akanjs 3.0.0-beta.20 → 3.0.0-beta.21

package/vendor/@akanjs/native/plugins/auth-session/android/AuthSessionPlugin.kt

@@ -0,0 +1,171 @@
+package com.akanjs.plugins.authsession
+
+import android.app.Activity
+import android.app.Application
+import android.content.Intent
+import android.content.pm.PackageManager
+import android.net.Uri
+import android.os.Bundle
+import android.os.Handler
+import android.os.Looper
+import com.akanjs.runtime.AkanNativeErrorCode
+import com.akanjs.runtime.AkanNativePluginContext
+import com.akanjs.runtime.AkanNativeReply
+
+/**
+ * Custom Tab + the app's deep link, the AppAuth pattern (plugins.md §4.5, S4).
+ * - The provider redirects to <callbackScheme>://…; the app's VIEW intent-filter for the scheme
+ *   (akan-native.config.ts deepLinks.schemes) brings the singleTask shell activity back, which clears the
+ *   tab above it, and the URL arrives through onNewIntent. The scheme is checked against the app's
+ *   own intent filters first, so a missing entry fails at once instead of never calling back.
+ *   ACTION_VIEW only, matching plugins/app; tauri-plugins-workspace/plugins/deep-link/android/.../
+ *   DeepLinkPlugin.kt:51-53 also accepts ChromeOS's org.chromium.arc.intent.action.VIEW.
+ * - Cancel: the tab is started for a result, which arrives when the tab is gone: after the
+ *   redirect (the deep link comes with it, in either order) or when the user closed the tab or
+ *   returned to the app another way. No deep link within GRACE_MS of that → CANCELLED.
+ * - No Custom Tabs browser: the plain browser in its own task; returning to the app (onResume)
+ *   without the redirect → CANCELLED after GRACE_MS.
+ * - Custom Tab extras as in the browser plugin (EXTRA_SESSION null binder makes it a Custom Tab),
+ *   without androidx.browser; the <queries> in native-plugin.json make the browsers visible.
+ * - start() needs the app in front (PERMISSION_DENIED otherwise): Android 15+ blocks activity
+ *   starts from the background for apps targeting 35+ (seen in the browser plugin's close()).
+ * - A new start() rejects the running one with CANCELLED. If the process dies while the tab is up,
+ *   the redirect starts a fresh app: the URL is then app.getLaunchUrl().
+ * Arguments arrive decoded and type-checked by the generated AuthSessionPluginSpec (PL-10).
+ */
+class AuthSessionPlugin(private val context: AkanNativePluginContext) : AuthSessionPluginSpec {
+    private val main = Handler(Looper.getMainLooper())
+    private var pending: AkanNativeReply<AuthSessionStartResult>? = null
+    private var scheme: String? = null
+    /** The start URL's OAuth `state`: only a callback with the same one answers (src/args.ts isAnswer). */
+    private var state: String? = null
+    private var left = false // the app went to the background since start() (plain browser)
+    private var plainBrowser = false
+    private var resumed = false
+    private val cancel = Runnable { finish(null) }
+
+    private val lifecycle = object : Application.ActivityLifecycleCallbacks {
+        override fun onActivityPaused(activity: Activity) {
+            resumed = false
+            left = true
+        }
+
+        override fun onActivityResumed(activity: Activity) {
+            resumed = true
+            if (plainBrowser && left && pending != null) main.postDelayed(cancel, GRACE_MS)
+        }
+
+        override fun onActivityStarted(activity: Activity) {}
+        override fun onActivityStopped(activity: Activity) {}
+        override fun onActivityCreated(activity: Activity, savedInstanceState: Bundle?) {}
+        override fun onActivitySaveInstanceState(activity: Activity, outState: Bundle) {}
+        override fun onActivityDestroyed(activity: Activity) {}
+    }
+
+    init {
+        // Created in the shell's onCreate: the first onResume is still to come.
+        context.activity.registerActivityLifecycleCallbacks(lifecycle)
+    }
+
+    override fun start(args: AuthSessionStartArgs, reply: AkanNativeReply<AuthSessionStartResult>) {
+        val activity = context.activity
+        val uri = if (args.url.isEmpty()) null else Uri.parse(args.url).normalizeScheme()
+        if (uri == null || (uri.scheme != "http" && uri.scheme != "https") || uri.host.isNullOrEmpty()) {
+            return reply.reject(AkanNativeErrorCode.INVALID_ARGS, "the sign-in page must be an http or https URL")
+        }
+        val callbackScheme = args.callbackScheme
+        if (!SCHEME.matches(callbackScheme) || callbackScheme in RESERVED) {
+            return reply.reject(AkanNativeErrorCode.INVALID_ARGS, "callbackScheme must be a lowercase custom scheme such as \"myapp\"")
+        }
+        val callback = Intent(Intent.ACTION_VIEW, Uri.parse("$callbackScheme://callback"))
+            .addCategory(Intent.CATEGORY_BROWSABLE)
+            .setPackage(activity.packageName)
+        if (activity.packageManager.queryIntentActivities(callback, 0).isEmpty()) {
+            return reply.reject(AkanNativeErrorCode.INVALID_ARGS, "the app does not handle $callbackScheme: links; add it to deepLinks.schemes in akan-native.config.ts")
+        }
+        // From the background the start would be a blocked background activity launch (Android 15+).
+        if (!resumed) return reply.reject(AkanNativeErrorCode.PERMISSION_DENIED, "sign-in can only start while the app is in front")
+
+        pending?.reject(AkanNativeErrorCode.CANCELLED, "replaced by a newer start()")
+        main.removeCallbacks(cancel)
+        pending = reply
+        scheme = callbackScheme
+        state = uri.getQueryParameter("state")
+        left = false
+
+        val provider = customTabsPackage(activity)
+        plainBrowser = provider == null
+        try {
+            if (provider != null) {
+                val intent = Intent(Intent.ACTION_VIEW, uri).setPackage(provider)
+                intent.putExtras(Bundle().apply { putBinder(EXTRA_SESSION, null) })
+                intent.putExtra(Intent.EXTRA_REFERRER, Uri.parse("android-app://${activity.packageName}"))
+                context.startActivityForResult("auth", intent) { _, _ ->
+                    // The tab is gone; the redirect's onNewIntent may come just before or after.
+                    if (pending === reply) main.postDelayed(cancel, GRACE_MS)
+                }
+            } else {
+                activity.startActivity(Intent(Intent.ACTION_VIEW, uri).addCategory(Intent.CATEGORY_BROWSABLE).addFlags(Intent.FLAG_ACTIVITY_NEW_TASK))
+            }
+        } catch (e: RuntimeException) { // ActivityNotFoundException, SecurityException
+            finish(null, AkanNativeErrorCode.NOT_FOUND, "no browser can show the sign-in page: ${e.message}")
+        }
+    }
+
+    /** The redirect that answers the running start(), or null. */
+    private fun answer(intent: Intent): String? {
+        val expected = scheme ?: return null
+        if (pending == null || intent.action != Intent.ACTION_VIEW) return null
+        val url = intent.dataString ?: return null
+        if (!url.substringBefore(':').equals(expected, ignoreCase = true)) return null
+        // Another app can send a link of the scheme too: with a state, it must be ours.
+        val want = state
+        if (want != null && stateOf(Uri.parse(url)) != want) return null
+        return url
+    }
+
+    /** The answer ends start() and does not also reach app.urlOpen (R10), as on iOS. */
+    override fun claimsLink(intent: Intent): Boolean = answer(intent) != null
+
+    override fun onNewIntent(intent: Intent) {
+        answer(intent)?.let { finish(it) }
+    }
+
+    /** `state` from the query, or from the fragment (implicit flows). */
+    private fun stateOf(uri: Uri): String? =
+        uri.getQueryParameter("state") ?: uri.fragment?.let { Uri.parse("x://fragment?$it").getQueryParameter("state") }
+
+    override fun onRestoredActivityResult(key: String, resultCode: Int, data: Intent?) {}
+
+    override fun destroy() {
+        main.removeCallbacks(cancel)
+        context.activity.unregisterActivityLifecycleCallbacks(lifecycle)
+    }
+
+    private fun finish(url: String?, code: String = AkanNativeErrorCode.CANCELLED, message: String = "the sign-in page was closed without a callback") {
+        val reply = pending ?: return
+        pending = null
+        scheme = null
+        state = null
+        main.removeCallbacks(cancel)
+        if (url != null) reply.resolve(AuthSessionStartResult(url = url)) else reply.reject(code, message)
+    }
+
+    private companion object {
+        const val ACTION_CUSTOM_TABS_SERVICE = "android.support.customtabs.action.CustomTabsService"
+        const val EXTRA_SESSION = "android.support.customtabs.extra.SESSION"
+        const val GRACE_MS = 1000L
+        val SCHEME = Regex("^[a-z][a-z0-9+.-]*$")
+        val RESERVED = setOf("http", "https", "file", "app", "javascript", "data", "about", "blob")
+
+        /** Like CustomTabsClient.getPackageName: the default browser if it has a Custom Tabs service, else the first that has. */
+        fun customTabsPackage(activity: Activity): String? {
+            val pm = activity.packageManager
+            val providers = pm.queryIntentServices(Intent(ACTION_CUSTOM_TABS_SERVICE), 0).mapNotNull { it.serviceInfo?.packageName }
+            if (providers.isEmpty()) return null
+            val browse = Intent(Intent.ACTION_VIEW, Uri.parse("https://")).addCategory(Intent.CATEGORY_BROWSABLE)
+            val default = pm.resolveActivity(browse, PackageManager.MATCH_DEFAULT_ONLY)?.activityInfo?.packageName
+            return if (default != null && default in providers) default else providers.first()
+        }
+    }
+}

package/vendor/@akanjs/native/plugins/auth-session/ios/AuthSessionPlugin.swift

@@ -0,0 +1,112 @@
+import AuthenticationServices
+import UIKit
+
+/// ASWebAuthenticationSession (plugins.md §4.5). The session catches the redirect to the callback
+/// scheme itself, so the scheme needs no CFBundleURLTypes entry on iOS and the app's urlOpen
+/// listeners do not see it.
+/// - init(url:callback:completionHandler:) with .customScheme (iOS 17.4); the scheme-string
+///   initializer is deprecated.
+/// - The presentation anchor is the web view's window at start(), held by a small provider object
+///   (the session keeps its provider weakly). Without one start() fails with presentationContextNotProvided.
+/// - One session at a time: a new start() cancels the running one, whose call rejects CANCELLED.
+/// - The completion handler runs on the main queue in practice; it hops there anyway.
+/// Arguments arrive decoded and type-checked by the generated AuthSessionPluginSpec (PL-10).
+final class AuthSessionPlugin: AuthSessionPluginSpec {
+    static let id = "auth-session"
+    private static let reserved: Set<String> = ["http", "https", "file", "app", "javascript", "data", "about", "blob"]
+
+    private let context: AkanNativePluginContext
+    private var session: ASWebAuthenticationSession?
+    private var anchor: Anchor?
+    private var token: UUID?
+    private var pending: AkanNativeReply<AuthSessionStartResult>?
+
+    init(context: AkanNativePluginContext) {
+        self.context = context
+    }
+
+    func start(_ args: AuthSessionStartArgs, _ reply: AkanNativeReply<AuthSessionStartResult>) {
+        guard let parts = URLComponents(string: args.url),
+              let scheme = parts.scheme?.lowercased(), scheme == "http" || scheme == "https",
+              !(parts.host ?? "").isEmpty, let url = parts.url
+        else {
+            return reply.reject(.invalidArgs, "the sign-in page must be an http or https URL")
+        }
+        let callbackScheme = args.callbackScheme
+        guard Self.valid(callbackScheme) else {
+            return reply.reject(.invalidArgs, "callbackScheme must be a lowercase custom scheme such as \"myapp\"")
+        }
+        guard let window = context.webView?.window else {
+            return reply.reject(.internalError, "no window to present the sign-in page from")
+        }
+
+        if let running = session {
+            let replaced = pending
+            clear()
+            replaced?.reject(.cancelled, "replaced by a newer start()")
+            running.cancel()
+        }
+
+        let id = UUID()
+        let completion: ASWebAuthenticationSession.CompletionHandler = { [weak self] callbackURL, error in
+            let result = UncheckedBox((callbackURL, error))
+            DispatchQueue.main.async {
+                MainActor.assumeIsolated { self?.finish(id, result.value.0, result.value.1) }
+            }
+        }
+        // The same custom-scheme callback; `callback:` (iOS 17.4) is only needed for https callbacks.
+        let next = if #available(iOS 17.4, *) {
+            ASWebAuthenticationSession(url: url, callback: .customScheme(callbackScheme), completionHandler: completion)
+        } else {
+            ASWebAuthenticationSession(url: url, callbackURLScheme: callbackScheme, completionHandler: completion)
+        }
+        let provider = Anchor(window)
+        next.presentationContextProvider = provider
+        next.prefersEphemeralWebBrowserSession = args.ephemeral ?? false
+        session = next
+        anchor = provider
+        token = id
+        pending = reply
+        guard next.start() else {
+            clear()
+            return reply.reject(.internalError, "the sign-in session could not start")
+        }
+    }
+
+    private func clear() {
+        session = nil
+        anchor = nil
+        token = nil
+        pending = nil
+    }
+
+    private func finish(_ id: UUID, _ callbackURL: URL?, _ error: (any Error)?) {
+        guard id == token, let reply = pending else { return } // replaced meanwhile
+        clear()
+        if let callbackURL {
+            return reply.resolve(AuthSessionStartResult(url: callbackURL.absoluteString))
+        }
+        let nsError = error as NSError?
+        if nsError?.domain == ASWebAuthenticationSessionErrorDomain,
+           nsError?.code == ASWebAuthenticationSessionError.canceledLogin.rawValue {
+            return reply.reject(.cancelled, "the user closed the sign-in page")
+        }
+        reply.reject(.internalError, "sign-in failed: \(nsError?.localizedDescription ?? "no callback URL")")
+    }
+
+    private static func valid(_ scheme: String) -> Bool {
+        guard let first = scheme.unicodeScalars.first, ("a"..."z").contains(first), !reserved.contains(scheme) else { return false }
+        return scheme.unicodeScalars.allSatisfy { ("a"..."z").contains($0) || ("0"..."9").contains($0) || $0 == "+" || $0 == "-" || $0 == "." }
+    }
+}
+
+@MainActor
+private final class Anchor: NSObject, ASWebAuthenticationPresentationContextProviding {
+    private let window: UIWindow
+
+    init(_ window: UIWindow) {
+        self.window = window
+    }
+
+    func presentationAnchor(for session: ASWebAuthenticationSession) -> ASPresentationAnchor { window }
+}

package/vendor/@akanjs/native/plugins/auth-session/native-plugin.json

@@ -0,0 +1,19 @@
+{
+  "id": "auth-session",
+  "apiVersion": 1,
+  "methods": ["start"],
+  "events": [],
+  "codegen": true,
+  "web": null,
+  "desktop": "./src/desktop.ts",
+  "ios": {
+    "sources": ["ios/*.swift"],
+    "class": "AuthSessionPlugin",
+    "frameworks": ["AuthenticationServices"]
+  },
+  "android": {
+    "sources": ["android/*.kt"],
+    "class": "com.akanjs.plugins.authsession.AuthSessionPlugin",
+    "manifestXml": "<queries><intent><action android:name=\"android.support.customtabs.action.CustomTabsService\" /></intent><intent><action android:name=\"android.intent.action.VIEW\" /><category android:name=\"android.intent.category.BROWSABLE\" /><data android:scheme=\"https\" /></intent></queries>"
+  }
+}

package/vendor/@akanjs/native/plugins/auth-session/src/args.ts

@@ -0,0 +1,62 @@
+import { AkanNativeError } from "../../../packages/core/src/index.ts";
+
+export interface StartArgs {
+  url: URL;
+  callbackScheme: string;
+  ephemeral: boolean;
+}
+
+const SCHEME = /^[a-z][a-z0-9+.-]*$/;
+const RESERVED = ["http", "https", "file", "app", "javascript", "data", "about", "blob"];
+
+/** Checks start()'s arguments; the native implementations check the same rules. */
+export function checkStart(args: unknown): StartArgs {
+  const a = (args ?? {}) as { url?: unknown; callbackScheme?: unknown; ephemeral?: unknown };
+  if (typeof a.url !== "string" || a.url.length === 0)
+    throw new AkanNativeError("INVALID_ARGS", "url must be a non-empty string");
+  let url: URL;
+  try {
+    url = new URL(a.url);
+  } catch {
+    throw new AkanNativeError("INVALID_ARGS", `${a.url} is not an absolute URL`);
+  }
+  if ((url.protocol !== "https:" && url.protocol !== "http:") || !url.hostname) {
+    throw new AkanNativeError("INVALID_ARGS", `the sign-in page must be an http or https URL (got ${a.url})`);
+  }
+  const scheme = a.callbackScheme;
+  if (typeof scheme !== "string" || !SCHEME.test(scheme) || RESERVED.includes(scheme)) {
+    throw new AkanNativeError(
+      "INVALID_ARGS",
+      `callbackScheme must be a lowercase custom scheme such as "myapp", as listed in deepLinks.schemes (got ${JSON.stringify(scheme)})`,
+    );
+  }
+  if (a.ephemeral !== undefined && typeof a.ephemeral !== "boolean")
+    throw new AkanNativeError("INVALID_ARGS", "ephemeral must be a boolean");
+  return { url, callbackScheme: scheme, ephemeral: a.ephemeral ?? false };
+}
+
+/** Whether `url` is a callback for `scheme` (schemes compare case-insensitively). */
+export function isCallback(url: string, scheme: string): boolean {
+  const colon = url.indexOf(":");
+  return colon > 0 && url.slice(0, colon).toLowerCase() === scheme;
+}
+
+/** The `state` parameter of a URL's query, or of its fragment (implicit flows), or null. */
+export function stateOf(url: string): string | null {
+  try {
+    const u = new URL(url);
+    return u.searchParams.get("state") ?? new URLSearchParams(u.hash.slice(1)).get("state");
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Whether a link is the answer to this sign-in. Any app, or a web page linking to the scheme, can
+ * send a link of the callback scheme while start() waits; when the start URL carries OAuth's
+ * `state`, only a callback with the same `state` is taken (RFC 6749 §10.12) and others are left
+ * to the app plugin. PKCE is still the app's (RFC 8252 §8.1).
+ */
+export function isAnswer(url: string, scheme: string, state: string | null): boolean {
+  return isCallback(url, scheme) && (state === null || stateOf(url) === state);
+}

package/vendor/@akanjs/native/plugins/auth-session/src/desktop.ts

@@ -0,0 +1,133 @@
+
+
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { AkanNativeError } from "../../../packages/core/src/index.ts";
+import { claimLinks, defineDesktopPlugin, externalOpenAllowed } from "../../../packages/desktop/src/plugin.ts";
+import { checkStart, isAnswer } from "./args.ts";
+import type { AuthSessionApi } from "./index.ts";
+
+export const TIMEOUT_MS = 10 * 60 * 1000;
+
+export type Runner = (argv: string[]) => Promise<{ code: number; stderr: string }>;
+
+const spawnRunner: Runner = async (argv) => {
+  const proc = Bun.spawn(argv, { stdin: "ignore", stdout: "ignore", stderr: "pipe" });
+  const [stderr, code] = await Promise.all([new Response(proc.stderr).text(), proc.exited]);
+  return { code, stderr };
+};
+
+/** CFBundleURLSchemes of an XML Info.plist (the CLI writes XML), or null if there is none to read. */
+export function registeredSchemes(plist: string | null): string[] | null {
+  if (plist === null) return null;
+  
+  const schemes: string[] = [];
+  for (const block of plist.matchAll(/<key>CFBundleURLSchemes<\/key>\s*<array>([\s\S]*?)<\/array>/g)) {
+    for (const s of block[1]!.matchAll(/<string>([^<]*)<\/string>/g)) schemes.push(s[1]!.toLowerCase());
+  }
+  return schemes;
+}
+
+function bundlePlist(): string | null {
+  try {
+    
+    return readFileSync(join(dirname(process.execPath), "..", "Info.plist"), "utf8");
+  } catch {
+    return null; 
+  }
+}
+
+interface Pending {
+  scheme: string;
+  /** The start URL's OAuth `state`: the callback must carry it (args.ts isAnswer). */
+  state: string | null;
+  resolve(result: { url: string }): void;
+  reject(error: AkanNativeError): void;
+  timer: ReturnType<typeof setTimeout>;
+}
+
+/** Replaceable parts for tests: the command runner, the Info.plist text, the OS and the timeout. */
+export function createDesktopAuthSession(
+  options: { run?: Runner; plist?: () => string | null; timeoutMs?: number; platform?: NodeJS.Platform } = {},
+) {
+  const run = options.run ?? spawnRunner;
+  const plist = options.plist ?? bundlePlist;
+  const platform = options.platform ?? process.platform;
+  const timeoutMs = options.timeoutMs ?? TIMEOUT_MS;
+  let pending: Pending | null = null;
+
+  const settle = (fn: (p: Pending) => void) => {
+    const p = pending;
+    if (!p) return;
+    pending = null;
+    clearTimeout(p.timer);
+    fn(p);
+  };
+
+  const answered = new Set<string>();
+  const claim = (url: string): boolean => {
+    if (answered.has(url)) return true;
+    if (!pending || !isAnswer(url, pending.scheme, pending.state)) return false;
+    settle((p) => p.resolve({ url }));
+    answered.add(url);
+    setTimeout(() => answered.delete(url), 10_000).unref?.();
+    return true;
+  };
+
+  return defineDesktopPlugin<AuthSessionApi>({
+    id: "auth-session",
+    setup(ctx) {
+      
+      claimLinks(claim);
+      ctx.onNativeEvent("opened", (event) => {
+        for (const url of (event.urls as string[] | undefined) ?? []) claim(url);
+      });
+    },
+    methods: {
+      async start(args, ctx) {
+        const { url, callbackScheme } = checkStart(args);
+        const mac = platform === "darwin";
+        if (!mac && platform !== "win32" && platform !== "linux")
+          throw new AkanNativeError("UNSUPPORTED", `auth-session is not implemented on ${platform}`);
+        const schemes = mac ? registeredSchemes(plist()) : [...ctx.deepLinkSchemes];
+        if (schemes && !schemes.includes(callbackScheme)) {
+          throw new AkanNativeError(
+            "INVALID_ARGS",
+            `the app does not handle ${callbackScheme}: links; add it to deepLinks.schemes in akan-native.config.ts`,
+          );
+        }
+        if (!externalOpenAllowed())
+          throw new AkanNativeError("NOT_ALLOWED", "at most one URL per second leaves the app; try again later");
+        settle((p) => p.reject(new AkanNativeError("CANCELLED", "replaced by a newer start()")));
+        const result = new Promise<{ url: string }>((resolve, reject) => {
+          const timer = setTimeout(
+            () => settle((p) => p.reject(new AkanNativeError("CANCELLED", "no sign-in callback arrived in time"))),
+            timeoutMs,
+          );
+          pending = { scheme: callbackScheme, state: url.searchParams.get("state"), resolve, reject, timer };
+        });
+        const mine = pending;
+        if (mac) {
+          const opened = await run(["/usr/bin/open", "-u", url.href]);
+          if (opened.code !== 0 && pending === mine) {
+            settle((p) =>
+              p.reject(new AkanNativeError("INTERNAL", `open failed (${opened.code}): ${opened.stderr.trim()}`)),
+            );
+          }
+        } else {
+          await ctx.shell("shell.open", { url: url.href }).catch((error: unknown) => {
+            if (pending === mine)
+              settle((p) =>
+                p.reject(
+                  new AkanNativeError("INTERNAL", `cannot open the browser: ${(error as Error)?.message ?? error}`),
+                ),
+              );
+          });
+        }
+        return result;
+      },
+    },
+  });
+}
+
+export default createDesktopAuthSession();

package/vendor/@akanjs/native/plugins/auth-session/src/index.ts

@@ -0,0 +1,39 @@
+import { definePlugin } from "../../../packages/core/src/index.ts";
+
+export { checkStart, isCallback } from "./args.ts";
+
+/**
+ * OAuth / OpenID sign-in in the system browser (plugins.md §4.5, like Expo's
+ * WebBrowser.openAuthSessionAsync): shows the provider's page and returns the redirect to
+ * `callbackScheme` with the result (code, state, error) in its query or fragment. The app then
+ * exchanges the code itself (PKCE); this plugin does not parse or validate the result.
+ *
+ * The callback scheme must be one of the app's deep link schemes (akan-native.config.ts
+ * `deepLinks.schemes`): Android and macOS receive the redirect as a deep link, so the app's
+ * `urlOpen` listeners see it too there. iOS catches it inside the session.
+ *
+ * | host    | how                                              | cancel detection                         |
+ * |---------|--------------------------------------------------|------------------------------------------|
+ * | iOS     | ASWebAuthenticationSession                       | the user closed the sheet                |
+ * | Android | Custom Tab + deep link (plain browser if none)   | back in the app without the redirect     |
+ * | macOS   | default browser + deep link (TAO Event::Opened)  | none: a new start() or 10 minutes        |
+ * | web     | UNSUPPORTED                                      |                                          |
+ *
+ * The web has no custom-scheme callback to catch: web apps register an https redirect on their
+ * own origin and read the result on that route (full-page redirect, or a popup posting to its
+ * opener), which depends on the app's routing and is left to the app.
+ */
+export interface AuthSessionApi {
+  /**
+   * Resolves with the callback URL. Rejects CANCELLED when the user dismissed the page, came back
+   * without finishing (Android), or a newer start() replaced this one; INVALID_ARGS for a bad URL
+   * or scheme (Android also when the app does not handle the scheme). `ephemeral` (iOS) signs in
+   * without the browser's cookies and skips the "wants to use … to sign in" prompt.
+   * The callback that ends a start() is its result only: it does not also reach app.urlOpen, on any
+   * platform. A link of the scheme that arrives with no start() waiting (or with another state) is
+   * an ordinary deep link.
+   */
+  start(args: { url: string; callbackScheme: string; ephemeral?: boolean }): Promise<{ url: string }>;
+}
+
+export const authSession = definePlugin<AuthSessionApi>("auth-session", { methods: ["start"] });

package/vendor/@akanjs/native/plugins/autostart/native-plugin.json

@@ -0,0 +1,10 @@
+{
+  "id": "autostart",
+  "apiVersion": 1,
+  "methods": ["enable", "disable", "isEnabled", "openSettings"],
+  "events": [],
+  "web": null,
+  "desktop": "./src/desktop.ts",
+  "ios": null,
+  "android": null
+}