@livx.cc/appwrap 0.49.0 → 0.50.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livx.cc/appwrap",
-  "version": "0.49.0",
+  "version": "0.50.0",
   "description": "Wrap any PWA into a native app with native capabilities (appwrap runtime + @livx.cc/native-kit).",
   "license": "MIT",
   "author": "Elya Livshitz",

package/runtime/app/shell/custom-webview.android.ts

@@ -4,13 +4,7 @@ import { mimeFor } from './mime';
 import { APPWRAP_GLOBALS_JS, NATIVE_FEEL_JS, serviceWorkerGuardJs, externalNavGuardJs } from './web-quirks';
 import { envGlobalsJs } from './env';
 import { requestPermissions } from './android-helpers';
-
-/** Host[:port] of a URL, lowercased; '' if unparseable (scheme/path/userinfo stripped). */
-function hostOfUrl(url: string): string {
-  const afterScheme = String(url || '').replace(/^[a-z][a-z0-9+.-]*:\/\//i, '');
-  const authority = afterScheme.split(/[/?#]/)[0];
-  return (authority.split('@').pop() || authority).toLowerCase();
-}
+import { hostOf } from './env-switcher';
 
 // `android` + `java` resolve to the real types-android namespaces (no declare needed).
 declare const androidx: any; // no NS types: androidx.webkit.* (WebViewFeature/WebViewCompat) not in the android-32 platform typings
@@ -404,8 +398,11 @@ function createAssetServingClient(): android.webkit.WebViewClient {
     ): void {
       // BUILD-TIME serverUrl host ONLY — never the switchable `effectiveServerUrl()` override (would let a
       // switched host's self-signed cert be trusted → MITM). The dev server is always the build-time URL.
-      const allowedHost = hostOfUrl(SHELL_CONFIG.serverUrl);
-      const errHost = hostOfUrl(String(error?.getUrl?.() ?? ''));
+      // Host WITHOUT port, mirroring the iOS DevCertNavDelegate (a dev server on :3000 and its HMR sub-
+      // resources on an alt port share one self-signed cert) — same `hostOf` normalization + port strip.
+      const stripPort = (h: string) => h.replace(/:\d+$/, '');
+      const allowedHost = stripPort(hostOf(SHELL_CONFIG.serverUrl));
+      const errHost = stripPort(hostOf(String(error?.getUrl?.() ?? '')));
       if (SHELL_CONFIG.debug && SHELL_CONFIG.loader === 'server' && !!allowedHost && errHost === allowedHost) {
         console.warn('AppWrap: trusting self-signed dev-server cert (debug + host-scoped):', errHost);
         handler.proceed();

package/runtime/app/shell/env-banner.ts

@@ -24,6 +24,7 @@ let iosPanRecognizer: any = null; // read inside the (no-arg) pan handler to avo
 
 // Android refs.
 let androidView: android.widget.TextView | null = null;
+let androidDraggedPos: { x: number; y: number } | null = null; // parked translation (mirror of iosDraggedCenter)
 
 /** Show the banner if the switcher is enabled AND a NON-DEFAULT override is active. Idempotent. No-op
  * otherwise (incl. when the override resolves to the build-time default host). */
@@ -61,6 +62,7 @@ export function hideEnvBanner(): void {
  */
 export function resetEnvBannerPosition(): void {
   iosDraggedCenter = null;
+  androidDraggedPos = null;
   if (isIOS) { if (iosContainer) render(); }
   else if (isAndroid) { if (androidView) render(); }
 }
@@ -207,19 +209,68 @@ function showAndroidBanner(): void {
   bg.setColor(android.graphics.Color.argb(235, 184, 115, 5)); // amber
   bg.setCornerRadius(15 * density);
   tv.setBackground(bg);
+  // Tap semantics (via performClick from the touch listener below): pill → expand; expanded → switch menu.
   tv.setOnClickListener(new android.view.View.OnClickListener({ onClick() { onTap(); } }));
 
+  // Drag ANYWHERE via translationX/Y (mirror of the iOS pan — no clamp; recall via shake →
+  // resetEnvBannerPosition). Consume the gesture stream (return true on DOWN) so we get MOVE/UP; on a
+  // no-move UP, performClick() routes to the tap handler above (preserves tap + a11y). The parked
+  // translation is remembered in androidDraggedPos so re-renders don't snap it home.
+  const slop = android.view.ViewConfiguration.get(activity).getScaledTouchSlop();
+  let downX = 0, downY = 0, startTX = 0, startTY = 0, moved = false;
+  tv.setOnTouchListener(new android.view.View.OnTouchListener({
+    onTouch(v: android.view.View, event: android.view.MotionEvent): boolean {
+      switch (event.getActionMasked()) {
+        case android.view.MotionEvent.ACTION_DOWN:
+          downX = event.getRawX(); downY = event.getRawY();
+          startTX = v.getTranslationX(); startTY = v.getTranslationY();
+          moved = false;
+          return true;
+        case android.view.MotionEvent.ACTION_MOVE: {
+          const dx = event.getRawX() - downX, dy = event.getRawY() - downY;
+          if (Math.abs(dx) > slop || Math.abs(dy) > slop) moved = true;
+          v.setTranslationX(startTX + dx);
+          v.setTranslationY(startTY + dy);
+          return true;
+        }
+        case android.view.MotionEvent.ACTION_UP:
+          if (moved) androidDraggedPos = { x: v.getTranslationX(), y: v.getTranslationY() };
+          else v.performClick();
+          return true;
+        default:
+          return false;
+      }
+    },
+  }));
+
   const lp = new android.widget.FrameLayout.LayoutParams(-2, -2); // WRAP_CONTENT × WRAP_CONTENT
   lp.gravity = android.view.Gravity.BOTTOM | android.view.Gravity.CENTER_HORIZONTAL;
-  lp.bottomMargin = Math.round(10 * density);
+  // Raise above the gesture/nav area (mirror of the iOS home-indicator raise), respecting insets where
+  // available so the default pill never sits under the system nav bar (best-effort — falls back cleanly).
+  lp.bottomMargin = androidBottomInsetPx(activity) + Math.round(16 * density);
   activity.addContentView(tv, lp);
   androidView = tv;
   renderAndroid();
   armShrink();
 }
 
+/** Bottom system-inset (gesture/nav bar) in px; 0 best-effort if unavailable. */
+function androidBottomInsetPx(activity: android.app.Activity): number {
+  try {
+    const wi = activity.getWindow().getDecorView().getRootWindowInsets();
+    if (wi) return wi.getSystemWindowInsetBottom();
+  } catch (e) { /* pre-attach / older API — fall back to the base margin */ }
+  return 0;
+}
+
 function renderAndroid(): void {
-  if (androidView) androidView.setText(bannerText());
+  const tv = androidView;
+  if (!tv) return;
+  tv.setText(bannerText());
+  tv.setAlpha(state === 'pill' ? 0.6 : 1.0); // shrunk pill is semi-transparent but still readable
+  // Re-apply the parked translation (or default home) so a re-render doesn't snap a dragged pill back.
+  tv.setTranslationX(androidDraggedPos ? androidDraggedPos.x : 0);
+  tv.setTranslationY(androidDraggedPos ? androidDraggedPos.y : 0);
 }
 
 function hideAndroidBanner(): void {

package/runtime/app/shell/env-switcher.ts

@@ -143,6 +143,72 @@ export async function showEnvSwitcher(): Promise<void> {
   }
 }
 
+// ── Deep-link entry (`<scheme>://env?url=<encoded-url>`) ──────────────────────────────────────────
+// A PR-preview link can be SHARED and auto-open the app on that env. Same security model as "Other":
+// the decoded target must pass `isUrlAllowed` (anchored allowPattern, default-deny) and a confirm
+// prompt, then applies via the EXACT SAME `applySwitch` path as a manual switch. events.ts owns the
+// WebView-ready timing (warm: now; cold launch: buffered, replayed after the PWA handshake).
+
+export type EnvDeepLinkDecision =
+  | { action: 'switch'; url: string }
+  | { action: 'rejected'; url: string }
+  | { action: 'ignored' };
+
+/** Decode the `url` query param from a `<scheme>://env?url=<encoded>` link. Null if absent/undecodable. */
+function parseEnvTargetUrl(link: string): string | null {
+  const q = String(link || '').indexOf('?');
+  if (q < 0) return null;
+  for (const part of link.slice(q + 1).split('&')) {
+    const eq = part.indexOf('=');
+    if ((eq < 0 ? part : part.slice(0, eq)) !== 'url') continue;
+    try {
+      const decoded = decodeURIComponent((eq < 0 ? '' : part.slice(eq + 1)).replace(/\+/g, '%20')).trim();
+      return decoded || null;
+    } catch {
+      return null; // malformed percent-encoding
+    }
+  }
+  return null;
+}
+
+/** Structurally an env-switch deep link (`<scheme>://env…`) AND the switcher is enabled — the signal
+ * events.ts uses to CONSUME the link (never forward an env link to the PWA). Inert (false) when the
+ * feature is disabled/absent, so such a link simply falls through to the normal PWA deep-link path. */
+export function isEnvDeepLink(link: string): boolean {
+  return isEnvSwitcherEnabled() && hostOf(link) === 'env';
+}
+
+/**
+ * PURE decision for an inbound `<scheme>://env?url=…` deep link — no dialogs, no side effects (unit-
+ * testable, mirrors env-switcher-security.test.ts). SECURITY: the decoded target MUST pass the SAME
+ * `isUrlAllowed` gate as the "Other" custom URL (anchored allowPattern, default-deny). Disabled feature
+ * / non-env link / malformed (no decodable `url`) → `ignored` (silently dropped); target present but not
+ * allowlisted → `rejected` (NEVER switch); allowlisted → `switch`.
+ */
+export function decideEnvDeepLink(link: string): EnvDeepLinkDecision {
+  if (!isEnvSwitcherEnabled() || hostOf(link) !== 'env') return { action: 'ignored' };
+  const target = parseEnvTargetUrl(link);
+  if (!target) return { action: 'ignored' };
+  if (!isUrlAllowed(target)) return { action: 'rejected', url: target };
+  return { action: 'switch', url: target };
+}
+
+/**
+ * Handle an env-switch deep link end-to-end: confirm + apply via the SAME `applySwitch` path as a manual
+ * switch (persist override → reload the WebView → refresh the banner, incl. the host-equals-default →
+ * RESET semantics). A disallowed target shows a brief alert and NEVER switches; a malformed/disabled link
+ * is ignored silently. Callers gate the WebView-ready timing (warm now / cold at handshake).
+ */
+export async function handleEnvDeepLink(link: string): Promise<void> {
+  const decision = decideEnvDeepLink(link);
+  if (decision.action === 'switch') {
+    const preset = (SHELL_CONFIG.envSwitcher?.envs ?? []).find((e) => e.url === decision.url);
+    await applySwitch(decision.url, preset ? preset.label : 'Shared link');
+  } else if (decision.action === 'rejected') {
+    await Dialogs.alert({ title: 'Not allowed', message: 'That environment link is not allowed for this app.', okButtonText: 'OK' });
+  }
+}
+
 /** Free-form URL entry, gated by `allowPattern` (default-deny). Rejects a non-matching URL. */
 async function promptOther(): Promise<void> {
   const res = await Dialogs.prompt({

package/runtime/app/shell/events.ts

@@ -2,8 +2,13 @@ import { Application, Connectivity, isAndroid } from '@nativescript/core';
 import type { AndroidActivityNewIntentEventData, OrientationChangedEventData } from '@nativescript/core';
 import { bridge } from './bridge';
 import { connectivityStatus } from './handlers-extended';
+import { isEnvDeepLink, handleEnvDeepLink } from './env-switcher';
 
 let pendingDeepLink: string | null = null;
+// A cold-launch env-switch deep link (`<scheme>://env?url=…`). Buffered like `pendingDeepLink` until the
+// PWA handshake, so the confirm dialog + WebView reload run when the shell is actually ready (not during
+// iOS didFinishLaunching / the Android launch-intent read, when no WebView exists yet).
+let pendingEnvDeepLink: string | null = null;
 let pendingPushTap: { data: Record<string, string> } | null = null;
 let pendingShortcut: string | null = null;
 // True only once the PWA's JS has handshaked — i.e. the WebView is actually
@@ -25,6 +30,14 @@ export function onDeepLink(url: string): void {
   // Give a native consumer (OAuth callback) first refusal — a matched OAuth redirect is internal
   // plumbing, not an app deep link, so it's swallowed here and never forwarded to the PWA.
   if (deepLinkInterceptor?.(url)) return;
+  // Env-switch deep link (config-gated): a shared PR-preview link that re-points the shell. CONSUMED
+  // here — never forwarded to the PWA (it's a shell command, not an app route). The allowlist + confirm
+  // gate lives in handleEnvDeepLink; disabled/absent switcher → isEnvDeepLink is false → normal path.
+  if (isEnvDeepLink(url)) {
+    if (pwaReady) void handleEnvDeepLink(url);
+    else pendingEnvDeepLink = url; // cold launch — replay after the handshake, when the WebView is ready
+    return;
+  }
   if (pwaReady) bridge.emit('deeplink.open', { url });
   else pendingDeepLink = url; // buffer until the PWA handshakes — delivered IN the handshake response
 }
@@ -77,6 +90,12 @@ export function onPwaHandshake(): void {
     pendingShortcut = null;
     setTimeout(() => bridge.emit('app.shortcut', { id }), 500);
   }
+  if (pendingEnvDeepLink) {
+    const link = pendingEnvDeepLink;
+    pendingEnvDeepLink = null;
+    // Small beat so the just-handshaked WebView is fully attached before the confirm/reload.
+    setTimeout(() => void handleEnvDeepLink(link), 500);
+  }
 }
 
 /** Wire lifecycle + connectivity event forwarding (the PWA subscribes to these). */