Reference editor research preview
The editor is an executable conformance and research instrument, not the owner
of the NUIF data model. Its 0.1.0-alpha.N versions describe application
maturity and do not assign a maturity level to the draft specification. The
native Masonry shell and headless driver edit NUIF through the same semantic
operation API available to the CLI and automated clients.
The executable profile-zero shell provides a file menu for native document import/save, PNG export, and the repository’s declared SVG, HTML/CSS, DTCG, Penpot, static React JSX and static Svelte profile adapters. A foreign import is bounded before parsing, presents its fidelity summary before opening as a new unsaved NUIF document, and leaves the active document untouched when parsing or confirmation fails. A foreign export writes a sibling .report.json fidelity record. The shell also provides page creation, layer and component browsing, identity-backed canvas selection, frame/rectangle/ellipse/path/text insertion, subtree duplication and deletion, undo/redo, evaluation-width presets, zoom, panel visibility and a command palette. The canvas opens with a document-aligned background grid, pixel rulers and explicit px measurement labels; grid and rulers can be toggled independently. Move-tool drags author whole-pixel-snapped freeform positions or same-parent Stack/Flex order, while resolved selection handles author bounded fixed sizes and anchored freeform positions in one transaction. Its inspector authors names, positions, sizing intents, stack/flex layout, gaps, four-edge padding, alignment, bounded explicit Grid tracks/flow/placement/spans, solid fills and pinned-font text. Multi-field Apply is one atomic transaction.
Run cargo run --locked -p nuif-editor to open the native editor from a checkout. The canonical persistent path is cargo xtask editor-install --user --channel source; tagged source uses the alpha channel. Update, doctor, rollback and uninstall remain explicit checkout-owned operations. See INSTALLING.md for the verified source lifecycle and user-owned platform paths. The same editor binary accepts --headless --script <jsonl> with either direct command records or entity-bound action records. Its accessibility surface supports selection plus name, size intent, position, layout spacing, solid fill and text edits; undo/redo patches are logged too, and every run replays the complete mutation log from the opening document and requires the final hashes to match. Document reads share the 16 MiB profile limit; scripts are capped at 8 MiB, 100,000 commands and 64 KiB per line before JSON parsing.
cargo xtask editor-gui-trial drives the real AccessKit nodes of the native shell and derives pointer paths from resolved entity geometry rather than hard-coded screen coordinates. It exercises freeform move, north-west resize, responsive Stack reorder, undo and redo; independently replays the operation log; renders the complete 1280×800 Masonry tree through the CPU harness twice; and requires identical canonical, replay, shell, menu and document hashes. It emits the screenshot, canonical output, semantic-node inventory and machine-readable report under target/editor-gui-trial/. The full shell is specified in UI-SPEC.md; a Svelte 5 shell over WASM remains a later browser demonstration.
Snapshots reject zero dimensions, an edge above 4,096 pixels or more than
16,777,216 pixels before layout or raster allocation. Accessibility and
inspector numeric inputs reject non-finite values for fixed, percentage and
fit-content sizes, positions, spacing and text metrics. cargo xtask editor-hostile-inputs checks those boundaries together with missing semantic
nodes, atomic multi-operation failure, empty history, redo invalidation and
complete operation-log replay; it writes
target/editor-hostile-input-report.json.
Opening a package is not a capability grant. Packages with no required
capabilities remain editable and preserve their verified embedded resources.
A package requiring behavior or another capability the reference editor does
not implement opens structurally in persistent read-only mode. Selection,
inspection, static snapshots and byte-exact Save As remain available; semantic
commands, accessibility mutations, undo/redo mutation and a changed package
save fail with the exact missing set. cargo xtask editor-hostile-inputs
exercises both the driver and save boundary so opaque resources cannot be
silently rebound to an unvalidated document revision.
The draft UI-SPEC.md is broader than executable profile zero. Multi-selection, cross-parent/tree drag, Grid/Constraint reorder, persisted aspect-ratio constraints, object smart guides, managed leading-edge resize, in-editor token editing, component authoring, advanced paint/effects, arbitrary foreign formats and non-PNG rendering export remain gated on corresponding model, protocol, layout, adapter or renderer profiles. The shell does not present inert controls for those features.
Use cargo xtask editor-package to build and verify the native package for the host platform, or cargo xtask editor-launch to package and open it without installation. macOS produces NUIF Editor.app, Windows produces a GUI-subsystem executable, and Linux produces a relocatable desktop application directory. Version tags produce five GitHub prerelease archives with checksums and provenance attestations. Those archives are release evidence and an expert opt-in path; developer installation builds locally according to ADR 0009. See INSTALLING.md, PACKAGING.md and docs/VERSIONING.md.