@livx.cc/appwrap 0.23.2 → 0.25.0

package/runtime/app/shell/web-quirks.ts

@@ -119,6 +119,64 @@ export function serviceWorkerGuardJs(enabled: boolean): string {
 })();`;
 }
 
+/**
+ * Make the shell behave like a regular native app when the web content tries to leave the app's own
+ * origin: hand external-origin navigations to the OS default browser (Safari / Chrome — via the core
+ * `app.openUrl` handler, which leaves the app) instead of replacing the shell WebView. Intercepts, at
+ * document-start (BEFORE the page wires its own handlers), two intents:
+ *   - a click on an `<a href>` resolving to a DIFFERENT origin (incl. `target="_blank"`), and
+ *   - `window.open(url, ...)` to a different origin.
+ * Same-origin links / SPA route changes pass straight through (the app keeps owning its own
+ * navigation), so this never ejects the user mid-flow inside their own app. Only runs in the top
+ * frame — embedded iframes (maps, video, ad frames) are left alone. Non-http(s) schemes
+ * (`tel:`/`mailto:`/`app:`) are ignored here and handled by the OS/WebView as usual.
+ *
+ * The request is dispatched fire-and-forget over the same raw transport the bridge listens on (iOS
+ * `webkit.messageHandlers.appwrap`, Android `appwrapNative.postMessage`) — independent of the
+ * consumer's native-kit, so it works even on an unmodified remotely-loaded (loader:'server') webapp.
+ *
+ * `enabled` = SHELL_CONFIG.openNewWindowsInBrowser (default false). Idempotent via a window guard.
+ */
+export function externalNavGuardJs(enabled: boolean): string {
+  if (!enabled) return '';
+  return `(function(){
+  if (window.top !== window.self || window.__appwrapExtNavGuard) return;
+  window.__appwrapExtNavGuard = true;
+  function send(url){
+    try {
+      var json = JSON.stringify({ v:1, id:'extnav-'+Date.now()+'-'+Math.random().toString(36).slice(2),
+        kind:'request', method:'app.openUrl', params:{ url:url } });
+      if (window.webkit && window.webkit.messageHandlers && window.webkit.messageHandlers.appwrap) {
+        window.webkit.messageHandlers.appwrap.postMessage(json); return true; }
+      if (window.appwrapNative && window.appwrapNative.postMessage) {
+        window.appwrapNative.postMessage(json); return true; }
+    } catch (e) {}
+    return false;
+  }
+  // Resolve to an absolute http(s) URL that is on a DIFFERENT origin than the app shell; else null.
+  function external(href){
+    try {
+      var u = new URL(href, location.href);
+      if (u.protocol !== 'http:' && u.protocol !== 'https:') return null; // tel:/mailto:/app:/blob: → OS/WebView
+      return u.origin !== location.origin ? u.href : null;
+    } catch (e) { return null; }
+  }
+  document.addEventListener('click', function(e){
+    if (e.defaultPrevented || e.button !== 0 || e.metaKey || e.ctrlKey || e.shiftKey || e.altKey) return;
+    var a = e.target && e.target.closest ? e.target.closest('a[href]') : null;
+    if (!a) return;
+    var url = external(a.getAttribute('href'));
+    if (url && send(url)) { e.preventDefault(); e.stopPropagation(); }
+  }, true);
+  var open = window.open;
+  window.open = function(url){
+    var ext = url != null ? external(String(url)) : null;
+    if (ext && send(ext)) return null;
+    return open ? open.apply(window, arguments) : null;
+  };
+})();`;
+}
+
 /**
  * Native-feel injection shared by both CustomWebViews. Suppresses the "it's a
  * web page" tells: pinch / double-tap zoom, long-press callout & selection,

package/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "appwrap-shell",
   "main": "app/app.ts",
-  "version": "0.18.0",
+  "version": "0.28.0",
   "private": true,
   "scripts": {
     "dev:ios": "ns run ios",

package/src/cli.ts

@@ -172,6 +172,9 @@ function nativeReqs(cfg: AppwrapConfig): NativeReqs {
 const OPTIONAL_GROUP_HANDLERS: Record<string, { file: string; fn: string }> = {
   health: { file: './handlers-health', fn: 'registerHealthHandlers' },
   oauth: { file: './handlers-oauth', fn: 'registerOAuthHandlers' },
+  reviews: { file: './handlers-reviews', fn: 'registerReviewsHandlers' },
+  scanner: { file: './handlers-scanner', fn: 'registerScannerHandlers' },
+  speech: { file: './handlers-speech', fn: 'registerSpeechHandlers' },
 };
 
 /** Generate the two composition artifacts in the wrapper: the active capability list (drives the
@@ -363,8 +366,10 @@ export const SHELL_CONFIG = {
   debugLog: ${JSON.stringify(cfg.debugLog ?? '*')},
   devMenu: ${JSON.stringify(cfg.devMenu ?? true)},
   neutralizeServiceWorker: ${JSON.stringify(cfg.neutralizeServiceWorker ?? true)},
+  openNewWindowsInBrowser: ${JSON.stringify(cfg.openNewWindowsInBrowser ?? false)},
   pushIos: ${JSON.stringify(!!cfg.push?.enabled && cfg.push?.ios !== false)},
   pushAndroid: ${JSON.stringify(!!cfg.push?.enabled && cfg.push?.android !== false)},
+  pushRegistrationUrl: ${JSON.stringify(cfg.push?.registrationUrl ?? '')},
 };
 `;
   writeFileSync(join(outDir, 'app/shell/config.ts'), content);
@@ -433,7 +438,15 @@ function stampIOSDisplayName(outDir: string, cfg: AppwrapConfig, req: NativeReqs
 
 function stampTeamId(outDir: string, cfg: AppwrapConfig): void {
   const xcconfig = join(outDir, 'App_Resources/iOS/build.xcconfig');
-  if (!existsSync(xcconfig) || !cfg.teamId) return;
+  // A placeholder/empty teamId silently produces an unsignable build (DEVELOPMENT_TEAM = YOUR_APPLE_TEAM_ID
+  // → xcodebuild "No Account for Team"). Warn loudly rather than let a long build fail cryptically.
+  if (!cfg.teamId || /YOUR_APPLE_TEAM_ID|^$/.test(cfg.teamId)) {
+    console.warn(`⚠ teamId is unset/placeholder ("${cfg.teamId ?? ''}") — device builds won't sign.\n` +
+      '  Set it to your Apple Team ID in appwrap.config (Xcode → Settings → Accounts shows it; ' +
+      'Individual = paid, Personal Team = free).');
+    return;
+  }
+  if (!existsSync(xcconfig)) return;
   let src = readFileSync(xcconfig, 'utf8');
   src = /DEVELOPMENT_TEAM\s*=/.test(src)
     ? src.replace(/DEVELOPMENT_TEAM\s*=\s*[^;\n]*;?/, `DEVELOPMENT_TEAM = ${cfg.teamId};`)
@@ -1146,7 +1159,21 @@ async function deploy(cwd: string, flags: Record<string, string>, positionals: s
   // Dev deploy → debug mode: keep-awake + WebView inspector for continuous troubleshooting.
   stampShellConfig(outDir, { ...cfg, debug: true });
   console.log('▶ ns build ios --for-device  (debug: keep-awake + inspector on)');
-  execFileSync('ns', ['build', 'ios', '--for-device'], { cwd: outDir, stdio: 'inherit' });
+  try {
+    execFileSync('ns', ['build', 'ios', '--for-device'], { cwd: outDir, stdio: 'inherit' });
+  } catch (e) {
+    // The xcodebuild dump above is cryptic; surface the two signing failures we actually hit most.
+    console.error(
+      '\n✖ Device build failed — if the errors above mention signing:\n' +
+        `  • "Failed Registering Bundle Identifier … not available" → the App ID "${cfg.id}" is already\n` +
+        '    registered to another team (e.g. a prior free-team build). Change `id` in appwrap.config to a\n' +
+        '    unique string and re-deploy.\n' +
+        '  • "profile doesn\'t include the … entitlement" (e.g. HealthKit) → that capability needs a PAID\n' +
+        '    team (Individual). A free Personal Team can\'t hold it — switch teamId or drop the module.\n' +
+        '  • "No Account for Team" → sign that Apple ID into Xcode → Settings → Accounts first.'
+    );
+    process.exit(1);
+  }
 
   const ipaDir = join(outDir, 'platforms/ios/build/Debug-iphoneos');
   const ipa = existsSync(ipaDir) ? readdirSync(ipaDir).find((f) => f.endsWith('.ipa')) : undefined;

package/src/config.ts

@@ -79,6 +79,13 @@ export interface AppwrapConfig {
    * for in-WebView web-push as a fallback. NOTE: keeping the SW is the only way to get web push; native
    * push is the separate `push` lane (APNs/FCM) and does NOT need a SW. */
   neutralizeServiceWorker?: boolean;
+  /** Hand navigations that LEAVE the app's own origin to the OS default browser (Safari / Chrome)
+   * instead of replacing the shell WebView — so external links and `window.open(...)`/`target="_blank"`
+   * behave like a regular native app (open in the system browser) rather than navigating away inside
+   * the shell. Covers external-origin `<a>` clicks (including `target="_blank"`) and `window.open()`;
+   * same-origin SPA navigation, subframes/iframes and `tel:`/`mailto:` are left untouched. Default
+   * `false` (unchanged in-WebView navigation). See `externalNavGuardJs`. */
+  openNewWindowsInBrowser?: boolean;
   /** Apple Development Team ID for device builds (Xcode → Settings → Accounts). */
   teamId?: string;
   /** Path (relative to the PWA project) to a StoreKit configuration file for LOCAL IAP
@@ -132,6 +139,10 @@ export interface AppwrapConfig {
     apsEnvironment?: 'development' | 'production';
     /** Path (relative to the PWA project) to the Firebase `google-services.json` for Android FCM. */
     googleServicesJson?: string;
+    /** Optional backend URL the shell POSTs the device token to NATIVELY on acquisition (`{token,
+     * platform}`). Native HTTP sidesteps the WKWebView app:// cross-origin wall — the token reaches
+     * your server with no WebView fetch. Your backend stores it + sends pushes (provider-agnostic). */
+    registrationUrl?: string;
   };
 }