houseaccount 0.8.1 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eb93eb6916d764185a9a842424a967a999a604c13f69c4fd1e55520732238a5e
-  data.tar.gz: 18f86ddd7092b5c594a5384cef3071eead026ac4b3af0ac92d74cd5edb24d4ac
+  metadata.gz: eda698b249d0a859fdd7e065f4eb5e03b80aac58f18427980f71fc4afa64544d
+  data.tar.gz: 5235bd2a69be8fccb8c1e0d0eb084211a8ac5300ffc38d4a9f5b1c7d74f48313
 SHA512:
-  metadata.gz: b491d90baf039dc87e9cb31acac22b61753c9f669a7c3a497c7f54cc717b4668ee15775cbb7b96f796165ce5fe376a361c503880804377908e962d6ed27bfd89
-  data.tar.gz: fba487c0cd2d2b2e7982c8c7c0edb2f766ef7e88a36fb3067785a671aa2857253f2a83b67a291f9ecde777a939d6ae8e1e4d60758644c032a479be25c7f2f22d
+  metadata.gz: 5098a845c0501400495e7cd5452ba5d6ed070d7bffd0f511ea424e525df08ed34782e5cc70a7a4462d4962eb14fc357c5f1df013116720e3a784242ee19ecf6b
+  data.tar.gz: 6923638ae33a328473bb3e343d9296fbf3b332c2f722c6bc9c7a77cb35c258a8fe1943f00204166d1a0458a34b4de48c426360f8e4ab9bf706d6fdc567881e9c

data/CHANGELOG.md

@@ -7,6 +7,25 @@ For more information about changelogs, check [Keep a Changelog](http://keepachan
 
 ## [Unreleased]
 
+## 0.9.0 - 2026-09-14
+
+* [Breaking change] A one-time code carries the line for the phone again
+
+  0.8.0 took `@host #code` out because it is plainly visible in the message that arrives.
+  Visible is what it is for: it is Apple's own format, it tells a reader which site the code
+  belongs to, and it binds the code to that domain so no other site can ask for it. Without
+  it iOS falls back to guessing at the text, which it does not do reliably — the suggestion
+  above the keyboard stopped appearing. `HouseAccount.one_time_code` takes `host:` again,
+  defaulting to the application's own.
+
+* [Fix] A seventh digit leaves no bar behind in the first slot
+
+  The real field lies transparently across all six slots, and its hidden text sits crammed
+  against the left edge rather than under them. A keystroke iOS cannot place answers by
+  selecting inside that field, and the grab handles it draws for a selection are its own to
+  paint — so one surfaced over the first slot. The selection is collapsed back to the end
+  once the code is whole.
+
 ## 0.8.1 - 2026-09-14
 
 * [Fix] The wall is drawn again after a page Turbo morphs

data/README.md

@@ -20,10 +20,10 @@ gem install houseaccount
 
 ```ruby
 # Gemfile
-gem 'houseaccount', '~> 0.8.1'
+gem 'houseaccount', '~> 0.9.0'
 ```
 
-`~> 0.8.0` stops short of `0.9`, since below 1.0 a minor release may break whatever it likes.
+`~> 0.9.0` stops short of `0.10`, since below 1.0 a minor release may break whatever it likes.
 Rails 8.1 and Ruby 3.2 are the minimum.
 
 A page takes the gem's layout, and wears the same head:
@@ -60,7 +60,7 @@ which Pages redirects away from.
 
 With the gem in the bundle an app serves `/css/houseaccount.css`, `/js/houseaccount.js`,
 `/theme/*`, `/font/*`, `/logo/*` and `/favicon/*` itself — and its own version's copy under
-`/v0.8.1/`, which is what the head helper links, cached for a year — answers a 400, 404, 406, 422 or 500
+`/v0.9.0/`, which is what the head helper links, cached for a year — answers a 400, 404, 406, 422 or 500
 with the house's own page, and has these helpers in every view:
 
 ```erb
@@ -181,13 +181,15 @@ HouseAccount::Message.new side: :left, text: answer.note, sender: 'Claude', at:
 ```
 
 A code sent to a phone is the same words from every app, `HouseAccount.one_time_code`, in
-each voice they are said in. `written` is the one sentence a person reads; `spoken` is that
-same sentence with its digits one at a time, so a listener can write them down. The words are
+each voice they are said in. `written` is the sentence a person reads and, under it, the
+`@host #code` line that offers the code above the keyboard on the phone it arrived on;
+`spoken` is the sentence alone, its digits one at a time so a listener can write them down.
+The host is the application's default one unless `host:` says otherwise, and the words are
 the gem's `config/locales` entry.
 
 ```ruby
 HouseAccount.one_time_code(contact.pin).written
-# => "Enter this 6-digit code to proceed: 482913"
+# => "Enter this 6-digit code to proceed: 482913\n\n@houseaccount.com #482913"
 HouseAccount.one_time_code(contact.pin).spoken
 # => "Enter this 6-digit code to proceed: 4, 8, 2, 9, 1, 3"
 ```
@@ -203,8 +205,8 @@ Those follow the latest release. Every release is also kept whole under its own
 forever and cached for a year, for a page that would rather move on its own terms:
 
 ```html
-<link rel='stylesheet' href='https://design.houseaccount.com/v0.8.1/css/houseaccount.css'>
-<script type='module' src='https://design.houseaccount.com/v0.8.1/js/houseaccount.js'></script>
+<link rel='stylesheet' href='https://design.houseaccount.com/v0.9.0/css/houseaccount.css'>
+<script type='module' src='https://design.houseaccount.com/v0.9.0/js/houseaccount.js'></script>
 ```
 
 A host with a Content Security Policy allows that origin for `style-src`, `script-src` and

data/config/locales/houseaccount.en.yml

@@ -4,7 +4,10 @@ en:
     ask: Ask a question
     close: Close
     okay: Okay
-    one_time_code: 'Enter this 6-digit code to proceed: %{pin}'
+    one_time_code: |-
+      Enter this 6-digit code to proceed: %{pin}
+
+      @%{host} #%{pin}
     send: Send
     spoken_one_time_code: 'Enter this 6-digit code to proceed: %{pin}'
     typing: Typing

data/lib/houseaccount/version.rb

@@ -1,4 +1,4 @@
 module HouseAccount
   # Version of the gem, read by the gemspec and by hosts checking compatibility.
-  VERSION = '0.8.1'
+  VERSION = '0.9.0'
 end

data/lib/houseaccount.rb

@@ -29,10 +29,14 @@ module HouseAccount
     MARKS.key?(name) ? name : :houseaccount
   end
 
-  # The one sentence that carries a 6-digit code to a phone, written as a person reads it and
-  # spoken a digit at a time so a listener can write it down.
-  def self.one_time_code(pin)
-    Copy.new written: I18n.t('houseaccount.one_time_code', pin:),
+  # The words that carry a 6-digit code to a phone, in both voices. `written` is the sentence
+  # a person reads and, under it, the line Safari matches against the page about to be filled,
+  # `@host #code`, which offers the code above the keyboard so nobody leaves for Messages to
+  # copy it. `spoken` is the sentence alone, its digits one at a time so a listener can write
+  # them down, and without a line meant for a phone rather than a person. Every app of the
+  # house that sends a code sends these, from `config/locales`.
+  def self.one_time_code(pin, host: Rails.application.default_url_options[:host])
+    Copy.new written: I18n.t('houseaccount.one_time_code', pin:, host:),
              spoken: I18n.t('houseaccount.spoken_one_time_code', pin: pin.chars.join(', '))
   end
 end

data/public/index.html

@@ -66,8 +66,8 @@
           </div>
           <div class='col-12'>
             <div class='card p-3'>
-              <strong>Pinned to a version — the latest is 0.8.1</strong>
-              <span class='design-url'>https://design.houseaccount.com/v0.8.1/css/houseaccount.css · /v0.8.1/js/houseaccount.js · /v0.8.1/theme/nord.css</span>
+              <strong>Pinned to a version — the latest is 0.9.0</strong>
+              <span class='design-url'>https://design.houseaccount.com/v0.9.0/css/houseaccount.css · /v0.9.0/js/houseaccount.js · /v0.9.0/theme/nord.css</span>
               <span class='small fg-2 mt-1'>Every release stays at its own prefix forever, whole and cached for a year, for a page that moves on its own terms. The unversioned paths follow the latest.</span>
             </div>
           </div>