QuxCloud
mobile-kit
Your app on the phone rather than merely working on one: a shell that renders only the hosts you name, deep links that open it, and copy that changes without a store review.
@quxkit/mobile-kit·in EnterpriseA WebView is a browser with the address bar removed
Whatever the shell loads wears Wilson & Co’s name and reaches Wilson & Co’s cookies, and the person holding the phone has no way to tell. So the policy is an allow-list, matched exactly or by one leading *., never by suffix and never by substring. Everything else is handed to the system browser, where the address bar and the padlock are visible.
Try to get something onto the screen
Each of these is a real URL a real app gets handed. Two of them are the reason this is a library rather than a config file: one ends with the allowed host, one contains it, and the obvious implementations admit both.
The two files that fail silently
apple-app-site-association and assetlinks.json are what make https://app.wilsonandco.example/orders/7 open the app. Every way of getting them wrong fails the same way, the link opens in the browser and nothing, anywhere, logs why. Generated from the same definition as the native config, so the paths the app claims and the paths the file declares cannot drift.
Config, not a checked-in native project
The ios/ and android/ directories are Capacitor’s to create from these, hundreds of files, and a stale copy of them in a template is how a shell ends up pinned to a version nobody chose.
