ruby_everywhere 0.2.0 → 0.4.0

data/support/mobile/ios/App/Bridge/MenuComponent.swift

@@ -0,0 +1,192 @@
+import Foundation
+import HotwireNative
+import UIKit
+import WebKit
+
+/// Bridge component backing `everywhere--menu`: the native chrome the page
+/// declares with `data-everywhere-nav-*` / `data-everywhere-menu` (the
+/// everywhere_nav_button / everywhere_nav_menu / everywhere_menu Rails helpers).
+///
+/// Two events, both replied to by echoing back the tapped item's id so the web
+/// half can `.click()` the element it mirrors — behavior stays defined once, in
+/// the page:
+///   * `navItems` — install left/right `UIBarButtonItem`s on THIS screen's
+///     navigation bar (plain buttons, and pull-down `UIMenu`s for overflow
+///     menus). Native re-replies to the same message on every tap.
+///   * `menu` — present a `UIAlertController` action sheet, replying once with
+///     the selection (or a cancel).
+///
+/// Installs onto `delegate?.destination` — the visitable view controller this
+/// component instance belongs to — so buttons land on the right screen and go
+/// away with it, exactly like the framework's own per-page bridge components.
+final class MenuComponent: BridgeComponent {
+    override nonisolated class var name: String { "everywhere--menu" }
+
+    override func onReceive(message: Message) {
+        switch message.event {
+        case "navItems":
+            handleNavItems(message: message)
+        case "menu":
+            handleMenu(message: message)
+        default:
+            break
+        }
+    }
+
+    // MARK: Private
+
+    private var viewController: UIViewController? {
+        delegate?.destination as? UIViewController
+    }
+
+    // MARK: Nav bar items
+
+    private func handleNavItems(message: Message) {
+        guard let viewController, let data: NavItemsData = message.data() else { return }
+
+        var left: [UIBarButtonItem] = []
+        var right: [UIBarButtonItem] = []
+        for item in data.items {
+            let barButton = barButtonItem(for: item)
+            if item.side == "left" { left.append(barButton) } else { right.append(barButton) }
+        }
+
+        // Right-side items read right-to-left in a nav bar; reverse so the page
+        // order ("Edit", "Share") lands left-to-right as authored.
+        viewController.navigationItem.leftBarButtonItems = left.isEmpty ? nil : left
+        viewController.navigationItem.rightBarButtonItems = right.isEmpty ? nil : right.reversed()
+    }
+
+    private func barButtonItem(for item: NavItem) -> UIBarButtonItem {
+        let image = item.image.flatMap { UIImage(systemName: $0) }
+
+        // A pull-down / overflow menu: children become a native UIMenu, each
+        // echoing its own id back on selection.
+        if let children = item.children, !children.isEmpty {
+            let actions = children.map { child in
+                UIAction(
+                    title: child.title,
+                    image: child.image.flatMap { UIImage(systemName: $0) },
+                    attributes: child.style == "destructive" ? .destructive : []
+                ) { [weak self] _ in
+                    self?.replyTap(id: child.id)
+                }
+            }
+            let menu = UIMenu(title: item.title.isEmpty ? "" : item.title, children: actions)
+            let barButton = UIBarButtonItem(
+                title: item.title.isEmpty ? nil : item.title,
+                image: image ?? UIImage(systemName: "ellipsis.circle"),
+                menu: menu
+            )
+            return barButton
+        }
+
+        // A plain button: echo its id back so the web half clicks the element.
+        let action = UIAction(title: item.title, image: image) { [weak self] _ in
+            self?.replyTap(id: item.id)
+        }
+        let barButton: UIBarButtonItem
+        if let image {
+            barButton = UIBarButtonItem(image: image, primaryAction: action)
+        } else {
+            barButton = UIBarButtonItem(title: item.title, primaryAction: action)
+        }
+        barButton.style = item.style == "done" ? .done : .plain
+        barButton.isEnabled = !(item.disabled ?? false)
+        return barButton
+    }
+
+    private func replyTap(id: String) {
+        reply(to: "navItems", with: NavReply(action: "tap", id: id))
+    }
+
+    // MARK: Action sheet
+
+    private func handleMenu(message: Message) {
+        guard let viewController, let data: MenuData = message.data() else { return }
+
+        let sheet = UIAlertController(title: data.title, message: data.message, preferredStyle: .actionSheet)
+        for item in data.items {
+            let style: UIAlertAction.Style = item.style == "destructive" ? .destructive : .default
+            let action = UIAlertAction(title: item.title, style: style) { [weak self] _ in
+                self?.reply(to: "menu", with: MenuReply(action: "select", id: item.id))
+            }
+            action.isEnabled = !(item.disabled ?? false)
+            sheet.addAction(action)
+        }
+        sheet.addAction(UIAlertAction(title: "Cancel", style: .cancel) { [weak self] _ in
+            self?.reply(to: "menu", with: MenuReply(action: "cancel", id: nil))
+        })
+
+        // iPad / iOS 26 present action sheets as popovers, which need an anchor.
+        // The web sends the trigger's rect in page coordinates; offset by the
+        // web view's top content inset (the nav bar) to reach view coordinates.
+        if let popover = sheet.popoverPresentationController {
+            popover.sourceView = viewController.view
+            if let source = data.source {
+                var y = source.y
+                if let visitable = viewController as? Visitable,
+                   let webView = visitable.visitableView.webView {
+                    y += Double(webView.scrollView.adjustedContentInset.top)
+                }
+                popover.sourceRect = CGRect(x: source.x, y: y, width: source.width, height: source.height)
+            } else {
+                popover.sourceRect = CGRect(x: viewController.view.bounds.midX,
+                                            y: viewController.view.bounds.midY, width: 0, height: 0)
+                popover.permittedArrowDirections = []
+            }
+        }
+
+        viewController.present(sheet, animated: true)
+    }
+}
+
+// MARK: - Message data
+
+private extension MenuComponent {
+    struct NavItemsData: Decodable {
+        let items: [NavItem]
+    }
+
+    struct NavItem: Decodable {
+        let id: String
+        let title: String
+        let image: String?
+        let side: String?
+        let style: String?
+        let disabled: Bool?
+        let children: [MenuItem]?
+    }
+
+    struct MenuData: Decodable {
+        let title: String?
+        let message: String?
+        let items: [MenuItem]
+        let source: Source?
+    }
+
+    struct MenuItem: Decodable {
+        let id: String
+        let title: String
+        let image: String?
+        let style: String?
+        let disabled: Bool?
+    }
+
+    struct Source: Decodable {
+        let x: Double
+        let y: Double
+        let width: Double
+        let height: Double
+    }
+
+    struct NavReply: Encodable {
+        let action: String
+        let id: String
+    }
+
+    struct MenuReply: Encodable {
+        let action: String
+        let id: String?
+    }
+}

data/support/mobile/ios/App/EverywhereConfig.swift

@@ -32,6 +32,43 @@ struct ThemedColor: Decodable {
     }
 }
 
+/// Third-party sign-in (everywhere.yml `auth:`): which paths hand off to the
+/// system browser instead of loading in the web view, and the custom scheme
+/// ASWebAuthenticationSession returns through. Absent when the app declares no
+/// `auth:` — a shell that diverts nothing.
+struct AuthConfig: Decodable {
+    let oauthPaths: [String]
+    let scheme: String
+
+    private enum CodingKeys: String, CodingKey {
+        case oauthPaths = "oauth_paths"
+        case scheme
+    }
+
+    /// The patterns compiled once. They're regex sources, matched unanchored,
+    /// exactly like the path-configuration `rules:` patterns they sit beside in
+    /// everywhere.yml — and exactly like the gem matches them server-side, so
+    /// both halves of the flow agree on what a provider path is.
+    let expressions: [NSRegularExpression]
+
+    init(from decoder: Decoder) throws {
+        let container = try decoder.container(keyedBy: CodingKeys.self)
+        oauthPaths = try container.decodeIfPresent([String].self, forKey: .oauthPaths) ?? []
+        scheme = try container.decodeIfPresent(String.self, forKey: .scheme) ?? ""
+        expressions = oauthPaths.compactMap { try? NSRegularExpression(pattern: $0) }
+    }
+
+    /// Half a declaration is worse than none: without a scheme there's nothing
+    /// for the auth session to return through, and diverting a visit we can't
+    /// finish would turn the sign-in button into a button that does nothing.
+    var isUsable: Bool { !scheme.isEmpty && !expressions.isEmpty }
+
+    func matches(path: String) -> Bool {
+        let range = NSRange(path.startIndex..., in: path)
+        return expressions.contains { $0.firstMatch(in: path, range: range) != nil }
+    }
+}
+
 /// The app's configuration, stamped into the bundle as `everywhere.json` by
 /// `every build`. The raw template ships a placeholder pointing at rubyeverywhere.com.
 struct EverywhereConfig: Decodable {
@@ -46,6 +83,8 @@ struct EverywhereConfig: Decodable {
     let permissions: [String]?
     let splashMinSeconds: Double?
     let lazyLoadTabs: Bool?
+    let universalLinkHosts: [String]?
+    let auth: AuthConfig?
 
     private enum CodingKeys: String, CodingKey {
         case name
@@ -59,6 +98,8 @@ struct EverywhereConfig: Decodable {
         case permissions
         case splashMinSeconds = "splash_min_seconds"
         case lazyLoadTabs = "lazy_load_tabs"
+        case universalLinkHosts = "universal_link_hosts"
+        case auth
     }
 
     /// Whether the tab bar defers each non-selected tab's initial visit until
@@ -197,6 +238,70 @@ struct EverywhereConfig: Decodable {
         ]
     }
 
+    // MARK: Third-party sign-in
+
+    /// The path a visit should hand to the auth session, or nil to let it load
+    /// in the web view. Two shapes: a provider path the app linked to directly,
+    /// and the gem's /everywhere/auth/native page, which is where the server
+    /// sends visits the shell couldn't intercept (a `data-turbo="false"` link,
+    /// or the POST OmniAuth 2 requires) — its `to` names the real provider path.
+    func authTarget(for url: URL) -> String? {
+        guard let auth, auth.isUsable else { return nil }
+
+        if url.path == "/everywhere/auth/native" {
+            let to = URLComponents(url: url, resolvingAgainstBaseURL: false)?
+                .queryItems?.first { $0.name == "to" }?.value
+            return to.flatMap { $0.hasPrefix("/") && !$0.hasPrefix("//") ? $0 : nil }
+        }
+        guard auth.matches(path: url.path) else { return nil }
+
+        return pathAndQuery(of: url)
+    }
+
+    var authScheme: String? { auth.flatMap { $0.isUsable ? $0.scheme : nil } }
+
+    /// The first page of the auth session: the gem's start endpoint, which
+    /// marks the browser's jar as ours and continues into `to`. `returnTo` is
+    /// where the user was, used only if the app's own sign-in doesn't say where
+    /// to land.
+    func authStartURL(to: String, returnTo: String?) -> URL? {
+        var components = URLComponents(url: url(forPath: "/everywhere/auth/start"),
+                                       resolvingAgainstBaseURL: false)
+        var items = [URLQueryItem(name: "to", value: to)]
+        if let returnTo { items.append(URLQueryItem(name: "return_to", value: returnTo)) }
+        components?.queryItems = items
+        return components?.url
+    }
+
+    /// Where the token gets spent. Visited in the web view — that's the whole
+    /// point, the response's cookies have to land in the web view's jar — and
+    /// it redirects on to wherever the app's sign-in wanted the user.
+    func authHandoffURL(token: String) -> URL? {
+        var components = URLComponents(url: url(forPath: "/everywhere/auth/handoff"),
+                                       resolvingAgainstBaseURL: false)
+        components?.queryItems = [URLQueryItem(name: "token", value: token)]
+        return components?.url
+    }
+
+    /// Whether an incoming universal link belongs to this app: https, and its
+    /// host is the app's own root host or one of the associated domains
+    /// (everywhere.yml deep_linking, injected as `universal_link_hosts`). A link
+    /// to some other site is left to Safari.
+    func handlesUniversalLink(_ url: URL) -> Bool {
+        guard url.scheme?.lowercased() == "https", let host = url.host?.lowercased() else { return false }
+        if rootURL.host?.lowercased() == host { return true }
+        return (universalLinkHosts ?? []).contains { $0.lowercased() == host }
+    }
+
+    /// The path (plus query) of an absolute URL, for re-routing a universal link
+    /// through the app's own effective root (dev override / picked instance).
+    func pathAndQuery(of url: URL) -> String {
+        guard let components = URLComponents(url: url, resolvingAgainstBaseURL: false) else { return "/" }
+        let path = components.path.isEmpty ? "/" : components.path
+        if let query = components.query, !query.isEmpty { return "\(path)?\(query)" }
+        return path
+    }
+
     /// rootURL joined with an absolute-style path (leading `/` optional).
     func url(forPath path: String) -> URL {
         let root = rootURL

data/support/mobile/ios/App/SceneDelegate.swift

@@ -1,3 +1,4 @@
+import AuthenticationServices
 import HotwireNative
 import UIKit
 import WebKit
@@ -39,6 +40,22 @@ final class SceneDelegate: UIResponder, UIWindowSceneDelegate {
     /// The path the shell treats as the "reset the app" signal.
     private static let resetPath = "/everywhere/reset"
 
+    /// A universal link that arrived before the root existed (cold launch), held
+    /// until the first navigator/tab bar is built, then routed.
+    private var pendingUniversalLinkURL: URL?
+
+    /// Third-party sign-in, run in the system browser (everywhere.yml `auth:`).
+    /// Held for the scene's lifetime — the session inside it must outlive the
+    /// call that started it.
+    private lazy var authFlow = AuthFlow { [weak self] in
+        self?.window ?? ASPresentationAnchor()
+    }
+
+    /// Set while the web view is spending a handoff token. The visit that
+    /// follows carries the Set-Cookie headers that sign the app in, so the
+    /// auth-gated tab bar can only be fetched once it has finished.
+    private var awaitingAuthHandoff = false
+
     func scene(_ scene: UIScene, willConnectTo session: UISceneSession, options connectionOptions: UIScene.ConnectionOptions) {
         guard let windowScene = scene as? UIWindowScene else { return }
 
@@ -71,6 +88,9 @@ final class SceneDelegate: UIResponder, UIWindowSceneDelegate {
         NotificationCenter.default.addObserver(
             self, selector: #selector(handleNativeVisit(_:)),
             name: .everywhereNativeVisit, object: nil)
+        NotificationCenter.default.addObserver(
+            self, selector: #selector(handleAuthFlow(_:)),
+            name: .everywhereAuthFlow, object: nil)
 
         // Cookie hydration BEFORE the first visit: after a force-kill relaunch
         // (iOS kills the app when a Settings permission changes) the first
@@ -79,13 +99,50 @@ final class SceneDelegate: UIResponder, UIWindowSceneDelegate {
         // hydration — the splash covers the wait — and the same pass mirrors
         // cookies for the auth-aware config fetch, which adds the tab bar for
         // a signed-in user.
+        // A universal link that launched the app (cold start): capture it now,
+        // route it once the root exists (below).
+        captureUniversalLink(from: connectionOptions.userActivities)
+
         syncWebViewCookiesToSharedStore { [weak self] in
             guard let self else { return }
             self.applyPathConfiguration()
+            self.routePendingUniversalLink()
             Hotwire.loadPathConfiguration(from: EverywhereConfig.pathConfigurationSources(serverOnly: true))
         }
     }
 
+    // MARK: Universal links (deep linking)
+
+    /// A universal link tapped while the app is running: route it straight to
+    /// its in-app path. Links to other sites fall through to the system.
+    func scene(_ scene: UIScene, continue userActivity: NSUserActivity) {
+        guard let url = webpageURL(from: userActivity) else { return }
+        activeNavigator.route(config.url(forPath: config.pathAndQuery(of: url)))
+    }
+
+    private func captureUniversalLink(from activities: Set<NSUserActivity>) {
+        guard let activity = activities.first(where: { $0.activityType == NSUserActivityTypeBrowsingWeb }),
+              let url = webpageURL(from: activity)
+        else { return }
+        pendingUniversalLinkURL = config.url(forPath: config.pathAndQuery(of: url))
+    }
+
+    /// The webpage URL of a browsing-web activity, but only if this app claims
+    /// its host (the associated domains) — never route someone else's link.
+    private func webpageURL(from userActivity: NSUserActivity) -> URL? {
+        guard userActivity.activityType == NSUserActivityTypeBrowsingWeb,
+              let url = userActivity.webpageURL,
+              config.handlesUniversalLink(url)
+        else { return nil }
+        return url
+    }
+
+    private func routePendingUniversalLink() {
+        guard let url = pendingUniversalLinkURL else { return }
+        pendingUniversalLinkURL = nil
+        activeNavigator.route(url)
+    }
+
     /// Refetch the server path configuration on every foreground — so a config
     /// change lands without a relaunch (the dev endpoint is uncached). Uses the
     /// server-only sources: the auth-aware source of truth, no baked flash.
@@ -141,6 +198,10 @@ final class SceneDelegate: UIResponder, UIWindowSceneDelegate {
     ///   3. refresh the auth-aware server config, which rebuilds the tab bar
     ///      back in if (and only if) the user is now signed in.
     private func resetApp(to target: URL) {
+        // A sign-in sheet still up is answering a question the app no longer
+        // has — the reset is re-rooting or re-authing underneath it.
+        authFlow.cancel()
+        awaitingAuthHandoff = false
         clearWebContentCache()
         rebuildRoot(entries: [], routeTo: target)
         loadedTabsFingerprint = "" // matches the empty tab set we just built
@@ -162,6 +223,75 @@ final class SceneDelegate: UIResponder, UIWindowSceneDelegate {
         activeNavigator.route(url)
     }
 
+    // MARK: Third-party sign-in
+
+    /// `{action: "authFlow", to: "/auth/github"}` from the gem's
+    /// /everywhere/auth/native page — the fallback for visits the proposal
+    /// handler never sees (a `data-turbo="false"` link, or OmniAuth 2's POST).
+    @objc private func handleAuthFlow(_ note: Notification) {
+        guard let to = note.userInfo?["to"] as? String, to.hasPrefix("/"), !to.hasPrefix("//") else { return }
+        startAuthFlow(to: to)
+    }
+
+    /// Open a provider sign-in in the system browser. Nothing is loaded in the
+    /// web view: the whole point is that this URL never touches it.
+    private func startAuthFlow(to: String) {
+        guard let scheme = config.authScheme,
+              let start = config.authStartURL(to: to, returnTo: currentPath)
+        else { return }
+
+        #if DEBUG
+        NSLog("authFlow: %@", start.absoluteString)
+        #endif
+
+        authFlow.start(url: start, scheme: scheme) { [weak self] result in
+            guard let self else { return }
+            switch result {
+            case .success(let token):
+                self.finishAuthFlow(token: token)
+            case .failure(.canceled):
+                break // they closed the sheet; they're still on the page they started from
+            case .failure(let error):
+                self.presentAuthFailure(error)
+            }
+        }
+    }
+
+    /// Spend the handoff token in the web view and rebuild around whatever it
+    /// signs the app in as. Deliberately the reset sequence, in order:
+    ///   1. drop cached web content — the pre-auth pages are all stale now,
+    ///   2. drop to a single navigator aimed at the handoff, which sets the
+    ///      session cookie in the WEB VIEW's jar (the browser's jar, where the
+    ///      flow actually happened, is unreachable from here) and redirects on
+    ///      to the app's post-sign-in page,
+    ///   3. once that request has finished — and only then, or the fetch races
+    ///      the cookie — re-read the auth-gated config, which brings the tab
+    ///      bar back for the user who just signed in.
+    private func finishAuthFlow(token: String) {
+        guard let handoff = config.authHandoffURL(token: token) else { return }
+
+        clearWebContentCache()
+        rebuildRoot(entries: [], routeTo: handoff)
+        loadedTabsFingerprint = "" // matches the empty tab set we just built
+        awaitingAuthHandoff = true
+    }
+
+    private func presentAuthFailure(_ error: AuthFlow.Failure) {
+        NSLog("authFlow failed: %@", String(describing: error))
+
+        let alert = UIAlertController(title: "Sign-in didn't finish",
+                                      message: "Something went wrong on the way back to the app. Please try again.",
+                                      preferredStyle: .alert)
+        alert.addAction(UIAlertAction(title: "OK", style: .default))
+        activeNavigator.activeNavigationController.present(alert, animated: true)
+    }
+
+    /// The path the user is currently on, for the flow to come back to when the
+    /// app's own sign-in doesn't name a destination.
+    private var currentPath: String? {
+        activeNavigator.currentVisitableURL.map { config.pathAndQuery(of: $0) }
+    }
+
     // MARK: Instance switching (multi-instance apps)
 
     /// `Everywhere.instance.set(url)`: persist the picked instance as the
@@ -403,6 +533,13 @@ extension SceneDelegate: NavigatorDelegate {
             resetApp(to: resetTarget(from: proposal.url))
             return .reject
         }
+        // A provider sign-in: hand it to the system browser instead of loading
+        // it here. Rejecting leaves the user on the page they tapped from, which
+        // is where they belong if they close the sheet.
+        if let target = config.authTarget(for: proposal.url) {
+            startAuthFlow(to: target)
+            return .reject
+        }
         // App-provided native screens: a path rule's `view_controller`
         // identifier resolves through the extension registry (everywhere.yml
         // native.ios.screens). Unknown identifiers fall through to the web.
@@ -419,6 +556,13 @@ extension SceneDelegate: NavigatorDelegate {
 
     func requestDidFinish(at url: URL) {
         dismissSplash()
+
+        // The handoff has landed, so its cookies are in the web view's jar:
+        // now the tab bar can be fetched as the signed-in user.
+        if awaitingAuthHandoff {
+            awaitingAuthHandoff = false
+            loadPathConfiguration(serverOnly: true)
+        }
     }
 
     func visitableDidFailRequest(_ visitable: any Visitable, error: HotwireNativeError, retryHandler: RetryBlock?) {

data/support/mobile/ios/App.xcodeproj/project.pbxproj

@@ -16,7 +16,9 @@
 		EBE000000000000000000046 /* PermissionsComponent.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000045 /* PermissionsComponent.swift */; };
 		EBE000000000000000000058 /* BiometricsComponent.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000057 /* BiometricsComponent.swift */; };
 		EBE000000000000000000060 /* StorageComponent.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000059 /* StorageComponent.swift */; };
+		EBE000000000000000000068 /* MenuComponent.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000067 /* MenuComponent.swift */; };
 		EBE000000000000000000063 /* EverywhereHost.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000062 /* EverywhereHost.swift */; };
+		EBE000000000000000000070 /* AuthFlow.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000069 /* AuthFlow.swift */; };
 		EBE000000000000000000036 /* everywhere.json in Resources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000018 /* everywhere.json */; };
 		EBE000000000000000000037 /* path-configuration.json in Resources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000019 /* path-configuration.json */; };
 		EBE000000000000000000038 /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000020 /* Assets.xcassets */; };
@@ -38,11 +40,13 @@
 		EBE000000000000000000045 /* PermissionsComponent.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = PermissionsComponent.swift; sourceTree = "<group>"; };
 		EBE000000000000000000057 /* BiometricsComponent.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BiometricsComponent.swift; sourceTree = "<group>"; };
 		EBE000000000000000000059 /* StorageComponent.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = StorageComponent.swift; sourceTree = "<group>"; };
+		EBE000000000000000000067 /* MenuComponent.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = MenuComponent.swift; sourceTree = "<group>"; };
 		EBE000000000000000000018 /* everywhere.json */ = {isa = PBXFileReference; lastKnownFileType = text.json; path = everywhere.json; sourceTree = "<group>"; };
 		EBE000000000000000000019 /* path-configuration.json */ = {isa = PBXFileReference; lastKnownFileType = text.json; path = "path-configuration.json"; sourceTree = "<group>"; };
 		EBE000000000000000000020 /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = Assets.xcassets; sourceTree = "<group>"; };
 		EBE000000000000000000021 /* Base */ = {isa = PBXFileReference; lastKnownFileType = file.storyboard; name = Base; path = Base.lproj/LaunchScreen.storyboard; sourceTree = "<group>"; };
 		EBE000000000000000000062 /* EverywhereHost.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = EverywhereHost.swift; sourceTree = "<group>"; };
+		EBE000000000000000000069 /* AuthFlow.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = AuthFlow.swift; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFileSystemSynchronizedRootGroup section */
@@ -87,6 +91,7 @@
 				EBE000000000000000000015 /* EverywhereConfig.swift */,
 				EBE000000000000000000016 /* ErrorViewController.swift */,
 				EBE000000000000000000062 /* EverywhereHost.swift */,
+				EBE000000000000000000069 /* AuthFlow.swift */,
 				EBE000000000000000000005 /* Bridge */,
 				EBE000000000000000000061 /* Extensions */,
 				EBE000000000000000000023 /* Resources */,
@@ -105,6 +110,7 @@
 				EBE000000000000000000045 /* PermissionsComponent.swift */,
 				EBE000000000000000000057 /* BiometricsComponent.swift */,
 				EBE000000000000000000059 /* StorageComponent.swift */,
+				EBE000000000000000000067 /* MenuComponent.swift */,
 			);
 			path = Bridge;
 			sourceTree = "<group>";
@@ -210,7 +216,9 @@
 				EBE000000000000000000046 /* PermissionsComponent.swift in Sources */,
 				EBE000000000000000000058 /* BiometricsComponent.swift in Sources */,
 				EBE000000000000000000060 /* StorageComponent.swift in Sources */,
+				EBE000000000000000000068 /* MenuComponent.swift in Sources */,
 				EBE000000000000000000063 /* EverywhereHost.swift in Sources */,
+				EBE000000000000000000070 /* AuthFlow.swift in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};

data/support/mobile/ios/README.md

@@ -19,6 +19,16 @@ this template, it overwrites **exactly** these files and nothing else:
 4. `App/Assets.xcassets/AppIcon.appiconset/AppIcon.png` — the app icon (1024×1024 opaque PNG)
 5. *(optionally)* `App/Assets.xcassets/AccentColor.colorset/Contents.json` and
    `App/Assets.xcassets/LaunchBackground.colorset/Contents.json` — brand colors
+6. *(optionally)* `App/Info.plist`'s `CFBundleURLTypes` — the sign-in callback
+   scheme, written **only** when `auth:` is set in `everywhere.yml` (alongside
+   the permission usage strings, which are stamped the same way)
+7. *(optionally)* `App/App.entitlements` — the Associated Domains entitlement,
+   written **only** when `deep_linking:` is set in `everywhere.yml`. The matching
+   `CODE_SIGN_ENTITLEMENTS` is added to the xcconfig in the same case, so the
+   default build stays entitlement-free and the frozen template still compiles
+   unchanged. The gem serves the `/.well-known/apple-app-site-association` file
+   these domains point at; `SceneDelegate` routes an incoming universal link to
+   its in-app path.
 
 Everything the CLI needs to vary per app flows through those files. The product
 is always `App.app` (`PRODUCT_NAME = App` is hardcoded); identity comes from the