@livx.cc/appwrap 0.20.1 → 0.20.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livx.cc/appwrap",
-  "version": "0.20.1",
+  "version": "0.20.3",
   "description": "Wrap any PWA into a native app with native capabilities (appwrap runtime + @livx.cc/native-kit).",
   "license": "MIT",
   "author": "Elya Livshitz",

package/runtime/App_Resources/iOS/PrivacyInfo.xcprivacy

@@ -8,9 +8,13 @@
     - FileTimestamp (C617.1)  — NativeScript reads bundle/app file metadata at runtime
     - SystemBootTime (35F9.1) — NativeScript timers/uptime
     - DiskSpace (E174.1)      — NativeScript file I/O
-  NSPrivacyTracking is false and no data types are collected BY THE SHELL. If your PWA collects user
-  data (account, analytics, location) or uses tracking, add the matching NSPrivacyCollectedDataTypes /
-  NSPrivacyTracking entries here — see tracking-analytics + store-readiness.
+  NSPrivacyTracking is false (no IDFA, no cross-app/third-party linkage). The shell surfaces install
+  context for FIRST-PARTY analytics via kit.context():
+    - DeviceID (CRC0)  — identifierForVendor (IDFV), app-scoped, reset on uninstall; NOT IDFA.
+    - ProductInteraction (385F.1) — usage/app-environment props (platform, version, install source).
+  Both are declared NOT linked to identity and NOT used for tracking. If your PWA collects MORE
+  (account, location, contacts) or DOES track (ads/3rd-party linkage), add the matching
+  NSPrivacyCollectedDataTypes / set NSPrivacyTracking=true here — see tracking-analytics + store-readiness.
 -->
 <plist version="1.0">
 <dict>
@@ -19,7 +23,32 @@
 	<key>NSPrivacyTrackingDomains</key>
 	<array/>
 	<key>NSPrivacyCollectedDataTypes</key>
-	<array/>
+	<array>
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypeDeviceID</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array>
+				<string>NSPrivacyCollectedDataTypePurposeAnalytics</string>
+			</array>
+		</dict>
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypeProductInteraction</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array>
+				<string>NSPrivacyCollectedDataTypePurposeAnalytics</string>
+			</array>
+		</dict>
+	</array>
 	<key>NSPrivacyAccessedAPITypes</key>
 	<array>
 		<dict>

package/runtime/app/shell/custom-webview.ios.ts

@@ -17,6 +17,14 @@ import { appwrapNativeLog } from './native-log';
 // Forwarded WebView console/errors → the shared native-log sink (Documents/appwrap-web.log).
 const appendWebLog = appwrapNativeLog;
 
+/** Parse a #rrggbb config color into a UIColor (for the WebView background). */
+function uiColorFromHex(hex?: string): any {
+  const m = /^#?([0-9a-fA-F]{6})$/.exec((hex ?? '').trim());
+  if (!m) return null;
+  const n = parseInt(m[1], 16);
+  return UIColor.colorWithRedGreenBlueAlpha(((n >> 16) & 255) / 255, ((n >> 8) & 255) / 255, (n & 255) / 255, 1);
+}
+
 export class CustomWebView extends WebView {
   /** Set by the bridge before load; receives raw envelope JSON. */
   onAppwrapMessage: ((json: string) => void) | null = null;
@@ -104,6 +112,12 @@ export class CustomWebView extends WebView {
     // and the auto content-inset (the page owns safe areas via env()).
     webView.scrollView.bounces = false;
     webView.scrollView.contentInsetAdjustmentBehavior = 2; // .never
+
+    // No white flash before the page paints: make the WebView transparent so the (themed) NS page
+    // backgroundColor shows through during load — critical for loader:'server' (network) startups.
+    const bg = uiColorFromHex(SHELL_CONFIG.backgroundColor);
+    webView.opaque = false;
+    if (bg) { webView.backgroundColor = bg; webView.scrollView.backgroundColor = bg; }
     webView.allowsLinkPreview = false;
     // Edge-swipe to go back/forward in WebView history — the iOS native gesture
     // users expect. SPAs that own their own history still get it for free.

package/runtime/app/shell/handlers-push.ts

@@ -93,6 +93,29 @@ export function registerPushHandlers(): void {
     throw unsupported();
   });
 
+  bridge.register('push.permissionStatus', () => {
+    if (isIOS) {
+      return new Promise<string>((resolve) => {
+        UNUserNotificationCenter.currentNotificationCenter().getNotificationSettingsWithCompletionHandler(
+          (settings) => {
+            switch (settings.authorizationStatus) {
+              case UNAuthorizationStatus.Authorized:
+              case UNAuthorizationStatus.Provisional:
+              case UNAuthorizationStatus.Ephemeral:
+                return resolve('granted');
+              case UNAuthorizationStatus.Denied:
+                return resolve('denied');
+              default:
+                return resolve('notDetermined');
+            }
+          }
+        );
+      });
+    }
+    if (isAndroid) return androidPermissionStatus();
+    throw unsupported();
+  });
+
   bridge.register('push.register', () => {
     if (isIOS) {
       return new Promise<PushToken>((resolve, reject) => {
@@ -164,6 +187,19 @@ function androidRequestPermission(): Promise<string> {
   });
 }
 
+function androidPermissionStatus(): string {
+  // No "not-determined" concept on Android — report the effective on/off state.
+  // < API 33 has no runtime perm, but the user can still disable notifications in Settings.
+  try {
+    const ctx = Utils.android.getApplicationContext();
+    const enabled = androidx.core.app.NotificationManagerCompat.from(ctx).areNotificationsEnabled();
+    return enabled ? 'granted' : 'denied';
+  } catch (e) {
+    console.warn('AppWrap: push.permissionStatus failed', e);
+    return 'notDetermined';
+  }
+}
+
 function androidGetToken(): Promise<PushToken> {
   return new Promise((resolve, reject) => {
     try {

package/runtime/app/shell/handlers-system.ts

@@ -1,10 +1,79 @@
-import { Application, Color, Utils, isAndroid, isIOS } from '@nativescript/core';
+import { Application, ApplicationSettings, Color, Utils, isAndroid, isIOS } from '@nativescript/core';
 import { bridge } from './bridge';
 
-declare const android: any, androidx: any;
+declare const android: any, androidx: any, java: any;
 
 const err = (code: string, message: string) => Object.assign(new Error(message), { code });
 
+/** Running on a simulator/emulator? (mirrors env.ts detection; kept local to avoid a cross-import). */
+function detectEmulator(): boolean {
+  if (isIOS) {
+    return NSProcessInfo.processInfo.environment.objectForKey('SIMULATOR_DEVICE_NAME') != null;
+  }
+  const B = android.os.Build;
+  const fp = String(B.FINGERPRINT ?? '');
+  return (
+    fp.startsWith('generic') ||
+    fp.includes('vbox') ||
+    fp.includes('test-keys') ||
+    String(B.MODEL ?? '').includes('Emulator') ||
+    String(B.MANUFACTURER ?? '').includes('Genymotion') ||
+    String(B.HARDWARE ?? '').includes('goldfish') ||
+    String(B.HARDWARE ?? '').includes('ranchu')
+  );
+}
+
+/**
+ * Install-level environment for analytics/identification. First-party & non-tracking:
+ *  - iOS installId = identifierForVendor (NOT IDFA — no ATT prompt needed); source from the
+ *    App Store receipt path (sandboxReceipt ⇒ TestFlight). iOS has no clean first/last-install API.
+ *  - Android installId = a random UUID persisted in app storage (cleared on uninstall, like IDFV);
+ *    source from the installer package name; first/last-install from PackageInfo.
+ */
+function appEnvironment() {
+  const isEmulator = detectEmulator();
+  if (isIOS) {
+    let source = 'sideload';
+    if (isEmulator) source = 'simulator';
+    // A dev/ad-hoc build carries embedded.mobileprovision; TestFlight & App Store builds do NOT.
+    // Both TestFlight AND dev builds have a `sandboxReceipt`, so the receipt name alone can't tell
+    // them apart — the provisioning profile is the reliable discriminator.
+    else if (NSBundle.mainBundle.pathForResourceOfType('embedded', 'mobileprovision')) source = 'sideload';
+    else {
+      const receipt = NSBundle.mainBundle.appStoreReceiptURL;
+      const name = receipt?.lastPathComponent ?? '';
+      if (name === 'sandboxReceipt') source = 'testflight';
+      else if (receipt && NSFileManager.defaultManager.fileExistsAtPath(receipt.path)) source = 'appstore';
+    }
+    const idfv = UIDevice.currentDevice.identifierForVendor;
+    return { source, installId: idfv ? idfv.UUIDString : undefined, isEmulator };
+  }
+  // Android
+  const ctx = Utils.android.getApplicationContext();
+  const pm = ctx.getPackageManager();
+  const pkg = ctx.getPackageName();
+  let source = isEmulator ? 'simulator' : 'sideload';
+  let firstInstallAt: number | undefined;
+  let lastUpdateAt: number | undefined;
+  try {
+    const installer = android.os.Build.VERSION.SDK_INT >= 30
+      ? pm.getInstallSourceInfo(pkg)?.getInstallingPackageName()
+      : pm.getInstallerPackageName(pkg);
+    if (!isEmulator && (installer === 'com.android.vending' || installer === 'com.google.android.feedback')) source = 'playstore';
+    const pi = pm.getPackageInfo(pkg, 0);
+    firstInstallAt = Number(pi.firstInstallTime);
+    lastUpdateAt = Number(pi.lastUpdateTime);
+  } catch (e) {
+    console.warn('AppWrap: app.environment install info failed', e);
+  }
+  let installId = ApplicationSettings.getString('kit:__installId', '');
+  if (!installId) {
+    installId = String(java.util.UUID.randomUUID().toString());
+    ApplicationSettings.setString('kit:__installId', installId);
+  }
+  return { source, installId, firstInstallAt, lastUpdateAt, isEmulator };
+}
+
 /**
  * System / navigation handlers shared by both platforms (each method branches
  * internally rather than relying on the iOS-first + Android-override split):
@@ -48,6 +117,8 @@ export function registerSystemHandlers(): void {
     }
   });
 
+  bridge.register('app.environment', () => appEnvironment());
+
   bridge.register('browser.open', ({ url, toolbarColor }: { url: string; toolbarColor?: string }) => {
     const target = String(url ?? '');
     if (!target) throw err('NATIVE_ERROR', 'browser.open: empty url');

package/templates/ci/github/workflows/appwrap-pr.yml

@@ -22,7 +22,8 @@ jobs:
       - uses: actions/setup-node@v4
         with: { node-version: 22 }
       - run: bun install && bun run build.ts
-      - run: npm i -g nativescript
+      # Pin global tools — unpinned installs can grab a breaking release mid-flight. Bump deliberately.
+      - run: npm i -g nativescript@9.0.6
       - run: bunx @livx.cc/appwrap init # native/ is generated (gitignored) — regenerate it fresh in CI
       - working-directory: native
         run: npm install && ns build ios --emulator

package/templates/ci/github/workflows/appwrap-release-android.yml

@@ -24,7 +24,8 @@ jobs:
         with: { distribution: temurin, java-version: 17 }
       - uses: android-actions/setup-android@v3
       - run: bun install && bun run build.ts        # → dist/ (the PWA bundle the wrapper ships)
-      - run: npm i -g nativescript
+      # Pin global tools — unpinned installs can grab a breaking release mid-flight. Bump deliberately.
+      - run: npm i -g nativescript@9.0.6
       - run: bunx @livx.cc/appwrap init                      # native/ is generated (gitignored) — regenerate fresh in CI
       - working-directory: native
         run: npm install
@@ -43,7 +44,7 @@ jobs:
           path: native/platforms/android/app/build/outputs/bundle/release/app-release.aab
       - uses: ruby/setup-ruby@v1
         with: { ruby-version: '3.3', bundler-cache: false }
-      - run: gem install fastlane
+      - run: gem install fastlane -v 2.236.1
       - name: Upload to Play (internal)
         working-directory: native
         env:

package/templates/ci/github/workflows/appwrap-release-ios.yml

@@ -26,13 +26,14 @@ jobs:
       - uses: actions/setup-node@v4
         with: { node-version: 22 }
       - run: bun install && bun run build.ts
-      - run: npm i -g nativescript
+      # Pin global tools — unpinned installs can grab a breaking release mid-flight. Bump deliberately.
+      - run: npm i -g nativescript@9.0.6
       - run: bunx @livx.cc/appwrap init # native/ is generated (gitignored) — regenerate it fresh in CI
       - working-directory: native
         run: npm install
       - uses: ruby/setup-ruby@v1
         with: { ruby-version: '3.3', bundler-cache: false }
-      - run: gem install fastlane
+      - run: gem install fastlane -v 2.236.1
       - name: Set up match deploy key (read-only SSH on the certs repo)
         run: |
           mkdir -p ~/.ssh && chmod 700 ~/.ssh