akanjs 3.0.0-beta.20 → 3.0.0-beta.21

package/vendor/@akanjs/native/native/desktop/src/win/screen.rs

@@ -0,0 +1,127 @@
+//! Displays and the mouse cursor on Windows (screen plugin, plugins.md §5), with the ops and JSON of
+//! screen.rs: tao monitors and the monitor info of Win32.
+//!
+//! - bounds: the tao monitor's position and size in logical pixels of its own scale, the rects
+//!   lib.rs `monitors` hands to placement.rs and the space window.setPosition uses (tao converts a
+//!   window's logical position with that window's scale). The primary display is at 0,0.
+//! - workArea: tao has none (its MonitorHandle keeps rcMonitor only, tao-0.37.0/src/platform_impl/
+//!   windows/monitor.rs:159-223). GetMonitorInfoW's rcWork, without the taskbar and docked app
+//!   bars, is placed inside bounds by its insets from rcMonitor, as the macOS side does.
+//! - name: the monitor's description (EnumDisplayDevicesW on the adapter's device name, e.g.
+//!   "Generic PnP Monitor"); tao's name is the device name ("\\.\DISPLAY1").
+//! - id: the HMONITOR, stable while the display configuration stays.
+//! - screen.watch: the helper window (msgwin.rs) gets WM_DISPLAYCHANGE (displays, resolution) and
+//!   WM_SETTINGCHANGE with SPI_SETWORKAREA (the taskbar moved or resized); the host reads the
+//!   displays again and compares.
+//! - The cursor: GetCursorPos is in physical pixels (tao makes the process per-monitor DPI aware),
+//!   divided by the scale of the display it is on, like the bounds (Electrobun converts it the
+//!   same way, electrobun/package/src/native/win/nativeWrapper.cpp:14065-14086).
+
+use std::cell::Cell;
+
+use tao::{event_loop::EventLoopWindowTarget, platform::windows::MonitorHandleExtWindows};
+use windows::core::PCWSTR;
+use windows::Win32::Graphics::Gdi::{EnumDisplayDevicesW, GetMonitorInfoW, DISPLAY_DEVICEW, HMONITOR, MONITORINFO, MONITORINFOEXW};
+
+use crate::{json, placement::Rect, push_event};
+
+fn rect_json(r: Rect) -> String {
+  format!(r#"{{"x":{},"y":{},"width":{},"height":{}}}"#, r.x, r.y, r.width, r.height)
+}
+
+/// (rcMonitor, rcWork, device name) of a monitor, physical pixels.
+fn info(hmonitor: isize) -> Option<([i32; 4], [i32; 4], Vec<u16>)> {
+  let mut mi = MONITORINFOEXW::default();
+  mi.monitorInfo.cbSize = std::mem::size_of::<MONITORINFOEXW>() as u32;
+  let ok = unsafe { GetMonitorInfoW(HMONITOR(hmonitor as *mut _), &mut mi as *mut MONITORINFOEXW as *mut MONITORINFO) }.as_bool();
+  if !ok {
+    return None;
+  }
+  let r = |r: windows::Win32::Foundation::RECT| [r.left, r.top, r.right, r.bottom];
+  let device = mi.szDevice.iter().take_while(|c| **c != 0).copied().chain([0]).collect();
+  Some((r(mi.monitorInfo.rcMonitor), r(mi.monitorInfo.rcWork), device))
+}
+
+fn description(device: &[u16]) -> Option<String> {
+  let mut dd = DISPLAY_DEVICEW { cb: std::mem::size_of::<DISPLAY_DEVICEW>() as u32, ..Default::default() };
+  let ok = unsafe { EnumDisplayDevicesW(PCWSTR(device.as_ptr()), 0, &mut dd, 0) }.as_bool();
+  let name = String::from_utf16_lossy(&dd.DeviceString[..dd.DeviceString.iter().position(|c| *c == 0).unwrap_or(dd.DeviceString.len())]);
+  (ok && !name.is_empty()).then_some(name)
+}
+
+/// The work area inside logical `bounds`, from the monitor and work rects in physical pixels.
+pub fn work_area(bounds: Rect, monitor: [i32; 4], work: [i32; 4], scale: f64) -> Rect {
+  Rect {
+    x: bounds.x + (work[0] - monitor[0]) as f64 / scale,
+    y: bounds.y + (work[1] - monitor[1]) as f64 / scale,
+    width: (work[2] - work[0]) as f64 / scale,
+    height: (work[3] - work[1]) as f64 / scale,
+  }
+}
+
+fn displays<T>(target: &EventLoopWindowTarget<T>) -> String {
+  let primary = target.primary_monitor().map(|m| m.hmonitor());
+  let mut list: Vec<(bool, String)> = target
+    .available_monitors()
+    .map(|m| {
+      let scale = m.scale_factor();
+      let (p, s) = (m.position().to_logical::<f64>(scale), m.size().to_logical::<f64>(scale));
+      let bounds = Rect { x: p.x, y: p.y, width: s.width, height: s.height };
+      let (work, name) = match info(m.hmonitor()) {
+        Some((monitor, work, device)) => (work_area(bounds, monitor, work, scale), description(&device).unwrap_or_else(|| m.name().unwrap_or_default())),
+        None => (bounds, m.name().unwrap_or_default()),
+      };
+      let is_primary = primary == Some(m.hmonitor());
+      let json = format!(
+        r#"{{"id":{},"name":{},"bounds":{},"workArea":{},"scale":{scale},"primary":{is_primary}}}"#,
+        m.hmonitor() as u32,
+        json::quote(&name),
+        rect_json(bounds),
+        rect_json(work)
+      );
+      (is_primary, json)
+    })
+    .collect();
+  list.sort_by_key(|(primary, _)| !primary);
+  format!("[{}]", list.into_iter().map(|(_, j)| j).collect::<Vec<_>>().join(","))
+}
+
+fn cursor<T>(target: &EventLoopWindowTarget<T>) -> Result<String, String> {
+  let p = target.cursor_position().map_err(|e| format!("cannot read the cursor position: {e}"))?;
+  let scale = target
+    .available_monitors()
+    .find(|m| {
+      let (mp, ms) = (m.position(), m.size());
+      p.x >= mp.x as f64 && p.y >= mp.y as f64 && p.x < mp.x as f64 + ms.width as f64 && p.y < mp.y as f64 + ms.height as f64
+    })
+    .or_else(|| target.primary_monitor())
+    .map_or(1.0, |m| m.scale_factor());
+  let round = |v: f64| (v * 1000.0).round() / 1000.0;
+  Ok(format!(r#"{{"x":{},"y":{}}}"#, round(p.x / scale), round(p.y / scale)))
+}
+
+thread_local! {
+  static WATCHING: Cell<bool> = const { Cell::new(false) };
+}
+
+/// msgwin.rs: the displays or the work area changed.
+pub fn changed() {
+  if WATCHING.with(Cell::get) {
+    push_event(r#"{"type":"screen","event":"changed"}"#);
+  }
+}
+
+/// screen.* shell ops; None for other ops.
+pub fn shell_op<T>(op: &str, target: &EventLoopWindowTarget<T>) -> Option<Result<String, String>> {
+  let result = match op {
+    "screen.displays" => Ok(displays(target)),
+    "screen.cursor" => cursor(target),
+    "screen.watch" => super::msgwin::hwnd().map(|_| {
+      WATCHING.with(|w| w.set(true));
+      "null".to_string()
+    }),
+    _ if op.starts_with("screen.") => Err(format!("unknown op {op}")),
+    _ => return None,
+  };
+  Some(result)
+}

package/vendor/@akanjs/native/native/desktop/src/win/tray.rs

@@ -0,0 +1,280 @@
+//! Tray icons on Windows (tray plugin, plugins.md §5): notification area icons (Shell_NotifyIconW)
+//! on the helper window (msgwin.rs), with the ops and events of tray.rs.
+//!
+//! Know-how from the references:
+//! - Callbacks in the classic layout (no NIM_SETVERSION): wParam is the icon's uID, lParam the
+//!   mouse message. Electrobun reads it the same way (electrobun/package/src/native/win/
+//!   nativeWrapper.cpp:12785-12791); its left click falls through into the right-click case and
+//!   opens the menu (:12792-12795), which menuOnLeftClick decides here.
+//! - Explorer forgets every icon when it restarts and broadcasts TaskbarCreated to top-level
+//!   windows: the icons are added again then (tao registers the message for the same reason,
+//!   tao-0.37.0/src/platform_impl/windows/event_loop.rs:623-626; Electrobun loses its icons).
+//! - The icon: PNG bytes become an HICON with CreateIconFromResourceEx, which reads PNG-compressed
+//!   icon images (Vista and later), at the small-icon size. The old HICON is destroyed only after
+//!   NIM_MODIFY took the new one (Electrobun nativeWrapper.cpp:13001-13028).
+//! - The menu: menu.rs builds and tracks it on the helper window (SetForegroundWindow, WM_NULL).
+//!
+//! Events: `click { tray, button }` for every left and right click; then, if the tray has a menu,
+//! a right click opens it, and so does a left click unless menuOnLeftClick is false. A tray has no
+//! title on Windows: `title` shows as the tooltip when there is no tooltip. `iconAsTemplate` has no
+//! meaning here. Without an icon the tray shows the app's icon (the one akan-native build puts in the exe).
+
+use std::{cell::RefCell, collections::HashMap, path::Path};
+
+use windows::Win32::Foundation::HWND;
+use windows::Win32::UI::Shell::{ExtractIconExW, Shell_NotifyIconW, NIF_ICON, NIF_MESSAGE, NIF_TIP, NIM_ADD, NIM_DELETE, NIM_MODIFY, NOTIFYICONDATAW, NOTIFY_ICON_MESSAGE};
+use windows::Win32::UI::WindowsAndMessaging::{CreateIconFromResourceEx, DestroyIcon, GetSystemMetrics, LoadIconW, HICON, IDI_APPLICATION, LR_DEFAULTCOLOR, SM_CXSMICON, WM_LBUTTONUP, WM_RBUTTONUP};
+
+use crate::{
+  chrome::{self, Clicked, Source, Tree},
+  json::{self, V},
+  push_event,
+};
+
+struct Tray {
+  uid: u32,
+  /// Ours to destroy; None: the app's icon.
+  icon: Option<HICON>,
+  template: bool,
+  title: String,
+  tooltip: Option<String>,
+  menu: Option<Tree>,
+  menu_on_left_click: bool,
+}
+
+thread_local! {
+  static TRAYS: RefCell<HashMap<String, Tray>> = RefCell::new(HashMap::new());
+  static NEXT_UID: std::cell::Cell<u32> = const { std::cell::Cell::new(1) };
+}
+
+fn string<'a>(cmd: &'a V, key: &str) -> Result<Option<&'a str>, String> {
+  match cmd.get(key) {
+    None | Some(V::Null) => Ok(None),
+    Some(V::Str(s)) => Ok(Some(s)),
+    Some(_) => Err(format!("{key} must be a string")),
+  }
+}
+
+fn flag(cmd: &V, key: &str) -> Result<Option<bool>, String> {
+  match cmd.get(key) {
+    None | Some(V::Null) => Ok(None),
+    Some(V::Bool(b)) => Ok(Some(*b)),
+    Some(_) => Err(format!("{key} must be a boolean")),
+  }
+}
+
+fn icon(app_dir: &Path, path: &str) -> Result<HICON, String> {
+  let file = chrome::resolve_app_file(app_dir, path)?;
+  let bytes = std::fs::read(&file).map_err(|e| format!("cannot read {path}: {e}"))?;
+  if !bytes.starts_with(b"\x89PNG") {
+    return Err(format!("{path} is not a PNG image"));
+  }
+  let size = unsafe { GetSystemMetrics(SM_CXSMICON) };
+  // 0x00030000: the icon resource format version CreateIconFromResourceEx expects.
+  unsafe { CreateIconFromResourceEx(&bytes, true, 0x0003_0000, size, size, LR_DEFAULTCOLOR) }.map_err(|e| format!("{path}: cannot make an icon of it: {e}"))
+}
+
+fn data(tray: &Tray, hwnd: HWND) -> NOTIFYICONDATAW {
+  let mut nid = NOTIFYICONDATAW {
+    cbSize: std::mem::size_of::<NOTIFYICONDATAW>() as u32,
+    hWnd: hwnd,
+    uID: tray.uid,
+    uFlags: NIF_MESSAGE | NIF_ICON | NIF_TIP,
+    uCallbackMessage: super::msgwin::WM_TRAY,
+    hIcon: tray.icon.unwrap_or_else(app_icon),
+    ..Default::default()
+  };
+  let tip: Vec<u16> = tray.tooltip.as_deref().unwrap_or(&tray.title).encode_utf16().take(nid.szTip.len() - 1).collect();
+  nid.szTip[..tip.len()].copy_from_slice(&tip);
+  nid
+}
+
+/// The exe's first icon at the small-icon size (akan-native build embeds the app icon), else the generic
+/// application icon. Loaded once and kept: every tray without an icon of its own shares it.
+fn app_icon() -> HICON {
+  static ICON: std::sync::OnceLock<usize> = std::sync::OnceLock::new();
+  let handle = *ICON.get_or_init(|| {
+    let mut small = HICON::default();
+    let exe = std::env::current_exe().ok().map(|p| windows::core::HSTRING::from(p.as_os_str()));
+    let found = exe.is_some_and(|exe| unsafe { ExtractIconExW(&exe, 0, None, Some(&mut small), 1) } > 0 && !small.is_invalid());
+    let icon = if found { small } else { unsafe { LoadIconW(None, IDI_APPLICATION) }.unwrap_or_default() };
+    icon.0 as usize
+  });
+  HICON(handle as *mut std::ffi::c_void)
+}
+
+/// Shell_NotifyIconW talks to Explorer and can take messages meanwhile, so TRAYS is not borrowed
+/// then: callers pass the data.
+fn notify(message: NOTIFY_ICON_MESSAGE, nid: &NOTIFYICONDATAW) -> Result<(), String> {
+  if unsafe { Shell_NotifyIconW(message, nid) }.as_bool() {
+    Ok(())
+  } else {
+    Err("INTERNAL: the notification area refused the icon".into())
+  }
+}
+
+/// Applies the given fields. Returns the icon it replaced, to destroy once the shell has the new one.
+fn apply(tray: &mut Tray, cmd: &V, app_dir: &Path, id: &str) -> Result<Option<HICON>, String> {
+  // Everything is checked before anything changes.
+  let new_icon = match cmd.get("icon") {
+    None => None,
+    Some(_) => Some(string(cmd, "icon")?.map(|path| icon(app_dir, path)).transpose()?),
+  };
+  let menu = match cmd.get("menu") {
+    None => None,
+    Some(V::Null) => Some(None),
+    Some(items) => Some(Some(chrome::parse(items, &super::menu::app_name())?)),
+  };
+  let (template, title, tooltip, left) = (flag(cmd, "iconAsTemplate")?, string(cmd, "title")?, string(cmd, "tooltip")?, flag(cmd, "menuOnLeftClick")?);
+  let _ = id;
+  let mut old = None;
+  if let Some(icon) = new_icon {
+    old = std::mem::replace(&mut tray.icon, icon);
+  }
+  if let Some(template) = template {
+    tray.template = template;
+  }
+  if cmd.get("title").is_some() {
+    tray.title = title.unwrap_or("").to_string();
+  }
+  if cmd.get("tooltip").is_some() {
+    tray.tooltip = tooltip.map(str::to_string);
+  }
+  if let Some(menu) = menu {
+    tray.menu = menu;
+  }
+  if let Some(left) = left {
+    tray.menu_on_left_click = left;
+  }
+  Ok(old)
+}
+
+fn destroy(icon: Option<HICON>) {
+  if let Some(icon) = icon {
+    unsafe {
+      let _ = DestroyIcon(icon);
+    }
+  }
+}
+
+fn tray_json(id: &str, tray: &Tray) -> String {
+  format!(
+    r#"{{"id":{},"title":{},"tooltip":{},"icon":{},"iconAsTemplate":{},"menu":{},"menuOnLeftClick":{}}}"#,
+    json::quote(id),
+    json::quote(&tray.title),
+    tray.tooltip.as_deref().map_or_else(|| "null".into(), json::quote),
+    tray.icon.is_some(),
+    tray.template,
+    tray.menu.is_some(),
+    tray.menu_on_left_click
+  )
+}
+
+fn click(id: &str, button: &str) {
+  push_event(&format!(r#"{{"type":"tray","event":"click","tray":{},"button":"{button}"}}"#, json::quote(id)));
+}
+
+/// msgwin.rs: a mouse message of the icon `uid`.
+pub fn callback(uid: u32, message: u32) {
+  let button = match message {
+    WM_LBUTTONUP => "left",
+    WM_RBUTTONUP => "right",
+    _ => return,
+  };
+  // Take what the menu needs, then let TRAYS go: the menu runs a modal loop.
+  let found = TRAYS.with(|t| {
+    let trays = t.borrow();
+    let (id, tray) = trays.iter().find(|(_, tray)| tray.uid == uid)?;
+    let menu = tray.menu.as_ref().filter(|_| button == "right" || tray.menu_on_left_click).map(super::menu::build_popup);
+    Some((id.clone(), menu))
+  });
+  let Some((id, menu)) = found else { return };
+  click(&id, button);
+  let Some(menu) = menu else { return };
+  let (Ok(menu), Ok(owner)) = (menu, super::msgwin::hwnd()) else { return };
+  let Some(index) = super::menu::track(menu, owner, super::menu::cursor(), None) else { return };
+  let clicked = TRAYS.with(|t| t.borrow_mut().get_mut(&id).and_then(|tray| tray.menu.as_mut()).map(|tree| tree.click(index, &Source::Tray(id.clone()))));
+  if let Some(Clicked::Role(role)) = clicked {
+    super::menu::perform(role, None, Some(owner), true);
+  }
+}
+
+/// msgwin.rs: Explorer restarted; the icons are added again.
+pub fn recreate() {
+  let Ok(hwnd) = super::msgwin::hwnd() else { return };
+  let all: Vec<NOTIFYICONDATAW> = TRAYS.with(|t| t.borrow().values().map(|tray| data(tray, hwnd)).collect());
+  for nid in all {
+    let _ = notify(NIM_ADD, &nid);
+  }
+}
+
+/// tray.* shell ops; None for other ops.
+pub fn shell_op(op: &str, cmd: &V, app_dir: &Path, app_name: &str) -> Option<Result<String, String>> {
+  if !op.starts_with("tray.") {
+    return None;
+  }
+  super::menu::set_app_name(app_name);
+  Some(run(op, cmd, app_dir))
+}
+
+fn run(op: &str, cmd: &V, app_dir: &Path) -> Result<String, String> {
+  if op == "tray.list" {
+    return TRAYS.with(|t| {
+      let trays = t.borrow();
+      let mut ids: Vec<&String> = trays.keys().collect();
+      ids.sort();
+      Ok(format!("[{}]", ids.iter().map(|id| tray_json(id, &trays[*id])).collect::<Vec<_>>().join(",")))
+    });
+  }
+  let id = string(cmd, "id")?.filter(|s| !s.is_empty()).ok_or("id is required")?.to_string();
+  let hwnd = super::msgwin::hwnd()?;
+  match op {
+    "tray.create" if !TRAYS.with(|t| t.borrow().contains_key(&id)) => {
+      if string(cmd, "icon")?.is_none() && string(cmd, "title")?.is_none_or(str::is_empty) {
+        return Err("a tray needs an icon or a title".into());
+      }
+      let uid = NEXT_UID.with(|n| n.replace(n.get() + 1));
+      let mut tray = Tray { uid, icon: None, template: false, title: String::new(), tooltip: None, menu: None, menu_on_left_click: true };
+      apply(&mut tray, cmd, app_dir, &id)?;
+      if let Err(e) = notify(NIM_ADD, &data(&tray, hwnd)) {
+        destroy(tray.icon);
+        return Err(e);
+      }
+      let json = tray_json(&id, &tray);
+      TRAYS.with(|t| t.borrow_mut().insert(id, tray));
+      Ok(json)
+    }
+    // Creating an existing id updates it (a reloaded page creates its tray again).
+    "tray.create" | "tray.update" => {
+      let (old, nid, json) = TRAYS.with(|t| {
+        let mut trays = t.borrow_mut();
+        let tray = trays.get_mut(&id).ok_or_else(|| format!("no tray {id}"))?;
+        let old = apply(tray, cmd, app_dir, &id)?;
+        Ok::<_, String>((old, data(tray, hwnd), tray_json(&id, tray)))
+      })?;
+      notify(NIM_MODIFY, &nid)?;
+      destroy(old);
+      Ok(json)
+    }
+    "tray.remove" => {
+      if let Some(tray) = TRAYS.with(|t| t.borrow_mut().remove(&id)) {
+        let _ = notify(NIM_DELETE, &data(&tray, hwnd));
+        destroy(tray.icon);
+      }
+      Ok("null".into())
+    }
+    // A synthetic click (tests): the event only, no menu, which nobody could close.
+    "tray.trigger" => {
+      if !TRAYS.with(|t| t.borrow().contains_key(&id)) {
+        return Err(format!("no tray {id}"));
+      }
+      match string(cmd, "button")? {
+        None | Some("left") => click(&id, "left"),
+        Some("right") => click(&id, "right"),
+        Some(other) => return Err(format!("unknown button {other}")),
+      }
+      Ok("null".into())
+    }
+    _ => Err(format!("unknown op {op}")),
+  }
+}

package/vendor/@akanjs/native/native/ios/Sources/AkanNativeAcl.swift

@@ -0,0 +1,241 @@
+// Plugin permission ACL (requirements PL-11, plugins.md C7): the Swift copy of
+// packages/core/src/acl.ts. The CLI resolves the app's capabilities into boot.json `acl`; the
+// bridge checks every call here before a plugin sees it, and hands the matching scopes to the call.
+
+import Foundation
+
+/// What a call may touch: `allow == nil` means no restriction beyond the plugin's own rules.
+struct AkanNativeScope: @unchecked Sendable {
+    let allow: [[String: String]]?
+    let deny: [[String: String]]
+
+    /// Whether `value` (e.g. ["base": "data", "path": "notes/a.txt"]) is inside the scope.
+    /// Fields in `pathFields` match as paths (`*` stays within a segment, `**` crosses "/"), fields
+    /// in `urlFields` as URLs (AkanNativeGlob.url). `fold`: the paths are on a case-insensitive volume.
+    func permits(_ value: [String: String], pathFields: Set<String> = [], urlFields: Set<String> = [], fold: Bool = false) -> Bool {
+        if deny.contains(where: { Self.matches($0, value, pathFields, urlFields, deny: true, fold: fold) }) { return false }
+        guard let allow else { return true }
+        return allow.contains(where: { Self.matches($0, value, pathFields, urlFields, deny: false, fold: fold) })
+    }
+
+    private static func matches(_ entry: [String: String], _ value: [String: String], _ pathFields: Set<String>, _ urlFields: Set<String>, deny: Bool, fold: Bool) -> Bool {
+        for (field, pattern) in entry {
+            guard let actual = value[field] else { return false }
+            let path = pathFields.contains(field)
+            let ok = urlFields.contains(field) ? AkanNativeGlob.url(pattern, actual, deny: deny)
+                : path && fold ? AkanNativeGlob.match(pattern.lowercased(), actual.lowercased(), path: true, deny: deny)
+                : AkanNativeGlob.match(pattern, actual, path: path, deny: deny)
+            if !ok { return false }
+        }
+        return true
+    }
+}
+
+/// Same rules as globMatch and urlMatch in packages/core/src/acl.ts; the cases in
+/// packages/core/vectors/scope.json run here too (scripts/native-vectors.ts).
+enum AkanNativeGlob {
+    nonisolated(unsafe) private static var cache: [String: NSRegularExpression] = [:]
+    private static let lock = NSLock()
+
+    /// Whole-text match of the regex `source`. `\z`, not `$`, which also matches before a final newline.
+    private static func test(_ source: String, _ text: String) -> Bool {
+        lock.lock()
+        var re = cache[source]
+        if re == nil {
+            re = try? NSRegularExpression(pattern: "^(?:" + source + ")\\z", options: [.dotMatchesLineSeparators])
+            cache[source] = re
+        }
+        lock.unlock()
+        guard let re else { return false }
+        return re.firstMatch(in: text, range: NSRange(text.startIndex..., in: text)) != nil
+    }
+
+    private static func escaped(_ c: Character) -> String {
+        "\\^$.|+()[]{}".contains(c) ? "\\" + String(c) : String(c)
+    }
+
+    /// acl.ts globMatch: in an allow entry no path wildcard matches a name that starts with "."; a
+    /// deny entry (`deny`) covers dot files too.
+    static func match(_ pattern: String, _ text: String, path: Bool, deny: Bool = false) -> Bool {
+        test(source(pattern, path: path, deny: deny), text)
+    }
+
+    static func source(_ pattern: String, path: Bool, deny: Bool = false) -> String {
+        let dots = !path || deny
+        let guardDot = dots ? "" : "(?!\\.)"
+        let segment = guardDot + "[^/]*"
+        let across = dots ? ".*" : "(?:[^/]|/(?!\\.))*"
+        let chars = Array(pattern)
+        var out = ""
+        var i = 0
+        while i < chars.count {
+            let c = chars[i]
+            let start = i == 0 || chars[i - 1] == "/"
+            if c == "*" {
+                if i + 1 < chars.count, chars[i + 1] == "*" {
+                    i += 1
+                    if !path {
+                        out += ".*"
+                    } else if i + 1 < chars.count, chars[i + 1] == "/", start {
+                        out += "(?:" + segment + "/)*"
+                        i += 1
+                    } else if i == chars.count - 1, i >= 2, chars[i - 2] == "/" {
+                        out.removeLast()
+                        out += "(?:/" + segment + ")*"
+                    } else {
+                        out += (start ? guardDot : "") + across
+                    }
+                } else {
+                    out += path ? (start ? segment : "[^/]*") : ".*"
+                }
+            } else if c == "?" {
+                out += path ? (start ? guardDot + "[^/]" : "[^/]") : "."
+            } else {
+                out += escaped(c)
+            }
+            i += 1
+        }
+        return out
+    }
+
+    /// `*` (and `**`) → `star`, `?` → one character, everything else literal.
+    private static func wildcard(_ pattern: String, _ text: String, star: String) -> Bool {
+        var out = ""
+        var afterStar = false
+        for c in pattern {
+            if c == "*" {
+                if !afterStar { out += star }
+                afterStar = true
+                continue
+            }
+            afterStar = false
+            out += c == "?" ? "." : escaped(c)
+        }
+        return test(out, text)
+    }
+
+    struct UrlParts {
+        let scheme: String
+        let host: String?
+        let port: String
+        let rest: String
+    }
+
+    /// urlParts in packages/core/src/acl.ts.
+    static func urlParts(_ text: String, pattern: Bool = false) -> UrlParts? {
+        guard let colon = text.firstIndex(of: ":"), colon != text.startIndex else { return nil }
+        let scheme = text[..<colon].lowercased()
+        var rest = text[text.index(after: colon)...]
+        if !pattern, let query = rest.firstIndex(where: { $0 == "?" || $0 == "#" }) { rest = rest[..<query] }
+        guard rest.hasPrefix("//") else { return UrlParts(scheme: scheme, host: nil, port: "", rest: String(rest)) }
+        rest = rest.dropFirst(2)
+        let end = rest.firstIndex(of: "/")
+        var authority = end.map { rest[..<$0] } ?? rest
+        if let at = authority.lastIndex(of: "@") { authority = authority[authority.index(after: at)...] } // user info
+        var from = authority.startIndex
+        if authority.hasPrefix("["), let close = authority.firstIndex(of: "]") { from = authority.index(after: close) } // IPv6
+        let portColon = authority[from...].firstIndex(of: ":")
+        return UrlParts(
+            scheme: scheme,
+            host: (portColon.map { authority[..<$0] } ?? authority).lowercased(),
+            port: portColon.map { String(authority[authority.index(after: $0)...]) } ?? "",
+            rest: end.map { String(rest[$0...]) } ?? ""
+        )
+    }
+
+    private static let defaultPorts = ["http": "80", "https": "443", "ws": "80", "wss": "443"]
+
+    /// urlMatch in packages/core/src/acl.ts: scheme, host, port and path compared separately. A
+    /// pattern without a port matches the default port in an allow entry, every port in a deny entry.
+    static func url(_ pattern: String, _ url: String, deny: Bool = false) -> Bool {
+        if !pattern.isEmpty && pattern.allSatisfy({ $0 == "*" }) { return true }
+        guard let p = urlParts(pattern, pattern: true), let v = urlParts(url), (p.host == nil) == (v.host == nil) else { return false }
+        guard wildcard(p.scheme, v.scheme, star: "[a-z0-9+.-]*") else { return false }
+        if let host = p.host, let actual = v.host {
+            guard wildcard(host, actual, star: ".*") else { return false }
+            let port = v.port.isEmpty ? defaultPorts[v.scheme] ?? "" : v.port
+            if p.port.isEmpty ? !deny && port != defaultPorts[v.scheme] ?? "" : p.port != "*" && p.port != port { return false }
+            if p.rest.isEmpty { return true }
+        }
+        return wildcard(p.rest, v.rest, star: ".*")
+    }
+}
+
+struct AkanNativeAcl: @unchecked Sendable {
+    private struct Grant {
+        let plugin: String
+        let windows: [Int]? // nil: every window
+        let items: Set<String>? // nil: everything
+        let allow: [[String: String]]?
+        let deny: [[String: String]]
+    }
+
+    private let grants: [Grant]
+    private let denied: [String: Set<String>]
+
+    /// What the bridge enforces when boot.json's ACL is broken: nothing is allowed (fail-closed).
+    static let denyAll = AkanNativeAcl(grants: [], denied: [:])
+
+    /// boot.json's ACL (acl.ts loadAcl): nil when boot.json has none (everything allowed). One that
+    /// is not well formed denies everything, and `problem` says why: a malformed part must not loosen
+    /// the rest (one bad grant used to allow everything, one bad denial to drop every denial).
+    static func from(_ boot: [String: Any]) -> (acl: AkanNativeAcl?, problem: String?) {
+        guard let value = boot["acl"] else { return (nil, nil) }
+        if let problem = problem(value) { return (denyAll, problem) }
+        let acl = value as! [String: Any]
+        let entries = { (value: Any?) in (value as? [[String: Any]])?.map { $0.mapValues { $0 as! String } } }
+        let grants = (acl["grants"] as! [[String: Any]]).map { g in
+            Grant(
+                plugin: g["plugin"] as! String,
+                windows: (g["windows"] as? [NSNumber])?.map(\.intValue),
+                items: (g["items"] as? [String]).map(Set.init),
+                allow: entries(g["allow"]),
+                deny: entries(g["deny"]) ?? []
+            )
+        }
+        return (AkanNativeAcl(grants: grants, denied: (acl["denied"] as? [String: [String]] ?? [:]).mapValues(Set.init)), nil)
+    }
+
+    /// nil: boot.json has no ACL: everything is allowed. A malformed one denies everything.
+    static func load(_ boot: [String: Any]) -> AkanNativeAcl? {
+        let (acl, problem) = from(boot)
+        if let problem { NSLog("[akan-native] boot.json: the capabilities cannot be read (%@); every plugin call is denied", problem) }
+        return acl
+    }
+
+    /// acl.ts aclProblem: why a value is not an ACL the bridge can enforce, or nil.
+    static func problem(_ value: Any) -> String? {
+        func strings(_ v: Any?) -> Bool { (v as? [Any])?.allSatisfy { $0 is String } ?? false }
+        func scopes(_ v: Any?) -> Bool {
+            guard let v else { return true }
+            return (v as? [Any])?.allSatisfy { e in (e as? [String: Any])?.values.allSatisfy { $0 is String } ?? false } ?? false
+        }
+        func window(_ v: Any) -> Bool {
+            guard let n = v as? NSNumber, CFGetTypeID(n) != CFBooleanGetTypeID() else { return false }
+            return n.doubleValue == n.doubleValue.rounded() && n.doubleValue >= 1
+        }
+        guard let acl = value as? [String: Any], let grants = acl["grants"] as? [Any] else { return "acl must be { grants: [...], denied?: {...} }" }
+        for (i, item) in grants.enumerated() {
+            guard let g = item as? [String: Any], let plugin = g["plugin"] as? String, !plugin.isEmpty else { return "grant \(i) has no plugin" }
+            guard g["windows"] as? String == "*" || ((g["windows"] as? [Any])?.allSatisfy(window) ?? false) else { return "grant \(i): bad windows" }
+            guard g["items"] as? String == "*" || strings(g["items"]) else { return "grant \(i): bad items" }
+            guard scopes(g["allow"]), scopes(g["deny"]) else { return "grant \(i): bad scopes" }
+        }
+        if let denied = acl["denied"] {
+            guard let d = denied as? [String: Any], d.values.allSatisfy({ strings($0) }) else { return "bad denied" }
+        }
+        return nil
+    }
+
+    /// The C7 check: (allowed, scope for the call).
+    func check(plugin: String, item: String, window: Int = 1) -> (allowed: Bool, scope: AkanNativeScope?) {
+        if denied[plugin]?.contains(item) == true { return (false, nil) }
+        let matching = grants.filter { g in
+            g.plugin == plugin && (g.items?.contains(item) ?? true) && (g.windows?.contains(window) ?? true)
+        }
+        if matching.isEmpty { return (false, nil) }
+        let allow: [[String: String]]? = matching.contains { $0.allow == nil } ? nil : matching.flatMap { $0.allow ?? [] }
+        let deny = matching.flatMap(\.deny)
+        return (true, allow == nil && deny.isEmpty ? nil : AkanNativeScope(allow: allow, deny: deny))
+    }
+}