akanjs 3.0.0-beta.9 → 3.0.0

package/vendor/@akanjs/native/plugins/appearance/src/desktop.ts

@@ -0,0 +1,133 @@
+
+
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { AkanNativeError } from "../../../packages/core/src/index.ts";
+import { type DesktopContext, defineDesktopPlugin, type NativeEvent } from "../../../packages/desktop/src/plugin.ts";
+import type { AppearanceApi, AppearanceEvents, AppearanceState } from "./index.ts";
+import { type AppearanceSetting, type ColorScheme, checkSetting } from "./setting.ts";
+
+export type Runner = (argv: string[]) => Promise<{ code: number; stdout: string }>;
+
+const spawnRunner: Runner = async (argv) => {
+  const proc = Bun.spawn(argv, { stdin: "ignore", stdout: "pipe", stderr: "ignore" });
+  const [stdout, code] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
+  return { code, stdout };
+};
+
+const SHELL_TIMEOUT_MS = 2000;
+
+function isUnknownOp(error: unknown): boolean {
+  return /unknown op/.test(String((error as Error)?.message ?? error));
+}
+
+/** A shell op with a timeout, so a missing native side can never hang a call. */
+function shell(ctx: DesktopContext, op: string, args?: Record<string, unknown>): Promise<unknown> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const timeout = new Promise<never>((_, reject) => {
+    timer = setTimeout(
+      () => reject(new AkanNativeError("INTERNAL", `shell op ${op} did not answer`)),
+      SHELL_TIMEOUT_MS,
+    );
+  });
+  return Promise.race([ctx.shell(op, args), timeout]).finally(() => clearTimeout(timer));
+}
+
+/** `run` is replaceable so tests can check the commands and shell ops, `platform` to test the other OSes' fallback. */
+export function createDesktopAppearance(run: Runner = spawnRunner, platform: NodeJS.Platform = process.platform) {
+  let setting: AppearanceSetting = "system";
+  let loadedFrom = "";
+  let last: AppearanceState | null = null;
+  let send: ((state: AppearanceState) => void) | null = null;
+
+  const file = (ctx: DesktopContext) => join(ctx.appDataDir, "appearance.json");
+
+  const load = (ctx: DesktopContext) => {
+    const path = file(ctx);
+    if (loadedFrom === path) return;
+    loadedFrom = path;
+    try {
+      if (existsSync(path))
+        setting = checkSetting((JSON.parse(readFileSync(path, "utf8")) as { setting?: unknown }).setting);
+    } catch (error) {
+      console.error(`[akan-native] ${path} is unreadable, following the system appearance`, error);
+    }
+  };
+
+  const save = (ctx: DesktopContext) => {
+    const path = file(ctx);
+    writeFileSync(`${path}.tmp`, JSON.stringify({ setting }));
+    renameSync(`${path}.tmp`, path);
+  };
+
+  const systemMode = async (): Promise<ColorScheme> => {
+    if (platform !== "darwin") return "light"; 
+    const { code, stdout } = await run(["/usr/bin/defaults", "read", "-g", "AppleInterfaceStyle"]);
+    return code === 0 && stdout.trim() === "Dark" ? "dark" : "light"; 
+  };
+
+  const state = async (ctx: DesktopContext): Promise<AppearanceState> => {
+    load(ctx);
+    try {
+      const theme = ((await shell(ctx, "window.getState")) as { theme?: unknown } | null)?.theme;
+      if (theme === "light" || theme === "dark") return { mode: theme, setting };
+    } catch {
+    }
+    return { mode: setting === "system" ? await systemMode() : setting, setting };
+  };
+
+  const report = (next: AppearanceState) => {
+    if (!send || (last && last.mode === next.mode && last.setting === next.setting)) return;
+    last = next;
+    send(next);
+  };
+
+  return defineDesktopPlugin<AppearanceApi, AppearanceEvents>({
+    id: "appearance",
+    setup(ctx) {
+      ctx.onNativeEvent("init", () => {
+        load(ctx);
+        if (setting !== "system") shell(ctx, "window.setTheme", { theme: setting }).catch(() => {});
+      });
+      ctx.onNativeEvent("window", (event: NativeEvent) => {
+        if (event.event !== "themeChanged" || (event.theme !== "light" && event.theme !== "dark")) return;
+        report({ mode: event.theme, setting });
+      });
+    },
+    methods: {
+      get: (_args, ctx) => state(ctx),
+      async set(args, ctx) {
+        const next = checkSetting(args?.mode);
+        load(ctx);
+        try {
+          await shell(ctx, "window.setTheme", { theme: next === "system" ? null : next });
+        } catch (error) {
+          if (isUnknownOp(error))
+            throw new AkanNativeError(
+              "UNSUPPORTED",
+              "appearance.set needs the window.setTheme shell op, which this akan-native runtime lacks",
+            );
+          throw error;
+        }
+        setting = next;
+        save(ctx);
+        report(await state(ctx));
+      },
+    },
+    events: {
+      change(emit, ctx) {
+        send = emit;
+        last = null;
+        void state(ctx).then((s) => {
+          if (send === emit && !last) last = s; 
+        });
+        return () => {
+          send = null;
+          last = null;
+        };
+      },
+    },
+  });
+}
+
+export default createDesktopAppearance();

package/vendor/@akanjs/native/plugins/appearance/src/index.ts

@@ -0,0 +1,62 @@
+import { createLiveValue, definePlugin, shallowEqual } from "../../../packages/core/src/index.ts";
+import { useLiveValue } from "../../../packages/react/src/index.ts";
+import type { AppearanceSetting, ColorScheme } from "./setting.ts";
+import { readWebState, web } from "./web.ts";
+
+export { APPEARANCE_SETTINGS, type AppearanceSetting, type ColorScheme, checkSetting } from "./setting.ts";
+
+export interface AppearanceState {
+  /** The scheme the app is drawn in right now; the page's `prefers-color-scheme` matches it. */
+  mode: ColorScheme;
+  /** The app's setting. Always "system" on the web and until set() was called. */
+  setting: AppearanceSetting;
+}
+
+/**
+ * Light/dark appearance of the app (plugins.md §4.1). To only follow the OS, CSS
+ * `prefers-color-scheme` is enough; this plugin is for apps with their own theme switch.
+ */
+export interface AppearanceApi {
+  get(): Promise<AppearanceState>;
+  /**
+   * Forces light or dark for the whole app (WebView, system UI such as dialogs, keyboards and
+   * status bar icons), or goes back to the OS setting with "system". The setting is kept across
+   * launches and applied at start (on iOS and Android before the first paint), so call it when the
+   * user picks a theme, not at every start. The change event follows once the app redrew. Not
+   * available on the web (UNSUPPORTED): a page cannot change `prefers-color-scheme`.
+   */
+  set(args: { mode: AppearanceSetting }): Promise<void>;
+}
+
+export interface AppearanceEvents {
+  /** `mode` or `setting` changed: an OS switch while following the system, or set(). */
+  change: AppearanceState;
+}
+
+export const appearance = definePlugin<AppearanceApi, AppearanceEvents>("appearance", {
+  methods: ["get", "set"],
+  events: ["change"],
+  web,
+});
+
+const current = createLiveValue<AppearanceState>(
+  readWebState(),
+  (set) => {
+    let live = true;
+    const stop = appearance.listen("change", set);
+    appearance
+      .get()
+      .then((state) => live && set(state))
+      .catch(() => {});
+    return () => {
+      live = false;
+      stop();
+    };
+  },
+  shallowEqual,
+);
+
+/** The current appearance. Re-renders on every change. */
+export function useAppearance(): AppearanceState {
+  return useLiveValue(current);
+}

package/vendor/@akanjs/native/plugins/appearance/src/setting.ts

@@ -0,0 +1,18 @@
+import { AkanNativeError } from "../../../packages/core/src/index.ts";
+
+export type ColorScheme = "light" | "dark";
+/** What the app asked for: a fixed scheme, or "system" to follow the OS setting. */
+export type AppearanceSetting = ColorScheme | "system";
+
+export const APPEARANCE_SETTINGS: readonly AppearanceSetting[] = ["light", "dark", "system"];
+
+/** Checks set()'s argument; the native implementations check the same list. */
+export function checkSetting(mode: unknown): AppearanceSetting {
+  if (typeof mode !== "string" || !(APPEARANCE_SETTINGS as readonly string[]).includes(mode)) {
+    throw new AkanNativeError(
+      "INVALID_ARGS",
+      `mode must be one of ${APPEARANCE_SETTINGS.join(", ")} (got ${JSON.stringify(mode)})`,
+    );
+  }
+  return mode as AppearanceSetting;
+}

package/vendor/@akanjs/native/plugins/appearance/src/web.ts

@@ -0,0 +1,25 @@
+import { defineWebPlugin } from "../../../packages/core/src/index.ts";
+import type { AppearanceApi, AppearanceEvents, AppearanceState } from "./index.ts";
+
+function query(): MediaQueryList | null {
+  return typeof matchMedia === "function" ? matchMedia("(prefers-color-scheme: dark)") : null;
+}
+
+export function readWebState(): AppearanceState {
+  return { mode: query()?.matches ? "dark" : "light", setting: "system" };
+}
+
+export const web = defineWebPlugin<AppearanceApi, AppearanceEvents>({
+  methods: {
+    get: async () => readWebState(),
+  },
+  events: {
+    change(emit) {
+      const q = query();
+      if (!q) return () => {};
+      const onChange = () => emit(readWebState());
+      q.addEventListener("change", onChange);
+      return () => q.removeEventListener("change", onChange);
+    },
+  },
+});

package/vendor/@akanjs/native/plugins/auth-session/android/AuthSessionPlugin.kt

@@ -0,0 +1,171 @@
+package com.akanjs.plugins.authsession
+
+import android.app.Activity
+import android.app.Application
+import android.content.Intent
+import android.content.pm.PackageManager
+import android.net.Uri
+import android.os.Bundle
+import android.os.Handler
+import android.os.Looper
+import com.akanjs.runtime.AkanNativeErrorCode
+import com.akanjs.runtime.AkanNativePluginContext
+import com.akanjs.runtime.AkanNativeReply
+
+/**
+ * Custom Tab + the app's deep link, the AppAuth pattern (plugins.md §4.5, S4).
+ * - The provider redirects to <callbackScheme>://…; the app's VIEW intent-filter for the scheme
+ *   (akan-native.config.ts deepLinks.schemes) brings the singleTask shell activity back, which clears the
+ *   tab above it, and the URL arrives through onNewIntent. The scheme is checked against the app's
+ *   own intent filters first, so a missing entry fails at once instead of never calling back.
+ *   ACTION_VIEW only, matching plugins/app; tauri-plugins-workspace/plugins/deep-link/android/.../
+ *   DeepLinkPlugin.kt:51-53 also accepts ChromeOS's org.chromium.arc.intent.action.VIEW.
+ * - Cancel: the tab is started for a result, which arrives when the tab is gone: after the
+ *   redirect (the deep link comes with it, in either order) or when the user closed the tab or
+ *   returned to the app another way. No deep link within GRACE_MS of that → CANCELLED.
+ * - No Custom Tabs browser: the plain browser in its own task; returning to the app (onResume)
+ *   without the redirect → CANCELLED after GRACE_MS.
+ * - Custom Tab extras as in the browser plugin (EXTRA_SESSION null binder makes it a Custom Tab),
+ *   without androidx.browser; the <queries> in native-plugin.json make the browsers visible.
+ * - start() needs the app in front (PERMISSION_DENIED otherwise): Android 15+ blocks activity
+ *   starts from the background for apps targeting 35+ (seen in the browser plugin's close()).
+ * - A new start() rejects the running one with CANCELLED. If the process dies while the tab is up,
+ *   the redirect starts a fresh app: the URL is then app.getLaunchUrl().
+ * Arguments arrive decoded and type-checked by the generated AuthSessionPluginSpec (PL-10).
+ */
+class AuthSessionPlugin(private val context: AkanNativePluginContext) : AuthSessionPluginSpec {
+    private val main = Handler(Looper.getMainLooper())
+    private var pending: AkanNativeReply<AuthSessionStartResult>? = null
+    private var scheme: String? = null
+    /** The start URL's OAuth `state`: only a callback with the same one answers (src/args.ts isAnswer). */
+    private var state: String? = null
+    private var left = false // the app went to the background since start() (plain browser)
+    private var plainBrowser = false
+    private var resumed = false
+    private val cancel = Runnable { finish(null) }
+
+    private val lifecycle = object : Application.ActivityLifecycleCallbacks {
+        override fun onActivityPaused(activity: Activity) {
+            resumed = false
+            left = true
+        }
+
+        override fun onActivityResumed(activity: Activity) {
+            resumed = true
+            if (plainBrowser && left && pending != null) main.postDelayed(cancel, GRACE_MS)
+        }
+
+        override fun onActivityStarted(activity: Activity) {}
+        override fun onActivityStopped(activity: Activity) {}
+        override fun onActivityCreated(activity: Activity, savedInstanceState: Bundle?) {}
+        override fun onActivitySaveInstanceState(activity: Activity, outState: Bundle) {}
+        override fun onActivityDestroyed(activity: Activity) {}
+    }
+
+    init {
+        // Created in the shell's onCreate: the first onResume is still to come.
+        context.activity.registerActivityLifecycleCallbacks(lifecycle)
+    }
+
+    override fun start(args: AuthSessionStartArgs, reply: AkanNativeReply<AuthSessionStartResult>) {
+        val activity = context.activity
+        val uri = if (args.url.isEmpty()) null else Uri.parse(args.url).normalizeScheme()
+        if (uri == null || (uri.scheme != "http" && uri.scheme != "https") || uri.host.isNullOrEmpty()) {
+            return reply.reject(AkanNativeErrorCode.INVALID_ARGS, "the sign-in page must be an http or https URL")
+        }
+        val callbackScheme = args.callbackScheme
+        if (!SCHEME.matches(callbackScheme) || callbackScheme in RESERVED) {
+            return reply.reject(AkanNativeErrorCode.INVALID_ARGS, "callbackScheme must be a lowercase custom scheme such as \"myapp\"")
+        }
+        val callback = Intent(Intent.ACTION_VIEW, Uri.parse("$callbackScheme://callback"))
+            .addCategory(Intent.CATEGORY_BROWSABLE)
+            .setPackage(activity.packageName)
+        if (activity.packageManager.queryIntentActivities(callback, 0).isEmpty()) {
+            return reply.reject(AkanNativeErrorCode.INVALID_ARGS, "the app does not handle $callbackScheme: links; add it to deepLinks.schemes in akan-native.config.ts")
+        }
+        // From the background the start would be a blocked background activity launch (Android 15+).
+        if (!resumed) return reply.reject(AkanNativeErrorCode.PERMISSION_DENIED, "sign-in can only start while the app is in front")
+
+        pending?.reject(AkanNativeErrorCode.CANCELLED, "replaced by a newer start()")
+        main.removeCallbacks(cancel)
+        pending = reply
+        scheme = callbackScheme
+        state = uri.getQueryParameter("state")
+        left = false
+
+        val provider = customTabsPackage(activity)
+        plainBrowser = provider == null
+        try {
+            if (provider != null) {
+                val intent = Intent(Intent.ACTION_VIEW, uri).setPackage(provider)
+                intent.putExtras(Bundle().apply { putBinder(EXTRA_SESSION, null) })
+                intent.putExtra(Intent.EXTRA_REFERRER, Uri.parse("android-app://${activity.packageName}"))
+                context.startActivityForResult("auth", intent) { _, _ ->
+                    // The tab is gone; the redirect's onNewIntent may come just before or after.
+                    if (pending === reply) main.postDelayed(cancel, GRACE_MS)
+                }
+            } else {
+                activity.startActivity(Intent(Intent.ACTION_VIEW, uri).addCategory(Intent.CATEGORY_BROWSABLE).addFlags(Intent.FLAG_ACTIVITY_NEW_TASK))
+            }
+        } catch (e: RuntimeException) { // ActivityNotFoundException, SecurityException
+            finish(null, AkanNativeErrorCode.NOT_FOUND, "no browser can show the sign-in page: ${e.message}")
+        }
+    }
+
+    /** The redirect that answers the running start(), or null. */
+    private fun answer(intent: Intent): String? {
+        val expected = scheme ?: return null
+        if (pending == null || intent.action != Intent.ACTION_VIEW) return null
+        val url = intent.dataString ?: return null
+        if (!url.substringBefore(':').equals(expected, ignoreCase = true)) return null
+        // Another app can send a link of the scheme too: with a state, it must be ours.
+        val want = state
+        if (want != null && stateOf(Uri.parse(url)) != want) return null
+        return url
+    }
+
+    /** The answer ends start() and does not also reach app.urlOpen (R10), as on iOS. */
+    override fun claimsLink(intent: Intent): Boolean = answer(intent) != null
+
+    override fun onNewIntent(intent: Intent) {
+        answer(intent)?.let { finish(it) }
+    }
+
+    /** `state` from the query, or from the fragment (implicit flows). */
+    private fun stateOf(uri: Uri): String? =
+        uri.getQueryParameter("state") ?: uri.fragment?.let { Uri.parse("x://fragment?$it").getQueryParameter("state") }
+
+    override fun onRestoredActivityResult(key: String, resultCode: Int, data: Intent?) {}
+
+    override fun destroy() {
+        main.removeCallbacks(cancel)
+        context.activity.unregisterActivityLifecycleCallbacks(lifecycle)
+    }
+
+    private fun finish(url: String?, code: String = AkanNativeErrorCode.CANCELLED, message: String = "the sign-in page was closed without a callback") {
+        val reply = pending ?: return
+        pending = null
+        scheme = null
+        state = null
+        main.removeCallbacks(cancel)
+        if (url != null) reply.resolve(AuthSessionStartResult(url = url)) else reply.reject(code, message)
+    }
+
+    private companion object {
+        const val ACTION_CUSTOM_TABS_SERVICE = "android.support.customtabs.action.CustomTabsService"
+        const val EXTRA_SESSION = "android.support.customtabs.extra.SESSION"
+        const val GRACE_MS = 1000L
+        val SCHEME = Regex("^[a-z][a-z0-9+.-]*$")
+        val RESERVED = setOf("http", "https", "file", "app", "javascript", "data", "about", "blob")
+
+        /** Like CustomTabsClient.getPackageName: the default browser if it has a Custom Tabs service, else the first that has. */
+        fun customTabsPackage(activity: Activity): String? {
+            val pm = activity.packageManager
+            val providers = pm.queryIntentServices(Intent(ACTION_CUSTOM_TABS_SERVICE), 0).mapNotNull { it.serviceInfo?.packageName }
+            if (providers.isEmpty()) return null
+            val browse = Intent(Intent.ACTION_VIEW, Uri.parse("https://")).addCategory(Intent.CATEGORY_BROWSABLE)
+            val default = pm.resolveActivity(browse, PackageManager.MATCH_DEFAULT_ONLY)?.activityInfo?.packageName
+            return if (default != null && default in providers) default else providers.first()
+        }
+    }
+}

package/vendor/@akanjs/native/plugins/auth-session/ios/AuthSessionPlugin.swift

@@ -0,0 +1,112 @@
+import AuthenticationServices
+import UIKit
+
+/// ASWebAuthenticationSession (plugins.md §4.5). The session catches the redirect to the callback
+/// scheme itself, so the scheme needs no CFBundleURLTypes entry on iOS and the app's urlOpen
+/// listeners do not see it.
+/// - init(url:callback:completionHandler:) with .customScheme (iOS 17.4); the scheme-string
+///   initializer is deprecated.
+/// - The presentation anchor is the web view's window at start(), held by a small provider object
+///   (the session keeps its provider weakly). Without one start() fails with presentationContextNotProvided.
+/// - One session at a time: a new start() cancels the running one, whose call rejects CANCELLED.
+/// - The completion handler runs on the main queue in practice; it hops there anyway.
+/// Arguments arrive decoded and type-checked by the generated AuthSessionPluginSpec (PL-10).
+final class AuthSessionPlugin: AuthSessionPluginSpec {
+    static let id = "auth-session"
+    private static let reserved: Set<String> = ["http", "https", "file", "app", "javascript", "data", "about", "blob"]
+
+    private let context: AkanNativePluginContext
+    private var session: ASWebAuthenticationSession?
+    private var anchor: Anchor?
+    private var token: UUID?
+    private var pending: AkanNativeReply<AuthSessionStartResult>?
+
+    init(context: AkanNativePluginContext) {
+        self.context = context
+    }
+
+    func start(_ args: AuthSessionStartArgs, _ reply: AkanNativeReply<AuthSessionStartResult>) {
+        guard let parts = URLComponents(string: args.url),
+              let scheme = parts.scheme?.lowercased(), scheme == "http" || scheme == "https",
+              !(parts.host ?? "").isEmpty, let url = parts.url
+        else {
+            return reply.reject(.invalidArgs, "the sign-in page must be an http or https URL")
+        }
+        let callbackScheme = args.callbackScheme
+        guard Self.valid(callbackScheme) else {
+            return reply.reject(.invalidArgs, "callbackScheme must be a lowercase custom scheme such as \"myapp\"")
+        }
+        guard let window = context.webView?.window else {
+            return reply.reject(.internalError, "no window to present the sign-in page from")
+        }
+
+        if let running = session {
+            let replaced = pending
+            clear()
+            replaced?.reject(.cancelled, "replaced by a newer start()")
+            running.cancel()
+        }
+
+        let id = UUID()
+        let completion: ASWebAuthenticationSession.CompletionHandler = { [weak self] callbackURL, error in
+            let result = UncheckedBox((callbackURL, error))
+            DispatchQueue.main.async {
+                MainActor.assumeIsolated { self?.finish(id, result.value.0, result.value.1) }
+            }
+        }
+        // The same custom-scheme callback; `callback:` (iOS 17.4) is only needed for https callbacks.
+        let next = if #available(iOS 17.4, *) {
+            ASWebAuthenticationSession(url: url, callback: .customScheme(callbackScheme), completionHandler: completion)
+        } else {
+            ASWebAuthenticationSession(url: url, callbackURLScheme: callbackScheme, completionHandler: completion)
+        }
+        let provider = Anchor(window)
+        next.presentationContextProvider = provider
+        next.prefersEphemeralWebBrowserSession = args.ephemeral ?? false
+        session = next
+        anchor = provider
+        token = id
+        pending = reply
+        guard next.start() else {
+            clear()
+            return reply.reject(.internalError, "the sign-in session could not start")
+        }
+    }
+
+    private func clear() {
+        session = nil
+        anchor = nil
+        token = nil
+        pending = nil
+    }
+
+    private func finish(_ id: UUID, _ callbackURL: URL?, _ error: (any Error)?) {
+        guard id == token, let reply = pending else { return } // replaced meanwhile
+        clear()
+        if let callbackURL {
+            return reply.resolve(AuthSessionStartResult(url: callbackURL.absoluteString))
+        }
+        let nsError = error as NSError?
+        if nsError?.domain == ASWebAuthenticationSessionErrorDomain,
+           nsError?.code == ASWebAuthenticationSessionError.canceledLogin.rawValue {
+            return reply.reject(.cancelled, "the user closed the sign-in page")
+        }
+        reply.reject(.internalError, "sign-in failed: \(nsError?.localizedDescription ?? "no callback URL")")
+    }
+
+    private static func valid(_ scheme: String) -> Bool {
+        guard let first = scheme.unicodeScalars.first, ("a"..."z").contains(first), !reserved.contains(scheme) else { return false }
+        return scheme.unicodeScalars.allSatisfy { ("a"..."z").contains($0) || ("0"..."9").contains($0) || $0 == "+" || $0 == "-" || $0 == "." }
+    }
+}
+
+@MainActor
+private final class Anchor: NSObject, ASWebAuthenticationPresentationContextProviding {
+    private let window: UIWindow
+
+    init(_ window: UIWindow) {
+        self.window = window
+    }
+
+    func presentationAnchor(for session: ASWebAuthenticationSession) -> ASPresentationAnchor { window }
+}

package/vendor/@akanjs/native/plugins/auth-session/native-plugin.json

@@ -0,0 +1,19 @@
+{
+  "id": "auth-session",
+  "apiVersion": 1,
+  "methods": ["start"],
+  "events": [],
+  "codegen": true,
+  "web": null,
+  "desktop": "./src/desktop.ts",
+  "ios": {
+    "sources": ["ios/*.swift"],
+    "class": "AuthSessionPlugin",
+    "frameworks": ["AuthenticationServices"]
+  },
+  "android": {
+    "sources": ["android/*.kt"],
+    "class": "com.akanjs.plugins.authsession.AuthSessionPlugin",
+    "manifestXml": "<queries><intent><action android:name=\"android.support.customtabs.action.CustomTabsService\" /></intent><intent><action android:name=\"android.intent.action.VIEW\" /><category android:name=\"android.intent.category.BROWSABLE\" /><data android:scheme=\"https\" /></intent></queries>"
+  }
+}

package/vendor/@akanjs/native/plugins/auth-session/src/args.ts

@@ -0,0 +1,62 @@
+import { AkanNativeError } from "../../../packages/core/src/index.ts";
+
+export interface StartArgs {
+  url: URL;
+  callbackScheme: string;
+  ephemeral: boolean;
+}
+
+const SCHEME = /^[a-z][a-z0-9+.-]*$/;
+const RESERVED = ["http", "https", "file", "app", "javascript", "data", "about", "blob"];
+
+/** Checks start()'s arguments; the native implementations check the same rules. */
+export function checkStart(args: unknown): StartArgs {
+  const a = (args ?? {}) as { url?: unknown; callbackScheme?: unknown; ephemeral?: unknown };
+  if (typeof a.url !== "string" || a.url.length === 0)
+    throw new AkanNativeError("INVALID_ARGS", "url must be a non-empty string");
+  let url: URL;
+  try {
+    url = new URL(a.url);
+  } catch {
+    throw new AkanNativeError("INVALID_ARGS", `${a.url} is not an absolute URL`);
+  }
+  if ((url.protocol !== "https:" && url.protocol !== "http:") || !url.hostname) {
+    throw new AkanNativeError("INVALID_ARGS", `the sign-in page must be an http or https URL (got ${a.url})`);
+  }
+  const scheme = a.callbackScheme;
+  if (typeof scheme !== "string" || !SCHEME.test(scheme) || RESERVED.includes(scheme)) {
+    throw new AkanNativeError(
+      "INVALID_ARGS",
+      `callbackScheme must be a lowercase custom scheme such as "myapp", as listed in deepLinks.schemes (got ${JSON.stringify(scheme)})`,
+    );
+  }
+  if (a.ephemeral !== undefined && typeof a.ephemeral !== "boolean")
+    throw new AkanNativeError("INVALID_ARGS", "ephemeral must be a boolean");
+  return { url, callbackScheme: scheme, ephemeral: a.ephemeral ?? false };
+}
+
+/** Whether `url` is a callback for `scheme` (schemes compare case-insensitively). */
+export function isCallback(url: string, scheme: string): boolean {
+  const colon = url.indexOf(":");
+  return colon > 0 && url.slice(0, colon).toLowerCase() === scheme;
+}
+
+/** The `state` parameter of a URL's query, or of its fragment (implicit flows), or null. */
+export function stateOf(url: string): string | null {
+  try {
+    const u = new URL(url);
+    return u.searchParams.get("state") ?? new URLSearchParams(u.hash.slice(1)).get("state");
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Whether a link is the answer to this sign-in. Any app, or a web page linking to the scheme, can
+ * send a link of the callback scheme while start() waits; when the start URL carries OAuth's
+ * `state`, only a callback with the same `state` is taken (RFC 6749 §10.12) and others are left
+ * to the app plugin. PKCE is still the app's (RFC 8252 §8.1).
+ */
+export function isAnswer(url: string, scheme: string, state: string | null): boolean {
+  return isCallback(url, scheme) && (state === null || stateOf(url) === state);
+}