craft-native 0.0.451 → 0.0.467

package/dist/mobile-testing.js

@@ -201,6 +201,7 @@ ${errors}`);
   try {
     if (options.platform === "ios") {
       const files = await Bun.file(join(root, "ios/templates/CraftNativeFiles.swift")).text();
+      const ownership = await Bun.file(join(root, "ios/templates/CraftNativeMediaOwnership.swift")).text();
       const media = files.slice(files.indexOf("enum CraftNativeMedia {"));
       if (!media.startsWith("enum CraftNativeMedia"))
         throw new Error("iOS media implementation missing");
@@ -208,8 +209,10 @@ ${errors}`);
       const isolated = media.replace(/static var root: URL \{[\s\S]*?\n    \}/, 'static var root: URL { CommandLine.arguments.count > 3 ? URL(fileURLWithPath: CommandLine.arguments[3]) : URL(fileURLWithPath: NSTemporaryDirectory()).appendingPathComponent("hq-download-probe-media") }');
       await Bun.write(source, `import Foundation
 import CryptoKit
+import Network
 struct CraftNativeActionError: Error { let code: String;
   let message: String }
+${ownership}
 ${isolated}
 ${await Bun.file(join(fixtures, "media-cache.swift.fixture")).text()}`);
       const iosSDK = (await run(["xcrun", "--sdk", "iphonesimulator", "--show-sdk-path"])).trim();
@@ -229,6 +232,7 @@ ${await Bun.file(join(fixtures, "media-cache.swift.fixture")).text()}`);
         await run(["xcrun", "simctl", "bootstatus", simulator, "-b"]);
       }
       const base = `http://127.0.0.1:${server.port}/ios`;
+      const mediaRoot = join(scratch, "media");
       const image = join(scratch, "cache-pressure.sparseimage");
       const volume = join(scratch, "cache-volume");
       await mkdir(volume);
@@ -240,14 +244,16 @@ ${await Bun.file(join(fixtures, "media-cache.swift.fixture")).text()}`);
       mountedVolume = "";
       print("PASS: iOS native ENOSPC, cache cleanup, progress preservation and video redownload");
       if (!storageOnly) {
-        print(await run(["xcrun", "simctl", "spawn", simulator, executable, base, "normal"]));
-        const interrupted = await run(["xcrun", "simctl", "spawn", simulator, executable, base, "interrupt"], scratch, true);
+        print(await run(["xcrun", "simctl", "spawn", simulator, executable, base, "normal", mediaRoot]));
+        for (const phase of ["retire", "retired-recover"])
+          print(await run(["xcrun", "simctl", "spawn", simulator, executable, base, phase, mediaRoot]));
+        const interrupted = await run(["xcrun", "simctl", "spawn", simulator, executable, base, "interrupt", mediaRoot], scratch, true);
         print(interrupted);
         if (!interrupted.includes("KILLING"))
           throw new Error("iOS probe did not reach process-death checkpoint");
         if (counts.get("/ios/restart.mp4") !== 1)
           throw new Error("iOS process did not start interrupted download");
-        print(await run(["xcrun", "simctl", "spawn", simulator, executable, base, "recover"]));
+        print(await run(["xcrun", "simctl", "spawn", simulator, executable, base, "recover", mediaRoot]));
         if (counts.get("/ios/slow.mp4") !== 1)
           throw new Error("iOS duplicate fetch: keep did not coalesce");
         if (counts.get("/ios/account/slow.mp4") !== 2)
@@ -328,6 +334,9 @@ ${await Bun.file(join(fixtures, "media-cache.kt")).text()}`);
       print("PASS: Android native ENOSPC, cache cleanup, progress preservation and video redownload");
       if (!storageOnly) {
         await probe("normal");
+        await probe("retire");
+        await run([adb, "-s", serial, "shell", "am", "force-stop", packageName]);
+        await probe("retired-recover");
         await probe("interrupt", true);
         if (counts.get("/android/restart.mp4") !== 1)
           throw new Error("Android process did not start interrupted download");

package/dist/mobile.d.ts

@@ -6,3 +6,5 @@
  * which intentionally target Bun and must not enter a browser bundle.
  */
 export * from './api/mobile.js';
+export { matchNativePath, normalizeNativePath } from './native-routing.js';
+export type { NativePathMatch, NativeParameterConstraint, NativeRouteConstraints } from './native-routing.js';

package/dist/mobile.js

@@ -1964,6 +1964,124 @@ function getCraftMobile() {
   }
   return;
 }
+// src/native-routing.ts
+function applyNativeParameterConstraints(params, rules) {
+  if (rules === undefined)
+    return true;
+  if (!rules || typeof rules !== "object" || Array.isArray(rules))
+    return false;
+  for (const [name, rule] of Object.entries(rules)) {
+    let value = params[name];
+    if (typeof value !== "string" || !rule || typeof rule !== "object" || Array.isArray(rule))
+      return false;
+    if (Object.keys(rule).some((key) => !["pattern", "exclude", "normalize"].includes(key)))
+      return false;
+    if (rule.normalize !== undefined && rule.normalize !== "lowercase")
+      return false;
+    if (rule.normalize === "lowercase")
+      value = value.toLowerCase();
+    if (rule.exclude !== undefined) {
+      if (!Array.isArray(rule.exclude) || rule.exclude.some((item) => typeof item !== "string"))
+        return false;
+      if (rule.exclude.some((item) => (rule.normalize === "lowercase" ? item.toLowerCase() : item) === value))
+        return false;
+    }
+    if (rule.pattern !== undefined) {
+      if (typeof rule.pattern !== "string")
+        return false;
+      try {
+        const matched = new RegExp(`^(?:${rule.pattern})$`).exec(value);
+        if (!matched || matched[0] !== value)
+          return false;
+      } catch {
+        return false;
+      }
+    }
+    params[name] = value;
+  }
+  return true;
+}
+function normalizeNativePath(raw) {
+  if (typeof raw !== "string")
+    return null;
+  let path = raw;
+  const cut = path.search(/[?#]/);
+  if (cut >= 0)
+    path = path.slice(0, cut);
+  if (!path.startsWith("/"))
+    return null;
+  path = path.replace(/\/{2,}/g, "/");
+  if (path.length > 1 && path.endsWith("/"))
+    path = path.slice(0, -1);
+  return path;
+}
+function routeSegments(path) {
+  return path === "/" ? [] : path.slice(1).split("/");
+}
+function matchNativePath(nativeScreens, raw, constraints) {
+  if (constraints !== undefined && (!constraints || typeof constraints !== "object" || Array.isArray(constraints)))
+    return null;
+  const path = normalizeNativePath(raw);
+  if (path === null)
+    return null;
+  const routes = Object.entries(nativeScreens ?? {}).map(([pattern, screen]) => ({ key: pattern, pattern: normalizeNativePath(pattern), screen })).filter((route) => route.pattern !== null && !!route.screen).map((route) => ({ ...route, segments: routeSegments(route.pattern) }));
+  const wild = (segments) => segments.at(-1) === "*" ? 1 : 0;
+  const fixed = (segments) => segments.filter((s) => s !== "*" && !s.startsWith(":")).length;
+  routes.sort((a, b) => wild(a.segments) - wild(b.segments) || fixed(b.segments) - fixed(a.segments) || b.segments.length - a.segments.length || (a.pattern < b.pattern ? -1 : a.pattern > b.pattern ? 1 : 0));
+  const decode = (value) => {
+    try {
+      return decodeURIComponent(value);
+    } catch {
+      return value;
+    }
+  };
+  const parts = routeSegments(path);
+  for (const route of routes) {
+    const params = {};
+    let matched = true;
+    for (let i = 0;i < route.segments.length; i++) {
+      const segment = route.segments[i];
+      if (segment === "*") {
+        params["*"] = parts.slice(i).join("/");
+        break;
+      }
+      if (i >= parts.length) {
+        matched = false;
+        break;
+      }
+      if (segment.startsWith(":")) {
+        if (!parts[i]) {
+          matched = false;
+          break;
+        }
+        params[segment.slice(1)] = decode(parts[i]);
+      } else if (segment !== parts[i]) {
+        matched = false;
+        break;
+      }
+    }
+    if (!matched)
+      continue;
+    if (route.segments.at(-1) !== "*" && route.segments.length !== parts.length)
+      continue;
+    if (!applyNativeParameterConstraints(params, constraints?.[route.key]))
+      continue;
+    const query = raw.indexOf("?");
+    if (query >= 0) {
+      for (const item of raw.slice(query + 1).split("#")[0].split("&")) {
+        if (!item)
+          continue;
+        const [rawKey = "", ...rest] = item.split("=");
+        const key = decode(rawKey);
+        if (!key || key in params)
+          continue;
+        params[key] = decode(rest.join("=").replace(/\+/g, " "));
+      }
+    }
+    return { path, screen: route.screen, params };
+  }
+  return null;
+}
 export {
   DEFAULT_SESSION_TOKEN_KEY,
   SESSION_EVENT,
@@ -1995,6 +2113,7 @@ export {
   lifecycle,
   liveActivities,
   location,
+  matchNativePath,
   music,
   network,
   normalizeDeepLinkURL,
@@ -2002,6 +2121,7 @@ export {
   normalizeHeartRateReading,
   normalizeHeartRateSamples,
   normalizeHeartRateState,
+  normalizeNativePath,
   normalizeNowPlaying,
   normalizeScheduledWorkout,
   notifications,

package/dist/native-notifications.d.ts

@@ -0,0 +1,17 @@
+/** Registered before notification delivery; payloads reference category ids. */
+export interface NativeNotificationCategory {
+    id: string;
+    actions: {
+        id: string;
+        title: string;
+        destructive?: boolean;
+        /** Open the app. Otherwise nativeApp handles the action in the background. */
+        foreground?: boolean;
+        authenticationRequired?: boolean;
+        textInput?: {
+            buttonTitle: string;
+            placeholder?: string;
+        };
+    }[];
+}
+export declare function nativeNotificationProblems(categories: unknown, nativeApp?: string, renderer?: string): string[];

package/dist/native-routing.d.ts

@@ -0,0 +1,26 @@
+/** Constraints on decoded named path parameters; query items cannot override them. */
+export interface NativeParameterConstraint {
+    /** A case-sensitive regular expression for the complete normalized value. */
+    pattern?: string;
+    exclude?: readonly string[];
+    /** Normalize decoded values and exclusions before case-sensitive grammar validation. */
+    normalize?: 'lowercase';
+}
+export type NativeRouteConstraints = Record<string, Record<string, NativeParameterConstraint>>;
+/** Validate and normalize the decoded parameter map before query binding. */
+export declare function applyNativeParameterConstraints(params: Record<string, string>, rules?: Record<string, NativeParameterConstraint>): boolean;
+export declare function nativeRouteConstraintProblems(screens?: Record<string, string>, constraints?: NativeRouteConstraints): string[];
+/** `/a//b/?q#h` → `/a/b`, the way the shell and the page compare paths. Null for a relative path. */
+export declare function normalizeNativePath(raw: string): string | null;
+export interface NativePathMatch {
+    path: string;
+    screen: string;
+    params: Record<string, string>;
+}
+export declare function routeSegments(path: string): string[];
+/**
+ * The native screen for a path, by the rules the shell (`CraftHybridRoutes`)
+ * and the page script apply: static segments win over `:params`, which win
+ * over a trailing `*`; query items become params under the path's own.
+ */
+export declare function matchNativePath(nativeScreens: Record<string, string> | undefined, raw: string, constraints?: NativeRouteConstraints): NativePathMatch | null;

package/dist/testing/media-cache/media-cache.kt

@@ -23,10 +23,10 @@ class DownloadProbe : android.app.Instrumentation() {
         proof.append("PASS: ").append(message).append('\n')
         android.util.Log.i("CraftMediaProbe", "PASS: $message")
     }
-    private fun keep(address: String): Boolean {
+    private fun keep(address: String, cacheKey: String? = null): Boolean {
         val done = java.util.concurrent.CountDownLatch(1)
         var ok = false
-        CraftNativeMedia.keep(targetContext, address, JSONObject(), true) {
+        CraftNativeMedia.keep(targetContext, address, JSONObject(), true, cacheKey = cacheKey) {
             latestErrorCode = it.code
             ok = (it.data as? JSONObject)?.optBoolean("ok") == true
             done.countDown()
@@ -58,7 +58,7 @@ class DownloadProbe : android.app.Instrumentation() {
                     check(keep(retained), "existing video is kept before storage pressure")
                     val original = CraftNativeMedia.local(targetContext, retained)!!.readBytes()
                     val fresh = "$base/storage.mp4"
-                    val staging = File(CraftNativeMedia.file(targetContext, fresh).absolutePath + ".part")
+                    val staging = CraftNativeMedia.part(targetContext, fresh)
                     val root = staging.parentFile!!
                     check(root.totalSpace in 1..(32L * 1024 * 1024), "storage pressure is confined to a bounded disposable volume")
                     val pressure = File(root, "pressure.mp4")
@@ -90,6 +90,44 @@ class DownloadProbe : android.app.Instrumentation() {
                     CraftNativeMedia.prune(targetContext, emptyList())
                     prefs.edit().clear().commit()
                 }
+                "retire" -> {
+                    val a = "$base/selective-a.mp4"
+                    val b = "$base/selective-b.mp4"
+                    check(keep(a) && keep(b), "two authorized videos are kept")
+                    val oldGeneration = CraftNativeMedia.generation(targetContext)
+                    check(targetContext.getSharedPreferences("media-probe", Context.MODE_PRIVATE).edit().putInt("old-generation", oldGeneration).commit(), "old worker generation is retained for restart verification")
+                    val cacheRoot = CraftNativeMedia.file(targetContext, a).parentFile!!
+                    android.system.Os.chmod(cacheRoot.absolutePath, 365) // 0555: read/search, no unlink
+                    var unlinkFailed = false
+                    try { CraftNativeMedia.remove(targetContext, a) } catch (error: java.io.IOException) { unlinkFailed = true }
+                    finally { android.system.Os.chmod(cacheRoot.absolutePath, 448) } // 0700
+                    check(unlinkFailed, "a real unlink failure is reported")
+                    check(CraftNativeMedia.local(targetContext, a) == null && CraftNativeMedia.local(targetContext, b) != null, "failed unlink hides revoked A and preserves authorized B")
+                    check(CraftNativeMedia.remove(targetContext, a) == 1, "removing A removes only its copy")
+                    check(CraftNativeMedia.local(targetContext, a) == null && CraftNativeMedia.local(targetContext, b) != null, "B stays available after A is revoked")
+                }
+                "retired-recover" -> {
+                    val a = "$base/selective-a.mp4"
+                    val b = "$base/selective-b.mp4"
+                    val oldGeneration = targetContext.getSharedPreferences("media-probe", Context.MODE_PRIVATE).getInt("old-generation", -1)
+                    check(CraftNativeMedia.local(targetContext, a) == null && CraftNativeMedia.local(targetContext, b) != null, "selective revocation survives a fresh Android process")
+                    fun obsoleteCompletion() {
+                        val result = CraftNativeMedia.transfer(targetContext, a, JSONObject(), oldGeneration, 0, ownerRevision = "") { false }
+                        check(result == CraftNativeMedia.Outcome.DONE, "obsolete worker retires without retry or publication")
+                    }
+                    obsoleteCompletion()
+                    check(keep(a), "a new authorized keep can re-grant A")
+                    val fresh = CraftNativeMedia.local(targetContext, a)!!.readBytes()
+                    obsoleteCompletion()
+                    check(CraftNativeMedia.local(targetContext, a)!!.readBytes().contentEquals(fresh), "obsolete worker cannot replace re-granted A")
+                    val decoder = android.media.MediaMetadataRetriever()
+                    try {
+                        decoder.setDataSource(CraftNativeMedia.local(targetContext, b)!!.absolutePath)
+                        check(decoder.getFrameAtTime(1000000) != null, "unrelated B still decodes offline after revocation and re-grant")
+                    } finally { decoder.release() }
+                    CraftNativeMedia.clear(targetContext)
+                    targetContext.getSharedPreferences("media-probe", Context.MODE_PRIVATE).edit().clear().commit()
+                }
                 "interrupt" -> {
                     CraftNativeMedia.prune(targetContext, emptyList())
                     CraftNativeMedia.keep(targetContext, restart, JSONObject(), true) {}
@@ -113,6 +151,32 @@ class DownloadProbe : android.app.Instrumentation() {
                 }
                 else -> {
                     CraftNativeMedia.prune(targetContext, emptyList())
+                    val queuedKey = "account:one:lesson:8:version:a"
+                    val expired = base + "/queued.mp4?token=expired"
+                    val renewed = base + "/queued.mp4?token=renewed"
+                    val queuedIdentity = CraftNativeMedia.identity(expired, JSONObject().put("cacheKey", queuedKey))
+                    val queuedGeneration = CraftNativeMedia.generation(targetContext)
+                    targetContext.getSharedPreferences("craft.media", Context.MODE_PRIVATE).edit().putString("source:${CraftNativeMedia.digest(queuedIdentity)}", CraftNativeMedia.digest(expired + "\n")).commit()
+                    val queuedWork = androidx.work.OneTimeWorkRequestBuilder<CraftNativeMediaWorker>()
+                        .setInputData(androidx.work.workDataOf("address" to queuedIdentity, "source" to expired, "headers" to "{}", "generation" to queuedGeneration))
+                        .setInitialDelay(1, java.util.concurrent.TimeUnit.DAYS)
+                        .addTag("craft-media:generation:$queuedGeneration")
+                        .build()
+                    androidx.work.WorkManager.getInstance(targetContext).enqueueUniqueWork("craft-media:${CraftNativeMedia.digest(queuedIdentity)}:any", androidx.work.ExistingWorkPolicy.REPLACE, queuedWork).result.get()
+                    check(keep(renewed, queuedKey), "a renewed authorized source replaces expired queued work immediately")
+                    val signed = base + "/keyed.mp4?token=first"
+                    val key = "account:one:lesson:7:version:a"
+                    check(keep(signed, key), "signed URL downloads under an account/version identity")
+                    val identity = CraftNativeMedia.identity(signed, JSONObject().put("cacheKey", key))
+                    val rotated = CraftNativeMedia.identity(base + "/keyed.mp4?token=second", JSONObject().put("cacheKey", key))
+                    check(identity == rotated && CraftNativeMedia.local(targetContext, rotated) != null, "renewed signed URLs reuse the complete copy offline")
+                    check(keep(base + "/keyed.mp4?token=second", key), "renewing authorization does not redownload unchanged content")
+                    check(CraftNativeMedia.local(targetContext, CraftNativeMedia.identity(signed, JSONObject().put("cacheKey", "account:two:lesson:7:version:a"))) == null, "another account cannot address the copy")
+                    check(CraftNativeMedia.local(targetContext, CraftNativeMedia.identity(signed, JSONObject().put("cacheKey", "account:one:lesson:7:version:b"))) == null, "a new version invalidates the copy")
+                    CraftNativeMedia.prune(targetContext, listOf(rotated))
+                    check(CraftNativeMedia.local(targetContext, rotated) != null, "key-aware prune retains the authorized source")
+                    CraftNativeMedia.prune(targetContext, emptyList())
+                    check(CraftNativeMedia.local(targetContext, rotated) == null, "revocation removes the keyed copy")
                     val broken = "$base/broken.mp4"
                     check(!keep(broken), "truncated transfer fails")
                     check(CraftNativeMedia.local(targetContext, broken) == null, "truncated transfer is not playable cache")
@@ -129,7 +193,8 @@ class DownloadProbe : android.app.Instrumentation() {
                     val settledName = "craft-media:${CraftNativeMedia.digest(settled)}:any"
                     val settledRequest = androidx.work.OneTimeWorkRequestBuilder<SettledMediaAttemptWorker>()
                         .addTag("craft-media").addTag("craft-media:${CraftNativeMedia.digest(settled)}")
-                        .addTag("craft-media:generation:${CraftNativeMedia.generation(targetContext)}").build()
+                        .addTag("craft-media:generation:${CraftNativeMedia.generation(targetContext)}")
+                        .addTag("craft-media:identity:${CraftNativeMedia.digest(settled)}:legacy").build()
                     work.enqueueUniqueWork(settledName, androidx.work.ExistingWorkPolicy.KEEP, settledRequest).result.get()
                     val settledDeadline = System.currentTimeMillis() + 10000
                     var settledInfo = work.getWorkInfoById(settledRequest.id).get()!!
@@ -150,7 +215,8 @@ class DownloadProbe : android.app.Instrumentation() {
                         .setInitialDelay(10, java.util.concurrent.TimeUnit.SECONDS)
                         .setInputData(androidx.work.workDataOf("address" to queued, "headers" to "{}", "generation" to CraftNativeMedia.generation(targetContext)))
                         .addTag("craft-media").addTag("craft-media:${CraftNativeMedia.digest(queued)}")
-                        .addTag("craft-media:generation:${CraftNativeMedia.generation(targetContext)}").build()
+                        .addTag("craft-media:generation:${CraftNativeMedia.generation(targetContext)}")
+                        .addTag("craft-media:identity:${CraftNativeMedia.digest(queued)}:legacy").build()
                     work.enqueueUniqueWork(queuedName, androidx.work.ExistingWorkPolicy.KEEP, queuedRequest).result.get()
                     val beforeJoin = work.getWorkInfoById(queuedRequest.id).get()!!
                     check(beforeJoin.state == androidx.work.WorkInfo.State.ENQUEUED && beforeJoin.runAttemptCount == 0, "the coalescing regression starts with a fresh queued transfer")
@@ -191,6 +257,9 @@ class DownloadProbe : android.app.Instrumentation() {
                     check(currentDone.await(25, java.util.concurrent.TimeUnit.SECONDS) && currentOK, "an obsolete worker cannot cancel the next generation's waiters")
 
                     val inflight = "$base/inflight/slow.mp4"
+                    // This fixture starts the old worker directly rather than through keep.
+                    // Give it the same persisted grant keep records after a clear.
+                    check(targetContext.getSharedPreferences("craft.media", Context.MODE_PRIVATE).edit().putBoolean("authorized:${CraftNativeMedia.digest(inflight)}", true).commit(), "the direct worker starts with an explicit grant")
                     val inflightGeneration = CraftNativeMedia.generation(targetContext)
                     var obsoleteOutcome: CraftNativeMedia.Outcome? = null
                     val obsoleteWriter = Thread { obsoleteOutcome = CraftNativeMedia.transfer(targetContext, inflight, JSONObject(), inflightGeneration, 0) { false } }

package/dist/testing/media-cache/media-cache.swift.fixture

@@ -15,13 +15,14 @@ func wait(_ ready: () -> Bool) {
 }
 var latestTask: URLSessionTask?
 var latestErrorCode: String?
-func start(_ address: String, _ done: @escaping (Bool) -> Void) {
+func start(_ source: String, cacheKey: String? = nil, _ done: @escaping (Bool) -> Void) {
+    let address = CraftNativeMedia.identity(source, options: cacheKey.map { ["cacheKey": $0] } ?? [:])
     if let local = CraftNativeMedia.local(address) { done((CraftNativeMedia.describe(address, local)["size"] as? Int ?? 0) > 0); return }
     guard let flight = CraftNativeMedia.begin(address, { result in
         if case .success(let data) = result { done((data as? [String: Any])?["ok"] as? Bool == true) }
         else if case .failure(let error) = result { latestErrorCode = error.code; done(false) }
     }) else { return }
-    let task = URLSession.shared.downloadTask(with: URL(string: address)!) { location, response, error in
+    let task = URLSession.shared.downloadTask(with: URL(string: source)!) { location, response, error in
         let result: Result<Any, CraftNativeActionError>
         if error != nil { result = .failure(CraftNativeActionError(code: "NETWORK_ERROR", message: "Interrupted")) }
         else if let location, let response = response as? HTTPURLResponse { result = CraftNativeMedia.store(address, at: location, response: response, flight: flight) }
@@ -31,9 +32,9 @@ func start(_ address: String, _ done: @escaping (Bool) -> Void) {
     latestTask = task
     task.resume()
 }
-func keep(_ address: String) -> Bool {
+func keep(_ address: String, cacheKey: String? = nil) -> Bool {
     var result: Bool?
-    start(address) { result = $0 }
+    start(address, cacheKey: cacheKey) { result = $0 }
     wait { result != nil }
     return result!
 }
@@ -78,6 +79,48 @@ if phase == "storage" {
     _ = CraftNativeMedia.prune(keep: [])
     exit(0)
 }
+if phase == "retire" || phase == "retired-recover" {
+    let a = base + "/selective-a.mp4"
+    let b = base + "/selective-b.mp4"
+    let saved = CraftNativeMedia.root.deletingLastPathComponent().appendingPathComponent("obsolete-stamp.json")
+    if phase == "retire" {
+        check(keep(a) && keep(b), "two authorized videos are kept")
+        let flight = CraftNativeMedia.begin(a) { _ in }!
+        let stamp = CraftNativeMedia.ownershipStamp(a, flight: flight)!
+        try JSONEncoder().encode(stamp).write(to: saved)
+        try fm.setAttributes([.posixPermissions: 0o555], ofItemAtPath: CraftNativeMedia.root.path)
+        var unlinkFailed = false
+        do { _ = try CraftNativeMedia.remove(a) } catch { unlinkFailed = true }
+        try fm.setAttributes([.posixPermissions: 0o700], ofItemAtPath: CraftNativeMedia.root.path)
+        check(unlinkFailed, "a real unlink failure is reported")
+        check(CraftNativeMedia.local(a) == nil && CraftNativeMedia.local(b) != nil, "failed unlink hides revoked A and preserves authorized B")
+        let removed = try CraftNativeMedia.remove(a)
+        check(removed == 1, "removing A removes only its copy")
+        check(CraftNativeMedia.local(a) == nil && CraftNativeMedia.local(b) != nil, "B stays available after A is revoked")
+    } else {
+        let stamp = try JSONDecoder().decode(CraftNativeMediaOwnership.Stamp.self, from: Data(contentsOf: saved))
+        check(CraftNativeMedia.local(a) == nil && CraftNativeMedia.local(b) != nil, "selective revocation survives a fresh simulator process")
+        func obsoleteCompletion() throws {
+            let payload = CraftNativeMedia.root.deletingLastPathComponent().appendingPathComponent("obsolete-download.mp4")
+            try Data(contentsOf: CraftNativeMedia.local(b)!).write(to: payload)
+            defer { try? fm.removeItem(at: payload) }
+            let response = HTTPURLResponse(url: URL(string: a)!, statusCode: 200, httpVersion: nil, headerFields: nil)!
+            let result = CraftNativeMedia.store(a, at: payload, response: response, stamp: stamp)
+            if case .failure(let error) = result { check(error.code == "CANCELLED", "obsolete transfer cannot publish after process restart") }
+            else { check(false, "obsolete transfer was accepted") }
+        }
+        try obsoleteCompletion()
+        check(keep(a), "a new authorized keep can re-grant A")
+        try obsoleteCompletion()
+        check(CraftNativeMedia.local(a) != nil && CraftNativeMedia.local(b) != nil, "old completion cannot replace re-granted A or remove B")
+        let generator = AVAssetImageGenerator(asset: AVURLAsset(url: CraftNativeMedia.local(b)!))
+        _ = try generator.copyCGImage(at: CMTime(seconds: 1, preferredTimescale: 600), actualTime: nil)
+        check(true, "unrelated B still decodes offline after revocation and re-grant")
+        _ = try CraftNativeMedia.clear()
+        try fm.removeItem(at: saved)
+    }
+    exit(0)
+}
 if phase == "interrupt" {
     _ = CraftNativeMedia.prune(keep: [])
     start(restart) { _ in }
@@ -105,6 +148,19 @@ check(CraftNativeMedia.local(broken) == nil, "truncated transfer is not playable
 check(keep(broken), "same URL retries successfully")
 check(!keep(base + "/partial.mp4"), "unsolicited partial response is refused")
 check(!keep(base + "/empty.mp4"), "empty file is refused")
+let signed = base + "/keyed.mp4?token=first"
+let key = "account:one:lesson:7:version:a"
+check(keep(signed, cacheKey: key), "authorized signed URL downloads under account/version identity")
+let identity = CraftNativeMedia.identity(signed, options: ["cacheKey": key])
+let rotated = CraftNativeMedia.identity(base + "/keyed.mp4?token=second", options: ["cacheKey": key])
+check(identity == rotated && CraftNativeMedia.local(rotated) != nil, "renewing a signed URL reuses the complete cached file offline")
+check(keep(base + "/keyed.mp4?token=second", cacheKey: key), "renewed authorization does not redownload unchanged content")
+check(CraftNativeMedia.local(CraftNativeMedia.identity(signed, options: ["cacheKey": "account:two:lesson:7:version:a"])) == nil, "another account cannot address the private copy")
+check(CraftNativeMedia.local(CraftNativeMedia.identity(signed, options: ["cacheKey": "account:one:lesson:7:version:b"])) == nil, "a new prepared version invalidates the old copy")
+_ = CraftNativeMedia.prune(keep: [rotated])
+check(CraftNativeMedia.local(rotated) != nil, "key-aware prune retains the current authorized source")
+_ = CraftNativeMedia.prune(keep: [])
+check(CraftNativeMedia.local(rotated) == nil, "definitive revocation removes the keyed copy")
 let slow = base + "/slow.mp4"
 var answers = [Bool]()
 start(slow) { answers.append($0) }

package/dist/typescript/src/native-notifications.d.ts

@@ -0,0 +1,17 @@
+/** Registered before notification delivery; payloads reference category ids. */
+export interface NativeNotificationCategory {
+    id: string;
+    actions: {
+        id: string;
+        title: string;
+        destructive?: boolean;
+        /** Open the app. Otherwise nativeApp handles the action in the background. */
+        foreground?: boolean;
+        authenticationRequired?: boolean;
+        textInput?: {
+            buttonTitle: string;
+            placeholder?: string;
+        };
+    }[];
+}
+export declare function nativeNotificationProblems(categories: unknown, nativeApp?: string, renderer?: string): string[];

package/dist/typescript/src/native-routing.d.ts

@@ -0,0 +1,26 @@
+/** Constraints on decoded named path parameters; query items cannot override them. */
+export interface NativeParameterConstraint {
+    /** A case-sensitive regular expression for the complete normalized value. */
+    pattern?: string;
+    exclude?: readonly string[];
+    /** Normalize decoded values and exclusions before case-sensitive grammar validation. */
+    normalize?: 'lowercase';
+}
+export type NativeRouteConstraints = Record<string, Record<string, NativeParameterConstraint>>;
+/** Validate and normalize the decoded parameter map before query binding. */
+export declare function applyNativeParameterConstraints(params: Record<string, string>, rules?: Record<string, NativeParameterConstraint>): boolean;
+export declare function nativeRouteConstraintProblems(screens?: Record<string, string>, constraints?: NativeRouteConstraints): string[];
+/** `/a//b/?q#h` → `/a/b`, the way the shell and the page compare paths. Null for a relative path. */
+export declare function normalizeNativePath(raw: string): string | null;
+export interface NativePathMatch {
+    path: string;
+    screen: string;
+    params: Record<string, string>;
+}
+export declare function routeSegments(path: string): string[];
+/**
+ * The native screen for a path, by the rules the shell (`CraftHybridRoutes`)
+ * and the page script apply: static segments win over `:params`, which win
+ * over a trailing `*`; query items become params under the path's own.
+ */
+export declare function matchNativePath(nativeScreens: Record<string, string> | undefined, raw: string, constraints?: NativeRouteConstraints): NativePathMatch | null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "craft-native",
-  "version": "0.0.451",
+  "version": "0.0.467",
   "type": "module",
   "description": "Build desktop apps with web languages - TypeScript SDK for Craft",
   "author": "Chris Breuer <chris@stacksjs.org>",