@livx.cc/appwrap 0.38.0 → 0.38.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livx.cc/appwrap",
-  "version": "0.38.0",
+  "version": "0.38.2",
   "description": "Wrap any PWA into a native app with native capabilities (appwrap runtime + @livx.cc/native-kit).",
   "license": "MIT",
   "author": "Elya Livshitz",

package/runtime/app/shell/config.ts

@@ -40,6 +40,11 @@ export const SHELL_CONFIG = {
    * fights the app:// handler / remote-update detection). On by default; set false to opt out and keep
    * the SW (e.g. for in-WebView web-push). See `serviceWorkerGuardJs`. */
   neutralizeServiceWorker: true,
+  /** iOS App-Bound Domains (from `appwrap.json.appBoundDomains`). When non-empty the shell sets
+   * `WKWebViewConfiguration.limitsNavigationsToAppBoundDomains = true` — Apple's gate for running a
+   * service worker in the WKWebView (the same hosts are stamped to Info.plist `WKAppBoundDomains`).
+   * RESTRICTS the WebView to these domains, so only for single-origin apps. Empty = no restriction. */
+  appBoundDomains: [] as string[],
   /** Open external-origin navigations (`<a>` to another origin, incl. `target="_blank"`, and
    * `window.open(...)`) in the OS default browser (Safari / Chrome) instead of inside the shell
    * WebView — regular-native-app behavior. Same-origin SPA navigation is untouched. Off by default.

package/runtime/app/shell/custom-webview.ios.ts

@@ -180,6 +180,10 @@ export class CustomWebView extends WebView {
     config.allowsPictureInPictureMediaPlayback = true;
     config.mediaTypesRequiringUserActionForPlayback = 0; // WKAudiovisualMediaTypeNone
     config.websiteDataStore = WKWebsiteDataStore.defaultDataStore();
+    // Apple's hard requirement for a service worker in a WKWebView: restrict navigation to the
+    // declared app-bound domains (also stamped to Info.plist WKAppBoundDomains). Only set when
+    // configured — otherwise the WebView stays unrestricted (default behavior).
+    if (SHELL_CONFIG.appBoundDomains?.length) config.limitsNavigationsToAppBoundDomains = true;
 
     // Env hints + framework globals (backend origin) + a getUserMedia guard for UNDECLARED capabilities
     // (must reject in JS before WebKit's native capture path — see mediaCaptureGuardJs) + native-feel

package/src/cli.ts

@@ -28,6 +28,7 @@ import {
   resolveBuildNumber,
   stampAndroidOrientation,
   stampAndroidQueries,
+  stampAppBoundDomains,
   stampPlistBackgroundTasks,
   stampPlistOrientations,
   stampPrivacyTracking,
@@ -410,6 +411,7 @@ export const SHELL_CONFIG = {
   debugLog: ${JSON.stringify(cfg.debugLog ?? '*')},
   devMenu: ${JSON.stringify(cfg.devMenu ?? true)},
   neutralizeServiceWorker: ${JSON.stringify(cfg.neutralizeServiceWorker ?? true)},
+  appBoundDomains: ${JSON.stringify(cfg.appBoundDomains ?? [])} as string[],
   openNewWindowsInBrowser: ${JSON.stringify(cfg.openNewWindowsInBrowser ?? false)},
   pushIos: ${JSON.stringify(!!cfg.push?.enabled && cfg.push?.ios !== false)},
   pushAndroid: ${JSON.stringify(!!cfg.push?.enabled && cfg.push?.android !== false)},
@@ -448,6 +450,11 @@ function stampIOSDisplayName(outDir: string, cfg: AppwrapConfig, req: NativeReqs
   const bgActive = req.activeOptionalGroups.includes('backgroundTask');
   src = stampPlistBackgroundTasks(src, bgActive ? cfg.backgroundTasks : undefined);
 
+  // iOS App-Bound Domains — gate for a WKWebView service worker (paired with
+  // limitsNavigationsToAppBoundDomains in the shell config). Idempotent both ways: empty/undefined
+  // strips the WKAppBoundDomains key, so it no-ops when the field is absent.
+  src = stampAppBoundDomains(src, cfg.appBoundDomains);
+
   // Permission usage strings + URL scheme + export-compliance — idempotent: strip stamped block, re-add
   src = src.replace(/\s*<!-- appwrap:begin -->[\s\S]*?<!-- appwrap:end -->/g, '');
   const extras: string[] = [];

package/src/config.ts

@@ -97,6 +97,15 @@ export interface AppwrapConfig {
    * for in-WebView web-push as a fallback. NOTE: keeping the SW is the only way to get web push; native
    * push is the separate `push` lane (APNs/FCM) and does NOT need a SW. */
   neutralizeServiceWorker?: boolean;
+  /** iOS App-Bound Domains — the hosts (no scheme, max 10 per Apple) the WebView may navigate to.
+   * Setting this stamps `WKAppBoundDomains` into Info.plist AND sets
+   * `WKWebViewConfiguration.limitsNavigationsToAppBoundDomains = true`, which is Apple's HARD
+   * requirement for a service worker to run inside a WKWebView. Pair with `neutralizeServiceWorker:false`
+   * to actually enable a SW (this flag is the iOS gate; Android's SW is a separate lane).
+   * TRADEOFF: `limitsNavigationsToAppBoundDomains` RESTRICTS the WebView to exactly these domains —
+   * any navigation/OAuth/redirect to another domain breaks. Only for single-origin apps. Empty/unset =
+   * no change to current behavior (no Info.plist key, no nav restriction). */
+  appBoundDomains?: string[];
   /** Hand navigations that LEAVE the app's own origin to the OS default browser (Safari / Chrome)
    * instead of replacing the shell WebView — so external links and `window.open(...)`/`target="_blank"`
    * behave like a regular native app (open in the system browser) rather than navigating away inside

package/src/derive.ts

@@ -228,6 +228,27 @@ export function stampPlistBackgroundTasks(src: string, ids: string[] | undefined
   return src;
 }
 
+/**
+ * Stamp (or strip) `WKAppBoundDomains` in an Info.plist string — Apple's gate for running a service
+ * worker inside a WKWebView (paired with `limitsNavigationsToAppBoundDomains` on the config). Pure +
+ * idempotent: rewrites an `appwrap:appbound` marker block (added before `</dict>`), so a re-sync never
+ * duplicates. `domains` empty/undefined → strips the block entirely (no key = current behavior). Apple
+ * caps the array at 10; we stamp what's given. Mirrors `stampPlistOrientations` (pure string transform).
+ */
+export function stampAppBoundDomains(src: string, domains: string[] | undefined): string {
+  src = src.replace(/\s*<!-- appwrap:appbound -->[\s\S]*?<!-- \/appwrap:appbound -->/g, '');
+  const list = (domains ?? []).filter(Boolean);
+  if (list.length) {
+    const items = list.map((d) => `    <string>${d}</string>`).join('\n');
+    const block =
+      `  <!-- appwrap:appbound -->\n` +
+      `  <key>WKAppBoundDomains</key>\n  <array>\n${items}\n  </array>\n` +
+      `  <!-- /appwrap:appbound -->`;
+    src = src.replace(/<\/dict>\s*<\/plist>\s*$/, `${block}\n</dict>\n</plist>\n`);
+  }
+  return src;
+}
+
 /**
  * Stamp the App Tracking Transparency declarations into PrivacyInfo.xcprivacy. Rewrites the two
  * tracking keys IN PLACE (the template ships them, so we never restructure the doc — we only flip

package/templates/ci/fastlane/Fastfile

@@ -80,7 +80,25 @@ def appwrap_archive_and_sign_ios
   api_key
 end
 
+# Restore the login keychain as the system default and drop fastlane's temp keychain. `setup_ci`/`match`
+# create `fastlane_tmp_keychain` and point the default keychain at it; if a lane dies mid-run before
+# fastlane's own teardown, that stray keychain is left as the DEFAULT — so macOS (com.apple.iCloudHelper
+# etc.) keeps prompting for its password forever. CI runners are ephemeral so this is a no-op there;
+# locally it prevents the recurring keychain prompt. Best-effort: never fail the lane on cleanup.
+def appwrap_keychain_cleanup
+  login = File.expand_path('~/Library/Keychains/login.keychain-db')
+  return unless File.exist?(login)
+  sh("security default-keychain -s '#{login}'", error_callback: ->(_) {})
+  sh('security delete-keychain ~/Library/Keychains/fastlane_tmp_keychain-db 2>/dev/null || true',
+     error_callback: ->(_) {})
+rescue StandardError => e
+  UI.message("keychain cleanup skipped: #{e}")
+end
+
 platform :ios do
+  after_all { appwrap_keychain_cleanup }
+  error { |_lane, _exception| appwrap_keychain_cleanup }
+
   desc 'Build the NativeScript wrapper and upload to TestFlight'
   lane :beta do
     api_key = appwrap_archive_and_sign_ios