, not byte-addressed. A no-op reports {pos:0, del:0, ins:0}.
TextFlowRegion: Non-rectangular local-coordinate region used for both line fitting and exact scene clipping. Concave polygons may produce several independent spans on one baseline, allowing text to flow around an inset or cutout.
TextLayoutConstraints: Width/height offered to a pluggable text layout engine.
TextPosition: A document byte offset plus the visual side of an ambiguous boundary.
TextRenderer
TextStyle: The complete typographic style for a plain text run.
Theme
TouchPointerEmulator: Converts direct touch into the toolkit’s ordinary pointer contract.
Transition: An interruptible open/close transition tracking a 0.0..=1.0 “openness” so a surface animates in and out, and a mid-flight reversal retargets from the current value instead of snapping to 0 first.
TransitionVisual
TreeDelta: What changed between two refreshes. Ids that appear in neither list are present and byte-identical in both frames — their identity and content survived unchanged.
TypingRun: A burst of typing: every edit touches the run, and a programmatic replacement of the text closes it.
UiBuildContext: Process-local services available while compiling a serialized graph.
UiComponentRequest: Inputs passed to one app-owned serialized-graph component factory.
UiDocument
UiGraphEditor: A native, accessible object-graph editor with a live production-widget preview. It is also the root component used by the standalone UI builder.
UiGraphHandle
UiValues: A graph’s text and checked values, by each control’s value_path, and which buttons were clicked, by each button’s on_click_path.
UndoAccess: The undo half of a widget, as one embeddable field: the last UndoStatus the host published, plus at most one pending UndoRequest.
UndoEntry: One step of the history as a window shows it: the changes it brackets, where the caret was, and who made it.
UndoLog: A document’s undo, as one window drives it. See the module docs.
UndoStatus: What the live undo history can do right now, as a widget sees it.
UnknownRevision: A revision id from another document or from discarded/corrupt input.
UserId: A person’s stable id, as apps and presence spell it.
View: A participant’s View: everything about where they are looking that is never merged into anyone else’s. Every field derives Serialize/Deserialize so a future presence layer can broadcast any subset. View::default is “top of the document, nothing focused, no resource” — the correct starting point for a freshly-launched app.
ViewContribution: The typed presentation fields a widget contributes to (and has restored from) the View — its scroll offset(s) and its current view mode. Kept structured rather than folded into FocusView::ephemeral because a presence layer wants to broadcast scroll/view-mode on their own — “this peer is scrolled here, in grid mode” — independent of whether the scrolling container is the focused widget.
ViewRect: A rectangle in physical pixels — the app’s viewport at capture time.
VirtualViewport: Variable-height virtual collection geometry, keyed by model identity.
WakeEvent: A weak identity for a queued wake; it never owns an app or its scope.
WakeHandle: Captures one scope, or remains detached forever. Unlike a closed scope, detached execution may publish local/headless state without waking a host.
WakeScope: The non-clone owner of one mount incarnation. Drop closes it.
WakeScopeGuard: A thread-affine construction/dispatch guard, independent of an App borrow.
WindowAppearance: What the host showing a window knows about where, and for whom, it is shown: the temperature of the workspace the window is in and the colour of the person sitting at it. The shell resolves both and hands them to its own chrome and, over the shell-ui channel, to every app window (crate::floating_surface::FloatingSurfaceHostMessage::Appearance). A window nobody told stays neutral and wears the default colour.

Enums§

Access: How far a sandbox capability reaches into its resource.
ActionKind: What an action is able to do, derived by the framework from the action’s code and never declared by an app.
AppKind
ArgValue: An owned value to interpolate into a localized message. Owned (rather than a borrowed FluentValue) so callers — most importantly the retained-mode Text widget — can stash arguments alongside a translation key and re-format every frame without keeping the original references alive.
AuthorRelation: Who an author is to the person reading the history. Rows draw the reader’s own changes, a collaborator’s and an agent’s differently.
BaselineShift: Per-run baseline shift, for superscript / subscript runs.
CapDecision: The outcome of a sandbox check.
CapScope: What a sandbox capability ranges over.
CompareError
ControlProducerDiscipline
ControllerButton
ControllerFamily: Controller legend/layout used when rendering face buttons.
Curve: Animation easing / dynamics curve. Applied to a normalized 0..1 duration ratio to produce an interpolation factor (which may itself over/undershoot for Spring).
DialogActionOrder: Visual order of a primary confirmation and its secondary/cancel action.
DropPlacement
EditOutcome
EntryKind: What a history entry did, as the history and activity views mark, filter and group it. Read from the change itself (its entry and what it wrote), not from the transport that carried it.
FontChoice: A font family to shape with. The three generic classes resolve to the system’s default face for that class; Named targets a specific installed family by name.
FontFamily: A generic font family the toolkit can resolve from system fonts.
Granularity: Selection granularity, from the click count.
HistoryClassification
HistoryError
HudAction: The swatch index in HudAction::Highlight indexes into the swatches slice passed to SelectionHud::draw; the caller maps it back to its own colour model.
HudSide: Which side of the selection a SelectionHud prefers.
Hyphenation
I18nError
IconDescriptor: A lightweight icon descriptor usable before the full asset pipeline lands. Glyph is a Nerd Font / unicode codepoint (existing approach in both the iced file-explorer and quick-terminal). Named is a symbolic name for future theme-driven icon resolution.
InputBinding
InputDevice: Devices known to be available in this session. This is deliberately separate from InputModality: moving a mouse must not make a connected touchscreen or controller disappear from shortcut help.
InputModality: The kind of interaction most recently used.
KeyLegend
KeyboardFamily: Physical legends printed on the connected keyboard. Tilo may run on Linux with an Apple keyboard attached, so this cannot be inferred from the OS.
KeyboardModifier
KeycapLanguage: The legend language of a keyboard layout: which words are printed on its modifier and navigation keys. Layouts whose keyboards carry English legends (Dutch, Portuguese, Nordic, Swiss, Japanese) differ from US English only in naming the right Alt key Alt Gr.
LineBreakKind: Whether a UAX #14 opportunity permits or requires a break.
Motion: A caret motion. Vertical motion across wrapped lines is the host’s job because it needs laid-out line geometry; Motion::LineUp and Motion::LineDown move across \n-delimited lines only.
NameFieldOutcome: What a key did to the field.
NativeViewAccessibility: Whether AccessKit or the native child owns this view’s semantic subtree.
NavAction: Navigation history intents shared by gestures, keys, and buttons.
NavMode: What the sidebar becomes when the window is too narrow to dock it.
NavPane: A screen of the narrow push stack.
NumericStyle: Numeric glyph style requested from an OpenType face.
OpFamily: Grouping never mixes two families, so a filter chip can never empty a group while leaving its header claiming rows that are no longer shown.
OpticalSizing: Whether a variable font’s opsz axis follows the rendered font size.
PaletteMode: Which chrome the palette wears.
ParagraphAlign: Paragraph alignment, including inter-word justification.
Pass: Attributes a measured duration to the right column of the current frame’s FrameTiming.
PathSegment
PerfStep: Each step drives the headless driver and produces one or more measured frames.
PermissionScope: What a widget or a launch asks permission for.
Platform: Platform family relevant to human-interface conventions.
PointerPrecision: Accuracy of the active pointing device.
PortalOutcome: The result of a single-file portal interaction (open, or a Save destination), delivered back to the UI thread over a channel.
PresenceKey
PresencePayload
PreviewSide: Which exact frontier of a selected change or group is being previewed.
PseudoLocale: Layout-stress translation mode used by screenshots and acceptance tests. It deliberately preserves digits and punctuation while expanding letters, making clipped labels and fixed-width controls visible before translators have completed a catalog.
QueryEventChange: Result of routing an event through the shared single-line query editor.
QueryImeChange: Whether an IME event changed only the display composition or committed a new query value. Owners should re-run filtering only for Committed.
ReadingFace: A reading face the system ships, chosen by name in a theme’s type role or by a reader in an app that sets long-form text (Books). Each is set through the Reading role’s family, so its optical sizes, features and script fallbacks work like the default’s.
ReconcileError: A key appeared more than once in a reconciliation input.
RemoteCall: Where one request stands.
ResourceRef: A sandboxed resource an app might reach.
RevertError: Why a run could not be addressed at all — distinct from “addressed it and chose to keep some of it”, which is RevertOutcome::kept.
Role: A role preset. A member of a room holds one; the room keeps the grants each role carries (see crate::roles).
RouteError
SaveAction: What a person did on the save status surface.
SaveState: What a document’s save state is, as the save status surface shows it.
ScrollAlignment: Where an item should land when explicitly scrolled into view.
SearchScope
SemanticActionKind: How a SemanticAction is carried out when invoked.
Slot: A place in the document a change wrote to, at the granularity where two writers collide.
StatusOrigin
StatusSharing
StepState: What happened to one application’s share of a run.
Subject: Who a capability is about: one signing identity or a named Principal.
TextAffinity: Which shaped run owns a caret at a shared logical byte boundary.
TextAlign: Horizontal alignment of a block.
TextFlowRegionError
TextGround: The ground text is set on, as far as the face is concerned. Light ink on a dark ground loses fine hairlines first, so a family drawn in separate optical cuts keeps its sturdier text cut to larger sizes there (OpticalSizing::Auto). A theme’s roles carry its content ground; a surface that paints its own ground (a book’s page) says which it is.
TextKind: What a run of text is, so the toolkit can pick its OpenType features.
TextRole: What a piece of text is. Pick the role; never a pixel size.
TextScaling: What a TextStyle’s size (and pixel letter spacing) is measured in.
TextWeight: Named weight tiers mapping 1:1 to cosmic_text::fontdb::Weight’s numeric constants (Tailwind’s font-medium/semibold/bold), so call sites read declaratively instead of passing raw u16s.
TextWrapMode: Line selection policy for a constrained paragraph.
ThawError: Why a FreezeThaw::thaw failed. Thaw never panics — truncated or garbage bytes, an unknown version, or an unloadable state payload all surface here.
TouchGesture
TouchPointerEvent: Pointer events synthesised from direct touch, so ordinary widgets work on a touchscreen without interpreting contact streams themselves.
UiButtonRole
UiFace: A UI face the system ships, chosen by name in a theme’s type role or by the accessibility layer. Reading (ReadingFace) and code keep their own faces.
UiGraphEdit: One validated edit to a serialized UI object graph.
UiGraphError
UiNavigation: Process-local navigation requested by a button.
UiNode
UiTextRole
UiTextSource
UndoRequest: A widget’s request that the host drive the history. The host performs it through the one undo implementation; a widget never touches the stacks.
WakeBindError: Why a platform destination could not be installed.
WheelStep: What a vertical collection should do with one wheel event, decided by ScrollMomentum::wheel.

Constants§

FRAME_BUDGET_US: Rounded 60 Hz CPU-work budget. Exceeding it is a CPU diagnostic, not evidence of an actual dropped display frame.
FROZEN_VERSION: Envelope format version. Bump when the wire shape of FrozenApp changes in a way older readers cannot decode; FreezeThaw::thaw refuses a version it does not understand rather than mis-reading it.
INFERRED_STATUS_TTL: Automatic summaries go stale quickly. A stale intention is worse than no status because it makes collaborators coordinate around work that stopped.
LIVE_GRAPH_DIR_ENV: Directory of live *.json screen graphs. When set, graph apps load and hot-reload screens from disk instead of the embed baked by include_str!.
LIVE_GRAPH_OPERATION: Operation type for live graph mutations published by LiveUi.
MAX_GROUP_DEPTH: Two levels is what a reader can hold; three is a tree of edit history nobody asked for.
MAX_STATUS_CHARS: Manual statuses are explicit communication and therefore remain until the author clears them.
SUGGESTION_SETTLE: How long the word under the caret must stay the same before a field offers a spelling suggestion for it: a short pause at the end of a word, or the caret coming to rest in a word typed earlier.
UI_GRAPH_VERSION
UI_HYPERLEGIBLE_FAMILY: The built-in “Hyperlegible” UI face a theme or the accessibility layer can choose instead of UI_SANS_FAMILY.
UI_MONOSPACE_FAMILY
UI_SANS_FAMILY: Product-wide primary font families. Tilo ships these exact faces, and the renderer also assigns them to the CSS-like generic families below. Keeping the names here makes plain text, rich text, and theme tokens agree instead of depending on each machine’s fontconfig defaults.
UI_SERIF_FAMILY: The default reading face, New Computer Modern. Set in this family, text takes the cut its size calls for: the 8 pt design for footnotes, Book for body text and Regular for titles (crate::tokens::ReadingFace).

Traits§

ActivityNarrator
AppWidget: Trait every in-process app implements so the shell can host it inside a TileContent::App. AppWidget: Widget means the shell always falls through to the widget contract for layout, draw, and events.
ColorCompat
FreezeThaw: Freeze/thaw for a Tilo app, extendable at exactly one seam.
Lerp
NativeViewBackend: App/platform implementation of one native child view.
SearchProvider: A source of search results — implemented by an app for each searchable type it exposes (its contacts, its open files, its commands, …).
TextLayoutEngine: Replaceable measurement/painting boundary used by crate::widget::Text. Implementations keep localization, accessibility, Taffy integration, scene caching, and inspection supplied by the standard widget. style is always renderer-relative: implementations which delegate to TextRenderer pass it through unchanged. For theme-resolved or fixed-size widgets, Text compensates the font size for the renderer’s current multiplier before this boundary; renderer-relative letter spacing keeps its established behavior.
UiDocumentExt: Compile a validated serialized graph into ordinary Tilo widgets.
Widget

Functions§

card_column_width: The width of each of cols columns that, with gap between them, fill avail_w exactly. Never negative.
card_columns: How many columns of at least min_card_w fit in avail_w with gap between them. Always at least 1.
clipboard_copy: Push text onto the system clipboard — the Ctrl+C buffer.
clipboard_copy_image: Push an RGBA8 image (width * height * 4 bytes, row-major, no padding) onto the system clipboard as image data, so it can be pasted into an image editor or chat. Returns false when the buffer size is wrong or no backend can carry an image. Used by the PDF reader to copy a selected page region.
clipboard_copy_primary: Push text onto the primary selection — the mouse-driven “select then middle-click paste” buffer, distinct from the Ctrl+C clipboard. Terminals and editors set this whenever a range is selected so a middle-click paste in any app receives it. Goes through the same clipboard as clipboard_copy.
clipboard_paste: Pull the current clipboard contents as a UTF-8 string. Returns None when the clipboard is empty / unavailable / non-text.
clipboard_paste_image: The image on the clipboard, when another app copied one (a screenshot, an image from a viewer or a browser). None when it holds no image.
clipboard_paste_primary: Read the primary selection as a UTF-8 string — what a middle-click paste should insert. None when empty or unavailable.
compare_entries: Compare the dependency frontier immediately before the selected changes to the frontier after every selected change. Concurrent changes outside the selection are excluded. Pending edits are neither committed nor included.
compose_paragraph: Compose a paragraph globally. If the requested tolerance has no feasible solution, progressively looser emergency passes are tried; the final fallback preserves every box and always makes forward progress.
configured_font_system: Build the process’s font system: the database a host built for it when there is one, otherwise the product font catalog with the system’s fonts behind it and Tilo’s script fallback (Android copies its catalog out of the APK first). A binary run from a checkout, a screenshot and the Tilo image therefore all set text in the same faces, whether or not the machine has them installed. Only when no catalog loads does it fall back to the system’s fonts alone with the generic families pinned to the product names.
delete_last_grapheme: Backspace for text typed only at its end (a type-ahead query, a digit entry): remove the last character as a person sees it, never half of a combining sequence or an emoji. Returns whether anything was removed.
describe: Compose the spoken phrase for an accessible node — the pure, heavily unit-tested core of the screen reader.
deterministic_narrative: Privacy-preserving fallback used when no model is configured or when a generated result fails grounding validation.
discretionary_hyphen_breaks: UTF-8 byte offsets at which TeX/Liang patterns permit a discretionary hyphen for language. The source text is never modified; callers decide whether a chosen line break should paint the hyphen glyph.
ease_out: Delegates to Curve::EaseOut so there is exactly one home for the formula — retune it there and every fade/slide/spawn/snap follows.
extend_span_drag: Word/line-granularity drag extension — the shared rule behind double-click-then-drag in TextInput and the reader.
flatten_reading_order: DFS, collapsing presentational widgets (accessibility() == None) exactly as crate::accesskit_bridge::build_tree_update does.
forget_run: Remove a run record. The changes it referenced stay untouched in their own documents; only the grouping goes.
format_relative_time: Used by both widgets so the wording stays uniform with every other “time ago” label (crate::format::relative). Re-renders every frame, so the label freshens naturally as now advances — no clock plumbing needed.
grapheme_boundary_at_or_before: The nearest extended-grapheme boundary at or before byte_idx.
group_entries: Group entries (oldest first, in the producer’s causal order).
heads_for_entry: The other half of HistorySource::entries: a restore needs a document state for the HistoryEntryId a widget hands back. None when the id names no change in this document — mixed ids from two artifacts.
hue_to_rgb: HSV(h, 0.65, 0.95) → RGB. Saturation and value held constant so generated author colours stay visually coherent (no neon outliers, no muddy ones).
latest_run_by: The contiguous run of changes authored by actor_hex, ending at the document’s newest change by that actor.
line_boundaries: Byte range (start, end) of the line containing byte_idx, where lines are linefeed-delimited (\n). The end is the index of the trailing \n, or text.len() for the final line. Triple-click line selection uses this.
line_break_opportunities: Iterate byte offsets where a line may or must end according to Unicode Standard Annex #14. Every offset is a UTF-8 boundary and the final text boundary is always returned as mandatory.
local_surface_id: Public because it is half of a protocol: what a pointer published in this surface’s content coordinates is scoped to (crate::presence::PointerSpace::Surface) — both ends must spell the surface the same way by calling this same function.
next_char_boundary: Step one user-perceived character to the right of byte_idx. See prev_char_boundary for the compatibility note.
next_word_boundary: Mirror of prev_word_boundary for forward movement: the next UAX #29 word start, or the end of the string.
next_word_boundary_chars: Char index of the next word boundary at or after char_idx — the char-indexed mirror of next_word_boundary. Used to extend a reader selection rightward by a whole word (Shift+Ctrl+Right).
parse_ui_graph_edits: Parse a non-empty JSON array of tagged graph edits.
participant_display_label: Turn a durable collaboration principal into copy suitable for people-facing history and audit UI.
plan_revert: Work out what undoing run would do, without touching the document.
prev_char_boundary: Step one user-perceived character to the left of byte_idx. Extended grapheme clusters keep combining marks, emoji modifiers, flags, and ZWJ sequences together. The legacy function name is retained for API compatibility.
prev_word_boundary: Walk back to the previous UAX #29 word start. If the cursor is inside a word this returns that word’s start; at its start it returns the preceding word’s start. The result is always a UTF-8 boundary.
prev_word_boundary_chars: Char index of the previous word boundary at or before char_idx — the char-indexed mirror of prev_word_boundary. Used to extend a reader selection leftward by a whole word (Shift+Ctrl+Left).
put_text_diffed: Creates the Text object on first use (inserting the whole value); subsequent calls splice only the diff.
read_runs: Read every recorded run out of doc, oldest key first. A record that does not parse is skipped rather than guessed at: an undo affordance pointing at the wrong changes is worse than no affordance.
record_run: Record a run. Returns the document key, which is also AgentRun::id. The transaction is left open — the caller commits, so the record lands stamped and attributed like any other edit. A run with no steps is not recorded: nothing changed, so there is nothing to offer undo on.
record_run_with_details: Record a run with the task evidence needed for a later review.
refuse_run: Build the report for a run that was refused whole. Nothing was written.
resolve_theme_layers: Resolve the stack. Order, lowest first:
revert_run: Undo a run of changes by writing its inverse forward into doc.
run_scenario: The driver runs the app’s real five passes with no GPU or display, so timings are of the production code path, not a mock.
run_scenario_on: The one-call entry point for an app author or a test: no driver bookkeeping.
run_starting_at: The run whose first step starts at start, if one is recorded.
splice_text_diffed: Prefer put_text_diffed when you have a parent object + key and want the Text created on first use.
try_clipboard_copy: Copy text only if a system clipboard backend accepts it.
undo_run: Undo every step of a run, given the documents the caller could open.
undo_step: Undo one application’s share of a run against the document that app owns.
unreachable_steps: Steps whose documents this process cannot reach.
validate_narrative
version_index_for_entry
word_at_caret: The word the caret is in or just after, as a byte range: letters plus in-word apostrophes, so don't is one word. None between words.
word_boundaries: Byte range (start, end) of the UAX #29 word containing byte_idx, or the word immediately on the left when the index lands in following punctuation or whitespace. Used by double-click word selection.
word_boundaries_chars: Char range (start, end) of the word containing char_idx — the char-indexed mirror of word_boundaries. Drives double-click word selection in a reflowable reader.
workspace_hue: The neutral temperature a workspace takes from its wallpaper (RGBA8 pixels): the image’s dominant hue, or None for a wallpaper with none (a grey photograph, a missing file), which leaves the material neutral. Only the hue is taken — the material never gains chroma from a wallpaper.

Type Aliases§

CatalogueCall: A catalogue read: every page of one query, gathered.
CharFilter: A per-character admission rule (for example a spreadsheet cell-reference box that only takes [A-Za-z0-9$:]). Applied to every insertion path: typing, paste, IME preedit and commit, programmatic insertion.
Element
Fetcher: Fetches the raw encoded bytes for a URL, or None on failure. Invoked as background work, so it may block on I/O.
InvocationCall: An invocation: its latest lifecycle update.
PortalChannel: A pending single-file request: the receiver the UI thread drains each frame. Some(rx) means a picker is in flight; None means idle.

Crate tilo_app

Crate tilo_app Copy item path

Re-exports§

Modules§

Macros§

Structs§

Enums§

Constants§

Traits§

Functions§

Type Aliases§

Crate tilo_app