catalyst-core 1.1.0 → 1.2.0-canary.1

package/changelog.md

@@ -1,6 +1,14 @@
 # Changelog
 
-## [1.0.2] - unreleased
+## [1.1.0] - 2026-10-22
+
+This release contains everything in 1.0.2, namely the HTML splash screen, experimental WebMCP support and the new CLI output, plus one fix. There are no breaking API changes.
+
+### Fixes
+
+- `WebMcpProvider` no longer throws `useRouterState must be used within a RouterDataProvider` on every page under `catalyst serve`. A production build can load Catalyst's router context twice, once inlined in the app's server bundle and once from `catalyst-core/webmcp`, and the two copies did not share state. The context is now shared across copies.
+
+## [1.0.2] - 2026-10-22
 
 This release adds two opt-in features, an animated HTML splash screen for universal apps and experimental WebMCP support, and gives every CLI command the same terminal output. There are no breaking API changes.
 
@@ -34,6 +42,24 @@ The root entry of `catalyst-core` adds `useRouterState`, which returns `{ locati
 
 New apps declare `"type": "module"`, and the Tailwind template's config is `postcss.config.cjs`. `catalyst-core` loads either `postcss.config.cjs` or `postcss.config.js`, so existing apps need no change. `create-catalyst-app` declares `node >= 20.12.0` and runs across that range.
 
+## [1.0.1] - 2026-10-08
+
+This release fixes Android edge-to-edge and brings on-device AI to iOS through `catalyst-ai` 1.0.1. There are no breaking API changes, but apps that converted safe-area insets from device pixels should read the edge-to-edge section.
+
+### On-device AI on iOS
+
+`useNativeAI` and `useAI({ provider: "native" })` now run on-device on iOS. Set `ai.enabled: true` in `WEBVIEW_CONFIG`, install `catalyst-ai`, and build the iOS app as usual. Two engines sit behind the same hook. LiteRT-LM runs Gemma 4 E2B by default and downloads the model, about 2.6 GB, once. Apple Foundation Models needs no download and runs on iOS 26 or later on Apple Intelligence devices. The default `engine: "auto"` uses LiteRT-LM if its model is already downloaded, then Foundation Models if it is available, and otherwise LiteRT-LM with a download. The providers `litert` and `foundation-models` pin one engine. Installing `catalyst-ai` without `ai.enabled` adds nothing to the iOS build. Device requirements are in the `catalyst-ai` README.
+
+### Android edge-to-edge
+
+With `WEBVIEW_CONFIG.edgeToEdge.enabled`, the WebView now draws under transparent system bars instead of opaque ones, and the bottom inset stays stable while the keyboard is open. `useSafeArea()` and the `X-Safe-Area-*` headers report insets in CSS pixels, and 0 when edge-to-edge is disabled. Apps that divided the insets by `devicePixelRatio` should remove that. The new `edgeToEdge.statusBarStyle` option (`auto`, `dark-content`, `light-content`) sets the system bar icon colour.
+
+### Fixes
+
+- Dependency updates clear security advisories in `compression`, `proxy-addr` (through `express`) and `source-map-js`.
+- `catalyst-core` can be installed from a git branch. Its `prepare` script no longer reads files outside the package.
+- The 0.3 to 1.0 upgrade guide and the MCP server's upgrade context are corrected.
+
 ## [1.0.0] - 2026-09-29
 
 This release freezes the public API. The root entry of `catalyst-core` now exports exactly eight names and nothing else: `RouterDataProvider`, `useCurrentRouteData`, `useRouterData`, `MetaTag`, `split`, `hydrationReady`, `Head`, and `Body`. Anything previously reachable through the root entry but not in that list is no longer public. Applications that import a removed name will fail at build time rather than silently resolving to `undefined`.

package/dist/native/androidProject/app/src/main/java/io/yourname/androidproject/CustomWebview.kt

@@ -1,8 +1,10 @@
 package io.yourname.androidproject
 
+import android.Manifest
 import android.annotation.SuppressLint
 import android.content.Context
 import android.content.Intent
+import android.content.pm.PackageManager
 import android.graphics.Bitmap
 import android.net.Uri
 import android.os.Bundle
@@ -11,6 +13,10 @@ import android.view.GestureDetector
 import android.view.MotionEvent
 import android.view.View
 import android.webkit.*
+import androidx.activity.ComponentActivity
+import androidx.activity.result.ActivityResultLauncher
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.core.content.ContextCompat
 import androidx.webkit.ServiceWorkerClientCompat
 import androidx.webkit.ServiceWorkerControllerCompat
 import androidx.webkit.WebViewCompat
@@ -43,6 +49,11 @@ class CustomWebView(
     private val job = SupervisorJob()
     override val coroutineContext = Dispatchers.Main + job
 
+    // navigator.geolocation prompt waiting on the runtime permission result
+    private var pendingGeolocationCallback: GeolocationPermissions.Callback? = null
+    private var pendingGeolocationOrigin: String? = null
+    private var geolocationPermissionLauncher: ActivityResultLauncher<Array<String>>? = null
+
     private var cacheManager: WebCacheManager
     private var offlineCacheService: OfflineCacheService
     private val metricsMonitor = MetricsMonitor.getInstance(context)
@@ -84,6 +95,10 @@ class CustomWebView(
         }
         setupFromProperties()
         cacheManager = WebCacheManager(context, properties)
+        // Must register before the activity is STARTED; CustomWebView is built in onCreate.
+        if (context is ComponentActivity) {
+            initializeGeolocationPermissionLauncher(context)
+        }
         if (profilerEnabled) metricsMonitor.attachWebView(webView)
         offlineCacheService = OfflineCacheService(context)
         setupWebView()
@@ -338,6 +353,30 @@ class CustomWebView(
         }
     }
 
+    private fun initializeGeolocationPermissionLauncher(activity: ComponentActivity) {
+        geolocationPermissionLauncher = activity.registerForActivityResult(
+            ActivityResultContracts.RequestMultiplePermissions()
+        ) { permissions ->
+            val granted = permissions.values.any { it }
+            val callback = pendingGeolocationCallback
+            val origin = pendingGeolocationOrigin
+            pendingGeolocationCallback = null
+            pendingGeolocationOrigin = null
+            if (callback != null && origin != null) {
+                if (BuildConfig.DEBUG) {
+                    Log.d(TAG, "Geolocation permission result: granted=$granted")
+                }
+                callback.invoke(origin, granted, false)
+            }
+        }
+    }
+
+    private fun hasLocationPermission(): Boolean =
+        ContextCompat.checkSelfPermission(context, Manifest.permission.ACCESS_FINE_LOCATION) ==
+            PackageManager.PERMISSION_GRANTED ||
+            ContextCompat.checkSelfPermission(context, Manifest.permission.ACCESS_COARSE_LOCATION) ==
+            PackageManager.PERMISSION_GRANTED
+
     fun destroy() {
         job.cancel()
         metricsMonitor.detachWebView()
@@ -794,6 +833,9 @@ class CustomWebView(
             domStorageEnabled = true
             allowFileAccess = true
             allowContentAccess = true
+            // navigator.geolocation; the OS permission is only declared when
+            // WEBVIEW_CONFIG.location.enabled is set (see buildAndroid/assets.js).
+            setGeolocationEnabled(true)
             setSupportZoom(false)
             builtInZoomControls = false
             displayZoomControls = false
@@ -1279,6 +1321,36 @@ class CustomWebView(
                 return true
             }
 
+            override fun onGeolocationPermissionsShowPrompt(
+                origin: String?,
+                callback: GeolocationPermissions.Callback?
+            ) {
+                if (BuildConfig.DEBUG) {
+                    Log.d(TAG, "Geolocation permission requested for origin: $origin")
+                }
+                if (hasLocationPermission()) {
+                    callback?.invoke(origin, true, false)
+                    return
+                }
+                val launcher = geolocationPermissionLauncher
+                if (launcher == null || callback == null || origin == null) {
+                    callback?.invoke(origin, false, false)
+                    return
+                }
+                // Deny any prompt still waiting so its page doesn't hang
+                pendingGeolocationCallback?.invoke(pendingGeolocationOrigin, false, false)
+                pendingGeolocationCallback = callback
+                pendingGeolocationOrigin = origin
+                // Without the permission in the manifest (location disabled), Android
+                // returns denied immediately and no dialog is shown.
+                launcher.launch(
+                    arrayOf(
+                        Manifest.permission.ACCESS_FINE_LOCATION,
+                        Manifest.permission.ACCESS_COARSE_LOCATION
+                    )
+                )
+            }
+
             override fun onPermissionRequest(request: PermissionRequest) {
                 if (BuildConfig.DEBUG) {
                     Log.d(TAG, "Permission request from web content: ${request.resources?.joinToString()}")

package/dist/native/buildAndroid/assets.js

@@ -545,6 +545,28 @@ function createAssetsPhase(ctx) {
       progress.log(`Warning: Error cleaning notification assets: ${error.message}`, "warning");
     }
   }
+
+  // ── Location helpers ──────────────────────────────────────────────────────
+
+  const LOCATION_PERMISSIONS = ["android.permission.ACCESS_FINE_LOCATION", "android.permission.ACCESS_COARSE_LOCATION"];
+
+  // Location permissions are only declared when WEBVIEW_CONFIG.location.enabled is
+  // true, so apps that never use navigator.geolocation don't ship them.
+  async function processLocation(WEBVIEW_CONFIG) {
+    const manifestPath = `${pwd}/androidProject/app/src/main/AndroidManifest.xml`;
+    try {
+      let manifestContent = fs.readFileSync(manifestPath, "utf8");
+      manifestContent = manifestContent.split("\n").filter(line => !LOCATION_PERMISSIONS.some(permission => line.includes(`<uses-permission android:name="${permission}"`))).join("\n");
+      if (WEBVIEW_CONFIG.location?.enabled) {
+        const permissionsXml = LOCATION_PERMISSIONS.map(permission => `    <uses-permission android:name="${permission}" />`).join("\n");
+        manifestContent = manifestContent.replace(/(<uses-permission[^>]*>[\s\S]*?)(\s*<uses-feature)/, `$1\n${permissionsXml}$2`);
+        progress.log("Added location permissions to AndroidManifest.xml", "success");
+      }
+      fs.writeFileSync(manifestPath, manifestContent);
+    } catch (error) {
+      progress.log(`Warning: Error processing location permissions: ${error.message}`, "warning");
+    }
+  }
   return {
     copyBuildAssets,
     copySplashscreenAssets,
@@ -552,7 +574,8 @@ function createAssetsPhase(ctx) {
     copySplashHtml,
     copyIconAssets,
     configureAppName,
-    processNotifications
+    processNotifications,
+    processLocation
   };
 }
 module.exports = createAssetsPhase;

package/dist/native/buildAndroid/index.js

@@ -66,7 +66,8 @@ function createAndroidBuild(config) {
     copySplashHtml,
     copyIconAssets,
     configureAppName,
-    processNotifications
+    processNotifications,
+    processLocation
   } = createAssetsPhase(ctx);
   const {
     detectPhysicalDevice,
@@ -164,6 +165,7 @@ function createAndroidBuild(config) {
         log: (message, status = "info") => progress.log(message, status)
       });
       await processNotifications(wvConfig);
+      await processLocation(wvConfig);
       progress.log(`Build optimization: ${buildOptimisation ? "Enabled" : "Disabled"}`, "info");
       syncAIPackageIfEnabled(wvConfig, progress);
       progress.complete("copyAssets");
@@ -241,6 +243,7 @@ function createAndroidBuild(config) {
         log: (message, status = "info") => progress.log(message, status)
       });
       await processNotifications(wvConfig);
+      await processLocation(wvConfig);
       syncAIPackageIfEnabled(wvConfig, progress);
       progress.log("buildAndroidForTesting complete — project ready for gradlew test", "success");
       return {

package/dist/native/buildIos/config.js

@@ -77,6 +77,7 @@ function generateSwiftProperty(key, value, indent = "    ") {
 
 // ─── Module factory ───────────────────────────────────────────────────────────
 
+const DEFAULT_LOCATION_USAGE_DESCRIPTION = "This app needs your location to provide location-based services";
 module.exports = function createConfigPhase(ctx) {
   const {
     WEBVIEW_CONFIG,
@@ -365,6 +366,11 @@ INFOPLIST_KEY_UISupportedInterfaceOrientations_iPhone = UIInterfaceOrientationPo
       restoreManagedFileFromBaseline(plistPath);
       const plistObject = readPlistObject(plistPath);
       plistObject.CFBundleDisplayName = iosConfig.appName || "Catalyst Application";
+      // WKWebView's navigator.geolocation needs this key; without it iOS never prompts.
+      // Restored from baseline above, so it disappears when location is turned off.
+      if (WEBVIEW_CONFIG.location?.enabled) {
+        plistObject.NSLocationWhenInUseUsageDescription = WEBVIEW_CONFIG.location.usageDescription || DEFAULT_LOCATION_USAGE_DESCRIPTION;
+      }
       mergeIntoTopLevelObject(plistObject, pluginInfoPlist, "ios.infoPlist");
       if (isGoogleSignInEnabled && resolvedReversedClientId) {
         mergeUrlSchemes(plistObject, [{

package/dist/offline/registerServiceWorker.js

@@ -9,6 +9,8 @@ export function registerCatalystServiceWorker() {
     if (registered) return
     if (typeof window === "undefined" || typeof navigator === "undefined") return
     if (process.env.NODE_ENV !== "production") return
+    // Replaced at build time from config.json (see getClientEnvVariables).
+    if (process.env.OFFLINE_SNAPSHOTS_ENABLE === false) return
     if (isNativeWebView()) return
     if (!("serviceWorker" in navigator)) return