ruby_everywhere 0.12.0 → 0.14.0

data/lib/everywhere/tab_filter.rb

@@ -33,7 +33,7 @@ module Everywhere
     # rebuild, no app-store release. Wrap the registration in `to_prepare` so a
     # reload in development doesn't leave the block closed over stale constants.
     def tabs(&block)
-      raise ArgumentError, "Everywhere.tabs needs a block — Everywhere.tabs { |tabs, ctx| … }" unless block
+      raise ArgumentError, "Everywhere.tabs needs a block: Everywhere.tabs { |tabs, ctx| … }" unless block
 
       @tabs_filter = block
     end
@@ -68,7 +68,7 @@ module Everywhere
     # Return nil for a signed-out request. Runs at most once per request.
     def current_user(&block)
       unless block
-        raise ArgumentError, "Everywhere.current_user needs a block — it registers the resolver " \
+        raise ArgumentError, "Everywhere.current_user needs a block. It registers the resolver " \
                              "(ask a RequestContext for the user itself: ctx.current_user)"
       end
 

data/lib/everywhere/version.rb

@@ -3,7 +3,7 @@
 require "json"
 
 module Everywhere
-  VERSION = "0.12.0"
+  VERSION = "0.14.0"
 
   # Version of the @rubyeverywhere/bridge JS this gem ships. bridge/ in the
   # gem IS the npm package (served to Rails apps by Everywhere::Engine,

data/support/agents/AGENTS.md

@@ -6,7 +6,7 @@ shells are Hotwire Native, and all three are driven from one config file
 (`config/everywhere.yml`), one CLI (`every`, aliased `rbe`), and one JavaScript API
 (`Everywhere`) with server-side helpers to match.
 
-**The web app is the source of truth.** You do not edit the shells — you edit the app, its
+**The web app is the source of truth.** You do not edit the shells. You edit the app, its
 views, and the config. Full docs: <https://rubyeverywhere.com/docs>.
 
 ### How this app reaches its users: {{MODE}} mode
@@ -32,7 +32,7 @@ Things that bite:
   the sentence iOS shows when asking, or the build fails.
 - **`tabs:` and `rules:` deploy with the web app.** They're baked into the bundle *and* served
   live from `/everywhere/ios_v1.json` and `/everywhere/android_v1.json`, so changing a tab or a
-  presentation rule ships with your next deploy — no app-store release.
+  presentation rule ships with your next deploy. No app-store release.
 - Most other keys (`window`, `menu`, `tray`, `permissions`, `appearance`) are read at build
   time and do need a new build.
 
@@ -53,7 +53,7 @@ namespaces `auth`, `clipboard`, `haptics`, `permissions`, `biometrics`, `instanc
 and `updates` (`check`/`install`/`setChannel`/`on`).
 
 Reach for the bridge when something has to happen in response to JS. For anything you can
-render, prefer the markup above — it's CSP-safe, correct on first paint, and works in a
+render, prefer the markup above: it's CSP-safe, correct on first paint, and works in a
 browser without a code path of its own.
 
 ### Commands
@@ -64,24 +64,24 @@ Run these from the app root.
 | --- | --- |
 | `every dev` | Dev server plus native shells on demand, live reload (`--desktop --ios --android --mobile --browser`) |
 | `every doctor` | Check the toolchain before a first build |
-| `every build` | Build the native shells — desktop, or `--ios` / `--android` |
+| `every build` | Build the native shells: desktop, or `--ios` / `--android` |
 | `every logs` | Stream shell logs from the iOS Simulator or an Android device |
 | `every icon` | Generate `.icns` / `.ico` / Linux icons from a source PNG |
 | `every release` | Sign, notarize, staple, and emit `dist/release.json` |
 | `every publish` | Publish a release to the app's update bucket |
 | `every clean` | Remove the shell build caches |
 
-`every dev` never packages anything — it runs the ordinary dev server and points the shells
+`every dev` never packages anything: it runs the ordinary dev server and points the shells
 at it, so the edit-refresh loop is unchanged.
 
 Two directories are build output, never source: `dist/` (artifacts) and `~/.rubyeverywhere`
-(stamped shell projects and caches). Don't commit them, don't hand-edit them — the next build
+(stamped shell projects and caches). Don't commit them, don't hand-edit them; the next build
 overwrites both.
 
 ### Config `every install` touched
 
 These exist so this codebase can also be compiled and shipped on-device, and several of them
-look like mistakes if you don't know that. Leave them in place — full rationale at
+look like mistakes if you don't know that. Leave them in place; full rationale at
 <https://rubyeverywhere.com/docs>.
 
 {{FRAMEWORK_NOTES}}

data/support/agents/frameworks/hanami-views.md

@@ -2,25 +2,25 @@
 
 The ERB helpers (`native_app?`, `everywhere_nav_button`, `everywhere_fab`, …) ship with the
 Rails engine, so they aren't available here. The markup contract behind them is public,
-though, and the shell watches for it on every Turbo visit — write it directly:
+though, and the shell watches for it on every Turbo visit, so write it directly:
 
 - `data-everywhere-nav-button` (+ `-nav-title`, `-nav-icon`, `-nav-icon-ios`,
-  `-nav-icon-android`, `-nav-style`, `side`) — lifts a link or submit button into the top
+  `-nav-icon-android`, `-nav-style`, `side`): lifts a link or submit button into the top
   navigation bar. Tapping the native control clicks your element.
 - `data-everywhere-nav-menu` with `data-everywhere-menu-item` children (+ `-menu-title`,
-  `-menu-style`) — a native pull-down menu.
-- `data-everywhere-menu` + `-menu-trigger` + `-menu-items` — an in-content action sheet.
-- `data-everywhere-haptic` — a tap haptic.
+  `-menu-style`): a native pull-down menu.
+- `data-everywhere-menu` + `-menu-trigger` + `-menu-items`: an in-content action sheet.
+- `data-everywhere-haptic`: a tap haptic.
 - `data-everywhere-biometric-lock` (+ `-content`, `-locked`, `-unlock`, `-reason`,
-  `-passcode`) — the Face ID / Touch ID gate.
+  `-passcode`): the Face ID / Touch ID gate.
 - `<meta name="everywhere:badge">` and `<meta name="everywhere:tab-badge">` (JSON
-  `{path, count}`) — app-icon and tab badges, CSP-safe and correct on first paint.
+  `{path, count}`): app-icon and tab badges, CSP-safe and correct on first paint.
 
 Detect the shell server-side from the User-Agent: the shells prepend
 `RubyEverywhere/<version> (<os>)` to Hotwire Native's own marker. Client-side, use
 `Everywhere.platform` / `Everywhere.native`.
 
-`public/native.css`, served via `Rack::Static`, carries the styling helpers — including
+`public/native.css`, served via `Rack::Static`, carries the styling helpers, including
 `.everywhere-titlebar-inset` for `window.title_bar: overlay`. Hanami's CSP forbids inline
 scripts, so every bit of this has to be attributes and external files; that's the same reason
 the markup contract exists in the first place.

data/support/agents/frameworks/hanami.md

@@ -1,5 +1,5 @@
-- `native_boot.rb` — the packaged-app entry point. Keep it thin and keep it at the app root.
-- `public/bridge.js` and `public/native.css` — the bridge, vendored and refreshed on each
+- `native_boot.rb`: the packaged-app entry point. Keep it thin and keep it at the app root.
+- `public/bridge.js` and `public/native.css`: the bridge, vendored and refreshed on each
   `every install`. Serve `public/` via `Rack::Static` and load `/bridge.js` as an **external**
   module; Hanami's CSP forbids inline scripts.
 

data/support/agents/frameworks/rails-views.md

@@ -2,7 +2,7 @@
 
 `Everywhere::Engine` mixes a set of helpers into every view. **Prefer these over hand-written
 markup or JavaScript.** They render a real link or button that works in a browser, and carry
-the `data-everywhere-*` attributes the shell lifts into native chrome — tapping the native
+the `data-everywhere-*` attributes the shell lifts into native chrome. Tapping the native
 control just clicks the element it mirrors, so behavior is defined once and CSP is never an
 issue.
 
@@ -13,15 +13,15 @@ names an SF Symbol and a Material Symbol respectively.
 
 | Helper | |
 | --- | --- |
-| `native_app?` | any shell — iOS, Android, or desktop. "Not a browser tab." |
+| `native_app?` | any shell: iOS, Android, or desktop. "Not a browser tab." |
 | `mobile_app?` | a phone: safe-area insets, the native tab bar, biometrics, the OAuth handoff |
 | `desktop_app?` | the desktop window: title bar, menu bar, pointer |
 | `native_platform` | `:ios`, `:android`, `:desktop`, or `nil` in a browser |
 | `mobile_platform` | `:ios`, `:android`, or `nil` (including on desktop) |
-| `native_version` | the shell's version as a `Gem::Version` — gate features that need a newer shell |
+| `native_version` | the shell's version as a `Gem::Version`, to gate features that need a newer shell |
 
 Detection is by User-Agent, so it's correct on the server before the JS bridge has booted.
-Hiding a web nav in favor of native chrome is usually `mobile_app?`, not `native_app?` — the
+Hiding a web nav in favor of native chrome is usually `mobile_app?`, not `native_app?`; the
 desktop shell has no native navigation to replace it with.
 
 **Navigation bar.** Renders in the page for browsers; the shell hides the in-page copy and
@@ -49,7 +49,7 @@ makes it a Turbo method link, `type: :submit` with `form:` submits a form, and
 **In-content controls.**
 
 ```erb
-<%# floating action button — fixed, safe-area-aware, tap haptic in the shell %>
+<%# floating action button: fixed, safe-area-aware, tap haptic in the shell %>
 <%= everywhere_fab new_note_path, icon: :plus, label: "New note" %>
 <%= everywhere_fab compose_path, icon: :pencil, label: "Compose", extended: true %>
 
@@ -61,7 +61,7 @@ makes it a Turbo method link, `type: :submit` with `form:` submits a form, and
 ```
 
 `everywhere_fab` accepts `icon:` (a built-in line glyph), `label:` (accessible name, plus a
-visible pill with `extended: true`), `side:`, and `haptic:` — or a block for custom content.
+visible pill with `extended: true`), `side:`, and `haptic:`, or a block for custom content.
 
 **Badges.** Server-rendered meta tags the bridge applies on every Turbo visit; `0` clears.
 
@@ -92,7 +92,7 @@ redirect_to everywhere_auth_redirect(after_authentication_url)
 ```
 
 **Tab bar, per request.** `Everywhere.tabs { |tabs, ctx| … }` in an initializer (inside
-`to_prepare`) builds the mobile tab bar — return the list to serve, or `[]` to hide the bar.
+`to_prepare`) builds the mobile tab bar. Return the list to serve, or `[]` to hide the bar.
 `ctx` carries `platform`, `session`/`cookies`, and `current_user` (register the lookup once
 with `Everywhere.current_user { |ctx| … }`). `ctx.tab("Name")` pulls in a tab declared
 `visible: false` in `everywhere.yml`.

data/support/agents/frameworks/rails.md

@@ -1,16 +1,16 @@
-- `native_boot.rb` — the packaged-app entry point. Keep it thin and keep it at the app root.
-- `config/initializers/everywhere.rb` — packaged-only public-path and session-store setup.
-- `config/boot.rb` — bootsnap guarded with `unless ENV["NATIVE_PACKAGED"]` (its cache dir is
+- `native_boot.rb`: the packaged-app entry point. Keep it thin and keep it at the app root.
+- `config/initializers/everywhere.rb`: packaged-only public-path and session-store setup.
+- `config/boot.rb`: bootsnap guarded with `unless ENV["NATIVE_PACKAGED"]` (its cache dir is
   read-only when packaged).
-- `config/environments/production.rb` — `force_ssl` and `assume_ssl` are `false`, because a
+- `config/environments/production.rb`: `force_ssl` and `assume_ssl` are `false`, because a
   packaged app's webview talks plain HTTP to `127.0.0.1`.
-- `config/puma.rb` — keep-alives off when packaged; WebKit reuses connections Puma has closed.
-- `config/database.yml` — the production SQLite path reads
+- `config/puma.rb`: keep-alives off when packaged; WebKit reuses connections Puma has closed.
+- `config/database.yml`: the production SQLite path reads
   `<%= ENV.fetch("NATIVE_STORAGE_DIR", "storage") %>`. Any database you add should use the same
   lookup.
-- `app/javascript/application.js` — imports the bridge and exposes it as `window.Everywhere`.
+- `app/javascript/application.js`: imports the bridge and exposes it as `window.Everywhere`.
 
 One rule that matters in every mode: the bridge is served and importmap-pinned by
 `Everywhere::Engine` straight from the gem, so it updates with `bundle update ruby_everywhere`.
-Don't vendor it into `vendor/javascript/` or pin it in `config/importmap.rb` — a local copy
+Don't vendor it into `vendor/javascript/` or pin it in `config/importmap.rb`; a local copy
 shadows the engine's and freezes the app on an old bridge.

data/support/agents/frameworks/sinatra-views.md

@@ -2,19 +2,19 @@
 
 The ERB helpers (`native_app?`, `everywhere_nav_button`, `everywhere_fab`, …) ship with the
 Rails engine, so they aren't available here. The markup contract behind them is public,
-though, and the shell watches for it on every Turbo visit — write it directly:
+though, and the shell watches for it on every Turbo visit, so write it directly:
 
 - `data-everywhere-nav-button` (+ `-nav-title`, `-nav-icon`, `-nav-icon-ios`,
-  `-nav-icon-android`, `-nav-style`, `side`) — lifts a link or submit button into the top
+  `-nav-icon-android`, `-nav-style`, `side`): lifts a link or submit button into the top
   navigation bar. Tapping the native control clicks your element.
 - `data-everywhere-nav-menu` with `data-everywhere-menu-item` children (+ `-menu-title`,
-  `-menu-style`) — a native pull-down menu.
-- `data-everywhere-menu` + `-menu-trigger` + `-menu-items` — an in-content action sheet.
-- `data-everywhere-haptic` — a tap haptic.
+  `-menu-style`): a native pull-down menu.
+- `data-everywhere-menu` + `-menu-trigger` + `-menu-items`: an in-content action sheet.
+- `data-everywhere-haptic`: a tap haptic.
 - `data-everywhere-biometric-lock` (+ `-content`, `-locked`, `-unlock`, `-reason`,
-  `-passcode`) — the Face ID / Touch ID gate.
+  `-passcode`): the Face ID / Touch ID gate.
 - `<meta name="everywhere:badge">` and `<meta name="everywhere:tab-badge">` (JSON
-  `{path, count}`) — app-icon and tab badges, CSP-safe and correct on first paint.
+  `{path, count}`): app-icon and tab badges, CSP-safe and correct on first paint.
 
 Detect the shell server-side from the User-Agent: the shells prepend
 `RubyEverywhere/<version> (<os>)` to Hotwire Native's own marker. Client-side, use

data/support/agents/frameworks/sinatra.md

@@ -1,5 +1,5 @@
-- `native_boot.rb` — the packaged-app entry point. Keep it thin and keep it at the app root.
-- `public/bridge.js` and `public/native.css` — the bridge, vendored and refreshed on each
+- `native_boot.rb`: the packaged-app entry point. Keep it thin and keep it at the app root.
+- `public/bridge.js` and `public/native.css`: the bridge, vendored and refreshed on each
   `every install`. Load it with `<script type="module" src="/bridge.js"></script>`.
 
 Rack apps vary too much for the CLI to auto-edit their boot files, so the rest is by hand and

data/support/agents/modes/local.md

@@ -2,8 +2,8 @@ The app itself is compiled into the shipped binary and runs on the user's machin
 the shells pointing at a deployed site. Shipping a change means cutting a new build and
 release.
 
-That trade brings constraints the docs cover properly — a read-only application filesystem
-with a separate writable data directory, SQLite only, desktop only — so read
+That trade brings constraints the docs cover properly: a read-only application filesystem
+with a separate writable data directory, SQLite only, desktop only. Read
 <https://rubyeverywhere.com/docs> before changing anything that writes to disk, boots the app,
 or touches `native_boot.rb`. The short version: anything written at runtime belongs under
 `ENV.fetch("NATIVE_STORAGE_DIR", "storage")`, and `ENV["NATIVE_PACKAGED"]` is the guard for

data/support/agents/modes/remote.md

@@ -2,7 +2,7 @@ The native shells are a thin wrapper around the deployed site at `remote.url` in
 `config/everywhere.yml`. Nothing about the app is compiled into them.
 
 **So you are working on an ordinary web app.** Ship a change by deploying as you always have,
-and users see it on their next launch — no rebuild, no app-store review. Normal databases,
+and users see it on their next launch. No rebuild, no app-store review. Normal databases,
 background jobs, and hosting all apply, unchanged.
 
 Only three things are native-specific, and they're all covered below: what
@@ -10,5 +10,5 @@ Only three things are native-specific, and they're all covered below: what
 `Everywhere` JavaScript API. Of those, tab and path-rule changes deploy with the app; the rest
 of `config/everywhere.yml` needs a new build of the shells.
 
-Remote is also the only mode mobile supports — iOS and Android are always a shell around a
+Remote is also the only mode mobile supports: iOS and Android are always a shell around a
 deployed app.

data/support/desktop/src-tauri/src/updater.rs

@@ -480,7 +480,7 @@ fn verify_signature(path: &Path, signature: &str, public_key: &str) -> Result<()
     let pk = minisign_verify::PublicKey::from_base64(public_key)
         .map_err(|e| format!("bad updates.public_key: {e}"))?;
     let sig = minisign_verify::Signature::decode(signature)
-        .map_err(|e| format!("bad manifest signature: {e}"))?;
+        .map_err(|e| format!("unreadable artifact signature: {e}"))?;
     let data = std::fs::read(path).map_err(|e| e.to_string())?;
     pk.verify(&data, &sig, false)
         .map_err(|_| "signature verification FAILED — artifact does not match the app's signing key".to_string())

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby_everywhere
 version: !ruby/object:Gem::Version
-  version: 0.12.0
+  version: 0.14.0
 platform: ruby
 authors:
 - Andrea Fomera