catalyst-core 0.1.0-canary.7 → 0.1.0-canary.9

package/README.md

@@ -7,8 +7,8 @@
 
 ## Table of Contents
 
--   Overview
--   Installation
+- Overview
+- Installation
 
 ## Overview
 
@@ -20,8 +20,8 @@ This version adds support for Universal app for both Android and iOS. Please che
 
 **System Requirements**
 
--   Node version 20.4.0 or later
--   Compatible with **macOS** and **Linux**
+- Node version 20.4.0 or later
+- Compatible with **macOS** and **Linux**
 
 **Automatic Installation**
 

package/changelog.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## [0.1.0-beta.2] - 2026-05-06
+
+- Moved Catalyst into a monorepo structure with `catalyst-core`, `create-catalyst-app`, the Catalyst docs app, and the Catalyst core test app managed from one repository.
+- Replaced the internal-package pre-release flow with a local release sandbox that scaffolds a real app using current-branch CCA and a locally packed current-branch `catalyst-core`.
+
+## [0.1.0-beta.1] - 2026-04-15
+
+- Promoted `0.1.0-canary.7` to the first proper beta release after stabilization.
+- No code changes from `0.1.0-canary.7`; this release marks the same build as production-ready beta.
+
+## [0.1.0-canary.7] - 2026-03-31
+
+- Introduced Catalyst MCP v2 with a new setup flow, database schema, knowledge base, and source-aware migration tooling for stronger project guidance and conversion workflows.
+- Expanded MCP/framework knowledge coverage across SEO, observability, webpack, React Compiler, CLI, file conventions, and native hooks, while improving setup and verification messaging across supported MCP clients.
+
+## [0.1.0-canary.6] - 2026-03-09
+
+- Hardened URL whitelisting with thread-safety improvements, broader test coverage, and related iOS build fixes to make access-control behavior more reliable.
+- Improved compatibility and runtime resilience by softening bridge environment mismatch failures and preserving backward compatibility for `useDataProtection` on older native binaries.
+
+## [0.1.0-canary.5] - 2026-02-27
+
+- Strengthened native app security with backup restrictions, screen-capture protection, web data clearing, and related Android/iOS test coverage.
+- Improved universal app runtime behavior with safe-area inset support, edge-to-edge rendering, and notification permission override fixes.
+- Expanded platform support with offline fallback handling, notification/access-control refinements, localhost HTTP allowances for local development, and file-picker/HTTPS server improvements.
+
 ## [0.1.0-canary.4] - 2026-02-12
 
 - Added Google Sign-In support for both Android and iOS in Catalyst, enabling a unified native authentication experience for apps built on the framework.

package/dist/native/androidProject/app/src/main/java/io/yourname/androidproject/BridgeMessageValidator.kt

@@ -62,16 +62,8 @@ object BridgeMessageValidator {
     private const val TAG = "BridgeMessageValidator"
     private const val MAX_MESSAGE_SIZE = 10 * 1024 * 1024 // 10MB (match iOS)
 
-    // Valid commands (should match iOS CatalystConstants.Bridge.validCommands)
-    private val validCommands = setOf(
-        "openCamera",
-        "requestCameraPermission",
-        "pickFile",
-        "requestHapticFeedback",
-        "openFileWithIntent",
-        "getDeviceInfo",
-        "logger"
-    )
+    // Valid commands — single source of truth from CatalystConstants
+    private val validCommands = CatalystConstants.Bridge.VALID_COMMANDS
 
     // MARK: - Schema Definitions (mirror iOS schemas)
 

package/dist/native/androidProject/app/src/test/java/io/yourname/androidproject/SecurityBridgeTest.kt

@@ -0,0 +1,199 @@
+package io.yourname.androidproject
+
+import org.json.JSONObject
+import org.junit.Assert.*
+import org.junit.Test
+
+/**
+ * Unit tests for security bridge command routing and JSON injection safety.
+ *
+ * Coverage:
+ * - setScreenSecure command routing (5 tests)
+ * - getScreenSecure command routing (2 tests)
+ * - clearWebData command routing (2 tests)
+ * - JSON injection safety in error responses (3 tests)
+ *
+ * Total: 12 tests
+ *
+ * Note: These tests operate on static parsing/validation logic and JSON data
+ * structures. Full lifecycle (FLAG_SECURE, CookieManager) is exercised in
+ * device integration tests; here we confirm command acceptance, param parsing,
+ * and that error payloads produced via JSONObject cannot carry injected content.
+ */
+class SecurityBridgeTest {
+
+    // ============================================================
+    // CATEGORY 1: setScreenSecure COMMAND ROUTING (5 tests)
+    // ============================================================
+
+    @Test
+    fun `test setScreenSecure command is accepted by validator`() {
+        val messageJson = """{"command": "setScreenSecure", "data": {"enable": true}}"""
+
+        val result = NativeBridge.parseAndValidateMessage(messageJson)
+
+        assertTrue("setScreenSecure should be a valid command", result.isValid)
+        assertEquals("setScreenSecure", result.command)
+        assertNull(result.error)
+    }
+
+    @Test
+    fun `test setScreenSecure enable true parsed from params`() {
+        val params = JSONObject().apply { put("enable", true) }
+
+        val enable = params.optBoolean("enable", false)
+
+        assertTrue("enable should be true", enable)
+    }
+
+    @Test
+    fun `test setScreenSecure enable false parsed from params`() {
+        val params = JSONObject().apply { put("enable", false) }
+
+        val enable = params.optBoolean("enable", true)
+
+        assertFalse("enable should be false", enable)
+    }
+
+    @Test
+    fun `test setScreenSecure defaults to true when params are malformed`() {
+        // NativeBridge.setScreenSecure falls back to true when JSON parse fails
+        val malformedParams = "not-json"
+        val enable = try {
+            JSONObject(malformedParams).optBoolean("enable", true)
+        } catch (e: Exception) {
+            true
+        }
+
+        assertTrue("Malformed params should default to enable=true", enable)
+    }
+
+    @Test
+    fun `test setScreenSecure success response shape`() {
+        val enable = true
+        val response = JSONObject().apply {
+            put("secure", enable)
+            put("success", true)
+        }
+
+        assertTrue(response.getBoolean("secure"))
+        assertTrue(response.getBoolean("success"))
+        // Verify no extra fields bleed in
+        assertEquals(2, response.length())
+    }
+
+    // ============================================================
+    // CATEGORY 2: getScreenSecure COMMAND ROUTING (2 tests)
+    // ============================================================
+
+    @Test
+    fun `test getScreenSecure command is accepted by validator`() {
+        val messageJson = """{"command": "getScreenSecure", "data": {}}"""
+
+        val result = NativeBridge.parseAndValidateMessage(messageJson)
+
+        assertTrue("getScreenSecure should be a valid command", result.isValid)
+        assertEquals("getScreenSecure", result.command)
+        assertNull(result.error)
+    }
+
+    @Test
+    fun `test getScreenSecure status response shape`() {
+        // Validate that the JSON payload produced by getScreenSecure is well-formed
+        val isSecure = false
+        val response = JSONObject().apply {
+            put("secure", isSecure)
+            put("success", true)
+        }
+
+        assertFalse(response.getBoolean("secure"))
+        assertTrue(response.getBoolean("success"))
+        assertEquals(2, response.length())
+    }
+
+    // ============================================================
+    // CATEGORY 3: clearWebData COMMAND ROUTING (2 tests)
+    // ============================================================
+
+    @Test
+    fun `test clearWebData command is accepted by validator`() {
+        val messageJson = """{"command": "clearWebData", "data": {}}"""
+
+        val result = NativeBridge.parseAndValidateMessage(messageJson)
+
+        assertTrue("clearWebData should be a valid command", result.isValid)
+        assertEquals("clearWebData", result.command)
+        assertNull(result.error)
+    }
+
+    @Test
+    fun `test clearWebData success response shape`() {
+        val cookiesRemoved = true
+        val response = JSONObject().apply {
+            put("success", true)
+            put("cookiesRemoved", cookiesRemoved)
+        }
+
+        assertTrue(response.getBoolean("success"))
+        assertTrue(response.getBoolean("cookiesRemoved"))
+        assertEquals(2, response.length())
+    }
+
+    // ============================================================
+    // CATEGORY 4: JSON INJECTION SAFETY (3 tests)
+    // ============================================================
+
+    @Test
+    fun `test error message with injection characters is safe via JSONObject`() {
+        // Simulate an exception message that contains characters dangerous in naive JS
+        // string interpolation: double-quotes and backslashes.
+        // JSONObject must escape them so the serialized JSON stays valid and cannot
+        // break out of the surrounding JS string literal in notifyWebJson.
+        val injectionPayload = "failed\"; window[\"evil\"]=\"injected"
+
+        val response = JSONObject().apply {
+            put("success", false)
+            put("error", injectionPayload)
+        }
+
+        val serialized = response.toString()
+
+        // The raw unescaped double-quote sequence that would break JS must not appear
+        assertFalse(
+            "Unescaped double-quote injection sequence must not appear in serialized JSON",
+            serialized.contains("\"evil\"")
+        )
+        // The value must survive a round-trip intact
+        assertEquals(injectionPayload, JSONObject(serialized).getString("error"))
+    }
+
+    @Test
+    fun `test error message with backslash sequences is safe via JSONObject`() {
+        val backslashPayload = "err\\\"injected\\\""
+
+        val response = JSONObject().apply {
+            put("success", false)
+            put("error", backslashPayload)
+        }
+
+        // Round-trip must survive without throwing
+        val roundTripped = JSONObject(response.toString()).getString("error")
+        assertEquals(backslashPayload, roundTripped)
+    }
+
+    @Test
+    fun `test setScreenSecure and clearWebData commands are in VALID_COMMANDS whitelist`() {
+        assertTrue(
+            "setScreenSecure must be whitelisted",
+            CatalystConstants.Bridge.VALID_COMMANDS.contains("setScreenSecure")
+        )
+        assertTrue(
+            "getScreenSecure must be whitelisted",
+            CatalystConstants.Bridge.VALID_COMMANDS.contains("getScreenSecure")
+        )
+        assertTrue(
+            "clearWebData must be whitelisted",
+            CatalystConstants.Bridge.VALID_COMMANDS.contains("clearWebData")
+        )
+    }
+}

package/dist/native/bridge/hooks.js

@@ -103,12 +103,12 @@ if(_NativeBridge.default.isAvailable()){try{// Call native bridge directly witho
 if(_NativeBridge.default.isAndroid&&window.NativeBridge?.checkNotificationPermissionStatus){window.NativeBridge.checkNotificationPermissionStatus(null);}else if(_NativeBridge.default.isIOS&&window.webkit?.messageHandlers?.NativeBridge){window.webkit.messageHandlers.NativeBridge.postMessage({command:"checkNotificationPermissionStatus",data:null});}}catch(error){console.error("🔔 Error checking notification permission status:",error);}}window.WebBridge.register(_NativeInterfaces.NATIVE_CALLBACKS.LOCAL_NOTIFICATION_SCHEDULED,data=>{try{const result=typeof data==="string"?JSON.parse(data):data;if(result?.success===false||result?.error){base.handleNativeError(result.error||result);return;}base.setDataAndComplete(result);}catch(error){base.handleNativeError(error);}});window.WebBridge.register(_NativeInterfaces.NATIVE_CALLBACKS.LOCAL_NOTIFICATION_CANCELLED,data=>{try{const result=typeof data==="string"?JSON.parse(data):data;if(result?.success===false||result?.error){base.handleNativeError(result.error||result);return;}base.setDataAndComplete(result);}catch(error){base.handleNativeError(error);}});window.WebBridge.register(_NativeInterfaces.NATIVE_CALLBACKS.PUSH_NOTIFICATION_TOKEN,data=>{try{const result=typeof data==="string"?JSON.parse(data):data;if(result?.error){base.handleNativeError(result.error);return;}setPushToken(result.token);base.setDataAndComplete(result);}catch(error){base.handleNativeError(error);}});window.WebBridge.register(_NativeInterfaces.NATIVE_CALLBACKS.NOTIFICATION_RECEIVED,data=>{const notification=typeof data==="string"?JSON.parse(data):data;setLastNotification(notification);});window.WebBridge.register(_NativeInterfaces.NATIVE_CALLBACKS.NOTIFICATION_TAPPED,data=>{try{const result=typeof data==="string"?JSON.parse(data):data;base.setDataAndComplete(result);}catch(error){base.handleNativeError(error);}});window.WebBridge.register(_NativeInterfaces.NATIVE_CALLBACKS.NOTIFICATION_ACTION_PERFORMED,data=>{const action=typeof data==="string"?JSON.parse(data):data;base.setDataAndComplete(action);});window.WebBridge.register(_NativeInterfaces.NATIVE_CALLBACKS.TOPIC_SUBSCRIPTION_RESULT,data=>{try{const result=typeof data==="string"?JSON.parse(data):data;if(result?.error){base.handleNativeError(result.error);return;}const success=result?.success;if(success===false){base.handleNativeError(result);return;}base.setDataAndComplete(result);}catch(error){base.handleNativeError(error);}});window.WebBridge.register(_NativeInterfaces.NATIVE_CALLBACKS.SUBSCRIBED_TOPICS_RESULT,data=>{try{const result=typeof data==="string"?JSON.parse(data):data;if(result?.error){base.handleNativeError(result.error);return;}if(result?.success===false){base.handleNativeError(result);return;}setSubscribedTopics(result.topics||[]);base.setDataAndComplete(result);}catch(error){base.handleNativeError(error);}});return()=>{// Cleanup - unregister from shared callback system
 unregister();// Cleanup other callbacks
 window.WebBridge.unregister(_NativeInterfaces.NATIVE_CALLBACKS.LOCAL_NOTIFICATION_SCHEDULED);window.WebBridge.unregister(_NativeInterfaces.NATIVE_CALLBACKS.LOCAL_NOTIFICATION_CANCELLED);window.WebBridge.unregister(_NativeInterfaces.NATIVE_CALLBACKS.PUSH_NOTIFICATION_TOKEN);window.WebBridge.unregister(_NativeInterfaces.NATIVE_CALLBACKS.NOTIFICATION_RECEIVED);window.WebBridge.unregister(_NativeInterfaces.NATIVE_CALLBACKS.NOTIFICATION_TAPPED);window.WebBridge.unregister(_NativeInterfaces.NATIVE_CALLBACKS.NOTIFICATION_ACTION_PERFORMED);window.WebBridge.unregister(_NativeInterfaces.NATIVE_CALLBACKS.TOPIC_SUBSCRIPTION_RESULT);window.WebBridge.unregister(_NativeInterfaces.NATIVE_CALLBACKS.SUBSCRIBED_TOPICS_RESULT);};},[]);// Local notification scheduling with all supported styles
-const scheduleLocal=config=>{base.executeOperation(()=>{_NativeBridge.default.notification.scheduleLocal(config);},"schedule local notification");};const cancelLocal=notificationId=>{base.executeOperation(()=>{_NativeBridge.default.notification.cancelLocal(notificationId);},"cancel notification");};const registerForPush=()=>{base.executeOperation(()=>{_NativeBridge.default.notification.registerForPush();},"register for push");};const updateBadge=count=>{_NativeBridge.default.notification.updateBadge(count);setBadges(count);};const subscribeToTopic=topic=>{base.executeOperation(()=>{_NativeBridge.default.notification.subscribeToTopic(topic);},"subscribe to topic");};const unsubscribeFromTopic=topic=>{base.executeOperation(()=>{_NativeBridge.default.notification.unsubscribeFromTopic(topic);},"unsubscribe from topic");};const getSubscribedTopics=()=>{base.executeOperation(()=>{_NativeBridge.default.notification.getSubscribedTopics();},"get subscribed topics");};return{// Standardized interface
+const scheduleLocal=config=>{base.executeOperation(()=>{_NativeBridge.default.notification.scheduleLocal(config);},"schedule local notification");};const cancelLocal=notificationId=>{base.executeOperation(()=>{_NativeBridge.default.notification.cancelLocal(notificationId);},"cancel notification");};const registerForPush=()=>{base.executeOperation(()=>{_NativeBridge.default.notification.registerForPush();},"register for push");};const updateBadge=count=>{base.callNative(()=>_NativeBridge.default.notification.updateBadge(count));setBadges(count);};const subscribeToTopic=topic=>{base.executeOperation(()=>{_NativeBridge.default.notification.subscribeToTopic(topic);},"subscribe to topic");};const unsubscribeFromTopic=topic=>{base.executeOperation(()=>{_NativeBridge.default.notification.unsubscribeFromTopic(topic);},"unsubscribe from topic");};const getSubscribedTopics=()=>{base.executeOperation(()=>{_NativeBridge.default.notification.getSubscribedTopics();},"get subscribed topics");};return{// Standardized interface
 data:base.data,loading:base.loading,progress:base.progress,error:base.error,execute:scheduleLocal,clear:base.clear,clearError:base.clearError,// Notification-specific
 permissionStatus,pushToken,badges,lastNotification,subscribedTopics,scheduleLocal,cancelLocal,registerForPush,updateBadge,subscribeToTopic,unsubscribeFromTopic,getSubscribedTopics};};/**
  * Network status hook
  * Listens to native network changes and exposes online/offline state
- */exports.useNotification=useNotification;const useNetworkStatus=()=>{const initialOnline=typeof navigator!=="undefined"?navigator.onLine:true;const[status,setStatus]=(0,_react.useState)({online:initialOnline,type:null});const[error,setError]=(0,_react.useState)(null);const isNative=_NativeBridge.default.isNativeEnvironment;(0,_react.useEffect)(()=>{if(typeof window==="undefined")return;if(!window.WebBridge)return;if(!isNative)return;const handleStatus=payload=>{try{const parsed=parseNativePayload(payload)||{};setStatus({online:Boolean(parsed.online),type:parsed.type||null});setError(null);}catch(e){console.error("🌐 Error parsing network status:",e);setError(e.message);}};window.WebBridge.register(_NativeInterfaces.NATIVE_CALLBACKS.NETWORK_STATUS_CHANGED,handleStatus);try{_NativeBridge.default.network.getStatus();}catch(e){setError(e.message||"Network status unavailable");}return()=>{window.WebBridge.unregister(_NativeInterfaces.NATIVE_CALLBACKS.NETWORK_STATUS_CHANGED);};},[isNative]);return{...status,error};};/**
+ */exports.useNotification=useNotification;const useNetworkStatus=()=>{const initialOnline=typeof navigator!=="undefined"?navigator.onLine:true;const[status,setStatus]=(0,_react.useState)({online:initialOnline,type:null});const[error,setError]=(0,_react.useState)(null);const isNative=_NativeBridge.default.isAvailable();(0,_react.useEffect)(()=>{if(typeof window==="undefined")return;if(!window.WebBridge)return;if(!isNative)return;const handleStatus=payload=>{try{const parsed=parseNativePayload(payload)||{};setStatus({online:Boolean(parsed.online),type:parsed.type||null});setError(null);}catch(e){console.error("🌐 Error parsing network status:",e);setError(e.message);}};window.WebBridge.register(_NativeInterfaces.NATIVE_CALLBACKS.NETWORK_STATUS_CHANGED,handleStatus);try{_NativeBridge.default.network.getStatus();}catch(e){setError(e.message||"Network status unavailable");}return()=>{window.WebBridge.unregister(_NativeInterfaces.NATIVE_CALLBACKS.NETWORK_STATUS_CHANGED);};},[isNative]);return{...status,error};};/**
  * React hook for data protection primitives.
  *
  * Exposes screen-capture prevention and web data clearing as
@@ -130,8 +130,8 @@ permissionStatus,pushToken,badges,lastNotification,subscribedTopics,scheduleLoca
  *   clearError: () => void,
  * }}
  */exports.useNetworkStatus=useNetworkStatus;const useDataProtection=()=>{const base=(0,_useBaseHook.useBaseHook)("useDataProtection");const[screenSecure,setScreenSecureState]=(0,_react.useState)(false);// Server-side rendering safety
-if(typeof window==="undefined"){return{screenSecure:false,setScreenSecure:()=>{},clearWebData:()=>{},data:null,loading:false,progress:null,error:null,isWeb:true,isNative:false,clear:()=>{},clearError:()=>{}};}if(!window.WebBridge){throw new Error("WebBridge is not initialized. Call WebBridge.init() first.");}(0,_react.useEffect)(()=>{const handleScreenSecureSet=data=>{try{const result=typeof data==="string"?JSON.parse(data):data;if(result?.error){base.handleNativeError(result.error);return;}setScreenSecureState(Boolean(result?.secure));base.setDataAndComplete(result);}catch(error){base.handleNativeError(error);}};const handleScreenSecureError=data=>{try{const result=typeof data==="string"?JSON.parse(data):data;base.handleNativeError(result?.error||"setScreenSecure failed");}catch(error){base.handleNativeError(error);}};const handleWebDataCleared=data=>{try{const result=typeof data==="string"?JSON.parse(data):data;if(result?.error){base.handleNativeError(result.error);return;}base.setDataAndComplete(result);}catch(error){base.handleNativeError(error);}};const handleWebDataClearError=data=>{try{const result=typeof data==="string"?JSON.parse(data):data;base.handleNativeError(result?.error||"clearWebData failed");}catch(error){base.handleNativeError(error);}};const handleScreenSecureStatus=data=>{try{const result=typeof data==="string"?JSON.parse(data):data;if(result?.error){base.handleNativeError(result.error);return;}setScreenSecureState(Boolean(result?.secure));}catch(error){base.handleNativeError(error);}};const cleanup=registerNativeHandlers([[_NativeInterfaces.NATIVE_CALLBACKS.ON_SCREEN_SECURE_SET,handleScreenSecureSet],[_NativeInterfaces.NATIVE_CALLBACKS.ON_SCREEN_SECURE_STATUS,handleScreenSecureStatus],[_NativeInterfaces.NATIVE_CALLBACKS.ON_SCREEN_SECURE_ERROR,handleScreenSecureError],[_NativeInterfaces.NATIVE_CALLBACKS.ON_WEB_DATA_CLEARED,handleWebDataCleared],[_NativeInterfaces.NATIVE_CALLBACKS.ON_WEB_DATA_CLEAR_ERROR,handleWebDataClearError]]);// Initialize screenSecure state from native on mount
-_NativeBridge.default.security.getScreenSecure();return cleanup;},[base.setDataAndComplete,base.handleNativeError]);const setScreenSecure=(0,_react.useCallback)(enable=>{base.executeOperation(()=>{_NativeBridge.default.security.setScreenSecure(enable);},"setScreenSecure");},[base.executeOperation]);const clearWebData=(0,_react.useCallback)(()=>{base.executeOperation(()=>{_NativeBridge.default.security.clearWebData();},"clearWebData");},[base.executeOperation]);return{// Standardized base interface
+if(typeof window==="undefined"){return{screenSecure:false,setScreenSecure:()=>{},clearWebData:()=>{},data:null,loading:false,progress:null,error:null,isWeb:true,isNative:false,clear:()=>{},clearError:()=>{}};}if(!window.WebBridge){throw new Error("WebBridge is not initialized. Call WebBridge.init() first.");}(0,_react.useEffect)(()=>{const handleScreenSecureSet=data=>{try{const result=typeof data==="string"?JSON.parse(data):data;if(result?.error){base.handleNativeError(result.error);return;}setScreenSecureState(Boolean(result?.secure));base.setDataAndComplete(result);}catch(error){base.handleNativeError(error);}};const handleScreenSecureError=data=>{try{const result=typeof data==="string"?JSON.parse(data):data;base.handleNativeError(result?.error||"setScreenSecure failed");}catch(error){base.handleNativeError(error);}};const handleWebDataCleared=data=>{try{const result=typeof data==="string"?JSON.parse(data):data;if(result?.error){base.handleNativeError(result.error);return;}base.setDataAndComplete(result);}catch(error){base.handleNativeError(error);}};const handleWebDataClearError=data=>{try{const result=typeof data==="string"?JSON.parse(data):data;base.handleNativeError(result?.error||"clearWebData failed");}catch(error){base.handleNativeError(error);}};const handleScreenSecureStatus=data=>{try{const result=typeof data==="string"?JSON.parse(data):data;if(result?.error){base.handleNativeError(result.error);return;}setScreenSecureState(Boolean(result?.secure));}catch(error){base.handleNativeError(error);}};const cleanup=registerNativeHandlers([[_NativeInterfaces.NATIVE_CALLBACKS.ON_SCREEN_SECURE_SET,handleScreenSecureSet],[_NativeInterfaces.NATIVE_CALLBACKS.ON_SCREEN_SECURE_STATUS,handleScreenSecureStatus],[_NativeInterfaces.NATIVE_CALLBACKS.ON_SCREEN_SECURE_ERROR,handleScreenSecureError],[_NativeInterfaces.NATIVE_CALLBACKS.ON_WEB_DATA_CLEARED,handleWebDataCleared],[_NativeInterfaces.NATIVE_CALLBACKS.ON_WEB_DATA_CLEAR_ERROR,handleWebDataClearError]]);// Initialize screenSecure state from native on mount (native env only)
+base.callNative(()=>_NativeBridge.default.security.getScreenSecure());return cleanup;},[base.setDataAndComplete,base.handleNativeError]);const setScreenSecure=(0,_react.useCallback)(enable=>{base.callNative(()=>_NativeBridge.default.security.setScreenSecure(enable));},[base.callNative]);const clearWebData=(0,_react.useCallback)(()=>{base.callNative(()=>_NativeBridge.default.security.clearWebData());},[base.callNative]);return{// Standardized base interface
 data:base.data,loading:base.loading,progress:base.progress,error:base.error,isWeb:base.isWeb,isNative:base.isNative,clear:base.clear,clearError:base.clearError,// Security state
 screenSecure,// Security actions
 setScreenSecure,clearWebData};};exports.useDataProtection=useDataProtection;const useSafeArea=()=>{const fromGlobal=(0,_safeArea.getSafeAreaFromGlobal)();const initialValue=fromGlobal||{..._safeArea.DEFAULT_INSETS};const[insets,setInsets]=(0,_react.useState)(()=>initialValue);(0,_react.useEffect)(()=>{if(typeof window==="undefined")return;if(!window.WebBridge)return;if(!_NativeBridge.default.isAvailable())return;const handleInsetsUpdate=data=>{try{const parsed=typeof data==="string"?JSON.parse(data):data;const normalized={top:Number(parsed.top)||0,right:Number(parsed.right)||0,bottom:Number(parsed.bottom)||0,left:Number(parsed.left)||0};setInsets(normalized);(0,_safeArea.setSafeAreaGlobal)(normalized);}catch(error){console.error("Error parsing safe area insets:",error);setInsets({..._safeArea.DEFAULT_INSETS});}};window.WebBridge.register("ON_SAFE_AREA_INSETS_UPDATED",handleInsetsUpdate);_NativeBridge.default.safeArea.get();return()=>{window.WebBridge.unregister("ON_SAFE_AREA_INSETS_UPDATED");};},[]);return insets;};exports.useSafeArea=useSafeArea;

package/dist/native/bridge/useBaseHook.js

@@ -17,9 +17,10 @@ bytesTotal:null// Total bytes
 const updateProgress=(0,_react.useCallback)(updates=>{setProgress(prev=>({...prev,...updates}));},[]);const resetProgress=(0,_react.useCallback)(()=>{setProgress({state:"idle",percentage:null,message:null,phase:null,transport:null,bytesLoaded:null,bytesTotal:null});},[]);const startProgress=(0,_react.useCallback)((phase=null,message=null)=>{updateProgress({state:"active",phase,message,percentage:null});},[updateProgress]);const completeProgress=(0,_react.useCallback)(()=>{updateProgress({state:"complete",percentage:100});},[updateProgress]);const errorProgress=(0,_react.useCallback)(()=>{updateProgress({state:"error"});},[updateProgress]);// Error handling utilities
 const handleNativeError=(0,_react.useCallback)(nativeError=>{const standardError=(0,_errors.translateError)(nativeError);setError(standardError);setLoading(false);errorProgress();// Development logging
 if((0,_errors.isDevelopment)()){console.group(`🚨 ${hookName} Error`);console.log("Standard Error:",standardError);console.log("Native Error:",nativeError);console.groupEnd();}return standardError;},[hookName,errorProgress]);const clearError=(0,_react.useCallback)(()=>{setError(null);if(progress.state==="error"){resetProgress();}},[progress.state,resetProgress]);// Data management utilities
-const setDataAndComplete=(0,_react.useCallback)(newData=>{setData(newData);setLoading(false);completeProgress();setError(null);if((0,_errors.isDevelopment)()){console.log(`✅ ${hookName} Success:`,newData);}},[hookName,completeProgress]);const clear=(0,_react.useCallback)(()=>{setData(null);setError(null);resetProgress();if((0,_errors.isDevelopment)()){console.log(`🗑️ ${hookName} Cleared`);}},[hookName,resetProgress]);// Operation wrapper that handles common patterns
-const executeOperation=(0,_react.useCallback)((operationCallback,operationName="operation")=>{try{if(isWeb()){console.warn(`${hookName} requires web fallback implementation (isWeb: true)`);return;}if(!isNative()){throw new Error("Native bridge not available");}setLoading(true);setError(null);startProgress("starting",`Starting ${operationName}...`);if((0,_errors.isDevelopment)()){console.log(`🚀 ${hookName} ${operationName} started`);}// Execute the actual operation
-operationCallback();}catch(err){handleNativeError(err);console.error(`❌ ${hookName} ${operationName} failed:`,err);}},[hookName,isWeb,startProgress,handleNativeError]);// Environment flags (computed values, not functions)
+const setDataAndComplete=(0,_react.useCallback)(newData=>{setData(newData);setLoading(false);completeProgress();setError(null);if((0,_errors.isDevelopment)()){console.log(`✅ ${hookName} Success:`,newData);}},[hookName,completeProgress]);const clear=(0,_react.useCallback)(()=>{setData(null);setError(null);resetProgress();if((0,_errors.isDevelopment)()){console.log(`🗑️ ${hookName} Cleared`);}},[hookName,resetProgress]);// Fire-and-forget native call — no-ops silently on web, routes errors through handleNativeError on native
+const callNative=(0,_react.useCallback)(fn=>{if(!isNative()){if((0,_errors.isDevelopment)()){console.warn(`${hookName} callNative skipped — not in native environment`);}return;}try{fn();}catch(err){if((0,_errors.isDevelopment)()){console.warn(`${hookName} callNative failed silently:`,err);}}},[hookName,isNative]);// Operation wrapper that handles common patterns
+const executeOperation=(0,_react.useCallback)((operationCallback,operationName="operation")=>{try{if(isWeb()){console.warn(`${hookName} requires web fallback implementation (isWeb: true)`);return;}if(!isNative()){console.error(`${hookName} executeOperation: Native bridge not available`);return;}setLoading(true);setError(null);startProgress("starting",`Starting ${operationName}...`);if((0,_errors.isDevelopment)()){console.log(`🚀 ${hookName} ${operationName} started`);}// Execute the actual operation
+operationCallback();}catch(err){handleNativeError(err);console.error(`❌ ${hookName} ${operationName} failed:`,err);}},[hookName,isWeb,isNative,startProgress,handleNativeError]);// Environment flags (computed values, not functions)
 const environmentFlags={isWeb:isWeb(),isNative:isNative()};// Return standardized interface
 return{// Data state
 data,// Loading states
@@ -27,7 +28,7 @@ loading,progress,// Error handling
 error,// Environment detection
 ...environmentFlags,// Actions
 clear,clearError,// Internal utilities for specific hooks
-setData,setLoading,setError,setProgress,updateProgress,resetProgress,startProgress,completeProgress,errorProgress,setDataAndComplete,handleNativeError,executeOperation};};/**
+setData,setLoading,setError,setProgress,updateProgress,resetProgress,startProgress,completeProgress,errorProgress,setDataAndComplete,handleNativeError,callNative,executeOperation};};/**
  * Hook for development debugging and testing
  * @param {string} hookName
  * @returns {Object} Environment information and utilities

package/dist/native/bridge/utils/NativeBridge.js

@@ -10,10 +10,10 @@
      * Log environment detection info for debugging
      */_logEnvironmentInfo(){console.log("🌉 NativeBridge Environment Detection:",{isAndroid:this.isAndroid,isIOS:this.isIOS,isNativeEnvironment:this.isNativeEnvironment,hasAndroidBridge:!!window.NativeBridge,hasIOSBridge:!!window.webkit?.messageHandlers?.NativeBridge});}/**
      * Validate command before execution
-     */_validateCommand(command){if(!command){throw new Error("Command is required");}if(!(0,_NativeInterfaces.isValidCommand)(command)){throw new Error(`Invalid command: ${command}. Available commands: ${Object.values(_NativeInterfaces.NATIVE_COMMANDS).join(", ")}`);}if(!this.isNativeEnvironment){throw new Error("Native bridge not available. Ensure you are running in a native WebView environment.");}}/**
+     */_validateCommand(command){if(!command){throw new Error("Command is required");}if(!(0,_NativeInterfaces.isValidCommand)(command)){throw new Error(`Invalid command: ${command}. Available commands: ${Object.values(_NativeInterfaces.NATIVE_COMMANDS).join(", ")}`);}if(!this.isAvailable()){throw new Error("Native bridge not available. Ensure you are running in a native WebView environment.");}}/**
      * Execute command on Android platform
      */_executeAndroidCommand(command,data){try{if(typeof window.NativeBridge[command]==="function"){console.log(`🌉 Calling Android method '${command}'`,data?{data}:"(no data)");// Always pass data parameter to match Kotlin method signatures
-window.NativeBridge[command](data);return true;}else{throw new Error(`Android bridge method '${command}' not found`);}}catch(error){console.error(`Error executing Android command '${command}':`,error);throw error;}}/**
+window.NativeBridge[command](data);return true;}else{console.error(`Android bridge method '${command}' not found`);return false;}}catch(error){console.error(`Error executing Android command '${command}':`,error);return false;}}/**
      * Execute command on iOS platform
      */_executeIOSCommand(command,data){try{// For iOS, we always send a message object
 const message={command:command,data:data// This can be null/undefined, iOS bridge should handle it
@@ -102,8 +102,8 @@ if(process.env.NODE_ENV==="development"){console.warn(`🌉 Development mode: Na
          */clearWebData:()=>this.call(_NativeInterfaces.NATIVE_COMMANDS.CLEAR_WEB_DATA)};/**
      * Get environment info
      */getEnvironmentInfo(){return{isAndroid:this.isAndroid,isIOS:this.isIOS,isNativeEnvironment:this.isNativeEnvironment,platform:this.isAndroid?"android":this.isIOS?"ios":"web"};}/**
-     * Check if native bridge is available
-     */isAvailable(){return this.isNativeEnvironment;}/**
+     * Check if native bridge is available — live check, never stale
+     */isAvailable(){return this._detectAndroid()||this._detectIOS();}/**
      * Debug method to test native bridge connectivity
      */testConnection(){console.group("🌉 NativeBridge Connection Test");console.log("Environment:",this.getEnvironmentInfo());console.log("Available commands:",Object.values(_NativeInterfaces.NATIVE_COMMANDS));if(this.isAndroid&&window.NativeBridge){console.log("Android bridge methods:",Object.getOwnPropertyNames(window.NativeBridge));}if(this.isIOS&&window.webkit?.messageHandlers?.NativeBridge){console.log("iOS webkit bridge available");}console.groupEnd();}}// Export singleton instance
 exports.NativeBridgeUtil=NativeBridgeUtil;const nativeBridge=new NativeBridgeUtil();var _default=exports.default=nativeBridge;// Also export the class for advanced usage

package/dist/native/iosnativeWebView/Sources/Core/Utils/CacheManager.swift

@@ -265,9 +265,20 @@ public final class CacheManager {
     }
     
     func getCacheStatistics() -> (memoryUsed: Int, diskUsed: Int) {
-        // URLCache methods are thread-safe, no need for sync queue
         let memoryUsed = session.configuration.urlCache?.currentMemoryUsage ?? 0
-        let diskUsed = session.configuration.urlCache?.currentDiskUsage ?? 0
+
+        // Sum size of all custom .cache files written to disk (separate from URLCache internals)
+        var diskUsed = 0
+        if let files = try? FileManager.default.contentsOfDirectory(
+            at: cacheDirectory,
+            includingPropertiesForKeys: [.fileSizeKey]
+        ) {
+            diskUsed = files.reduce(0) { total, url in
+                let size = (try? url.resourceValues(forKeys: [.fileSizeKey]))?.fileSize ?? 0
+                return total + size
+            }
+        }
+
         return (memoryUsed, diskUsed)
     }
 }

package/dist/native/iosnativeWebView/iosnativeWebView.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved

@@ -1,6 +1,42 @@
 {
   "originHash" : "3d4b03cf830e06eaa66e0727fd91253b9df9d2675cbe24eb099df0d4bb4d1f01",
   "pins" : [
+    {
+      "identity" : "appauth-ios",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/openid/AppAuth-iOS.git",
+      "state" : {
+        "revision" : "2781038865a80e2c425a1da12cc1327bcd56501f",
+        "version" : "1.7.6"
+      }
+    },
+    {
+      "identity" : "googlesignin-ios",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/google/GoogleSignIn-iOS",
+      "state" : {
+        "revision" : "a7965d134c5d3567026c523e0a8a583f73b62b0d",
+        "version" : "7.1.0"
+      }
+    },
+    {
+      "identity" : "gtm-session-fetcher",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/google/gtm-session-fetcher.git",
+      "state" : {
+        "revision" : "a2ab612cb980066ee56d90d60d8462992c07f24b",
+        "version" : "3.5.0"
+      }
+    },
+    {
+      "identity" : "gtmappauth",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/google/GTMAppAuth.git",
+      "state" : {
+        "revision" : "5d7d66f647400952b1758b230e019b07c0b4b22a",
+        "version" : "4.1.1"
+      }
+    },
     {
       "identity" : "jsonschema.swift",
       "kind" : "remoteSourceControl",

package/dist/native/iosnativeWebView/iosnativeWebView.xctestplan

@@ -9,6 +9,7 @@
     }
   ],
   "defaultOptions" : {
+    "codeCoverage" : true,
     "commandLineArgumentEntries" : [
       {
         "argument" : "-OSLogEnable"