@livx.cc/appwrap 0.42.3 → 0.42.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livx.cc/appwrap",
-  "version": "0.42.3",
+  "version": "0.42.4",
   "description": "Wrap any PWA into a native app with native capabilities (appwrap runtime + @livx.cc/native-kit).",
   "license": "MIT",
   "author": "Elya Livshitz",

package/runtime/app/shell/custom-webview.android.ts

@@ -31,6 +31,58 @@ function buildBootstrapJs(): string {
   return `${envGlobalsJs()}\n${APPWRAP_GLOBALS_JS}\n${TRANSPORT_SHIM}\n${serviceWorkerGuardJs(SHELL_CONFIG.neutralizeServiceWorker)}\n${externalNavGuardJs(SHELL_CONFIG.openNewWindowsInBrowser)}\n${NATIVE_FEEL_JS}`;
 }
 
+/**
+ * The extended WebChromeClient MUST be generated ONCE. NativeScript caches the Java proxy
+ * class it synthesizes for `extend({...})` keyed by the methods-object shape, so calling
+ * extend() again per-webview REUSES the first invocation's class — including its captured
+ * closure. A per-instance `owner` WeakRef baked into the closure therefore cross-wires every
+ * later webview's prompt() transport to the FIRST instance (device-proven in the feedox
+ * mini-app spike: webview-2's bridge request was answered as webview-1). Route by the native
+ * view the callback is given instead, resolved against a per-view registry.
+ */
+let chromeClientClass: any;
+function getChromeClientClass(): any {
+  if (chromeClientClass) return chromeClientClass;
+  // NS runtime adds `.extend` on Java classes; it's not in the static typings, hence the cast.
+  chromeClientClass = (android.webkit.WebChromeClient as any).extend({
+    onJsPrompt(
+      view: android.webkit.WebView,
+      _url: string,
+      message: string,
+      _defaultValue: string,
+      result: android.webkit.JsPromptResult
+    ): boolean {
+      if (typeof message === 'string' && message.startsWith(PROMPT_PREFIX)) {
+        result.confirm('');
+        CustomWebView.forNative(view)?.onAppwrapMessage?.(message.slice(PROMPT_PREFIX.length));
+        return true;
+      }
+      return false; // genuine page prompt — default handling
+    },
+
+    // getUserMedia: grant the WebView's per-origin capture after ensuring the
+    // app holds the matching OS runtime permission (CAMERA / RECORD_AUDIO).
+    // No instance state — safe on the shared class.
+    onPermissionRequest(request: android.webkit.PermissionRequest): void {
+      const PR = android.webkit.PermissionRequest;
+      const resources: string[] = Array.from(request.getResources());
+      const perms = new Set<string>();
+      for (const r of resources) {
+        if (r === PR.RESOURCE_VIDEO_CAPTURE) perms.add('android.permission.CAMERA');
+        if (r === PR.RESOURCE_AUDIO_CAPTURE) perms.add('android.permission.RECORD_AUDIO');
+      }
+      if (!perms.size) {
+        Utils.dispatchToMainThread(() => request.grant(request.getResources()));
+        return;
+      }
+      requestPermissions(Array.from(perms)).then((ok) =>
+        Utils.dispatchToMainThread(() => (ok ? request.grant(request.getResources()) : request.deny()))
+      );
+    },
+  });
+  return chromeClientClass;
+}
+
 /**
  * Android CustomWebView — replaces NS's default clients after creation:
  * WebChromeClient.onJsPrompt is the appwrap transport, WebViewClient
@@ -41,6 +93,18 @@ export class CustomWebView extends WebView {
   /** Set by the bridge before load; receives raw envelope JSON. */
   onAppwrapMessage: ((json: string) => void) | null = null;
 
+  // Native-view → owning CustomWebView, keyed by the Java identity hash (stable per native
+  // object, robust to NS re-wrapping the arg passed into the ChromeClient callback). WeakRef
+  // so a destroyed view can be GC'd; entry pruned on dispose.
+  private static registry = new Map<number, WeakRef<CustomWebView>>();
+  static forNative(view: android.webkit.WebView): CustomWebView | undefined {
+    const owner = CustomWebView.registry.get(view.hashCode())?.deref();
+    // identityHashCode is not unique: on a (rare) collision the map holds the LAST writer —
+    // re-check native identity so a colliding view drops rather than cross-wires.
+    if (owner && owner.android !== view) return undefined;
+    return owner;
+  }
+
   initNativeView(): void {
     super.initNativeView();
     // NS core types the `.android` getter as `any`; narrow to the real WebView for this scope.
@@ -68,7 +132,15 @@ export class CustomWebView extends WebView {
 
     this.installDocumentStartShim(wv);
     wv.setWebViewClient(createAssetServingClient());
-    wv.setWebChromeClient(this.createTransportChromeClient());
+    // Bind THIS native view to THIS instance before wiring the (shared, extend-once) client.
+    CustomWebView.registry.set(wv.hashCode(), new WeakRef<CustomWebView>(this));
+    wv.setWebChromeClient(new (getChromeClientClass())());
+  }
+
+  disposeNativeView(): void {
+    const wv = this.android as android.webkit.WebView | undefined;
+    if (wv) CustomWebView.registry.delete(wv.hashCode());
+    super.disposeNativeView();
   }
 
   /**
@@ -115,52 +187,15 @@ export class CustomWebView extends WebView {
       console.warn('AppWrap: addDocumentStartJavaScript failed', e);
     }
   }
-
-  private createTransportChromeClient(): android.webkit.WebChromeClient {
-    const owner = new WeakRef<CustomWebView>(this);
-    // NS runtime adds `.extend` on Java classes; it's not in the static typings, hence the cast.
-    const ChromeClient = (android.webkit.WebChromeClient as any).extend({
-      onJsPrompt(
-        _view: android.webkit.WebView,
-        _url: string,
-        message: string,
-        _defaultValue: string,
-        result: android.webkit.JsPromptResult
-      ): boolean {
-        if (typeof message === 'string' && message.startsWith(PROMPT_PREFIX)) {
-          result.confirm('');
-          const view = owner.get ? owner.get() : (owner as { deref(): CustomWebView }).deref();
-          view?.onAppwrapMessage?.(message.slice(PROMPT_PREFIX.length));
-          return true;
-        }
-        return false; // genuine page prompt — default handling
-      },
-
-      // getUserMedia: grant the WebView's per-origin capture after ensuring the
-      // app holds the matching OS runtime permission (CAMERA / RECORD_AUDIO).
-      onPermissionRequest(request: android.webkit.PermissionRequest): void {
-        const PR = android.webkit.PermissionRequest;
-        const resources: string[] = Array.from(request.getResources());
-        const perms = new Set<string>();
-        for (const r of resources) {
-          if (r === PR.RESOURCE_VIDEO_CAPTURE) perms.add('android.permission.CAMERA');
-          if (r === PR.RESOURCE_AUDIO_CAPTURE) perms.add('android.permission.RECORD_AUDIO');
-        }
-        if (!perms.size) {
-          Utils.dispatchToMainThread(() => request.grant(request.getResources()));
-          return;
-        }
-        requestPermissions(Array.from(perms)).then((ok) =>
-          Utils.dispatchToMainThread(() => (ok ? request.grant(request.getResources()) : request.deny()))
-        );
-      },
-    });
-    return new ChromeClient();
-  }
 }
 
-/** https://appwrap.local/<path> → file under www/; SPA fallback to the entry for extension-less misses. */
+/** https://appwrap.local/<path> → file under www/; SPA fallback to the entry for extension-less misses.
+ * Extend-once (same NS shape-caching pitfall as the ChromeClient above): the closure here is
+ * process-constant, but generating the class per webview would silently pin the FIRST call's
+ * closure anyway — build it once and reuse. */
+let assetClientClass: any;
 function createAssetServingClient(): android.webkit.WebViewClient {
+  if (assetClientClass) return new assetClientClass();
   const wwwPath = nsPath.join(knownFolders.currentApp().path, 'www');
 
   const respond = (filePath: string, ext: string): android.webkit.WebResourceResponse => {
@@ -246,7 +281,7 @@ function createAssetServingClient(): android.webkit.WebViewClient {
   };
 
   // NS runtime adds `.extend` on Java classes; it's not in the static typings, hence the cast.
-  const Client = (android.webkit.WebViewClient as any).extend({
+  assetClientClass = (android.webkit.WebViewClient as any).extend({
     // Modern (API 21+) overload passes a WebResourceRequest; the legacy overload passed a string URL.
     // We defensively handle both, so the param is the union.
     shouldInterceptRequest(
@@ -305,5 +340,5 @@ function createAssetServingClient(): android.webkit.WebViewClient {
       }
     },
   });
-  return new Client();
+  return new assetClientClass();
 }

package/runtime/app/shell/handlers-android.ts

@@ -97,18 +97,36 @@ export function registerAndroidHandlers(): void {
     }
   });
 
+  // NS caches the Java proxy class synthesized by .extend({...}) by the methods-object SHAPE, so
+  // re-extending per call would permanently bake in the FIRST call's resolve/reject closure — every
+  // later authenticate would settle the first (already-settled) promise and hang its own. Extend once
+  // and route through a mutable slot (only one biometric prompt can be active at a time).
+  let biometricCallbackClass: any;
+  let biometricPending: { resolve: (v: unknown) => void; reject: (e: unknown) => void } | null = null;
+  const getBiometricCallbackClass = () => {
+    if (biometricCallbackClass) return biometricCallbackClass;
+    biometricCallbackClass = (androidx.biometric.BiometricPrompt.AuthenticationCallback as any).extend({
+      onAuthenticationSucceeded(_result: any) {
+        biometricPending?.resolve({ success: true });
+        biometricPending = null;
+      },
+      onAuthenticationError(_code: number, message: any) {
+        biometricPending?.reject(err('DENIED', String(message ?? 'authentication error')));
+        biometricPending = null;
+      },
+    });
+    return biometricCallbackClass;
+  };
+
   bridge.register('biometrics.authenticate', ({ reason }: { reason?: string }) => {
     return new Promise((resolve, reject) => {
       Utils.dispatchToMainThread(() => {
         try {
           const act = activity(); // NativeScriptActivity extends AppCompatActivity → FragmentActivity
           const executor = androidx.core.content.ContextCompat.getMainExecutor(act);
-          const Callback = (androidx.biometric.BiometricPrompt.AuthenticationCallback as any).extend({
-            onAuthenticationSucceeded(_result: any) { resolve({ success: true }); },
-            onAuthenticationError(_code: number, message: any) {
-              reject(err('DENIED', String(message ?? 'authentication error')));
-            },
-          });
+          biometricPending?.reject(err('DENIED', 'superseded by a new biometric prompt'));
+          biometricPending = { resolve, reject };
+          const Callback = getBiometricCallbackClass();
           const prompt = new androidx.biometric.BiometricPrompt(act, executor, new Callback());
           const info = new androidx.biometric.BiometricPrompt.PromptInfo.Builder()
             .setTitle(String(reason ?? 'Authenticate'))
@@ -117,6 +135,7 @@ export function registerAndroidHandlers(): void {
             .build();
           prompt.authenticate(info);
         } catch (e: any) {
+          if (biometricPending?.reject === reject) biometricPending = null;
           reject(err('UNSUPPORTED', e?.message ?? String(e)));
         }
       });

package/runtime/webpack.config.js

@@ -14,6 +14,26 @@ module.exports = (env) => {
   webpack.init(env);
 
   webpack.chainWebpack((config) => {
+    // node:-scheme imports: pure-JS deps (e.g. @noble/hashes) conditionally probe Node builtins via
+    // the `node:` scheme, which webpack cannot even READ ("UnhandledSchemeError: Reading from
+    // 'node:crypto' is not handled by plugins") — the whole NS build fails. Strip the scheme so the
+    // request becomes a bare builtin name…
+    const { NormalModuleReplacementPlugin } = require('webpack');
+    config.plugin('AppwrapStripNodeScheme').use(NormalModuleReplacementPlugin, [
+      /^node:/,
+      (resource) => {
+        resource.request = resource.request.replace(/^node:/, '');
+      },
+    ]);
+    // …then stub every Node builtin the NS runtime doesn't have to an empty module (fallback: false),
+    // so conditional probes resolve gracefully instead of "Module not found". `module` is excluded:
+    // @nativescript/webpack maps it to its own polyfill and that must keep winning.
+    config.resolve.merge({
+      fallback: Object.fromEntries(
+        require('module').builtinModules.filter((m) => m !== 'module').map((m) => [m, false])
+      ),
+    });
+
     // Ship the PWA bundle inside the app package
     config.plugin('CopyWww').use(CopyWebpackPlugin, [
       {

package/src/cli.ts

@@ -2,7 +2,7 @@
 /**
  * appwrap CLI v0 — scaffold a native wrapper around a built PWA.
  *
- *   appwrap init [--config <path>] [--out native]   # from the PWA project dir
+ *   appwrap init [--config <path>] [--out native] [--ci]   # from the PWA project dir; --ci also scaffolds GH Actions workflows
  *   appwrap sync [--config <path>] [--out native]   # re-copy PWA dist into the wrapper
  *
  * Config (TS preferred, JSON fallback) — probed in order: appwrap.config.ts → .js → appwrap.json.
@@ -1414,22 +1414,25 @@ export function isFrameworkRepo(root: string): boolean {
   return existsSync(join(root, 'packages/appwrap-cli/src/cli.ts'));
 }
 
-/** Emit CI scaffolding (GH Actions → git repo root, fastlane → native/).
+/** Emit CI scaffolding (GH Actions → git repo root ONLY with --ci, fastlane → native/).
+ * Writing `.github/workflows` into a consumer repo is a repo-level side effect (it can shadow or
+ * clash with the project's own CI), so it is OPT-IN via `appwrap init --ci` — never implicit.
  * GH workflows are never overwritten (users may customize them). The fastlane lane IS appwrap-managed
  * (the release recipe, not for hand-editing — see AGENTS.md), so it is RE-EMITTED on `--force` to keep
  * the recipe current after a framework upgrade; without --force it's still first-time-only. */
-function copyCiTemplates(cwd: string, outDir: string, cfg: AppwrapConfig, force = false): void {
+function copyCiTemplates(cwd: string, outDir: string, cfg: AppwrapConfig, force = false, withWorkflows = false): void {
   if (!existsSync(CI_TEMPLATE_DIR)) return;
   const repoRoot = gitRoot(cwd);
   // GitHub only reads `.github/workflows` at the REPO ROOT — in a monorepo, writing it under the
   // package cwd (e.g. packages/app/.github) is dead config and regenerates a stray workflow each init.
   // [from, to, overwritable]
   const targets: Array<[string, string, boolean]> = [[join(CI_TEMPLATE_DIR, 'fastlane'), join(outDir, 'fastlane'), force]];
-  // …but if the repo root IS the appwrap framework itself (in-repo example), DON'T scaffold consumer
-  // workflows into the framework's .github — that's the stray-workflow-each-init bug.
-  if (isFrameworkRepo(repoRoot)) {
+  // Even with --ci: if the repo root IS the appwrap framework itself (in-repo example), DON'T scaffold
+  // consumer workflows into the framework's .github — that's the stray-workflow-each-init bug.
+  const scaffoldWorkflows = withWorkflows && !isFrameworkRepo(repoRoot);
+  if (withWorkflows && !scaffoldWorkflows) {
     console.log('  ci   ← GH Actions scaffold skipped (inside the appwrap framework repo — manages its own CI)');
-  } else {
+  } else if (scaffoldWorkflows) {
     targets.unshift([join(CI_TEMPLATE_DIR, 'github/workflows'), join(repoRoot, '.github/workflows'), false]);
   }
   for (const [from, to, overwrite] of targets) {
@@ -1439,7 +1442,7 @@ function copyCiTemplates(cwd: string, outDir: string, cfg: AppwrapConfig, force
   // Pin the emitted workflow's `bunx @livx.cc/appwrap@^x.y.z` to THIS CLI's version floor, so a CI run
   // using a freshly-emitted workflow can't silently resolve an older published build that lacks the
   // `init`/`release` commands (it would 404 loudly instead). Idempotent: re-init finds no placeholder.
-  if (!isFrameworkRepo(repoRoot)) {
+  if (scaffoldWorkflows) {
     const wf = join(repoRoot, '.github/workflows/appwrap-release-ios.yml');
     if (existsSync(wf)) writeFileSync(wf, readFileSync(wf, 'utf8').replaceAll('__APPWRAP_VERSION__', CLI_VERSION));
   }
@@ -1454,9 +1457,9 @@ function copyCiTemplates(cwd: string, outDir: string, cfg: AppwrapConfig, force
       .replaceAll('__TEAM_ID__', cfg.teamId ?? '');
     writeFileSync(p, stamped);
   }
-  const ci = isFrameworkRepo(repoRoot)
-    ? '  ci   ← fastlane (native/fastlane, signing stamped) — see secrets contract in workflow headers'
-    : '  ci   ← GH Actions (.github/workflows) + fastlane (native/fastlane, signing stamped) — see secrets contract in workflow headers';
+  const ci = scaffoldWorkflows
+    ? '  ci   ← GH Actions (.github/workflows) + fastlane (native/fastlane, signing stamped) — see secrets contract in workflow headers'
+    : '  ci   ← fastlane (native/fastlane, signing stamped) — GH Actions workflows are opt-in: `appwrap init --ci`';
   console.log(ci);
 }
 
@@ -1577,7 +1580,7 @@ async function init(cwd: string, flags: Record<string, string>): Promise<void> {
   console.log(`🎁 appwrap init → ${outDir}`);
   mkdirSync(outDir, { recursive: true });
   regenerateCore(cwd, outDir, cfg, { firstRun: true, flags });
-  copyCiTemplates(cwd, outDir, cfg, 'force' in flags); // GH workflows: first-time only; fastlane lane: re-emit on --force
+  copyCiTemplates(cwd, outDir, cfg, 'force' in flags, 'ci' in flags); // GH workflows: opt-in (--ci), first-time only; fastlane lane: re-emit on --force
   writeFileSync(join(outDir, '.gitignore'), 'node_modules/\nplatforms/\nhooks/\n');
   applyOverrides(cwd, outDir, cfg); // escape hatch — last, so custom native code wins
   stampManualSigning(outDir, cfg, { configPath: resolveConfigPath(cwd, flags) }); // AFTER overrides: a consumer's extension.json / build.xcconfig would otherwise clobber the signing stamp