Module system 

Native and browser system-search policy. Activation payloads remain host-owned.

Modules

filters

The native system-search filter strip: paint, hit targets and accessibility.

Structs

KindGroup

One contiguous run of same-kind results, as group_by_kind arranges them.

Query

Registry

Registration order survives equal-strength ties. Borrowed registrations also support query-scoped native adapters without transferring retained provider ownership.

SearchBudget

Hard ceilings for one provider page. These are deliberately expressed in the protocol rather than as palette constants: the same limits protect the visual palette, headless agents, and a future remote directory source. A provider may stop sooner, but must never exceed any non-zero ceiling.

SearchCursor

An opaque provider-owned continuation. The revision is carried alongside the provider-local payload, so a result page can never silently advance across a changed ordering.

SearchPage

One bounded answer from a Provider. stale_cursor is a protocol outcome rather than an empty page: callers restart explicitly, preserving the distinction between “there are no more hits” and “the source changed while you were paging”.

Enums

Availability

How far a hit is from the person: what they have, an app Tilo opens at once, or an app they would first have to install. A property of the hit, set by the provider that knows it, and read by the merge (order_hits): what the person has ranks by match quality; the Store’s offers follow it, however well their names match, the Tilo apps that just open before the third-party apps whose Store page they would first install. Each band is ordered among its own kind by match quality and still listed.

ResourceKind

One well-known category a result can belong to — the domain vocabulary the chip strip and grouping use. Providers pick from it or, via ResourceKind::Custom, mint a new one.

Constants

ACTIVE_APP_PROXIMITY_BOOST

A deliberately small contextual preference: proximity should settle close matches, never make a weak metadata hit beat an exact visible title.

FILLER_WORDS

Words a query is never required to match: possessives and filler (“my mails”, “all the notes”, “videos of ”). The published resources on a person’s search are theirs to read, so “my” narrows nothing further; it is dropped with the rest.

MAX_PROVIDER_SCORE

Top of every provider’s ranker-derived score.

PACKAGE_ID_WEIGHT

The package id in full names exactly one app, so an exact id is as strong as the name; a shared id prefix names a publisher and stays below an exact name.

PALETTE_ROW_BUDGET

Traits

Provider

Typed fanout boundary. The host supplies retained providers and activation payloads.

SearchRow

Portable display metadata; implement on a host row without moving its callbacks.

Functions

a_row_a_person_can_take

Whether a person may take spec from a palette row now: offered to people, available in the window’s state, and asking no more than a row can collect (tilo_actions::ActionSpec::takes_a_row_answer).

action_ranks

What a tier earns in an action’s fields: the usual ranks, except that an action’s keywords are the other words people use for it (“power off” for Shut down, “mkdir” for New folder), so a keyword typed whole ranks as the start of the action’s title, as an app’s other names rank as its name (application_ranks). A keyword only begun keeps a keyword’s rank: “bat” is not yet “battery saver”.

action_search_fields

What an app-published action is found by, as every search ranks it: its label names it, the other words its declaration gives name it as people say it (“mkdir” for New folder), and the resource it acts on narrows it. Its id and its resource’s kind are names for code: an item’s kind is the collection’s field (so.tilo.chat.messages), so matching it would offer every action on every message for “messages”.

actions_found_by

The actions of actions a search for query finds, best first, on action_search_fields: what an app’s test asserts to pin the words people use for its actions (“mkdir”) to the action they mean.

application_fields

An app’s searchable fields: its name, the words it is known by and what kind of app it is. The package id in full, or its last segment, identifies exactly one app and weighs as its name — hex-editor typed for so.tilo.hex-editor is the app’s identity and must outrank an incidental substring. Category ranks below the id because it’s a bucket, not an identity, but is still a name for the app (“office” is Notes). Prose an app says of itself — a tagline, a description, what it runs on — is not: a person typing a word has it in mind, and an app’s blurb holds most words at once.

application_intent_boost

How much more an application hit is worth at the merge than its field rank says, because a person who types what an app is called, or a word it is known by, wants to open it: a perfect name match is launch intent; an exact alias or keyword (“youtube” for a video app) is the same intent reached by another word and must still lead the notes and files that merely contain it; a keyword or name that only begins or contains the query is weaker and ranks by its score alone.

application_ranks

What a tier earns in an app’s fields: an app is found by the words that name it begun, never by a word that merely holds them. A typo, words spread over its fields, or the query inside a longer word each find half the catalogue (“nodes”, “note pad”, “footnotes”), so an app row needs a word it is named by to start with what was typed — its name, an alias, its kind. Inside those fields an app’s keywords are its other names (Finder and Explorer are Files, Task Manager is System Monitor), so a keyword typed whole or begun ranks like the start of its name: “explo” is already Files, ahead of every file that merely starts with it.

application_search_fields

An app’s application_fields plus what else people call it: each of its keywords (aliases, synonyms, the products it stands in for, in every language its manifest gives), its names in other languages as the name itself, and the initials of its name (wp for Word Processor).

command_entries

group

group_by_kind

Ranked hits arranged into contiguous per-kind groups and trimmed to a row_budget shared round-robin (trim_groups): a palette paints ~10 rows, and an outscoring kind (forty file hits) can otherwise push a correctly-ranked app off the bottom. A lone group is exempt — narrowing to one kind means “show me all of these”. A zero budget keeps everything.

icon_for_kind

lexical_strength

Provider-independent lexical fit used at the global merge boundary. A provider still contributes domain knowledge through its normalized score, but an exact visible title must beat a weak metadata/fuzzy match from a different source.

merged_strength

One hit’s strength against every other provider’s: its lexical fit, its provider’s normalized score, launch intent for an application match (application_intent_boost), and the caller’s contextual proximity boost.

order_by_kind

Order merged hits: groups by how well their best member matched, then the fixed kind order, then strength within a group. Enter activates the top row, so an app’s name must not open an action that merely mentions the word. The sort is stable: equally strong hits keep their provider’s own order rather than being re-alphabetised by title.

order_hits

order_by_kind within each Availability::band: every hit the person can open now, ordered as order_by_kind orders them, then the apps they would have to install first, ordered the same way among themselves. Hits of one kind in different bands are separate groups.

provider_score

A field rank on the provider scale. A title prefix is already a perfect hit for a provider — it is what a person types to launch or open something — so the scale tops out there; lexical_strength still separates an exact title from a prefix across providers.

query_input_is_bounded

rank

Rows from providers with their declared top score, ordered by their normalized score on order_by_kind.

rank_action_fields

How well needle names an action by its fields, on action_ranks: rank_fields for an action.

rank_actions_fields

rank_action_fields for every action of a list at once, row for row: the list is indexed once, so ranking a session’s hundreds of published actions costs one index, not one per action.

rank_fields

The shared ranker’s rank of fields for needle, on the provider scale.

scope_allows

Whether a search of scope asks the provider provider_id: only a search of one app narrows, to that app’s own providers and the ones that keep to the app in front. Nothing focused widens it to every provider rather than emptying it.

show_all_entry

The row under a group trim_groups cut short that lists the rest of it in place: “Show all 59”. Its host handles choosing it by id, by expanding the group’s kind. Without it a palette says “Applications 59” and offers four, and the rest are only reachable by already knowing their names.

starting_point_rank

Product-owned ordering for the empty Applications palette. Search queries continue to rank purely by match quality; this only prevents a fresh system from presenting forty alphabetised tools as though they were equally likely starting points. The first group is deliberately useful to curious tinkerers without assuming they are developers. Higher first.

trim_groups

Keep each group to a fair share of row_budget rows, round-robin from the front, except the kinds in expanded, which keep every row. A group that lost rows keeps its total, so its header and its show_all_entry can say how many there are. A lone group, or a zero budget, keeps everything.

type_match_score

How well needle names a resource by what it is (tilo_actions::ResourceType): a word naming its type’s noun or plural, or its app’s name, matches it whatever it is called, and the rest of the query must match its text, which text ranks (on the provider scale). A word naming another type of its app (kin, each type’s noun) is about the app’s things and need not match either: “videos of ” finds the channel by its name. None when no word names what it is, or the rest names nothing of it.

type_match_score_with

type_match_score, with the words its app is known by besides its title (keywords: the registry’s “youtube”, “channel”, “subscription” for Tube). A word naming one of them names the app: “youtube videos of mkbhd” is a Channel of the YouTube client, whose title as published is Tube. What only names an app (by its title or a keyword) without naming the type scores as the app’s name does.

without_filler

needle without its FILLER_WORDS: what every source is asked. A query of filler alone is asked as typed (“the” may be all the person remembers of a title).

Type Aliases

RankField

One searchable field and its weight, as the shared ranker takes it.