@multiplatform.one/core 6.0.4 → 6.1.0

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # @multiplatform.one/core
 
+## 6.1.0
+
+### Minor Changes
+
+- Point apps at the `make localnet` dev chains by default: Web3Config gains
+  `localnet` (prepends the hardhat 31337 dev chain as wagmi's default chain on
+  web AND native via a shared `resolveChains`), `localnetRpcUrl` (emulator host
+  addresses), and `suiRpcUrl` alongside the existing `solanaRpcUrl`. createApp
+  reads WEB3_LOCALNET_ENABLED / WEB3_EVM_RPC / WEB3_SOLANA_RPC / WEB3_SUI_RPC
+  from env config.
+- Native auth + authenticated Frappe data end-to-end:
+  - keycloak: native Keycloak login via a hand-rolled Better Auth expo flow
+    (fetch + expo-web-browser + SecureStore cookie jar — no @better-auth/expo
+    client, whose zod import graph dies on Hermes). Real native dist
+    (dist/esm/index.native.js) + react-native export condition; new
+    getKeycloakBearerToken() for Frappe Bearer auth; native useSession backed
+    by a real store; Loading/Authenticated use RN primitives (they mount above
+    TamaguiProvider); KeycloakProvider gains betterAuthBaseUrl/expoScheme.
+  - frappe: isBrowser() now means "client runtime" (isNative ||
+    isWindowDefined) — the tamagui native dist hardcodes isWindowDefined=false,
+    which silently disabled the entire sync pipeline (collections never
+    fetched) on iOS/Android. Token type widened to string | fn through the
+    React layer.
+  - core: createApp wires native Frappe requests with Authorization: Bearer
+    from better-auth /get-access-token (web stays same-origin cookie mode);
+    keycloak config plumbs betterAuthBaseUrl (BETTER_AUTH_BASE_URL, falls back
+    to BASE_URL) and expoScheme.
+  - (repo auth service, unpublished: exp:// trusted origin in development for
+    Expo Go OAuth returns.)
+
+### Patch Changes
+
+- Updated dependencies
+  - @multiplatform.one/web3@6.1.0
+  - @multiplatform.one/i18n@6.1.0
+  - @multiplatform.one/logger@6.1.0
+  - @multiplatform.one/platform@6.1.0
+  - @multiplatform.one/store@6.1.0
+  - @multiplatform.one/theme@6.1.0
+
 ## 6.0.4
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@multiplatform.one/core",
-  "version": "6.0.4",
+  "version": "6.1.0",
   "description": "Core framework shell, provider composition, and layout factories for multiplatform.one",
   "keywords": [
     "app",
@@ -36,12 +36,12 @@
     "@tanstack/react-form-devtools": "0.2.22",
     "@tanstack/react-pacer-devtools": "^0.7.0",
     "react-cookie": "^8.1.2",
-    "@multiplatform.one/i18n": "6.0.4",
-    "@multiplatform.one/logger": "6.0.4",
-    "@multiplatform.one/platform": "6.0.4",
-    "@multiplatform.one/theme": "6.0.4",
-    "@multiplatform.one/store": "6.0.4",
-    "@multiplatform.one/web3": "6.0.4"
+    "@multiplatform.one/i18n": "6.1.0",
+    "@multiplatform.one/store": "6.1.0",
+    "@multiplatform.one/platform": "6.1.0",
+    "@multiplatform.one/logger": "6.1.0",
+    "@multiplatform.one/theme": "6.1.0",
+    "@multiplatform.one/web3": "6.1.0"
   },
   "devDependencies": {
     "@sentry/react": "^10.51.0",
@@ -57,8 +57,8 @@
     "react-native-safe-area-context": "~5.7.0",
     "tamagui": "2.0.0-rc.41",
     "typescript": "~5.9.3",
-    "@multiplatform.one/frappe": "6.0.4",
-    "@multiplatform.one/web3": "6.0.4"
+    "@multiplatform.one/web3": "6.1.0",
+    "@multiplatform.one/frappe": "6.1.0"
   },
   "peerDependencies": {
     "@sentry/react": "^9.0.0",
@@ -74,10 +74,10 @@
     "react-native-gesture-handler": ">=2.0.0",
     "react-native-safe-area-context": ">=4.0.0",
     "tamagui": "^2.0.0-rc",
-    "@multiplatform.one/frappe": "6.0.4",
-    "@multiplatform.one/keycloak": "6.0.4",
-    "@multiplatform.one/frappe-ui": "6.0.4",
-    "@multiplatform.one/web3": "6.0.4"
+    "@multiplatform.one/frappe": "^6.1.0",
+    "@multiplatform.one/keycloak": "^6.1.0",
+    "@multiplatform.one/web3": "^6.1.0",
+    "@multiplatform.one/frappe-ui": "^6.1.0"
   },
   "peerDependenciesMeta": {
     "@multiplatform.one/frappe": {

package/src/app/CreateApp.tsx

@@ -58,6 +58,12 @@ export interface KeycloakConfig {
   iframeSso?: boolean;
   loginRedirectUri?: string;
   messageHandlerKeys?: string[];
+  /** Better Auth server base URL (native sign-in). When omitted, reads
+   * BETTER_AUTH_BASE_URL, then falls back to BASE_URL (the app server proxies
+   * /api/auth). */
+  betterAuthBaseUrl?: string;
+  /** App scheme for the Expo auth-session redirect (native). */
+  expoScheme?: string;
 }
 
 export interface FrappeConfig {
@@ -71,7 +77,7 @@ export interface FrappeConfig {
   socketPort?: number;
   auth?: {
     useToken?: boolean;
-    token?: string;
+    token?: string | (() => string | Promise<string>);
     type?: string;
   };
 }
@@ -85,9 +91,17 @@ export interface Web3AppConfig {
   appUrl?: string;
   appIcon?: string;
   enableTestnets?: boolean;
-  /** Native: URL serving the wallet WebView HTML (preferred over the inline string). */
+  /** Add the local dev chain (`make localnet`). When omitted, reads WEB3_LOCALNET_ENABLED. */
+  localnet?: boolean;
+  /** Local EVM JSON-RPC endpoint for localnet. When omitted, reads WEB3_EVM_RPC. */
+  localnetRpcUrl?: string;
+  /** Solana JSON-RPC endpoint. When omitted, reads WEB3_SOLANA_RPC. */
+  solanaRpcUrl?: string;
+  /** Sui JSON-RPC endpoint. When omitted, reads WEB3_SUI_RPC. */
+  suiRpcUrl?: string;
+  /** Native: URL serving the wallet WebView HTML. When omitted, reads WEB3_WEBVIEW_URL. */
   webViewUrl?: string;
-  /** E2E only (native): route connect through the in-WebView mock wallet. */
+  /** E2E only (native): route connect through the in-WebView mock wallet. When omitted, reads WEB3_MOCK_WALLET. */
   mockWallet?: boolean;
 }
 
@@ -186,8 +200,12 @@ export function createApp(appConfig: CreateAppConfig) {
                 (isWeb && typeof window !== "undefined" ? window.location.origin : ""),
               appIcon: cfg.appIcon,
               enableTestnets: testnetsEnabled,
-              webViewUrl: cfg.webViewUrl,
-              mockWallet: cfg.mockWallet,
+              localnet: cfg.localnet ?? config.get("WEB3_LOCALNET_ENABLED") === "1",
+              localnetRpcUrl: cfg.localnetRpcUrl || config.get("WEB3_EVM_RPC") || undefined,
+              solanaRpcUrl: cfg.solanaRpcUrl || config.get("WEB3_SOLANA_RPC") || undefined,
+              suiRpcUrl: cfg.suiRpcUrl || config.get("WEB3_SUI_RPC") || undefined,
+              webViewUrl: cfg.webViewUrl || config.get("WEB3_WEBVIEW_URL") || undefined,
+              mockWallet: cfg.mockWallet ?? config.get("WEB3_MOCK_WALLET") === "1",
             }}
           >
             {children}
@@ -216,6 +234,8 @@ export function createApp(appConfig: CreateAppConfig) {
             iframeSso?: boolean;
             loginRedirectUri?: string;
             messageHandlerKeys?: string[];
+            betterAuthBaseUrl?: string;
+            expoScheme?: string;
           }>
         >,
       };
@@ -237,6 +257,13 @@ export function createApp(appConfig: CreateAppConfig) {
             iframeSso={cfg.iframeSso}
             loginRedirectUri={cfg.loginRedirectUri}
             messageHandlerKeys={cfg.messageHandlerKeys || []}
+            betterAuthBaseUrl={
+              cfg.betterAuthBaseUrl ||
+              config.get("BETTER_AUTH_BASE_URL") ||
+              config.get("BASE_URL") ||
+              undefined
+            }
+            expoScheme={cfg.expoScheme}
           >
             {children}
           </LazyKeycloakProvider>
@@ -264,8 +291,29 @@ export function createApp(appConfig: CreateAppConfig) {
       const socketPort =
         cfg.socketPort ?? (Number(config.get("FRAPPE_SOCKETIO_PORT")) || undefined);
 
+      // Auth transport differs by platform. Web is same-origin with the bench
+      // (:8000 proxy), so the better-auth account cookie authenticates Frappe
+      // requests automatically (the bench's frappe_keycloak hook decrypts it).
+      // Native requests can't carry those cookies (they live in the SecureStore
+      // jar), so the HttpClient sends `Authorization: Bearer <keycloak access
+      // token>` instead, fetched lazily from better-auth's /get-access-token
+      // (which also refreshes server-side). When signed out the getter resolves
+      // undefined and requests fall back to guest.
+      const auth =
+        cfg.auth ??
+        (!isWeb && appConfig.keycloak
+          ? {
+              useToken: true,
+              type: "Bearer",
+              token: async () => {
+                const mod = await import("@multiplatform.one/keycloak");
+                return (await mod.getKeycloakBearerToken()) || "";
+              },
+            }
+          : undefined);
+
       return (
-        <FrappeProvider baseURL={baseURL} socketPort={socketPort} auth={cfg.auth}>
+        <FrappeProvider baseURL={baseURL} socketPort={socketPort} auth={auth}>
           {children}
         </FrappeProvider>
       );