@livx.cc/appwrap 0.42.3 → 0.43.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livx.cc/appwrap",
-  "version": "0.42.3",
+  "version": "0.43.0",
   "description": "Wrap any PWA into a native app with native capabilities (appwrap runtime + @livx.cc/native-kit).",
   "license": "MIT",
   "author": "Elya Livshitz",
@@ -30,17 +30,19 @@
   "exports": {
     ".": "./src/config.ts",
     "./config": "./src/config.ts",
+    "./handlers": "./src/handlers.ts",
     "./cli": "./src/cli.ts"
   },
   "files": [
     "src",
     "runtime",
+    "runtime-desktop",
     "templates",
     "scripts/stage-assets.mjs"
   ],
   "scripts": {
     "prepack": "node scripts/stage-assets.mjs",
-    "postpack": "rm -rf runtime templates"
+    "postpack": "rm -rf runtime runtime-desktop templates"
   },
   "publishConfig": {
     "access": "public"

package/runtime/app/app.ts

@@ -48,6 +48,21 @@ if (isIOS) {
       onDeepLink(url.absoluteString);
       return true;
     }
+    // Universal links (https://<associated-domain>/...) arrive as a browsing user
+    // activity, NOT via openURL. Without this, tapping an https app link opens Safari
+    // instead of the app. Requires the associated-domains entitlement (iosEntitlements).
+    applicationContinueUserActivityRestorationHandler(
+      _app: UIApplication,
+      userActivity: NSUserActivity,
+      _restorationHandler: (restorableObjects: NSArray<any>) => void
+    ): boolean {
+      if (userActivity.activityType === NSUserActivityTypeBrowsingWeb && userActivity.webpageURL) {
+        console.log('AppWrap: universalLink', userActivity.webpageURL.absoluteString);
+        onDeepLink(userActivity.webpageURL.absoluteString);
+        return true;
+      }
+      return false;
+    }
     // Drives `kit.screen.orientation.lock` — UIKit reads this on every rotation.
     applicationSupportedInterfaceOrientationsForWindow(_app: UIApplication, _window: UIWindow): UIInterfaceOrientationMask {
       // iosOrientationMask() returns the raw bitmask as a number; the protocol types it as the enum.

package/runtime/app/main-page.ts

@@ -116,7 +116,16 @@ export function onPageLoaded(args: EventData): void {
 
   const webView = page.getViewById<CustomWebView>('webview');
   bridge.attach(webView);
-  if (isIOS) armNativeSurfaceRecovery(webView); // global freeze-recovery on any native modal dismiss
+  // NOTE: the GLOBAL UIWindowDidBecomeHidden freeze-recovery observer is intentionally NOT armed.
+  // It over-fired: the iOS edit menu / text-selection callout / AutoFill bar present in their own
+  // floating UIWindows, and their normal appear/disappear churn hides a transient window → the observer
+  // ran neutralizeStrayWindows() and DETACHED the just-shown edit-menu window (a plain UIWindow, so no
+  // class filter can distinguish it from a real orphan) → Copy/Paste + AutoFill silently dead on EVERY
+  // text field (device-verified via the [native:recover] log). Freeze recovery still runs via the
+  // explicit per-surface dismiss callbacks (billing/oauth/share/PHPicker/SafariVC → recoverAfterNativeSurface),
+  // which are the proven baseline and only fire for actual native surfaces. Re-add a scoped observer only
+  // if a future surface orphans a window with no dismiss callback — gate it on a "surface presented" flag.
+  void armNativeSurfaceRecovery; // referenced to keep the helper (still callable if a scoped need arises)
   if (isAndroid) wireAndroidSafeArea(webView); // experimental edge-to-edge (no-op unless config on)
   startEventForwarding();
   loadBundle(webView);
@@ -171,7 +180,7 @@ function loadBundle(webView: CustomWebView): void {
         const readAccessURL = NSURL.fileURLWithPathIsDirectory(wwwPath, true);
         wk.loadFileURLAllowingReadAccessToURL(entryURL, readAccessURL);
       } else {
-        const url = NSURL.URLWithString(`app://local/${SHELL_CONFIG.entry}`);
+        const url = NSURL.URLWithString(`app://localhost/${SHELL_CONFIG.entry}`);
         wk.loadRequest(NSURLRequest.requestWithURL(url));
       }
     };

package/runtime/app/shell/custom-webview.android.ts

@@ -31,6 +31,58 @@ function buildBootstrapJs(): string {
   return `${envGlobalsJs()}\n${APPWRAP_GLOBALS_JS}\n${TRANSPORT_SHIM}\n${serviceWorkerGuardJs(SHELL_CONFIG.neutralizeServiceWorker)}\n${externalNavGuardJs(SHELL_CONFIG.openNewWindowsInBrowser)}\n${NATIVE_FEEL_JS}`;
 }
 
+/**
+ * The extended WebChromeClient MUST be generated ONCE. NativeScript caches the Java proxy
+ * class it synthesizes for `extend({...})` keyed by the methods-object shape, so calling
+ * extend() again per-webview REUSES the first invocation's class — including its captured
+ * closure. A per-instance `owner` WeakRef baked into the closure therefore cross-wires every
+ * later webview's prompt() transport to the FIRST instance (device-proven in the feedox
+ * mini-app spike: webview-2's bridge request was answered as webview-1). Route by the native
+ * view the callback is given instead, resolved against a per-view registry.
+ */
+let chromeClientClass: any;
+function getChromeClientClass(): any {
+  if (chromeClientClass) return chromeClientClass;
+  // NS runtime adds `.extend` on Java classes; it's not in the static typings, hence the cast.
+  chromeClientClass = (android.webkit.WebChromeClient as any).extend({
+    onJsPrompt(
+      view: android.webkit.WebView,
+      _url: string,
+      message: string,
+      _defaultValue: string,
+      result: android.webkit.JsPromptResult
+    ): boolean {
+      if (typeof message === 'string' && message.startsWith(PROMPT_PREFIX)) {
+        result.confirm('');
+        CustomWebView.forNative(view)?.onAppwrapMessage?.(message.slice(PROMPT_PREFIX.length));
+        return true;
+      }
+      return false; // genuine page prompt — default handling
+    },
+
+    // getUserMedia: grant the WebView's per-origin capture after ensuring the
+    // app holds the matching OS runtime permission (CAMERA / RECORD_AUDIO).
+    // No instance state — safe on the shared class.
+    onPermissionRequest(request: android.webkit.PermissionRequest): void {
+      const PR = android.webkit.PermissionRequest;
+      const resources: string[] = Array.from(request.getResources());
+      const perms = new Set<string>();
+      for (const r of resources) {
+        if (r === PR.RESOURCE_VIDEO_CAPTURE) perms.add('android.permission.CAMERA');
+        if (r === PR.RESOURCE_AUDIO_CAPTURE) perms.add('android.permission.RECORD_AUDIO');
+      }
+      if (!perms.size) {
+        Utils.dispatchToMainThread(() => request.grant(request.getResources()));
+        return;
+      }
+      requestPermissions(Array.from(perms)).then((ok) =>
+        Utils.dispatchToMainThread(() => (ok ? request.grant(request.getResources()) : request.deny()))
+      );
+    },
+  });
+  return chromeClientClass;
+}
+
 /**
  * Android CustomWebView — replaces NS's default clients after creation:
  * WebChromeClient.onJsPrompt is the appwrap transport, WebViewClient
@@ -41,6 +93,18 @@ export class CustomWebView extends WebView {
   /** Set by the bridge before load; receives raw envelope JSON. */
   onAppwrapMessage: ((json: string) => void) | null = null;
 
+  // Native-view → owning CustomWebView, keyed by the Java identity hash (stable per native
+  // object, robust to NS re-wrapping the arg passed into the ChromeClient callback). WeakRef
+  // so a destroyed view can be GC'd; entry pruned on dispose.
+  private static registry = new Map<number, WeakRef<CustomWebView>>();
+  static forNative(view: android.webkit.WebView): CustomWebView | undefined {
+    const owner = CustomWebView.registry.get(view.hashCode())?.deref();
+    // identityHashCode is not unique: on a (rare) collision the map holds the LAST writer —
+    // re-check native identity so a colliding view drops rather than cross-wires.
+    if (owner && owner.android !== view) return undefined;
+    return owner;
+  }
+
   initNativeView(): void {
     super.initNativeView();
     // NS core types the `.android` getter as `any`; narrow to the real WebView for this scope.
@@ -68,7 +132,15 @@ export class CustomWebView extends WebView {
 
     this.installDocumentStartShim(wv);
     wv.setWebViewClient(createAssetServingClient());
-    wv.setWebChromeClient(this.createTransportChromeClient());
+    // Bind THIS native view to THIS instance before wiring the (shared, extend-once) client.
+    CustomWebView.registry.set(wv.hashCode(), new WeakRef<CustomWebView>(this));
+    wv.setWebChromeClient(new (getChromeClientClass())());
+  }
+
+  disposeNativeView(): void {
+    const wv = this.android as android.webkit.WebView | undefined;
+    if (wv) CustomWebView.registry.delete(wv.hashCode());
+    super.disposeNativeView();
   }
 
   /**
@@ -115,52 +187,15 @@ export class CustomWebView extends WebView {
       console.warn('AppWrap: addDocumentStartJavaScript failed', e);
     }
   }
-
-  private createTransportChromeClient(): android.webkit.WebChromeClient {
-    const owner = new WeakRef<CustomWebView>(this);
-    // NS runtime adds `.extend` on Java classes; it's not in the static typings, hence the cast.
-    const ChromeClient = (android.webkit.WebChromeClient as any).extend({
-      onJsPrompt(
-        _view: android.webkit.WebView,
-        _url: string,
-        message: string,
-        _defaultValue: string,
-        result: android.webkit.JsPromptResult
-      ): boolean {
-        if (typeof message === 'string' && message.startsWith(PROMPT_PREFIX)) {
-          result.confirm('');
-          const view = owner.get ? owner.get() : (owner as { deref(): CustomWebView }).deref();
-          view?.onAppwrapMessage?.(message.slice(PROMPT_PREFIX.length));
-          return true;
-        }
-        return false; // genuine page prompt — default handling
-      },
-
-      // getUserMedia: grant the WebView's per-origin capture after ensuring the
-      // app holds the matching OS runtime permission (CAMERA / RECORD_AUDIO).
-      onPermissionRequest(request: android.webkit.PermissionRequest): void {
-        const PR = android.webkit.PermissionRequest;
-        const resources: string[] = Array.from(request.getResources());
-        const perms = new Set<string>();
-        for (const r of resources) {
-          if (r === PR.RESOURCE_VIDEO_CAPTURE) perms.add('android.permission.CAMERA');
-          if (r === PR.RESOURCE_AUDIO_CAPTURE) perms.add('android.permission.RECORD_AUDIO');
-        }
-        if (!perms.size) {
-          Utils.dispatchToMainThread(() => request.grant(request.getResources()));
-          return;
-        }
-        requestPermissions(Array.from(perms)).then((ok) =>
-          Utils.dispatchToMainThread(() => (ok ? request.grant(request.getResources()) : request.deny()))
-        );
-      },
-    });
-    return new ChromeClient();
-  }
 }
 
-/** https://appwrap.local/<path> → file under www/; SPA fallback to the entry for extension-less misses. */
+/** https://appwrap.local/<path> → file under www/; SPA fallback to the entry for extension-less misses.
+ * Extend-once (same NS shape-caching pitfall as the ChromeClient above): the closure here is
+ * process-constant, but generating the class per webview would silently pin the FIRST call's
+ * closure anyway — build it once and reuse. */
+let assetClientClass: any;
 function createAssetServingClient(): android.webkit.WebViewClient {
+  if (assetClientClass) return new assetClientClass();
   const wwwPath = nsPath.join(knownFolders.currentApp().path, 'www');
 
   const respond = (filePath: string, ext: string): android.webkit.WebResourceResponse => {
@@ -246,7 +281,7 @@ function createAssetServingClient(): android.webkit.WebViewClient {
   };
 
   // NS runtime adds `.extend` on Java classes; it's not in the static typings, hence the cast.
-  const Client = (android.webkit.WebViewClient as any).extend({
+  assetClientClass = (android.webkit.WebViewClient as any).extend({
     // Modern (API 21+) overload passes a WebResourceRequest; the legacy overload passed a string URL.
     // We defensively handle both, so the param is the union.
     shouldInterceptRequest(
@@ -305,5 +340,5 @@ function createAssetServingClient(): android.webkit.WebViewClient {
       }
     },
   });
-  return new Client();
+  return new assetClientClass();
 }

package/runtime/app/shell/custom-webview.ios.ts

@@ -1,7 +1,7 @@
 import { WebView, knownFolders, path as nsPath, File } from '@nativescript/core';
 import { SHELL_CONFIG } from './config';
 import { mimeFor } from './mime';
-import { APPWRAP_GLOBALS_JS, NATIVE_FEEL_JS, mediaCaptureGuardJs, serviceWorkerGuardJs, externalNavGuardJs } from './web-quirks';
+import { APPWRAP_GLOBALS_JS, NATIVE_FEEL_JS, capabilityGuardJs, serviceWorkerGuardJs, externalNavGuardJs } from './web-quirks';
 import { envGlobalsJs } from './env';
 import { createUiDelegate } from './ios-ui-delegate';
 import { appwrapNativeLog } from './native-log';
@@ -157,7 +157,7 @@ export class CustomWebView extends WebView {
       for (let j = 0; j < windows.count; j++) {
         const w = windows.objectAtIndex(j);
         if (main && w !== main && w.windowLevel > 0 && !w.hidden) {
-          if (dbg) appendWebLog(`[native:recover] stray win[${j}] lvl=${w.windowLevel} uie=${w.userInteractionEnabled} key=${w.keyWindow}`);
+          if (dbg) appendWebLog(`[native:recover] stray win[${j}] ${NSStringFromClass(w.class())} lvl=${w.windowLevel} uie=${w.userInteractionEnabled} key=${w.keyWindow}`);
           w.userInteractionEnabled = false;
           w.hidden = true;
           w.windowScene = null; // detach from the scene — strongest removal
@@ -179,21 +179,31 @@ export class CustomWebView extends WebView {
     config.allowsInlineMediaPlayback = true;
     config.allowsPictureInPictureMediaPlayback = true;
     config.mediaTypesRequiringUserActionForPlayback = 0; // WKAudiovisualMediaTypeNone
+    // Element Fullscreen API (iOS 15.4+): the JS Fullscreen API on arbitrary elements is gated behind
+    // this preference (native <video> fullscreen works without it). respondsToSelector-guarded so it's a
+    // no-op on older iOS (mirrors the setInspectable: probe below).
+    if (config.preferences.respondsToSelector('setElementFullscreenEnabled:')) {
+      (config.preferences as WKPreferences & { elementFullscreenEnabled: boolean }).elementFullscreenEnabled = true;
+    }
     config.websiteDataStore = WKWebsiteDataStore.defaultDataStore();
     // Apple's hard requirement for a service worker in a WKWebView: restrict navigation to the
     // declared app-bound domains (also stamped to Info.plist WKAppBoundDomains). Only set when
     // configured — otherwise the WebView stays unrestricted (default behavior).
     if (SHELL_CONFIG.appBoundDomains?.length) config.limitsNavigationsToAppBoundDomains = true;
 
-    // Env hints + framework globals (backend origin) + a getUserMedia guard for UNDECLARED capabilities
-    // (must reject in JS before WebKit's native capture path — see mediaCaptureGuardJs) + native-feel
-    // suppression, all injected before the page's own scripts run. Globals first so the page can read
-    // __APPWRAP__ / __APPWRAP_BACKEND_ORIGIN__.
+    // Env hints + framework globals (backend origin) + the TCC capability guard for UNDECLARED web APIs
+    // (reject camera/mic/geolocation in JS before WebKit's native path — see capabilityGuardJs) +
+    // native-feel suppression, all injected before the page's own scripts run. Globals first so the page
+    // can read __APPWRAP__ / __APPWRAP_BACKEND_ORIGIN__.
     const hasPlistKey = (k: string) => !!NSBundle.mainBundle.objectForInfoDictionaryKey(k);
-    const mediaGuard = mediaCaptureGuardJs(hasPlistKey('NSCameraUsageDescription'), hasPlistKey('NSMicrophoneUsageDescription'));
+    const capabilityGuard = capabilityGuardJs({
+      camera: hasPlistKey('NSCameraUsageDescription'),
+      microphone: hasPlistKey('NSMicrophoneUsageDescription'),
+      geolocation: hasPlistKey('NSLocationWhenInUseUsageDescription'),
+    });
     const swGuard = serviceWorkerGuardJs(SHELL_CONFIG.neutralizeServiceWorker);
     const extNavGuard = externalNavGuardJs(SHELL_CONFIG.openNewWindowsInBrowser);
-    for (const src of [envGlobalsJs(), APPWRAP_GLOBALS_JS, mediaGuard, swGuard, extNavGuard, NATIVE_FEEL_JS]) {
+    for (const src of [envGlobalsJs(), APPWRAP_GLOBALS_JS, capabilityGuard, swGuard, extNavGuard, NATIVE_FEEL_JS]) {
       const script = WKUserScript.alloc().initWithSourceInjectionTimeForMainFrameOnly(
         src,
         WKUserScriptInjectionTime.AtDocumentStart,

package/runtime/app/shell/handlers-android.ts

@@ -97,18 +97,36 @@ export function registerAndroidHandlers(): void {
     }
   });
 
+  // NS caches the Java proxy class synthesized by .extend({...}) by the methods-object SHAPE, so
+  // re-extending per call would permanently bake in the FIRST call's resolve/reject closure — every
+  // later authenticate would settle the first (already-settled) promise and hang its own. Extend once
+  // and route through a mutable slot (only one biometric prompt can be active at a time).
+  let biometricCallbackClass: any;
+  let biometricPending: { resolve: (v: unknown) => void; reject: (e: unknown) => void } | null = null;
+  const getBiometricCallbackClass = () => {
+    if (biometricCallbackClass) return biometricCallbackClass;
+    biometricCallbackClass = (androidx.biometric.BiometricPrompt.AuthenticationCallback as any).extend({
+      onAuthenticationSucceeded(_result: any) {
+        biometricPending?.resolve({ success: true });
+        biometricPending = null;
+      },
+      onAuthenticationError(_code: number, message: any) {
+        biometricPending?.reject(err('DENIED', String(message ?? 'authentication error')));
+        biometricPending = null;
+      },
+    });
+    return biometricCallbackClass;
+  };
+
   bridge.register('biometrics.authenticate', ({ reason }: { reason?: string }) => {
     return new Promise((resolve, reject) => {
       Utils.dispatchToMainThread(() => {
         try {
           const act = activity(); // NativeScriptActivity extends AppCompatActivity → FragmentActivity
           const executor = androidx.core.content.ContextCompat.getMainExecutor(act);
-          const Callback = (androidx.biometric.BiometricPrompt.AuthenticationCallback as any).extend({
-            onAuthenticationSucceeded(_result: any) { resolve({ success: true }); },
-            onAuthenticationError(_code: number, message: any) {
-              reject(err('DENIED', String(message ?? 'authentication error')));
-            },
-          });
+          biometricPending?.reject(err('DENIED', 'superseded by a new biometric prompt'));
+          biometricPending = { resolve, reject };
+          const Callback = getBiometricCallbackClass();
           const prompt = new androidx.biometric.BiometricPrompt(act, executor, new Callback());
           const info = new androidx.biometric.BiometricPrompt.PromptInfo.Builder()
             .setTitle(String(reason ?? 'Authenticate'))
@@ -117,6 +135,7 @@ export function registerAndroidHandlers(): void {
             .build();
           prompt.authenticate(info);
         } catch (e: any) {
+          if (biometricPending?.reject === reject) biometricPending = null;
           reject(err('UNSUPPORTED', e?.message ?? String(e)));
         }
       });

package/runtime/app/shell/handlers-background.ts

@@ -102,7 +102,7 @@ function loadAppInto(webView: CustomWebView, id: string, attempt = 0): void {
     if (SHELL_CONFIG.loader === 'server' && SHELL_CONFIG.serverUrl) {
       wk.loadRequest(NSURLRequest.requestWithURL(NSURL.URLWithString(SHELL_CONFIG.serverUrl)));
     } else {
-      wk.loadRequest(NSURLRequest.requestWithURL(NSURL.URLWithString(`app://local/${SHELL_CONFIG.entry}`)));
+      wk.loadRequest(NSURLRequest.requestWithURL(NSURL.URLWithString(`app://localhost/${SHELL_CONFIG.entry}`)));
     }
   } else {
     if (retry(!webView.android)) return;

package/runtime/app/shell/web-quirks.ts

@@ -71,6 +71,65 @@ export function mediaCaptureGuardJs(camera: boolean, microphone: boolean): strin
 })();`;
 }
 
+/**
+ * Reject `navigator.geolocation` in JS at document-start when this build did NOT declare location
+ * (no NSLocationWhenInUseUsageDescription). Unlike camera/mic — where an undeclared request is a HARD
+ * TCC process-kill (see mediaCaptureGuardJs) — a WKWebView geolocation request with no usage string
+ * does NOT crash: WebKit's CoreLocation provider silently denies it. But the un-guarded failure mode is
+ * poor (the promise/callback can hang, and some iOS builds surface a confusing WebKit prompt for a
+ * permission the app can never grant). So when location is undeclared we fail FAST and deterministically
+ * — invoke the error callback with PERMISSION_DENIED so the page's own fallback runs immediately. When
+ * location IS declared, we no-op: WebKit + CoreLocation own the real prompt and the API works natively.
+ *
+ * `declared` = presence of NSLocationWhenInUseUsageDescription (the `geo` module). Patches BOTH
+ * getCurrentPosition and watchPosition on the live `navigator.geolocation`. Idempotent via a window guard.
+ */
+export function geolocationGuardJs(declared: boolean): string {
+  if (declared) return '';
+  return `(function(){
+  var geo = navigator.geolocation;
+  if (!geo || window.__appwrapGeoGuard) return;
+  window.__appwrapGeoGuard = true;
+  function deny(_pos, err){
+    if (typeof err === 'function') {
+      // GeolocationPositionError.PERMISSION_DENIED === 1.
+      setTimeout(function(){ try { err({ code: 1, message: 'location not available (capability not enabled for this app)', PERMISSION_DENIED: 1, POSITION_UNAVAILABLE: 2, TIMEOUT: 3 }); } catch (e) {} }, 0);
+    }
+  }
+  geo.getCurrentPosition = function(_ok, err){ deny(_ok, err); };
+  geo.watchPosition = function(_ok, err){ deny(_ok, err); return 0; };
+  geo.clearWatch = function(){};
+})();`;
+}
+
+/** A snapshot of which TCC-gated capabilities THIS build declared (Info.plist usage strings present),
+ * derived by the shell from `NSBundle.mainBundle.objectForInfoDictionaryKey`. Drives capabilityGuardJs. */
+export interface DeclaredCaps {
+  /** NSCameraUsageDescription present. */
+  camera: boolean;
+  /** NSMicrophoneUsageDescription present. */
+  microphone: boolean;
+  /** NSLocationWhenInUseUsageDescription present (the `geo` module). */
+  geolocation: boolean;
+}
+
+/**
+ * The single crash-proofing / graceful-degradation guard for ALL JS-reachable, TCC-gated web APIs in a
+ * WKWebView, injected at document-start. Takes the build's declared-capability snapshot and, for every
+ * capability the build did NOT declare, prevents the app-killing (camera/mic) or hanging (geolocation)
+ * failure while letting DECLARED capabilities pass straight through to their native prompt. Composes the
+ * individual guards so every consumer's foreign webview (shell + feedox mini-app views) is covered from
+ * one call site. Other TCC-gated surfaces (getDisplayMedia, SpeechRecognition, WebMIDI/BT/NFC/USB) are
+ * simply UNIMPLEMENTED by WKWebView — they resolve to `undefined`, so feature-detection degrades cleanly
+ * and there is nothing to guard.
+ */
+export function capabilityGuardJs(declared: DeclaredCaps): string {
+  return [
+    mediaCaptureGuardJs(declared.camera, declared.microphone),
+    geolocationGuardJs(declared.geolocation),
+  ].filter(Boolean).join('\n');
+}
+
 /**
  * Neutralize `navigator.serviceWorker.register` inside the native shell at document-start, so a
  * consumer PWA doesn't have to hand-gate its own SW. Inside the shell a service worker is at best
@@ -195,6 +254,10 @@ const NATIVE_FEEL_CSS = [
   // touch-callout:none suppresses long-press menus, but on inputs/textareas/contenteditable that also
   // kills the iOS Copy/Paste callout — so exclude editable fields (same set as the user-select rule).
   ':where(:not(input,textarea,[contenteditable],[contenteditable] *)){-webkit-touch-callout:none;-webkit-user-select:none;user-select:none}',
+  // Both -webkit-touch-callout and user-select INHERIT, so a :not(input) exclusion isn't enough — the
+  // field still inherits `none` from body/form and loses its paste callout + AutoFill selection. Must
+  // EXPLICITLY re-enable editable fields (not merely exempt them).
+  'input,textarea,[contenteditable],[contenteditable] *{-webkit-touch-callout:default;-webkit-user-select:text;user-select:text}',
 ].join('');
 
 /** Accessibility-standard reduced-motion reset — collapse animation/transition durations to ~0 and

package/runtime/webpack.config.js

@@ -14,6 +14,26 @@ module.exports = (env) => {
   webpack.init(env);
 
   webpack.chainWebpack((config) => {
+    // node:-scheme imports: pure-JS deps (e.g. @noble/hashes) conditionally probe Node builtins via
+    // the `node:` scheme, which webpack cannot even READ ("UnhandledSchemeError: Reading from
+    // 'node:crypto' is not handled by plugins") — the whole NS build fails. Strip the scheme so the
+    // request becomes a bare builtin name…
+    const { NormalModuleReplacementPlugin } = require('webpack');
+    config.plugin('AppwrapStripNodeScheme').use(NormalModuleReplacementPlugin, [
+      /^node:/,
+      (resource) => {
+        resource.request = resource.request.replace(/^node:/, '');
+      },
+    ]);
+    // …then stub every Node builtin the NS runtime doesn't have to an empty module (fallback: false),
+    // so conditional probes resolve gracefully instead of "Module not found". `module` is excluded:
+    // @nativescript/webpack maps it to its own polyfill and that must keep winning.
+    config.resolve.merge({
+      fallback: Object.fromEntries(
+        require('module').builtinModules.filter((m) => m !== 'module').map((m) => [m, false])
+      ),
+    });
+
     // Ship the PWA bundle inside the app package
     config.plugin('CopyWww').use(CopyWebpackPlugin, [
       {

package/runtime-desktop/autotest/index.html

@@ -0,0 +1,77 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>appwrap desktop autotest</title>
+<body style="font-family:monospace;background:#111;color:#0f0"><pre id="log">autotest</pre>
+<canvas id="cv" width="800" height="600"></canvas>
+<script>
+const logEl = document.getElementById('log');
+const say = (m) => { logEl.textContent += '\n' + m; };
+// Phase markers travel over the real bridge so they interleave with [bridge] eprintln
+// lines next to the watchdog's memory samples. UNSUPPORTED responses are irrelevant.
+const mark = (name) => window.appwrapNative?.postMessage(JSON.stringify({ v: 1, id: 'ph-' + name, kind: 'request', method: 'phase.' + name, params: null }));
+window.__appwrapDeliver = () => {}; // swallow responses
+
+const cleanups = [];
+const phases = [
+  ['idle', () => {}],
+  ['motion-listeners', () => {
+    const h1 = () => {}; const h2 = () => {};
+    window.addEventListener('devicemotion', h1);
+    window.addEventListener('deviceorientation', h2);
+    cleanups.push(() => { window.removeEventListener('devicemotion', h1); window.removeEventListener('deviceorientation', h2); });
+  }],
+  ['raf-canvas', () => {
+    const ctx = document.getElementById('cv').getContext('2d');
+    let run = true, t = 0;
+    const loop = () => { if (!run) return; t++; ctx.fillStyle = `hsl(${t % 360},80%,50%)`; ctx.fillRect(0, 0, 800, 600); ctx.getImageData(0, 0, 100, 100); requestAnimationFrame(loop); };
+    loop();
+    cleanups.push(() => { run = false; });
+  }],
+  ['speech-tts', () => {
+    let run = true;
+    const speak = () => { if (!run) return; const u = new SpeechSynthesisUtterance('test'); u.volume = 0; u.onend = speak; speechSynthesis.speak(u); };
+    speak();
+    cleanups.push(() => { run = false; speechSynthesis.cancel(); });
+  }],
+  ['geo-watch', () => {
+    if (!navigator.geolocation) return say('no geolocation');
+    const id = navigator.geolocation.watchPosition(() => {}, () => {}, { enableHighAccuracy: true });
+    cleanups.push(() => navigator.geolocation.clearWatch(id));
+  }],
+  ['bridge-storage-spam', () => {
+    let run = true, i = 0;
+    const big = 'x'.repeat(100_000);
+    const tick = () => {
+      if (!run) return;
+      for (let j = 0; j < 20; j++) window.appwrapNative.postMessage(JSON.stringify({ v: 1, id: 's' + (++i), kind: 'request', method: 'storage.set', params: { key: 'k' + (i % 50), value: big } }));
+      setTimeout(tick, 100);
+    };
+    tick();
+    cleanups.push(() => { run = false; });
+  }],
+  ['toast-spam', () => {
+    let run = true, i = 0;
+    const tick = () => { if (!run || i > 40) return; i++; window.appwrapNative.postMessage(JSON.stringify({ v: 1, id: 't' + i, kind: 'request', method: 'toast.show', params: { message: 'spam ' + i } })); setTimeout(tick, 500); };
+    tick();
+    cleanups.push(() => { run = false; });
+  }],
+  ['getusermedia', () => {
+    navigator.mediaDevices?.getUserMedia({ video: true, audio: true })
+      .then((s) => { say('gum ok'); cleanups.push(() => s.getTracks().forEach((t) => t.stop())); })
+      .catch((e) => say('gum err ' + e.name));
+  }],
+  ['idle-end', () => {}],
+];
+
+let idx = 0;
+const next = () => {
+  while (cleanups.length) { try { cleanups.pop()(); } catch {} }
+  if (idx >= phases.length) { mark('DONE'); say('DONE'); return; }
+  const [name, fn] = phases[idx++];
+  mark(name); say('phase: ' + name);
+  try { fn(); } catch (e) { say('threw: ' + e.message); }
+  setTimeout(next, 30_000);
+};
+next();
+</script>
+</body>