@glassly/engine 0.3.4-dev.692 → 0.3.4-dev.696

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glassly/engine",
-  "version": "0.3.4-dev.692",
+  "version": "0.3.4-dev.696",
   "description": "Glassly Engine — miniapp registry, WebView bridge, and miniapp store",
   "main": "build/index.js",
   "react-native": "src/index.ts",
@@ -97,17 +97,17 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@glassly/bluetooth-sdk": "0.3.4-dev.692",
-    "@glassly/cloud-client": "0.3.4-dev.692",
-    "@glassly/cloud-protocol": "0.3.4-dev.692",
-    "@glassly/crust": "0.3.4-dev.692",
-    "@glassly/miniapp": "0.3.4-dev.692",
+    "@glassly/bluetooth-sdk": "0.3.4-dev.696",
+    "@glassly/cloud-client": "0.3.4-dev.696",
+    "@glassly/cloud-protocol": "0.3.4-dev.696",
+    "@glassly/crust": "0.3.4-dev.696",
+    "@glassly/miniapp": "0.3.4-dev.696",
     "buffer": "^6.0.3",
     "events": "^3.3.0",
     "react-native-marked": "8.1.1",
     "semver": "^7.7.4",
     "typesafe-ts": "^1.7.1",
-    "@glassly/llm-providers": "0.3.4-dev.692",
+    "@glassly/llm-providers": "0.3.4-dev.696",
     "@huggingface/jinja": "^0.5.9",
     "jsonrepair": "^3.12.0"
   },

package/src/generated/releaseMetadata.ts

@@ -12,9 +12,9 @@ export interface EngineReleaseMetadata {
 export const ENGINE_RELEASE_METADATA: Readonly<EngineReleaseMetadata> = Object.freeze({
   "schemaVersion": 1,
   "familyBaseVersion": "0.3.4",
-  "releaseIdentity": "0.3.4-dev.692",
-  "releaseSetId": "glassly-0.3.4-dev.692",
-  "sourceCommit": "cdff0285d06e386961f1cd79f78ea78296ffe545",
+  "releaseIdentity": "0.3.4-dev.696",
+  "releaseSetId": "glassly-0.3.4-dev.696",
+  "sourceCommit": "6350b9aa9518c8af4da730f6d6c60312dc47e672",
   "otaManifestUrl": null,
   "otaManifestSha256": null
 })

package/src/index.ts

@@ -35,6 +35,8 @@ export type {
   IslandUiSeams,
   ScanQrOptions,
   ScanQrResult,
+  WebLoginOptions,
+  WebLoginResult,
   SubjectTokenType,
 } from "./runtime/bootstrap"
 

package/src/runtime/bootstrap.ts

@@ -66,6 +66,13 @@ export interface IslandUiSeams {
    * miniapps get NOT_IMPLEMENTED.
    */
   scanQr?: (options?: ScanQrOptions) => Promise<ScanQrResult>
+  /**
+   * `session.system.webLogin` — open a third-party sign-in page in an in-app
+   * browser sheet and hand back named cookies once it reaches the done URL.
+   * Same Modal rule as scanQr: must NOT clear miniapp foreground. Absent ⇒
+   * miniapps get NOT_IMPLEMENTED.
+   */
+  webLogin?: (options: WebLoginOptions) => Promise<WebLoginResult>
 }
 
 export interface ScanQrOptions {
@@ -75,6 +82,17 @@ export interface ScanQrOptions {
 
 export type ScanQrResult = {data: string} | {cancelled: true}
 
+export interface WebLoginOptions {
+  url: string
+  doneUrlPrefix: string
+  cookies: string[]
+  title?: string
+  /** The requesting miniapp, shown on the sheet so the user knows who asked. */
+  packageName?: string
+}
+
+export type WebLoginResult = {status: "completed"; cookies: Record<string, string>; url: string} | {status: "cancelled"}
+
 export interface IslandConfigureOptions {
   /** REQUIRED — the only must-have seam. The host owns login; engine owns the rest. */
   auth: IslandAuth

package/src/runtime/webLoginSeam.ts

@@ -0,0 +1,59 @@
+import type {WebLoginOptions, WebLoginResult} from "./bootstrap"
+
+export class WebLoginNotConfiguredError extends Error {
+  readonly code = "NOT_IMPLEMENTED"
+  constructor() {
+    super("In-app sign-in is not configured on this host. Reload the Glassly App and try again.")
+    this.name = "WebLoginNotConfiguredError"
+  }
+}
+
+export class WebLoginInvalidError extends Error {
+  readonly code = "INVALID_ARGS"
+  constructor(message: string) {
+    super(message)
+    this.name = "WebLoginInvalidError"
+  }
+}
+
+/** The host of an https URL, or null when it is anything else. */
+function httpsHost(value: unknown): string | null {
+  if (typeof value !== "string") return null
+  const match = value.match(/^https:\/\/([^/?#]+)(?:[/?#]|$)/i)
+  return match ? match[1].toLowerCase() : null
+}
+
+/**
+ * Checks a WEB_LOGIN payload before it reaches the host sheet: both URLs
+ * https, at least one cookie name, and the cookie names sane. The done URL is
+ * where cookies are read from, so it must be an origin the miniapp named.
+ */
+export function parseWebLoginOptions(payload: Record<string, unknown>, packageName?: string): WebLoginOptions {
+  const url = payload.url
+  const doneUrlPrefix = payload.doneUrlPrefix
+  if (!httpsHost(url)) throw new WebLoginInvalidError("webLogin: url must be an https URL")
+  if (!httpsHost(doneUrlPrefix)) throw new WebLoginInvalidError("webLogin: doneUrlPrefix must be an https URL")
+  const cookies = Array.isArray(payload.cookies)
+    ? payload.cookies.filter(
+        (name): name is string => typeof name === "string" && /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(name),
+      )
+    : []
+  if (cookies.length === 0) throw new WebLoginInvalidError("webLogin: cookies must name at least one cookie")
+  return {
+    url: url as string,
+    doneUrlPrefix: doneUrlPrefix as string,
+    cookies,
+    title: typeof payload.title === "string" && payload.title.trim() ? payload.title.trim() : undefined,
+    packageName,
+  }
+}
+
+export async function invokeWebLoginSeam(
+  webLogin: ((options: WebLoginOptions) => Promise<WebLoginResult>) | undefined,
+  payload: Record<string, unknown>,
+  packageName?: string,
+): Promise<WebLoginResult> {
+  const options = parseWebLoginOptions(payload, packageName)
+  if (!webLogin) throw new WebLoginNotConfiguredError()
+  return webLogin(options)
+}

package/src/services/LocalMiniappRuntime.ts

@@ -142,6 +142,7 @@ import {
 } from "../runtime/config"
 import {getAnalytics, getUiSeams} from "../runtime/bootstrap"
 import {invokeScanQrSeam} from "../runtime/scanQrSeam"
+import {invokeWebLoginSeam} from "../runtime/webLoginSeam"
 import {normalizeStreamAudioConfig, normalizeStreamVideoConfig} from "../runtime/streamConfig"
 import {visibleActionRows} from "./manifestActions"
 import {toLanguageHint} from "@glassly/cloud-protocol/languages"
@@ -1623,6 +1624,9 @@ class LocalMiniappRuntime {
       case MiniappRequestType.SCAN_QR:
         void this.handleScanQr(packageName, payload, requestId)
         break
+      case MiniappRequestType.WEB_LOGIN:
+        void this.handleWebLogin(packageName, payload, requestId)
+        break
 
       // Persistent binary blob storage (session.blob)
       case MiniappRequestType.BLOB_CREATE:
@@ -4536,6 +4540,25 @@ class LocalMiniappRuntime {
     }
   }
 
+  /**
+   * session.system.webLogin — host in-app browser sheet. Same contract as
+   * scanQr: the seam presents a Modal and never clears miniapp foreground.
+   */
+  private async handleWebLogin(packageName: string, payload: Record<string, unknown>, requestId?: string): Promise<void> {
+    try {
+      const result = await invokeWebLoginSeam(getUiSeams().webLogin, payload, packageName)
+      this.sendResult(packageName, requestId, true, result)
+    } catch (err) {
+      if (!getUiSeams().webLogin) {
+        console.warn(`${LOG_TAG}: webLogin seam missing — sign-in sheet is not registered`)
+      }
+      this.sendResult(packageName, requestId, false, undefined, {
+        code: (err as {code?: string} | null | undefined)?.code || MiniappErrorCode.INTERNAL,
+        message: err instanceof Error ? err.message : "Web sign-in failed",
+      })
+    }
+  }
+
   // ---------------------------------------------------------------------------
   // System utilities (share, open URL, clipboard, download)
   // ---------------------------------------------------------------------------