ruby_everywhere 0.7.0 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 83b4d5f0135bc80870fdacccaf5014ee478cbaa2bad08541871ab67a6485d3fc
-  data.tar.gz: dd86792cae35b098877012c42ebe0286ada230909a8588c9a4c933c7c8771137
+  metadata.gz: a1644d6c9be14fdb8ef738eaee6f33225e5916ea401945f7c6c494e8963a2c16
+  data.tar.gz: 03621b7846f16b5621a352e7d4fc42ac38c8859095fc1be1098eef48b081fb0f
 SHA512:
-  metadata.gz: 97ad2a4b22e6255abcf6e68850ef9c2615ca725bfac46f62db9d7f2423314afdd882088589670cd609e3f9a8da854616b1b7af0015dd29e2bafff587664ff838
-  data.tar.gz: ec09e6586570025a8e02acb4d61f323f841201441341de7aa1cf3cfa621c74d331d1e48794e6e88e87990511e4a215233b990c86cfca11829aa52be0ea82b12a
+  metadata.gz: 4de42927fa8a53c136e0f9a3015ee1f930199642a26504d198673d0fe3e8cc24e32e9db219d34a170023809db8a9fb20715a6577e13cc6bb030fc9e3a8600b45
+  data.tar.gz: 58da2af357a422bd9dd87badf31175ba71767a5c3364d52f875690fd217a0be15cf1b12296bb195332ebec015ede65b7f486e3c1bf65ff66d5d0cb6831a20e3f

data/exe/every

@@ -1,17 +1,6 @@
 #!/usr/bin/env ruby
 # frozen_string_literal: true
 
-require "everywhere/cli"
-require "everywhere/ui"
+require "everywhere/entrypoint"
 
-begin
-  Dry::CLI.new(Everywhere::CLI).call
-rescue Interrupt
-  # ^C is an answer, not a crash: no backtrace, and the shell's own convention
-  # for "killed by SIGINT".
-  exit 130
-rescue Everywhere::Error => e
-  # Everywhere::Fatal is a SystemExit, not an Error, so a die! that already
-  # printed its own line passes straight through here.
-  Everywhere::UI.die!(e.message)
-end
+Everywhere::Entrypoint.run

data/exe/rbe

@@ -1,17 +1,6 @@
 #!/usr/bin/env ruby
 # frozen_string_literal: true
 
-require "everywhere/cli"
-require "everywhere/ui"
+require "everywhere/entrypoint"
 
-begin
-  Dry::CLI.new(Everywhere::CLI).call
-rescue Interrupt
-  # ^C is an answer, not a crash: no backtrace, and the shell's own convention
-  # for "killed by SIGINT".
-  exit 130
-rescue Everywhere::Error => e
-  # Everywhere::Fatal is a SystemExit, not an Error, so a die! that already
-  # printed its own line passes straight through here.
-  Everywhere::UI.die!(e.message)
-end
+Everywhere::Entrypoint.run

data/lib/everywhere/boot.rb

@@ -2,6 +2,7 @@
 
 require "fileutils"
 require "securerandom"
+require_relative "error"
 
 module Everywhere
   # Runtime boot for the packaged desktop build. Called from the app's
@@ -141,8 +142,14 @@ module Everywhere
     def ensure_secret_key_base
       secret_file = File.join(app_data, "secret_key_base")
       unless File.exist?(secret_file)
-        File.write(secret_file, SecureRandom.hex(64))
-        File.chmod(0o600, secret_file)
+        # Created 0600 rather than written then chmod'ed: this signs the app's
+        # cookies, and write-then-tighten leaves it world-readable in between.
+        # EXCL so a racing boot doesn't clobber the one already in use.
+        begin
+          File.open(secret_file, File::WRONLY | File::CREAT | File::EXCL, 0o600) { |f| f.write(SecureRandom.hex(64)) }
+        rescue Errno::EEXIST
+          nil
+        end
       end
       ENV["SECRET_KEY_BASE"] ||= File.read(secret_file).strip
     end

data/lib/everywhere/builders/android.rb

@@ -10,6 +10,8 @@ require_relative "../android_resources"
 require_relative "../android_sdk"
 require_relative "../version"
 require_relative "../ui"
+require_relative "base"
+require_relative "native_sources"
 
 module Everywhere
   module Builders
@@ -34,7 +36,7 @@ module Everywhere
     #
     # Signing and the format Play accepts are driven from the environment, not
     # from everywhere.yml — see SIGNING_ENV.
-    class Android
+    class Android < Base
       # Fixed by the template contract: one Gradle module, always :app, so
       # build paths and task names never depend on per-app values.
       GRADLE_MODULE = ":app"
@@ -107,23 +109,10 @@ module Everywhere
       # keeps its fonts out of assets/ still resolves.
       BUNDLED_FONT_DIRS = [%w[app src main assets fonts], %w[fonts]].freeze
 
-      # Marks which template a work dir was staged from. A gem upgrade can add,
-      # rename or delete template files, and staging merges rather than wipes
-      # (see #stage), so a stale Kotlin file from an older template would keep
-      # compiling in. Version mismatch = wipe once, then merge as usual.
-      STAGE_MARKER = ".everywhere-template"
-
       # What AGP accepts as an applicationId: two or more segments, each a Java
       # identifier starting with a letter. No hyphens, unlike a bundle id.
       APPLICATION_ID = /\A[a-zA-Z]\w*(\.[a-zA-Z]\w*)+\z/
 
-      def initialize(config:, root:, target:, template_dir: nil)
-        @config = config
-        @root = root
-        @target = target
-        @template_dir = template_dir
-      end
-
       # Build the app and copy it into dist_dir. `dev` builds the debug variant
       # and relaxes the remote-mode requirement (the dev URL is stamped into a
       # debug asset each run — Android has no SIMCTL_CHILD_* equivalent).
@@ -147,8 +136,9 @@ module Everywhere
 
       private
 
-      def name = @config.name(target: @target)
-      def application_id = @config.bundle_id(target: @target)
+      # AGP name for the bundle id, kept because everything Android-side (the
+      # properties file, the work dir, the validation) says applicationId.
+      def application_id = bundle_id
 
       # The dev-server URL, for the debug source set only (EverywhereConfig's
       # devUrl reads it, and release builds never look). This is the whole of
@@ -258,14 +248,6 @@ module Everywhere
             env_value("EVERY_ANDROID_KEYSTORE_PASSWORD") }
       end
 
-      # An env var that was set to nothing is the same as unset here: CI writes
-      # `EVERY_ANDROID_KEYSTORE: ${{ secrets.KEYSTORE }}` whether or not the
-      # secret exists, and an empty keystore path must not look configured.
-      def env_value(name)
-        value = ENV[name].to_s.strip
-        value.empty? ? nil : value
-      end
-
       # Copy the template into the app's persistent work dir. Merged over
       # whatever is already there, NOT wiped like the iOS stage: Gradle's
       # incremental state (app/build/, .gradle/) lives *inside* this directory,
@@ -281,15 +263,10 @@ module Everywhere
         # non-executable gradlew fails with a bare "Permission denied".
         wrapper = File.join(work, "gradlew")
         FileUtils.chmod("u+x", wrapper) if File.file?(wrapper)
-        File.write(File.join(work, STAGE_MARKER), "#{Everywhere::VERSION}\n")
+        mark_staged!(work)
         work
       end
 
-      def staged_version(work)
-        marker = File.join(work, STAGE_MARKER)
-        File.read(marker).strip if File.file?(marker)
-      end
-
       # The whole per-app surface: identity properties, two JSON assets, colors,
       # launcher icons, the icon font, the merged-in manifest, the Extensions
       # sources + generated registry, and the Maven coordinate script. No build
@@ -565,7 +542,13 @@ module Everywhere
             when Net::HTTPRedirection
               raise "too many redirects for #{url}" if redirects <= 0
 
-              return fetch!(response["location"], dest, sha256: sha256, redirects: redirects - 1)
+              # The font is checksummed, so a swapped body is caught anyway —
+              # but the base is https and a redirect has no business dropping
+              # to http on the way to a cached artifact.
+              target = URI.join(uri, response["location"].to_s)
+              raise "refusing a non-https redirect to #{target.host}" unless target.scheme == "https"
+
+              return fetch!(target.to_s, dest, sha256: sha256, redirects: redirects - 1)
             when Net::HTTPSuccess
               File.open(part, "wb") { |f| response.read_body { |chunk| f.write(chunk) } }
             else
@@ -764,18 +747,9 @@ module Everywhere
         FileUtils.rm_rf(dest)
         FileUtils.mkdir_p(dest)
 
-        source = File.join(@root, "native", "android")
-        sources = File.directory?(source) ? Dir.glob(File.join(source, "**", "*.kt")).sort : []
-        sources.each do |file|
-          relative = file.delete_prefix("#{source}/")
-          if File.basename(file) == "EverywhereExtensions.kt"
-            UI.die!("native/android/#{relative}: EverywhereExtensions.kt is generated by " \
-                    "`every build` — declare your types under native.android in config/everywhere.yml instead")
-          end
+        sources = NativeSources.copy!(from: File.join(@root, "native", "android"), into: dest, ext: "kt",
+                                      reserved: "EverywhereExtensions.kt", label: "native/android") do |file, relative|
           check_package!(file, relative)
-          target_file = File.join(dest, relative)
-          FileUtils.mkdir_p(File.dirname(target_file))
-          FileUtils.cp(file, target_file)
         end
 
         if @config.native_android?

data/lib/everywhere/builders/base.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require_relative "../version"
+
+module Everywhere
+  module Builders
+    # What the three platform builders (Android, Ios, Desktop) genuinely share.
+    # Deliberately thin: `stage`, `preflight!`, `stamp!` and `collect` are
+    # structurally parallel across the three but mean different things on each
+    # platform, so they stay where they are. Only identity (name, bundle id),
+    # the environment reader and the stage marker live here.
+    class Base
+      # Marks which template a work dir was staged from. A gem upgrade can add,
+      # rename or delete template files, and staging merges rather than wipes
+      # (see #stage), so a stale Kotlin file from an older template would keep
+      # compiling in. Version mismatch = wipe once, then merge as usual.
+      STAGE_MARKER = ".everywhere-template"
+
+      # `target` is a build target like "ios-arm64" or "android-arm64"; the
+      # desktop builder has none, and everything below reads it as nil.
+      def initialize(config:, root:, target: nil, template_dir: nil)
+        @config = config
+        @root = root
+        @target = target
+        @template_dir = template_dir
+      end
+
+      private
+
+      def name = @config.name(target: @target)
+      def bundle_id = @config.bundle_id(target: @target)
+
+      # An env var that was set to nothing is the same as unset here: CI writes
+      # `EVERY_ANDROID_KEYSTORE: ${{ secrets.KEYSTORE }}` whether or not the
+      # secret exists, and an empty keystore path must not look configured.
+      def env_value(name)
+        value = ENV[name].to_s.strip
+        value.empty? ? nil : value
+      end
+
+      def staged_version(work)
+        marker = File.join(work, STAGE_MARKER)
+        File.read(marker).strip if File.file?(marker)
+      end
+
+      # Records which gem version staged this work dir, for the next run to
+      # read back.
+      def mark_staged!(work)
+        File.write(File.join(work, STAGE_MARKER), "#{Everywhere::VERSION}\n")
+      end
+    end
+  end
+end

data/lib/everywhere/builders/desktop.rb

@@ -4,6 +4,8 @@ require "fileutils"
 require_relative "../paths"
 require_relative "../ui"
 require_relative "../version"
+require_relative "base"
+require_relative "native_sources"
 
 module Everywhere
   module Builders
@@ -40,11 +42,10 @@ module Everywhere
     # Everything else in the work dir is the frozen template, copied as-is. In
     # particular src/main.rs, src/extension_host.rs and capabilities/ are never
     # rewritten — see support/desktop/README.md.
-    class Desktop
+    class Desktop < Base
       # The generated module file, at every level of src/extensions. Reserved:
       # an app shipping its own would be silently overwritten, so we refuse.
       MODULE_FILE = "mod.rs"
-      STAGE_MARKER = ".everywhere-template"
       CRATES_MARKER = "# __EVERYWHERE_APP_CRATES__"
 
       # Where the app keeps its Rust, relative to the app root.
@@ -54,12 +55,6 @@ module Everywhere
         def stamped? = stamped
       end
 
-      def initialize(config:, root:, template_dir: nil)
-        @config = config
-        @root = root
-        @template_dir = template_dir
-      end
-
       # Returns where to run cargo and what to set CARGO_TARGET_DIR to. Callers
       # (`every dev`, `every build`) don't need to care which path they got.
       def prepare!
@@ -76,8 +71,6 @@ module Everywhere
 
       private
 
-      def bundle_id = @config.bundle_id
-
       # Config errors first: they're free to check, and everything below either
       # interpolates these values into generated Rust or spends minutes on cargo.
       def preflight!
@@ -109,15 +102,10 @@ module Everywhere
         FileUtils.rm_rf(work) unless staged_version(work) == Everywhere::VERSION
         FileUtils.mkdir_p(work)
         FileUtils.cp_r(File.join(File.dirname(template), "."), work)
-        File.write(File.join(work, STAGE_MARKER), "#{Everywhere::VERSION}\n")
+        mark_staged!(work)
         File.join(work, File.basename(template))
       end
 
-      def staged_version(work)
-        marker = File.join(work, STAGE_MARKER)
-        File.read(marker).strip if File.file?(marker)
-      end
-
       def stamp!(work)
         write_cargo_toml(work)
         write_extensions(work)
@@ -194,17 +182,13 @@ module Everywhere
         FileUtils.mkdir_p(dest)
 
         source = File.join(@root, SOURCE_DIR)
-        sources = File.directory?(source) ? Dir.glob(File.join(source, "**", "*.rs")).sort : []
-        sources.each do |path|
-          relative = path.delete_prefix("#{source}/")
+        # mod.rs is reserved here rather than by NativeSources: the fix isn't to
+        # declare the file in everywhere.yml, it's to delete it.
+        sources = NativeSources.copy!(from: source, into: dest, ext: "rs") do |_path, relative|
           if File.basename(relative) == MODULE_FILE
             UI.die!("#{File.join(SOURCE_DIR, relative)} is generated by `every build` — " \
                     "remove it and let the CLI write the module declarations")
           end
-
-          target = File.join(dest, relative)
-          FileUtils.mkdir_p(File.dirname(target))
-          FileUtils.cp(path, target)
         end
 
         modules = module_tree(sources.map { |path| path.delete_prefix("#{source}/") })

data/lib/everywhere/builders/ios.rb

@@ -1,12 +1,16 @@
 # frozen_string_literal: true
 
 require "fileutils"
+require_relative "../host"
 require_relative "../paths"
 require_relative "../shellout"
 require_relative "../log_filter"
 require_relative "../icon"
 require_relative "../asset_catalog"
+require_relative "../plist"
 require_relative "../ui"
+require_relative "base"
+require_relative "native_sources"
 
 module Everywhere
   module Builders
@@ -18,7 +22,7 @@ module Everywhere
     # Two products come out of the same stamped project: the Simulator .app
     # (ad-hoc signed, no certs) and, with device: true, a signed .ipa via
     # xcodebuild archive + -exportArchive — see platform/docs/build-engine.md §5.
-    class Ios
+    class Ios < Base
       # Fixed by the template contract: the target/product is always "App"
       # (App.app), so build paths never depend on per-app values.
       SCHEME = "App"
@@ -48,10 +52,7 @@ module Everywhere
       }.freeze
 
       def initialize(config:, root:, target:, template_dir: nil, channel: "direct")
-        @config = config
-        @root = root
-        @target = target
-        @template_dir = template_dir
+        super(config: config, root: root, target: target, template_dir: template_dir)
         @channel = channel.to_s
       end
 
@@ -62,6 +63,7 @@ module Everywhere
       # Returns the path of the built product.
       def build!(dist_dir:, dev: false, device: false)
         preflight!(dev: dev, device: device)
+        @device = device
         template = @template_dir ? File.expand_path(@template_dir) : Paths.ios_dir!
         work = stage(template)
         stamp!(work)
@@ -77,15 +79,12 @@ module Everywhere
 
       private
 
-      def name = @config.name(target: @target)
-      def bundle_id = @config.bundle_id(target: @target)
-
       def preflight!(dev:, device:)
         unless dev || @config.remote?
           UI.die!("iOS apps are remote mode only for now — set remote.url in config/everywhere.yml " \
                   "(the shell wraps your deployed app; nothing is packaged locally)")
         end
-        UI.die!("iOS builds need macOS with Xcode installed") unless RUBY_PLATFORM.include?("darwin")
+        UI.die!("iOS builds need macOS with Xcode installed") unless Host.darwin?
         return device_preflight! if device
         return if Shellout.run?("xcrun", "--sdk", "iphonesimulator", "--show-sdk-path", quiet: true)
 
@@ -102,7 +101,7 @@ module Everywhere
                   "and run: xcode-select --switch /Applications/Xcode.app")
         end
 
-        missing = REQUIRED_SIGNING_ENV.reject { |name, _| signing_env(name) }
+        missing = REQUIRED_SIGNING_ENV.reject { |name, _| env_value(name) }
         unless missing.empty?
           UI.die!("device builds need signing credentials in the environment:\n" \
                   "#{missing.map { |name, hint| "  #{name} — #{hint}" }.join("\n")}")
@@ -129,20 +128,15 @@ module Everywhere
                 "#{DEFAULT_EXPORT_METHOD} builds — unset EVERY_IOS_EXPORT_METHOD=#{export_method}")
       end
 
-      def signing_env(name)
-        value = ENV[name].to_s.strip
-        value.empty? ? nil : value
-      end
-
-      def asc_env(field) = ASC_ENV.fetch(field).filter_map { |name| signing_env(name) }.first
+      def asc_env(field) = ASC_ENV.fetch(field).filter_map { |name| env_value(name) }.first
 
       def store_channel? = STORE_CHANNELS.include?(@channel)
       def upload_to_asc? = store_channel? && ASC_ENV.each_key.all? { |field| asc_env(field) }
 
-      def team_id = signing_env("EVERY_IOS_TEAM_ID")
-      def provisioning_profile = signing_env("EVERY_IOS_PROVISIONING_PROFILE")
-      def signing_identity = signing_env("APPLE_SIGNING_IDENTITY")
-      def export_method = signing_env("EVERY_IOS_EXPORT_METHOD") || DEFAULT_EXPORT_METHOD
+      def team_id = env_value("EVERY_IOS_TEAM_ID")
+      def provisioning_profile = env_value("EVERY_IOS_PROVISIONING_PROFILE")
+      def signing_identity = env_value("APPLE_SIGNING_IDENTITY")
+      def export_method = env_value("EVERY_IOS_EXPORT_METHOD") || DEFAULT_EXPORT_METHOD
 
       # Copy the template into the app's persistent work dir. Persistent (not
       # a tmpdir) so the project path is stable — Xcode's incremental state
@@ -189,7 +183,7 @@ module Everywhere
         return unless @config.deep_linking? && domains.any?
 
         values = domains.flat_map { |host| ["applinks:#{host}", "webcredentials:#{host}"] }
-        entries = values.map { |v| "\t\t<string>#{v}</string>" }.join("\n")
+        entries = values.map { |v| "\t\t<string>#{xml_escape(v)}</string>" }.join("\n")
         UI.step("stamping associated domains #{UI.dim("(#{domains.join(", ")})")}")
         File.write(File.join(work, "App", "App.entitlements"), <<~PLIST)
           <?xml version="1.0" encoding="UTF-8"?>
@@ -215,19 +209,8 @@ module Everywhere
         UI.die!("native.ios in config/everywhere.yml:\n#{errors.join("\n")}") unless errors.empty?
 
         dest = File.join(work, "App", "Extensions")
-        source = File.join(@root, "native", "ios")
-        sources = File.directory?(source) ? Dir.glob(File.join(source, "**", "*.swift")).sort : []
-
-        sources.each do |file|
-          relative = file.delete_prefix("#{source}/")
-          if File.basename(file) == "EverywhereExtensions.swift"
-            UI.die!("native/ios/#{relative}: EverywhereExtensions.swift is generated by " \
-                    "`every build` — declare your types under native.ios in config/everywhere.yml instead")
-          end
-          target_file = File.join(dest, relative)
-          FileUtils.mkdir_p(File.dirname(target_file))
-          FileUtils.cp(file, target_file)
-        end
+        sources = NativeSources.copy!(from: File.join(@root, "native", "ios"), into: dest, ext: "swift",
+                                      reserved: "EverywhereExtensions.swift", label: "native/ios")
 
         if @config.native_ios?
           UI.step("bundling native extensions #{UI.dim("(#{sources.length} Swift files from native/ios)")}")
@@ -439,15 +422,38 @@ module Everywhere
         File.write(File.join(work, "App", "App.xcconfig"), <<~XCCONFIG)
           // Written by `every build --target #{@target}` — do not edit; changes
           // belong in config/everywhere.yml.
-          PRODUCT_BUNDLE_IDENTIFIER = #{bundle_id}
-          MARKETING_VERSION = #{@config.version(target: @target)}
+          PRODUCT_BUNDLE_IDENTIFIER = #{xcconfig_value(bundle_id)}
+          MARKETING_VERSION = #{xcconfig_value(@config.version(target: @target))}
           CURRENT_PROJECT_VERSION = 1
-          INFOPLIST_KEY_CFBundleDisplayName = #{name}
-          DEVELOPMENT_TEAM =#{" #{team_id}" if team_id}
-          #{entitlements}
+          INFOPLIST_KEY_CFBundleDisplayName = #{xcconfig_value(name)}
+          DEVELOPMENT_TEAM =#{" #{xcconfig_value(team_id)}" if team_id}
+          #{entitlements}#{device_signing_xcconfig}
         XCCONFIG
       end
 
+      # Signing lives here, not on the xcodebuild command line: command-line
+      # build settings apply to every target in the build — including SPM
+      # resource-bundle targets (HotwireNative_HotwireNative), which reject
+      # PROVISIONING_PROFILE_SPECIFIER outright. The xcconfig is scoped to the
+      # App target.
+      def device_signing_xcconfig
+        return unless @device
+
+        identity = signing_identity ||
+                   (export_method == "development" ? "Apple Development" : "Apple Distribution")
+        <<~XCCONFIG
+          CODE_SIGN_STYLE = Manual
+          PROVISIONING_PROFILE_SPECIFIER = #{xcconfig_value(provisioning_profile)}
+          CODE_SIGN_IDENTITY = #{xcconfig_value(identity)}
+        XCCONFIG
+      end
+
+      # An xcconfig is line-oriented: a value carrying a newline doesn't produce
+      # a broken setting, it produces an ADDITIONAL one of the author's
+      # choosing (OTHER_CODE_SIGN_FLAGS, a run-script path, …). Strip rather
+      # than die — the same values feed non-xcconfig writers that don't care.
+      def xcconfig_value(value) = value.to_s.gsub(/[\r\n]+/, " ").strip
+
       def write_app_icon(work)
         source = @config.icon
         unless source && File.exist?(source)
@@ -498,11 +504,8 @@ module Everywhere
                              log: log, filter: LogFilter.for(:xcodebuild))
       end
 
-      # Archive for a real device. The signing settings are passed as
-      # command-line build settings because those override the project file —
-      # the template ships CODE_SIGN_STYLE = Automatic and the stamp-only
-      # contract forbids editing its pbxproj. CODE_SIGN_IDENTITY is left to
-      # xcodebuild ("Apple Distribution") unless the runner names one.
+      # Archive for a real device. Signing arrives via the stamped xcconfig
+      # (device_signing_xcconfig), never as command-line build settings.
       def archive!(work, dist_dir)
         UI.step("archiving iOS app #{UI.dim("(xcodebuild archive, team #{team_id})")}")
         FileUtils.mkdir_p(dist_dir)
@@ -515,11 +518,7 @@ module Everywhere
                               "-destination", "generic/platform=iOS",
                               "-archivePath", archive_path(work),
                               "-derivedDataPath", Paths.ios_derived_data_dir,
-                              "-clonedSourcePackagesDirPath", Paths.ios_packages_dir,
-                              "CODE_SIGN_STYLE=Manual",
-                              "DEVELOPMENT_TEAM=#{team_id}",
-                              "PROVISIONING_PROFILE_SPECIFIER=#{provisioning_profile}",
-                              *("CODE_SIGN_IDENTITY=#{signing_identity}" if signing_identity)],
+                              "-clonedSourcePackagesDirPath", Paths.ios_packages_dir],
                              log: File.join(dist_dir, "ios-archive.log"), filter: LogFilter.for(:xcodebuild))
       end
 
@@ -635,9 +634,7 @@ module Everywhere
         path
       end
 
-      # Profile names are free-form and come from outside the CLI, so this is
-      # the one interpolated plist value that can't be trusted as XML.
-      def xml_escape(value) = value.to_s.gsub("&", "&amp;").gsub("<", "&lt;").gsub(">", "&gt;")
+      def xml_escape(value) = Everywhere::Plist.escape(value)
 
       def collect_ipa(export, dist_dir)
         built = File.join(export, "App.ipa")

data/lib/everywhere/builders/native_sources.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require_relative "../ui"
+
+module Everywhere
+  module Builders
+    # The half of the native-extension seam that is the same on all three
+    # platforms: copy the app repo's native/<platform>/**/*.<ext> into the
+    # staged template, preserving relative paths. What the copied files then
+    # have to satisfy (a Kotlin package line) and what gets generated alongside
+    # them (a registry, mod.rs) is per-platform and stays in the builders.
+    module NativeSources
+      # `reserved` is the generated file's own name: an app shipping one would
+      # be overwritten by the generator, so we refuse instead. `label` is the
+      # source dir as the app sees it ("native/ios"), which doubles as the
+      # everywhere.yml key it maps to (native.ios). The block, when given, sees
+      # each file before it is copied. Returns the source paths, sorted.
+      def self.copy!(from:, into:, ext:, reserved: nil, label: nil)
+        sources = File.directory?(from) ? Dir.glob(File.join(from, "**", "*.#{ext}")).sort : []
+        sources.each do |file|
+          relative = file.delete_prefix("#{from}/")
+          if reserved && File.basename(file) == reserved
+            UI.die!("#{label}/#{relative}: #{reserved} is generated by " \
+                    "`every build` — declare your types under #{label.tr("/", ".")} " \
+                    "in config/everywhere.yml instead")
+          end
+          yield(file, relative) if block_given?
+
+          target = File.join(into, relative)
+          FileUtils.mkdir_p(File.dirname(target))
+          FileUtils.cp(file, target)
+        end
+        sources
+      end
+    end
+  end
+end

data/lib/everywhere/child_processes.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "clock"
+
 module Everywhere
   # A thread-scoped registry of the long-running children a task spawned, so the
   # task can be cancelled without hunting pids by hand.
@@ -38,8 +40,8 @@ module Everywhere
       return [] if pids.empty?
 
       pids.each { |pid| signal(pid, "TERM") }
-      deadline = now + grace
-      sleep(0.1) while pids.any? { |pid| alive?(pid) } && now < deadline
+      deadline = Clock.monotonic + grace
+      sleep(0.1) while pids.any? { |pid| alive?(pid) } && Clock.monotonic < deadline
       pids.select { |pid| alive?(pid) }.each { |pid| signal(pid, "KILL") }
     end
 
@@ -64,8 +66,6 @@ module Everywhere
       true
     end
 
-    def now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-
     def list
       Thread.current.thread_variable_get(PIDS) ||
         Thread.current.thread_variable_set(PIDS, [])