ruby_everywhere 0.3.0 → 0.4.0

data/support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/bridge/PermissionsComponent.kt

@@ -0,0 +1,271 @@
+package com.rubyeverywhere.shell.bridge
+
+import android.Manifest
+import android.app.Activity
+import android.content.Context
+import android.content.Intent
+import android.content.SharedPreferences
+import android.content.pm.PackageManager
+import android.net.Uri
+import android.os.Build
+import android.provider.Settings
+import android.util.Log
+import androidx.activity.ComponentActivity
+import androidx.activity.result.ActivityResultLauncher
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.core.app.ActivityCompat
+import androidx.core.app.NotificationManagerCompat
+import androidx.core.content.ContextCompat
+import androidx.fragment.app.Fragment
+import com.rubyeverywhere.shell.EverywhereConfig
+import dev.hotwire.core.bridge.BridgeComponent
+import dev.hotwire.core.bridge.BridgeDelegate
+import dev.hotwire.core.bridge.Message
+import dev.hotwire.navigation.destinations.HotwireDestination
+import kotlinx.serialization.SerialName
+import kotlinx.serialization.Serializable
+import java.util.concurrent.atomic.AtomicInteger
+
+/**
+ * Bridge component backing `everywhere--permissions`. Handles `query` and
+ * `request` for notifications / camera / location, replying `{name, status}`
+ * with granted | denied | prompt | undeclared | unsupported, and `openSettings`
+ * for the denied dead-end — the same events, keys and vocabulary as iOS's
+ * PermissionsComponent.swift.
+ *
+ * Everything must be declared in everywhere.yml, and an undeclared name
+ * short-circuits to `undeclared` before touching a system API. On iOS that gate
+ * is load-bearing because a prompt without an Info.plist usage string kills the
+ * process; Android just prompts, so the gate is doing something different and
+ * arguably more important here — it is the *promise* that an app which never
+ * declared `camera:` can never be talked into asking for the camera by a page.
+ * Weakening it on Android would make the same everywhere.yml mean two things.
+ *
+ * Notifications are the one exception, and it is iOS's exception, kept
+ * deliberately: they carry no usage string there, so they were never gated. The
+ * Android analogue of the gate for them is the manifest — `POST_NOTIFICATIONS`
+ * is only stamped when everywhere.yml declares `notifications:` — and an
+ * undeclared app is answered from the real notification state rather than being
+ * told it can prompt when it can't.
+ *
+ * ### `denied` means what it means on iOS
+ *
+ * iOS never re-prompts, so `denied` is final and `openSettings()` is the only
+ * way out. Android's own APIs can't distinguish "never asked" from "asked and
+ * permanently refused" — `shouldShowRequestPermissionRationale` is false for
+ * both — so the shell remembers that it asked. Never-asked and asked-once both
+ * answer `prompt` (they can still be prompted); asked-and-no-longer-promptable
+ * answers `denied`, which is exactly the state where the page should be offering
+ * `openSettings()` instead of asking again.
+ */
+class PermissionsComponent(
+    name: String,
+    private val delegate: BridgeDelegate<HotwireDestination>
+) : BridgeComponent<HotwireDestination>(name, delegate) {
+
+    private val fragment: Fragment
+        get() = delegate.destination.fragment
+
+    override fun onReceive(message: Message) {
+        when (message.event) {
+            "query", "request" -> {
+                val data = message.data<Payload>() ?: return
+                handle(message, data.name)
+            }
+            "openSettings" -> openSettings()
+            else -> Log.w(TAG, "Unknown event for message: $message")
+        }
+    }
+
+    private fun handle(message: Message, permission: String) {
+        val context = fragment.context ?: return
+        val activity = fragment.activity ?: return
+
+        if (permission != "notifications" && !EverywhereConfig.shared.declaresPermission(permission)) {
+            return reply(message, permission, "undeclared")
+        }
+
+        val request = message.event == "request"
+        when (permission) {
+            "notifications" -> notifications(context, activity, request) { reply(message, permission, it) }
+            "camera" -> runtime(context, activity, Manifest.permission.CAMERA, request) {
+                reply(message, permission, it)
+            }
+            "location" -> runtime(context, activity, Manifest.permission.ACCESS_FINE_LOCATION, request) {
+                reply(message, permission, it)
+            }
+            // `biometrics` lives in everywhere.yml's permissions list too, but it
+            // is not a runtime permission — the page asks
+            // Everywhere.biometrics.available() instead. Same answer as iOS.
+            else -> reply(message, permission, "unsupported")
+        }
+    }
+
+    // MARK: Notifications
+
+    private fun notifications(
+        context: Context,
+        activity: Activity,
+        request: Boolean,
+        completion: (String) -> Unit
+    ) {
+        val enabled = NotificationManagerCompat.from(context).areNotificationsEnabled()
+
+        // Below API 33 there is no permission to hold: notifications are on
+        // unless the user turned them off in settings, and nothing can prompt.
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.TIRAMISU) {
+            return completion(if (enabled) "granted" else "denied")
+        }
+
+        // Declared in everywhere.yml → POST_NOTIFICATIONS is in the manifest and
+        // this is an ordinary runtime permission. Undeclared → it isn't, a
+        // request would be refused without any UI, so report the real state.
+        if (!declaredInManifest(context, POST_NOTIFICATIONS)) {
+            return completion(if (enabled) "granted" else "denied")
+        }
+
+        runtime(context, activity, POST_NOTIFICATIONS, request, completion)
+    }
+
+    // MARK: Runtime permissions
+
+    private fun runtime(
+        context: Context,
+        activity: Activity,
+        permission: String,
+        request: Boolean,
+        completion: (String) -> Unit
+    ) {
+        val status = status(context, activity, permission)
+        if (!request || status != "prompt") return completion(status)
+
+        RuntimePermissions.request(fragment, permission) { granted ->
+            // Re-derive rather than trusting the boolean: a refusal that used up
+            // the last prompt has to read as `denied`, not as another `prompt`.
+            completion(if (granted) "granted" else status(context, activity, permission))
+        }
+    }
+
+    private fun status(context: Context, activity: Activity, permission: String): String {
+        if (ContextCompat.checkSelfPermission(context, permission) == PackageManager.PERMISSION_GRANTED) {
+            return "granted"
+        }
+        // The system is offering to explain itself, which means it will still
+        // show the dialog — promptable.
+        if (ActivityCompat.shouldShowRequestPermissionRationale(activity, permission)) return "prompt"
+
+        return if (RuntimePermissions.hasAsked(context, permission)) "denied" else "prompt"
+    }
+
+    @Suppress("DEPRECATION")
+    private fun declaredInManifest(context: Context, permission: String): Boolean = try {
+        context.packageManager
+            .getPackageInfo(context.packageName, PackageManager.GET_PERMISSIONS)
+            .requestedPermissions
+            ?.contains(permission) == true
+    } catch (e: Exception) {
+        Log.w(TAG, "could not read the manifest permissions", e)
+        false
+    }
+
+    // MARK: Settings
+
+    /**
+     * The denied dead-end. iOS opens the app's settings pane; Android's
+     * equivalent is the app details screen, which is where the permission
+     * toggles live.
+     */
+    private fun openSettings() {
+        val context = fragment.context ?: return
+        val intent = Intent(
+            Settings.ACTION_APPLICATION_DETAILS_SETTINGS,
+            Uri.fromParts("package", context.packageName, null)
+        )
+        try {
+            fragment.startActivity(intent)
+        } catch (e: Exception) {
+            Log.w(TAG, "could not open app settings", e)
+        }
+    }
+
+    /**
+     * Replies on the exact message that asked. Concurrent messages for the same
+     * event (every permission row queries on page load at once) make
+     * `replyTo(event)` unusable — it targets only the last-received message.
+     * Same reasoning, same fix, as iOS.
+     */
+    private fun reply(message: Message, name: String, status: String) {
+        replyWith(message.replacing(event = message.event, data = StatusReply(name = name, status = status)))
+    }
+
+    @Serializable
+    data class Payload(
+        @SerialName("name") val name: String
+    )
+
+    @Serializable
+    data class StatusReply(
+        @SerialName("name") val name: String,
+        @SerialName("status") val status: String
+    )
+
+    private companion object {
+        const val TAG = "EverywherePermissions"
+        const val POST_NOTIFICATIONS = "android.permission.POST_NOTIFICATIONS"
+    }
+}
+
+/**
+ * Runtime permission prompts for the bridge components, plus the "we have asked
+ * before" memory that makes a permanent refusal distinguishable from a fresh
+ * one.
+ *
+ * `Fragment.registerForActivityResult` is unusable here: it must be called
+ * before the fragment reaches STARTED, and a bridge component is created lazily
+ * when its first message arrives — long after. `ActivityResultRegistry.register`
+ * (the overload without a LifecycleOwner) is the documented escape hatch for
+ * exactly this, and it is why the launcher is unregistered by hand.
+ *
+ * Known limit, shared with iOS's own force-kill case: a configuration change or
+ * process death while the system dialog is up loses the callback, so the web
+ * promise never settles. Re-registering under a stable key would need state the
+ * bridge message doesn't carry, and the page recovers on its next query().
+ *
+ * Shared with NotificationComponent, which asks for POST_NOTIFICATIONS inside
+ * notify() the way iOS asks for authorization inside its own notify().
+ */
+internal object RuntimePermissions {
+    private const val PREFS = "everywhere.permissions"
+    private const val ASKED_PREFIX = "asked."
+
+    private val sequence = AtomicInteger(0)
+
+    fun request(fragment: Fragment, permission: String, onResult: (Boolean) -> Unit) {
+        val activity = fragment.activity as? ComponentActivity ?: return onResult(false)
+
+        // Recorded before launching, not after: if the process dies while the
+        // dialog is up, the user was still asked, and forgetting that would make
+        // a permanent refusal look promptable forever.
+        markAsked(activity, permission)
+
+        var launcher: ActivityResultLauncher<String>? = null
+        launcher = activity.activityResultRegistry.register(
+            "everywhere-permission:$permission:${sequence.incrementAndGet()}",
+            ActivityResultContracts.RequestPermission()
+        ) { granted ->
+            launcher?.unregister()
+            onResult(granted)
+        }
+        launcher.launch(permission)
+    }
+
+    fun hasAsked(context: Context, permission: String): Boolean =
+        prefs(context).getBoolean(ASKED_PREFIX + permission, false)
+
+    private fun markAsked(context: Context, permission: String) {
+        prefs(context).edit().putBoolean(ASKED_PREFIX + permission, true).apply()
+    }
+
+    private fun prefs(context: Context): SharedPreferences =
+        context.applicationContext.getSharedPreferences(PREFS, Context.MODE_PRIVATE)
+}

data/support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/bridge/StorageComponent.kt

@@ -0,0 +1,101 @@
+package com.rubyeverywhere.shell.bridge
+
+import android.content.Context
+import android.content.SharedPreferences
+import android.util.Log
+import dev.hotwire.core.bridge.BridgeComponent
+import dev.hotwire.core.bridge.BridgeDelegate
+import dev.hotwire.core.bridge.Message
+import dev.hotwire.navigation.destinations.HotwireDestination
+import kotlinx.serialization.SerialName
+import kotlinx.serialization.Serializable
+
+/**
+ * Bridge component backing `everywhere--storage`: device-local key/value
+ * settings persisted in SharedPreferences for `Everywhere.storage.*` — the
+ * Android stand-in for iOS's UserDefaults, and for the same reason: it outlives
+ * web view resets and cache clears, which localStorage does not.
+ *
+ * Values ride the wire as JSON-encoded strings (the JS side owns encoding and
+ * decoding), so any JSON value round-trips without a typed schema here. Four
+ * events — `get` `set` `remove` `clear` — replying `{ok}` and, for `get`,
+ * `{ok, value}`. Identical to iOS's StorageComponent.swift.
+ *
+ * Keys keep iOS's "everywhere.app." prefix even though they live in their own
+ * preferences file: `clear()` is defined as "the app's keys, not the shell's",
+ * and having both platforms express that the same way means one description of
+ * the storage layout is true on both.
+ *
+ * Settings, not secrets — server tokens belong in `biometrics.credential`.
+ */
+class StorageComponent(
+    name: String,
+    private val delegate: BridgeDelegate<HotwireDestination>
+) : BridgeComponent<HotwireDestination>(name, delegate) {
+
+    private val prefs: SharedPreferences?
+        get() = delegate.destination.fragment.context
+            ?.applicationContext
+            ?.getSharedPreferences(PREFS, Context.MODE_PRIVATE)
+
+    override fun onReceive(message: Message) {
+        val prefs = prefs ?: return reply(message, Reply(ok = false))
+        val data = message.data<Payload>()
+
+        when (message.event) {
+            "get" -> {
+                val key = namespaced(data) ?: return reply(message, Reply(ok = false))
+                reply(message, Reply(ok = true, value = prefs.getString(key, null)))
+            }
+            "set" -> {
+                val key = namespaced(data)
+                val value = data?.value
+                if (key == null || value == null) return reply(message, Reply(ok = false))
+                prefs.edit().putString(key, value).apply()
+                reply(message, Reply(ok = true))
+            }
+            "remove" -> {
+                val key = namespaced(data) ?: return reply(message, Reply(ok = false))
+                prefs.edit().remove(key).apply()
+                reply(message, Reply(ok = true))
+            }
+            "clear" -> {
+                val editor = prefs.edit()
+                prefs.all.keys.filter { it.startsWith(PREFIX) }.forEach { editor.remove(it) }
+                editor.apply()
+                reply(message, Reply(ok = true))
+            }
+            else -> Log.w(TAG, "Unknown event for message: $message")
+        }
+    }
+
+    private fun namespaced(data: Payload?): String? =
+        data?.key?.takeIf { it.isNotEmpty() }?.let { PREFIX + it }
+
+    /**
+     * Replies on the exact message that asked — a page that reads three
+     * settings at once has three `get` messages in flight, and `replyTo(event)`
+     * would answer all of them with the last one's key.
+     */
+    private fun reply(message: Message, payload: Reply) {
+        replyWith(message.replacing(event = message.event, data = payload))
+    }
+
+    @Serializable
+    data class Payload(
+        @SerialName("key") val key: String? = null,
+        @SerialName("value") val value: String? = null
+    )
+
+    @Serializable
+    data class Reply(
+        @SerialName("ok") val ok: Boolean,
+        @SerialName("value") val value: String? = null
+    )
+
+    private companion object {
+        const val TAG = "EverywhereStorage"
+        const val PREFS = "everywhere.storage"
+        const val PREFIX = "everywhere.app."
+    }
+}

data/support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/bridge/WebControlChannel.kt

@@ -0,0 +1,204 @@
+package com.rubyeverywhere.shell.bridge
+
+import android.content.pm.ApplicationInfo
+import android.net.Uri
+import android.util.Log
+import android.webkit.WebView
+import androidx.core.net.toUri
+import androidx.webkit.JavaScriptReplyProxy
+import androidx.webkit.WebMessageCompat
+import androidx.webkit.WebViewCompat
+import androidx.webkit.WebViewFeature
+import com.rubyeverywhere.shell.EverywhereConfig
+import com.rubyeverywhere.shell.EverywhereEvents
+import org.json.JSONObject
+
+/**
+ * The page → shell control channel: app-level actions (reset, tabs, badges,
+ * instance, auth) that must work on any page, whether or not a bridge component
+ * happens to be mounted on it. The Android half of iOS's
+ * `WKScriptMessageHandler` (see AppDelegate.WebControlHandler).
+ *
+ *   { action: "reloadConfig" }                      → refresh tabs/path config
+ *   { action: "reset", to: "/path" }                → full app reset, then land on `to`
+ *   { action: "setBadge", count: 3 }                → app icon badge (0 clears)
+ *   { action: "setTabBadge", path: "/x", count: 3 } → tab bar badge (0 clears)
+ *   { action: "setInstance", url: "https://…", to: "/path"? } → persist instance root + reset
+ *   { action: "clearInstance", to: "/path"? }       → back to the stamped root + reset
+ *   { action: "authFlow", to: "/auth/github" }      → provider sign-in in the system browser
+ *
+ * Two things differ from iOS and both are forced by the platform:
+ *
+ *  1. **A web message is text.** `WKUserContentController` serializes the object
+ *     `postMessage` was handed and delivers a dictionary;
+ *     `WebViewCompat.addWebMessageListener` is backed by a `WebMessagePort`,
+ *     which carries a `String`. bridge.js already knows this — its
+ *     `nativeControlChannel()` JSON.stringify's for the Android branch — so the
+ *     work here is parsing that JSON back into the same seven shapes.
+ *  2. **No NotificationCenter.** Actions are emitted onto [EverywhereEvents],
+ *     which MainActivity collects. Same fan-out, one subscriber.
+ *
+ * Holds no reference to a WebView or a navigator, so retaining one per web view
+ * can't cycle.
+ */
+class WebControlChannel : WebViewCompat.WebMessageListener {
+
+    override fun onPostMessage(
+        view: WebView,
+        message: WebMessageCompat,
+        sourceOrigin: Uri,
+        isMainFrame: Boolean,
+        replyProxy: JavaScriptReplyProxy
+    ) {
+        // Sub-frames must never re-root the app: an embedded iframe is not the
+        // page the user is on, and `setInstance`/`reset` are app-level.
+        if (!isMainFrame) return
+
+        val body = message.data?.let { parse(it) } ?: return
+        val action = body.optString("action").takeIf { it.isNotEmpty() } ?: return
+
+        // The debuggable flag rather than BuildConfig.DEBUG: this file must not
+        // assume the frozen build script turned `buildConfig` on.
+        if (view.context.applicationInfo.flags and ApplicationInfo.FLAG_DEBUGGABLE != 0) {
+            Log.d(TAG, "everywhereControl: $body")
+        }
+
+        when (action) {
+            "reloadConfig" ->
+                EverywhereEvents.emit(EverywhereEvents.Event.ReloadConfig)
+
+            "reset" ->
+                EverywhereEvents.emit(EverywhereEvents.Event.ResetApp(body.optPath("to")))
+
+            "setBadge" ->
+                EverywhereEvents.emit(
+                    EverywhereEvents.Event.SetBadge(body.optInt("count", 0).coerceAtLeast(0))
+                )
+
+            "setTabBadge" -> {
+                val path = body.optString("path").takeIf { it.isNotEmpty() } ?: return
+                EverywhereEvents.emit(
+                    EverywhereEvents.Event.SetTabBadge(
+                        path = path,
+                        count = body.optInt("count", 0).coerceAtLeast(0)
+                    )
+                )
+            }
+
+            "setInstance" -> {
+                // Validating the URL itself belongs with the persistence
+                // (EverywhereConfig.setInstanceUrl), exactly as on iOS — this
+                // only refuses the empty case, so a blank string can't re-root.
+                val url = body.optString("url").takeIf { it.isNotEmpty() } ?: return
+                EverywhereEvents.emit(
+                    EverywhereEvents.Event.SetInstance(url = url, to = body.optPath("to"))
+                )
+            }
+
+            "clearInstance" ->
+                EverywhereEvents.emit(EverywhereEvents.Event.ClearInstance(body.optPath("to")))
+
+            "authFlow" -> {
+                // Same guard as iOS's handleAuthFlow: an absolute same-origin
+                // path only, never a protocol-relative "//evil.example" that
+                // would send the user's sign-in to somebody else's host.
+                val to = body.optPath("to") ?: return
+                EverywhereEvents.emit(EverywhereEvents.Event.AuthFlow(to))
+            }
+
+            else -> Log.w(TAG, "everywhereControl: unknown action '$action'")
+        }
+    }
+
+    private fun parse(data: String): JSONObject? = try {
+        JSONObject(data)
+    } catch (e: Exception) {
+        Log.w(TAG, "everywhereControl: unparseable message", e)
+        null
+    }
+
+    /** An absolute, same-origin path, or null — the only `to` worth acting on. */
+    private fun JSONObject.optPath(name: String): String? =
+        optString(name).takeIf { it.startsWith("/") && !it.startsWith("//") }
+
+    companion object {
+        private const val TAG = "EverywhereControl"
+
+        /** The name bridge.js looks for: `window.everywhereControl`. */
+        const val JS_OBJECT_NAME = "everywhereControl"
+
+        /**
+         * Everything iOS does with `WKUserContentController`, done per web view
+         * because Android has no user-script API: inject
+         * `window.__EVERYWHERE_CONFIG__` before the page's own scripts run, and
+         * expose the control channel object bridge.js posts to.
+         *
+         * Both are `androidx.webkit` features a device's WebView provider can be
+         * too old for, and both degrade honestly rather than throwing:
+         *
+         *  * no DOCUMENT_START_SCRIPT — the page loses the app's name, version
+         *    and instance, not its ability to run (bridge.js reads the object
+         *    defensively and falls back to the browser adapter).
+         *  * no WEB_MESSAGE_LISTENER — `nativeControlChannel()` finds nothing,
+         *    so `reloadTabs()` logs a debug line and `resetApp()` becomes a
+         *    plain navigation. Worth a warning in the log, because the shell
+         *    silently loses tab refreshes and instance switching.
+         *
+         * Both are scoped to the app's own origin. `"*"` would hand every page
+         * the app ever loads — including anything a link leads to — the ability
+         * to re-root the shell.
+         *
+         * @param webConfigJson the object literal for `window.__EVERYWHERE_CONFIG__`,
+         *   rebuilt per web view because it carries the instance override, which
+         *   changes when a picker re-roots the app.
+         */
+        fun install(webView: WebView, webConfigJson: String) {
+            val origins = originRules()
+
+            if (WebViewFeature.isFeatureSupported(WebViewFeature.DOCUMENT_START_SCRIPT)) {
+                runCatching {
+                    WebViewCompat.addDocumentStartJavaScript(
+                        webView,
+                        "window.__EVERYWHERE_CONFIG__ = $webConfigJson;",
+                        origins
+                    )
+                }.onFailure { Log.w(TAG, "could not inject the page config", it) }
+            }
+
+            if (!WebViewFeature.isFeatureSupported(WebViewFeature.WEB_MESSAGE_LISTENER)) {
+                Log.w(
+                    TAG,
+                    "WEB_MESSAGE_LISTENER unsupported by this WebView provider — reloadTabs, " +
+                        "reset, badges, instance switching and native sign-in fall back to their web behaviour"
+                )
+                return
+            }
+
+            runCatching {
+                WebViewCompat.addWebMessageListener(
+                    webView,
+                    JS_OBJECT_NAME,
+                    origins,
+                    WebControlChannel()
+                )
+            }.onFailure {
+                // addWebMessageListener throws on a malformed origin rule; a
+                // typo'd root URL must not take the shell down at launch.
+                Log.e(TAG, "could not install the control channel", it)
+            }
+        }
+
+        /**
+         * The app's own origin, derived from the *effective* root — so a dev
+         * build against 127.0.0.1 and a picked instance both work without a
+         * second list to keep in sync.
+         */
+        private fun originRules(): Set<String> {
+            val uri = EverywhereConfig.shared.rootUrl.toUri()
+            val scheme = uri.scheme ?: return emptySet()
+            val host = uri.host ?: return emptySet()
+            val port = if (uri.port > 0) ":${uri.port}" else ""
+            return setOf("$scheme://$host$port")
+        }
+    }
+}

data/support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/extensions/EverywhereExtensions.kt

@@ -0,0 +1,51 @@
+package com.rubyeverywhere.shell.extensions
+
+import android.content.Context
+import android.view.View
+import androidx.fragment.app.Fragment
+import dev.hotwire.core.bridge.BridgeComponent
+import dev.hotwire.core.bridge.BridgeComponentFactory
+import dev.hotwire.navigation.destinations.HotwireDestination
+import kotlin.reflect.KClass
+
+// The app-extension registry. This checked-in copy is the empty default so the
+// raw template builds unchanged; `every build` overwrites it — and drops the
+// app repo's native/android/*.kt beside it, in this same package — when
+// config/everywhere.yml declares native code:
+//
+//   native:
+//     android:
+//       components: [ChartComponent]   # BridgeComponent subclasses to register
+//       screens:                       # path rules with uri: hotwire://fragment/map
+//         map: MapFragment             #   a Fragment destination
+//       splash: LaunchSplash           # a View subclass with a (Context) constructor
+//
+// Kotlin sources landing in this directory compile with no build-script change:
+// the source set is the whole directory tree, which is the Gradle equivalent of
+// iOS's filesystem-synchronized Extensions/ folder. Each one must start with
+//
+//   package com.rubyeverywhere.shell.extensions
+//
+// so the registry below can name its types — `every build` refuses a file that
+// doesn't, because Kotlin would otherwise fail with "unresolved reference"
+// pointing at this generated file rather than at the app's own source.
+object EverywhereExtensions {
+
+    /** Extra bridge components, registered alongside the six built-ins. */
+    val bridgeComponents: List<BridgeComponentFactory<HotwireDestination, BridgeComponent<HotwireDestination>>> =
+        emptyList()
+
+    /**
+     * App-provided native screens. A path rule's `uri` selects one of these by
+     * its `@HotwireDestinationDeepLink` annotation; anything unmatched falls
+     * through to the web fragment.
+     */
+    val fragmentDestinations: List<KClass<out Fragment>> = emptyList()
+
+    /**
+     * Replaces the splash overlay's default spinner when non-null. Given the
+     * Activity as its context so it can resolve theme attributes — the splash
+     * is meant to look like part of the app, not a floating rectangle.
+     */
+    fun splashView(context: Context): View? = null
+}

data/support/mobile/android/app/src/main/res/color/bottom_navigation_active_indicator.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<selector xmlns:android="http://schemas.android.com/apk/res/android">
+    <item android:alpha="0.15" android:color="?colorPrimary" />
+</selector>

data/support/mobile/android/app/src/main/res/color/bottom_navigation_item.xml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  The ColorStateList that tints the runtime-rendered tab icons. The bitmap
+  IconFont draws is opaque white; every pixel of visible colour on a tab comes
+  from here, which is why the glyph follows the theme and the selection state
+  for free.
+-->
+<selector xmlns:android="http://schemas.android.com/apk/res/android">
+    <item android:state_checked="true" android:color="?colorPrimary" />
+    <item android:alpha="0.65" android:color="?colorOnSurface" />
+</selector>

data/support/mobile/android/app/src/main/res/drawable/ic_launcher_foreground.xml

@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  STAMPED: the adaptive icon's foreground layer. The template's placeholder is
+  a vector so the raw checkout has no binary blob to keep in sync; `every build`
+  replaces it with drawable-<dpi>/ic_launcher_foreground.png rendered from the
+  app's icon and deletes this file. Nothing references it by type, only by
+  name, so the swap needs no edit to the adaptive-icon XML.
+
+  Adaptive-icon safe zone: only the centre 66dp of the 108dp canvas is
+  guaranteed visible, hence the inset group.
+-->
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="108dp"
+    android:height="108dp"
+    android:viewportWidth="108"
+    android:viewportHeight="108">
+    <group
+        android:scaleX="0.5"
+        android:scaleY="0.5"
+        android:translateX="27"
+        android:translateY="27">
+        <path
+            android:fillColor="#FFFFFF"
+            android:pathData="M54,10L98,35L98,73L54,98L10,73L10,35Z" />
+    </group>
+</vector>