1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
//! rightkit-control: drive a real desktop app like a human, in the background.
//!
//! macOS: embedded targets receive main-thread AppKit `NSEvent`s through the
//! WKWebView responder, including hidden, non-key windows. Non-embedded targets
//! use per-pid `CGEventPostToPid` (never the global HID tap); inactive-window
//! first-mouse handling can discard their press. Neither path activates apps
//! or moves the user's cursor.
//! State is read through the Accessibility API and window captures.
//!
//! Control-plane guarantees (CodeRight EFF-001 / PTY-002):
//! - [`admission::EffectGate`]: every effectful request is validated, approved
//! by a host [`admission::AdmissionHook`], executed, and settled; a denial
//! happens before any side effect.
//! - [`lease::InputLease`]: input carries `(epoch, sequence)`; stale epochs are
//! fenced, duplicates are deduplicated, unacknowledged input must be
//! explicitly reconciled. [`lease::ControlSession`] composes both.
//! - [`events::ControlEvent`]: content-free lifecycle events for the journal.
//!
//! - [`lease_store`]: optional durable lease state (store trait plus an
//! atomic file store), execution identity and `Running | Exited | Unknown`.
//!
//! Every effectful entry point routes through the gate: `webdriver::Server`,
//! the `tauri-plugin` server, `mac::Gated` and the `rightkit-control` CLI
//! ([`cli`]). The raw macOS primitives are reachable only through the
//! explicitly named `mac::unsafe_ungated` opt-in.