RubyGems - ruby_everywhere - Versions diffs - 0.7.0 → 0.8.0 - Mend

ruby_everywhere 0.7.0 → 0.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (63) hide show

checksums.yaml +4 -4
data/exe/every +2 -13
data/exe/rbe +2 -13
data/lib/everywhere/boot.rb +9 -2
data/lib/everywhere/builders/android.rb +16 -42
data/lib/everywhere/builders/base.rb +53 -0
data/lib/everywhere/builders/desktop.rb +7 -23
data/lib/everywhere/builders/ios.rb +49 -52
data/lib/everywhere/builders/native_sources.rb +38 -0
data/lib/everywhere/child_processes.rb +4 -4
data/lib/everywhere/child_supervision.rb +172 -0
data/lib/everywhere/clock.rb +12 -0
data/lib/everywhere/commands/build.rb +20 -9
data/lib/everywhere/commands/dev.rb +59 -284
data/lib/everywhere/commands/doctor.rb +6 -6
data/lib/everywhere/commands/install.rb +1 -0
data/lib/everywhere/commands/platform/auth_status.rb +1 -0
data/lib/everywhere/commands/platform/build.rb +5 -6
data/lib/everywhere/commands/platform/login.rb +4 -4
data/lib/everywhere/commands/platform/logout.rb +1 -0
data/lib/everywhere/commands/platform/runner.rb +62 -7
data/lib/everywhere/commands/preview.rb +24 -97
data/lib/everywhere/commands/publish.rb +2 -0
data/lib/everywhere/commands/release.rb +14 -11
data/lib/everywhere/commands/shell_dir.rb +2 -0
data/lib/everywhere/commands/updates_keygen.rb +25 -1
data/lib/everywhere/config/app.rb +126 -0
data/lib/everywhere/config/auth.rb +108 -0
data/lib/everywhere/config/data.rb +50 -0
data/lib/everywhere/config/deep_linking.rb +107 -0
data/lib/everywhere/config/desktop_ui.rb +153 -0
data/lib/everywhere/config/mobile.rb +211 -0
data/lib/everywhere/config/native_desktop.rb +168 -0
data/lib/everywhere/config/native_mobile.rb +337 -0
data/lib/everywhere/config/shell.rb +57 -0
data/lib/everywhere/config/updates.rb +63 -0
data/lib/everywhere/config.rb +30 -1423
data/lib/everywhere/desktop_dev_app.rb +138 -0
data/lib/everywhere/dock/state.rb +3 -1
data/lib/everywhere/entrypoint.rb +24 -0
data/lib/everywhere/error.rb +8 -0
data/lib/everywhere/framework.rb +2 -2
data/lib/everywhere/host.rb +11 -0
data/lib/everywhere/ignore.rb +11 -5
data/lib/everywhere/line_pump.rb +3 -1
data/lib/everywhere/minisign.rb +1 -0
data/lib/everywhere/native_platform.rb +44 -0
data/lib/everywhere/paths.rb +23 -7
data/lib/everywhere/platform/client.rb +19 -1
data/lib/everywhere/platform/snapshot.rb +6 -4
data/lib/everywhere/plist.rb +17 -0
data/lib/everywhere/png.rb +1 -0
data/lib/everywhere/raw_tty.rb +51 -0
data/lib/everywhere/s3.rb +1 -0
data/lib/everywhere/shell_pages.rb +109 -0
data/lib/everywhere/tab_filter.rb +36 -0
data/lib/everywhere/task_pool.rb +3 -4
data/lib/everywhere/ui.rb +6 -1
data/lib/everywhere/version.rb +6 -4
data/lib/everywhere.rb +1 -2
data/support/mobile/ios/App.xcodeproj/project.pbxproj +0 -2
data/support/release/macos/notarize.sh +3 -0
metadata +24 -1

data/lib/everywhere/config.rb CHANGED Viewed

@@ -1,189 +1,23 @@
 # frozen_string_literal: true
 require "yaml"
+require_relative "error"
 require_relative "ui"
+require_relative "native_platform"
+require_relative "shell_pages"
+require_relative "tab_filter"
+require_relative "config/data"
+require_relative "config/app"
+require_relative "config/updates"
+require_relative "config/desktop_ui"
+require_relative "config/auth"
+require_relative "config/mobile"
+require_relative "config/native_mobile"
+require_relative "config/native_desktop"
+require_relative "config/deep_linking"
+require_relative "config/shell"
 module Everywhere
-  # Also defined by everywhere.rb and framework.rb; repeated here so config.rb
-  # stays loadable on its own (the packaged runtime requires it piecemeal).
-  class Error < StandardError; end
-  class << self
-    # Register a per-request filter for the mobile tab bar. The block receives
-    # the resolved tab list (`[{ "title" =>, "path" =>, "icon" => }, …]`) and
-    # the current request, and returns the subset to show — return `[]` to hide
-    # the tab bar entirely (the shell falls back to single-screen navigation).
-    #
-    # It runs inside the mobile config endpoint, which shares the app's session
-    # and cookies, so it can branch on auth or any request state:
-    #
-    #   # config/initializers/everywhere.rb
-    #   Everywhere.filter_tabs do |tabs, request|
-    #     request.session[:user_id] ? tabs : []
-    #   end
-    #
-    # Live like the rest of the config: the shell re-reads it on launch and on
-    # every foreground, so a sign-in shows the tabs on next foreground — no
-    # rebuild, no app-store release.
-    def filter_tabs(&block)
-      @tabs_filter = block
-    end
-    # Apply the registered filter (identity when none is set). Always returns
-    # an Array so a stray nil/scalar from a block can't break serialization.
-    def resolve_tabs(tabs, request)
-      return tabs unless @tabs_filter
-      Array(@tabs_filter.call(tabs, request))
-    end
-    # The tiny page served at /everywhere/reset. Auth flows redirect the native
-    # app here so it resets cleanly (fresh web views, re-fetched tabs) before
-    # continuing — the standard Hotwire Native "reset the app" pattern. It talks
-    # to the shell's control channel directly (no bridge/importmap dependency);
-    # in a plain browser it just forwards to the target. `to` is constrained to
-    # a same-origin path.
-    #
-    # Both shells are addressed inline, and differently, for the same reason
-    # the bridge normalizes them: WKWebView's message handler takes an object,
-    # while Android's WebMessageListener channel takes a string. Reaching for
-    # the bridge here instead would trade that one line for an importmap
-    # dependency on a page whose whole job is to work before anything loads.
-    def mobile_reset_html(to)
-      require "json"
-      target = to.to_s
-      target = "/" unless target.start_with?("/") && !target.start_with?("//")
-      # script_safe, not to_json: this lands inside <script>, and outside Rails
-      # nothing escapes "</script>" in a plain JSON string.
-      encoded = JSON.generate(target, script_safe: true)
-      <<~HTML
-        <!DOCTYPE html><html><head><meta charset="utf-8"><title>One moment…</title>
-        <meta name="viewport" content="width=device-width,initial-scale=1"></head>
-        <body><script>
-        (function(){var to=#{encoded};var msg={action:"reset",to:to};
-        var ios=window.webkit&&window.webkit.messageHandlers&&window.webkit.messageHandlers.everywhereControl;
-        var android=window.everywhereControl;
-        if(ios){ios.postMessage(msg);}
-        else if(android&&android.postMessage){android.postMessage(JSON.stringify(msg));}
-        else{window.location.replace(to);}})();
-        </script></body></html>
-      HTML
-    end
-    # The page served at /everywhere/jump/leave — the way OUT of a Jump
-    # preview. Once Jump re-roots onto a previewed app (instance.set), every
-    # Jump surface — launcher, scanner, tabs — resolves against the previewed
-    # app, so the escape hatch has to be served by the previewed app itself:
-    # this gem is the one thing guaranteed to be there. Posts clearInstance on
-    # the shell's control channel; shells that aren't multi-instance ignore
-    # it, and a plain browser just goes home.
-    # Fires clearInstance only once VISIBLE. This page rides in the previewed
-    # app's tab bar; shells preload tabs eagerly, but a preloaded webview is
-    # offscreen and reports visibilityState "hidden" — firing on load would
-    # bounce every preview the instant it connects, and a tap on the tab
-    # never re-proposes a visit, so visibility flipping is the ONLY signal a
-    # tab tap gives the page. The button is a belt for browsers and any
-    # webview that lies about visibility.
-    def mobile_jump_leave_html
-      <<~HTML
-        <!DOCTYPE html><html><head><meta charset="utf-8"><title>Jump</title>
-        <meta name="viewport" content="width=device-width,initial-scale=1">
-        <style>
-          body{font-family:-apple-system,system-ui,sans-serif;margin:0;min-height:100vh;
-               display:flex;flex-direction:column;align-items:center;justify-content:center;
-               gap:12px;padding:24px;text-align:center;background:#fff;color:#171717}
-          @media(prefers-color-scheme:dark){body{background:#171717;color:#fafafa}}
-          p{margin:0;opacity:.6}
-          button{font:inherit;font-weight:600;font-size:18px;color:#fff;background:#dc2626;
-                 border:0;border-radius:12px;padding:16px 32px}
-        </style></head>
-        <body>
-        <p>Returning to Jump…</p>
-        <button onclick="everywhereJumpLeave()">Return to Jump</button>
-        <script>
-        function everywhereJumpLeave(){var msg={action:"clearInstance"};
-        var ios=window.webkit&&window.webkit.messageHandlers&&window.webkit.messageHandlers.everywhereControl;
-        var android=window.everywhereControl;
-        if(ios){ios.postMessage(msg);}
-        else if(android&&android.postMessage){android.postMessage(JSON.stringify(msg));}
-        else{window.location.replace("/");}}
-        if(document.visibilityState==="visible"){everywhereJumpLeave();}
-        else{document.addEventListener("visibilitychange",function(){
-          if(document.visibilityState==="visible"){everywhereJumpLeave();}});}
-        </script></body></html>
-      HTML
-    end
-    # The page served at /everywhere/auth/native. The shell normally diverts a
-    # provider path natively, before the request is ever made; this covers the
-    # visits it can't see — a `data-turbo="false"` link, or the POST OmniAuth 2
-    # requires — by asking the shell, from the page, to open the auth session.
-    # In a browser it just continues to the provider.
-    def mobile_auth_html(to)
-      require "json"
-      target = to.to_s
-      target = "/" unless target.start_with?("/") && !target.start_with?("//")
-      # script_safe, as in mobile_reset_html: `to` is request input.
-      encoded = JSON.generate(target, script_safe: true)
-      <<~HTML
-        <!DOCTYPE html><html><head><meta charset="utf-8"><title>Signing in…</title>
-        <meta name="viewport" content="width=device-width,initial-scale=1"></head>
-        <body><p>Opening secure sign-in…</p><script>
-        (function(){var to=#{encoded};var msg={action:"authFlow",to:to};
-        var ios=window.webkit&&window.webkit.messageHandlers&&window.webkit.messageHandlers.everywhereControl;
-        var android=window.everywhereControl;
-        if(ios){ios.postMessage(msg);}
-        else if(android&&android.postMessage){android.postMessage(JSON.stringify(msg));}
-        else{window.location.replace(to);}})();
-        </script></body></html>
-      HTML
-    end
-    # The desktop shell's marker. WKWebView APPENDS
-    # `applicationNameForUserAgent` to the real system UA, so this arrives
-    # alongside a normal Safari UA rather than replacing it — hence a pattern
-    # rather than a prefix check. The version is absent when everywhere.yml
-    # declares none.
-    #
-    # macOS only for now: the marker is set in macos_webview_configuration, and
-    # Windows/Linux have no append-only equivalent (their user_agent() REPLACES
-    # the string, and fabricating a whole UA is worse than not marking it).
-    # Desktop only ships macOS today; revisit when it doesn't.
-    DESKTOP_UA = %r{\bRubyEverywhere(?:/[\w.\-]+)? \((?:macos|windows|linux)\)}
-    MOBILE_PLATFORMS = %i[ios android].freeze
-    # :ios, :android, :desktop or nil, from a User-Agent string. Present from
-    # the very first request, before any JS has run. Shared by the view helpers
-    # and the auth middleware.
-    #
-    # Mobile is checked FIRST and the order matters: the mobile shells prepend
-    # the same "RubyEverywhere/<version> (<os>)" marker to Hotwire Native's own,
-    # so a mobile UA matches DESKTOP_UA too.
-    def native_platform_of(user_agent)
-      ua = user_agent.to_s
-      return :ios if ua.include?("Hotwire Native iOS")
-      return :android if ua.include?("Hotwire Native Android")
-      return :desktop if ua.match?(DESKTOP_UA)
-      nil
-    end
-    # Just the phone shells. Anything that leans on a mobile-only affordance —
-    # the OAuth handoff to ASWebAuthenticationSession / Custom Tabs, biometric
-    # gating — has to ask for this rather than "is this a native shell", because
-    # the desktop shell answers yes to that and has neither.
-    def mobile_platform_of(user_agent)
-      platform = native_platform_of(user_agent)
-      platform if MOBILE_PLATFORMS.include?(platform)
-    end
-    # Test/reset hook.
-    attr_writer :tabs_filter
-  end
   # Loads config/everywhere.yml:
   #
   #   app:
@@ -197,6 +31,22 @@ module Everywhere
   #
   # Colors always normalize to { "light" => ..., "dark" => ... }.
   class Config
+    # One module per section of everywhere.yml — the sections are what the file
+    # is made of, and each is long enough (readers, constants, its own
+    # validations) to be worth reading on its own. Data comes first: it holds
+    # the private plumbing (`app`, `resolved`, `normalize_color`) the rest of
+    # them read through.
+    include Data
+    include App
+    include Updates
+    include DesktopUi
+    include Auth
+    include Mobile
+    include NativeMobile
+    include NativeDesktop
+    include DeepLinking
+    include Shell
     FILE = File.join("config", "everywhere.yml")
     # Dates, times and symbols are permitted rather than fatal: an unquoted
@@ -246,1248 +96,5 @@ module Everywhere
       suffix = target.to_s.split(":", 2)[1]
       suffix unless suffix.nil? || suffix.empty?
     end
-    def name(target: nil)
-      resolved(target)["name"] || File.basename(File.expand_path(root)).split(/[-_]/).map(&:capitalize).join(" ")
-    end
-    # Reverse-DNS identifier: macOS bundle id, and the name of the per-user
-    # app-data directory on every platform. Set it explicitly and never change
-    # it — renaming moves users' data. A platform may override it (e.g. the App
-    # Store often wants `com.example.app.ios`).
-    def bundle_id(target: nil)
-      resolved(target)["bundle_id"] ||
-        "com.rubyeverywhere.#{name(target: target).downcase.gsub(/[^a-z0-9]+/, "-").gsub(/\A-|-\z/, "")}"
-    end
-    # App icon source: a PNG (ideally square, 1024px+). Explicit `app.icon`
-    # path relative to the app root, or icon.png at the root by convention.
-    def icon
-      if (explicit = app["icon"])
-        File.expand_path(explicit, root)
-      else
-        default = File.join(root, "icon.png")
-        File.exist?(default) ? default : nil
-      end
-    end
-    # Optional custom splash page (HTML file, path relative to the app root).
-    # Shown while the packaged server boots; the shell injects
-    # window.__EVERYWHERE_CONFIG__ so it can use the app's name and colors.
-    def splash
-      path = app["splash"]
-      File.expand_path(path, root) if path
-    end
-    def entry_path
-      path = app["entry_path"] || "/"
-      path.start_with?("/") ? path : "/#{path}"
-    end
-    # Marketing/display version of the app (CFBundleShortVersionString, and the
-    # `version` recorded in the build receipt). One shared `app.version` is the
-    # default for every target; a platform may override it when a store forces a
-    # different number. Defaults conservatively.
-    def version(target: nil)
-      resolved(target)["version"] || "0.1.0"
-    end
-    # The `build:` section — durable build knobs that were once `every build`
-    # flags (ruby, targets, capabilities). CLI flags still override per-run.
-    # See platform/docs/build-engine.md §2.
-    def build = @data.fetch("build", nil) || {}
-    # Ruby version to package. nil here means "let the CLI decide its default".
-    def build_ruby = build["ruby"]
-    # Desktop OS-integration capabilities the app declares (`build.capabilities`),
-    # as a plain list. Deliberately not called permissions: the top-level
-    # `permissions:` below is the mobile prompt declaration — a different shape
-    # for a different consumer — and while both were spelled "permissions" this
-    # accessor was silently redefined by that one and could never be read.
-    def build_capabilities = Array(build["capabilities"])
-    # Build targets as BARE os-arch strings — any ":<channel>" suffix is
-    # stripped. Callers treat these as filesystem/URL-safe identifiers
-    # (`every publish` derives S3 update-manifest key paths from the first one),
-    # so a suffix leaking through here would poison those paths. Use
-    # #build_target_specs when the channel matters.
-    def targets = build_target_specs.map { |t| t.to_s.split(":", 2).first }
-    # The raw `build.targets` entries, suffixes intact ("ios-arm64:testflight").
-    def build_target_specs = Array(build["targets"])
-    # "local"  — the app is tebako-pressed and runs on-device (default)
-    # "remote" — thin shell around an already-deployed app: no press, no sidecar
-    def mode
-      app["mode"] || (remote_url ? "remote" : "local")
-    end
-    def remote? = mode == "remote"
-    def remote_url
-      @data.dig("remote", "url")&.chomp("/")
-    end
-    # Multi-instance apps (`remote.instances: true`): the mobile shell boots
-    # into remote.url — a hosted instance-picker page — and lets that page
-    # re-root the app onto a chosen instance via Everywhere.instance.set,
-    # persisted across launches until Everywhere.instance.clear. Opt-in
-    # because it lets page JS repoint the whole app: apps that aren't
-    # multi-instance shouldn't carry that surface.
-    def remote_instances?
-      @data.dig("remote", "instances") == true
-    end
-    # The `updates:` section — self-hosted auto-updates. Two halves:
-    # a client half (url/channel/public_key/auto/interval) that ships to the
-    # shell, and a publish-side `s3:` half that NEVER leaves the dev machine.
-    # `channel` here is a *release channel* (stable/beta) — not the receipt's
-    # `distribution_channel` (direct vs app stores).
-    def updates = @data.fetch("updates", nil) || {}
-    def updates_s3 = updates.fetch("s3", nil) || {}
-    def updates_channel = updates["channel"] || "stable"
-    def updates_url = updates["url"]&.chomp("/")
-    def updates_public_key = updates["public_key"]
-    # off — never check; check — check + notify (default); download — also
-    # fetch/verify in the background; install — silent auto-update.
-    def updates_auto = updates["auto"] || "check"
-    def updates_interval = [(updates["interval"] || 21_600).to_i, 300].max
-    # The client subset for the shell; nil (and thus absent from
-    # everywhere.json) until both url and public_key are configured — an
-    # unsigned update feed is not a thing.
-    def updates_shell_hash
-      return nil unless updates_url && updates_public_key
-      {
-        "url" => updates_url,
-        "channel" => updates_channel,
-        "public_key" => updates_public_key,
-        "auto" => updates_auto,
-        "interval" => updates_interval
-      }
-    end
-    def tint_color
-      normalize_color(appearance["tint_color"])
-    end
-    def background_color
-      normalize_color(appearance["background_color"])
-    end
-    # Mobile tab bar, platform-neutral. Icons are per-platform (ios = SF
-    # Symbol, android = Material icon later), with a shared `icon:` fallback:
-    #
-    #   tabs:
-    #     - name: Builds
-    #       path: /builds
-    #       icons:
-    #         ios: hammer
-    #         android: build
-    #
-    # Tabs ship two ways from the same source: baked into the app's bundled
-    # path-configuration.json at build time (offline/first-launch), and served
-    # live from /everywhere/<platform>_v1.json (MobileConfigEndpoint) so tab
-    # changes deploy with the web app — no app-store release.
-    def tabs
-      entries = @data["tabs"]
-      return [] unless entries.is_a?(Array)
-      entries.filter_map do |tab|
-        next unless tab.is_a?(Hash) && tab["name"] && tab["path"]
-        path = tab["path"].start_with?("/") ? tab["path"] : "/#{tab["path"]}"
-        { "name" => tab["name"], "path" => path,
-          "icon" => tab["icon"], "icons" => (tab["icons"] if tab["icons"].is_a?(Hash)) }.compact
-      end
-    end
-    # Tabs with the icon resolved for one platform: icons.<os>, then the
-    # shared icon, then a safe default.
-    def tabs_for(os)
-      tabs.map do |tab|
-        { "title" => tab["name"], "path" => tab["path"],
-          "icon" => tab.dig("icons", os.to_s) || tab["icon"] || DEFAULT_TAB_ICONS[os.to_s] }.compact
-      end
-    end
-    DEFAULT_TAB_ICONS = { "ios" => "circle", "android" => "circle" }.freeze
-    # The Hotwire Native path-configuration rules every RubyEverywhere mobile
-    # shell starts from. Single source of truth: the builder bakes this into
-    # the app bundle and MobileConfigEndpoint serves it live.
-    MOBILE_PATH_RULES = [
-      { "patterns" => [".*"],
-        "properties" => { "context" => "default", "pull_to_refresh_enabled" => true } },
-      { "patterns" => ["/new$", "/edit$"],
-        "properties" => { "context" => "modal", "pull_to_refresh_enabled" => false } }
-    ].freeze
-    # Native permissions the app declares (top-level `permissions:`). Only
-    # declared permissions can be requested at runtime — the shell answers
-    # `undeclared` for everything else, so an app that doesn't need a
-    # permission can never prompt for it. For camera and location the value is
-    # the user-facing usage string iOS shows in the permission prompt (the
-    # "why"); it's mandatory there because requesting without one crashes the
-    # app. Notifications need no string — declare with `true`.
-    #
-    #   permissions:
-    #     notifications: true
-    #     camera: "Scan QR codes to pair devices."
-    #     location:
-    #       ios: "Find build agents near you."
-    #     biometrics: "Unlock your account with Face ID."
-    #
-    # Returns { name => { "ios" => usage-or-nil, ... } }.
-    MOBILE_PERMISSIONS = %w[notifications camera location biometrics].freeze
-    # Info.plist usage-description keys per permission. Presence here makes
-    # the usage string mandatory on iOS.
-    IOS_USAGE_KEYS = {
-      "camera" => "NSCameraUsageDescription",
-      "location" => "NSLocationWhenInUseUsageDescription",
-      "biometrics" => "NSFaceIDUsageDescription"
-    }.freeze
-    # Manifest <uses-permission> names per permission, stamped into
-    # src/stamped/AndroidManifest.xml. Deliberately *not* the mirror of
-    # IOS_USAGE_KEYS: presence here mandates nothing, because Android has no
-    # Info.plist-style contract — a runtime request without a rationale string
-    # prompts normally instead of terminating the process, and the rationale is
-    # a dialog the app draws itself, not a manifest value. So the map only
-    # answers "which manifest entry does this permission need", and every
-    # declared name has one.
-    #
-    # ACCESS_FINE_LOCATION implies ACCESS_COARSE_LOCATION on API 31+ only when
-    # both are declared, but the shell asks for precise location, so the fine
-    # permission alone is the honest declaration.
-    ANDROID_PERMISSIONS = {
-      "notifications" => "android.permission.POST_NOTIFICATIONS",
-      "camera" => "android.permission.CAMERA",
-      "location" => "android.permission.ACCESS_FINE_LOCATION",
-      "biometrics" => "android.permission.USE_BIOMETRIC"
-    }.freeze
-    def permissions
-      entries = @data["permissions"]
-      return {} unless entries.is_a?(Hash)
-      entries.each_with_object({}) do |(name, value), acc|
-        next if value.nil? || value == false
-        acc[name.to_s] =
-          case value
-          when String then { "ios" => value }
-          when Hash then value.transform_keys(&:to_s).transform_values(&:to_s)
-          else {}
-          end
-      end
-    end
-    # The manifest permissions an Android build declares, in declaration order.
-    # Only known names map to anything; permission_errors("android") has
-    # already failed the build on the rest by the time the builder asks.
-    def android_manifest_permissions
-      permissions.keys.filter_map { |name| ANDROID_PERMISSIONS[name] }.uniq
-    end
-    # Problems with the permissions declaration for one platform, as
-    # human-readable strings — unknown names, and camera/location missing the
-    # mandatory usage string. Empty means buildable.
-    #
-    # Only the unknown-name half applies to Android: the usage string exists to
-    # satisfy iOS, which kills the app when a prompt has no Info.plist entry.
-    # Android just prompts, so requiring the sentence there would fail builds
-    # over a value nothing reads.
-    def permission_errors(os)
-      permissions.flat_map do |name, usage|
-        unless MOBILE_PERMISSIONS.include?(name)
-          next ["unknown permission #{name.inspect} — supported: #{MOBILE_PERMISSIONS.join(", ")}"]
-        end
-        if os == "ios" && IOS_USAGE_KEYS.key?(name) && usage["ios"].to_s.strip.empty?
-          next ["#{name} needs a usage string — the sentence iOS shows when asking. " \
-                "In config/everywhere.yml:\n  permissions:\n    #{name}: \"Why the app needs #{name}.\""]
-        end
-        []
-      end
-    end
-    # App-declared Hotwire Native path-configuration rules (everywhere.yml
-    # top-level `rules:`), appended after MOBILE_PATH_RULES — later rules win
-    # per property, so apps can make routes modal, disable pull-to-refresh,
-    # or set any other Hotwire path property without touching native code:
-    #
-    #   rules:
-    #     - patterns: ["/preferences$"]
-    #       properties:
-    #         context: default        # not a modal, unlike other /edit routes
-    #     - patterns: ["/live/"]
-    #       properties:
-    #         pull_to_refresh_enabled: false
-    # Native screens are selected by a different property on each platform, so
-    # `os` decides how a rule's `view_controller:` is read (see
-    # #android_screen_properties).
-    def mobile_rules(os = nil)
-      entries = @data["rules"]
-      return [] unless entries.is_a?(Array)
-      entries.filter_map do |rule|
-        next unless rule.is_a?(Hash) && rule["patterns"].is_a?(Array) && rule["properties"].is_a?(Hash)
-        properties = rule["properties"]
-        properties = android_screen_properties(properties) if android_target?(os)
-        { "patterns" => rule["patterns"].map(&:to_s), "properties" => properties }
-      end
-    end
-    # Hotwire Native iOS picks a native screen with `view_controller: <id>`;
-    # Android picks one with `uri: hotwire://fragment/<id>`, matched against the
-    # Fragment's own @HotwireDestinationDeepLink annotation. Same rule, same
-    # identifier, different property name — so the Android document derives the
-    # `uri` rather than making apps write the route twice and keep the two in
-    # sync by hand.
-    #
-    # Derived only for ids declared under native.android.screens: an id that
-    # names an iOS-only screen must fall through to the web fragment, because a
-    # `uri` pointing at a Fragment this build doesn't contain resolves to
-    # nothing and the visit dead-ends. An explicit `uri:` always wins — that's
-    # the escape hatch for a screen whose annotation says something else.
-    def android_screen_properties(properties)
-      id = properties["view_controller"]
-      return properties if id.nil? || properties.key?("uri")
-      return properties unless native_android_screens.key?(id.to_s)
-      properties.merge("uri" => "hotwire://fragment/#{id}")
-    end
-    # The full path-configuration document for one mobile platform — rules plus
-    # our settings (tabs live in settings, per Hotwire Native convention).
-    # Pass `tabs:` to override the resolved list (the mobile config endpoint
-    # passes a per-request-filtered list; build-time stamping omits it and
-    # bakes them all).
-    def path_configuration_hash(os, tabs: nil)
-      settings = {}
-      platform_tabs = tabs || tabs_for(os)
-      settings["tabs"] = platform_tabs unless platform_tabs.empty?
-      { "settings" => settings, "rules" => MOBILE_PATH_RULES + mobile_rules(os) }
-    end
-    def path_configuration_json(os, tabs: nil)
-      require "json"
-      JSON.generate(path_configuration_hash(os, tabs: tabs))
-    end
-    # Native code extensions ("supernative"): Swift the app repo carries in
-    # native/ios/ that `every build` compiles into the shell, plus this
-    # declaration of what to hook up. Build-time only — stores forbid
-    # downloading native code, so extensions ship with the app binary.
-    #
-    #   native:
-    #     ios:
-    #       components: [ChartComponent]   # BridgeComponent subclasses to register
-    #       screens:                       # path rules with view_controller: <id>
-    #         map: MapScreen               #   SwiftUI View or UIViewController, init(url:)
-    #       splash: LaunchSplash           # SwiftUI View or UIViewController, init()
-    #       splash_min_seconds: 1.0        # how long the custom splash stays up at minimum
-    #       lazy_load_tabs: true           # defer each tab's first visit until it's selected
-    def native_ios
-      section = @data.dig("native", "ios")
-      section.is_a?(Hash) ? section : {}
-    end
-    def native_ios_components = Array(native_ios["components"]).map(&:to_s)
-    def native_ios_screens
-      entries = native_ios["screens"]
-      return {} unless entries.is_a?(Hash)
-      entries.to_h { |id, type| [id.to_s, type.to_s] }
-    end
-    def native_ios_splash = native_ios["splash"]&.to_s
-    # Minimum seconds a custom splash stays on screen (default 1.0 shell-side;
-    # a fast server would otherwise dismiss a branded splash in a ~50ms flash).
-    # Clamped to the shell's 8s give-up timeout.
-    def native_ios_splash_min_seconds
-      value = native_ios["splash_min_seconds"]
-      value.to_f.clamp(0.0, 8.0) if value.is_a?(Numeric)
-    end
-    # Whether the native tab bar defers each non-selected tab's initial visit
-    # until the tab is first selected (Hotwire Native `lazyLoadTabs`). Tri-state
-    # so apps can opt in or opt out explicitly: `true` lazy-loads, `false` loads
-    # every tab up front, and an absent key leaves the shell on its default
-    # (eager).
-    def native_ios_lazy_load_tabs
-      value = native_ios["lazy_load_tabs"]
-      value if value == true || value == false
-    end
-    # Third-party Swift packages this app pins for its native/ios code. Each
-    # entry is one SPM dependency; `every build` writes them into the shell's
-    # local NativeExtensions package and re-exports every product, so native/ios
-    # code reaches them with a single `import NativeExtensions`.
-    #
-    #   packages:
-    #     - url: https://github.com/simibac/ConfettiSwiftUI
-    #       from: "1.1.0"                 # or exact: / branch: / revision:
-    #       products: [ConfettiSwiftUI]   # optional; defaults to the repo name
-    #
-    # Returns normalized entries: { "url", "requirement" => { "kind", "value" },
-    # "products" => [...] }. Assumes the config validated clean (see
-    # native_ios_package_errors) — the requirement is always present here.
-    PACKAGE_REQUIREMENT_KEYS = %w[from exact branch revision].freeze
-    def native_ios_packages
-      Array(native_ios["packages"]).filter_map do |entry|
-        next unless entry.is_a?(Hash)
-        url = entry["url"].to_s.strip
-        kind = PACKAGE_REQUIREMENT_KEYS.find { |k| entry.key?(k) && !entry[k].to_s.strip.empty? }
-        products = Array(entry["products"]).map { |p| p.to_s.strip }.reject(&:empty?)
-        products = [package_identity(url)] if products.empty?
-        { "url" => url,
-          "requirement" => (kind && { "kind" => kind, "value" => entry[kind].to_s.strip }),
-          "products" => products }
-      end
-    end
-    def native_ios_packages? = !native_ios_packages.empty?
-    # SPM's package identity: the URL's last path segment without a .git suffix
-    # (github.com/simibac/ConfettiSwiftUI → "ConfettiSwiftUI"). Used as the
-    # default product name and as the `package:` key in .product(name:package:).
-    def package_identity(url) = File.basename(url.to_s.sub(%r{/+\z}, "")).sub(/\.git\z/, "")
-    def native_ios? = !(native_ios_components.empty? && native_ios_screens.empty? && native_ios_splash.nil?)
-    # Everything declared here is interpolated into generated Swift, so names
-    # are validated hard: type names must be plain Swift identifiers, screen
-    # identifiers must be safe inside a Swift string literal.
-    SWIFT_TYPE_NAME = /\A[A-Za-z_][A-Za-z0-9_]*\z/
-    SCREEN_IDENTIFIER = /\A[A-Za-z0-9_-]+\z/
-    def native_ios_errors
-      types = native_ios_components + native_ios_screens.values + [native_ios_splash].compact
-      errors = types.reject { |t| t.match?(SWIFT_TYPE_NAME) }.map do |t|
-        "native.ios: #{t.inspect} is not a Swift type name (letters, digits, _)"
-      end
-      errors += native_ios_screens.keys.reject { |id| id.match?(SCREEN_IDENTIFIER) }.map do |id|
-        "native.ios.screens: identifier #{id.inspect} must match #{SCREEN_IDENTIFIER.inspect}"
-      end
-      raw = native_ios["splash_min_seconds"]
-      errors << "native.ios.splash_min_seconds must be a number (seconds)" if raw && !raw.is_a?(Numeric)
-      errors + native_ios_package_errors
-    end
-    # A URL SPM accepts (https for the common case, git@ for SSH remotes) and a
-    # loose semver for from:/exact: — enough to catch typos without reimplementing
-    # SPM's resolver, which reports anything subtler at build time.
-    PACKAGE_URL = %r{\A(https?://|git@).+}
-    PACKAGE_VERSION = /\A\d+(\.\d+){0,2}(-[0-9A-Za-z.-]+)?\z/
-    def native_ios_package_errors
-      raw = native_ios["packages"]
-      return [] if raw.nil?
-      return ["native.ios.packages must be a list"] unless raw.is_a?(Array)
-      raw.each_with_index.flat_map do |entry, i|
-        at = "native.ios.packages[#{i}]"
-        next ["#{at} must be a mapping with a url:"] unless entry.is_a?(Hash)
-        errors = []
-        url = entry["url"].to_s.strip
-        if url.empty?
-          errors << "#{at}.url is required"
-        elsif !url.match?(PACKAGE_URL)
-          errors << "#{at}.url #{url.inspect} must be an https:// or git@ URL"
-        end
-        present = PACKAGE_REQUIREMENT_KEYS.select { |k| entry.key?(k) && !entry[k].to_s.strip.empty? }
-        if present.empty?
-          errors << "#{at} needs one version requirement (#{PACKAGE_REQUIREMENT_KEYS.join(" / ")})"
-        elsif present.length > 1
-          errors << "#{at} sets conflicting requirements (#{present.join(", ")}) — pick one"
-        elsif %w[from exact].include?(present.first) && !entry[present.first].to_s.strip.match?(PACKAGE_VERSION)
-          errors << "#{at}.#{present.first} #{entry[present.first].to_s.inspect} must be a version like \"1.2.0\""
-        end
-        Array(entry["products"]).each do |product|
-          next if product.to_s.match?(SWIFT_TYPE_NAME)
-          errors << "#{at}.products: #{product.to_s.inspect} is not a module name (letters, digits, _)"
-        end
-        errors
-      end
-    end
-    # The Android half of "supernative": Kotlin the app repo carries in
-    # native/android/ that `every build --android` compiles into the shell,
-    # declared the same way iOS declares Swift. Same build-time-only rule —
-    # Play forbids downloading executable code — and the same shape, so an app
-    # that already knows `native.ios:` knows this section too.
-    #
-    #   native:
-    #     android:
-    #       components: [ChartComponent]   # BridgeComponent subclasses to register
-    #       screens:                       # path rules with view_controller: <id>
-    #         map: MapFragment             #   Fragment with an (url) argument
-    #       splash: LaunchSplash           # Fragment/Activity shown while booting
-    #       splash_min_seconds: 1.0        # how long that splash stays up at minimum
-    #       lazy_load_tabs: true           # defer each tab's first visit until selected
-    #       icon_font: symbols             # which Material icon font resolves icon names
-    #       packages:                      # Maven coordinates, not SPM entries
-    #         - "com.airbnb.android:lottie:6.4.0"
-    def native_android
-      section = @data.dig("native", "android")
-      section.is_a?(Hash) ? section : {}
-    end
-    def native_android_components = Array(native_android["components"]).map(&:to_s)
-    def native_android_screens
-      entries = native_android["screens"]
-      return {} unless entries.is_a?(Hash)
-      entries.to_h { |id, type| [id.to_s, type.to_s] }
-    end
-    def native_android_splash = native_android["splash"]&.to_s
-    # Same contract as the iOS splash minimum, and the same clamp: the shell
-    # gives up waiting at 8s either way, so a larger number here would only
-    # promise something the shell won't honor.
-    def native_android_splash_min_seconds
-      value = native_android["splash_min_seconds"]
-      value.to_f.clamp(0.0, 8.0) if value.is_a?(Numeric)
-    end
-    # Tri-state like native_ios_lazy_load_tabs: true defers each non-selected
-    # tab's first visit, false loads them all up front, absent leaves the shell
-    # on its default. Android's bottom-nav hosts are created eagerly at
-    # onCreate, so this decides whether they *visit*, not whether they exist.
-    def native_android_lazy_load_tabs
-      value = native_android["lazy_load_tabs"]
-      value if value == true || value == false
-    end
-    # Third-party dependencies for native/android code, as Gradle sees them:
-    # plain Maven coordinates. There is no SPM-style url + requirement split —
-    # a coordinate already carries group, artifact and version — so this
-    # accessor returns strings, one per `implementation(…)` line the builder
-    # writes into native-packages.gradle.kts. Assumes the config validated
-    # clean (see native_android_package_errors).
-    def native_android_packages
-      Array(native_android["packages"]).filter_map do |entry|
-        next unless entry.is_a?(String)
-        coordinate = entry.strip
-        coordinate unless coordinate.empty?
-      end
-    end
-    def native_android_packages? = !native_android_packages.empty?
-    def native_android? = !(native_android_components.empty? && native_android_screens.empty? &&
-                            native_android_splash.nil?)
-    # Kotlin's identifier rules match Swift's across everything we generate
-    # (no backticked names, no unicode escapes), so one pattern validates both.
-    # Aliased rather than reused by name so the Android messages can say
-    # "Kotlin" and the two paths can diverge later without touching iOS.
-    KOTLIN_TYPE_NAME = SWIFT_TYPE_NAME
-    def native_android_errors
-      types = native_android_components + native_android_screens.values + [native_android_splash].compact
-      errors = types.reject { |t| t.match?(KOTLIN_TYPE_NAME) }.map do |t|
-        "native.android: #{t.inspect} is not a Kotlin type name (letters, digits, _)"
-      end
-      errors += native_android_screens.keys.reject { |id| id.match?(SCREEN_IDENTIFIER) }.map do |id|
-        "native.android.screens: identifier #{id.inspect} must match #{SCREEN_IDENTIFIER.inspect}"
-      end
-      raw = native_android["splash_min_seconds"]
-      errors << "native.android.splash_min_seconds must be a number (seconds)" if raw && !raw.is_a?(Numeric)
-      errors + native_android_icon_font_errors + native_android_package_errors
-    end
-    # group:artifact:version — Gradle's shorthand form, and the only one we
-    # accept. The charset is narrower than Maven strictly allows on purpose:
-    # every coordinate is interpolated into a generated Kotlin DSL file inside
-    # a double-quoted literal, so a quote, a backslash, a `$` (Kotlin string
-    # templates), a newline or a space would rewrite the build script rather
-    # than name a dependency. Version ranges ("[1.0,2.0)") and BOM-style
-    # two-part coordinates are rejected for the same reason and because Gradle
-    # resolves anything subtler at build time anyway.
-    MAVEN_SEGMENT = /[A-Za-z0-9_][A-Za-z0-9_.-]*/
-    MAVEN_COORDINATE = /\A#{MAVEN_SEGMENT}:#{MAVEN_SEGMENT}:[A-Za-z0-9_][A-Za-z0-9_.+-]*\z/
-    def native_android_package_errors
-      raw = native_android["packages"]
-      return [] if raw.nil?
-      return ["native.android.packages must be a list"] unless raw.is_a?(Array)
-      raw.each_with_index.filter_map do |entry, i|
-        at = "native.android.packages[#{i}]"
-        next "#{at} must be a Maven coordinate string like \"com.airbnb.android:lottie:6.4.0\"" unless entry.is_a?(String)
-        coordinate = entry.strip
-        next if coordinate.match?(MAVEN_COORDINATE)
-        "#{at} #{coordinate.inspect} is not a Maven coordinate — " \
-          "\"group:artifact:version\" (letters, digits, . _ -)"
-      end
-    end
-    # Which Material icon font `icons.android` names — and the per-platform
-    # icon names nav buttons and menu items carry in page HTML — resolve
-    # against. Android has no UIImage(systemName:), so the shell draws the
-    # icon's codepoint from a font; the choice is which font ships.
-    #
-    # `bundled` is the whole reason this is a map and not a list: only the
-    # classic set (357 KB) rides inside the gem, because `ruby_everywhere` is
-    # 229 KB today and Symbols is ~10.6 MB — a 48x install cost paid by every
-    # user, including the desktop-only ones. The Symbols variants are fetched
-    # once on first Android build and cached under ~/.rubyeverywhere, which is
-    # noise next to the Gradle and AGP downloads the same build already makes.
-    #
-    # `codepoints` is the name → codepoint map Ruby validates every declared
-    # icon name against at build time, so a typo fails the build naming the tab
-    # it came from instead of rendering a blank icon on device.
-    ANDROID_ICON_FONTS = {
-      "symbols" => { "file" => "MaterialSymbolsOutlined.ttf", "bundled" => false },
-      "symbols-rounded" => { "file" => "MaterialSymbolsRounded.ttf", "bundled" => false },
-      "symbols-sharp" => { "file" => "MaterialSymbolsSharp.ttf", "bundled" => false },
-      "classic" => { "file" => "MaterialIcons-Regular.ttf", "bundled" => true },
-      # No font at all: the app brings its own drawables in native/android/res/.
-      "none" => { "file" => nil, "bundled" => true }
-    }.freeze
-    DEFAULT_ANDROID_ICON_FONT = "symbols"
-    def native_android_icon_font
-      value = native_android["icon_font"].to_s.strip
-      value.empty? ? DEFAULT_ANDROID_ICON_FONT : value
-    end
-    # The font's asset filename (assets/fonts/<file>), or nil for "none".
-    def native_android_icon_font_file = ANDROID_ICON_FONTS.dig(native_android_icon_font, "file")
-    # The sidecar map the builder validates names against, alongside the font.
-    def native_android_icon_font_codepoints
-      native_android_icon_font_file&.sub(/\.ttf\z/, ".codepoints")
-    end
-    # True when the selected font has to be downloaded before the first build
-    # can stamp it — the only case that can fail offline, so the builder warns
-    # about it (and points at `classic`) rather than dying mid-Gradle.
-    def native_android_icon_font_fetched?
-      entry = ANDROID_ICON_FONTS[native_android_icon_font]
-      !entry.nil? && entry["bundled"] == false
-    end
-    def native_android_icons? = !native_android_icon_font_file.nil?
-    def native_android_icon_font_errors
-      return [] if ANDROID_ICON_FONTS.key?(native_android_icon_font)
-      ["native.android.icon_font #{native_android_icon_font.inspect} is not a known font — " \
-       "one of: #{ANDROID_ICON_FONTS.keys.join(", ")}"]
-    end
-    # The desktop half of "supernative": Rust the app repo carries in
-    # native/desktop/ that `every build` compiles into the Tauri shell.
-    #
-    # The shape differs from ios/android because desktop differs: the whole UI
-    # is a webview, so there are no native screens or splash views to register.
-    # What an app actually wants down here is the machine — a serial port, a USB
-    # device, an FFI library, a Tauri plugin — reached from the page.
-    #
-    #   native:
-    #     desktop:
-    #       commands: [scan_ports]        # fns reachable from the page
-    #       setup: true                   # run native/desktop/setup.rs at boot
-    #       crates:
-    #         serialport: "4.3"
-    #         reqwest: { version: "0.12", features: [json] }
-    #
-    # A command is a plain function, NOT a #[tauri::command] — Tauri's typed
-    # commands only arrive through invoke, and invoke is unavailable to our
-    # pages (they're served over http; see extension_host.rs in the shell). The
-    # signature is uniform:
-    #
-    #   pub fn scan_ports(app: &tauri::AppHandle, payload: serde_json::Value)
-    #       -> Result<serde_json::Value, String>
-    #
-    # Declaring anything here has a real cost the mobile sections don't have:
-    # the shell stops being one prebuilt crate shared by every app and gets
-    # stamped and compiled per app (see Builders::Desktop). Apps that declare
-    # nothing keep the fast path.
-    def native_desktop
-      section = @data.dig("native", "desktop")
-      section.is_a?(Hash) ? section : {}
-    end
-    def native_desktop_commands = Array(native_desktop["commands"]).map { |name| name.to_s.strip }
-    def native_desktop_setup? = native_desktop["setup"] == true
-    # Cargo dependencies, normalized to { "name" => {...table} } so the
-    # generator has one shape to write. The short form (a bare version string)
-    # becomes { "version" => "4.3" }.
-    def native_desktop_crates
-      entries = native_desktop["crates"]
-      return {} unless entries.is_a?(Hash)
-      entries.to_h do |name, spec|
-        table = spec.is_a?(Hash) ? spec : { "version" => spec.to_s }
-        [name.to_s.strip, table]
-      end
-    end
-    def native_desktop? = !(native_desktop_commands.empty? && native_desktop_crates.empty?) ||
-                          native_desktop_setup?
-    # Everything here is interpolated into generated Rust and TOML, so names are
-    # validated hard — same reasoning as MAVEN_COORDINATE above. A command name
-    # becomes a path segment in a generate_handler! list; a crate name and its
-    # features become bare TOML keys and quoted strings.
-    RUST_FN_NAME = /\A[a-z_][a-z0-9_]*\z/
-    CRATE_NAME = /\A[a-zA-Z0-9_][a-zA-Z0-9_-]*\z/
-    # Cargo's requirement syntax, loosely: ^1.2, ~1.2, >=1.0, 1.*, 1.2.3-beta.1.
-    # Deliberately no spaces and no commas — a multi-requirement string would
-    # need quoting rules we don't want to own, and cargo reports anything
-    # subtler at build time.
-    CRATE_VERSION = /\A[\^~<>=]{0,2}\d+(\.\d+){0,2}(\.\*)?(-[0-9A-Za-z.-]+)?\z/
-    CRATE_FEATURE = /\A[A-Za-z0-9_][A-Za-z0-9_+-]*\z/
-    # Where a git dependency may point. Same rule the SPM packages use.
-    CRATE_GIT_URL = PACKAGE_URL
-    def native_desktop_errors
-      raw = @data.dig("native", "desktop")
-      return [] if raw.nil?
-      return ["native.desktop must be a mapping"] unless raw.is_a?(Hash)
-      errors = []
-      commands = raw["commands"]
-      if !commands.nil? && !commands.is_a?(Array)
-        errors << "native.desktop.commands must be a list of function names"
-      else
-        errors += native_desktop_commands.reject { |name| name.match?(RUST_FN_NAME) }.map do |name|
-          "native.desktop.commands: #{name.inspect} is not a Rust function name — " \
-            "snake_case (letters, digits, _), matching the fn in native/desktop/"
-        end
-        duplicates = native_desktop_commands.tally.select { |_name, count| count > 1 }.keys
-        errors += duplicates.map do |name|
-          "native.desktop.commands: #{name.inspect} is listed twice"
-        end
-      end
-      setup = raw["setup"]
-      errors << "native.desktop.setup must be true or false" unless setup.nil? || boolean_or_nil(setup) == setup
-      errors + native_desktop_crate_errors
-    end
-    def native_desktop_crate_errors
-      raw = native_desktop["crates"]
-      return [] if raw.nil?
-      return ["native.desktop.crates must be a mapping of crate name to version"] unless raw.is_a?(Hash)
-      raw.flat_map do |name, spec|
-        at = "native.desktop.crates.#{name}"
-        errors = []
-        unless name.to_s.strip.match?(CRATE_NAME)
-          errors << "#{at}: #{name.to_s.inspect} is not a crate name (letters, digits, _, -)"
-        end
-        errors + crate_spec_errors(at, spec)
-      end
-    end
-    # Third-party sign-in (Sign in with Apple / Google / GitHub / anything
-    # OmniAuth speaks). Providers refuse to run — or run badly — inside an app's
-    # web view, so the mobile shell hands these paths to an
-    # ASWebAuthenticationSession instead, and the gem bridges the resulting
-    # session back into the app (see AuthHandoff).
-    #
-    #   auth:
-    #     oauth_paths:                # paths that begin a provider flow
-    #       - ^/auth/                 # unanchored regexes, like `rules:`
-    #     scheme: com.example.app     # callback scheme (default: the iOS bundle id)
-    #     cookies:                    # which cookies cross back into the app
-    #       except: ["_ga"]           #   (default: all of them)
-    #
-    # The app keeps its own auth: `auth:` declares nothing about providers,
-    # only which paths the shell must not open in its web view.
-    def auth = @data.fetch("auth", nil) || {}
-    # Paths that begin a third-party auth flow, as regex source strings matched
-    # against the request path. Declaring `auth:` at all opts in, defaulting to
-    # OmniAuth's `/auth/…` convention.
-    DEFAULT_OAUTH_PATHS = ["^/auth/"].freeze
-    def oauth_paths
-      return [] unless @data.key?("auth")
-      paths = Array(auth["oauth_paths"]).map { |p| p.to_s.strip }.reject(&:empty?)
-      paths.empty? ? DEFAULT_OAUTH_PATHS.dup : paths
-    end
-    def oauth?  = !oauth_paths.empty?
-    # Whether a request path starts a provider flow. Both halves of the system
-    # ask this — the middleware per request, the shell per visit proposal — so
-    # the patterns are compiled the same way on both sides (unanchored regex).
-    def oauth_path?(path)
-      oauth_paths.any? { |pattern| Regexp.new(pattern).match?(path.to_s) }
-    rescue RegexpError
-      false
-    end
-    # The custom URL scheme ASWebAuthenticationSession returns through. Defaults
-    # to the iOS bundle id — the convention, and already unique per app. Only
-    # the characters RFC 3986 allows in a scheme.
-    URL_SCHEME = /\A[a-zA-Z][a-zA-Z0-9+.-]*\z/
-    def auth_scheme
-      explicit = auth["scheme"].to_s.strip
-      explicit.empty? ? bundle_id(target: "ios") : explicit
-    end
-    # Cookie names to carry from the auth browser back into the app's web view,
-    # filtered by an optional allow/deny list. Everything the flow set is
-    # carried by default: the gem can't know which cookie an app's auth library
-    # signs its session with.
-    def auth_cookie?(name)
-      cookies = auth["cookies"]
-      return true unless cookies.is_a?(Hash)
-      only = Array(cookies["only"]).map(&:to_s)
-      return only.include?(name.to_s) unless only.empty?
-      !Array(cookies["except"]).map(&:to_s).include?(name.to_s)
-    end
-    # How long a minted handoff token stays valid. It travels device-locally
-    # (browser sheet → shell → web view), so seconds are plenty.
-    def auth_token_ttl = [(auth["token_ttl"] || 60).to_i, 5].max
-    def auth_errors
-      return [] unless @data.key?("auth")
-      errors = oauth_paths.filter_map do |pattern|
-        Regexp.new(pattern)
-        nil
-      rescue RegexpError => e
-        "auth.oauth_paths: #{pattern.inspect} is not a valid pattern (#{e.message})"
-      end
-      unless auth_scheme.match?(URL_SCHEME)
-        errors << "auth.scheme #{auth_scheme.inspect} is not a URL scheme (letters, digits, +, -, .)"
-      end
-      errors
-    end
-    # The auth subset the shell needs: which visits to divert into the auth
-    # session, and the scheme to bring the answer back through. nil (absent from
-    # everywhere.json) when the app declares no `auth:` — a shell that can't
-    # divert anything is a shell with no new surface.
-    def auth_shell_hash
-      return nil unless oauth?
-      { "oauth_paths" => oauth_paths, "scheme" => auth_scheme }
-    end
-    # Custom native menu items (macOS app menu). Each entry: label + path
-    # (+ optional accelerator), or "separator". Clicks arrive in the page as
-    # "everywhere:menu" events and navigate via Turbo.
-    def menu
-      entries = @data["menu"]
-      return [] unless entries.is_a?(Array)
-      entries.filter_map do |item|
-        if item == "separator" || (item.is_a?(Hash) && item["separator"])
-          { "separator" => true }
-        elsif item.is_a?(Hash) && item["label"] && item["path"]
-          { "label" => item["label"], "path" => item["path"],
-            "accelerator" => item["accelerator"] }.compact
-        end
-      end
-    end
-    # System tray: same entry shape as `menu:` plus `action: quit | show`.
-    #
-    #   tray:
-    #     - label: "Open My App"
-    #       action: show
-    #     - label: "New Note"
-    #       path: /notes/new
-    #     - separator
-    #     - label: Quit
-    #       action: quit
-    def tray
-      entries = @data["tray"]
-      return [] unless entries.is_a?(Array)
-      entries.filter_map do |item|
-        if item == "separator" || (item.is_a?(Hash) && item["separator"])
-          { "separator" => true }
-        elsif item.is_a?(Hash) && item["label"] && (item["path"] || item["action"])
-          { "label" => item["label"], "path" => item["path"],
-            "action" => item["action"] }.compact
-        end
-      end
-    end
-    # Desktop window chrome. Desktop-only: on mobile the OS owns the frame, so
-    # mobile builds ignore this section entirely.
-    #
-    #   window:
-    #     title_bar: overlay   # decorated (default) | overlay | frameless
-    #     title: false         # draw the title text (default true)
-    #     size: [1100, 750]    # initial inner size
-    #     min_size: [600, 400]
-    #     resizable: true
-    #     drag_height: 28      # top strip that drags the window; 0 turns it off
-    #
-    # Every reader returns nil when the key is absent so `to_shell_hash` drops it
-    # and the shell keeps its own default — there is exactly one place each
-    # default lives, and it's the Rust side.
-    #
-    # `overlay` is the macOS "traffic lights floating over your content" look
-    # (TitleBarStyle::Overlay + hidden title). Windows and Linux have no such
-    # style, so the shell falls back to frameless there and the page draws its
-    # own controls via Everywhere.window.
-    WINDOW_TITLE_BARS = %w[decorated overlay frameless].freeze
-    def window
-      section = @data["window"]
-      section.is_a?(Hash) ? section : {}
-    end
-    def window_title_bar
-      value = window["title_bar"].to_s
-      value if WINDOW_TITLE_BARS.include?(value)
-    end
-    # Tri-state, like native_ios_lazy_load_tabs: an absent key leaves the shell
-    # on its default rather than forcing one.
-    def window_title = boolean_or_nil(window["title"])
-    def window_resizable = boolean_or_nil(window["resizable"])
-    def window_size = window_dimensions("size")
-    def window_min_size = window_dimensions("min_size")
-    # How much of the top of the page drags the window, in CSS pixels. Only
-    # meaningful for overlay/frameless, where there's no system title bar left
-    # to grab. nil leaves the shell's 28px default (the height of the macOS
-    # traffic-light band); 0 turns dragging off for an app that wants to place
-    # its own drag regions.
-    def window_drag_height
-      value = window["drag_height"]
-      value.to_f if value.is_a?(Numeric) && !value.negative?
-    end
-    # The window subset the shell needs. nil (absent from everywhere.json) when
-    # the app declares nothing, so the shell's own defaults stand untouched.
-    def window_shell_hash
-      hash = {
-        "title_bar" => window_title_bar,
-        "title" => window_title,
-        "resizable" => window_resizable,
-        "size" => window_size,
-        "min_size" => window_min_size,
-        "drag_height" => window_drag_height
-      }.compact
-      hash unless hash.empty?
-    end
-    def window_errors
-      raw = @data["window"]
-      return [] if raw.nil?
-      return ["window: must be a mapping"] unless raw.is_a?(Hash)
-      errors = []
-      bar = raw["title_bar"]
-      if bar && !WINDOW_TITLE_BARS.include?(bar.to_s)
-        errors << "window.title_bar #{bar.to_s.inspect} must be one of " \
-                  "#{WINDOW_TITLE_BARS.join(" / ")}"
-      end
-      errors += %w[size min_size].filter_map do |key|
-        next if raw[key].nil? || window_dimensions(key)
-        "window.#{key} must be two positive numbers, like [1100, 750]"
-      end
-      drag = raw["drag_height"]
-      unless drag.nil? || (drag.is_a?(Numeric) && !drag.negative?)
-        errors << "window.drag_height must be a number of pixels (0 turns dragging off)"
-      end
-      errors + %w[title resizable].filter_map do |key|
-        next if raw[key].nil? || boolean_or_nil(raw[key]) == raw[key]
-        "window.#{key} must be true or false"
-      end
-    end
-    # Deep linking / universal links. Declares the app's association with its
-    # web domains so the OS can hand matching URLs to the app instead of the
-    # browser. The gem serves the two well-known association files this needs —
-    # /.well-known/apple-app-site-association and /.well-known/assetlinks.json —
-    # generated from this config (Everywhere::Engine in Rails; MobileConfigEndpoint
-    # for Sinatra/Hanami). The iOS builder stamps the matching Associated Domains
-    # entitlement, and the shell routes an incoming link to its path.
-    #
-    #   deep_linking:
-    #     team_id: ABCDE12345          # derives the iOS app id from bundle_id
-    #     # or set app ids explicitly:
-    #     # apple_app_id: ABCDE12345.com.example.app
-    #     # apple_app_ids: ["ABCDE12345.com.example.app"]
-    #     paths: ["/*"]                # which paths open the app (default: all)
-    #     domains: ["www.example.com"] # extra applinks: domains (remote host is implicit)
-    #     android:
-    #       package: com.example.app
-    #       sha256_cert_fingerprints: ["AB:CD:EF:..."]
-    def deep_linking = @data.fetch("deep_linking", nil) || {}
-    # The iOS/tvOS/... app identifiers (TeamID.bundleID) the association file
-    # advertises. Explicit ids win; otherwise team_id + the app's iOS bundle id.
-    def deep_linking_apple_app_ids
-      explicit = Array(deep_linking["apple_app_ids"]) + [deep_linking["apple_app_id"]].compact
-      return explicit.map(&:to_s).uniq unless explicit.empty?
-      team = deep_linking["team_id"].to_s.strip
-      team.empty? ? [] : ["#{team}.#{bundle_id(target: "ios")}"]
-    end
-    # URL path patterns that open the app. Modern (iOS 14+) component form;
-    # defaults to every path.
-    def deep_linking_paths
-      paths = Array(deep_linking["paths"]).map(&:to_s).reject(&:empty?)
-      paths.empty? ? ["*"] : paths
-    end
-    def deep_linking_android = deep_linking["android"].is_a?(Hash) ? deep_linking["android"] : {}
-    def deep_linking_android_package = deep_linking_android["package"]&.to_s
-    def deep_linking_android_fingerprints
-      Array(deep_linking_android["sha256_cert_fingerprints"]).map { |f| f.to_s.strip }.reject(&:empty?)
-    end
-    def deep_linking_android? = !deep_linking_android_package.to_s.empty? && !deep_linking_android_fingerprints.empty?
-    def deep_linking_apple? = !deep_linking_apple_app_ids.empty?
-    def deep_linking? = deep_linking_apple? || deep_linking_android?
-    # Domains for the iOS Associated Domains entitlement (applinks:<host>) and
-    # the shell's universal-link host allowlist: the remote host plus any extra
-    # `domains:`. Bare hostnames (no scheme, no path).
-    def deep_linking_domains
-      hosts = []
-      if remote_url
-        require "uri"
-        hosts << URI(remote_url).host
-      end
-      hosts += Array(deep_linking["domains"]).map { |d| d.to_s.sub(%r{\Ahttps?://}, "").sub(%r{/.*\z}, "") }
-      hosts.compact.reject(&:empty?).uniq
-    rescue URI::InvalidURIError
-      Array(deep_linking["domains"]).map(&:to_s).reject(&:empty?).uniq
-    end
-    # The apple-app-site-association document (a Hash), or nil when no Apple app
-    # ids are configured. `applinks` for universal links; `webcredentials` so
-    # associated-domains password autofill / Face ID credentials work too.
-    def apple_app_site_association
-      ids = deep_linking_apple_app_ids
-      return nil if ids.empty?
-      { "applinks" => {
-          "details" => [{ "appIDs" => ids, "components" => deep_linking_paths.map { |p| { "/" => p } } }]
-        },
-        "webcredentials" => { "apps" => ids } }
-    end
-    def apple_app_site_association_json
-      require "json"
-      doc = apple_app_site_association or return nil
-      JSON.generate(doc)
-    end
-    # The Digital Asset Links document (an Array), or nil without an Android app.
-    def asset_links
-      return nil unless deep_linking_android?
-      [{ "relation" => ["delegate_permission/common.handle_all_urls"],
-         "target" => { "namespace" => "android_app",
-                       "package_name" => deep_linking_android_package,
-                       "sha256_cert_fingerprints" => deep_linking_android_fingerprints } }]
-    end
-    def asset_links_json
-      require "json"
-      doc = asset_links or return nil
-      JSON.generate(doc)
-    end
-    # The two `native:` knobs that ship inside everywhere.json rather than
-    # being compiled in, resolved for the platform being stamped. They read the
-    # target's own section: everywhere.json is written once per target, so an
-    # Android build that inherited native.ios.lazy_load_tabs would silently
-    # apply a decision the app made about a different shell — and the two
-    # platforms load tabs differently enough that the answer legitimately
-    # differs. Without a target (the desktop dev loop, and every caller written
-    # before Android existed) the iOS answer stands, which is what those
-    # callers have always gotten.
-    def native_lazy_load_tabs(target: nil)
-      android_target?(target) ? native_android_lazy_load_tabs : native_ios_lazy_load_tabs
-    end
-    def native_splash_min_seconds(target: nil)
-      android_target?(target) ? native_android_splash_min_seconds : native_ios_splash_min_seconds
-    end
-    # The subset the shell needs, shipped as JSON (env var in dev,
-    # Resources/everywhere.json inside a bundled .app). Pass `target:` so the
-    # packaged config reflects the platform being built (its bundle id / name).
-    def to_shell_hash(target: nil)
-      {
-        "name" => name(target: target),
-        "bundle_id" => bundle_id(target: target),
-        "version" => version(target: target),
-        "mode" => mode,
-        "remote_url" => remote_url,
-        "remote_instances" => (true if remote_instances?),
-        "entry_path" => entry_path,
-        "tint_color" => tint_color,
-        "background_color" => background_color,
-        "menu" => (menu unless menu.empty?),
-        "tray" => (tray unless tray.empty?),
-        "window" => window_shell_hash,
-        "lazy_load_tabs" => native_lazy_load_tabs(target: target),
-        "splash_min_seconds" => native_splash_min_seconds(target: target),
-        "updates" => updates_shell_hash,
-        "permissions" => (permissions.keys unless permissions.empty?),
-        "auth" => auth_shell_hash,
-        # Hosts the shell treats as its own for incoming universal links, so a
-        # tapped link to any associated domain opens in-app rather than Safari.
-        "universal_link_hosts" => (deep_linking_domains if deep_linking? && !deep_linking_domains.empty?)
-      }.compact
-    end
-    def to_shell_json(target: nil)
-      require "json"
-      JSON.generate(to_shell_hash(target: target))
-    end
-    private
-    def app = @data.fetch("app", nil) || {}
-    def appearance = @data.fetch("appearance", nil) || {}
-    # One crate's dependency spec: either a bare version string or a table.
-    def crate_spec_errors(at, spec)
-      return version_errors(at, spec) unless spec.is_a?(Hash)
-      errors = []
-      # A crate needs somewhere to come from. version: is the common case; git:
-      # and path: are the two escape hatches cargo itself offers.
-      unless %w[version git path].any? { |key| !spec[key].to_s.strip.empty? }
-        errors << "#{at} needs a version: (or git: / path:)"
-      end
-      errors += version_errors("#{at}.version", spec["version"]) if spec.key?("version")
-      git = spec["git"].to_s.strip
-      unless git.empty? || git.match?(CRATE_GIT_URL)
-        errors << "#{at}.git #{git.inspect} must be an https:// or git@ URL"
-      end
-      # branch/tag/rev/path have no useful shape to check, but they DO end up
-      # inside quoted TOML strings — so the one thing that matters is that they
-      # can't close the quote or start a new line.
-      errors += %w[branch tag rev path].filter_map do |key|
-        value = spec[key].to_s
-        next if value.empty? || !value.match?(/["\\\n\r]/)
-        "#{at}.#{key} can't contain quotes, backslashes or newlines"
-      end
-      features = spec["features"]
-      if !features.nil? && !features.is_a?(Array)
-        errors << "#{at}.features must be a list"
-      else
-        errors += Array(features).reject { |f| f.to_s.match?(CRATE_FEATURE) }.map do |feature|
-          "#{at}.features: #{feature.to_s.inspect} is not a feature name (letters, digits, _, +, -)"
-        end
-      end
-      errors
-    end
-    def version_errors(at, value)
-      version = value.to_s.strip
-      return [] if version.empty?
-      return [] if version.match?(CRATE_VERSION)
-      ["#{at} #{version.inspect} is not a cargo version requirement — like \"1.2\", \"^1.2.3\" or \"~0.4\""]
-    end
-    # YAML's `yes`/`on` already parse as true, so anything that reaches here
-    # still not a boolean is a genuine mistake rather than a spelling of one.
-    # Deliberately not an endless def: `def f(v) = v if cond` parses as
-    # `(def f(v) = v) if cond`, which would define nothing when cond is false.
-    def boolean_or_nil(value)
-      value if value == true || value == false
-    end
-    # A [width, height] pair. Rejects the near-misses (one number, three, a
-    # negative) rather than silently building a 0-pixel window.
-    def window_dimensions(key)
-      value = window[key]
-      return unless value.is_a?(Array) && value.length == 2
-      return unless value.all? { |n| n.is_a?(Numeric) && n.positive? }
-      value.map(&:to_f)
-    end
-    def android_target?(target) = self.class.os_of(target) == "android"
-    # Per-platform overrides, keyed by os (macos / ios / android / windows /
-    # linux). Each value overrides the matching `app:` keys for that platform.
-    def platforms = @data.fetch("platforms", nil) || {}
-    # The app-level keys with the target's platform override merged on top.
-    # Blank override values are dropped (`.compact`) so they don't erase a
-    # default. Without a target — or without an override for that os — this is
-    # just the plain `app:` hash.
-    def resolved(target)
-      override = target && platforms[self.class.os_of(target)]
-      override.is_a?(Hash) ? app.merge(override.compact) : app
-    end
-    def normalize_color(value)
-      case value
-      when String
-        { "light" => value, "dark" => value }
-      when Hash
-        light = value["light"] || value["dark"]
-        dark  = value["dark"] || value["light"]
-        { "light" => light, "dark" => dark } if light
-      end
-    end
   end
 end