확장엔 막고, 이름으로 열고

    /// The family's hosts, kept out of every extension's reach unless Dad
    /// let that extension in. Loopback and the tailnet are always family.
    public var familyHosts: Set<String> = [] {
        didSet { if familyHosts != oldValue { applyFamilyAccess() } }
    }
    public var allowedOnFamilySites: Set<String> = [] {
        didSet { if allowedOnFamilySites != oldValue { applyFamilyAccess() } }
    }
    /// The family patterns each context was denied, so a change clears
    /// exactly those and no pattern of the extension's own.
    private var familyDenials: [String: [WKWebExtension.MatchPattern]] = [:]
    /// What is family on every Mac: this Mac by either name, and the tailnet.
    static let alwaysFamilyPatterns = ["*://localhost/*", "*://127.0.0.1/*", "*://*.ts.net/*"]

    /// The match patterns that stand for the family's hosts now.
    func familyPatterns() -> [WKWebExtension.MatchPattern] {
        var texts = Self.alwaysFamilyPatterns
        for host in familyHosts.sorted() where !host.isEmpty && !host.contains("/") && !host.contains("*") {
            texts.append("*://\(host)/*")
        }
        return texts.compactMap { try? WKWebExtension.MatchPattern(string: $0) }
    }

    private func applyFamilyAccess() {
        for (id, context) in contexts { applyFamilyAccess(to: context, id: id) }
    }

    /// A denied pattern wins over a granted one (measured 2026-10-04 against
    /// a package granted `<all_urls>`: `hasAccess` says no for a denied
    /// host), so an extension keeps what it asked for everywhere else.
    private func applyFamilyAccess(to context: WKWebExtensionContext, id: String) {
        for pattern in familyDenials[id] ?? [] { context.setPermissionStatus(.unknown, for: pattern) }
        let denied = allowedOnFamilySites.contains(id) ? [] : familyPatterns()
        for pattern in denied { context.setPermissionStatus(.deniedExplicitly, for: pattern) }
        familyDenials[id] = denied
    }

/// `cwkvoyager://family/<target id>`: what a widget tile opens.
enum FamilyLink {
    static let scheme = "cwkvoyager"

    static func url(forTarget id: String) -> URL? {
        var components = URLComponents()
        components.scheme = scheme
        components.host = "family"
        components.path = "/" + id
        return components.url
    }

    /// The target id a family link names; nil for anything else.
    static func targetID(in url: URL) -> String? {
        guard url.scheme?.lowercased() == scheme, url.host(percentEncoded: false) == "family" else { return nil }
        let id = String(url.path(percentEncoded: false).dropFirst())
        return id.isEmpty || id.contains("/") ? nil : id
    }
}

    // MARK: Addresses from outside

    /// A link the widget opened. A family link names a catalog target, read
    /// against the catalog now; Voyager declares no web scheme on iOS.
    func handle(_ url: URL) {
        if let id = FamilyLink.targetID(in: url) {
            Task { await openFamilyTarget(id) }
        }
    }

    func openFamilyTarget(_ id: String) async {
        if MobileFamily.resolve(id, in: services.familyCatalog.projection) == .notListed || services.familyCatalog.projection == nil {
            await refreshCatalog()
        }
        switch MobileFamily.resolve(id, in: services.familyCatalog.projection) {
        case .open(let url):
            openFamily(url)
        case .notListed:
            showHome()
            post("Firelink's catalog no longer lists that app. The widget shows the current list after Voyager reads it.")
        case .noCatalog:
            showHome()
            if let problem = services.familyCatalog.problem { post(problem) }
        }
    }