Copyright (C) 2026 WEFT OS contributors Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice (including the next paragraph) shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. This protocol defines the boundary between weft-compositor and weft-servo-shell. It allows the shell to manage window slots on behalf of application surfaces that the compositor owns. The shell binds the weft_shell_manager_v1 global once per connection. The manager creates weft_shell_window_v1 objects, each representing one visual window slot. The compositor is authoritative for geometry, focus, and stacking. The shell is authoritative for window metadata, chrome layout, and the decision to create or destroy a window slot. Warning: This protocol is unstable and subject to change before version 1 is finalized. Clients must check the version advertised by the compositor and handle unknown events gracefully. Bound once by weft-servo-shell. The manager owns the shell session. If the binding is destroyed the compositor invalidates all window objects that were created through it. Destroys the manager. All weft_shell_window_v1 objects created through this manager become inert. The compositor will emit window_closed on each before processing the destructor. Creates a new window slot. The compositor assigns the protocol object identity; no separate window_id is exchanged. The compositor will emit configure on the new object to communicate the effective initial geometry and state. Represents one visual window. The compositor controls the effective geometry, stacking, and focus state. The shell controls metadata and may request geometry changes; the compositor may reject or adjust such requests. A window object becomes inert after window_closed is received. The shell must call destroy on an inert object as soon as possible. Destroys the window object. If the window is still alive the compositor will remove the corresponding window slot from the display. The shell must not send requests on this object after calling destroy. Updates advisory metadata. The compositor may use these values in window decorations or accessibility trees. Updates are not authoritative for policy decisions. Asks the compositor to change the window geometry. The compositor validates the request against output bounds and current policy. The compositor is not required to honor the exact values. A configure event will be sent with the effective geometry that results. Sent by the compositor when the effective geometry or state changes. The shell must treat this as authoritative and update its DOM layout to match. The shell must ack each configure event by sending an update_metadata request or by doing nothing if no metadata changed; no explicit ack request is defined in version 1. Sent when surface-level focus changes for this window slot. The shell updates visual focus state in its DOM but does not override compositor focus policy. Sent by the compositor when the window object is being invalidated. After this event the shell must call destroy on the object. Any request sent after window_closed is a protocol error. Sent after a frame containing this window's content is presented to the output. Allows the shell to align animations and resize flows with compositor timing. tv_sec and tv_nsec are wall-clock values from the compositor's monotonic clock. refresh is the output refresh interval in nanoseconds; 0 if unknown. Sent to panel windows only when the compositor recognizes a multi-touch gesture as a navigation intent rather than a standard pointer gesture. The shell uses this to present the launcher, switch applications, or perform other system-level transitions. type values: 0 = swipe, 1 = pinch, 2 = hold. dx and dy are total displacement in logical pixels at gesture end. The compositor only emits this after the gesture has ended and met the recognition threshold.