akanjs 3.0.0-beta.9 → 3.0.0

package/vendor/@akanjs/native/packages/core/vectors/navigation.json

@@ -0,0 +1,75 @@
+{
+  "about": "Where a navigation goes (SH-4, architecture.md §5 and the L0 shell policy). cases: [url, top level (false: a frame), schemes the app added to the external list (contract.json schemes.neverExternal never count), load|open|drop]. The app origin is written app://localhost; each host runs these with its own origin (https://app.localhost on Android and Windows). The app's own /__akan_native/* paths are never a top-level document (FileRefs, init.js, the bridge), and a frame may show only a FileRef there. fileRefSandbox: [a FileRef's mime, whether it is served with Content-Security-Policy: sandbox (everything but images other than SVG, audio, video, fonts and PDF: macOS WebKit draws nothing for a sandboxed PDF)].",
+  "cases": [
+    ["app://localhost/", true, [], "load"],
+    ["app://localhost/page?x=1#y", true, [], "load"],
+    ["app://localhost", true, [], "load"],
+    ["about:blank", true, [], "load"],
+    ["about:srcdoc", false, [], "load"],
+    ["app://localhost.evil.com/", true, [], "drop"],
+    ["app://localhostx/", true, [], "drop"],
+    ["https://example.com/", true, [], "open"],
+    ["HTTPS://example.com/", true, [], "open"],
+    ["http://example.com/", true, [], "open"],
+    ["mailto:a@b.c", true, [], "open"],
+    ["tel:+123", true, [], "open"],
+    ["sms:+123", true, [], "drop"],
+    ["sms:+123", true, ["sms"], "open"],
+    ["file:///etc/passwd", true, [], "drop"],
+    ["file:///etc/passwd", true, ["file"], "drop"],
+    ["javascript:alert(1)", true, ["javascript"], "drop"],
+    ["data:text/html,hi", true, [], "drop"],
+    ["blob:app://localhost/x", true, [], "drop"],
+    ["intent://x#Intent;scheme=x;end", true, [], "drop"],
+    ["myapp://callback", true, [], "drop"],
+    ["myapp://callback", true, ["myapp"], "open"],
+    ["not a url", true, [], "drop"],
+    ["", true, [], "drop"],
+    ["https://example.com/embed", false, [], "load"],
+    ["http://example.com/embed", false, [], "load"],
+    ["data:text/html,hi", false, [], "load"],
+    ["blob:https://example.com/x", false, [], "load"],
+    ["app://localhost/selftest-nav.html", false, [], "load"],
+    ["mailto:a@b.c", false, [], "drop"],
+    ["tel:+1", false, [], "drop"],
+    ["file:///etc/passwd", false, [], "drop"],
+    ["javascript:alert(1)", false, [], "drop"],
+    ["myapp://x", false, ["myapp"], "drop"],
+    ["app://localhost/__akan_native/file/abc.html", true, [], "drop"],
+    ["app://localhost/__akan_native/file/abc.html", false, [], "load"],
+    ["app://localhost/__akan_native/file/abc.html?x#y", true, [], "drop"],
+    ["app://localhost/__akan_native/init.js", true, [], "drop"],
+    ["app://localhost/__akan_native/init.js", false, [], "drop"],
+    ["app://localhost/__akan_native/ipc", false, [], "drop"],
+    ["app://localhost/__akan_native", true, [], "drop"],
+    ["app://localhost/%5F_akan_native/file/x.html", true, [], "drop"],
+    ["app://localhost//__akan_native/file/x.html", true, [], "drop"],
+    ["app://localhost/%E0%A4%A", true, [], "drop"],
+    ["app://localhost/a/__akan_native/x", true, [], "load"],
+    ["app://localhost/__akan_nativex", true, [], "load"],
+    ["app://localhost/__akan_native/file/..%2Fx", false, [], "drop"]
+  ],
+  "fileRefSandbox": [
+    ["text/html", true],
+    ["application/xhtml+xml", true],
+    ["image/svg+xml", true],
+    ["application/xml", true],
+    ["text/xml", true],
+    ["text/plain", true],
+    ["application/pdf", false],
+    ["APPLICATION/PDF; charset=binary", false],
+    ["application/pdfx", true],
+    ["application/octet-stream", true],
+    ["application/json", true],
+    ["image/png", false],
+    ["image/jpeg", false],
+    ["image/heic", false],
+    ["video/mp4", false],
+    ["audio/mpeg", false],
+    ["font/woff2", false],
+    ["IMAGE/PNG", false],
+    ["image/svg+xml; charset=utf-8", true],
+    ["image/png; x=1", false],
+    ["", true]
+  ]
+}

package/vendor/@akanjs/native/packages/core/vectors/ranges.json

@@ -0,0 +1,39 @@
+{
+  "about": "Range requests for assets and FileRefs (IN-5, RFC 9110 §14). cases: [Range header, file size, expected]: [200] = the whole file (no header, or one this host does not support or cannot parse: those are ignored), [206, first, last] (inclusive; at most maxRangeBytes), [416] = a valid single range that the file cannot satisfy. Only one \"bytes=\" range, lowercase, no spaces, 1 to 18 ASCII digits per number.",
+  "cases": [
+    [null, 10, [200]],
+    ["bytes=0-4", 10, [206, 0, 4]],
+    ["bytes=0-", 10, [206, 0, 9]],
+    ["bytes=4-", 10, [206, 4, 9]],
+    ["bytes=9-9", 10, [206, 9, 9]],
+    ["bytes=5-100", 10, [206, 5, 9]],
+    ["bytes=-3", 10, [206, 7, 9]],
+    ["bytes=-30", 10, [206, 0, 9]],
+    ["bytes=0-2000000", 3000000, [206, 0, 1023999]],
+    ["bytes=0-", 3000000, [206, 0, 1023999]],
+    ["bytes=-2000000", 3000000, [206, 1000000, 2023999]],
+    ["bytes=10-", 10, [416]],
+    ["bytes=10-20", 10, [416]],
+    ["bytes=-0", 10, [416]],
+    ["bytes=0-0", 0, [416]],
+    ["bytes=-5", 0, [416]],
+    ["bytes=5-2", 10, [200]],
+    ["bytes=0-1,4-5", 10, [200]],
+    ["bytes=5-abc", 10, [200]],
+    ["bytes=abc", 10, [200]],
+    ["bytes=", 10, [200]],
+    ["bytes=-", 10, [200]],
+    ["items=0-1", 10, [200]],
+    ["Bytes=0-1", 10, [200]],
+    ["bytes=+1-+4", 10, [200]],
+    ["bytes=-+4", 10, [200]],
+    ["bytes= 0-4", 10, [200]],
+    ["bytes=0-4 ", 10, [200]],
+    ["bytes=0x1-4", 10, [200]],
+    ["bytes=٠-٤", 10, [200]],
+    ["bytes=1234567890123456789-", 10, [200]],
+    ["bytes=0-1234567890123456789", 10, [200]],
+    ["bytes=123456789012345678-", 10, [416]],
+    ["bytes=0-123456789012345678", 10, [206, 0, 9]]
+  ]
+}

package/vendor/@akanjs/native/packages/core/vectors/retained.json

@@ -0,0 +1,17 @@
+{
+  "about": "Retained events (plugins.md C2; Capacitor retainUntilConsumed, 36564ef): links and taps that come before the page listens. ops: [listen, name, whether the listener accepts], [unlisten, name], [emit, value, retain]; log: \"name:value\" for each delivery a listener accepted. A live event goes to every listener; one no listener accepted is kept when retained (at most 16, the oldest go) and replayed, in order, to the next listener, once.",
+  "cases": [
+    {"name": "an active listener gets the event", "ops": [["listen", "a", true], ["emit", "x", true]], "log": ["a:x"]},
+    {"name": "after unlisten nothing is delivered; a retained event waits", "ops": [["listen", "a", true], ["unlisten", "a"], ["emit", "x", true], ["listen", "b", true]], "log": ["b:x"]},
+    {"name": "an event that is not retained is dropped without a listener", "ops": [["emit", "x", false], ["listen", "a", true]], "log": []},
+    {"name": "the first listen replays in order", "ops": [["emit", "x", true], ["emit", "y", true], ["listen", "a", true]], "log": ["a:x", "a:y"]},
+    {"name": "a retained event is replayed once", "ops": [["listen", "a", true], ["unlisten", "a"], ["emit", "x", true], ["listen", "b", true], ["unlisten", "b"], ["listen", "c", true]], "log": ["b:x"]},
+    {"name": "a listener that refuses counts as none (and is dropped)", "ops": [["listen", "a", false], ["emit", "x", true], ["listen", "b", true], ["emit", "y", true]], "log": ["b:x", "b:y"]},
+    {"name": "every active listener gets a live event", "ops": [["listen", "a", true], ["listen", "b", true], ["emit", "x", true]], "log": ["a:x", "b:x"]},
+    {"name": "replay, then live events", "ops": [["emit", "x", true], ["listen", "a", true], ["emit", "y", false]], "log": ["a:x", "a:y"]},
+    {"name": "a refusal during replay keeps the rest", "ops": [["emit", "x", true], ["emit", "y", true], ["listen", "a", false], ["listen", "b", true]], "log": ["b:x", "b:y"]},
+    {"name": "at most 16 wait: the oldest go", "ops": [["emit", "0", true], ["emit", "1", true], ["emit", "2", true], ["emit", "3", true], ["emit", "4", true], ["emit", "5", true], ["emit", "6", true], ["emit", "7", true], ["emit", "8", true], ["emit", "9", true], ["emit", "10", true], ["emit", "11", true], ["emit", "12", true], ["emit", "13", true], ["emit", "14", true], ["emit", "15", true], ["emit", "16", true], ["emit", "17", true], ["listen", "a", true]], "log": ["a:2", "a:3", "a:4", "a:5", "a:6", "a:7", "a:8", "a:9", "a:10", "a:11", "a:12", "a:13", "a:14", "a:15", "a:16", "a:17"]},
+    {"name": "unlisten of a name that never listened changes nothing", "ops": [["unlisten", "z"], ["emit", "x", true], ["listen", "a", true]], "log": ["a:x"]},
+    {"name": "a second listen of the same name replaces it", "ops": [["listen", "a", true], ["listen", "a", true], ["emit", "x", true]], "log": ["a:x"]}
+  ]
+}

package/vendor/@akanjs/native/packages/core/vectors/routes.json

@@ -0,0 +1,66 @@
+{
+  "about": "Asset routes (architecture.md §5). cases: [pathname (still percent-encoded), exists (\"files\": only the files below exist, \"all\": every path exists), kind (init|ipc|hello|file|asset|not-found), value (file id or asset path, else null)]. hostPaths: [pathname, whether the host answers it itself even with a dev server].",
+  "files": ["index.html", "logo.svg", "img/a b.png", "é.txt"],
+  "cases": [
+    ["/", "files", "asset", "index.html"],
+    ["", "files", "asset", "index.html"],
+    ["/index.html", "files", "asset", "index.html"],
+    ["/logo.svg", "files", "asset", "logo.svg"],
+    ["//logo.svg", "files", "asset", "logo.svg"],
+    ["/img/a%20b.png", "files", "asset", "img/a b.png"],
+    ["/img%2Fa%20b.png", "files", "asset", "img/a b.png"],
+    ["/%C3%A9.txt", "files", "asset", "é.txt"],
+    ["/hooks", "files", "asset", "index.html"],
+    ["/about/deep/link", "files", "asset", "index.html"],
+    ["/missing.png", "files", "not-found", null],
+    ["/dir.v2/page", "files", "asset", "index.html"],
+    ["/__akan_native/init.js", "files", "init", null],
+    ["/__akan_native/ipc", "files", "ipc", null],
+    ["/__akan_native/hello", "files", "hello", null],
+    ["/__akan_native/file/abc_1.jpg", "files", "file", "abc_1.jpg"],
+    ["/__akan_native/file/abc-_1", "files", "file", "abc-_1"],
+    ["/__akan_native/file/a.b.c", "files", "not-found", null],
+    ["/__akan_native/file/a.", "files", "not-found", null],
+    ["/__akan_native/file/.jpg", "files", "not-found", null],
+    ["/__akan_native/file/a.tar-gz", "files", "not-found", null],
+    ["/__akan_native/file/a.jpegjpegx", "files", "not-found", null],
+    ["/__akan_native/file/%C3%A9.jpg", "files", "not-found", null],
+    ["/__akan_native/file/../x", "files", "not-found", null],
+    ["/__akan_native/file", "files", "not-found", null],
+    ["/__akan_native/init.js/x", "files", "not-found", null],
+    ["/__akan_native/other", "files", "not-found", null],
+    ["/__akan_native", "files", "not-found", null],
+    ["/../etc/passwd", "files", "not-found", null],
+    ["/%2e%2e/etc/passwd", "files", "not-found", null],
+    ["/./logo.svg", "files", "not-found", null],
+    ["/a%5Cb", "files", "not-found", null],
+    ["/a%00b", "files", "not-found", null],
+    ["/%E0%A4%A", "files", "not-found", null],
+    ["/%E0%A4", "files", "not-found", null],
+    ["/%zz", "files", "not-found", null],
+    ["/a%+1.png", "files", "not-found", null],
+    ["/a%+1", "files", "not-found", null],
+    ["/a%-1", "files", "not-found", null],
+    ["/%", "files", "not-found", null],
+    ["/a%2", "files", "not-found", null],
+    ["/%ED%A0%80", "files", "not-found", null],
+    ["/C:/Users/u/.ssh/id_rsa", "all", "asset", "index.html"],
+    ["/%43%3A/Users/u/key.pem", "all", "not-found", null],
+    ["/C:key.pem", "all", "not-found", null],
+    ["/notes.txt:secret", "all", "not-found", null],
+    ["/at/12:30", "all", "asset", "index.html"],
+    ["/a/b.png", "all", "asset", "a/b.png"]
+  ],
+  "hostPaths": [
+    ["/__akan_native/init.js", true],
+    ["/__akan_native/anything", true],
+    ["//__akan_native/x", true],
+    ["/%5F_akan_native/x", true],
+    ["/%E0%A4%A", true],
+    ["/a%+1", true],
+    ["/", false],
+    ["/index.html", false],
+    ["/app/__akan_native", false],
+    ["/__akan_nativex", false]
+  ]
+}

package/vendor/@akanjs/native/packages/core/vectors/scope.json

@@ -0,0 +1,143 @@
+{
+  "about": "Scope matching cases shared by packages/core/src/acl.ts (acl.test.ts), native/ios/Sources/AkanNativeAcl.swift and native/android/.../AkanNativeAcl.kt (scripts/native-vectors.ts). glob: [pattern, text, mode (path: in an allow entry, path-deny: in a deny entry, plain), expected]; in an allow entry no path wildcard matches a name that starts with \".\". permits: [scope, value, path fields, url fields, fold (a case-insensitive volume), expected] (scopePermits). url: [pattern, normalized url, allow|deny, expected]: a pattern without a port matches only the scheme's default port in an allow entry and every port in a deny entry.",
+  "glob": [
+    ["*.txt", "a.txt", "path", true],
+    ["*.txt", "dir/a.txt", "path", false],
+    ["**/*.txt", "a.txt", "path", true],
+    ["**/*.txt", "dir/sub/a.txt", "path", true],
+    ["exports/**", "exports", "path", true],
+    ["exports/**", "exports/a/b.png", "path", true],
+    ["exports/**", "exportsX", "path", false],
+    ["exports/**", "other/exports/a", "path", false],
+    ["a/**/b", "a/b", "path", true],
+    ["a/**/b", "a/x/y/b", "path", true],
+    ["a/**/b", "a/x/yb", "path", false],
+    ["file?.md", "file1.md", "path", true],
+    ["file?.md", "file/.md", "path", false],
+    ["file?.md", "file😀.md", "path", true],
+    ["**", "anything/at/all", "path", true],
+    ["", "", "path", true],
+    ["", "a", "path", false],
+    ["a+b (1).[x]", "a+b (1).[x]", "path", true],
+    ["a.b", "axb", "path", false],
+    ["Readme.md", "readme.md", "path", false],
+    ["notes/*.txt", "notes/a.txt\n", "path", false],
+    ["notes/*.txt", "notes/a.txt", "path", true],
+    ["data", "data", "plain", true],
+    ["data", "data\n", "plain", false],
+    ["d*", "documents", "plain", true],
+    ["c?che", "cache", "plain", true],
+    ["$x^", "$x^", "plain", true],
+    ["*", ".env", "path", false],
+    ["*", ".env", "path-deny", true],
+    ["*", "env", "path", true],
+    [".*", ".env", "path", true],
+    ["**", ".git/config", "path", false],
+    ["**", "a/.git/config", "path", false],
+    ["**", "a/.git/config", "path-deny", true],
+    ["**", "a/b/c", "path", true],
+    ["**/*.txt", "a/.hidden/x.txt", "path", false],
+    ["**/*.txt", "a/.hidden/x.txt", "path-deny", true],
+    ["**/*.txt", ".x.txt", "path", false],
+    ["**/*.txt", "a/b.x.txt", "path", true],
+    ["**/.env", "a/.env", "path", true],
+    ["**/.env", ".env", "path", true],
+    [".secrets/**", ".secrets/key", "path", true],
+    [".secrets/**", ".secrets", "path", true],
+    ["exports/**", "exports/.cache/x", "path", false],
+    ["exports/**", "exports/.cache/x", "path-deny", true],
+    ["exports/**", "exports/a.b/c", "path", true],
+    ["private/**", "private/.env", "path-deny", true],
+    ["notes/*.txt", "notes/.a.txt", "path", false],
+    ["notes/?.txt", "notes/..txt", "path", false],
+    ["notes/?.txt", "notes/a.txt", "path", true],
+    ["a*", "a.b", "path", true],
+    ["a*", "a.b", "path-deny", true],
+    ["x**y", "x/a/y", "path", true],
+    ["x**y", "x/.a/y", "path", false],
+    ["x**y", "x/.a/y", "path-deny", true],
+    ["*", ".env", "plain", true]
+  ],
+  "url": [
+    ["https://example.com/*", "https://example.com/a/b?c=d", "allow", true],
+    ["https://example.com/*", "https://example.com/x#frag", "allow", true],
+    ["https://*.example.com/*", "https://docs.example.com/x", "allow", true],
+    ["https://*.example.com/*", "https://a.b.example.com/x", "allow", true],
+    ["https://*.example.com/*", "https://example.com/x", "allow", false],
+    ["https://*.example.com/*", "https://evil.com/x.example.com/", "allow", false],
+    ["https://*.example.com/*", "https://evil.com/?.example.com/", "allow", false],
+    ["https://*.example.com/*", "https://evil.com/#.example.com/", "allow", false],
+    ["https://example.com/*", "https://example.com.evil.io/", "allow", false],
+    ["https://example.com/*", "https://example.com@evil.io/", "allow", false],
+    ["https://example.com", "https://example.com/any/path", "allow", true],
+    ["https://example.com/api/*", "https://example.com/apix", "allow", false],
+    ["https://example.com/api/*", "https://example.com/api/v1?q=1", "allow", true],
+    ["https://example.com/*.json", "https://example.com/x?a=.json", "allow", false],
+    ["https://example.com/a?c", "https://example.com/abc", "allow", true],
+    ["https://EXAMPLE.com/*", "https://example.com/x", "allow", true],
+    ["HTTPS://example.com/*", "https://example.com/x", "allow", true],
+    ["https://example.com/*", "http://example.com/x", "allow", false],
+    ["http*://example.com/*", "http://example.com/x", "allow", true],
+    ["http*://example.com/*", "https://example.com/x", "allow", true],
+    ["http*://example.com/*", "ftp://example.com/x", "allow", false],
+    ["*://internal.example.com/*", "http://internal.example.com:8080/x", "allow", false],
+    ["*://internal.example.com/*", "http://internal.example.com:8080/x", "deny", true],
+    ["https://internal.example.com/*", "https://internal.example.com:8443/x", "allow", false],
+    ["https://internal.example.com/*", "https://internal.example.com:8443/x", "deny", true],
+    ["https://example.com:8443/*", "https://example.com/x", "allow", false],
+    ["https://example.com:443/*", "https://example.com/x", "allow", true],
+    ["http://example.com:80/*", "http://example.com/x", "allow", true],
+    ["https://example.com:*/*", "https://example.com:1/x", "allow", true],
+    ["https://[::1]:8080/*", "https://[::1]:8080/x", "allow", true],
+    ["https://[::1]/*", "https://[::1]:9/x", "allow", false],
+    ["https://[::1]/*", "https://[::1]:9/x", "deny", true],
+    ["https://[::1]/*", "https://[::2]/x", "allow", false],
+    ["https://127.0.0.1/*", "https://127.0.0.1:3000/", "allow", false],
+    ["https://127.0.0.1/*", "https://127.0.0.1:3000/", "deny", true],
+    ["mailto:*", "mailto:a@b.c", "allow", true],
+    ["mailto:*", "mailto:a@b.c?subject=hi", "allow", true],
+    ["mailto:*@example.com", "mailto:a@example.com", "allow", true],
+    ["mailto:*@example.com", "mailto:a@evil.com?cc=x@example.com", "allow", false],
+    ["mailto:*", "https://example.com/", "allow", false],
+    ["https://*", "mailto:a@b.c", "allow", false],
+    ["tel:*", "tel:+123", "allow", true],
+    ["https://example.com/*", "not a url", "allow", false],
+    ["example.com/*", "https://example.com/x", "allow", false],
+    ["*", "https://anything.example/x", "allow", true],
+    ["**", "mailto:x@y.z", "allow", true],
+    ["https://*", "https://anything.example/x/y", "allow", true],
+    ["https://example.com/*", "https://example.com:443/x", "allow", true],
+    ["ws://example.com/*", "ws://example.com:80/x", "allow", true],
+    ["ftp://example.com/*", "ftp://example.com/x", "allow", true],
+    ["ftp://example.com/*", "ftp://example.com:21/x", "allow", false],
+    ["*://example.com/*", "http://example.com/x", "allow", true],
+    ["*://example.com/*", "https://example.com:8443/x", "allow", false],
+    ["*://example.com/*", "https://example.com:8443/x", "deny", true],
+    ["https://example.com:8443/*", "https://example.com/x", "deny", false],
+    ["https://example.com:8443/*", "https://example.com:8443/x", "deny", true],
+    ["https://example.com:*/*", "https://example.com:8443/x", "allow", true],
+    ["*", "https://anything.example:9/x", "allow", true],
+    ["*", "https://anything.example:9/x", "deny", true],
+    ["https://example.com/*", "https://example.com.evil.io:443/", "deny", false]
+  ],
+  "permits": [
+    [{"allow": [{"base": "data", "path": "notes/**"}], "deny": [{"path": "notes/secret/**"}]}, {"base": "data", "path": "notes/a.txt"}, ["path"], [], false, true],
+    [{"allow": [{"base": "data", "path": "notes/**"}], "deny": [{"path": "notes/secret/**"}]}, {"base": "data", "path": "notes/secret/k"}, ["path"], [], false, false],
+    [{"allow": [{"base": "data", "path": "notes/**"}], "deny": [{"path": "notes/secret/**"}]}, {"base": "data", "path": "notes/Secret/k"}, ["path"], [], false, true],
+    [{"allow": [{"base": "data", "path": "notes/**"}], "deny": [{"path": "notes/secret/**"}]}, {"base": "data", "path": "notes/Secret/k"}, ["path"], [], true, false],
+    [{"allow": [{"base": "data", "path": "notes/**"}], "deny": [{"path": "notes/secret/**"}]}, {"base": "data", "path": "NOTES/a.txt"}, ["path"], [], true, true],
+    [{"allow": [{"base": "data", "path": "notes/**"}], "deny": [{"path": "notes/secret/**"}]}, {"base": "data", "path": "NOTES/a.txt"}, ["path"], [], false, false],
+    [{"allow": [{"base": "data", "path": "notes/**"}], "deny": []}, {"base": "Data", "path": "notes/a.txt"}, ["path"], [], true, false],
+    [{"allow": [{"base": "data", "path": "notes/**"}], "deny": []}, {"base": "data", "path": "notes/.draft"}, ["path"], [], false, false],
+    [{"allow": [{"base": "data", "path": "notes/**"}, {"base": "data", "path": "notes/.draft"}], "deny": []}, {"base": "data", "path": "notes/.draft"}, ["path"], [], false, true],
+    [{"allow": null, "deny": [{"path": "private/**"}]}, {"base": "data", "path": "private/.env"}, ["path"], [], false, false],
+    [{"allow": null, "deny": [{"path": "private/**"}]}, {"base": "data", "path": "Private/.env"}, ["path"], [], true, false],
+    [{"allow": null, "deny": []}, {"base": "data", "path": ".env"}, ["path"], [], false, true],
+    [{"allow": [], "deny": []}, {"base": "data", "path": "a"}, ["path"], [], false, false],
+    [{"allow": [{"url": "https://api.example.com/*"}], "deny": []}, {"url": "https://api.example.com/v1"}, [], ["url"], false, true],
+    [{"allow": [{"url": "https://api.example.com/*"}], "deny": []}, {"url": "https://api.example.com:8443/v1"}, [], ["url"], false, false],
+    [{"allow": null, "deny": [{"url": "*://internal.example.com/*"}]}, {"url": "http://internal.example.com:8080/x"}, [], ["url"], false, false],
+    [{"allow": [{"base": "data"}], "deny": []}, {"base": "data", "path": "x"}, ["path"], [], false, true],
+    [{"allow": [{"base": "data", "path": "x"}], "deny": []}, {"base": "data"}, ["path"], [], false, false]
+  ]
+}

package/vendor/@akanjs/native/packages/desktop/src/deeplinks.ts

@@ -0,0 +1,143 @@
+
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+
+type Env = Record<string, string | undefined>;
+type Runner = (argv: string[]) => Promise<{ code: number; stdout: string }>;
+
+const run: Runner = async (argv) => {
+  const proc = Bun.spawn(argv, { stdin: "ignore", stdout: "pipe", stderr: "ignore" });
+  const [stdout, code] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
+  return { code, stdout };
+};
+
+/** The links in a launch's arguments (without the executable): one argument, of an app scheme. */
+export function linkArguments(args: readonly string[], schemes: readonly string[]): string[] {
+  if (args.length !== 1) return [];
+  const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(args[0]!)?.[1]?.toLowerCase();
+  return scheme && schemes.includes(scheme) ? [args[0]!] : [];
+}
+
+/** Exec= of a desktop entry: the path quoted, with the characters the spec reserves escaped. */
+export function desktopExec(exe: string): string {
+  return `"${exe.replace(/[\\"`$]/g, (c) => `\\${c}`)}" %u`;
+}
+
+export function desktopEntry(name: string, exe: string, schemes: readonly string[]): string {
+  return [
+    "[Desktop Entry]",
+    "Type=Application",
+    `Name=${name.replace(/[\r\n]/g, " ")}`,
+    `Exec=${desktopExec(exe)}`,
+    "Terminal=false",
+    
+    "NoDisplay=true",
+    `MimeType=${schemes.map((s) => `x-scheme-handler/${s};`).join("")}`,
+    "",
+  ].join("\n");
+}
+
+/** mimeapps.list with `x-scheme-handler/<scheme>=<desktop file>` set in [Default Applications]. */
+export function withDefaults(list: string, desktopFile: string, schemes: readonly string[]): string {
+  const lines = list.split("\n");
+  if (lines.at(-1) === "") lines.pop();
+  let start = lines.findIndex((l) => l.trim() === "[Default Applications]");
+  if (start < 0) {
+    if (lines.length) lines.push("");
+    lines.push("[Default Applications]");
+    start = lines.length - 1;
+  }
+  let end = lines.findIndex((l, i) => i > start && l.trim().startsWith("["));
+  if (end < 0) end = lines.length;
+  for (const scheme of schemes) {
+    const key = `x-scheme-handler/${scheme}`;
+    const at = lines.findIndex((l, i) => i > start && i < end && l.split("=")[0]!.trim() === key);
+    if (at >= 0) lines[at] = `${key}=${desktopFile};`;
+    else lines.splice(end++, 0, `${key}=${desktopFile};`);
+  }
+  return `${lines.join("\n")}\n`;
+}
+
+const xdg = (value: string | undefined, fallback: string) => (value?.startsWith("/") ? value : fallback);
+
+function writeIfChanged(path: string, text: string): boolean {
+  if (existsSync(path) && readFileSync(path, "utf8") === text) return false;
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, text);
+  return true;
+}
+
+async function registerLinux(
+  app: { id: string; name: string },
+  exe: string,
+  schemes: readonly string[],
+  env: Env,
+  home: string,
+  runner: Runner,
+): Promise<void> {
+  const file = `${app.id}.desktop`;
+  const applications = join(xdg(env.XDG_DATA_HOME, join(home, ".local", "share")), "applications");
+  const entryChanged = writeIfChanged(join(applications, file), desktopEntry(app.name, exe, schemes));
+  const listPath = join(xdg(env.XDG_CONFIG_HOME, join(home, ".config")), "mimeapps.list");
+  const list = existsSync(listPath) ? readFileSync(listPath, "utf8") : "";
+  writeIfChanged(listPath, withDefaults(list, file, schemes));
+  
+  if (entryChanged) await runner(["update-desktop-database", applications]).catch(() => undefined);
+}
+
+/** The value of a registry key's default (or named) value, or null. */
+async function regValue(runner: Runner, key: string, name: string | null): Promise<string | null> {
+  const { code, stdout } = await runner(["reg.exe", "query", key, ...(name === null ? ["/ve"] : ["/v", name])]);
+  if (code !== 0) return null;
+  
+  const line = stdout.split(/\r?\n/).find((l) => /\sREG_SZ(\s|$)/.test(l));
+  return line ? line.replace(/^.*?\sREG_SZ\s{0,4}/, "") : null;
+}
+
+async function registerWindows(
+  app: { id: string; name: string },
+  exe: string,
+  schemes: readonly string[],
+  runner: Runner,
+): Promise<void> {
+  const command = `"${exe}" "%1"`;
+  for (const scheme of schemes) {
+    const key = `HKCU\\Software\\Classes\\${scheme}`;
+    if ((await regValue(runner, `${key}\\shell\\open\\command`, null)) === command) continue;
+    const values: [string, string | null, string][] = [
+      [key, null, `URL:${app.name}`],
+      [key, "URL Protocol", ""],
+      [`${key}\\DefaultIcon`, null, `${exe},0`],
+      [`${key}\\shell\\open\\command`, null, command],
+    ];
+    for (const [k, name, data] of values) {
+      await runner([
+        "reg.exe",
+        "add",
+        k,
+        ...(name === null ? ["/ve"] : ["/v", name]),
+        "/t",
+        "REG_SZ",
+        "/d",
+        data,
+        "/f",
+      ]);
+    }
+  }
+}
+
+/** Makes this executable the current user's handler of the app's schemes (Windows, Linux). */
+export async function registerDeepLinks(
+  app: { id: string; name: string },
+  schemes: readonly string[],
+  options: { exe?: string; platform?: NodeJS.Platform; env?: Env; home?: string; run?: Runner } = {},
+): Promise<void> {
+  const platform = options.platform ?? process.platform;
+  if (!schemes.length || (platform !== "win32" && platform !== "linux")) return;
+  const exe = options.exe ?? process.execPath;
+  const runner = options.run ?? run;
+  if (platform === "win32") await registerWindows(app, exe, schemes, runner);
+  else await registerLinux(app, exe, schemes, options.env ?? process.env, options.home ?? homedir(), runner);
+}