@zappdev/cli 0.1.1 → 0.2.0

package/native/src/cli/node_modules/undici-types/webidl.d.ts

@@ -0,0 +1,228 @@
+// These types are not exported, and are only used internally
+
+/**
+ * Take in an unknown value and return one that is of type T
+ */
+type Converter<T> = (object: unknown) => T
+
+type SequenceConverter<T> = (object: unknown, iterable?: IterableIterator<T>) => T[]
+
+type RecordConverter<K extends string, V> = (object: unknown) => Record<K, V>
+
+interface ConvertToIntOpts {
+  clamp?: boolean
+  enforceRange?: boolean
+}
+
+interface WebidlErrors {
+  exception (opts: { header: string, message: string }): TypeError
+  /**
+   * @description Throw an error when conversion from one type to another has failed
+   */
+  conversionFailed (opts: {
+    prefix: string
+    argument: string
+    types: string[]
+  }): TypeError
+  /**
+   * @description Throw an error when an invalid argument is provided
+   */
+  invalidArgument (opts: {
+    prefix: string
+    value: string
+    type: string
+  }): TypeError
+}
+
+interface WebidlUtil {
+  /**
+   * @see https://tc39.es/ecma262/#sec-ecmascript-data-types-and-values
+   */
+  Type (object: unknown):
+    | 'Undefined'
+    | 'Boolean'
+    | 'String'
+    | 'Symbol'
+    | 'Number'
+    | 'BigInt'
+    | 'Null'
+    | 'Object'
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#abstract-opdef-converttoint
+   */
+  ConvertToInt (
+    V: unknown,
+    bitLength: number,
+    signedness: 'signed' | 'unsigned',
+    opts?: ConvertToIntOpts
+  ): number
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#abstract-opdef-converttoint
+   */
+  IntegerPart (N: number): number
+
+  /**
+   * Stringifies {@param V}
+   */
+  Stringify (V: any): string
+
+  /**
+   * Mark a value as uncloneable for Node.js.
+   * This is only effective in some newer Node.js versions.
+   */
+  markAsUncloneable (V: any): void
+}
+
+interface WebidlConverters {
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-DOMString
+   */
+  DOMString (V: unknown, prefix: string, argument: string, opts?: {
+    legacyNullToEmptyString: boolean
+  }): string
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-ByteString
+   */
+  ByteString (V: unknown, prefix: string, argument: string): string
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-USVString
+   */
+  USVString (V: unknown): string
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-boolean
+   */
+  boolean (V: unknown): boolean
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-any
+   */
+  any <Value>(V: Value): Value
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-long-long
+   */
+  ['long long'] (V: unknown): number
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-unsigned-long-long
+   */
+  ['unsigned long long'] (V: unknown): number
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-unsigned-long
+   */
+  ['unsigned long'] (V: unknown): number
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-unsigned-short
+   */
+  ['unsigned short'] (V: unknown, opts?: ConvertToIntOpts): number
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#idl-ArrayBuffer
+   */
+  ArrayBuffer (V: unknown): ArrayBufferLike
+  ArrayBuffer (V: unknown, opts: { allowShared: false }): ArrayBuffer
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-buffer-source-types
+   */
+  TypedArray (
+    V: unknown,
+    TypedArray: NodeJS.TypedArray | ArrayBufferLike
+  ): NodeJS.TypedArray | ArrayBufferLike
+  TypedArray (
+    V: unknown,
+    TypedArray: NodeJS.TypedArray | ArrayBufferLike,
+    opts?: { allowShared: false }
+  ): NodeJS.TypedArray | ArrayBuffer
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-buffer-source-types
+   */
+  DataView (V: unknown, opts?: { allowShared: boolean }): DataView
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#BufferSource
+   */
+  BufferSource (
+    V: unknown,
+    opts?: { allowShared: boolean }
+  ): NodeJS.TypedArray | ArrayBufferLike | DataView
+
+  ['sequence<ByteString>']: SequenceConverter<string>
+  
+  ['sequence<sequence<ByteString>>']: SequenceConverter<string[]>
+
+  ['record<ByteString, ByteString>']: RecordConverter<string, string>
+
+  [Key: string]: (...args: any[]) => unknown
+}
+
+export interface Webidl {
+  errors: WebidlErrors
+  util: WebidlUtil
+  converters: WebidlConverters
+
+  /**
+   * @description Performs a brand-check on {@param V} to ensure it is a
+   * {@param cls} object.
+   */
+  brandCheck <Interface>(V: unknown, cls: Interface, opts?: { strict?: boolean }): asserts V is Interface
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-sequence
+   * @description Convert a value, V, to a WebIDL sequence type.
+   */
+  sequenceConverter <Type>(C: Converter<Type>): SequenceConverter<Type>
+
+  illegalConstructor (): never
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-to-record
+   * @description Convert a value, V, to a WebIDL record type.
+   */
+  recordConverter <K extends string, V>(
+    keyConverter: Converter<K>,
+    valueConverter: Converter<V>
+  ): RecordConverter<K, V>
+
+  /**
+   * Similar to {@link Webidl.brandCheck} but allows skipping the check if third party
+   * interfaces are allowed.
+   */
+  interfaceConverter <Interface>(cls: Interface): (
+    V: unknown,
+    opts?: { strict: boolean }
+  ) => asserts V is typeof cls
+
+  // TODO(@KhafraDev): a type could likely be implemented that can infer the return type
+  // from the converters given?
+  /**
+   * Converts a value, V, to a WebIDL dictionary types. Allows limiting which keys are
+   * allowed, values allowed, optional and required keys. Auto converts the value to
+   * a type given a converter.
+   */
+  dictionaryConverter (converters: {
+    key: string,
+    defaultValue?: () => unknown,
+    required?: boolean,
+    converter: (...args: unknown[]) => unknown,
+    allowedValues?: unknown[]
+  }[]): (V: unknown) => Record<string, unknown>
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#idl-nullable-type
+   * @description allows a type, V, to be null
+   */
+  nullableConverter <T>(
+    converter: Converter<T>
+  ): (V: unknown) => ReturnType<typeof converter> | null
+
+  argumentLengthCheck (args: { length: number }, min: number, context: string): void
+}

package/native/src/cli/node_modules/undici-types/websocket.d.ts

@@ -0,0 +1,150 @@
+/// <reference types="node" />
+
+import type { Blob } from 'buffer'
+import type { MessagePort } from 'worker_threads'
+import {
+  EventInit,
+  EventListenerOptions,
+  AddEventListenerOptions,
+  EventListenerOrEventListenerObject
+} from './patch'
+import Dispatcher from './dispatcher'
+import { HeadersInit } from './fetch'
+
+export type BinaryType = 'blob' | 'arraybuffer'
+
+interface WebSocketEventMap {
+  close: CloseEvent
+  error: ErrorEvent
+  message: MessageEvent
+  open: Event
+}
+
+interface WebSocket extends EventTarget {
+  binaryType: BinaryType
+  
+  readonly bufferedAmount: number
+  readonly extensions: string
+
+  onclose: ((this: WebSocket, ev: WebSocketEventMap['close']) => any) | null
+  onerror: ((this: WebSocket, ev: WebSocketEventMap['error']) => any) | null
+  onmessage: ((this: WebSocket, ev: WebSocketEventMap['message']) => any) | null
+  onopen: ((this: WebSocket, ev: WebSocketEventMap['open']) => any) | null
+
+  readonly protocol: string
+  readonly readyState: number
+  readonly url: string
+
+  close(code?: number, reason?: string): void
+  send(data: string | ArrayBufferLike | Blob | ArrayBufferView): void
+
+  readonly CLOSED: number
+  readonly CLOSING: number
+  readonly CONNECTING: number
+  readonly OPEN: number
+
+  addEventListener<K extends keyof WebSocketEventMap>(
+    type: K,
+    listener: (this: WebSocket, ev: WebSocketEventMap[K]) => any,
+    options?: boolean | AddEventListenerOptions
+  ): void
+  addEventListener(
+    type: string,
+    listener: EventListenerOrEventListenerObject,
+    options?: boolean | AddEventListenerOptions
+  ): void
+  removeEventListener<K extends keyof WebSocketEventMap>(
+    type: K,
+    listener: (this: WebSocket, ev: WebSocketEventMap[K]) => any,
+    options?: boolean | EventListenerOptions
+  ): void
+  removeEventListener(
+    type: string,
+    listener: EventListenerOrEventListenerObject,
+    options?: boolean | EventListenerOptions
+  ): void
+}
+
+export declare const WebSocket: {
+  prototype: WebSocket
+  new (url: string | URL, protocols?: string | string[] | WebSocketInit): WebSocket
+  readonly CLOSED: number
+  readonly CLOSING: number
+  readonly CONNECTING: number
+  readonly OPEN: number
+}
+
+interface CloseEventInit extends EventInit {
+  code?: number
+  reason?: string
+  wasClean?: boolean
+}
+
+interface CloseEvent extends Event {
+  readonly code: number
+  readonly reason: string
+  readonly wasClean: boolean
+}
+
+export declare const CloseEvent: {
+  prototype: CloseEvent
+  new (type: string, eventInitDict?: CloseEventInit): CloseEvent
+}
+
+interface MessageEventInit<T = any> extends EventInit {
+  data?: T
+  lastEventId?: string
+  origin?: string
+  ports?: (typeof MessagePort)[]
+  source?: typeof MessagePort | null
+}
+
+interface MessageEvent<T = any> extends Event {
+  readonly data: T
+  readonly lastEventId: string
+  readonly origin: string
+  readonly ports: ReadonlyArray<typeof MessagePort>
+  readonly source: typeof MessagePort | null
+  initMessageEvent(
+    type: string,
+    bubbles?: boolean,
+    cancelable?: boolean,
+    data?: any,
+    origin?: string,
+    lastEventId?: string,
+    source?: typeof MessagePort | null,
+    ports?: (typeof MessagePort)[]
+  ): void;
+}
+
+export declare const MessageEvent: {
+  prototype: MessageEvent
+  new<T>(type: string, eventInitDict?: MessageEventInit<T>): MessageEvent<T>
+}
+
+interface ErrorEventInit extends EventInit {
+  message?: string
+  filename?: string
+  lineno?: number
+  colno?: number
+  error?: any
+}
+
+interface ErrorEvent extends Event {
+  readonly message: string
+  readonly filename: string
+  readonly lineno: number
+  readonly colno: number
+  readonly error: any
+}
+
+export declare const ErrorEvent: {
+  prototype: ErrorEvent
+  new (type: string, eventInitDict?: ErrorEventInit): ErrorEvent
+}
+
+interface WebSocketInit {
+  protocols?: string | string[],
+  dispatcher?: Dispatcher,
+  headers?: HeadersInit
+}

package/native/src/platform/darwin/backend_bootstrap.zc

@@ -1,6 +1,6 @@
 // AUTO-GENERATED FILE. DO NOT EDIT.
 // Source of truth: `packages/bootstrap/src/backend.ts`
-// Generated: `2026-03-22T07:58:05.469Z`
+// Generated: `2026-03-23T03:23:37.946Z`
 
 raw {
     const char* zapp_darwin_backend_bootstrap_script(void) {

package/native/src/platform/darwin/bootstrap.zc

@@ -1,6 +1,6 @@
 // AUTO-GENERATED FILE. DO NOT EDIT.
 // Source of truth: `packages/bootstrap/src/worker.ts`
-// Generated: `2026-03-22T07:58:05.466Z`
+// Generated: `2026-03-23T03:23:37.944Z`
 
 raw {
     const char* zapp_darwin_worker_bootstrap_script(void) {

package/native/src/platform/darwin/platform.zc

@@ -32,6 +32,28 @@ raw {
         if (!zapp_should_terminate_after_last_window_closed) return NO;
         return app_should_quit() ? YES : NO;
     }
+    // Deep link handler: receives URLs when app is opened via custom scheme (e.g., myapp://callback)
+    - (void)application:(NSApplication*)application openURLs:(NSArray<NSURL*>*)urls {
+        (void)application;
+        for (NSURL* url in urls) {
+            NSString* urlStr = [url absoluteString];
+            if (urlStr == nil || [urlStr length] == 0) continue;
+            // Escape for JS string
+            NSString* escaped = [urlStr stringByReplacingOccurrencesOfString:@"\\" withString:@"\\\\"];
+            escaped = [escaped stringByReplacingOccurrencesOfString:@"'" withString:@"\\'"];
+            // Dispatch "app:open-url" event to all webviews
+            NSString* js = [NSString stringWithFormat:
+                @"(function(){var b=globalThis[Symbol.for('zapp.bridge')];if(b&&b.deliverEvent)b.deliverEvent('app:open-url',{url:'%@'});})();",
+                escaped
+            ];
+            for (NSWindow* window in [NSApp windows]) {
+                NSView* content = [window contentView];
+                if ([content isKindOfClass:[WKWebView class]]) {
+                    [(WKWebView*)content evaluateJavaScript:js completionHandler:nil];
+                }
+            }
+        }
+    }
     @end
 
     static id zapp_app_delegate = nil;

package/native/src/platform/darwin/webview.zc

@@ -167,6 +167,17 @@ raw {
         }
         while ([rel hasPrefix:@"/"]) rel = [rel substringFromIndex:1];
 
+        // Block path traversal
+        if ([rel rangeOfString:@".."].location != NSNotFound) {
+            NSHTTPURLResponse* forbidden = [[NSHTTPURLResponse alloc]
+                initWithURL:url statusCode:403 HTTPVersion:@"HTTP/1.1"
+                headerFields:@{ @"Content-Type": @"text/plain" }];
+            [task didReceiveResponse:forbidden];
+            [task didReceiveData:[@"Forbidden" dataUsingEncoding:NSUTF8StringEncoding]];
+            [task didFinish];
+            return;
+        }
+
         NSString* lookupPath = [@"/" stringByAppendingString:rel];
         if (zapp_build_use_embedded_assets() != 0 && zapp_embedded_assets_count > 0) {
             bool foundEmbedded = false;
@@ -436,6 +447,91 @@ raw {
         }
     }
 
+    // --- Navigation restriction ---
+    extern int zapp_build_is_dev_mode(void);
+    extern const char* zapp_build_initial_url(void);
+    extern const char* zapp_build_allowed_navigation(void);
+
+    static BOOL zapp_is_navigation_allowed(NSURL* url) {
+        if (url == nil) return YES;
+        NSString* scheme = [url scheme];
+        NSString* host = [url host];
+        NSString* urlStr = [url absoluteString];
+
+        // Always allow app scheme
+        if ([scheme isEqualToString:@"zapp"]) return YES;
+        // Always allow about:blank
+        if ([scheme isEqualToString:@"about"]) return YES;
+        // Always allow blob: (used by workers, downloads)
+        if ([scheme isEqualToString:@"blob"]) return YES;
+
+        // In dev mode, allow localhost
+        if (zapp_build_is_dev_mode()) {
+            if (host && ([host isEqualToString:@"localhost"] || [host isEqualToString:@"127.0.0.1"])) {
+                return YES;
+            }
+        }
+
+        // Check user-defined allowlist
+        const char* patternsRaw = zapp_build_allowed_navigation();
+        if (patternsRaw && patternsRaw[0] != '\0') {
+            NSString* patternsStr = [NSString stringWithUTF8String:patternsRaw];
+            NSData* data = [patternsStr dataUsingEncoding:NSUTF8StringEncoding];
+            if (data) {
+                NSArray* patterns = [NSJSONSerialization JSONObjectWithData:data options:0 error:nil];
+                if ([patterns isKindOfClass:[NSArray class]]) {
+                    for (NSString* pattern in patterns) {
+                        if (![pattern isKindOfClass:[NSString class]]) continue;
+                        // Simple glob: "https://example.com/*" → prefix match
+                        if ([pattern hasSuffix:@"*"]) {
+                            NSString* prefix = [pattern substringToIndex:[pattern length] - 1];
+                            if ([urlStr hasPrefix:prefix]) return YES;
+                        } else {
+                            if ([urlStr isEqualToString:pattern]) return YES;
+                        }
+                    }
+                }
+            }
+        }
+
+        return NO;
+    }
+
+    @interface ZappNavigationDelegate : NSObject <WKNavigationDelegate, WKUIDelegate>
+    @end
+
+    @implementation ZappNavigationDelegate
+    - (void)webView:(WKWebView*)webView
+        decidePolicyForNavigationAction:(WKNavigationAction*)navigationAction
+        decisionHandler:(void (^)(WKNavigationActionPolicy))decisionHandler {
+        (void)webView;
+        NSURL* url = navigationAction.request.URL;
+        if (zapp_is_navigation_allowed(url)) {
+            decisionHandler(WKNavigationActionPolicyAllow);
+        } else {
+            // If it's a user-initiated link click, open in system browser
+            if (navigationAction.navigationType == WKNavigationTypeLinkActivated) {
+                [[NSWorkspace sharedWorkspace] openURL:url];
+            }
+            decisionHandler(WKNavigationActionPolicyCancel);
+        }
+    }
+    // Handle target="_blank" links — open in system browser
+    - (WKWebView*)webView:(WKWebView*)webView
+        createWebViewWithConfiguration:(WKWebViewConfiguration*)configuration
+        forNavigationAction:(WKNavigationAction*)navigationAction
+        windowFeatures:(WKWindowFeatures*)windowFeatures {
+        (void)webView; (void)configuration; (void)windowFeatures;
+        NSURL* url = navigationAction.request.URL;
+        if (url) {
+            [[NSWorkspace sharedWorkspace] openURL:url];
+        }
+        return nil; // Don't create a new webview
+    }
+    @end
+
+    static ZappNavigationDelegate* zapp_shared_nav_delegate = nil;
+
     // Custom WKWebView subclass for drag region support
     @interface ZappWebView : WKWebView
     @property (nonatomic, assign) BOOL inDragRegion;
@@ -458,6 +554,47 @@ raw {
     - (BOOL)mouseDownCanMoveWindow {
         return self.inDragRegion;
     }
+    // Filter default context menu: remove Reload, Back, Forward, Stop Loading
+    - (void)willOpenMenu:(NSMenu*)menu withEvent:(NSEvent*)event {
+        for (NSInteger i = menu.numberOfItems - 1; i >= 0; i--) {
+            NSMenuItem* item = [menu itemAtIndex:i];
+            SEL action = item.action;
+            NSString* title = [item title];
+            // Filter by selector
+            BOOL remove = (action == @selector(reload:) ||
+                action == @selector(goBack:) ||
+                action == @selector(goForward:) ||
+                action == @selector(stopLoading:) ||
+                action == NSSelectorFromString(@"_reloadFromOrigin:") ||
+                action == NSSelectorFromString(@"_goBack:") ||
+                action == NSSelectorFromString(@"_goForward:"));
+            // Also filter by title (WebKit may use private selectors)
+            if (!remove && title) {
+                NSString* lower = [title lowercaseString];
+                if ([lower isEqualToString:@"reload page"] ||
+                    [lower isEqualToString:@"reload"] ||
+                    [lower isEqualToString:@"back"] ||
+                    [lower isEqualToString:@"forward"] ||
+                    [lower isEqualToString:@"go back"] ||
+                    [lower isEqualToString:@"go forward"]) {
+                    remove = YES;
+                }
+            }
+            if (remove) {
+                [menu removeItemAtIndex:i];
+            }
+        }
+        // Remove trailing/leading separators left over from removal
+        while (menu.numberOfItems > 0 && [[menu itemAtIndex:menu.numberOfItems - 1] isSeparatorItem]) {
+            [menu removeItemAtIndex:menu.numberOfItems - 1];
+        }
+        while (menu.numberOfItems > 0 && [[menu itemAtIndex:0] isSeparatorItem]) {
+            [menu removeItemAtIndex:0];
+        }
+        // WebKit automatically adds "Inspect Element" when developerExtrasEnabled is set.
+        // No need to manually add it — it survives the filter above.
+        [super willOpenMenu:menu withEvent:event];
+    }
     @end
 
     void zapp_darwin_webview_create(void* window_ptr, bool inspectable) {
@@ -482,14 +619,24 @@ raw {
         BOOL webContentInspectable =
             app_get_bootstrap_web_content_inspectable() ? YES : NO;
         int maxWorkers = app_get_bootstrap_max_workers();
+        extern const char* zapp_build_csp(void);
+        const char* cspRaw = zapp_build_csp();
+        NSString* cspExtra = @"";
+        if (cspRaw && cspRaw[0] != '\0') {
+            NSString* cspStr = [NSString stringWithUTF8String:cspRaw];
+            cspStr = [cspStr stringByReplacingOccurrencesOfString:@"\\" withString:@"\\\\"];
+            cspStr = [cspStr stringByReplacingOccurrencesOfString:@"'" withString:@"\\'"];
+            cspExtra = [NSString stringWithFormat:@",csp:'%@'", cspStr];
+        }
         appName = [appName stringByReplacingOccurrencesOfString:@"\\" withString:@"\\\\"];
         appName = [appName stringByReplacingOccurrencesOfString:@"'" withString:@"\\'"];
         NSString* appConfigScript = [NSString stringWithFormat:
-            @"(function(){globalThis[Symbol.for('zapp.bootstrapConfig')]={name:'%@',applicationShouldTerminateAfterLastWindowClosed:%@,webContentInspectable:%@,maxWorkers:%d};})();",
+            @"(function(){globalThis[Symbol.for('zapp.bootstrapConfig')]={name:'%@',applicationShouldTerminateAfterLastWindowClosed:%@,webContentInspectable:%@,maxWorkers:%d%@};})();",
             appName,
             applicationShouldTerminateAfterLastWindowClosed ? @"true" : @"false",
             webContentInspectable ? @"true" : @"false",
-            maxWorkers
+            maxWorkers,
+            cspExtra
         ];
         WKUserScript* appConfigUserScript = [[WKUserScript alloc]
             initWithSource:appConfigScript
@@ -537,10 +684,18 @@ raw {
         ZappMsgHandler* handler = [[ZappMsgHandler alloc] init];
         [ucc addScriptMessageHandler:handler name:@"zapp"];
         [config setUserContentController:ucc];
-        [[config preferences] setValue:@YES forKey:@"developerExtrasEnabled"];
+        if (inspectable) {
+            [[config preferences] setValue:@YES forKey:@"developerExtrasEnabled"];
+        }
         ZappWebView* webview = [[ZappWebView alloc] initWithFrame:bounds configuration:config];
         [webview setAutoresizingMask:(NSViewWidthSizable | NSViewHeightSizable)];
         [webview setInspectable:inspectable ? YES : NO];
+        // Set navigation delegate to restrict URLs
+        if (zapp_shared_nav_delegate == nil) {
+            zapp_shared_nav_delegate = [[ZappNavigationDelegate alloc] init];
+        }
+        [webview setNavigationDelegate:zapp_shared_nav_delegate];
+        [webview setUIDelegate:(id<WKUIDelegate>)zapp_shared_nav_delegate];
         NSURL* url = zapp_initial_url();
         [webview loadRequest:[NSURLRequest requestWithURL:url]];