@capgo/capacitor-inappbrowser 8.14.2 → 8.15.0

package/README.md

@@ -591,6 +591,24 @@ And in `AndroidManifest.xml`:
 </activity>
 ```
 
+### Bundled local assets
+
+`openWebView()` can load HTML, JavaScript, CSS, and other files from the app `public/` folder without starting a local HTTP server. Pass a relative path and the plugin resolves it to the Capacitor local URL for the current platform.
+
+```typescript
+import { InAppBrowser } from '@capgo/capacitor-inappbrowser';
+
+await InAppBrowser.openWebView({
+  url: '/index.html',
+});
+```
+
+- iOS resolves to `capacitor://localhost/...` and serves files from the packaged `public/` directory.
+- Android resolves to `https://localhost/...` and intercepts requests with `WebViewAssetLoader`, matching Capacitor's main WebView behavior.
+- Remote `http://` and `https://` URLs are unchanged.
+
+`open()` uses the system browser (Safari / Custom Tabs) and still requires a real remote URL.
+
 ## API
 
 <docgen-index>
@@ -1469,7 +1487,7 @@ See the README section "openSecureWindow (OAuth)" for full setup examples.
 
 | Prop                         | Type                 | Description                                                                                                                                                                             | Default            | Since |
 | ---------------------------- | -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ | ----- |
-| **`url`**                    | <code>string</code>  | Target URL to load.                                                                                                                                                                     |                    | 0.1.0 |
+| **`url`**                    | <code>string</code>  | Target URL to load. Remote `http://` and `https://` URLs are loaded as-is. Relative bundled paths such as `/index.html` are not supported; use `openWebView()` instead.                 |                    | 0.1.0 |
 | **`isPresentAfterPageLoad`** | <code>boolean</code> | if true, the browser will be presented after the page is loaded, if false, the browser will be presented immediately.                                                                   |                    | 0.1.0 |
 | **`preventDeeplink`**        | <code>boolean</code> | if true the deeplink will not be opened, if false the deeplink will be opened when clicked on the link                                                                                  |                    | 0.1.0 |
 | **`toolbarColor`**           | <code>string</code>  | Toolbar background color in hex format (e.g., "#1A1A2E"). Applied to both light and dark color schemes. Also sets the navigation bar color to match. **Android only** — ignored on iOS. |                    | 8.2.0 |
@@ -1556,7 +1574,7 @@ See the README section "openSecureWindow (OAuth)" for full setup examples.
 
 | Prop                                   | Type                                                                                                                                                                   | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | Default                                                       | Since  |
 | -------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | ------ |
-| **`url`**                              | <code>string</code>                                                                                                                                                    | Target URL to load.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                                                               | 0.1.0  |
+| **`url`**                              | <code>string</code>                                                                                                                                                    | Target URL to load. Remote `http://` and `https://` URLs are loaded as-is. To open bundled web assets from the app bundle without running a local HTTP server, pass a relative path such as `/index.html` or `assets/page.html`. The plugin resolves it to the Capacitor local URL for the current platform (defaults: `capacitor://localhost/...` on iOS, `https://localhost/...` on Android; actual scheme and host follow the app's configured Capacitor local URL) and serves files from the packaged `public/` directory, or `www/` on iOS when `public/` is absent.                                                                                                                                                                                                                                                                                                                                              |                                                               | 0.1.0  |
 | **`headers`**                          | <code><a href="#headers">Headers</a></code>                                                                                                                            | <a href="#headers">Headers</a> to send with the request.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |                                                               | 0.1.0  |
 | **`customUserAgent`**                  | <code>string</code>                                                                                                                                                    | Custom User-Agent string for the webview. When set, replaces the system default webview User-Agent on iOS and Android. Takes precedence over a `User-Agent` entry in `headers`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |                                                               | 8.13.0 |
 | **`credentials`**                      | <code><a href="#credentials">Credentials</a></code>                                                                                                                    | <a href="#credentials">Credentials</a> to send with the request and all subsequent requests for the same host.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |                                                               | 6.1.0  |
@@ -1610,9 +1628,9 @@ See the README section "openSecureWindow (OAuth)" for full setup examples.
 | **`preventDeeplink`**                  | <code>boolean</code>                                                                                                                                                   | If true, deeplinks and external app hand-off are blocked and stay in the webview. If false (default), custom schemes such as `tel:`, `mailto:`, and `sms:` open natively. On iOS, listing a custom scheme under `LSApplicationQueriesSchemes` is only required when you rely on `canOpenURL` for that scheme (for example `instagram://`). It is not required for HTTPS `authorizedAppLinks`, and `mailto`/`tel`/`sms` open without that Info.plist entry.                                                                                                                                                                                                                                                                                                                                                                                                                                                             | <code>false</code>                                            | 0.1.0  |
 | **`openBlankTargetInWebView`**         | <code>boolean</code>                                                                                                                                                   | When true, HTTP and HTTPS links opened from `target="_blank"` anchors stay in the current webview instead of spawning a popup or opening in the system browser. By default, blank-target HTTP(S) links stay inside the plugin as managed popups that share cookies with the opener; enabling this option keeps everything in the same tab. Custom schemes such as `tel:` and `mailto:` and authorized app links still prefer their native handlers unless `preventDeeplink` is enabled.                                                                                                                                                                                                                                                                                                                                                                                                                                | <code>false</code>                                            | 8.5.6  |
 | **`authorizedAppLinks`**               | <code>string[]</code>                                                                                                                                                  | List of base URLs whose hosts are treated as authorized App Links (Android) and Universal Links (iOS). - On both platforms, only HTTP(S) links whose host matches any entry in this list will attempt to leave the in-app browser for the native / system handler. - iOS tries a Universal Link first (`universalLinksOnly`), then falls back to a normal system open (App Store, Safari, etc.). Only if both fail does the URL stay in-webview. - Android uses an `ACTION_VIEW` intent for matching hosts. - Matching is host-based (case-insensitive), ignoring the "www." prefix. - HTTPS hosts do not need `LSApplicationQueriesSchemes`; that Info.plist key is for custom schemes like `instagram://`, not `https://instagram.com`. - When `preventDeeplink` is enabled, all external handling is blocked regardless of this list.                                                                               | <code>[]</code>                                               | 7.12.0 |
-| **`enabledSafeBottomMargin`**          | <code>boolean</code>                                                                                                                                                   | If true, the webView will not take the full height and will have a 20px margin at the bottom. This creates a safe margin area outside the browser view.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | <code>false</code>                                            | 7.13.0 |
-| **`enabledSafeTopMargin`**             | <code>boolean</code>                                                                                                                                                   | If false, the webView will extend behind the status bar for true full-screen immersive content. When true (default), respects the safe area at the top of the screen. Works independently of toolbarType - use for full-screen video players, games, or immersive web apps.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | <code>true</code>                                             | 8.2.0  |
-| **`useTopInset`**                      | <code>boolean</code>                                                                                                                                                   | When true, applies the system status bar inset as the WebView top margin on Android. Keeps the legacy 0px margin by default for apps that handle padding themselves.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | <code>false</code>                                            |        |
+| **`enabledSafeBottomMargin`**          | <code>boolean</code>                                                                                                                                                   | If true, the webView is inset by the bottom system bar (navigation bar) so bottom-anchored content stays reachable. On Android 15+ the browser window is always edge-to-edge, so the bottom inset is applied there regardless of this option.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | <code>false</code>                                            | 7.13.0 |
+| **`enabledSafeTopMargin`**             | <code>boolean</code>                                                                                                                                                   | If false, the webView will extend behind the status bar for true full-screen immersive content. When true (default), respects the safe area at the top of the screen. Works independently of toolbarType - use for full-screen video players, games, or immersive web apps. On Android, when a toolbar is visible the toolbar itself provides that safe area; with `toolbarType: 'blank'` on Android 15+ the status bar inset is applied to the webView instead.                                                                                                                                                                                                                                                                                                                                                                                                                                                       | <code>true</code>                                             | 8.2.0  |
+| **`useTopInset`**                      | <code>boolean</code>                                                                                                                                                   | When true, applies the system status bar inset to the top of the WebView on Android even when the window is not edge-to-edge (before Android 15). Keeps the legacy 0px inset by default for apps that handle padding themselves. On Android 15+ this is not needed: without a visible toolbar the status bar inset already follows `enabledSafeTopMargin`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | <code>false</code>                                            |        |
 | **`enableGooglePaySupport`**           | <code>boolean</code>                                                                                                                                                   | enableGooglePaySupport: if true, enables support for Google Pay popups and Payment Request API. This fixes OR_BIBED_15 errors by allowing popup windows and configuring Cross-Origin-Opener-Policy. Only enable this if you need Google Pay functionality as it allows popup windows. When enabled: - Allows popup windows for Google Pay authentication - Sets proper CORS headers for Payment Request API - Enables multiple window support in WebView - Configures secure context for payment processing                                                                                                                                                                                                                                                                                                                                                                                                            | <code>false</code>                                            | 7.13.0 |
 | **`hiddenPopupWindow`**                | <code>boolean</code>                                                                                                                                                   | Opens popup windows created by the page in hidden mode. Hidden popup windows can still be controlled with `executeScript`, `postMessage`, `show`, and `close`. Listen to `popupWindowOpened` to capture the popup id, then call `show({ id })` only if you want to reveal it.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | <code>false</code>                                            | 8.6.0  |
 | **`blockedHosts`**                     | <code>string[]</code>                                                                                                                                                  | blockedHosts: List of host patterns that should be blocked from loading in the InAppBrowser's internal navigations. Any request inside WebView to a URL with a host matching any of these patterns will be blocked. Supports wildcard patterns like: - "*.example.com" to block all subdomains - "www.example.*" to block wildcard domain extensions                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | <code>[]</code>                                               | 7.17.0 |

package/android/src/main/java/ee/forgr/capacitor_inappbrowser/BundledAssetSupport.java

@@ -0,0 +1,397 @@
+package ee.forgr.capacitor_inappbrowser;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+import android.webkit.MimeTypeMap;
+import android.webkit.WebResourceResponse;
+import androidx.webkit.WebViewAssetLoader;
+import com.getcapacitor.Bridge;
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.URI;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Locale;
+import java.util.Set;
+
+final class BundledAssetSupport {
+
+    static final class LocalConfig {
+
+        final String scheme;
+        final String host;
+
+        LocalConfig(String scheme, String host) {
+            this.scheme = scheme;
+            this.host = host;
+        }
+    }
+
+    static final class Resolution {
+
+        final String url;
+        final boolean needsAssetLoader;
+
+        Resolution(String url) {
+            this(url, false);
+        }
+
+        Resolution(String url, boolean needsAssetLoader) {
+            this.url = url;
+            this.needsAssetLoader = needsAssetLoader;
+        }
+    }
+
+    private static final String[] RESERVED_WEB_SCHEMES = { "http", "https" };
+    private static final String PROXY_BRIDGE_MARKER_PATH = "/_capgo_proxy_";
+
+    private BundledAssetSupport() {}
+
+    static LocalConfig parseLocalConfig(String localUrl) {
+        if (isBlank(localUrl)) {
+            return null;
+        }
+
+        try {
+            URI uri = URI.create(localUrl.endsWith("/") ? localUrl : localUrl + "/");
+            String scheme = uri.getScheme();
+            String host = uri.getHost();
+            if (scheme == null || host == null) {
+                return null;
+            }
+            return new LocalConfig(scheme.toLowerCase(Locale.ROOT), host.toLowerCase(Locale.ROOT));
+        } catch (IllegalArgumentException error) {
+            return null;
+        }
+    }
+
+    static String assetLoaderScheme(LocalConfig localConfig) {
+        if ("http".equals(localConfig.scheme) || "https".equals(localConfig.scheme)) {
+            return localConfig.scheme;
+        }
+        return "https";
+    }
+
+    static Resolution resolve(String url, Bridge bridge) {
+        LocalConfig localConfig = parseLocalConfig(bridge != null ? bridge.getLocalUrl() : null);
+        if (localConfig == null) {
+            localConfig = new LocalConfig("https", "localhost");
+        }
+        return resolve(url, localConfig);
+    }
+
+    static Resolution resolve(String url, LocalConfig localConfig) {
+        String trimmed = url == null ? "" : url.trim();
+        String navigationScheme = assetLoaderScheme(localConfig);
+
+        if (isRelativeBundledPath(trimmed)) {
+            String path = normalizeBundledPath(trimmed);
+            if (path == null) {
+                return null;
+            }
+            return new Resolution(navigationScheme + "://" + localConfig.host + path, true);
+        }
+
+        if (isBundledLocalUrl(trimmed, localConfig)) {
+            String rewritten = rewriteBundledLocalUrl(trimmed, localConfig, navigationScheme);
+            return new Resolution(rewritten != null ? rewritten : trimmed, true);
+        }
+
+        return new Resolution(trimmed, false);
+    }
+
+    static boolean isBundledLocalUrl(String url, LocalConfig localConfig) {
+        if (!isAbsoluteUrl(url)) {
+            return false;
+        }
+
+        try {
+            URI uri = URI.create(url);
+            String scheme = uri.getScheme();
+            String host = uri.getHost();
+            if (scheme == null || host == null) {
+                return false;
+            }
+
+            if (!host.equalsIgnoreCase(localConfig.host)) {
+                return false;
+            }
+
+            if (uri.getPort() != -1) {
+                return false;
+            }
+
+            String normalizedScheme = scheme.toLowerCase(Locale.ROOT);
+            if (normalizedScheme.equalsIgnoreCase(localConfig.scheme) || normalizedScheme.equals(assetLoaderScheme(localConfig))) {
+                return true;
+            }
+
+            return isReservedWebScheme(normalizedScheme) && isReservedWebScheme(localConfig.scheme);
+        } catch (IllegalArgumentException error) {
+            return false;
+        }
+    }
+
+    static boolean isRelativeBundledPath(String url) {
+        if (isBlank(url)) {
+            return false;
+        }
+        return !isAbsoluteUrl(url);
+    }
+
+    private static final Set<String> BUNDLED_ASSET_EXTENSIONS = Collections.unmodifiableSet(
+        new HashSet<>(
+            Arrays.asList(
+                "html",
+                "htm",
+                "js",
+                "css",
+                "json",
+                "xml",
+                "svg",
+                "png",
+                "jpg",
+                "jpeg",
+                "gif",
+                "webp",
+                "woff",
+                "woff2",
+                "ttf",
+                "map"
+            )
+        )
+    );
+
+    static boolean isLikelyBundledRelativePath(String url) {
+        if (!isRelativeBundledPath(url)) {
+            return false;
+        }
+
+        String trimmed = stripPathQueryAndFragment(url.trim());
+        if (finalPathComponentStartsWithDot(trimmed)) {
+            return false;
+        }
+
+        if (trimmed.startsWith("/") || trimmed.contains("/")) {
+            return true;
+        }
+
+        int dot = trimmed.lastIndexOf('.');
+        if (dot < 0) {
+            return true;
+        }
+        if (dot == 0) {
+            return false;
+        }
+
+        String extension = trimmed.substring(dot + 1).toLowerCase(Locale.ROOT);
+        return BUNDLED_ASSET_EXTENSIONS.contains(extension);
+    }
+
+    private static boolean isBlank(String value) {
+        if (value == null || value.isEmpty()) {
+            return true;
+        }
+
+        for (int index = 0; index < value.length(); index++) {
+            if (!Character.isWhitespace(value.charAt(index))) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    private static boolean finalPathComponentStartsWithDot(String path) {
+        int lastSlash = path.lastIndexOf('/');
+        String finalComponent = lastSlash >= 0 ? path.substring(lastSlash + 1) : path;
+        return !finalComponent.isEmpty() && finalComponent.charAt(0) == '.';
+    }
+
+    private static String stripPathQueryAndFragment(String path) {
+        int query = path.indexOf('?');
+        if (query >= 0) {
+            path = path.substring(0, query);
+        }
+        int fragment = path.indexOf('#');
+        if (fragment >= 0) {
+            path = path.substring(0, fragment);
+        }
+        return path;
+    }
+
+    static String normalizeBundledPath(String path) {
+        String trimmed = path == null ? "" : path.trim();
+        if (trimmed.isEmpty() || "/".equals(trimmed)) {
+            return "/";
+        }
+
+        if (containsPathTraversal(trimmed)) {
+            return null;
+        }
+
+        return trimmed.startsWith("/") ? trimmed : "/" + trimmed;
+    }
+
+    static boolean isProxyBridgeMarkerPath(String path) {
+        return PROXY_BRIDGE_MARKER_PATH.equals(path);
+    }
+
+    static WebViewAssetLoader createAssetLoader(Context context, String hostname, String scheme) {
+        WebViewAssetLoader.Builder builder = new WebViewAssetLoader.Builder()
+            .setDomain(hostname)
+            .addPathHandler("/", new PublicAssetsPathHandler(context.getAssets()));
+        if ("http".equalsIgnoreCase(scheme)) {
+            builder.setHttpAllowed(true);
+        }
+        return builder.build();
+    }
+
+    static String mimeTypeForPath(String path) {
+        String extension = MimeTypeMap.getFileExtensionFromUrl(path);
+        if (extension != null && !extension.isEmpty()) {
+            String mimeType = MimeTypeMap.getSingleton().getMimeTypeFromExtension(extension.toLowerCase(Locale.ROOT));
+            if (mimeType != null) {
+                return mimeType;
+            }
+        }
+        return extension == null || extension.isEmpty() ? "text/html" : "application/octet-stream";
+    }
+
+    static String encodingForMimeType(String mimeType) {
+        if (mimeType == null || mimeType.isEmpty()) {
+            return null;
+        }
+
+        String normalized = mimeType.toLowerCase(Locale.ROOT);
+        if (normalized.startsWith("text/")) {
+            return "utf-8";
+        }
+        if (
+            normalized.contains("javascript") ||
+            normalized.contains("json") ||
+            normalized.contains("xml") ||
+            normalized.endsWith("+json") ||
+            normalized.endsWith("+xml")
+        ) {
+            return "utf-8";
+        }
+        return null;
+    }
+
+    private static WebResourceResponse notFoundResponse(String path) {
+        return new WebResourceResponse("text/plain", "utf-8", 404, "Not Found", null, new java.io.ByteArrayInputStream(new byte[0]));
+    }
+
+    private static boolean isReservedWebScheme(String scheme) {
+        for (String reservedScheme : RESERVED_WEB_SCHEMES) {
+            if (reservedScheme.equals(scheme)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private static boolean isAbsoluteUrl(String url) {
+        if (url.startsWith("//")) {
+            return true;
+        }
+
+        int separatorIndex = url.indexOf(':');
+        if (separatorIndex <= 0) {
+            return false;
+        }
+
+        for (int index = 0; index < separatorIndex; index++) {
+            char character = url.charAt(index);
+            if (!Character.isLetterOrDigit(character) && character != '+' && character != '-' && character != '.') {
+                return false;
+            }
+        }
+
+        return Character.isLetter(url.charAt(0));
+    }
+
+    private static boolean containsPathTraversal(String path) {
+        for (String segment : path.split("/")) {
+            if ("..".equals(segment)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private static String rewriteBundledLocalUrl(String url, LocalConfig localConfig, String navigationScheme) {
+        try {
+            URI uri = URI.create(url);
+            String scheme = uri.getScheme();
+            String host = uri.getHost();
+            if (scheme == null || host == null || !host.equalsIgnoreCase(localConfig.host)) {
+                return null;
+            }
+            if (scheme.equalsIgnoreCase(navigationScheme)) {
+                return null;
+            }
+            return new URI(
+                navigationScheme,
+                uri.getUserInfo(),
+                host,
+                uri.getPort(),
+                uri.getPath(),
+                uri.getQuery(),
+                uri.getFragment()
+            ).toString();
+        } catch (Exception error) {
+            return null;
+        }
+    }
+
+    private static String mapToAssetPath(String path) {
+        if (containsPathTraversal(path)) {
+            return null;
+        }
+
+        String normalizedPath = path == null || path.isEmpty() ? "/" : path;
+        if (!normalizedPath.startsWith("/")) {
+            normalizedPath = "/" + normalizedPath;
+        }
+
+        int lastSlash = normalizedPath.lastIndexOf('/');
+        String fileName = lastSlash >= 0 ? normalizedPath.substring(lastSlash + 1) : normalizedPath;
+        if (!fileName.contains(".")) {
+            return "public/index.html";
+        }
+
+        return "public" + normalizedPath;
+    }
+
+    private static final class PublicAssetsPathHandler implements WebViewAssetLoader.PathHandler {
+
+        private final AssetManager assetManager;
+
+        PublicAssetsPathHandler(AssetManager assetManager) {
+            this.assetManager = assetManager;
+        }
+
+        @Override
+        public WebResourceResponse handle(String path) {
+            if (isProxyBridgeMarkerPath(path)) {
+                return null;
+            }
+
+            String assetPath = mapToAssetPath(path);
+            if (assetPath == null) {
+                return null;
+            }
+
+            try {
+                InputStream stream = assetManager.open(assetPath);
+                String mimeType = mimeTypeForPath(path);
+                return new WebResourceResponse(mimeType, encodingForMimeType(mimeType), stream);
+            } catch (IOException error) {
+                return notFoundResponse(path);
+            }
+        }
+    }
+}

package/android/src/main/java/ee/forgr/capacitor_inappbrowser/CapgoInAppBrowserPlugin.java

@@ -32,6 +32,7 @@ import androidx.browser.customtabs.CustomTabsIntent;
 import androidx.browser.customtabs.CustomTabsServiceConnection;
 import androidx.browser.customtabs.CustomTabsSession;
 import androidx.core.content.ContextCompat;
+import com.getcapacitor.Bridge;
 import com.getcapacitor.JSArray;
 import com.getcapacitor.JSObject;
 import com.getcapacitor.Plugin;
@@ -358,6 +359,26 @@ public class CapgoInAppBrowserPlugin extends Plugin implements WebViewDialog.Per
         return dialog;
     }
 
+    private boolean applyBundledAssetOptions(Options options, String url) {
+        Bridge bridge = getBridge();
+        BundledAssetSupport.Resolution resolution = BundledAssetSupport.resolve(url, bridge);
+        if (resolution == null) {
+            return false;
+        }
+        options.setUrl(resolution.url);
+        if (resolution.needsAssetLoader) {
+            BundledAssetSupport.LocalConfig localConfig = BundledAssetSupport.parseLocalConfig(
+                bridge != null ? bridge.getLocalUrl() : null
+            );
+            options.setBundledAssetHost(localConfig != null ? localConfig.host : "localhost");
+            options.setBundledAssetScheme(localConfig != null ? BundledAssetSupport.assetLoaderScheme(localConfig) : "https");
+            options.setServeBundledAssets(true);
+        } else {
+            options.setServeBundledAssets(false);
+        }
+        return true;
+    }
+
     private void notifyPopupWindowOpened(String popupId, String parentId, String popupUrl, boolean visible) {
         JSObject event = new JSObject();
         event.put("id", popupId);
@@ -752,13 +773,21 @@ public class CapgoInAppBrowserPlugin extends Plugin implements WebViewDialog.Per
             return;
         }
 
-        currentUrl = url;
+        BundledAssetSupport.Resolution resolution = BundledAssetSupport.resolve(url, getBridge());
+        if (resolution == null) {
+            call.reject("Invalid bundled asset path");
+            return;
+        }
+        final String resolvedUrl = resolution.url;
+        currentUrl = resolvedUrl;
+        final String localUrl = getBridge() != null ? getBridge().getLocalUrl() : null;
         this.getActivity().runOnUiThread(
             new Runnable() {
                 @Override
                 public void run() {
                     try {
-                        webViewDialog.setUrl(url);
+                        webViewDialog.applyBundledAssetResolution(resolution, localUrl);
+                        webViewDialog.setUrl(resolvedUrl);
                         call.resolve();
                     } catch (Exception e) {
                         Log.e("InAppBrowser", "Error setting URL: " + e.getMessage());
@@ -785,6 +814,11 @@ public class CapgoInAppBrowserPlugin extends Plugin implements WebViewDialog.Per
             call.reject("Invalid URL");
             return;
         }
+
+        if (BundledAssetSupport.isLikelyBundledRelativePath(url)) {
+            call.reject("Bundled assets require openWebView()");
+            return;
+        }
         currentUrl = url;
         awaitCustomTabsClientIfNeeded();
         CustomTabsIntent.Builder builder = new CustomTabsIntent.Builder(getCustomTabsSession());
@@ -1054,11 +1088,15 @@ public class CapgoInAppBrowserPlugin extends Plugin implements WebViewDialog.Per
         String url = call.getString("url");
         if (url == null || TextUtils.isEmpty(url)) {
             call.reject("Invalid URL");
+            return;
         }
-        currentUrl = url;
         final String webViewId = UUID.randomUUID().toString();
         final Options options = new Options();
-        options.setUrl(url);
+        if (!applyBundledAssetOptions(options, url)) {
+            call.reject("Invalid bundled asset path");
+            return;
+        }
+        currentUrl = options.getUrl();
         options.setHeaders(call.getObject("headers"));
         options.setCustomUserAgent(call.getString("customUserAgent"));
         options.setCredentials(call.getObject("credentials"));

package/android/src/main/java/ee/forgr/capacitor_inappbrowser/Options.java

@@ -8,7 +8,7 @@ import java.io.IOException;
 import java.io.InputStream;
 import java.util.ArrayList;
 import java.util.List;
-import java.util.Objects;
+import java.util.Locale;
 import java.util.Objects;
 import java.util.regex.Pattern;
 
@@ -151,6 +151,9 @@ public class Options {
     private String CloseModalOk;
     private Pattern closeModalURLPattern;
     private String url;
+    private volatile String bundledAssetHost = "localhost";
+    private volatile String bundledAssetScheme = "https";
+    private volatile boolean serveBundledAssets = false;
     private JSObject headers;
     private String customUserAgent;
     private JSObject credentials;
@@ -493,6 +496,38 @@ public class Options {
         this.url = url;
     }
 
+    public String getBundledAssetHost() {
+        return bundledAssetHost;
+    }
+
+    public void setBundledAssetHost(String bundledAssetHost) {
+        if (bundledAssetHost == null || bundledAssetHost.isBlank()) {
+            this.bundledAssetHost = "localhost";
+            return;
+        }
+        this.bundledAssetHost = bundledAssetHost;
+    }
+
+    public String getBundledAssetScheme() {
+        return bundledAssetScheme;
+    }
+
+    public void setBundledAssetScheme(String bundledAssetScheme) {
+        if (bundledAssetScheme == null || bundledAssetScheme.isBlank()) {
+            this.bundledAssetScheme = "https";
+            return;
+        }
+        this.bundledAssetScheme = bundledAssetScheme.toLowerCase(Locale.ROOT);
+    }
+
+    public boolean getServeBundledAssets() {
+        return serveBundledAssets;
+    }
+
+    public void setServeBundledAssets(boolean serveBundledAssets) {
+        this.serveBundledAssets = serveBundledAssets;
+    }
+
     public JSObject getHeaders() {
         return headers;
     }
@@ -784,6 +819,9 @@ public class Options {
         copy.setTitleFontFamily(titleFontFamily);
         copy.setTitleIcon(titleIcon);
         copy.setUrl("about:blank");
+        copy.setBundledAssetHost(bundledAssetHost);
+        copy.setBundledAssetScheme(bundledAssetScheme);
+        copy.setServeBundledAssets(serveBundledAssets);
         copy.setHeaders(headers);
         copy.setCustomUserAgent(customUserAgent);
         copy.setCredentials(credentials);