craft-native 0.0.91 → 0.0.92

package/dist/ios/templates/CraftApp.swift

@@ -172,9 +172,16 @@ class DeepLinkManager {
     static let shared = DeepLinkManager()
 
     private var initialURL: URL?
-    private var pendingURL: URL?
+    // Every link that arrived while no page could receive it, in order. This
+    // was a single slot, so a second link before the bridge was ready replaced
+    // the first; on a cold start, that could be the link that launched the app.
+    private var pendingURLs: [URL] = []
     private weak var webView: WKWebView?
     private var isReady = false
+    // Whether a page has ever become ready. A link that arrives before that is
+    // the one the app was opened with; a link that arrives later is not, and
+    // is no answer to getInitialURL.
+    private var hasBeenReady = false
 
     private init() {}
 
@@ -182,26 +189,33 @@ class DeepLinkManager {
         self.webView = webView
     }
 
+    // A navigation started, so the page that would have received a link is
+    // going away. Without this a link arriving during a reload was dispatched
+    // into the page being torn down and lost.
+    func setLoading() {
+        isReady = false
+    }
+
     func setReady() {
         isReady = true
-        // If there's a pending URL, dispatch it now
-        if let url = pendingURL {
-            dispatchDeepLink(url)
-            pendingURL = nil
+        let firstPage = !hasBeenReady
+        hasBeenReady = true
+        let urls = pendingURLs
+        pendingURLs.removeAll()
+        for url in urls {
+            dispatchDeepLink(url, initial: firstPage && url == initialURL)
         }
     }
 
     func handleURL(_ url: URL) {
-        // Store as initial URL if this is the first one
-        if initialURL == nil {
+        if initialURL == nil && !hasBeenReady {
             initialURL = url
         }
 
         if isReady && webView != nil {
-            dispatchDeepLink(url)
+            dispatchDeepLink(url, initial: false)
         } else {
-            // Store for later when web view is ready
-            pendingURL = url
+            pendingURLs.append(url)
         }
     }
 
@@ -209,7 +223,7 @@ class DeepLinkManager {
         return initialURL
     }
 
-    private func dispatchDeepLink(_ url: URL) {
+    private func dispatchDeepLink(_ url: URL, initial: Bool) {
         guard let webView = webView else { return }
 
         // Parse URL components
@@ -218,7 +232,10 @@ class DeepLinkManager {
             "scheme": url.scheme ?? "",
             "host": url.host ?? "",
             "path": url.path,
-            "query": url.query ?? ""
+            "query": url.query ?? "",
+            // Lets the page tell the launch link apart from later ones, so a
+            // page that reads getInitialURL is not also handed it again.
+            "initial": initial
         ]
 
         // Parse query parameters
@@ -650,16 +667,23 @@ struct CraftWebView: UIViewRepresentable {
             switch action {
             case "startListening":
                 if config.enableSpeechRecognition {
+                    // Answers that the request was taken. Authorization and the
+                    // recognizer answer later, as craftSpeech* events; waiting
+                    // for them here would leave the promise open on every path
+                    // that ends without one.
                     startSpeechRecognition()
+                    resolveCallback(callbackId, result: true)
                 } else {
                     rejectCallback(callbackId, error: "Speech recognition is disabled", code: "CAPABILITY_DISABLED")
                 }
             case "stopListening":
                 stopSpeechRecognition()
+                resolveCallback(callbackId, result: true)
             case "haptic":
                 if config.enableHaptics {
                     let style = body["style"] as? String ?? "medium"
                     triggerHaptic(style: style)
+                    resolveCallback(callbackId, result: true)
                 } else {
                     rejectCallback(callbackId, error: "Haptics is disabled", code: "CAPABILITY_DISABLED")
                 }
@@ -1400,6 +1424,7 @@ struct CraftWebView: UIViewRepresentable {
 
         func webView(_ webView: WKWebView, didStartProvisionalNavigation navigation: WKNavigation!) {
             CraftEventManager.shared.setLoading()
+            DeepLinkManager.shared.setLoading()
         }
 
         func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
@@ -1445,11 +1470,29 @@ struct CraftWebView: UIViewRepresentable {
 
         private func isTrustedURL(_ url: URL?) -> Bool {
             guard let url = url else { return false }
-            if url.scheme == "craft" && url.host == "app" { return true }
             return isTrustedOrigin(scheme: url.scheme ?? "", host: url.host ?? "", port: url.port ?? 0)
         }
 
+        /// The single answer to "may this origin reach native?".
+        ///
+        /// The bundled app is served from craft://app by
+        /// `BundledAssetSchemeHandler`, and it is the only content a generated
+        /// app loads when no dev server is configured. That origin used to be
+        /// trusted for *navigation* only: `isTrustedURL` carried the clause,
+        /// while the `userContentController` guard called this function
+        /// directly and fell through to the https/localhost check. So every
+        /// bridge call from the app's own page was answered with
+        ///
+        ///     Blocked Craft bridge message from untrusted origin: craft://app
+        ///
+        /// and its promise never settled — the whole native surface was dead
+        /// in the default configuration, which is the one every generated app
+        /// ships with. Two guards that had to agree, and did not. There is one
+        /// now, and `scripts/mobile-e2e.ts` runs a real round trip on a booted
+        /// simulator so a future hardening pass cannot quietly take the bridge
+        /// away again.
         private func isTrustedOrigin(scheme: String, host: String, port: Int) -> Bool {
+            if scheme == "craft" && host == "app" { return true }
             if scheme == "file" { return true }
             guard scheme == "https" || (scheme == "http" && ["localhost", "127.0.0.1", "::1"].contains(host)) else { return false }
             let defaultPort = scheme == "https" ? 443 : 80
@@ -1977,20 +2020,62 @@ struct CraftWebView: UIViewRepresentable {
                     return Promise.reject(new Error('Android fitness APIs are unavailable on iOS'));
                 },
 
+                // Resolves true once UIKit has taken the haptic, and rejects
+                // CAPABILITY_DISABLED when enableHaptics is off.
                 haptic: function(style) {
-                    window.webkit.messageHandlers.craft.postMessage({action: 'haptic', style: style || 'medium'});
+                    var self = window.craft;
+                    var id = 'cb_' + (++self._callbackId);
+                    window.webkit.messageHandlers.craft.postMessage({action: 'haptic', style: style || 'medium', callbackId: id});
+                    return new Promise(function(resolve, reject) {
+                        self._callbacks[id] = {resolve: resolve, reject: reject};
+                    });
                 },
 
+                // Resolves true once native has taken the request, not once
+                // audio is flowing. What happens next (a prompt declined, no
+                // recognizer, a transcript) still arrives as craftSpeech*
+                // events, because none of it is known when this answers.
                 startListening: function() {
-                    window.webkit.messageHandlers.craft.postMessage({action: 'startListening'});
+                    var self = window.craft;
+                    var id = 'cb_' + (++self._callbackId);
+                    window.webkit.messageHandlers.craft.postMessage({action: 'startListening', callbackId: id});
+                    return new Promise(function(resolve, reject) {
+                        self._callbacks[id] = {resolve: resolve, reject: reject};
+                    });
                 },
 
                 stopListening: function() {
-                    window.webkit.messageHandlers.craft.postMessage({action: 'stopListening'});
+                    var self = window.craft;
+                    var id = 'cb_' + (++self._callbackId);
+                    window.webkit.messageHandlers.craft.postMessage({action: 'stopListening', callbackId: id});
+                    return new Promise(function(resolve, reject) {
+                        self._callbacks[id] = {resolve: resolve, reject: reject};
+                    });
                 },
 
                 share: function(text) {
-                    window.webkit.messageHandlers.craft.postMessage({action: 'share', text: text});
+                    return this._share({text: text});
+                },
+
+                // Both share entry points come through here, because the
+                // native side answers them the same way: `true` when the
+                // person finished an activity, `false` when they dismissed
+                // the sheet, a rejection when sharing is disabled or there is
+                // nothing to share. The flat `share` used to post with no
+                // callbackId, so every one of those answers stopped at the nil
+                // guard in resolveCallback and the page got `undefined`.
+                //
+                // No timeout, unlike `_invoke`'s thirty seconds. The sheet
+                // waits on a person, and someone slower than that to pick an
+                // app would be told the share failed while it was still on
+                // screen, with the real answer then dropped.
+                _share: function(payload) {
+                    var self = this;
+                    var id = 'cb_' + (++this._callbackId);
+                    window.webkit.messageHandlers.craft.postMessage(Object.assign({}, payload, {action: 'share', callbackId: id}));
+                    return new Promise(function(resolve, reject) {
+                        self._callbacks[id] = {resolve: resolve, reject: reject};
+                    });
                 },
 
                 openCamera: function() {
@@ -2112,12 +2197,25 @@ struct CraftWebView: UIViewRepresentable {
                             }
                         });
                     },
+                    // Resolves true once updates have started, before any
+                    // authorization answer. A later refusal arrives as a
+                    // craftLocationError event.
                     watchPosition: function(callback) {
+                        var self = window.craft;
+                        var id = 'cb_' + (++self._callbackId);
                         window.addEventListener('craftLocationUpdate', function(e) { callback(e.detail); });
-                        window.webkit.messageHandlers.craft.postMessage({action: 'watchPosition'});
+                        window.webkit.messageHandlers.craft.postMessage({action: 'watchPosition', callbackId: id});
+                        return new Promise(function(resolve, reject) {
+                            self._callbacks[id] = {resolve: resolve, reject: reject};
+                        });
                     },
                     clearWatch: function() {
-                        window.webkit.messageHandlers.craft.postMessage({action: 'clearWatch'});
+                        var self = window.craft;
+                        var id = 'cb_' + (++self._callbackId);
+                        window.webkit.messageHandlers.craft.postMessage({action: 'clearWatch', callbackId: id});
+                        return new Promise(function(resolve, reject) {
+                            self._callbacks[id] = {resolve: resolve, reject: reject};
+                        });
                     }
                 },
 
@@ -2217,7 +2315,12 @@ struct CraftWebView: UIViewRepresentable {
 
                 // Vibrate
                 vibrate: function(pattern) {
-                    window.webkit.messageHandlers.craft.postMessage({action: 'vibrate', pattern: pattern});
+                    var self = window.craft;
+                    var id = 'cb_' + (++self._callbackId);
+                    window.webkit.messageHandlers.craft.postMessage({action: 'vibrate', pattern: pattern, callbackId: id});
+                    return new Promise(function(resolve, reject) {
+                        self._callbacks[id] = {resolve: resolve, reject: reject};
+                    });
                 },
 
                 // Open URL
@@ -2394,7 +2497,7 @@ struct CraftWebView: UIViewRepresentable {
 
                 // Deep Links
                 onDeepLink: function(callback) {
-                    window.addEventListener('craftDeepLink', function(e) { callback(e.detail); });
+                    return window.craft._subscribeDeepLinks(callback);
                 },
 
                 // Background Tasks
@@ -2722,6 +2825,7 @@ struct CraftWebView: UIViewRepresentable {
                 deepLinks: {
                     getInitialURL: function() {
                         var self = window.craft;
+                        self._claimInitialDeepLink();
                         var id = 'cb_' + (++self._callbackId);
                         window.webkit.messageHandlers.craft.postMessage({action: 'getInitialURL', callbackId: id});
                         return new Promise(function(resolve, reject) {
@@ -2729,7 +2833,7 @@ struct CraftWebView: UIViewRepresentable {
                         });
                     },
                     onLink: function(callback) {
-                        window.addEventListener('craftDeepLink', function(e) { callback(e.detail); });
+                        return window.craft._subscribeDeepLinks(callback);
                     }
                 },
 
@@ -2792,6 +2896,61 @@ struct CraftWebView: UIViewRepresentable {
             // Stable, versioned mobile contract consumed by craft-native/mobile.
             // Legacy flat methods remain available while every public SDK method
             // is routed through this nested contract.
+            // Links that arrive before anything is listening (#198).
+            //
+            // The native side dispatches a link the moment this script has
+            // run, and on a cold start that is the link the app was opened
+            // with. No page code can have called onLink by then: onLink is
+            // defined by this very script. So every such link was dispatched
+            // to nobody, and a page that subscribes, rather than asking
+            // getInitialURL, never learned how it was opened.
+            //
+            // Held here instead, and handed to the first subscriber on the
+            // next turn, so an unsubscribe returned in the same tick still
+            // applies. The launch link belongs to getInitialURL once the page
+            // has called it, whether native has dispatched it yet or not, so a
+            // page that does both in the same tick, in either order, gets it
+            // once. That includes a craftReady handler, which runs before
+            // native dispatches anything. A page that asks getInitialURL only
+            // later, after an await, should skip `initial` in onLink.
+            //
+            // The same block runs on Android (#215), where this script can run
+            // twice in one document, so its state lives on window.
+            (function installDeepLinkReplay(craft) {
+                var replay = window.__craftDeepLinkReplay;
+                if (!replay) {
+                    replay = window.__craftDeepLinkReplay = {undelivered: [], subscribed: false, initialClaimed: false};
+                    window.addEventListener('craftDeepLink', function(e) {
+                        if (!replay.subscribed && !claimed(e.detail)) replay.undelivered.push(e.detail);
+                    });
+                }
+                function claimed(detail) {
+                    return replay.initialClaimed && detail && detail.initial;
+                }
+                craft._subscribeDeepLinks = function(callback) {
+                    var active = true;
+                    var listener = function(e) { if (!claimed(e.detail)) callback(e.detail); };
+                    window.addEventListener('craftDeepLink', listener);
+                    if (!replay.subscribed) {
+                        replay.subscribed = true;
+                        setTimeout(function() {
+                            var pending = replay.undelivered;
+                            replay.undelivered = [];
+                            if (!active) return;
+                            pending.forEach(function(detail) { callback(detail); });
+                        }, 0);
+                    }
+                    return function() {
+                        active = false;
+                        window.removeEventListener('craftDeepLink', listener);
+                    };
+                };
+                craft._claimInitialDeepLink = function() {
+                    replay.initialClaimed = true;
+                    replay.undelivered = replay.undelivered.filter(function(detail) { return !(detail && detail.initial); });
+                };
+            })(window.craft);
+
             (function installCraftMobileContract(craft) {
                 var legacyShare = craft.share.bind(craft);
                 var legacyOpenCamera = craft.openCamera.bind(craft);
@@ -2823,14 +2982,25 @@ struct CraftWebView: UIViewRepresentable {
                     getInfo: function() { return craft.getDeviceInfo(); },
                     getCapabilities: function() { return Promise.resolve(Object.assign({}, craft.capabilities)); }
                 };
+                // Feedback, as on Android and the web, where there is no
+                // motor to fire: an app that left enableHaptics off gets
+                // nothing played and a settled promise, so `await
+                // haptics.selection()` in the middle of a flow does not stop
+                // the flow. A native failure still rejects, and
+                // craft.haptic() itself reports the refusal.
+                function hapticFeedback(answer) {
+                    return answer.then(function() {}, function(error) {
+                        if (error && error.code === 'CAPABILITY_DISABLED') return;
+                        throw error;
+                    });
+                }
                 craft.haptics = {
-                    impact: function(style) { craft.haptic(style || 'medium'); return Promise.resolve(); },
+                    impact: function(style) { return hapticFeedback(craft.haptic(style || 'medium')); },
                     notification: function(type) {
-                        craft.haptic(type === 'error' ? 'heavy' : type === 'warning' ? 'medium' : 'light');
-                        return Promise.resolve();
+                        return hapticFeedback(craft.haptic(type === 'error' ? 'heavy' : type === 'warning' ? 'medium' : 'light'));
                     },
-                    selection: function() { craft.haptic('soft'); return Promise.resolve(); },
-                    vibrate: function(pattern) { craft.vibrate(pattern || []); return Promise.resolve(); }
+                    selection: function() { return hapticFeedback(craft.haptic('soft')); },
+                    vibrate: function(pattern) { return hapticFeedback(craft.vibrate(pattern || [])); }
                 };
                 craft.permissions = {
                     check: function(permission) { return craft._invoke('checkPermission', {permission: permission}); },
@@ -2870,9 +3040,7 @@ struct CraftWebView: UIViewRepresentable {
                     },
                     clearWatch: function(id) {
                         locationWatchCallbacks.delete(id);
-                        if (locationWatchCallbacks.size === 0) {
-                            window.webkit.messageHandlers.craft.postMessage({action: 'clearWatch'});
-                        }
+                        if (locationWatchCallbacks.size === 0) void craft._invoke('clearWatch');
                     },
                     startRecording: function() { return craft._invoke('startLocationRecording'); },
                     pauseRecording: function() { return craft._invoke('pauseLocationRecording'); },
@@ -2901,7 +3069,7 @@ struct CraftWebView: UIViewRepresentable {
                     }
                 };
                 var shareApi = function(text) { return legacyShare(text); };
-                shareApi.share = function(options) { return craft._invoke('share', {options: options || {}}); };
+                shareApi.share = function(options) { return craft._share({options: options || {}}); };
                 craft.share = shareApi;
                 craft.lifecycle = {
                     getState: function() { return document.visibilityState === 'visible' ? 'active' : 'background'; },
@@ -5452,9 +5620,42 @@ struct CraftWebView: UIViewRepresentable {
             resolveCallback(callbackId, result: ["registered": true, "action": action, "phrase": phrase])
         }
 
+        // Removals waiting on their completion, each under a token of its own:
+        // callbackId can be nil, and restarts when the page reloads.
+        private var pendingSiriRemovals: [UUID: DispatchWorkItem] = [:]
+        // The only thing that settles craft.siri.remove, which arms no timeout
+        // of its own; the same as Zig's.
+        private static let siriRemovalDeadline: TimeInterval = 15
+
         private func removeSiriShortcut(action: String, callbackId: String?) {
+            // The completion comes from a system daemon, and sometimes it never
+            // comes (#211). The deadline settles the call instead, and never
+            // with removed: true, because the deletion may still have happened.
+            // Both run on the main queue and remove the same entry, so only one
+            // of them answers.
+            let token = UUID()
+            let deadline = DispatchWorkItem { [weak self] in
+                guard let self, self.pendingSiriRemovals.removeValue(forKey: token) != nil else { return }
+                self.rejectCallback(
+                    callbackId,
+                    error: "NSUserActivity.deleteSavedUserActivities did not call its completion handler within \(Int(Coordinator.siriRemovalDeadline))s",
+                    code: "TIMEOUT"
+                )
+            }
+            pendingSiriRemovals[token] = deadline
+            DispatchQueue.main.asyncAfter(deadline: .now() + Coordinator.siriRemovalDeadline, execute: deadline)
+
             NSUserActivity.deleteSavedUserActivities(withPersistentIdentifiers: [action]) {
-                self.resolveCallback(callbackId, result: ["removed": true, "action": action])
+                // The queue this runs on is not documented, and a zig: hand-off
+                // reply goes to evaluateJavaScript without a hop of its own.
+                DispatchQueue.main.async { [weak self] in
+                    guard let self, let pending = self.pendingSiriRemovals.removeValue(forKey: token) else {
+                        print("removeSiriShortcut: the completion for \(action) arrived after its deadline; ignored")
+                        return
+                    }
+                    pending.cancel()
+                    self.resolveCallback(callbackId, result: ["removed": true, "action": action])
+                }
             }
         }
 

package/dist/mobile.js

@@ -457,11 +457,18 @@ var share = {
       return craft.share.share(options);
     }
     if (navigator.share) {
-      await navigator.share({
-        title: options.title,
-        text: options.text,
-        url: options.url
-      });
+      try {
+        await navigator.share({
+          title: options.title,
+          text: options.text,
+          url: options.url
+        });
+        return true;
+      } catch (error) {
+        if (error instanceof DOMException && error.name === "AbortError")
+          return false;
+        throw error;
+      }
     } else {
       throw new Error("Share API not available");
     }
@@ -555,15 +562,16 @@ var deepLinks = {
       return craft.deepLinks.onLink((value) => {
         const url = normalizeDeepLinkURL(value);
         if (url)
-          callback(url);
+          callback(url, { initial: value?.initial === true });
       }) ?? (() => {});
     }
     if (typeof globalThis === "undefined")
       return () => {};
     const listener = (event) => {
-      const url = normalizeDeepLinkURL(event.detail);
+      const detail = event.detail;
+      const url = normalizeDeepLinkURL(detail);
       if (url)
-        callback(url);
+        callback(url, { initial: detail?.initial === true });
     };
     globalThis.addEventListener("craftDeepLink", listener);
     return () => globalThis.removeEventListener("craftDeepLink", listener);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "craft-native",
-  "version": "0.0.91",
+  "version": "0.0.92",
   "type": "module",
   "description": "Build desktop apps with web languages - TypeScript SDK for Craft",
   "author": "Chris Breuer <chris@stacksjs.org>",