hibira-rails 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: ec8dd25bdad390a25709965fcd822ac5882f32a09ba94ae218a61f0f3bf88463
+  data.tar.gz: 0f75219446b55e2a1385861a14e69bc33a7f77eefc6642099ba33f9a38326345
+SHA512:
+  metadata.gz: 90e64f04f5b36d52f038dce3c950730b3b85a182981969dd41764bb9626f4e9f03dc2d1f6190959175d294dc4e9c1c7fd05cbe38b13ea63a3a11800da49ef89d
+  data.tar.gz: 0743615164b04d789f48c40eac56507c92a8462bdc212f9d2638698f916833ee25083527858103b007b4ec5f6faf8dae85fcd9bc9dc370e710d0ab5b25bc9b9b

data/CHANGELOG.md

@@ -0,0 +1,17 @@
+# Changelog
+
+## 0.1.0
+
+- Turbo Streams over Hibira: every Turbo broadcast (`broadcasts_to`,
+  `broadcast_*_to`, `broadcasts_refreshes`, the `_later` jobs) goes to a
+  private Hibira channel, and `turbo_stream_from` subscribes through Hibira.
+  No Action Cable server or Redis needed.
+- Broadcasts over the app's event size limit are sent as a Turbo page refresh
+  (`config.oversize`).
+- Channel auth for your own private and presence channels
+  (`config.authorize_channel`, `POST /hibira/auth`).
+- Verified webhooks, including the previous secret during rotation
+  (`Hibira.on_webhook`, `POST /hibira/webhooks`).
+- `Hibira.push` and push user tokens (`GET /hibira/push/token`).
+- `bin/rails generate hibira:install` and `bin/rails hibira:check`.
+- Rails 7.0 to 8.1.

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hibira
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,215 @@
+# hibira-rails
+
+[![ci](https://github.com/hibira-io/rails/actions/workflows/ci.yml/badge.svg)](https://github.com/hibira-io/rails/actions/workflows/ci.yml)
+
+Hotwire Turbo Streams over [Hibira](https://hibira.io), with no Action Cable
+server, Redis or Solid Cable to run.
+
+Hibira is a hosted realtime service that speaks the Pusher Channels protocol.
+This gem sends every Turbo Stream broadcast your app already makes through
+Hibira, and makes `turbo_stream_from` subscribe through it. Your models and
+views stay as they are. It also signs your own private and presence
+channels, verifies webhooks and serves push notification tokens.
+
+Supports Rails 7.0 to 8.1 (Ruby 3.1+) and turbo-rails 1.5 to 2.
+
+## Install
+
+```sh
+bundle add hibira-rails
+bin/rails generate hibira:install
+```
+
+The generator writes `config/initializers/hibira.rb`, pins `pusher-js` (or
+installs it with your package manager in a jsbundling app) and imports the
+`hibira/turbo` module after `@hotwired/turbo-rails` in
+`app/javascript/application.js`.
+
+Copy the app ID, key and secret from your app page on
+[hibira.io/portal](https://hibira.io/portal) (the free plan needs no card)
+into the environment:
+
+```sh
+HIBIRA_APP_ID=your-app-id
+HIBIRA_APP_KEY=your-app-key
+HIBIRA_APP_SECRET=your-app-secret
+```
+
+or into `bin/rails credentials:edit`:
+
+```yaml
+hibira:
+  app_id: your-app-id
+  key: your-app-key
+  secret: your-app-secret
+```
+
+Then check them:
+
+```sh
+bin/rails hibira:check
+```
+
+## Turbo Streams
+
+Nothing changes in your code. This model and view, straight from the Turbo
+handbook, now update every open page through Hibira:
+
+```ruby
+class Message < ApplicationRecord
+  belongs_to :room
+  broadcasts_to :room
+end
+```
+
+```erb
+<%= turbo_stream_from @room %>
+<div id="messages"><%= render @room.messages %></div>
+```
+
+`broadcast_append_to`, `broadcast_replace_later_to`, `broadcasts_refreshes`
+and the rest all go through Hibira, from requests and from Active Job alike.
+
+Each Turbo stream maps to one private channel. `turbo_stream_from` renders a
+`<hibira-turbo-stream-source>` element holding the signed stream name, and the
+browser can only subscribe with it (checked at `POST /hibira/turbo/auth`), the
+same rule Action Cable applies. The app secret never leaves the server.
+
+Turbo goes through Hibira whenever the credentials are set, except in the
+test environment, where Turbo's `assert_turbo_stream_broadcasts` keeps working
+on Action Cable. Force it either way:
+
+```ruby
+Hibira.configure do |config|
+  config.turbo = true # or false
+end
+```
+
+A `turbo_stream_from` with a custom Action Cable channel
+(`turbo_stream_from @room, channel: RoomChannel`) still uses Action Cable.
+
+### Large broadcasts
+
+Each plan has an event size limit (4 KB on Free). When a Turbo Stream is
+larger, the gem sends a Turbo 8 page refresh instead, so open pages still
+catch up. For pages with long lists, `broadcasts_refreshes` with
+`turbo_refreshes_with method: :morph` keeps every broadcast tiny:
+
+```ruby
+class Room < ApplicationRecord
+  broadcasts_refreshes
+end
+```
+
+Set `config.oversize = :log` to drop large broadcasts instead, or `:raise`
+to raise `Hibira::PayloadTooLarge`.
+
+## Your own channels
+
+`Hibira.trigger` is the pusher-http-ruby client, already pointed at Hibira:
+
+```ruby
+Hibira.trigger("orders", "order-shipped", { id: 1024 })
+Hibira.client.channel_info("presence-room.1", info: "user_count")
+```
+
+To sign private and presence channels, set `authorize_channel`. It receives
+the channel name and the controller, which inherits from your
+`ApplicationController`, so `current_user` and CSRF protection work as usual:
+
+```ruby
+Hibira.configure do |config|
+  config.authorize_channel = lambda do |channel, controller|
+    user = controller.send(:current_user)
+    case channel
+    when /\Aprivate-user\.(\d+)\z/ then user&.id == $1.to_i
+    when /\Apresence-room\.(\d+)\z/ then user && { user_id: user.id, user_info: { name: user.name } }
+    end
+  end
+end
+```
+
+In the browser, reuse the client the Turbo module created:
+
+```erb
+<%# in your layout, for pages without turbo_stream_from %>
+<%= hibira_meta_tags %>
+```
+
+```js
+import { hibira } from "hibira/turbo"
+
+hibira().subscribe("private-user.42").bind("order-shipped", (order) => console.log(order))
+```
+
+It authorizes at `POST /hibira/auth` with the page's CSRF token. For presence
+rooms with thousands of members, use a `presence-large-*` channel and
+[`@hibira-io/large-presence`](https://github.com/hibira-io/large-presence-js).
+
+## Webhooks
+
+Add `https://your-app.example.com/hibira/webhooks` on your app page →
+Webhooks, then handle events in an initializer:
+
+```ruby
+Hibira.on_webhook("channel_vacated") do |event|
+  Room.find_by(channel: event["channel"])&.close!
+end
+
+Hibira.on_webhook { |event| Rails.logger.info("Hibira: #{event['name']}") } # every event
+```
+
+The signature is checked against your app secret. While a rotated-out secret
+is in its grace period, Hibira also signs with the old one
+(`X-Hibira-Previous-Signature`), so webhooks keep arriving until you
+redeploy. Each event is also instrumented as `webhook.hibira` with
+`ActiveSupport::Notifications`.
+
+## Push notifications
+
+Enable push on your app page (Push notifications), upload your APNs key or
+FCM service account there, add `gem "pusher-push-notifications"` and set:
+
+```sh
+HIBIRA_PUSH_INSTANCE_ID=your-instance-id
+HIBIRA_PUSH_SECRET_KEY=your-secret-key
+```
+
+```ruby
+Hibira.push.publish_to_users(
+  users: [order.user_id.to_s],
+  payload: {
+    apns: { aps: { alert: { title: "Order shipped", body: "Order ##{order.id} is on its way." } } },
+    fcm: { notification: { title: "Order shipped", body: "Order ##{order.id} is on its way." } },
+    web: { notification: { title: "Order shipped", body: "Order ##{order.id} is on its way.", deep_link: order_url(order) } }
+  }
+)
+```
+
+`GET /hibira/push/token?user_id=…` returns a user token for `setUserId` in the
+web, Android and iOS SDKs. It answers only for the signed-in user
+(`current_user` or `Current.user`; change it with `config.push_user_id`).
+
+## Settings
+
+| Setting | Environment | Default |
+| --- | --- | --- |
+| `app_id`, `key`, `secret` | `HIBIRA_APP_ID`, `HIBIRA_APP_KEY`, `HIBIRA_APP_SECRET` | |
+| `host` | `HIBIRA_HOST` | `ws.hibira.io` (or `ws-<cluster>.hibira.io`, as shown on your app page) |
+| `port`, `use_tls` | `HIBIRA_PORT`, `HIBIRA_USE_TLS` | `443`, `true` |
+| `turbo` | | `:auto` |
+| `oversize` | | `:refresh` |
+| `authorize_channel` | | refuses all |
+| `push_instance_id`, `push_secret_key` | `HIBIRA_PUSH_INSTANCE_ID`, `HIBIRA_PUSH_SECRET_KEY` | |
+| `push_endpoint` | `HIBIRA_PUSH_ENDPOINT` | `https://<host>` |
+| `push_user_id` | | `current_user&.id` or `Current.user&.id` |
+| `parent_controller` | | `"ApplicationController"` |
+| `draw_routes`, `route_prefix` | | `true`, `"hibira"` |
+| `client_options` | | `{}` (passed to `Pusher::Client.new`) |
+
+Values set in `Hibira.configure` win over the environment, which wins over
+credentials.
+
+## License
+
+MIT

data/app/controllers/hibira/channel_auth_controller.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Hibira
+  # Signs subscriptions to your own private- and presence- channels through
+  # Hibira.config.authorize_channel. Inherits from your ApplicationController
+  # (Hibira.config.parent_controller), so current_user, the session and CSRF
+  # protection work as in the rest of your app.
+  class ChannelAuthController < Hibira.config.parent_controller.constantize
+    def create
+      channel_name = params[:channel_name].to_s
+      socket_id = params[:socket_id].to_s
+      authorize = Hibira.config.authorize_channel
+
+      return head(:forbidden) if authorize.nil? || Hibira::Turbo.turbo_channel?(channel_name)
+      return head(:forbidden) unless channel_name.start_with?("private-", "presence-")
+
+      result = authorize.call(channel_name, self)
+      return head(:forbidden) unless result
+
+      if channel_name.start_with?("presence-")
+        return head(:forbidden) unless result.is_a?(Hash) && result.with_indifferent_access[:user_id].present?
+
+        render json: Hibira.client.authenticate(channel_name, socket_id, presence_data(result))
+      else
+        render json: Hibira.client.authenticate(channel_name, socket_id)
+      end
+    rescue ::Pusher::Error
+      head :unprocessable_entity
+    end
+
+    private
+
+    def presence_data(result)
+      result = result.with_indifferent_access
+      { user_id: result[:user_id].to_s, user_info: result[:user_info] || {} }
+    end
+  end
+end

data/app/controllers/hibira/push_tokens_controller.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Hibira
+  # Returns a Beams user token for the signed-in user, for setUserId in the
+  # web, Android and iOS SDKs, at GET /hibira/push/token. The SDKs pass
+  # ?user_id=, which must be the signed-in user's push user ID
+  # (Hibira.config.push_user_id).
+  class PushTokensController < Hibira.config.parent_controller.constantize
+    def show
+      user_id = Hibira.config.push_user_id.call(self)&.to_s
+      return head(:unauthorized) if user_id.blank?
+      return head(:unauthorized) unless ActiveSupport::SecurityUtils.secure_compare(user_id, params[:user_id].to_s)
+
+      render json: Hibira.push.generate_token(user: user_id)
+    end
+  end
+end

data/app/controllers/hibira/turbo_auth_controller.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Hibira
+  # Signs subscriptions to Turbo stream channels. The signed stream name that
+  # turbo_stream_from rendered is the credential, as it is for Action Cable,
+  # so this needs no session and no CSRF token.
+  class TurboAuthController < ActionController::Base
+    skip_forgery_protection
+
+    def create
+      stream_name = ::Turbo::StreamsChannel.verified_stream_name(params[:signed_stream_name].to_s)
+      channel_name = params[:channel_name].to_s
+
+      if stream_name && channel_name == Hibira::Turbo.channel_name(stream_name)
+        render json: Hibira.client.authenticate(channel_name, params[:socket_id].to_s)
+      else
+        head :forbidden
+      end
+    rescue ::Pusher::Error
+      head :unprocessable_entity
+    end
+  end
+end

data/app/controllers/hibira/webhooks_controller.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Hibira
+  # Receives Hibira webhooks at POST /hibira/webhooks. Add that URL on your
+  # app page → Webhooks. Each verified event runs the Hibira.on_webhook
+  # handlers for its name and is instrumented as "webhook.hibira".
+  class WebhooksController < ActionController::Base
+    skip_forgery_protection
+
+    def create
+      webhook = Hibira::Webhook.new(request.env)
+      return head(:unauthorized) unless webhook.valid?
+
+      events = begin
+        webhook.events
+      rescue JSON::ParserError
+        return head(:bad_request)
+      end
+
+      events.each do |event|
+        ActiveSupport::Notifications.instrument("webhook.hibira", event: event, time_ms: webhook.time_ms) do
+          (Hibira.webhook_handlers[event["name"]] + Hibira.webhook_handlers["*"]).each do |handler|
+            handler.call(event)
+          end
+        end
+      end
+
+      head :ok
+    end
+  end
+end

data/app/javascript/hibira/turbo.js

@@ -0,0 +1,144 @@
+// Turbo Streams over Hibira.
+//
+// Defines <hibira-turbo-stream-source>, which turbo_stream_from renders when
+// the hibira-rails gem is set up. Each element subscribes to its stream's
+// private channel and hands every "turbo-stream" event to Turbo, the way
+// <turbo-cable-stream-source> does for Action Cable.
+//
+//   import "@hotwired/turbo-rails"
+//   import "hibira/turbo"
+
+import { Turbo } from "@hotwired/turbo-rails"
+import Pusher from "pusher-js"
+
+const EVENT = "turbo-stream"
+const UNSUBSCRIBE_DELAY = 1000 // keeps the channel across a Turbo visit to a page with the same stream
+
+let client = null
+const streams = new Map() // channel name → { channel, elements, signedStreamName, authEndpoint, timer }
+
+const META = { Key: "hibira-key", Host: "hibira-host", Port: "hibira-port", Tls: "hibira-tls", AuthEndpoint: "hibira-auth-endpoint" }
+
+// A connection setting from the element's data-hibira-* attributes, falling
+// back to the hibira_meta_tags meta tags.
+function setting(element, name) {
+  const value = element?.dataset?.[`hibira${name}`]
+  if (value != null && value !== "") return value
+  return document.querySelector(`meta[name="${META[name]}"]`)?.content
+}
+
+function csrfToken() {
+  return document.querySelector('meta[name="csrf-token"]')?.content
+}
+
+async function authorize({ socketId, channelName }, callback) {
+  const stream = streams.get(channelName)
+  const endpoint = stream ? stream.authEndpoint : setting(null, "AuthEndpoint") || "/hibira/auth"
+  const body = new URLSearchParams({ socket_id: socketId, channel_name: channelName })
+  if (stream) body.set("signed_stream_name", stream.signedStreamName)
+
+  const headers = { Accept: "application/json" }
+  const token = csrfToken()
+  if (token) headers["X-CSRF-Token"] = token
+
+  try {
+    const response = await fetch(endpoint, { method: "POST", headers, body, credentials: "same-origin" })
+    if (!response.ok) throw new Error(`Hibira auth for ${channelName} failed with ${response.status}`)
+    callback(null, await response.json())
+  } catch (error) {
+    callback(error, null)
+  }
+}
+
+// The shared pusher-js client, created from the first stream source element
+// or, without one, from the hibira_meta_tags meta tags. Use it for your own
+// channels too: hibira().subscribe("presence-room.1").
+export function hibira(element = null) {
+  if (client) return client
+
+  const key = setting(element, "Key")
+  if (!key) throw new Error("Hibira: no app key. Set HIBIRA_APP_KEY, or add <%= hibira_meta_tags %> to your layout.")
+
+  const tls = setting(element, "Tls") !== "false"
+  const port = Number(setting(element, "Port") || (tls ? 443 : 80))
+  client = new Pusher(key, {
+    cluster: "hkg", // required by pusher-js, unused once wsHost is set
+    wsHost: setting(element, "Host") || "ws.hibira.io",
+    wsPort: port,
+    wssPort: port,
+    forceTLS: tls,
+    enabledTransports: ["ws", "wss"],
+    channelAuthorization: { customHandler: authorize },
+  })
+  return client
+}
+
+class HibiraTurboStreamSourceElement extends HTMLElement {
+  static observedAttributes = ["channel-name", "signed-stream-name"]
+
+  connectedCallback() {
+    Turbo.connectStreamSource(this)
+    this.subscribe()
+  }
+
+  disconnectedCallback() {
+    Turbo.disconnectStreamSource(this)
+    this.unsubscribe()
+  }
+
+  attributeChangedCallback() {
+    if (this.subscribedTo) {
+      this.unsubscribe()
+      this.subscribe()
+    }
+  }
+
+  subscribe() {
+    const name = this.getAttribute("channel-name")
+    if (!name) return
+
+    let stream = streams.get(name)
+    if (!stream) {
+      stream = { elements: new Set(), timer: null }
+      streams.set(name, stream)
+    }
+    stream.signedStreamName = this.getAttribute("signed-stream-name")
+    stream.authEndpoint = setting(this, "AuthEndpoint")
+    clearTimeout(stream.timer)
+    stream.channel ||= hibira(this).subscribe(name)
+
+    this.receive = (data) => this.dispatchEvent(new MessageEvent("message", { data }))
+    this.connected = () => this.setAttribute("connected", "")
+    stream.channel.bind(EVENT, this.receive)
+    stream.channel.bind("pusher:subscription_succeeded", this.connected)
+    if (stream.channel.subscribed) this.connected()
+
+    stream.elements.add(this)
+    this.subscribedTo = name
+  }
+
+  unsubscribe() {
+    const name = this.subscribedTo
+    const stream = name && streams.get(name)
+    this.subscribedTo = null
+    this.removeAttribute("connected")
+    if (!stream) return
+
+    stream.channel.unbind(EVENT, this.receive)
+    stream.channel.unbind("pusher:subscription_succeeded", this.connected)
+    stream.elements.delete(this)
+
+    if (stream.elements.size === 0) {
+      clearTimeout(stream.timer)
+      stream.timer = setTimeout(() => {
+        if (stream.elements.size > 0) return
+        client?.unsubscribe(name)
+        streams.delete(name)
+      }, UNSUBSCRIBE_DELAY)
+    }
+  }
+}
+
+if (customElements.get("hibira-turbo-stream-source") === undefined) {
+  customElements.define("hibira-turbo-stream-source", HibiraTurboStreamSourceElement)
+}

data/config/importmap.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+pin "hibira/turbo", to: "hibira/turbo.js"

data/lib/generators/hibira/install/install_generator.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+
+module Hibira
+  module Generators
+    # bin/rails generate hibira:install
+    class InstallGenerator < ::Rails::Generators::Base
+      source_root File.expand_path("templates", __dir__)
+
+      desc "Sets up Hibira: an initializer, pusher-js and the hibira/turbo JavaScript module."
+
+      class_option :skip_install, type: :boolean, default: false, desc: "Don't install pusher-js"
+
+      def create_initializer
+        template "hibira.rb", "config/initializers/hibira.rb"
+      end
+
+      def install_javascript
+        if importmap?
+          run "bin/importmap pin pusher-js" unless options[:skip_install]
+          import_in_application_js 'import "hibira/turbo"'
+        elsif File.exist?(File.join(destination_root, "package.json"))
+          copy_file File.expand_path("../../../../app/javascript/hibira/turbo.js", __dir__), "app/javascript/hibira/turbo.js"
+          run "#{package_manager} pusher-js" unless options[:skip_install]
+          import_in_application_js 'import "./hibira/turbo"'
+        else
+          say "No importmap or package.json found. Load pusher-js and the hibira/turbo module " \
+              "(#{File.expand_path('../../../../app/javascript/hibira/turbo.js', __dir__)}) yourself.", :yellow
+        end
+      end
+
+      def show_next_steps
+        say <<~TEXT
+
+          Hibira is installed. Copy the app ID, key and secret from your app page on
+          https://hibira.io/portal into the environment:
+
+            HIBIRA_APP_ID=your-app-id
+            HIBIRA_APP_KEY=your-app-key
+            HIBIRA_APP_SECRET=your-app-secret
+
+          or into bin/rails credentials:edit under hibira: (app_id, key, secret).
+          Then check them with:
+
+            bin/rails hibira:check
+        TEXT
+      end
+
+      private
+
+      def importmap?
+        File.exist?(File.join(destination_root, "config/importmap.rb"))
+      end
+
+      def package_manager
+        if File.exist?(File.join(destination_root, "bun.lockb")) || File.exist?(File.join(destination_root, "bun.lock"))
+          "bun add"
+        elsif File.exist?(File.join(destination_root, "yarn.lock"))
+          "yarn add"
+        elsif File.exist?(File.join(destination_root, "pnpm-lock.yaml"))
+          "pnpm add"
+        else
+          "npm install"
+        end
+      end
+
+      def import_in_application_js(line)
+        path = "app/javascript/application.js"
+        full = File.join(destination_root, path)
+        unless File.exist?(full)
+          say "Add #{line} to your JavaScript entry point after @hotwired/turbo-rails.", :yellow
+          return
+        end
+        return if File.read(full).include?(line)
+
+        if File.read(full).match?(%r{^import ["']@hotwired/turbo-rails["'].*$})
+          inject_into_file path, "\n#{line}", after: %r{^import ["']@hotwired/turbo-rails["'].*$}
+        else
+          append_to_file path, "#{line}\n"
+        end
+      end
+    end
+  end
+end

data/lib/generators/hibira/install/templates/hibira.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+# Hibira reads HIBIRA_APP_ID, HIBIRA_APP_KEY, HIBIRA_APP_SECRET and HIBIRA_HOST
+# from the environment, then hibira: in your credentials. Anything set here
+# wins. See https://github.com/hibira-io/rails for every option.
+Hibira.configure do |config|
+  # Turbo Streams go through Hibira whenever the credentials are set (except
+  # in tests). Set true or false to force it.
+  # config.turbo = :auto
+
+  # A broadcast over your plan's event size limit is sent as a Turbo page
+  # refresh instead. Or :log to drop it, :raise to raise.
+  # config.oversize = :refresh
+
+  # Authorize your own private- and presence- channels (POST /hibira/auth).
+  # config.authorize_channel = lambda do |channel, controller|
+  #   user = controller.send(:current_user)
+  #   case channel
+  #   when /\Aprivate-user\.(\d+)\z/ then user&.id == $1.to_i
+  #   when /\Apresence-room\.(\d+)\z/ then user && { user_id: user.id, user_info: { name: user.name } }
+  #   end
+  # end
+end
+
+# Hibira.on_webhook("channel_vacated") do |event|
+#   Rails.logger.info "#{event['channel']} is empty"
+# end

data/lib/hibira/check.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Hibira
+  # Checks the settings and credentials, for bin/rails hibira:check.
+  module Check
+    module_function
+
+    # Returns [ok, lines].
+    def run(config = Hibira.config)
+      lines = []
+      ok = true
+
+      if config.configured?
+        lines << "ok    App #{config.app_id} on #{config.host}:#{config.port}"
+        begin
+          Hibira.client.channels
+          lines << "ok    Credentials accepted by the REST API"
+        rescue ::Pusher::AuthenticationError
+          ok = false
+          lines << "fail  The app key or secret was refused. Copy them again from your app page on hibira.io/portal."
+        rescue ::Pusher::Error => e
+          ok = false
+          lines << "fail  Could not reach #{config.host}: #{e.message}"
+        end
+      else
+        ok = false
+        lines << "fail  Missing #{config.missing.join(', ')} (environment or credentials hibira:)"
+      end
+
+      lines << if config.turbo?
+                 "ok    Turbo Streams go through Hibira"
+               else
+                 "info  Turbo Streams use Action Cable (turbo: #{config.turbo.inspect})"
+               end
+
+      lines << if config.push_configured?
+                 "ok    Push notifications set up (#{config.push_endpoint})"
+               else
+                 "info  Push notifications off (set HIBIRA_PUSH_INSTANCE_ID and HIBIRA_PUSH_SECRET_KEY)"
+               end
+
+      [ok, lines]
+    end
+  end
+end

data/lib/hibira/configuration.rb

@@ -0,0 +1,134 @@
+# frozen_string_literal: true
+
+module Hibira
+  # Settings for Hibira. Each one falls back to an environment variable and
+  # then to `hibira:` in Rails credentials, so an app that sets HIBIRA_APP_ID,
+  # HIBIRA_APP_KEY and HIBIRA_APP_SECRET needs no initializer at all.
+  class Configuration
+    # The app ID, key and secret from your app page on https://hibira.io.
+    attr_writer :app_id, :key, :secret
+
+    # The WebSocket host shown on the app page: ws.hibira.io for the default
+    # cluster, or ws-<cluster>.hibira.io for apps in another region. The
+    # REST API is served on the same host.
+    attr_writer :host, :port, :use_tls
+
+    # Send Turbo Stream broadcasts (broadcasts_to, broadcast_append_to,
+    # broadcasts_refreshes, ...) through Hibira instead of Action Cable, and
+    # make turbo_stream_from subscribe through Hibira. The default, :auto,
+    # does so whenever the credentials are set, except in the test
+    # environment, where Turbo's own broadcast assertions keep working on
+    # Action Cable. true forces it on, false off.
+    attr_accessor :turbo
+
+    # What to do when a Turbo Stream broadcast is larger than the app's event
+    # size limit (Hibira answers 413): :refresh sends a Turbo 8 page refresh
+    # instead, :log logs and drops it, :raise raises Hibira::PayloadTooLarge.
+    attr_accessor :oversize
+
+    # Called by the channel auth endpoint (POST /hibira/auth) for private-
+    # and presence- channels that are not Turbo streams. Receives the channel
+    # name and the controller (for current_user, session, params). Return
+    # false or nil to refuse, true to allow a private channel, or a hash such
+    # as { user_id: 1, user_info: { name: "Aiko" } } for a presence channel.
+    attr_accessor :authorize_channel
+
+    # Push notifications: from the app page → Push notifications.
+    attr_writer :push_instance_id, :push_secret_key, :push_endpoint
+
+    # Resolves the signed-in user's push user ID for GET /hibira/push/token
+    # (setUserId in the web, Android and iOS SDKs). Receives the controller;
+    # return nil when nobody is signed in. Defaults to the ID of current_user
+    # (Devise and most auth gems) or Current.user (the Rails 8 generator).
+    attr_accessor :push_user_id
+
+    # The controller the channel auth and push token endpoints inherit from,
+    # for current_user and your sign-in filters. Defaults to
+    # "ApplicationController".
+    attr_accessor :parent_controller
+
+    # Extra options passed to Pusher::Client.new (timeouts, http_proxy, ...).
+    attr_accessor :client_options
+
+    # The routes for Turbo and channel auth, webhooks and push tokens are drawn
+    # under /hibira. Set draw_routes to false to draw your own.
+    attr_accessor :draw_routes, :route_prefix
+
+    def initialize
+      @turbo = :auto
+      @oversize = :refresh
+      @client_options = {}
+      @parent_controller = "ApplicationController"
+      @draw_routes = true
+      @route_prefix = "hibira"
+      @push_user_id = lambda do |controller|
+        user = if controller.respond_to?(:current_user, true)
+                 controller.send(:current_user)
+               elsif defined?(::Current) && ::Current.respond_to?(:user)
+                 ::Current.user
+               end
+        user&.id
+      end
+    end
+
+    def app_id = setting(:@app_id, "HIBIRA_APP_ID", :app_id)
+    def key = setting(:@key, "HIBIRA_APP_KEY", :key)
+    def secret = setting(:@secret, "HIBIRA_APP_SECRET", :secret)
+    def host = setting(:@host, "HIBIRA_HOST", :host) || "ws.hibira.io"
+    def port = Integer(setting(:@port, "HIBIRA_PORT", :port) || (use_tls ? 443 : 80))
+
+    def use_tls
+      value = setting(:@use_tls, "HIBIRA_USE_TLS", :use_tls)
+      value.nil? || !%w[false 0 no off].include?(value.to_s.downcase)
+    end
+
+    def push_instance_id = setting(:@push_instance_id, "HIBIRA_PUSH_INSTANCE_ID", :push_instance_id)
+    def push_secret_key = setting(:@push_secret_key, "HIBIRA_PUSH_SECRET_KEY", :push_secret_key)
+
+    def push_endpoint
+      setting(:@push_endpoint, "HIBIRA_PUSH_ENDPOINT", :push_endpoint) || "https://#{host}"
+    end
+
+    # Whether Turbo Streams go through Hibira right now (see #turbo).
+    def turbo?
+      return turbo == true unless turbo == :auto
+
+      configured? && !(defined?(::Rails) && ::Rails.respond_to?(:env) && ::Rails.env.test?)
+    end
+
+    # True when the app ID, key and secret are all set.
+    def configured?
+      [app_id, key, secret].none? { |v| v.nil? || v.to_s.empty? }
+    end
+
+    def push_configured?
+      [push_instance_id, push_secret_key].none? { |v| v.nil? || v.to_s.empty? }
+    end
+
+    # Names of the realtime settings that are still blank.
+    def missing
+      { "HIBIRA_APP_ID" => app_id, "HIBIRA_APP_KEY" => key, "HIBIRA_APP_SECRET" => secret }
+        .select { |_, v| v.nil? || v.to_s.empty? }.keys
+    end
+
+    private
+
+    def setting(ivar, env, credential)
+      value = instance_variable_get(ivar)
+      return value unless value.nil?
+
+      value = ENV[env]
+      return value unless value.nil? || value.empty?
+
+      credentials&.dig(credential)&.then { |v| v.to_s.empty? ? nil : v }
+    end
+
+    def credentials
+      return unless defined?(::Rails) && ::Rails.respond_to?(:application) && ::Rails.application
+
+      ::Rails.application.credentials.hibira
+    rescue StandardError
+      nil
+    end
+  end
+end

data/lib/hibira/engine.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require "rails/engine"
+# Turbo::StreamsChannel subclasses ActionCable::Channel::Base, so the
+# constants must load even in apps generated with --skip-action-cable. No
+# Action Cable server is mounted or needed.
+require "action_cable"
+
+module Hibira
+  class Engine < ::Rails::Engine
+    initializer "hibira.assets" do |app|
+      if app.config.respond_to?(:assets)
+        app.config.assets.paths << root.join("app/javascript")
+        app.config.assets.precompile += %w[hibira/turbo.js] if app.config.assets.respond_to?(:precompile)
+      end
+    end
+
+    initializer "hibira.importmap", before: "importmap" do |app|
+      if app.config.respond_to?(:importmap)
+        app.config.importmap.paths << root.join("config/importmap.rb")
+        app.config.importmap.cache_sweepers << root.join("app/javascript")
+      end
+    end
+
+    initializer "hibira.helpers" do
+      ActiveSupport.on_load(:action_view) do
+        include Hibira::StreamsHelper
+      end
+    end
+
+    # The Hibira routes are drawn straight into the app's routes (like Active
+    # Storage's), under Hibira.config.route_prefix.
+    initializer "hibira.routes" do |app|
+      app.routes.prepend do
+        next unless Hibira.config.draw_routes
+
+        scope Hibira.config.route_prefix, module: "hibira", as: "hibira" do
+          post "turbo/auth" => "turbo_auth#create", as: :turbo_auth
+          post "auth" => "channel_auth#create", as: :channel_auth
+          post "webhooks" => "webhooks#create", as: :webhooks
+          get "push/token" => "push_tokens#show", as: :push_token
+        end
+      end
+    end
+
+    config.to_prepare do
+      if defined?(::Turbo::StreamsChannel)
+        singleton = ::Turbo::StreamsChannel.singleton_class
+        singleton.prepend(Hibira::Turbo::Broadcasts) unless singleton < Hibira::Turbo::Broadcasts
+      end
+      if defined?(::Turbo::StreamsHelper) && !(::Turbo::StreamsHelper < Hibira::TurboStreamFrom)
+        ::Turbo::StreamsHelper.prepend(Hibira::TurboStreamFrom)
+      end
+    end
+  end
+end

data/lib/hibira/streams_helper.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+module Hibira
+  module StreamsHelper
+    # Like turbo_stream_from, but subscribes through Hibira:
+    #
+    #   <%= hibira_turbo_stream_from @room %>
+    #
+    # Renders a <hibira-turbo-stream-source> element, which the hibira/turbo
+    # JavaScript module turns into a subscription to the stream's private
+    # channel. While Turbo goes through Hibira (config.turbo, on whenever the
+    # credentials are set), turbo_stream_from renders this too, so existing
+    # views need no change.
+    def hibira_turbo_stream_from(*streamables, **attributes)
+      raise ArgumentError, "streamables can't be blank" unless streamables.any?(&:present?)
+
+      stream_name = ::Turbo::StreamsChannel.send(:stream_name_from, streamables)
+      attributes.delete(:channel)
+      attributes[:"signed-stream-name"] = ::Turbo::StreamsChannel.signed_stream_name(streamables)
+      attributes[:"channel-name"] = Hibira::Turbo.channel_name(stream_name)
+
+      tag.hibira_turbo_stream_source(**hibira_client_attributes, **attributes)
+    end
+
+    # Connection settings for the browser, as data attributes. The key is the
+    # public app key; the secret never leaves the server.
+    def hibira_client_attributes
+      config = Hibira.config
+      {
+        "data-hibira-key": config.key,
+        "data-hibira-host": config.host,
+        "data-hibira-port": config.port,
+        "data-hibira-tls": config.use_tls.to_s,
+        "data-hibira-auth-endpoint": hibira_route_path(:hibira_turbo_auth_path, "turbo/auth")
+      }
+    end
+
+    # Meta tags with the same settings, for your own pusher-js code:
+    #
+    #   <%= hibira_meta_tags %>
+    def hibira_meta_tags
+      config = Hibira.config
+      safe_join([
+        tag.meta(name: "hibira-key", content: config.key),
+        tag.meta(name: "hibira-host", content: config.host),
+        tag.meta(name: "hibira-port", content: config.port),
+        tag.meta(name: "hibira-tls", content: config.use_tls.to_s),
+        tag.meta(name: "hibira-auth-endpoint", content: hibira_route_path(:hibira_channel_auth_path, "auth"))
+      ], "\n")
+    end
+
+    private
+
+    def hibira_route_path(helper, fallback)
+      respond_to?(helper) ? public_send(helper) : "/#{Hibira.config.route_prefix}/#{fallback}"
+    end
+  end
+
+  # Prepended to Turbo::StreamsHelper so turbo_stream_from goes through
+  # Hibira while Hibira.config.turbo? is true. A custom Action Cable channel
+  # (turbo_stream_from @room, channel: RoomChannel) still uses Action Cable.
+  module TurboStreamFrom
+    def turbo_stream_from(*streamables, **attributes)
+      channel = attributes[:channel]&.to_s
+      if Hibira.config.turbo? && (channel.nil? || channel == "Turbo::StreamsChannel")
+        hibira_turbo_stream_from(*streamables, **attributes)
+      else
+        super
+      end
+    end
+  end
+end

data/lib/hibira/turbo.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require "digest"
+
+module Hibira
+  # Turbo Streams over Hibira. Each Turbo stream name maps to one private
+  # channel, so a browser can only subscribe with the signed stream name that
+  # turbo_stream_from rendered for it, the same rule Action Cable applies.
+  module Turbo
+    EVENT = "turbo-stream"
+    CHANNEL_PREFIX = "private-turbo-"
+    REFRESH = '<turbo-stream action="refresh"></turbo-stream>'
+
+    class << self
+      # Stream names hold characters channel names cannot ("gid://app/Room/1"),
+      # so the channel is named after a digest of the stream name.
+      def channel_name(stream_name)
+        "#{CHANNEL_PREFIX}#{Digest::SHA256.hexdigest(stream_name.to_s)}"
+      end
+
+      def turbo_channel?(channel_name)
+        channel_name.to_s.start_with?(CHANNEL_PREFIX)
+      end
+
+      def broadcast(stream_name, content)
+        Hibira.trigger(channel_name(stream_name), EVENT, content.to_s)
+      rescue ::Pusher::Error => e
+        raise unless e.message.include?("Payload Too Large")
+
+        oversized(stream_name, content, e)
+      end
+
+      private
+
+      def oversized(stream_name, content, error)
+        message = "[Hibira] Turbo Stream for #{stream_name.inspect} is #{content.to_s.bytesize} bytes, " \
+                  "over the app's event size limit"
+
+        case Hibira.config.oversize
+        when :raise
+          raise PayloadTooLarge, message
+        when :refresh
+          if content.to_s.include?('action="refresh"')
+            logger&.warn("#{message}; dropped")
+          else
+            logger&.warn("#{message}; sent a page refresh instead")
+            Hibira.trigger(channel_name(stream_name), EVENT, REFRESH)
+          end
+        else
+          logger&.warn("#{message}; dropped")
+        end
+        nil
+      end
+
+      def logger
+        defined?(::Rails) && ::Rails.respond_to?(:logger) ? ::Rails.logger : nil
+      end
+    end
+
+    # Prepended to Turbo::StreamsChannel's singleton class. Every Turbo
+    # broadcast (broadcast_*_to, broadcasts_to, broadcasts_refreshes and the
+    # _later jobs) ends in broadcast_stream_to, so this one override sends all
+    # of them to Hibira.
+    module Broadcasts
+      def broadcast_stream_to(*streamables, content:)
+        return super unless Hibira.config.turbo?
+
+        streamables = streamables.flatten.compact_blank
+        return if streamables.empty?
+
+        Hibira::Turbo.broadcast(stream_name_from(streamables), content)
+      end
+    end
+  end
+end

data/lib/hibira/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Hibira
+  VERSION = "0.1.0"
+end

data/lib/hibira/webhook.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require "json"
+require "openssl"
+require "active_support/security_utils"
+
+module Hibira
+  # A webhook post from Hibira. X-Pusher-Signature is the hex HMAC-SHA256 of
+  # the body made with the app's current secret. While a rotated-out secret
+  # is in its grace period, X-Hibira-Previous-Signature carries the same HMAC
+  # made with the old one, so an app that still has the old secret keeps
+  # accepting webhooks until it is redeployed.
+  class Webhook
+    SIGNATURE_HEADERS = %w[HTTP_X_PUSHER_SIGNATURE HTTP_X_HIBIRA_PREVIOUS_SIGNATURE].freeze
+
+    attr_reader :body
+
+    def initialize(env, key: Hibira.config.key, secret: Hibira.config.secret)
+      @env = env
+      @key = key.to_s
+      @secret = secret.to_s
+      input = env["rack.input"]
+      input.rewind if input.respond_to?(:rewind)
+      @body = input ? input.read.to_s : ""
+      input.rewind if input.respond_to?(:rewind)
+    end
+
+    def valid?
+      return false if @key.empty? || @secret.empty?
+      return false unless secure_compare(@key, @env["HTTP_X_PUSHER_KEY"].to_s)
+
+      expected = OpenSSL::HMAC.hexdigest("SHA256", @secret, body)
+      SIGNATURE_HEADERS.any? { |h| secure_compare(expected, @env[h].to_s) }
+    end
+
+    def payload
+      @payload ||= JSON.parse(body)
+    end
+
+    def events
+      Array(payload["events"]).select { |e| e.is_a?(Hash) && e["name"].is_a?(String) }
+    end
+
+    def time_ms
+      payload["time_ms"].to_i
+    end
+
+    private
+
+    def secure_compare(a, b)
+      a.bytesize == b.bytesize && ActiveSupport::SecurityUtils.secure_compare(a, b)
+    end
+  end
+end

data/lib/hibira-rails.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require "hibira"

data/lib/hibira.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+require "pusher"
+require "hibira/version"
+require "hibira/configuration"
+require "hibira/webhook"
+require "hibira/turbo"
+require "hibira/streams_helper"
+require "hibira/check"
+
+# Rails integration for Hibira (https://hibira.io): Turbo Streams, private and
+# presence channel auth, webhooks and push notifications over the Pusher
+# Channels protocol.
+module Hibira
+  class Error < StandardError; end
+  class MissingCredentials < Error; end
+  class PayloadTooLarge < Error; end
+
+  class << self
+    def config
+      @config ||= Configuration.new
+    end
+
+    def configure
+      yield config
+      reset!
+      config
+    end
+
+    # The pusher-http-ruby client, pointed at Hibira.
+    def client
+      @client ||= begin
+        unless config.configured?
+          raise MissingCredentials, "Hibira is not configured: set #{config.missing.join(', ')} " \
+                                    "(run bin/rails hibira:check)"
+        end
+
+        ::Pusher::Client.new(
+          app_id: config.app_id.to_s,
+          key: config.key,
+          secret: config.secret,
+          host: config.host,
+          port: config.port,
+          use_tls: config.use_tls,
+          **config.client_options
+        )
+      end
+    end
+
+    # Hibira.trigger("orders", "order-shipped", { id: 1024 })
+    def trigger(channels, event, data, params = {})
+      client.trigger(channels, event, data, params)
+    end
+
+    # The Beams-compatible push client, pointed at Hibira. Needs the
+    # pusher-push-notifications gem in your Gemfile.
+    def push
+      begin
+        require "pusher/push_notifications"
+      rescue LoadError
+        raise Error, "Add gem \"pusher-push-notifications\" to your Gemfile to send push notifications"
+      end
+      raise MissingCredentials, "Set HIBIRA_PUSH_INSTANCE_ID and HIBIRA_PUSH_SECRET_KEY" unless config.push_configured?
+
+      push = ::Pusher::PushNotifications
+      push.configure do |c|
+        c.instance_id = config.push_instance_id
+        c.secret_key = config.push_secret_key
+        c.endpoint = config.push_endpoint
+      end
+      push
+    end
+
+    # Runs the block for each verified webhook event with that name ("*" for
+    # all). Events are also instrumented as "webhook.hibira".
+    #
+    #   Hibira.on_webhook("channel_vacated") { |event| Room.close(event["channel"]) }
+    def on_webhook(name = "*", &block)
+      webhook_handlers[name.to_s] << block
+      block
+    end
+
+    def webhook_handlers
+      @webhook_handlers ||= Hash.new { |h, k| h[k] = [] }
+    end
+
+    def reset!
+      @client = nil
+    end
+  end
+end
+
+require "hibira/engine" if defined?(Rails::Engine)

data/lib/tasks/hibira.rake

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+namespace :hibira do
+  desc "Check the Hibira settings and credentials"
+  task check: :environment do
+    ok, lines = Hibira::Check.run
+    puts lines
+    exit 1 unless ok
+  end
+end

metadata

@@ -0,0 +1,150 @@
+--- !ruby/object:Gem::Specification
+name: hibira-rails
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Hibira
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: actioncable
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
+- !ruby/object:Gem::Dependency
+  name: pusher
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
+- !ruby/object:Gem::Dependency
+  name: railties
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
+- !ruby/object:Gem::Dependency
+  name: turbo-rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.5'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.5'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
+description: Sends Hotwire Turbo Stream broadcasts through Hibira, a hosted realtime
+  service that speaks the Pusher Channels protocol, with no Action Cable server or
+  Redis to run. Also signs private and presence channels, verifies webhooks and serves
+  push tokens.
+email:
+- github@hibira.io
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE
+- README.md
+- app/controllers/hibira/channel_auth_controller.rb
+- app/controllers/hibira/push_tokens_controller.rb
+- app/controllers/hibira/turbo_auth_controller.rb
+- app/controllers/hibira/webhooks_controller.rb
+- app/javascript/hibira/turbo.js
+- config/importmap.rb
+- lib/generators/hibira/install/install_generator.rb
+- lib/generators/hibira/install/templates/hibira.rb
+- lib/hibira-rails.rb
+- lib/hibira.rb
+- lib/hibira/check.rb
+- lib/hibira/configuration.rb
+- lib/hibira/engine.rb
+- lib/hibira/streams_helper.rb
+- lib/hibira/turbo.rb
+- lib/hibira/version.rb
+- lib/hibira/webhook.rb
+- lib/tasks/hibira.rake
+homepage: https://hibira.io
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://hibira.io
+  source_code_uri: https://github.com/hibira-io/rails
+  changelog_uri: https://github.com/hibira-io/rails/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/hibira-io/rails/issues
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.1'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: Turbo Streams, channel auth, webhooks and push notifications over Hibira
+  for Rails
+test_files: []