akanjs 3.0.0-beta.9 → 3.0.1

package/vendor/@akanjs/native/native/desktop/src/win/notify.rs

@@ -0,0 +1,334 @@
+//! Local notifications on Windows: toast notifications (Windows.UI.Notifications through
+//! windows-rs) of an unpackaged app, registered as Microsoft documents it for apps without a
+//! package ("Send a local app notification from other types of unpackaged apps"): an
+//! AppUserModelID with DisplayName and IconUri under HKCU\Software\Classes\AppUserModelId\<AUMID>,
+//! and SetCurrentProcessExplicitAppUserModelID. tauri's notification plugin shows toasts the same
+//! way (notify-rust → CreateToastNotifierWithId and an XML template) but only with the app's
+//! identifier when it is installed, else as PowerShell (tauri-plugins-workspace/plugins/
+//! notification/src/desktop.rs); akan-native registers the app's own id instead.
+//!   notify.status / notify.request → {"status": 2} while toasts are on for the app, 1 when the user
+//!     or a policy turned them off (Settings > Notifications); there is nothing to ask for
+//!   notify.add / notify.pending / notify.removePending → notify_schedule.rs, shown with Show
+//!   notify.delivered → the app's toasts in Action Center (ToastNotificationHistory), from any run
+//!   notify.removeDelivered {ids} → removed from Action Center
+//! Argument `app` {id, name}: the AUMID and its display name.
+//! A toast is tagged with the id (the same id replaces it), grouped as GROUP, and carries its
+//! request JSON as the launch argument, so the history lists it like the macOS center does.
+//! Events: "received" when one is shown; "action" when it is clicked while the app runs (the
+//! toast's Activated event). A click after the app quit does nothing: that needs a COM activator
+//! (INotificationActivationCallback, CustomActivator in the registration, a class factory the app
+//! registers at launch), not done yet; ScheduledToastNotification, which delivers while the app
+//! is closed, is only useful with it.
+
+use std::path::{Path, PathBuf};
+use std::sync::Mutex;
+
+use windows::core::{IInspectable, HRESULT, HSTRING, PCWSTR};
+use windows::Data::Xml::Dom::XmlDocument;
+use windows::Foundation::TypedEventHandler;
+use windows::Win32::Foundation::{ERROR_NOT_FOUND, ERROR_SUCCESS, FILETIME, SYSTEMTIME};
+use windows::Win32::System::Registry::{RegCloseKey, RegCreateKeyExW, RegSetValueExW, HKEY, HKEY_CURRENT_USER, KEY_SET_VALUE, REG_OPTION_NON_VOLATILE, REG_SZ};
+use windows::Win32::System::Time::{FileTimeToSystemTime, SystemTimeToFileTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime};
+use windows::Win32::UI::Shell::SetCurrentProcessExplicitAppUserModelID;
+use windows::UI::Notifications::{NotificationSetting, ToastNotification, ToastNotificationManager};
+
+use crate::json;
+use crate::notify_schedule::{self as schedule, Item};
+
+/// The toasts' group: other toasts of the app (none yet) are left alone.
+const GROUP: &str = "akan-native.ln";
+
+#[derive(Clone)]
+struct App {
+  /// The AppUserModelID: the app id.
+  id: HSTRING,
+}
+
+static APP: Mutex<Option<App>> = Mutex::new(None);
+/// The shown toasts: their Activated handlers live as long as the objects.
+static TOASTS: Mutex<Vec<(String, ToastNotification)>> = Mutex::new(Vec::new());
+
+fn failed(what: &str) -> impl Fn(windows::core::Error) -> String + '_ {
+  move |e| format!("INTERNAL: {what} failed: {} ({})", e.message(), e.code())
+}
+
+/// A REG_SZ value under HKCU, creating the key.
+fn write_string(key: &str, value: &str, data: &str) -> Result<(), String> {
+  let mut hkey = HKEY::default();
+  let status = unsafe { RegCreateKeyExW(HKEY_CURRENT_USER, &HSTRING::from(key), None, PCWSTR::null(), REG_OPTION_NON_VOLATILE, KEY_SET_VALUE, None, &mut hkey, None) };
+  if status != ERROR_SUCCESS {
+    return Err(format!("INTERNAL: cannot create HKCU\\{key} ({})", status.0));
+  }
+  let bytes: Vec<u8> = data.encode_utf16().chain(std::iter::once(0)).flat_map(u16::to_le_bytes).collect();
+  let status = unsafe { RegSetValueExW(hkey, &HSTRING::from(value), None, REG_SZ, Some(&bytes)) };
+  unsafe {
+    let _ = RegCloseKey(hkey);
+  }
+  if status == ERROR_SUCCESS {
+    Ok(())
+  } else {
+    Err(format!("INTERNAL: cannot write HKCU\\{key}\\{value} ({})", status.0))
+  }
+}
+
+/// The app, registered on first use: the AUMID's registry entry (Action Center shows its name and
+/// icon) and the process's explicit AUMID.
+fn app(cmd: &json::V, resources: Option<&Path>) -> Result<App, String> {
+  let mut current = APP.lock().unwrap();
+  if let Some(app) = current.as_ref() {
+    return Ok(app.clone());
+  }
+  let field = |name: &str| cmd.get("app").and_then(|a| a.get(name)).and_then(|v| v.as_str()).filter(|s| !s.is_empty());
+  let (id, name) = (field("id").ok_or("app.id is required")?, field("name").ok_or("app.name is required")?);
+  // AppUserModelID: at most 128 characters, no spaces (Application User Model IDs, Microsoft Learn).
+  if id.chars().count() > 128 || id.contains(char::is_whitespace) {
+    return Err(format!("INTERNAL: the app id {id} cannot be an AppUserModelID (at most 128 characters, no spaces)"));
+  }
+  let key = format!(r"Software\Classes\AppUserModelId\{id}");
+  write_string(&key, "DisplayName", name)?;
+  if let Some(icon) = resources.and_then(|r| icon_file(id, r)) {
+    write_string(&key, "IconUri", &icon.to_string_lossy())?;
+  }
+  let aumid = HSTRING::from(id);
+  unsafe { SetCurrentProcessExplicitAppUserModelID(&aumid) }.map_err(failed("SetCurrentProcessExplicitAppUserModelID"))?;
+  let app = App { id: aumid };
+  *current = Some(app.clone());
+  Ok(app)
+}
+
+/// At launch, before any window exists (lib.rs akan_native_run): the taskbar groups and pins the app by
+/// its AppUserModelID from the start, not only after the first notification registered it.
+pub fn claim_app_id(id: &str) {
+  if id.chars().count() > 128 || id.contains(char::is_whitespace) {
+    return log!("the app id {id} cannot be an AppUserModelID (at most 128 characters, no spaces)");
+  }
+  if let Err(e) = unsafe { SetCurrentProcessExplicitAppUserModelID(&HSTRING::from(id)) } {
+    log!("SetCurrentProcessExplicitAppUserModelID: {}", e.message());
+  }
+}
+
+fn registered() -> Result<App, String> {
+  APP.lock().unwrap().clone().ok_or_else(|| "INTERNAL: the app is not registered for notifications".into())
+}
+
+// ───────────────────────── icon ─────────────────────────
+
+/// IconUri wants an image file: the CLI's icon.rgba ([u32 width LE][u32 height LE][RGBA]) as a PNG
+/// in %LOCALAPPDATA%\<id>, rewritten only when it changed.
+fn icon_file(id: &str, resources: &Path) -> Option<PathBuf> {
+  let bytes = std::fs::read(resources.join("icon.rgba")).ok()?;
+  let (w, h) = (u32::from_le_bytes(bytes.get(0..4)?.try_into().ok()?), u32::from_le_bytes(bytes.get(4..8)?.try_into().ok()?));
+  let rgba = bytes.get(8..)?;
+  if w == 0 || h == 0 || rgba.len() != (w as usize) * (h as usize) * 4 {
+    return None;
+  }
+  let dir = PathBuf::from(std::env::var_os("LOCALAPPDATA")?).join(id);
+  let file = dir.join("notification-icon.png");
+  let data = png(w, h, rgba);
+  if std::fs::read(&file).ok().as_deref() != Some(&data[..]) {
+    std::fs::create_dir_all(&dir).ok()?;
+    std::fs::write(&file, &data).map_err(|e| log!("cannot write {}: {e}", file.display())).ok()?;
+  }
+  Some(file)
+}
+
+fn crc32(bytes: &[u8]) -> u32 {
+  let mut crc = !0u32;
+  for &b in bytes {
+    crc ^= b as u32;
+    for _ in 0..8 {
+      crc = if crc & 1 != 0 { (crc >> 1) ^ 0xEDB8_8320 } else { crc >> 1 };
+    }
+  }
+  !crc
+}
+
+fn adler32(bytes: &[u8]) -> u32 {
+  let (mut a, mut b) = (1u32, 0u32);
+  for &x in bytes {
+    a = (a + x as u32) % 65521;
+    b = (b + a) % 65521;
+  }
+  (b << 16) | a
+}
+
+/// An RGBA PNG with uncompressed ("stored") deflate blocks: valid without a zlib crate, and a
+/// 256×256 icon is 256 KB.
+fn png(width: u32, height: u32, rgba: &[u8]) -> Vec<u8> {
+  let mut raw = Vec::with_capacity((width as usize * 4 + 1) * height as usize);
+  for row in rgba.chunks_exact(width as usize * 4) {
+    raw.push(0); // filter: none
+    raw.extend_from_slice(row);
+  }
+  let mut z = vec![0x78, 0x01];
+  let blocks: Vec<&[u8]> = raw.chunks(65_535).collect();
+  for (i, block) in blocks.iter().enumerate() {
+    z.push((i + 1 == blocks.len()) as u8);
+    z.extend_from_slice(&(block.len() as u16).to_le_bytes());
+    z.extend_from_slice(&(!(block.len() as u16)).to_le_bytes());
+    z.extend_from_slice(block);
+  }
+  z.extend_from_slice(&adler32(&raw).to_be_bytes());
+  let mut out = b"\x89PNG\r\n\x1a\n".to_vec();
+  let mut chunk = |kind: &[u8; 4], data: &[u8]| {
+    out.extend_from_slice(&(data.len() as u32).to_be_bytes());
+    let start = out.len();
+    out.extend_from_slice(kind);
+    out.extend_from_slice(data);
+    let crc = crc32(&out[start..]);
+    out.extend_from_slice(&crc.to_be_bytes());
+  };
+  let mut header = Vec::with_capacity(13);
+  header.extend_from_slice(&width.to_be_bytes());
+  header.extend_from_slice(&height.to_be_bytes());
+  header.extend_from_slice(&[8, 6, 0, 0, 0]); // 8 bits, RGBA, deflate, no filter, no interlace
+  chunk(b"IHDR", &header);
+  chunk(b"IDAT", &z);
+  chunk(b"IEND", &[]);
+  out
+}
+
+// ───────────────────────── toasts ─────────────────────────
+
+/// Text for XML: escaped, without the control characters XML 1.0 does not allow.
+fn xml(text: &str) -> String {
+  let mut out = String::with_capacity(text.len());
+  for c in text.chars() {
+    match c {
+      '&' => out.push_str("&amp;"),
+      '<' => out.push_str("&lt;"),
+      '>' => out.push_str("&gt;"),
+      '"' => out.push_str("&quot;"),
+      '\'' => out.push_str("&apos;"),
+      '\t' | '\n' | '\r' => out.push(c),
+      c if (c as u32) < 0x20 => {}
+      c => out.push(c),
+    }
+  }
+  out
+}
+
+fn event(kind: &str, item: &Item) -> String {
+  format!(r#"{{"type":"notification","event":"{kind}","notification":{}}}"#, item.json(None))
+}
+
+fn show(item: &Item) -> Result<(), String> {
+  let app = registered()?;
+  let launch = item.json(Some(schedule::now_ms()));
+  let body = if item.body.is_empty() { String::new() } else { format!("<text>{}</text>", xml(&item.body)) };
+  let content = format!(r#"<toast launch="{}"><visual><binding template="ToastGeneric"><text>{}</text>{body}</binding></visual></toast>"#, xml(&launch), xml(&item.title));
+  let action = event("action", item);
+  let toast = (|| -> windows::core::Result<ToastNotification> {
+    let doc = XmlDocument::new()?;
+    doc.LoadXml(&HSTRING::from(content))?;
+    let toast = ToastNotification::CreateToastNotification(&doc)?;
+    toast.SetTag(&HSTRING::from(item.id.as_str()))?;
+    toast.SetGroup(&HSTRING::from(GROUP))?;
+    // A click on the toast (or on it in Action Center) while the app runs; on a thread-pool thread.
+    toast.Activated(&TypedEventHandler::<ToastNotification, IInspectable>::new(move |_, _| {
+      crate::push_event(&action);
+      Ok(())
+    }))?;
+    ToastNotificationManager::CreateToastNotifierWithId(&app.id)?.Show(&toast)?;
+    Ok(toast)
+  })()
+  .map_err(failed("showing the toast"))?;
+  {
+    let mut toasts = TOASTS.lock().unwrap();
+    toasts.retain(|(id, _)| id != &item.id);
+    toasts.push((item.id.clone(), toast));
+  }
+  crate::push_event(&event("received", item));
+  Ok(())
+}
+
+fn status(app: &App) -> Result<String, String> {
+  let enabled = match ToastNotificationManager::CreateToastNotifierWithId(&app.id).and_then(|n| n.Setting()) {
+    Ok(setting) => setting == NotificationSetting::Enabled,
+    // An unpackaged app has no entry in Settings > Notifications until its first toast, and Setting
+    // fails with ERROR_NOT_FOUND until then (seen on Windows 11 26200). Nobody can have turned the
+    // app off yet, so only the switch for all apps counts (0 when the user turned it off).
+    Err(e) if e.code() == HRESULT::from_win32(ERROR_NOT_FOUND.0) => {
+      crate::win::registry::read_dword(HKEY_CURRENT_USER, r"Software\Microsoft\Windows\CurrentVersion\PushNotifications", "ToastEnabled").ok().flatten() != Some(0)
+    }
+    Err(e) => return Err(failed("reading the notification setting")(e)),
+  };
+  Ok(format!(r#"{{"status":{}}}"#, if enabled { 2 } else { 1 }))
+}
+
+fn delivered(app: &App) -> Result<String, String> {
+  let list = ToastNotificationManager::History().and_then(|h| h.GetHistoryWithId(&app.id)).map_err(failed("reading Action Center"))?;
+  let mut out = Vec::new();
+  for i in 0..list.Size().map_err(failed("reading Action Center"))? {
+    let Ok(toast) = list.GetAt(i) else { continue };
+    if !toast.Group().is_ok_and(|g| g == GROUP) {
+      continue;
+    }
+    let Ok(launch) = toast.Content().and_then(|c| c.DocumentElement()).and_then(|e| e.GetAttribute(&HSTRING::from("launch"))) else { continue };
+    let launch = launch.to_string();
+    if json::parse(&launch).is_ok_and(|v| v.get("ours").and_then(|o| o.as_bool()) == Some(true)) {
+      out.push(launch);
+    }
+  }
+  Ok(format!("[{}]", out.join(",")))
+}
+
+fn remove_delivered(app: &App, ids: &[String]) -> Result<String, String> {
+  let history = ToastNotificationManager::History().map_err(failed("reading Action Center"))?;
+  for id in ids {
+    // Not there (dismissed meanwhile) is no error.
+    let _ = history.RemoveGroupedTagWithId(&HSTRING::from(id.as_str()), &HSTRING::from(GROUP), &app.id);
+  }
+  TOASTS.lock().unwrap().retain(|(id, _)| !ids.contains(id));
+  Ok("null".into())
+}
+
+/// Local calendar days: UTC → local wall-clock time, plus the days, back to UTC (the time zone's
+/// offset for the new date), so 09:00 stays 09:00 across DST.
+fn add_days(ms: f64, days: i64) -> f64 {
+  // FILETIME: 100 ns units since 1601; the Unix epoch is this far in.
+  const EPOCH: i64 = 116_444_736_000_000_000;
+  let to_ft = |t: i64| FILETIME { dwLowDateTime: t as u32, dwHighDateTime: (t >> 32) as u32 };
+  let from_ft = |f: FILETIME| ((f.dwHighDateTime as i64) << 32) | f.dwLowDateTime as i64;
+  let local = || -> Option<f64> {
+    let (mut utc, mut local, mut ft) = (SYSTEMTIME::default(), SYSTEMTIME::default(), FILETIME::default());
+    unsafe {
+      FileTimeToSystemTime(&to_ft((ms * 10_000.0) as i64 + EPOCH), &mut utc).ok()?;
+      SystemTimeToTzSpecificLocalTime(None, &utc, &mut local).ok()?;
+      SystemTimeToFileTime(&local, &mut ft).ok()?;
+      FileTimeToSystemTime(&to_ft(from_ft(ft) + days * 864_000_000_000), &mut local).ok()?;
+      TzSpecificLocalTimeToSystemTime(None, &local, &mut utc).ok()?;
+      SystemTimeToFileTime(&utc, &mut ft).ok()?;
+    }
+    Some((from_ft(ft) - EPOCH) as f64 / 10_000.0)
+  };
+  local().unwrap_or(ms + days as f64 * 86_400_000.0)
+}
+
+fn run(op: &str, cmd: &json::V, resources: Option<&Path>) -> Result<String, String> {
+  let app = app(cmd, resources)?;
+  if let Some(result) = schedule::op(op, cmd) {
+    return result;
+  }
+  match op {
+    "notify.status" | "notify.request" => status(&app),
+    "notify.delivered" => delivered(&app),
+    "notify.removeDelivered" => remove_delivered(&app, &schedule::ids(cmd)?),
+    _ => Err(format!("unknown op {op}")),
+  }
+}
+
+/// notify.* ops, answered from a thread (WinRT from the implicit multithreaded apartment, which
+/// windows-rs enters when a thread first activates a class). `app_dir`: the shell's app folder,
+/// next to the CLI's icon.rgba.
+pub fn async_op(id: u64, json_text: &str, app_dir: &Path) -> bool {
+  if !json_text.contains("\"notify.") {
+    return false;
+  }
+  let Ok(cmd) = json::parse(json_text) else { return false };
+  let Some(op) = cmd.get("op").and_then(|v| v.as_str()).filter(|op| op.starts_with("notify.")).map(str::to_string) else { return false };
+  schedule::start(schedule::Host { show, add_days });
+  let resources = app_dir.parent().map(Path::to_path_buf);
+  std::thread::spawn(move || crate::reply(id, run(&op, &cmd, resources.as_deref())));
+  true
+}

package/vendor/@akanjs/native/native/desktop/src/win/open.rs

@@ -0,0 +1,127 @@
+//! Opening URLs with their default app on Windows (opener, browser and auth-session plugins).
+//!   shell.open    {url} → null      ShellExecuteExW, on a thread of its own (answered through crate::reply)
+//!   shell.handler {url} → {"app"}   the app registered for the URL's scheme, or null
+//! Errors: `NOT_FOUND: …` when no app is registered for the scheme, `INTERNAL: …` otherwise.
+//!
+//! ShellExecuteEx can block for an unbounded time (Electron runs it on a COM STA worker thread:
+//! electron/shell/common/platform_util_win.cc OpenExternalOnWorkerThread), and shell extensions
+//! need a single-threaded apartment (chromium/ui/base/win/shell.cc InvokeShellExecute), so each
+//! call gets a thread with COM initialized. SEE_MASK_FLAG_NO_UI: an unregistered scheme fails with
+//! ERROR_NO_ASSOCIATION instead of Windows' "you'll need a new app" dialog.
+//! The handler lookup is AssocQueryStringW with ASSOCF_IS_PROTOCOL, as Electron's
+//! app.getApplicationNameForProtocol (electron/shell/browser/browser_win.cc:103-153).
+
+use windows::core::{HSTRING, PCWSTR, PWSTR};
+use windows::Win32::Foundation::{ERROR_NO_ASSOCIATION, WIN32_ERROR};
+use windows::Win32::System::Com::{CoInitializeEx, CoUninitialize, COINIT_APARTMENTTHREADED, COINIT_DISABLE_OLE1DDE};
+use windows::Win32::UI::Shell::{
+  AssocQueryStringW, ShellExecuteExW, ASSOCF_INIT_IGNOREUNKNOWN, ASSOCF_IS_PROTOCOL, ASSOCF_NOTRUNCATE, ASSOCSTR, ASSOCSTR_EXECUTABLE, ASSOCSTR_FRIENDLYAPPNAME,
+  SEE_MASK_FLAG_NO_UI, SEE_MASK_NOASYNC, SHELLEXECUTEINFOW,
+};
+use windows::Win32::UI::WindowsAndMessaging::SW_SHOWNORMAL;
+
+use crate::json;
+
+fn url_arg(cmd: &json::V) -> Result<String, String> {
+  let url = cmd.get("url").and_then(|v| v.as_str()).ok_or("url must be a string")?;
+  if url.is_empty() || url.chars().any(char::is_control) {
+    return Err("url must be a URL".into());
+  }
+  Ok(url.to_string())
+}
+
+/// The URL's scheme, lowercase ("https" for "HTTPS://…").
+fn scheme(url: &str) -> Option<String> {
+  let (scheme, _) = url.split_once(':')?;
+  let ok = scheme.len() > 1 && scheme.starts_with(|c: char| c.is_ascii_alphabetic()) && scheme.chars().all(|c| c.is_ascii_alphanumeric() || "+-.".contains(c));
+  ok.then(|| scheme.to_ascii_lowercase())
+}
+
+/// Opens a URL (or file) with its default app. Blocks: call it off the main thread.
+pub fn open(url: &str) -> Result<(), String> {
+  let file = HSTRING::from(url);
+  let verb = HSTRING::from("open");
+  let mut info = SHELLEXECUTEINFOW {
+    cbSize: std::mem::size_of::<SHELLEXECUTEINFOW>() as u32,
+    fMask: SEE_MASK_NOASYNC | SEE_MASK_FLAG_NO_UI,
+    lpVerb: PCWSTR(verb.as_ptr()),
+    lpFile: PCWSTR(file.as_ptr()),
+    nShow: SW_SHOWNORMAL.0,
+    ..Default::default()
+  };
+  let com = unsafe { CoInitializeEx(None, COINIT_APARTMENTTHREADED | COINIT_DISABLE_OLE1DDE) };
+  let result = unsafe { ShellExecuteExW(&mut info) };
+  if com.is_ok() {
+    unsafe { CoUninitialize() };
+  }
+  result.map_err(|e| {
+    let what = scheme(url).map_or_else(|| url.to_string(), |s| format!("{s}:"));
+    // An unregistered scheme fails with ERROR_NO_ASSOCIATION, or ERROR_FILE_NOT_FOUND when Windows
+    // takes the URL for a file name: the lookup tells.
+    if WIN32_ERROR::from_error(&e) == Some(ERROR_NO_ASSOCIATION) || (scheme(url).is_some() && handler(url).is_none()) {
+      format!("NOT_FOUND: no app is registered for {what}")
+    } else {
+      format!("INTERNAL: cannot open {what}: {}", e.message())
+    }
+  })
+}
+
+fn assoc(scheme: &str, what: ASSOCSTR) -> Option<String> {
+  let scheme = HSTRING::from(scheme);
+  let flags = ASSOCF_IS_PROTOCOL | ASSOCF_NOTRUNCATE | ASSOCF_INIT_IGNOREUNKNOWN;
+  let mut buffer = vec![0u16; 1024];
+  let mut size = buffer.len() as u32;
+  let hr = unsafe { AssocQueryStringW(flags, what, &scheme, PCWSTR::null(), Some(PWSTR(buffer.as_mut_ptr())), &mut size) };
+  if hr.is_err() {
+    return None;
+  }
+  let text = String::from_utf16_lossy(&buffer[..(size as usize).saturating_sub(1).min(buffer.len())]);
+  let text = text.trim_end_matches('\0').trim().to_string();
+  (!text.is_empty()).then_some(text)
+}
+
+/// The app that opens `url`'s scheme: its display name (Store apps too), else its executable.
+pub fn handler(url: &str) -> Option<String> {
+  let scheme = scheme(url)?;
+  assoc(&scheme, ASSOCSTR_FRIENDLYAPPNAME).or_else(|| assoc(&scheme, ASSOCSTR_EXECUTABLE))
+}
+
+/// `shell.handler`; None for other ops.
+pub fn shell_op(op: &str, cmd: &json::V) -> Option<Result<String, String>> {
+  if op != "shell.handler" {
+    return None;
+  }
+  Some(url_arg(cmd).map(|url| format!(r#"{{"app":{}}}"#, handler(&url).map_or("null".into(), |app| json::quote(&app)))))
+}
+
+/// `shell.open`, answered from its thread; false for other ops.
+pub fn async_op(id: u64, json_text: &str) -> bool {
+  if !json_text.contains("\"shell.open\"") {
+    return false;
+  }
+  let Ok(cmd) = json::parse(json_text) else { return false };
+  if cmd.get("op").and_then(|v| v.as_str()) != Some("shell.open") {
+    return false;
+  }
+  match url_arg(&cmd) {
+    Ok(url) => {
+      std::thread::spawn(move || crate::reply(id, open(&url).map(|()| "null".to_string())));
+    }
+    Err(e) => crate::reply(id, Err(e)),
+  }
+  true
+}
+
+#[cfg(test)]
+mod tests {
+  use super::scheme;
+
+  #[test]
+  fn schemes() {
+    assert_eq!(scheme("HTTPS://example.com").as_deref(), Some("https"));
+    assert_eq!(scheme("mailto:a@b.c").as_deref(), Some("mailto"));
+    assert_eq!(scheme("ms-settings:privacy").as_deref(), Some("ms-settings"));
+    assert_eq!(scheme("C:\\Users\\a.txt"), None); // a drive letter, not a scheme
+    assert_eq!(scheme("no scheme"), None);
+  }
+}

package/vendor/@akanjs/native/native/desktop/src/win/power.rs

@@ -0,0 +1,64 @@
+//! Keeping the display and the system awake on Windows (keep-awake plugin).
+//!   power.preventSleep → null   a power request: display required + system required
+//!   power.allowSleep   → null   clears and closes it
+//! These are the two assertions caffeinate -d -i makes on macOS. A power request belongs to the
+//! process (unlike SetThreadExecutionState, which belongs to the calling thread and ends with it,
+//! keepawake-rs src/sys/windows.rs), the system ends it with the process, and
+//! `powercfg /requests` lists it with its reason.
+
+use std::sync::Mutex;
+
+use windows::core::{HSTRING, PWSTR};
+use windows::Win32::Foundation::{CloseHandle, HANDLE};
+use windows::Win32::System::Power::{PowerClearRequest, PowerCreateRequest, PowerSetRequest, PowerRequestDisplayRequired, PowerRequestSystemRequired};
+use windows::Win32::System::Threading::{POWER_REQUEST_CONTEXT_SIMPLE_STRING, REASON_CONTEXT, REASON_CONTEXT_0};
+
+/// The open power request (a HANDLE as isize: raw pointers are not Send).
+static REQUEST: Mutex<Option<isize>> = Mutex::new(None);
+
+fn prevent(reason: &str) -> Result<(), String> {
+  let mut request = REQUEST.lock().unwrap();
+  if request.is_some() {
+    return Ok(());
+  }
+  let reason = HSTRING::from(reason);
+  let context = REASON_CONTEXT {
+    Version: 0, // POWER_REQUEST_CONTEXT_VERSION
+    Flags: POWER_REQUEST_CONTEXT_SIMPLE_STRING,
+    // Only read during the call.
+    Reason: REASON_CONTEXT_0 { SimpleReasonString: PWSTR(reason.as_ptr() as *mut u16) },
+  };
+  let handle = unsafe { PowerCreateRequest(&context) }.map_err(|e| format!("INTERNAL: PowerCreateRequest failed: {}", e.message()))?;
+  let set = unsafe { PowerSetRequest(handle, PowerRequestDisplayRequired).and_then(|()| PowerSetRequest(handle, PowerRequestSystemRequired)) };
+  if let Err(e) = set {
+    unsafe {
+      let _ = CloseHandle(handle);
+    }
+    return Err(format!("INTERNAL: PowerSetRequest failed: {}", e.message()));
+  }
+  *request = Some(handle.0 as isize);
+  Ok(())
+}
+
+fn allow() {
+  if let Some(raw) = REQUEST.lock().unwrap().take() {
+    let handle = HANDLE(raw as *mut _);
+    unsafe {
+      let _ = PowerClearRequest(handle, PowerRequestDisplayRequired);
+      let _ = PowerClearRequest(handle, PowerRequestSystemRequired);
+      let _ = CloseHandle(handle);
+    }
+  }
+}
+
+/// `power.*` ops; None for other ops. `app` names the app in the request's reason.
+pub fn shell_op(op: &str, app: &str) -> Option<Result<String, String>> {
+  match op {
+    "power.preventSleep" => Some(prevent(&format!("{app} keeps the display on")).map(|()| "null".into())),
+    "power.allowSleep" => {
+      allow();
+      Some(Ok("null".into()))
+    }
+    _ => None,
+  }
+}

package/vendor/@akanjs/native/native/desktop/src/win/registry.rs

@@ -0,0 +1,87 @@
+//! Registry values for the Windows parts of the shell (autostart's Run key, the camera consent
+//! store, the BIOS names), through RegGetValueW / RegSetValueExW (Win32_System_Registry).
+//! Errors are Win32 codes; a missing key or value is `Ok(None)`.
+
+use windows::core::{HSTRING, PCWSTR};
+use windows::Win32::Foundation::{ERROR_FILE_NOT_FOUND, ERROR_MORE_DATA, ERROR_SUCCESS, WIN32_ERROR};
+use windows::Win32::System::Registry::{
+  RegCloseKey, RegCreateKeyExW, RegDeleteKeyValueW, RegGetValueW, RegSetValueExW, HKEY, KEY_SET_VALUE, REG_OPTION_NON_VOLATILE, REG_ROUTINE_FLAGS, REG_SZ,
+  RRF_RT_REG_BINARY, RRF_RT_REG_DWORD, RRF_RT_REG_SZ,
+};
+
+pub use windows::Win32::System::Registry::{HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE};
+
+/// A Win32 error as the code and the system's message, e.g. `5 (Access is denied.)`.
+pub fn describe(code: WIN32_ERROR) -> String {
+  format!("{} ({})", code.0, windows::core::Error::from(code.to_hresult()).message())
+}
+
+/// The raw bytes of a value of one of the `flags` types. RegGetValueW adds the terminating NUL
+/// of strings that were stored without one.
+fn read(root: HKEY, key: &str, value: &str, flags: REG_ROUTINE_FLAGS) -> Result<Option<Vec<u8>>, WIN32_ERROR> {
+  let (key, value) = (HSTRING::from(key), HSTRING::from(value));
+  let mut size = 0u32;
+  let mut status = unsafe { RegGetValueW(root, &key, &value, flags, None, None, Some(&mut size)) };
+  // The value may grow between the two calls: ask again with the new size.
+  for _ in 0..4 {
+    if status == ERROR_FILE_NOT_FOUND {
+      return Ok(None);
+    }
+    if status != ERROR_SUCCESS && status != ERROR_MORE_DATA {
+      return Err(status);
+    }
+    let mut data = vec![0u8; size as usize];
+    status = unsafe { RegGetValueW(root, &key, &value, flags, None, Some(data.as_mut_ptr().cast()), Some(&mut size)) };
+    if status == ERROR_SUCCESS {
+      data.truncate(size as usize);
+      return Ok(Some(data));
+    }
+  }
+  Err(status)
+}
+
+/// A REG_SZ value (REG_EXPAND_SZ is expanded by RegGetValueW's default).
+pub fn read_string(root: HKEY, key: &str, value: &str) -> Result<Option<String>, WIN32_ERROR> {
+  Ok(read(root, key, value, RRF_RT_REG_SZ)?.map(|bytes| {
+    let wide: Vec<u16> = bytes.chunks_exact(2).map(|c| u16::from_le_bytes([c[0], c[1]])).collect();
+    let end = wide.iter().position(|&c| c == 0).unwrap_or(wide.len());
+    String::from_utf16_lossy(&wide[..end])
+  }))
+}
+
+pub fn read_binary(root: HKEY, key: &str, value: &str) -> Result<Option<Vec<u8>>, WIN32_ERROR> {
+  read(root, key, value, RRF_RT_REG_BINARY)
+}
+
+#[allow(dead_code)] // kept next to its siblings; the Run key and the consent store are strings
+pub fn read_dword(root: HKEY, key: &str, value: &str) -> Result<Option<u32>, WIN32_ERROR> {
+  Ok(read(root, key, value, RRF_RT_REG_DWORD)?.and_then(|b| b.get(..4).map(|b| u32::from_le_bytes([b[0], b[1], b[2], b[3]]))))
+}
+
+/// Writes a REG_SZ value, creating the key if needed.
+pub fn write_string(root: HKEY, key: &str, value: &str, data: &str) -> Result<(), WIN32_ERROR> {
+  let mut hkey = HKEY::default();
+  let status = unsafe { RegCreateKeyExW(root, &HSTRING::from(key), None, PCWSTR::null(), REG_OPTION_NON_VOLATILE, KEY_SET_VALUE, None, &mut hkey, None) };
+  if status != ERROR_SUCCESS {
+    return Err(status);
+  }
+  // UTF-16 with the terminating NUL, as bytes (the size RegSetValueExW wants includes it).
+  let bytes: Vec<u8> = data.encode_utf16().chain(std::iter::once(0)).flat_map(u16::to_le_bytes).collect();
+  let status = unsafe { RegSetValueExW(hkey, &HSTRING::from(value), None, REG_SZ, Some(&bytes)) };
+  unsafe {
+    let _ = RegCloseKey(hkey);
+  }
+  if status == ERROR_SUCCESS {
+    Ok(())
+  } else {
+    Err(status)
+  }
+}
+
+/// Deletes a value; a missing key or value is fine.
+pub fn delete_value(root: HKEY, key: &str, value: &str) -> Result<(), WIN32_ERROR> {
+  match unsafe { RegDeleteKeyValueW(root, &HSTRING::from(key), &HSTRING::from(value)) } {
+    ERROR_SUCCESS | ERROR_FILE_NOT_FOUND => Ok(()),
+    status => Err(status),
+  }
+}