crossbind 2.0.0-beta.68 → 2.0.0-beta.69

package/src/utils/appFiles.js

@@ -0,0 +1,58 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+// The first link a file or folder holds, by its path inside root, or none: an app carries no link, which could reach any
+// file of the machine it is built on.
+export function linkIn(full, root) {
+    const stat = fs.lstatSync(full);
+    if (stat.isSymbolicLink()) return path.relative(root, full);
+    if (!stat.isDirectory()) return null;
+    for (const entry of fs.readdirSync(full)) {
+        const found = linkIn(path.join(full, entry), root);
+        if (found) return found;
+    }
+    return null;
+}
+
+// Whether a path leads out of root, as a relative one of .. does.
+export const isOutside = (relative) => relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative);
+
+const LINKED = 'an app carries no link, which could reach any file of the machine it is built on';
+
+// A file or folder a list of the files an app carries names, relative to root as it is written there, which whose names:
+// inside root, as the system reaches it through any link on the way, and holding no link.
+export function carriedPath(where, root, file, whose) {
+    const full = path.resolve(root, String(file));
+    const relative = path.relative(root, full);
+    if (typeof file !== 'string' || path.isAbsolute(file) || isOutside(relative) || relative === '') {
+        throw new Error(`crossbind: ${where} names ${JSON.stringify(file)}, which is no path inside the ${whose} folder.`);
+    }
+    if (!fs.existsSync(full)) throw new Error(`crossbind: ${where} names ${file}, which is no file or folder of the ${whose}.`);
+    const real = path.relative(fs.realpathSync(root), fs.realpathSync(full));
+    if (isOutside(real) || real === '') throw new Error(`crossbind: ${where} names ${file}, which a link leads out of the ${whose} folder: ${LINKED}.`);
+    const link = linkIn(full, root);
+    if (link) throw new Error(`crossbind: ${where} names ${file}, which holds the link ${link}: ${LINKED}.`);
+    return relative;
+}
+
+// Each file the lists name, those in their folders too, by its full path: what a build fingerprints by its size and
+// time, as a large model would take long to read at each build.
+export function carriedFilesOf(extensions, app) {
+    const filesOf = (full) => (fs.statSync(full).isDirectory()
+        ? fs.readdirSync(full).flatMap((entry) => filesOf(path.join(full, entry)))
+        : [full]);
+    return [...extensions.flatMap(({ root, paths }) => paths.map((file) => path.join(root, file))), ...app.paths.map((file) => path.join(app.root, file))]
+        .flatMap(filesOf);
+}
+
+// What an app carries beside its page: each extension's files in ext/<name>/ and the app's own in files/, each in the
+// place it had in its folder, as clones where the file system makes them, as each part of a phone's app copies them.
+export function copyCarriedFiles(resources, extensions, app) {
+    const copy = (root, file, to) => {
+        const target = path.join(to, file);
+        fs.mkdirSync(path.dirname(target), { recursive: true });
+        fs.cpSync(path.join(root, file), target, { recursive: true, mode: fs.constants.COPYFILE_FICLONE });
+    };
+    extensions.forEach(({ name, root, paths }) => paths.forEach((file) => copy(root, file, path.join(resources, 'ext', name))));
+    app.paths.forEach((file) => copy(app.root, file, path.join(resources, 'files')));
+}

package/src/utils/appLaunches.js

@@ -0,0 +1,249 @@
+// What opens an app beside its schemes' links: the files of its types, on iOS and Android the https links of its sites
+// and the quick actions of its icon, and on iOS and macOS the user activities of its types, each with the extension that
+// declared it, whose native code gets them, or null for the app's own, which the host hands the page.
+
+const FILE_TYPE_KEYS = ['name', 'extensions', 'mimeTypes', 'role', 'contentTypes'];
+const ROLES = ['editor', 'viewer'];
+const EXTENSION = /^[a-z0-9][a-z0-9_+-]*$/;
+// Of what an Android manifest's attribute and a C++ string literal hold as they are.
+const MIME_TYPE = /^[a-z0-9][a-z0-9!#$^_.+-]*\/[a-z0-9][a-z0-9!#$^_.+-]*$/;
+const CONTENT_TYPE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)+$/;
+// A domain of two labels at least, the last of letters or punycode, maybe with *. for its subdomains, then maybe the
+// path its links start with, of the characters a URL's path takes as they are, but those a manifest's attribute or the
+// host's C++ string literal escapes, and %, as Android and the host match a link's decoded path.
+const LINK = /^(\*\.)?([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+([a-z]{2,}|xn--[a-z0-9-]*[a-z0-9])(\/[A-Za-z0-9\-._~!$()+,;=:@/]*)?$/;
+
+const isPlainObject = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const ownerName = (extension, key) => (extension === null ? `app.${key}` : `the extension ${extension}`);
+
+function checkedList(at, values, pattern, what, isRequired) {
+    if (!Array.isArray(values)) throw new Error(`crossbind: ${at} ${JSON.stringify(values)} is no list of ${what}.`);
+    if (isRequired && values.length === 0) throw new Error(`crossbind: ${at} lists none, where it takes ${what}.`);
+    for (const value of values) {
+        if (typeof value !== 'string' || !pattern.test(value)) throw new Error(`crossbind: ${at} takes ${what}; ${JSON.stringify(value)} is none.`);
+    }
+    return values;
+}
+
+// The types of files an app opens: each with its name, which the system shows its files' kind by, the extensions of its
+// files, the MIME types Android and Linux match them by, its role, an editor's unless a viewer's, and the uniform type
+// identifiers Apple's platforms know a type by that they have of their own, as CSV's.
+export function checkedFileTypes(types, where) {
+    if (!Array.isArray(types)) {
+        throw new Error(`crossbind: ${where} ${JSON.stringify(types)} is no list of file types, as [{ name: 'GeoJSON', extensions: ['geojson'] }] is.`);
+    }
+    return types.map((type, index) => {
+        const at = `${where}[${index}]`;
+        if (!isPlainObject(type)) throw new Error(`crossbind: ${at} is no file type, as { name: 'GeoJSON', extensions: ['geojson'] } is.`);
+        const unknown = Object.keys(type).filter((key) => !FILE_TYPE_KEYS.includes(key));
+        if (unknown.length > 0) throw new Error(`crossbind: ${at} takes ${FILE_TYPE_KEYS.join(', ')}; ${unknown.join(', ')} is none of them.`);
+        if (typeof type.name !== 'string' || type.name.trim() === '') throw new Error(`crossbind: ${at} has no name, which the system shows its files' kind by.`);
+        // A Linux desktop entry and a Windows setup program hold it on one line.
+        if ([...type.name].some((character) => character.charCodeAt(0) < 0x20 || character.charCodeAt(0) === 0x7f)) throw new Error(`crossbind: ${at}.name ${JSON.stringify(type.name)} holds a control character, as a line break; name it on one line.`);
+        const role = type.role ?? 'editor';
+        if (!ROLES.includes(role)) throw new Error(`crossbind: ${at}.role is 'editor' or 'viewer'; ${JSON.stringify(type.role)} is neither.`);
+        return {
+            name: type.name,
+            extensions: checkedList(`${at}.extensions`, type.extensions, EXTENSION, "lowercase letters and digits without the dot, as 'geojson' is", true),
+            mimeTypes: checkedList(`${at}.mimeTypes`, type.mimeTypes ?? [], MIME_TYPE, "MIME types, as 'application/geo+json' is", false),
+            role,
+            contentTypes: checkedList(`${at}.contentTypes`, type.contentTypes ?? [], CONTENT_TYPE, "uniform type identifiers, as 'public.comma-separated-values-text' is", false),
+        };
+    });
+}
+
+// The types of files that open the app, app.fileTypes's, then its extensions', each with the extension that declared it,
+// or null. One owner of an extension's files alone: two stop the build, naming both.
+export function fileTypeOwners(config) {
+    const owned = [
+        ...checkedFileTypes(config.app.fileTypes ?? [], 'app.fileTypes').map((type) => ({ ...type, extension: null })),
+        ...(config.extensions ?? []).flatMap(({ name, app }) => (app.fileTypes ?? []).map((type) => ({ ...type, extension: name }))),
+    ];
+    const owners = new Map();
+    for (const { extensions, extension } of owned) {
+        for (const ending of extensions) {
+            if (!owners.has(ending)) {
+                owners.set(ending, extension);
+            } else if (owners.get(ending) === extension) {
+                throw new Error(`crossbind: ${ownerName(extension, 'fileTypes')} lists the files .${ending} twice.`);
+            } else {
+                throw new Error(`crossbind: ${ownerName(owners.get(ending), 'fileTypes')} and ${ownerName(extension, 'fileTypes')} both claim the files .${ending}, which one alone opens.`);
+            }
+        }
+    }
+    return owned;
+}
+
+const ROLE_NAMES = { editor: 'Editor', viewer: 'Viewer' };
+
+// A macOS app's document types: each by its extensions, unless its content types name it.
+export function macDocumentTypes(fileTypes) {
+    return fileTypes.map(({ name, extensions, mimeTypes, role, contentTypes }) => ({
+        CFBundleTypeName: name,
+        CFBundleTypeRole: ROLE_NAMES[role],
+        ...(contentTypes.length > 0 ? { LSItemContentTypes: contentTypes } : { CFBundleTypeExtensions: extensions }),
+        ...(mimeTypes.length > 0 ? { CFBundleTypeMIMETypes: mimeTypes } : {}),
+    }));
+}
+
+// An iOS app's document types, which iOS knows by type identifiers alone: Apple's that a type's content types name, else
+// one the app declares from the type's extensions and MIME types, named after its bundle id. The app opens a document
+// where it is.
+export function iosDocumentTypes(fileTypes, bundleId) {
+    if (fileTypes.length === 0) return {};
+    // A type identifier takes letters, digits, - and . alone.
+    const ownIdentifier = (type) => `${bundleId}.${type.extensions[0].replace(/[^A-Za-z0-9-]/g, '-')}`;
+    return {
+        CFBundleDocumentTypes: fileTypes.map((type) => ({
+            CFBundleTypeName: type.name,
+            CFBundleTypeRole: ROLE_NAMES[type.role],
+            LSItemContentTypes: type.contentTypes.length > 0 ? type.contentTypes : [ownIdentifier(type)],
+        })),
+        UTImportedTypeDeclarations: fileTypes.filter((type) => type.contentTypes.length === 0).map((type) => ({
+            UTTypeIdentifier: ownIdentifier(type),
+            UTTypeDescription: type.name,
+            UTTypeConformsTo: ['public.data'],
+            UTTypeTagSpecification: {
+                'public.filename-extension': type.extensions,
+                ...(type.mimeTypes.length > 0 ? { 'public.mime-type': type.mimeTypes } : {}),
+            },
+        })),
+        LSSupportsOpeningDocumentsInPlace: true,
+    };
+}
+
+// The https links of a list's sites, which open the app on iOS and Android: each a domain, lowercase, maybe with *. for
+// its subdomains, then maybe the path its links start with, as example.com/invite is.
+export function checkedLinks(links, where) {
+    if (!Array.isArray(links)) throw new Error(`crossbind: ${where} ${JSON.stringify(links)} is no list of links, as ['example.com/invite'] is.`);
+    for (const link of links) {
+        if (typeof link !== 'string' || !LINK.test(link)) {
+            const scheme = typeof link === 'string' ? /^(https?):\/\//.exec(link)?.[1] : undefined;
+            throw new Error(`crossbind: ${where} takes a site's domain, maybe with *. for its subdomains, then maybe the path its links start with, as example.com/invite is${scheme ? `, without its ${scheme}://` : ''}; ${JSON.stringify(link)} is none.`);
+        }
+    }
+    const twice = links.find((link, index) => links.indexOf(link) !== index);
+    if (twice) throw new Error(`crossbind: ${where} lists ${twice} twice.`);
+    return links;
+}
+
+// The type of a user activity or a quick action: a reverse-DNS name or an intent's class, of what an Info.plist's
+// string, an Android resource's attribute and the host's C++ string literal hold as they are.
+const TYPE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+// A web page's activity is a site's link.
+const BROWSING_WEB = 'NSUserActivityTypeBrowsingWeb';
+
+// The types of the user activities an iOS or macOS app continues, as Handoff from another of its user's devices does,
+// each once.
+export function checkedActivityTypes(types, where) {
+    checkedList(where, types, TYPE_NAME, "user activity types of letters, digits, ., _ and -, as 'com.example.app.edit' is", false);
+    if (types.includes(BROWSING_WEB)) throw new Error(`crossbind: ${where} cannot take ${BROWSING_WEB}, a web page's, which app.links takes by its site.`);
+    const twice = types.find((type, index) => types.indexOf(type) !== index);
+    if (twice) throw new Error(`crossbind: ${where} lists ${twice} twice.`);
+    return types;
+}
+
+// The types of the user activities the app continues, app.activityTypes's, then its extensions', each with the extension
+// that declared it, or null, whose activities the host's activities hands the page. Two owners of one stop the build,
+// naming both.
+export function activityTypeOwners(config) {
+    const owned = [
+        ...checkedActivityTypes(config.app.activityTypes ?? [], 'app.activityTypes').map((type) => ({ type, extension: null })),
+        ...(config.extensions ?? []).flatMap(({ name, app }) => (app.activityTypes ?? []).map((type) => ({ type, extension: name }))),
+    ];
+    owned.forEach(({ type, extension }, index) => {
+        const first = owned.findIndex((other) => other.type === type);
+        if (first !== index) {
+            throw new Error(`crossbind: ${ownerName(owned[first].extension, 'activityTypes')} and ${ownerName(extension, 'activityTypes')} both claim the user activities ${type}, which one alone continues.`);
+        }
+    });
+    return owned;
+}
+
+const SHORTCUT_KEYS = ['type', 'title', 'subtitle', 'icon'];
+// iOS's own icons of a quick action, UIApplicationShortcutIconType's names without its prefix.
+const SHORTCUT_ICONS = [
+    'add', 'alarm', 'audio', 'bookmark', 'capturePhoto', 'captureVideo', 'cloud', 'compose', 'confirmation', 'contact', 'date', 'favorite', 'home',
+    'invitation', 'location', 'love', 'mail', 'markLocation', 'message', 'pause', 'play', 'prohibit', 'search', 'share', 'shuffle', 'task',
+    'taskCompleted', 'time', 'update',
+];
+
+// Text the system shows on one line, or null for none where it may have none.
+function checkedLine(at, value, isRequired) {
+    if (value === undefined && !isRequired) return null;
+    if (typeof value !== 'string' || value.trim() === '') throw new Error(`crossbind: ${at} is no text, which the system shows.`);
+    // XML holds neither \uFFFE nor \uFFFF.
+    if (/[\p{Cc}\uFFFE\uFFFF]/u.test(value)) {
+        throw new Error(`crossbind: ${at} ${JSON.stringify(value)} holds a control character, as a line break; give it on one line.`);
+    }
+    return value;
+}
+
+// The quick actions of an iOS or Android app's icon: each by its type, with its title, and on iOS a subtitle and one of
+// its own icons, as compose is.
+export function checkedShortcutItems(items, where) {
+    if (!Array.isArray(items)) throw new Error(`crossbind: ${where} ${JSON.stringify(items)} is no list of quick actions, as [{ type: 'new-note', title: 'New note' }] is.`);
+    const checked = items.map((item, index) => {
+        const at = `${where}[${index}]`;
+        if (!isPlainObject(item)) throw new Error(`crossbind: ${at} is no quick action, as { type: 'new-note', title: 'New note' } is.`);
+        const unknown = Object.keys(item).filter((key) => !SHORTCUT_KEYS.includes(key));
+        if (unknown.length > 0) throw new Error(`crossbind: ${at} takes ${SHORTCUT_KEYS.join(', ')}; ${unknown.join(', ')} is none of them.`);
+        if (typeof item.type !== 'string' || !TYPE_NAME.test(item.type)) {
+            throw new Error(`crossbind: ${at}.type takes letters, digits, ., _ and -, as 'new-note' does; ${JSON.stringify(item.type)} is none.`);
+        }
+        if (item.icon !== undefined && item.icon !== null && !SHORTCUT_ICONS.includes(item.icon)) {
+            throw new Error(`crossbind: ${at}.icon is one of iOS's own icons, ${SHORTCUT_ICONS.join(', ')}; ${JSON.stringify(item.icon)} is none.`);
+        }
+        const subtitle = item.subtitle === null ? null : checkedLine(`${at}.subtitle`, item.subtitle, false);
+        return { type: item.type, title: checkedLine(`${at}.title`, item.title, true), subtitle, icon: item.icon ?? null };
+    });
+    const twice = checked.find(({ type }, index) => checked.findIndex((other) => other.type === type) !== index);
+    if (twice) throw new Error(`crossbind: ${where} lists the quick action ${twice.type} twice.`);
+    return checked;
+}
+
+// The quick actions of the app's icon, app.shortcutItems's, then its extensions', each with the extension that declared
+// it, or null, whose taps the host's shortcuts hands the page. Two owners of one type stop the build, naming both.
+export function shortcutItemOwners(config) {
+    const owned = [
+        ...checkedShortcutItems(config.app.shortcutItems ?? [], 'app.shortcutItems').map((item) => ({ ...item, extension: null })),
+        ...(config.extensions ?? []).flatMap(({ name, app }) => (app.shortcutItems ?? []).map((item) => ({ ...item, extension: name }))),
+    ];
+    owned.forEach(({ type, extension }, index) => {
+        const first = owned.findIndex((other) => other.type === type);
+        if (first !== index) {
+            throw new Error(`crossbind: ${ownerName(owned[first].extension, 'shortcutItems')} and ${ownerName(extension, 'shortcutItems')} both claim the quick action ${type}, whose taps one alone gets.`);
+        }
+    });
+    return owned;
+}
+
+// An iOS app's quick actions, as its Info.plist lists them.
+export const iosShortcutItems = (items) => items.map(({ type, title, subtitle, icon }) => ({
+    UIApplicationShortcutItemType: type,
+    UIApplicationShortcutItemTitle: title,
+    ...(subtitle ? { UIApplicationShortcutItemSubtitle: subtitle } : {}),
+    ...(icon ? { UIApplicationShortcutItemIconType: `UIApplicationShortcutIconType${icon[0].toUpperCase()}${icon.slice(1)}` } : {}),
+}));
+
+// A link's domain and the path its links start with, empty for all of the site's.
+export function appLinkParts(link) {
+    const slash = link.indexOf('/');
+    return slash < 0 ? { host: link, path: '' } : { host: link.slice(0, slash), path: link.slice(slash) };
+}
+
+// The links that open the app, app.links's, then its extensions', each with the extension that declared it, or null,
+// whose links the host's links hands the page. Two owners of one stop the build, naming both.
+export function linkOwners(config) {
+    const owned = [
+        ...checkedLinks(config.app.links ?? [], 'app.links').map((link) => ({ link, extension: null })),
+        ...(config.extensions ?? []).flatMap(({ name, app }) => (app.links ?? []).map((link) => ({ link, extension: name }))),
+    ];
+    owned.forEach(({ link, extension }, index) => {
+        const first = owned.findIndex((other) => other.link === link);
+        if (first !== index) {
+            throw new Error(`crossbind: ${ownerName(owned[first].extension, 'links')} and ${ownerName(extension, 'links')} both claim the links of ${link}, which one alone gets.`);
+        }
+    });
+    return owned;
+}

package/src/utils/appOptions.js

@@ -1,5 +1,6 @@
 // The app section of crossbind.config.js: what a user sees of an app, its name and, on the desktop, its window, and where
 // its page opens files.
+import { carriedPath } from './appFiles.js';
 
 const WINDOW_DEFAULTS = { width: 1024, height: 768, minWidth: 0, minHeight: 0, maxWidth: 0, maxHeight: 0, resizable: true, fullscreen: false, backgroundColor: null };
 // Larger than any display, and far within the int a host takes a size as.
@@ -8,9 +9,8 @@ const MAX_WINDOW_SIZE = 16384;
 const MAX_VERSION_NUMBER = 65535;
 // Up to four numbers, then a semver prerelease or build part; none of its characters needs escaping in C or RC.
 const WINDOWS_VERSION = /^(\d+(?:\.\d+){0,3})(?:[-+][0-9A-Za-z.+-]*)?$/;
-// What app.openPath can let the page's shell.openPath open: the app's folders as app.paths() names them, and what a
-// dialog picked during this run.
-const OPEN_PATH_PLACES = ['data', 'cache', 'logs', 'picked'];
+// The platforms whose apps have a window of their own, and updates.
+const DESKTOP = ['darwin', 'linux', 'win32'];
 // Apple's app categories, which macOS shows an app under, each with the main categories of the freedesktop menu
 // specification a Linux menu shows it under. An audio or a video app is in AudioVideo as well, as the specification asks.
 const GAMES = ['', 'action-', 'adventure-', 'arcade-', 'board-', 'card-', 'casino-', 'dice-', 'educational-', 'family-', 'kids-', 'music-', 'puzzle-',
@@ -32,6 +32,18 @@ export function appId(config) {
     return id;
 }
 
+// An Android application id: dot-separated parts of letters, digits and underscores that each start with a letter.
+const ANDROID_APP_ID = /^[A-Za-z][A-Za-z0-9_]*(\.[A-Za-z][A-Za-z0-9_]*)+$/;
+
+// An Android app's id: the project's app.id, else one made from the project's name.
+export function androidAppId(config) {
+    const id = config.app.id ?? `dev.crossbind.${config.general.name.replace(/[^A-Za-z0-9.]/g, '_')}`;
+    if (!ANDROID_APP_ID.test(id)) {
+        throw new Error(`crossbind: ${JSON.stringify(id)} (app.id, else made from the project's name) is no Android application id, which takes dot-separated parts of letters, digits and underscores that each start with a letter, as com.example.app does. Set app.id in crossbind.config.js.`);
+    }
+    return id;
+}
+
 // The name the app shows: its window's title, its macOS menus, its Windows file description and the label under its
 // icon. The project's name, without app.name.
 export function appDisplayName(config) {
@@ -158,18 +170,20 @@ export const PRIVACY_CATEGORIES = {
 
 // The reasons an iOS app's privacy manifest gives for the required reason API it calls: app.privacy, each category with
 // Apple's reasons that fit, as { fileTimestamp: ['C617.1'] }.
-export function appPrivacy(config) {
-    const privacy = config.app.privacy ?? {};
+export const appPrivacy = (config) => checkedPrivacy(config.app.privacy ?? {}, 'app.privacy');
+
+// Reasons for Apple's required reason API, as app.privacy gives them and an extension's ios.privacy does.
+export function checkedPrivacy(privacy, where) {
     const names = Object.keys(PRIVACY_CATEGORIES).join(', ');
     if (typeof privacy !== 'object' || privacy === null || Array.isArray(privacy)) {
-        throw new Error(`crossbind: app.privacy ${JSON.stringify(privacy)} is no object of ${names}, each with Apple's reasons for it, as { fileTimestamp: ['C617.1'] } is.`);
+        throw new Error(`crossbind: ${where} ${JSON.stringify(privacy)} is no object of ${names}, each with Apple's reasons for it, as { fileTimestamp: ['C617.1'] } is.`);
     }
     const unknown = Object.keys(privacy).filter((name) => !Object.hasOwn(PRIVACY_CATEGORIES, name));
-    if (unknown.length > 0) throw new Error(`crossbind: app.privacy takes ${names}; ${unknown.join(', ')} is none of them.`);
+    if (unknown.length > 0) throw new Error(`crossbind: ${where} takes ${names}; ${unknown.join(', ')} is none of them.`);
     Object.entries(privacy).forEach(([name, reasons]) => {
         const allowed = PRIVACY_CATEGORIES[name].reasons;
         if (!Array.isArray(reasons) || reasons.length === 0 || reasons.some((reason) => !allowed.includes(reason))) {
-            throw new Error(`crossbind: app.privacy.${name} ${JSON.stringify(reasons)} is no list of Apple's reasons for it, which are ${allowed.join(', ')}; Apple's "Describing use of required reason API" says what each covers.`);
+            throw new Error(`crossbind: ${where}.${name} ${JSON.stringify(reasons)} is no list of Apple's reasons for it, which are ${allowed.join(', ')}; Apple's "Describing use of required reason API" says what each covers.`);
         }
     });
     return privacy;
@@ -186,6 +200,40 @@ export function appEncryption(config) {
     return encryption;
 }
 
+const IOS_OPTIONS = ['multipleWindows', 'appGroup'];
+// An App Group of iOS's: group. and a bundle id's dot-separated parts.
+const APP_GROUP = /^group(\.[A-Za-z0-9-]+)+$/;
+
+function iosOptions(config) {
+    const ios = config.app.ios ?? {};
+    if (typeof ios !== 'object' || Array.isArray(ios)) {
+        throw new Error(`crossbind: app.ios ${JSON.stringify(ios)} is no object of multipleWindows and appGroup, as { multipleWindows: true } is.`);
+    }
+    const unknown = Object.keys(ios).filter((key) => !IOS_OPTIONS.includes(key));
+    if (unknown.length > 0) throw new Error(`crossbind: app.ios takes multipleWindows and appGroup; ${unknown.join(', ')} is none of them.`);
+    return ios;
+}
+
+// Whether an iPad app's user, and its page, open more windows of it, as app.ios.multipleWindows says: iOS shows an
+// iPhone's one window alone.
+export function iosMultipleWindows(config) {
+    const { multipleWindows = false } = iosOptions(config);
+    if (typeof multipleWindows !== 'boolean') {
+        throw new Error(`crossbind: app.ios.multipleWindows ${JSON.stringify(multipleWindows)} is no boolean: set it to true for an iPad app's windows, or leave it out.`);
+    }
+    return multipleWindows;
+}
+
+// The App Group an iOS app shares with the targets its extensions add, as app.ios.appGroup names it, else group. and the
+// app's id.
+export function iosAppGroup(config) {
+    const { appGroup = `group.${appId(config)}` } = iosOptions(config);
+    if (typeof appGroup !== 'string' || !APP_GROUP.test(appGroup)) {
+        throw new Error(`crossbind: app.ios.appGroup ${JSON.stringify(appGroup)} is no App Group, which is group. and a bundle id's parts, as group.com.example.notes is.`);
+    }
+    return appGroup;
+}
+
 // The version a Windows app's executable carries: package.json's, whose numbers are its file version.
 function windowsVersion(config) {
     const version = config.package?.version ?? '1.0.0';
@@ -197,17 +245,13 @@ function windowsVersion(config) {
     return { text: version, numbers: [...numbers, 0, 0, 0].slice(0, 4).join(',') };
 }
 
-// Where the page's shell.openPath opens a file: nowhere unless app.openPath lists it, as opening a program runs it.
-function appOpenPath(config) {
-    const places = config.app.openPath ?? [];
-    if (!Array.isArray(places)) {
-        throw new Error(`crossbind: app.openPath ${JSON.stringify(places)} is no list of ${OPEN_PATH_PLACES.join(', ')}, as ['logs', 'picked'] is.`);
-    }
-    const unknown = places.filter((place) => !OPEN_PATH_PLACES.includes(place));
-    if (unknown.length > 0) {
-        throw new Error(`crossbind: app.openPath takes ${OPEN_PATH_PLACES.join(', ')}; ${unknown.map((place) => JSON.stringify(place)).join(', ')} is none of them.`);
-    }
-    return places;
+// The files and folders of the project the app carries for its own native code, as app.files lists them: inside the
+// project's folder, which keep their places in the app's files/.
+export function appFiles(config) {
+    const files = config.app.files ?? [];
+    if (!Array.isArray(files)) throw new Error(`crossbind: app.files ${JSON.stringify(files)} is no list of the project's files and folders, as ['seed.sqlite'] is.`);
+    const root = config.paths.project;
+    return files.map((file) => carriedPath('app.files', root, file, "project's"));
 }
 
 // Schemes the web, the system or crossbind owns, which no app takes, and the keys of Windows' own classes, whose name a
@@ -218,75 +262,55 @@ const RESERVED_SCHEMES = [
     'wow6432node',
 ];
 
-// The schemes whose links open the app, as myapp://… does: lowercase, which is how Android matches them, and of two
-// characters at least, as one would take a Windows path's drive for a scheme.
-export function appUrlSchemes(config) {
-    const schemes = config.app.urlSchemes ?? [];
+// The schemes of a list whose links open the app, as myapp://… does: lowercase, which is how Android matches them, and
+// of two characters at least, as one would take a Windows path's drive for a scheme.
+export function checkedUrlSchemes(schemes, where) {
     if (!Array.isArray(schemes)) {
-        throw new Error(`crossbind: app.urlSchemes ${JSON.stringify(schemes)} is no list of schemes, as ['myapp'] is.`);
+        throw new Error(`crossbind: ${where} ${JSON.stringify(schemes)} is no list of schemes, as ['myapp'] is.`);
     }
     for (const scheme of schemes) {
         if (typeof scheme !== 'string' || !/^[a-z][a-z0-9+.-]+$/.test(scheme)) {
-            throw new Error(`crossbind: app.urlSchemes takes schemes of a lowercase letter, then one or more lowercase letters, digits, +, - and ., as myapp is; ${JSON.stringify(scheme)} is none.`);
+            throw new Error(`crossbind: ${where} takes schemes of a lowercase letter, then one or more lowercase letters, digits, +, - and ., as myapp is; ${JSON.stringify(scheme)} is none.`);
         }
         if (RESERVED_SCHEMES.includes(scheme)) {
-            throw new Error(`crossbind: app.urlSchemes cannot take ${scheme}, which the web or the system owns: pick a scheme of the app's own.`);
+            throw new Error(`crossbind: ${where} cannot take ${scheme}, which the web or the system owns: pick a scheme of the app's own.`);
         }
     }
-    if (new Set(schemes).size !== schemes.length) throw new Error(`crossbind: app.urlSchemes lists a scheme twice: ${JSON.stringify(schemes)}.`);
+    if (new Set(schemes).size !== schemes.length) throw new Error(`crossbind: ${where} lists a scheme twice: ${JSON.stringify(schemes)}.`);
     return schemes;
 }
 
-// Semver's version: three numbers, then a prerelease and build metadata of dot-separated identifiers.
-const SEMVER = /^\d+\.\d+\.\d+(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$/;
-// What an update's files are named after: characters an address carries as they are, and no leading dot.
-const UPDATE_NAME = /^[A-Za-z0-9_~-][A-Za-z0-9._~-]*$/;
-// The Ed25519 public keys of the points of small order, whatever the sign of x, whose signatures anyone can forge: the
-// list libsodium's ge25519_has_small_order checks.
-const SMALL_ORDER_KEYS = [
-    '0000000000000000000000000000000000000000000000000000000000000000',
-    '0100000000000000000000000000000000000000000000000000000000000000',
-    '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05',
-    'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a',
-    'ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f',
-    'edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f',
-    'eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f',
-].map((hex) => Buffer.from(hex, 'hex'));
+const ownerName = (extension) => (extension === null ? 'app.urlSchemes' : `the extension ${extension}`);
 
-const isSmallOrder = (key) => SMALL_ORDER_KEYS.some((point) => key.subarray(0, 31).equals(point.subarray(0, 31)) && (key[31] & 0x7f) === point[31]);
+// The schemes whose links open the app, each with the extension that declared it, whose native code gets its links, or
+// null for those of app.urlSchemes, whose links the host's links hands the page. Two owners of one scheme stop the build,
+// naming both.
+export function urlSchemeOwners(config) {
+    const owned = [
+        ...checkedUrlSchemes(config.app.urlSchemes ?? [], 'app.urlSchemes').map((scheme) => ({ scheme, extension: null })),
+        ...(config.extensions ?? []).flatMap(({ name, app }) => (app.urlSchemes ?? []).map((scheme) => ({ scheme, extension: name }))),
+    ];
+    owned.forEach(({ scheme, extension }, index) => {
+        const first = owned.findIndex((other) => other.scheme === scheme);
+        if (first !== index) {
+            throw new Error(`crossbind: ${ownerName(owned[first].extension)} and ${ownerName(extension)} both claim the scheme ${scheme}, whose links one alone gets.`);
+        }
+    });
+    return owned;
+}
 
-// Where a desktop app finds its updates, the key their signatures are checked with, and the version they are newer than:
-// package.json's, which semver orders. Null without app.updater.
-export function appUpdater(config) {
-    const updater = config.app.updater;
-    if (updater === undefined) return null;
-    const keys = 'url and publicKey';
-    if (updater === null || typeof updater !== 'object' || Array.isArray(updater)) {
-        throw new Error(`crossbind: app.updater ${JSON.stringify(updater)} is no object of ${keys}, as { url: 'https://example.com/updates/<name>-{platform}-{arch}.update.json', publicKey: '…' } is.`);
-    }
-    const unknown = Object.keys(updater).filter((key) => !['url', 'publicKey'].includes(key));
-    if (unknown.length > 0) throw new Error(`crossbind: app.updater takes ${keys}; ${unknown.join(', ')} is none of them.`);
-    const url = URL.canParse(updater.url) ? new URL(updater.url) : null;
-    const isLocal = url?.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
-    // The host takes the address as a C string, as it is written, and the update's file from beside the manifest.
-    if (!url || !(url.protocol === 'https:' || isLocal) || /[^\x21-\x7e]|["\\]/.test(updater.url) || url.pathname.endsWith('/')) {
-        throw new Error(`crossbind: app.updater.url ${JSON.stringify(updater.url)} is no https address of a manifest, as https://example.com/updates/<name>-{platform}-{arch}.update.json is; http serves localhost alone.`);
-    }
-    const publicKey = Buffer.from(typeof updater.publicKey === 'string' ? updater.publicKey : '', 'base64');
-    if (publicKey.length !== 32 || publicKey.toString('base64') !== updater.publicKey) {
-        throw new Error(`crossbind: app.updater.publicKey ${JSON.stringify(updater.publicKey)} is no Ed25519 public key, which \`crossbind app updater-key\` prints.`);
-    }
-    if (isSmallOrder(publicKey)) {
-        throw new Error(`crossbind: app.updater.publicKey ${JSON.stringify(updater.publicKey)} is a key anyone can forge signatures for, which no key pair has. Use the one \`crossbind app updater-key\` prints.`);
-    }
-    const version = config.package?.version ?? '1.0.0';
-    if (typeof version !== 'string' || !SEMVER.test(version)) {
-        throw new Error(`crossbind: package.json's version ${JSON.stringify(version)} is no semver version, as 1.2.3 and 1.2.3-beta.1 are, which an app that updates needs to tell a newer one.`);
-    }
-    if (!UPDATE_NAME.test(config.general.name)) {
-        throw new Error(`crossbind: general.name ${JSON.stringify(config.general.name)} names an app's update files, which an app fetches by name: letters, digits, and . _ ~ - alone, not starting with a dot. Change general.name in crossbind.config.js.`);
+// The schemes whose links open the app: app.urlSchemes's, then its extensions'.
+export const appUrlSchemes = (config) => urlSchemeOwners(config).map(({ scheme }) => scheme);
+
+// The installers app.installers names, which alone of each desktop platform's make what installs its app; null without
+// it, when every one does.
+export function appInstallers(config) {
+    const { installers } = config.app;
+    if (installers === undefined) return null;
+    if (!Array.isArray(installers) || !installers.every((name) => typeof name === 'string') || new Set(installers).size !== installers.length) {
+        throw new Error(`crossbind: app.installers ${JSON.stringify(installers)} is no list of installers' names, each once.`);
     }
-    return { url: updater.url, publicKey, version };
+    return installers;
 }
 
 // A desktop host's window: its page's size and limits, whether it resizes and whether it opens full screen. A maximum of
@@ -307,12 +331,13 @@ function windowDefines(window) {
     ];
 }
 
-// The header an app's host compiles where its page opens files from, an iOS or desktop host the color it shows until
-// its page paints and the devices the page may use, a desktop host its title, window, whether it keeps one instance and
-// its updates, and a Windows host its version resource.
-export function appHeader(config, platform) {
+// The header an app's host compiles its id and name with, an iOS or desktop host the color it shows until its page paints
+// and the devices the page may use, an iOS host the App Group of its extensions' targets, a desktop host its window, and a
+// Windows host its version resource.
+export function appHeader(config, platform, appGroup = null) {
     const comment = '// crossbind writes this file from crossbind.config.js and package.json.';
-    const openPath = `#define CROSSBIND_APP_OPEN_PATH {${appOpenPath(config).map((place) => `"${place}"`).join(', ')}}`;
+    const id = `#define CROSSBIND_APP_ID "${platform === 'android' ? androidAppId(config) : appId(config)}"`;
+    const name = `#define CROSSBIND_APP_NAME "${appDisplayName(config)}"`;
     const color = appBackgroundColor(config);
     const permissions = appPermissions(config);
     // An Android app's activity takes the color and the permissions from its Gradle project.
@@ -320,36 +345,20 @@ export function appHeader(config, platform) {
         ...(color ? [`#define CROSSBIND_APP_BACKGROUND_COLOR 0x${color.slice(1).toLowerCase()}`] : []),
         ...PERMISSIONS.map((name) => `#define CROSSBIND_APP_PERMISSION_${name.toUpperCase()} ${name in permissions ? 1 : 0}`),
     ];
-    if (!['darwin', 'linux', 'win32'].includes(platform)) return [comment, openPath, ...page, ''].join('\n');
+    const windows = platform === 'ios' && iosMultipleWindows(config) ? ['#define CROSSBIND_APP_IOS_MULTIPLE_WINDOWS 1'] : [];
+    const group = platform === 'ios' && appGroup ? [`#define CROSSBIND_APP_GROUP "${appGroup}"`] : [];
+    if (!DESKTOP.includes(platform)) return [comment, ...page, ...windows, ...group, id, name, ''].join('\n');
     // The category goes to the Info.plist and the desktop entry, which the build writes later; any desktop refuses a
     // wrong one here.
     const copyright = appCopyright(config);
     appCategory(config);
     const lines = [
         comment,
-        openPath,
         ...page,
-        `#define CROSSBIND_APP_ID "${appId(config)}"`,
-        `#define CROSSBIND_APP_NAME "${appDisplayName(config)}"`,
+        id,
+        name,
         ...windowDefines(appWindow(config)),
     ];
-    const urlSchemes = appUrlSchemes(config);
-    if (urlSchemes.length > 0) lines.push(`#define CROSSBIND_APP_URL_SCHEMES {${urlSchemes.map((scheme) => `"${scheme}"`).join(', ')}}`);
-    // A link the system opens a Windows or Linux app with starts it again, which reaches the app that runs this way; macOS
-    // hands the link to the app that runs.
-    const singleInstance = config.app.singleInstance ?? (urlSchemes.length > 0 && platform !== 'darwin');
-    if (typeof singleInstance !== 'boolean') {
-        throw new Error(`crossbind: app.singleInstance ${JSON.stringify(singleInstance)} is no boolean: set it to true to keep a desktop app to one instance, or to false to let each launch run.`);
-    }
-    if (singleInstance) lines.push('#define CROSSBIND_APP_SINGLE_INSTANCE 1');
-    const updater = appUpdater(config);
-    if (updater) {
-        lines.push(
-            `#define CROSSBIND_APP_UPDATER_URL "${updater.url}"`,
-            `#define CROSSBIND_APP_UPDATER_KEY {${[...updater.publicKey].map((byte) => `0x${byte.toString(16).padStart(2, '0')}`).join(', ')}}`,
-            `#define CROSSBIND_APP_UPDATER_VERSION "${updater.version}"`,
-        );
-    }
     if (platform === 'win32') {
         const version = windowsVersion(config);
         lines.push(`#define CROSSBIND_APP_VERSION "${version.text}"`, `#define CROSSBIND_APP_VERSION_NUMBERS ${version.numbers}`);