ruby_everywhere 0.6.0 → 0.7.0

data/lib/everywhere/commands/preview.rb

@@ -0,0 +1,359 @@
+# frozen_string_literal: true
+
+require "dry/cli"
+require "socket"
+require "securerandom"
+require "shellwords"
+require "timeout"
+require "uri"
+require_relative "../shellout"
+require_relative "../console"
+require_relative "../child_processes"
+require_relative "../relay"
+require_relative "../framework"
+require_relative "../config"
+require_relative "../jump"
+
+module Everywhere
+  module Commands
+    # Put the running dev server in someone's hand: boot the app, open a
+    # Cloudflare tunnel to it, and print a QR code that opens the Jump app
+    # (spec: platform/docs/jump.md). The server gets EVERYWHERE_JUMP_TOKEN, so
+    # the Jump endpoints in MobileConfigEndpoint / MobileConfigsController are
+    # live for exactly as long as this command runs.
+    #
+    # Three transports, one seam (tunnel_url):
+    #   default        cloudflared quick tunnel — free, no account, HTTPS,
+    #                  best-effort (restarted with a fresh QR if it drops)
+    #   --tunnel-name  a named tunnel from the developer's own Cloudflare
+    #                  account, for a stable hostname (--tunnel-host says what
+    #                  that hostname is — cloudflared doesn't know its own DNS)
+    #   --lan          no tunnel: the LAN address, for offline use
+    class Preview < Dry::CLI::Command
+      desc "Run the dev server behind a shareable tunnel for the Jump app"
+
+      option :port,        default: "3000", desc: "Dev server port"
+      option :lan,         type: :boolean, default: false, desc: "Skip the tunnel and share the LAN address"
+      option :tunnel_name, default: nil, desc: "Run a named cloudflared tunnel instead of a quick one"
+      option :tunnel_host, default: nil, desc: "Public hostname the named tunnel is routed to"
+
+      TRYCLOUDFLARE_URL = %r{https://[a-z0-9-]+\.trycloudflare\.com}
+      TUNNEL_BOOT_TIMEOUT = 30
+
+      def call(port: "3000", lan: false, tunnel_name: nil, tunnel_host: nil, **)
+        port = @port = validate_port!(port)
+        @pids = {}
+        @relays = {}
+        @children = Mutex.new
+        @framework = detect_local_framework
+        @config = Everywhere::Config.load(@framework.root)
+        # Multi-use on purpose: a forwarded link must work for a second
+        # coworker's device. Dies with this process — bearers are HMACs over
+        # it, so they die too.
+        @token = SecureRandom.urlsafe_base64(24)
+
+        @lan = lan
+        if lan
+          @url = lan_url(port)
+        else
+          Shellout.ensure_tool!("cloudflared",
+                                "preview shares your app through a Cloudflare tunnel — " \
+                                "install it with `brew install cloudflared` (or use --lan)")
+          validate_tunnel_options!(tunnel_name, tunnel_host)
+          @tunnel_name = tunnel_name
+          @tunnel_host = tunnel_host
+          @url = start_tunnel
+        end
+
+        start_server(port)
+        warn_if_loopback_only if lan
+        announce
+        wait
+      rescue Interrupt
+        nil
+      ensure
+        teardown
+      end
+
+      private
+
+      # Preview exists to share a *local* dev server. A remote-mode root has
+      # no local server — the deployed URL is already shareable.
+      def detect_local_framework
+        Framework.detect
+      rescue Everywhere::Error
+        config = Everywhere::Config.load(Dir.pwd)
+        if config.remote?
+          UI.die!("this app runs in remote mode — #{config.remote_url} is already online, share that " \
+                  "(preview tunnels a local dev server)")
+        end
+        UI.die!("no supported framework here (Rails, Hanami, Sinatra) — nothing to preview")
+      end
+
+      def validate_tunnel_options!(name, host)
+        return if name.nil? && host.nil?
+        return if name && host
+
+        UI.die!("--tunnel-name and --tunnel-host go together: cloudflared runs the named tunnel, " \
+                "but only your Cloudflare DNS knows its public hostname")
+      end
+
+      # --- transports -----------------------------------------------------------
+
+      def lan_url(port)
+        "http://#{lan_ip}:#{port}"
+      end
+
+      def lan_ip
+        Socket.ip_address_list.find { |a| a.ipv4_private? }&.ip_address ||
+          UI.die!("couldn't find a LAN address — is this machine on a network? (drop --lan to tunnel instead)")
+      end
+
+      def start_tunnel
+        if @tunnel_name
+          UI.step("starting named tunnel #{UI.bold(@tunnel_name)} → #{UI.cyan("https://#{@tunnel_host}")}")
+          spawn_tunnel("cloudflared tunnel run --url http://127.0.0.1:#{@port} #{@tunnel_name.shellescape}")
+          "https://#{@tunnel_host}"
+        else
+          UI.step("starting Cloudflare quick tunnel")
+          quick_tunnel_url
+        end
+      end
+
+      # Quick tunnels choose their hostname at startup and print it once;
+      # everything else cloudflared logs is noise here, so the relay drops it
+      # and the on_line hook fishes out the URL.
+      def quick_tunnel_url
+        found = Queue.new
+        spawn_tunnel("cloudflared tunnel --url http://127.0.0.1:#{@port}",
+                     on_line: ->(line) { (url = line[TRYCLOUDFLARE_URL]) && found << url },
+                     quiet: true)
+        begin
+          Timeout.timeout(TUNNEL_BOOT_TIMEOUT) { found.pop }
+        rescue Timeout::Error
+          UI.die!("cloudflared never reported a tunnel URL after #{TUNNEL_BOOT_TIMEOUT}s — " \
+                  "check your network, or share on the local network with --lan")
+        end
+      end
+
+      def spawn_tunnel(cmd, on_line: nil, quiet: false)
+        supervise(:tunnel, {}, cmd, chdir: Dir.pwd, on_line: on_line, quiet: quiet)
+      end
+
+      # Rails' puma template binds 0.0.0.0, but a rackup-style bin/dev often
+      # pins --host 127.0.0.1 — then the LAN URL on the QR is a promise the
+      # server can't keep. Say so, instead of letting the phone time out.
+      def warn_if_loopback_only
+        TCPSocket.new(URI.parse(@url).host, Integer(@port)).close
+      rescue SystemCallError
+        UI.warn("the dev server only listens on 127.0.0.1, so phones can't reach #{@url} — " \
+                "make bin/dev bind 0.0.0.0 (rackup --host 0.0.0.0), or drop --lan and tunnel instead")
+      end
+
+      # --- the dev server -------------------------------------------------------
+
+      def start_server(port)
+        # Attaching to an already-running server (dev's behavior) can't work
+        # here: that process has no EVERYWHERE_JUMP_TOKEN, so Jump could never
+        # pair with it.
+        if port_open?(port)
+          UI.die!("something is already running on port #{port} — preview must start the server itself " \
+                  "(the Jump pairing token rides in on its environment); stop that server or use --port")
+        end
+
+        UI.step("starting #{UI.bold(@framework.name)} dev server #{UI.dim("(" + @framework.dev_command + ")")}")
+        env = { "PORT" => port.to_s,
+                "EVERYWHERE_JUMP_TOKEN" => @token,
+                "EVERYWHERE_PREVIEW_HOST" => URI.parse(@url).host }
+        # `rails server` binds localhost by default, which would make the LAN
+        # address on the QR a lie. BINDING is Rails' own env override; rackup
+        # bin/devs that pin --host still get warn_if_loopback_only.
+        env["BINDING"] = "0.0.0.0" if @lan
+        pid = supervise(:web, env, @framework.dev_command, chdir: @framework.root)
+        wait_for_port(port, pid: pid)
+      end
+
+      # --- the invitation -------------------------------------------------------
+
+      def jump_base = ENV.fetch("EVERY_JUMP_URL", "https://jump.rubyeverywhere.com").chomp("/")
+
+      def connect_url
+        "#{jump_base}/connect?#{URI.encode_www_form(url: @url, token: @token)}"
+      end
+
+      # POST /j on the Jump site trades the long connect URL for a short one —
+      # a nicer link to read out and a much smaller QR. Best-effort: preview
+      # works offline from the Jump site's point of view.
+      def share_link
+        require "net/http"
+        require "json"
+        uri = URI.parse("#{jump_base}/j")
+        response = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https",
+                                                       open_timeout: 5, read_timeout: 5) do |http|
+          http.post(uri.path, JSON.generate(url: @url, token: @token),
+                    "content-type" => "application/json")
+        end
+        response.code == "201" ? JSON.parse(response.body)["url"] : nil
+      rescue StandardError
+        nil
+      end
+
+      def announce
+        link = share_link || connect_url
+        UI.step("preview of #{UI.bold(@config.name)} is live → #{UI.cyan(@url)}")
+        Console.print(qr_ansi(link)) if $stdout.tty?
+        Console.print("  Scan with your phone's camera, or send:\n\n    #{UI.cyan(link)}\n\n")
+        Console.print("  #{UI.dim("Manual entry in Jump:")} #{@url}  #{UI.dim("token:")} #{@token}\n")
+        Console.print(UI.dim("  The link and QR die with this session — Ctrl-C to stop.\n"))
+        UI.note("waiting for devices…", marker: "⌁", color: :cyan)
+      end
+
+      # Half-block rendering: ▀ painted fg-for-top-module, bg-for-bottom packs
+      # two QR rows into one terminal line and one module into one column —
+      # a quarter of the area of rqrcode's own as_ansi, which burns two full
+      # cells per module. Explicit black/white (not theme colors), because a
+      # camera needs dark-on-light no matter what the terminal theme thinks.
+      #
+      # rqrcode is pure Ruby. The rescue is portability hardening: a missing
+      # gem downgrades the session to link-only instead of killing it.
+      def qr_ansi(link)
+        require "rqrcode"
+        modules = RQRCode::QRCode.new(link, level: :l).modules
+        quiet = 2
+        size = modules.length + quiet * 2
+        dark = lambda do |x, y|
+          gx = x - quiet
+          gy = y - quiet
+          gy.between?(0, modules.length - 1) && gx.between?(0, modules.length - 1) && modules[gy][gx]
+        end
+        (0...size).step(2).map do |y|
+          "  " + (0...size).map do |x|
+            top = dark.call(x, y)
+            bottom = (y + 1 < size) && dark.call(x, y + 1)
+            "\e[#{top ? 30 : 97};#{bottom ? 40 : 107}m▀"
+          end.join + "\e[0m"
+        end.join("\n") << "\e[0m\n"
+      rescue LoadError, StandardError => e
+        UI.warn("couldn't render the QR (#{e.class}) — use the link below")
+        ""
+      end
+
+      # --- the wait loop --------------------------------------------------------
+
+      # The server's death ends the session; the tunnel's doesn't. Quick
+      # tunnels are explicitly best-effort — Cloudflare recycles them — so a
+      # dead tunnel is restarted and the fresh URL re-announced. (The token
+      # survives, but the origin changed, so recents/short links need the new
+      # invitation.)
+      def wait
+        loop do
+          sleep 1
+          web = @children.synchronize { @pids[:web] }
+          UI.die!("the dev server exited — scroll up for its output") unless ChildProcesses.alive?(web)
+
+          tunnel = @children.synchronize { @pids[:tunnel] }
+          next if tunnel.nil? || ChildProcesses.alive?(tunnel)
+
+          UI.warn("the tunnel dropped — starting a fresh one")
+          stop_child(:tunnel)
+          @url = start_tunnel
+          announce
+        end
+      end
+
+      # --- child supervision (dev.rb's pattern, without the dock) ---------------
+
+      # quiet drops the child's routine chatter but always lets errors
+      # through — a quick tunnel that can't connect must say why.
+      def supervise(key, env, cmd, chdir:, on_line: nil, quiet: false)
+        filter = quiet ? ->(line) { line.match?(/\bERR\b|error/i) ? line : :drop } : nil
+        if Shellout.pty?
+          io, pid = Shellout.spawn_pty(env, cmd, chdir: chdir)
+        else
+          # No pty (Windows): a plain pipe loses colors but keeps the output —
+          # and the quick tunnel's URL parsing, which reads it.
+          io, writer = IO.pipe
+          pid = Process.spawn(env, cmd, chdir: chdir, %i[out err] => writer)
+          writer.close
+        end
+        thread = Thread.new do
+          Thread.current.name = "relay-#{key}"
+          Thread.current.report_on_exception = false
+          begin
+            Relay.new(io, source: key, filter: filter, on_line: on_line).run
+          rescue StandardError => e
+            Kernel.warn("#{key} output relay stopped: #{e.class}: #{e.message}")
+          end
+        end
+        Process.detach(pid)
+        @children.synchronize do
+          @pids[key] = pid
+          @relays[key] = thread
+        end
+        pid
+      end
+
+      def stop_child(key, grace: 5)
+        pid, thread = @children.synchronize { [@pids.delete(key), @relays.delete(key)] }
+        return unless pid
+
+        reap([pid], grace: grace)
+        thread&.join(1)
+      end
+
+      def reap(pids, grace: 5)
+        live = pids.compact.select { |pid| ChildProcesses.alive?(pid) }
+        return if live.empty?
+
+        live.each { |pid| ChildProcesses.signal(pid, "TERM") }
+        deadline = monotonic + grace
+        sleep(0.1) while live.any? { |pid| ChildProcesses.alive?(pid) } && monotonic < deadline
+        live.select { |pid| ChildProcesses.alive?(pid) }.each { |pid| ChildProcesses.signal(pid, "KILL") }
+      end
+
+      def teardown
+        pids, relays = @children ? @children.synchronize { [@pids.values, @relays.values] } : [[], []]
+        [
+          -> { reap(pids, grace: 2) },
+          -> { relays.each { |thread| thread.join(1) } }
+        ].each do |step|
+          step.call
+        rescue StandardError => e
+          Kernel.warn("teardown: #{e.class}: #{e.message}")
+        end
+      end
+
+      # --- helpers --------------------------------------------------------------
+
+      def monotonic = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+
+      def validate_port!(port)
+        number = begin
+          Integer(port.to_s, 10)
+        rescue ArgumentError, TypeError
+          UI.die!("--port must be a number (got #{port.inspect})")
+        end
+        UI.die!("--port must be between 1 and 65535 (got #{number})") unless (1..65_535).cover?(number)
+        number.to_s
+      end
+
+      def port_open?(port)
+        TCPSocket.new("127.0.0.1", Integer(port)).close
+        true
+      rescue SystemCallError
+        false
+      end
+
+      def wait_for_port(port, pid: nil, timeout: 60)
+        deadline = monotonic + timeout
+        until port_open?(port)
+          if pid && !ChildProcesses.alive?(pid)
+            UI.die!("the dev server exited before it finished booting — scroll up for its output")
+          end
+          UI.die!("dev server never came up on port #{port} after #{timeout}s") if monotonic > deadline
+          sleep 0.25
+        end
+      end
+    end
+  end
+end

data/lib/everywhere/commands/publish.rb

@@ -8,6 +8,7 @@ require_relative "../s3"
 require_relative "../update_manifest"
 require_relative "../paths"
 require_relative "../ui"
+require_relative "build"
 
 module Everywhere
   module Commands
@@ -21,6 +22,15 @@ module Everywhere
     # from everywhere.yml's updates.s3 section. See UpdateManifest for the
     # layout/JSON contract.
     class Publish < Dry::CLI::Command
+      # Only the .apk needs a specific type: Android refuses to install a
+      # download the server labelled application/octet-stream.
+      CONTENT_TYPES = {
+        ".zip" => "application/zip",
+        ".apk" => "application/vnd.android.package-archive",
+        ".aab" => "application/octet-stream",
+        ".ipa" => "application/octet-stream"
+      }.freeze
+
       desc "Publish a released build to your update bucket (self-hosted auto-updates)"
 
       option :root,        default: ".",  desc: "App root directory"
@@ -46,6 +56,12 @@ module Everywhere
           publish!(receipt_path(receipt), notes: read_notes(notes, notes_file),
                    key: key, latest_alias: latest_alias, force: force)
         end
+      rescue Everywhere::S3::Error => e
+        # RequestTimeExpired means the bucket rejected our SigV4 timestamp; the
+        # only realistic local cause is a wrong clock, and the raw message
+        # doesn't say so.
+        hint = e.message.include?("RequestTimeExpired") ? " — your system clock may be off by more than 15 minutes" : ""
+        UI.die!("#{e.message}#{hint}")
       end
 
       private
@@ -131,7 +147,7 @@ module Everywhere
       def rollback!(version, latest_alias:)
         # os/arch come from the receipt on publish; on rollback there may be no
         # dist/, so take the target from build.targets (or the default).
-        target = Array(@config.targets).first || "macos-arm64"
+        target = Array(@config.targets).first || Build::DEFAULT_TARGET
         os, arch = target.split("-", 2)
         loc = { channel: @channel, os: os, arch: arch, prefix: prefix }
 
@@ -207,6 +223,8 @@ module Everywhere
         signature
       rescue Minisign::PassphraseError
         UI.die!("wrong or missing key passphrase — set EVERYWHERE_SIGNING_KEY_PASSPHRASE")
+      rescue Minisign::Error => e
+        UI.die!("couldn't sign with that key — #{e.message}")
       end
 
       def signing_key(key_option)
@@ -244,7 +262,7 @@ module Everywhere
       end
 
       def content_type(filename)
-        filename.end_with?(".zip") ? "application/zip" : "application/octet-stream"
+        CONTENT_TYPES.fetch(File.extname(filename), "application/octet-stream")
       end
 
       def read_notes(notes, notes_file)

data/lib/everywhere/commands/release.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 require "dry/cli"
+require "digest"
+require "json"
 require_relative "../shellout"
 require_relative "../log_filter"
 require_relative "../receipt"
@@ -17,46 +19,101 @@ module Everywhere
     # surface (local, CI, Platform) must produce. See
     # platform/docs/build-engine.md §4, §7, §9.
     #
-    # Today only the macos builder is live; the target is parameterized so
-    # ios/android/windows/linux slot in as builders later.
+    # macos/ios/android are live; windows/linux slot in as builders later.
     class Release < Dry::CLI::Command
       NOTARIZE = File.expand_path("../../../support/release/macos/notarize.sh", __dir__)
 
+      # What counts as "the distributable" per os, newest first when several
+      # match. Android is listed aab-then-apk so a `--format aab` run picks the
+      # bundle even when an older apk is still sitting in dist/.
+      ARTIFACTS = { "macos" => %w[*.zip], "ios" => %w[*.ipa], "android" => %w[*.aab *.apk] }.freeze
+
       desc "Sign, notarize, staple, and emit release.json for a distributable build"
 
       option :root,       default: ".",              desc: "App root directory"
-      option :target,     default: "macos-arm64",    desc: "Build target (os-arch)"
+      option :target,     default: Build::DEFAULT_TARGET, desc: "Build target (os-arch)"
       option :channel,    default: "direct",         desc: "Distribution channel (direct | mac_app_store | ...)"
       option :ruby,       default: nil,              desc: "Ruby version to package (default: build.ruby or 4.0.6)"
       option :entry,      default: "native_boot.rb", desc: "Entry point script relative to root"
       option :app_name,   default: nil,              desc: "Bundle name (default from config)"
       option :shell_dir,  default: nil,              desc: "Path to the shell's src-tauri directory"
       option :env_file,   default: nil,              desc: "dotenv file with APPLE_* signing secrets (default: .env.release)"
-      option :skip_build, type: :boolean, default: false, desc: "Notarize the existing .app instead of rebuilding"
+      option :format,     default: "apk",            desc: "Android artifact format (apk | aab)"
+      option :skip_build, type: :boolean, default: false, desc: "Sign the existing build instead of rebuilding"
 
-      def call(root: ".", target: "macos-arm64", channel: "direct", ruby: nil, entry: "native_boot.rb",
-               app_name: nil, shell_dir: nil, env_file: nil, skip_build: false, **)
+      def call(root: ".", target: Build::DEFAULT_TARGET, channel: "direct", ruby: nil, entry: "native_boot.rb",
+               app_name: nil, shell_dir: nil, env_file: nil, format: "apk", skip_build: false, **)
         root_path = File.expand_path(root)
         config = Everywhere::Config.load(root_path)
         app_name ||= config.name(target: target)
         ruby ||= config.build_ruby || "4.0.6"
+        os = Everywhere::Config.os_of(target)
 
-        preflight!(target)
+        preflight!(target, os)
 
         framework = config.remote? ? nil : Framework.detect(root_path)
         dist_dir = File.expand_path("dist", root_path)
 
-        # 1. Produce (or reuse) the signed-for-dev .app via the build path. The
-        #    notarize step below re-signs it inside-out with the Developer ID.
+        # 1. Produce (or reuse) the build. macOS gets a dev-signed .app that the
+        #    notarize step re-signs inside-out with the Developer ID; the mobile
+        #    toolchains sign as they build, so their artifact is already final.
         unless skip_build
           UI.phase("Building #{app_name} for #{UI.target_label(target)}")
-          Build.new.call(root: root, ruby: ruby, entry: entry, app_name: app_name, target: target, shell_dir: shell_dir, **)
+          Build.new.call(root: root, ruby: ruby, entry: entry, app_name: app_name, target: target,
+                         shell_dir: shell_dir, **, **build_options(os, format, channel))
         end
 
+        # 2. Sign/notarize (macOS) or locate what the mobile builder signed, then
+        #    3. record the signing facts and emit the receipt.
+        artifact, signing = case os
+                            when "macos" then notarize!(dist_dir, root_path, env_file)
+                            when "ios"   then [find_artifact(dist_dir, os), ios_signing(dist_dir)]
+                            else              [find_artifact(dist_dir, os), android_signing]
+                            end
+
+        receipt = Receipt.new(root: root_path, config: config, framework: framework, ruby: ruby,
+                              target: target, channel: channel, shell_dir: resolve_shell_dir(shell_dir))
+        out = File.join(dist_dir, "release.json")
+        receipt.write(out, artifact: artifact, signing: signing)
+
+        summarize(out, artifact, signing, root_path)
+      end
+
+      private
+
+      def preflight!(target, os)
+        case os
+        when "macos"
+          UI.die!("`every release --target #{target}` runs on macOS only") unless darwin?
+          UI.die!("signing engine missing at #{NOTARIZE}") unless File.exist?(NOTARIZE)
+        when "ios"
+          UI.die!("iOS releases need Xcode — `every release --target #{target}` runs on macOS only") unless darwin?
+        when "android"
+          nil # Gradle signs and builds anywhere the Android SDK does — Linux included.
+        else
+          UI.die!("no release builder for #{target} — macos-*, ios-* and android-* are supported")
+        end
+      end
+
+      def darwin? = RUBY_PLATFORM.include?("darwin")
+
+      # Only the flag that belongs to this os: `every build` rejects the other.
+      # iOS also needs the channel: a testflight/app_store release uploads to App
+      # Store Connect from the build host, which only the builder can do.
+      def build_options(os, format, channel)
+        case os
+        when "ios"     then { device: true, channel: channel } # a release is always a device .ipa, never a simulator .app
+        when "android" then { format: format }
+        else {}
+        end
+      end
+
+      # macOS: sign (Developer ID + hardened runtime) → notarize → staple → verify,
+      # then read the signing facts back off the bundle.
+      def notarize!(dist_dir, root_path, env_file)
         app_dir = Dir[File.join(dist_dir, "*.app")].max_by { |d| File.mtime(d) }
         UI.die!("no .app found in #{dist_dir} — run without --skip-build first") unless app_dir
 
-        # 2. Sign (Developer ID + hardened runtime) → notarize → staple → verify.
         env_file ||= discover_env_file(root_path)
         env = env_file ? { "ENV_FILE" => env_file } : {}
         UI.phase("Signing & notarizing #{File.basename(app_dir)}")
@@ -65,27 +122,75 @@ module Everywhere
         log = "#{app_dir}.notarize.log"
         Shellout.run_logged!(env, ["/bin/bash", NOTARIZE, app_dir], log: log, filter: LogFilter.for(:notarize))
 
-        # 3. Gather signing facts from the bundle itself, then emit the receipt.
         artifact = "#{app_dir.sub(/\.app\z/, "")}.zip" # notarize.sh re-zips the stapled app
         UI.die!("expected notarized zip #{artifact} not found") unless File.exist?(artifact)
-        artifact = dashify(artifact)
 
-        signing = gather_signing(app_dir, log)
-        receipt = Receipt.new(root: root_path, config: config, framework: framework, ruby: ruby,
-                              target: target, channel: channel, shell_dir: resolve_shell_dir(shell_dir))
-        out = File.join(dist_dir, "release.json")
-        receipt.write(out, artifact: artifact, signing: signing)
+        [dashify(artifact), gather_signing(app_dir, log)]
+      end
 
-        summarize(out, artifact, signing, root_path)
+      # The mobile artifact ships as-is — no zip, no rename: an .ipa/.apk/.aab is
+      # already the installable container the stores and devices expect.
+      def find_artifact(dist_dir, os)
+        patterns = ARTIFACTS.fetch(os)
+        found = patterns.filter_map { |p| Dir[File.join(dist_dir, p)].max_by { |f| File.mtime(f) } }.first
+        return found if found
+
+        UI.die!("no #{patterns.map { |p| p.delete("*") }.join(" or ")} found in #{dist_dir} — " \
+                "run without --skip-build first")
       end
 
-      private
+      # Reaching this line IS the verification for iOS: xcodebuild -exportArchive
+      # refuses to emit an .ipa it couldn't sign with the requested profile, so
+      # there's nothing left to probe (and no spctl/stapler for a mobile bundle).
+      def ios_signing(dist_dir)
+        {
+          "signed" => true,
+          "signed_by" => ENV["EVERY_IOS_TEAM_ID"],
+          "verified" => true,
+          "platform" => {
+            "provisioning_profile" => ENV["EVERY_IOS_PROVISIONING_PROFILE"],
+            "distribution_method" => ENV["EVERY_IOS_EXPORT_METHOD"] || "app-store-connect",
+            "upload" => upload_bag(dist_dir)
+          }.compact
+        }
+      end
+
+      # dist/ios-upload.json is written by Builders::Ios only after the App Store
+      # Connect upload pass succeeded — so it's absent (and the key compacted
+      # away) for every non-store channel. This is the contract the Platform's
+      # store distributors read back out of the receipt.
+      def upload_bag(dist_dir)
+        path = File.join(dist_dir, "ios-upload.json")
+        return nil unless File.exist?(path)
+
+        JSON.parse(File.read(path))
+      rescue JSON::ParserError
+        nil
+      end
 
-      def preflight!(target)
-        os = target.split("-", 2).first
-        UI.die!("only the macos target is implemented (got #{target}); other builders are stubs") unless os == "macos"
-        UI.die!("`every release` runs on macOS only") unless RUBY_PLATFORM.include?("darwin")
-        UI.die!("signing engine missing at #{NOTARIZE}") unless File.exist?(NOTARIZE)
+      # Gradle only signs when a keystore was handed to it; without one it still
+      # produces a (debug/unsigned) artifact, so the receipt has to say which.
+      def android_signing
+        keystore = ENV["EVERY_ANDROID_KEYSTORE"]
+        fingerprint = keystore_fingerprint(keystore)
+        {
+          "signed" => !fingerprint.nil?,
+          "signed_by" => fingerprint,
+          "verified" => !fingerprint.nil?,
+          "platform" => {
+            "signing_scheme" => fingerprint ? "v2" : "unsigned",
+            "keystore_fingerprint" => fingerprint
+          }.compact
+        }
+      end
+
+      # The file digest, not keytool's certificate fingerprint: it identifies the
+      # keystore that signed this build without shelling out to the JDK (which the
+      # runner may not have on PATH) or unlocking it with the store password.
+      def keystore_fingerprint(keystore)
+        return nil if keystore.nil? || keystore.empty? || !File.exist?(keystore)
+
+        "sha256:#{Digest::SHA256.file(keystore).hexdigest}"
       end
 
       # The distributable filename must be URL/CI-safe, so spaces become dashes
@@ -140,12 +245,24 @@ module Everywhere
         UI.phase("Release ready 🎉")
         UI.success("#{rel(artifact, root_path)} #{UI.dim("(#{(File.size(artifact) / 1024.0 / 1024.0).round}MB — send this to your friends)")}")
         UI.substep("signed by #{UI.bold(signing["signed_by"] || "?")}")
-        UI.substep("notarized #{UI.yn(signing.dig("platform", "notarized"))} · " \
-                   "stapled #{UI.yn(signing.dig("platform", "stapled"))} · " \
-                   "gatekeeper #{UI.yn(signing["verified"])}")
+        UI.substep(signing_line(signing["platform"] || {}, signing))
         UI.substep("receipt #{UI.dim(rel(out, root_path))}")
       end
 
+      def signing_line(platform, signing)
+        if platform.key?("notarized")
+          "notarized #{UI.yn(platform["notarized"])} · stapled #{UI.yn(platform["stapled"])} · " \
+            "gatekeeper #{UI.yn(signing["verified"])}"
+        elsif platform.key?("distribution_method")
+          upload = platform["upload"]
+          "profile #{UI.bold(platform["provisioning_profile"] || "?")} · " \
+            "method #{platform["distribution_method"]}" \
+            "#{" · uploaded to App Store Connect (build #{upload["build_number"] || "?"})" if upload}"
+        else
+          "signing scheme #{UI.bold(platform["signing_scheme"] || "?")}"
+        end
+      end
+
       def rel(path, root_path) = UI.short_path(path.sub("#{root_path}/", "").sub("#{Dir.pwd}/", ""))
     end
   end

data/lib/everywhere/commands/shell_dir.rb

@@ -12,9 +12,9 @@ module Everywhere
     class ShellDir < Dry::CLI::Command
       desc "Print the path of the bundled shell (Tauri src-tauri, or the iOS template)"
 
-      option :target, default: "macos-arm64", desc: "Build target (os or os-arch) selecting which shell"
+      option :target, default: "macos", desc: "Build target (os or os-arch) selecting which shell"
 
-      def call(target: "macos-arm64", **)
+      def call(target: "macos", **)
         case Everywhere::Config.os_of(target)
         when "ios" then puts Everywhere::Paths.ios_dir!
         else            puts Everywhere::Paths.shell_dir!