@exponential_app/eui 0.0.0-stage → 0.2.0

package/fixtures/host-policy.json

@@ -0,0 +1,1209 @@
+{
+  "$comment": "VAPP-91: the pure host rules (catalog/host.json functions, urls, media, sources, negotiation). Inputs hand-written; `expected` filled by the generator from src/host/{policy,sources,package}.ts. VAPP-122: `sourceParams` = sourceWithParams(source, params) → the source URI the `bind` action follows.",
+  "functions": [
+    {
+      "name": "a built-in always runs",
+      "policy": {
+        "deny": [
+          "*"
+        ]
+      },
+      "fn": "formatDate",
+      "registered": false,
+      "expected": "allow"
+    },
+    {
+      "name": "openUrl is a built-in",
+      "fn": "openUrl",
+      "registered": false,
+      "expected": "allow"
+    },
+    {
+      "name": "an unregistered name",
+      "fn": "harness.mcp",
+      "registered": false,
+      "expected": "not_found"
+    },
+    {
+      "name": "registered, no policy = allow",
+      "fn": "harness.toast",
+      "registered": true,
+      "expected": "allow"
+    },
+    {
+      "name": "a prefix ask",
+      "policy": {
+        "ask": [
+          "harness.*"
+        ]
+      },
+      "fn": "harness.mcp",
+      "registered": true,
+      "expected": "ask"
+    },
+    {
+      "name": "allow beats ask",
+      "policy": {
+        "allow": [
+          "harness.toast"
+        ],
+        "ask": [
+          "harness.*"
+        ]
+      },
+      "fn": "harness.toast",
+      "registered": true,
+      "expected": "allow"
+    },
+    {
+      "name": "deny beats allow",
+      "policy": {
+        "allow": [
+          "harness.*"
+        ],
+        "deny": [
+          "harness.mcp"
+        ]
+      },
+      "fn": "harness.mcp",
+      "registered": true,
+      "expected": "deny"
+    },
+    {
+      "name": "the default when nothing matches",
+      "policy": {
+        "allow": [
+          "harness.toast"
+        ],
+        "default": "deny"
+      },
+      "fn": "harness.openIssue",
+      "registered": true,
+      "expected": "deny"
+    },
+    {
+      "name": "a package allowlist",
+      "policy": {
+        "allow": [
+          "harness.toast",
+          "acme.*"
+        ],
+        "default": "deny"
+      },
+      "fn": "acme.refresh",
+      "registered": true,
+      "expected": "allow"
+    },
+    {
+      "name": "a star alone matches everything",
+      "policy": {
+        "ask": [
+          "*"
+        ]
+      },
+      "fn": "x",
+      "registered": true,
+      "expected": "ask"
+    }
+  ],
+  "combine": [
+    {
+      "a": "allow",
+      "b": "allow",
+      "expected": "allow"
+    },
+    {
+      "a": "allow",
+      "b": "ask",
+      "expected": "ask"
+    },
+    {
+      "a": "allow",
+      "b": "deny",
+      "expected": "deny"
+    },
+    {
+      "a": "allow",
+      "b": "not_found",
+      "expected": "not_found"
+    },
+    {
+      "a": "ask",
+      "b": "allow",
+      "expected": "ask"
+    },
+    {
+      "a": "ask",
+      "b": "ask",
+      "expected": "ask"
+    },
+    {
+      "a": "ask",
+      "b": "deny",
+      "expected": "deny"
+    },
+    {
+      "a": "ask",
+      "b": "not_found",
+      "expected": "not_found"
+    },
+    {
+      "a": "deny",
+      "b": "allow",
+      "expected": "deny"
+    },
+    {
+      "a": "deny",
+      "b": "ask",
+      "expected": "deny"
+    },
+    {
+      "a": "deny",
+      "b": "deny",
+      "expected": "deny"
+    },
+    {
+      "a": "deny",
+      "b": "not_found",
+      "expected": "not_found"
+    },
+    {
+      "a": "not_found",
+      "b": "allow",
+      "expected": "not_found"
+    },
+    {
+      "a": "not_found",
+      "b": "ask",
+      "expected": "not_found"
+    },
+    {
+      "a": "not_found",
+      "b": "deny",
+      "expected": "not_found"
+    },
+    {
+      "a": "not_found",
+      "b": "not_found",
+      "expected": "not_found"
+    }
+  ],
+  "urls": [
+    {
+      "name": "https",
+      "url": "https://exponential.at/docs",
+      "expected": {
+        "allowed": true,
+        "url": "https://exponential.at/docs"
+      }
+    },
+    {
+      "name": "mailto",
+      "url": "mailto:hi@exponential.at",
+      "expected": {
+        "allowed": true,
+        "url": "mailto:hi@exponential.at"
+      }
+    },
+    {
+      "name": "javascript is never a default scheme",
+      "url": "javascript:alert(1)",
+      "expected": {
+        "allowed": false,
+        "url": "javascript:alert(1)",
+        "reason": "scheme"
+      }
+    },
+    {
+      "name": "data is not a default scheme",
+      "url": "data:text/html,hi",
+      "expected": {
+        "allowed": false,
+        "url": "data:text/html,hi",
+        "reason": "scheme"
+      }
+    },
+    {
+      "name": "file is not a default scheme",
+      "url": "file:///etc/passwd",
+      "expected": {
+        "allowed": false,
+        "url": "file:///etc/passwd",
+        "reason": "scheme"
+      }
+    },
+    {
+      "name": "upper-case scheme",
+      "url": "HTTPS://Example.com/A",
+      "expected": {
+        "allowed": true,
+        "url": "https://example.com/A"
+      }
+    },
+    {
+      "name": "relative without a base",
+      "url": "/api/attachments/a1",
+      "expected": {
+        "allowed": false,
+        "reason": "invalid"
+      }
+    },
+    {
+      "name": "relative against the base",
+      "policy": {
+        "baseUrl": "https://app.exponential.at"
+      },
+      "url": "/api/attachments/a1",
+      "expected": {
+        "allowed": true,
+        "url": "https://app.exponential.at/api/attachments/a1"
+      }
+    },
+    {
+      "name": "a host allowlist",
+      "policy": {
+        "hosts": [
+          "exponential.at",
+          "*.exponential.at"
+        ]
+      },
+      "url": "https://ui.exponential.at/catalogs",
+      "expected": {
+        "allowed": true,
+        "url": "https://ui.exponential.at/catalogs"
+      }
+    },
+    {
+      "name": "outside the host allowlist",
+      "policy": {
+        "hosts": [
+          "exponential.at"
+        ]
+      },
+      "url": "https://evil.example/",
+      "expected": {
+        "allowed": false,
+        "url": "https://evil.example/",
+        "reason": "host"
+      }
+    },
+    {
+      "name": "a wildcard host does not match its apex",
+      "policy": {
+        "hosts": [
+          "*.exponential.at"
+        ]
+      },
+      "url": "https://exponential.at/",
+      "expected": {
+        "allowed": false,
+        "url": "https://exponential.at/",
+        "reason": "host"
+      }
+    },
+    {
+      "name": "hosts do not gate mailto",
+      "policy": {
+        "hosts": [
+          "exponential.at"
+        ]
+      },
+      "url": "mailto:a@b.c",
+      "expected": {
+        "allowed": true,
+        "url": "mailto:a@b.c"
+      }
+    },
+    {
+      "name": "a custom scheme list",
+      "policy": {
+        "schemes": [
+          "https",
+          "exponential"
+        ]
+      },
+      "url": "exponential://issue/EXP-1",
+      "expected": {
+        "allowed": true,
+        "url": "exponential://issue/EXP-1"
+      }
+    },
+    {
+      "name": "garbage",
+      "url": "::not a url",
+      "expected": {
+        "allowed": false,
+        "reason": "invalid"
+      }
+    },
+    {
+      "name": "a data url is not a link scheme",
+      "url": "data:text/html,<script>alert(1)</script>",
+      "expected": {
+        "allowed": false,
+        "url": "data:text/html,<script>alert(1)</script>",
+        "reason": "scheme"
+      }
+    },
+    {
+      "name": "a host allow-list holds for a relative href",
+      "policy": {
+        "baseUrl": "https://evil.example",
+        "hosts": [
+          "exponential.at"
+        ]
+      },
+      "url": "/x",
+      "expected": {
+        "allowed": false,
+        "url": "https://evil.example/x",
+        "reason": "host"
+      }
+    },
+    {
+      "name": "a url with balanced parentheses",
+      "url": "https://en.wikipedia.org/wiki/A_(b)",
+      "expected": {
+        "allowed": true,
+        "url": "https://en.wikipedia.org/wiki/A_(b)"
+      }
+    },
+    {
+      "name": "VAPP-107: loopback is private by default",
+      "url": "http://127.0.0.1:3000/api/attachments/a1",
+      "expected": {
+        "allowed": false,
+        "url": "http://127.0.0.1:3000/api/attachments/a1",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "localhost is private",
+      "url": "http://localhost:5173/",
+      "expected": {
+        "allowed": false,
+        "url": "http://localhost:5173/",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "a localhost subdomain is private",
+      "url": "https://app.localhost/",
+      "expected": {
+        "allowed": false,
+        "url": "https://app.localhost/",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "an IPv6 loopback is private",
+      "url": "http://[::1]:8080/",
+      "expected": {
+        "allowed": false,
+        "url": "http://[::1]:8080/",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "the unspecified addresses are private",
+      "url": "http://0.0.0.0/",
+      "expected": {
+        "allowed": false,
+        "url": "http://0.0.0.0/",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "the 10/8 block is private",
+      "url": "http://10.0.0.5/x.png",
+      "expected": {
+        "allowed": false,
+        "url": "http://10.0.0.5/x.png",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "the 172.16/12 block is private",
+      "url": "http://172.31.255.254/",
+      "expected": {
+        "allowed": false,
+        "url": "http://172.31.255.254/",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "172.32 is public",
+      "url": "http://172.32.0.1/",
+      "expected": {
+        "allowed": true,
+        "url": "http://172.32.0.1/"
+      }
+    },
+    {
+      "name": "the 192.168/16 block is private",
+      "url": "https://192.168.1.10/cam.jpg",
+      "expected": {
+        "allowed": false,
+        "url": "https://192.168.1.10/cam.jpg",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "link-local is private (the cloud metadata endpoint)",
+      "url": "http://169.254.169.254/latest/meta-data/",
+      "expected": {
+        "allowed": false,
+        "url": "http://169.254.169.254/latest/meta-data/",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "IPv6 link-local is private",
+      "url": "http://[fe80::1]/",
+      "expected": {
+        "allowed": false,
+        "url": "http://[fe80::1]/",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "IPv6 unique-local is private",
+      "url": "http://[fd12:3456::1]/",
+      "expected": {
+        "allowed": false,
+        "url": "http://[fd12:3456::1]/",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "an IPv4-mapped IPv6 address of a private IPv4 is private",
+      "url": "http://[::ffff:127.0.0.1]/",
+      "expected": {
+        "allowed": false,
+        "url": "http://[::ffff:7f00:1]/",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "a decimal IPv4 form normalizes before the check",
+      "url": "http://2130706433/",
+      "expected": {
+        "allowed": false,
+        "url": "http://127.0.0.1/",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "a hex IPv4 form normalizes before the check",
+      "url": "http://0xc0.0xa8.1.1/",
+      "expected": {
+        "allowed": false,
+        "url": "http://192.168.1.1/",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "a .local name is private",
+      "url": "http://printer.local/status.png",
+      "expected": {
+        "allowed": false,
+        "url": "http://printer.local/status.png",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "release train 2026-10-23: the CGNAT block is private",
+      "url": "http://100.64.0.1/",
+      "expected": {
+        "allowed": false,
+        "url": "http://100.64.0.1/",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "the CGNAT block's top edge is private",
+      "url": "http://100.127.255.255/",
+      "expected": {
+        "allowed": false,
+        "url": "http://100.127.255.255/",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "just below CGNAT is public",
+      "url": "http://100.63.255.255/",
+      "expected": {
+        "allowed": true,
+        "url": "http://100.63.255.255/"
+      }
+    },
+    {
+      "name": "just above CGNAT is public",
+      "url": "http://100.128.0.1/",
+      "expected": {
+        "allowed": true,
+        "url": "http://100.128.0.1/"
+      }
+    },
+    {
+      "name": "an IPv4-compatible IPv6 address of a private IPv4 is private",
+      "url": "http://[::7f00:1]/",
+      "expected": {
+        "allowed": false,
+        "url": "http://[::7f00:1]/",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "a NAT64 address of a private IPv4 is private",
+      "url": "http://[64:ff9b::127.0.0.1]/",
+      "expected": {
+        "allowed": false,
+        "url": "http://[64:ff9b::7f00:1]/",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "a 6to4 address of a private IPv4 is private",
+      "url": "http://[2002:7f00:1::]/",
+      "expected": {
+        "allowed": false,
+        "url": "http://[2002:7f00:1::]/",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "a 6to4 address of a public IPv4 is public",
+      "url": "http://[2002:808:808::1]/",
+      "expected": {
+        "allowed": true,
+        "url": "http://[2002:808:808::1]/"
+      }
+    },
+    {
+      "name": "a NAT64 address of a public IPv4 is public",
+      "url": "http://[64:ff9b::808:808]/",
+      "expected": {
+        "allowed": true,
+        "url": "http://[64:ff9b::808:808]/"
+      }
+    },
+    {
+      "name": "a public address is not private",
+      "url": "http://8.8.8.8/",
+      "expected": {
+        "allowed": true,
+        "url": "http://8.8.8.8/"
+      }
+    },
+    {
+      "name": "a public name is not resolved",
+      "url": "https://intranet.corp.example/",
+      "expected": {
+        "allowed": true,
+        "url": "https://intranet.corp.example/"
+      }
+    },
+    {
+      "name": "a relative url against a private base is private",
+      "policy": {
+        "baseUrl": "http://localhost:3000"
+      },
+      "url": "/api/attachments/a1",
+      "expected": {
+        "allowed": false,
+        "url": "http://localhost:3000/api/attachments/a1",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "the host opts localhost back in",
+      "policy": {
+        "allowPrivate": [
+          "localhost"
+        ]
+      },
+      "url": "http://localhost:3000/api/attachments/a1",
+      "expected": {
+        "allowed": true,
+        "url": "http://localhost:3000/api/attachments/a1"
+      }
+    },
+    {
+      "name": "an opt-in for one host does not cover another",
+      "policy": {
+        "allowPrivate": [
+          "localhost"
+        ]
+      },
+      "url": "http://127.0.0.1:3000/",
+      "expected": {
+        "allowed": false,
+        "url": "http://127.0.0.1:3000/",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "an opt-in by suffix",
+      "policy": {
+        "allowPrivate": [
+          "*.local"
+        ]
+      },
+      "url": "http://printer.local/",
+      "expected": {
+        "allowed": true,
+        "url": "http://printer.local/"
+      }
+    },
+    {
+      "name": "a star opts every private address in",
+      "policy": {
+        "allowPrivate": [
+          "*"
+        ]
+      },
+      "url": "http://10.0.0.5/",
+      "expected": {
+        "allowed": true,
+        "url": "http://10.0.0.5/"
+      }
+    },
+    {
+      "name": "a hosts allowlist does not opt a private host in",
+      "policy": {
+        "hosts": [
+          "localhost"
+        ]
+      },
+      "url": "http://localhost/",
+      "expected": {
+        "allowed": false,
+        "url": "http://localhost/",
+        "reason": "private"
+      }
+    },
+    {
+      "name": "outside the allowlist reads host before private",
+      "policy": {
+        "hosts": [
+          "exponential.at"
+        ]
+      },
+      "url": "http://localhost/",
+      "expected": {
+        "allowed": false,
+        "url": "http://localhost/",
+        "reason": "host"
+      }
+    },
+    {
+      "name": "mailto is never private",
+      "url": "mailto:root@localhost",
+      "expected": {
+        "allowed": true,
+        "url": "mailto:root@localhost"
+      }
+    },
+    {
+      "name": "a custom scheme is never private",
+      "policy": {
+        "schemes": [
+          "exponential"
+        ]
+      },
+      "url": "exponential://localhost/issue/EXP-1",
+      "expected": {
+        "allowed": true,
+        "url": "exponential://localhost/issue/EXP-1"
+      }
+    },
+    {
+      "name": "https only",
+      "policy": {
+        "schemes": [
+          "https"
+        ]
+      },
+      "url": "http://exponential.at/",
+      "expected": {
+        "allowed": false,
+        "url": "http://exponential.at/",
+        "reason": "scheme"
+      }
+    },
+    {
+      "name": "https only keeps https",
+      "policy": {
+        "schemes": [
+          "https"
+        ]
+      },
+      "url": "https://exponential.at/",
+      "expected": {
+        "allowed": true,
+        "url": "https://exponential.at/"
+      }
+    },
+    {
+      "name": "https only drops mailto and tel",
+      "policy": {
+        "schemes": [
+          "https"
+        ]
+      },
+      "url": "tel:+4312345",
+      "expected": {
+        "allowed": false,
+        "url": "tel:+4312345",
+        "reason": "scheme"
+      }
+    }
+  ],
+  "media": [
+    {
+      "name": "relative attachment gets the bearer",
+      "options": {
+        "baseUrl": "https://app.exponential.at",
+        "rules": [
+          {
+            "prefix": "https://app.exponential.at/api/attachments/",
+            "headers": {
+              "authorization": "Bearer expu_test"
+            }
+          }
+        ]
+      },
+      "url": "/api/attachments/a1?poster=1",
+      "expected": {
+        "url": "https://app.exponential.at/api/attachments/a1?poster=1",
+        "headers": {
+          "authorization": "Bearer expu_test"
+        }
+      }
+    },
+    {
+      "name": "another origin gets nothing",
+      "options": {
+        "baseUrl": "https://app.exponential.at",
+        "rules": [
+          {
+            "prefix": "https://app.exponential.at/api/",
+            "headers": {
+              "authorization": "Bearer t"
+            }
+          }
+        ]
+      },
+      "url": "https://cdn.example/x.png",
+      "expected": {
+        "url": "https://cdn.example/x.png",
+        "headers": {}
+      }
+    },
+    {
+      "name": "later rules win per header",
+      "options": {
+        "rules": [
+          {
+            "prefix": "https://a.example/",
+            "headers": {
+              "x-a": "1",
+              "x-b": "1"
+            }
+          },
+          {
+            "prefix": "https://a.example/p/",
+            "headers": {
+              "x-b": "2"
+            }
+          }
+        ]
+      },
+      "url": "https://a.example/p/q.png",
+      "expected": {
+        "url": "https://a.example/p/q.png",
+        "headers": {
+          "x-a": "1",
+          "x-b": "2"
+        }
+      }
+    },
+    {
+      "name": "relative without a base",
+      "options": {},
+      "url": "x.png",
+      "expected": null
+    },
+    {
+      "name": "javascript is never a media scheme",
+      "options": {},
+      "url": "javascript:alert(1)",
+      "expected": null
+    },
+    {
+      "name": "file is denied by default",
+      "options": {},
+      "url": "file:///etc/passwd",
+      "expected": null
+    },
+    {
+      "name": "a relative path against a file base stays denied",
+      "options": {
+        "baseUrl": "file:///Users/me/"
+      },
+      "url": "/etc/passwd",
+      "expected": null
+    },
+    {
+      "name": "file only when the host lists it",
+      "options": {
+        "schemes": [
+          "file"
+        ]
+      },
+      "url": "file:///tmp/a.png",
+      "expected": {
+        "url": "file:///tmp/a.png",
+        "headers": {}
+      }
+    },
+    {
+      "name": "a data image",
+      "options": {},
+      "url": "data:image/png;base64,iVBORw0KGgo=",
+      "expected": {
+        "url": "data:image/png;base64,iVBORw0KGgo=",
+        "headers": {}
+      }
+    },
+    {
+      "name": "the media host allow-list",
+      "options": {
+        "hosts": [
+          "*.exponential.at"
+        ]
+      },
+      "url": "https://cdn.example/x.png",
+      "expected": null
+    },
+    {
+      "name": "an allowed media host",
+      "options": {
+        "hosts": [
+          "*.exponential.at"
+        ],
+        "rules": [
+          {
+            "prefix": "https://app.exponential.at/",
+            "headers": {
+              "authorization": "Bearer t"
+            }
+          }
+        ]
+      },
+      "url": "https://app.exponential.at/a.png",
+      "expected": {
+        "url": "https://app.exponential.at/a.png",
+        "headers": {
+          "authorization": "Bearer t"
+        }
+      }
+    },
+    {
+      "name": "VAPP-107: a camera on the LAN is denied",
+      "options": {},
+      "url": "http://192.168.1.10/cam.jpg",
+      "expected": null
+    },
+    {
+      "name": "a loopback poster is denied",
+      "options": {
+        "baseUrl": "http://127.0.0.1:3000"
+      },
+      "url": "/api/attachments/a1?poster=1",
+      "expected": null
+    },
+    {
+      "name": "the dev app opts its own origin in",
+      "options": {
+        "baseUrl": "http://localhost:3000",
+        "allowPrivate": [
+          "localhost"
+        ],
+        "rules": [
+          {
+            "prefix": "http://localhost:3000/api/attachments/",
+            "headers": {
+              "authorization": "Bearer expu_dev"
+            }
+          }
+        ]
+      },
+      "url": "/api/attachments/a1",
+      "expected": {
+        "url": "http://localhost:3000/api/attachments/a1",
+        "headers": {
+          "authorization": "Bearer expu_dev"
+        }
+      }
+    },
+    {
+      "name": "the opt-in does not widen to the LAN",
+      "options": {
+        "baseUrl": "http://localhost:3000",
+        "allowPrivate": [
+          "localhost"
+        ]
+      },
+      "url": "http://192.168.1.10/cam.jpg",
+      "expected": null
+    },
+    {
+      "name": "a data image is never private",
+      "options": {},
+      "url": "data:image/png;base64,iVBORw0KGgo=",
+      "expected": {
+        "url": "data:image/png;base64,iVBORw0KGgo=",
+        "headers": {}
+      }
+    },
+    {
+      "name": "https-only media",
+      "options": {
+        "schemes": [
+          "https"
+        ]
+      },
+      "url": "http://cdn.example/x.png",
+      "expected": null
+    },
+    {
+      "name": "a CGNAT poster is denied",
+      "options": {},
+      "url": "http://100.100.100.100/poster.jpg",
+      "expected": null
+    }
+  ],
+  "sources": [
+    {
+      "uri": "exp:issues?board=b1&limit=20",
+      "expected": {
+        "uri": "exp:issues?board=b1&limit=20",
+        "scheme": "exp",
+        "name": "issues",
+        "params": {
+          "board": "b1",
+          "limit": "20"
+        }
+      }
+    },
+    {
+      "uri": "exp:devices",
+      "expected": {
+        "uri": "exp:devices",
+        "scheme": "exp",
+        "name": "devices",
+        "params": {}
+      }
+    },
+    {
+      "uri": "EXP:Members?team=t%201",
+      "expected": {
+        "uri": "EXP:Members?team=t%201",
+        "scheme": "exp",
+        "name": "Members",
+        "params": {
+          "team": "t 1"
+        }
+      }
+    },
+    {
+      "uri": "exp:issues?q=a+b&q=c",
+      "expected": {
+        "uri": "exp:issues?q=a+b&q=c",
+        "scheme": "exp",
+        "name": "issues",
+        "params": {
+          "q": "c"
+        }
+      }
+    },
+    {
+      "uri": "exp:records?vapp=v1&kind=recipe&empty=&flag",
+      "expected": {
+        "uri": "exp:records?vapp=v1&kind=recipe&empty=&flag",
+        "scheme": "exp",
+        "name": "records",
+        "params": {
+          "empty": "",
+          "flag": "",
+          "kind": "recipe",
+          "vapp": "v1"
+        }
+      }
+    },
+    {
+      "uri": "acme.data:list/items?x=%E2%9C%93",
+      "expected": {
+        "uri": "acme.data:list/items?x=%E2%9C%93",
+        "scheme": "acme.data",
+        "name": "list/items",
+        "params": {
+          "x": "✓"
+        }
+      }
+    },
+    {
+      "uri": "exp:",
+      "expected": null
+    },
+    {
+      "uri": "noscheme",
+      "expected": null
+    },
+    {
+      "uri": "1exp:issues",
+      "expected": null
+    },
+    {
+      "uri": "exp:issues?bad=%zz",
+      "expected": {
+        "uri": "exp:issues?bad=%zz",
+        "scheme": "exp",
+        "name": "issues",
+        "params": {
+          "bad": "%zz"
+        }
+      }
+    }
+  ],
+  "negotiation": [
+    {
+      "extensionIds": [],
+      "expected": {
+        "supportedCatalogIds": [
+          "https://ui.exponential.at/catalogs/core/v1",
+          "https://ui.exponential.at/catalogs/core-lite/v1",
+          "https://a2ui.org/specification/v0_9/basic_catalog.json"
+        ],
+        "clientCapabilities": {
+          "v0.9": {
+            "supportedCatalogIds": [
+              "https://ui.exponential.at/catalogs/core/v1",
+              "https://ui.exponential.at/catalogs/core-lite/v1",
+              "https://a2ui.org/specification/v0_9/basic_catalog.json"
+            ]
+          }
+        }
+      }
+    },
+    {
+      "extensionIds": [
+        "https://ui.exponential.at/catalogs/exponential-app/v1"
+      ],
+      "expected": {
+        "supportedCatalogIds": [
+          "https://ui.exponential.at/catalogs/core/v1",
+          "https://ui.exponential.at/catalogs/core-lite/v1",
+          "https://a2ui.org/specification/v0_9/basic_catalog.json",
+          "https://ui.exponential.at/catalogs/exponential-app/v1"
+        ],
+        "clientCapabilities": {
+          "v0.9": {
+            "supportedCatalogIds": [
+              "https://ui.exponential.at/catalogs/core/v1",
+              "https://ui.exponential.at/catalogs/core-lite/v1",
+              "https://a2ui.org/specification/v0_9/basic_catalog.json",
+              "https://ui.exponential.at/catalogs/exponential-app/v1"
+            ]
+          }
+        }
+      }
+    },
+    {
+      "extensionIds": [
+        "https://acme.example/catalog/v1",
+        "https://acme.example/catalog/v1",
+        "https://ui.exponential.at/catalogs/core/v1"
+      ],
+      "expected": {
+        "supportedCatalogIds": [
+          "https://ui.exponential.at/catalogs/core/v1",
+          "https://ui.exponential.at/catalogs/core-lite/v1",
+          "https://a2ui.org/specification/v0_9/basic_catalog.json",
+          "https://acme.example/catalog/v1"
+        ],
+        "clientCapabilities": {
+          "v0.9": {
+            "supportedCatalogIds": [
+              "https://ui.exponential.at/catalogs/core/v1",
+              "https://ui.exponential.at/catalogs/core-lite/v1",
+              "https://a2ui.org/specification/v0_9/basic_catalog.json",
+              "https://acme.example/catalog/v1"
+            ]
+          }
+        }
+      }
+    }
+  ],
+  "sourceParams": [
+    {
+      "source": "exp:records?kind=entry",
+      "params": {
+        "month": "2026-10"
+      },
+      "expected": "exp:records?kind=entry&month=2026-10"
+    },
+    {
+      "source": "exp:records",
+      "params": {
+        "mine": true,
+        "kind": "entry",
+        "limit": 50
+      },
+      "expected": "exp:records?kind=entry&limit=50&mine=true"
+    },
+    {
+      "source": "exp:issues?board=b1",
+      "params": {
+        "board": "b2"
+      },
+      "expected": "exp:issues?board=b1&board=b2"
+    },
+    {
+      "source": "exp:x",
+      "params": {
+        "q": "a b&c=d/ü",
+        "skip": null,
+        "gone": null
+      },
+      "expected": "exp:x?q=a%20b%26c%3Dd%2F%C3%BC"
+    },
+    {
+      "source": "exp:x",
+      "params": {},
+      "expected": "exp:x"
+    },
+    {
+      "source": "exp:x",
+      "params": {
+        "tags": [
+          "a",
+          "b"
+        ],
+        "opts": {
+          "k": 1
+        }
+      },
+      "expected": "exp:x?opts=%7B%22k%22%3A1%7D&tags=%5B%22a%22%2C%22b%22%5D"
+    },
+    {
+      "source": "exp:x?",
+      "params": {
+        "a": "1"
+      },
+      "expected": "exp:x?&a=1"
+    }
+  ]
+}