ruby_everywhere 0.10.1 → 0.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 500e5331ac0f9b650cef020b9992c4f54bcff2ec08a37aa160da69c57468498a
-  data.tar.gz: 78114f8b44040ad51a3d2e10b033f6e6df25f46ee0a91cfbd96e519987ae52fc
+  metadata.gz: a690caacf23100232c7d96fb2a5575d2408a475219ecd1290d6b03a6e69917e4
+  data.tar.gz: 98285827b8cac459773c44118c15f4447bbf5b3bbc182dbd49593c32e165a30c
 SHA512:
-  metadata.gz: ecd03c6b0ee4823567da935d34696fa75925472b9e2cfb086cb8e00b80cc2e74b72d89c94b588ce807187a511fa12e2b4ce385105befd0e3fbd2f520efaadce1
-  data.tar.gz: 683c8c90f049d8a7ae8718ad4ca12d4a02c7acfe639c01b76b38bcf9d7507ff37dfd7a7bf81ac6381dc1f990245f78ae83a2a99f6c1227488e2cc0105c58b6fb
+  metadata.gz: cce0faa307eb46f4d16ec00a1be4a5526168eceb4fb87934306afd009045ecc1e7e0c08009bef8bee2e89eb3b8f2407f57253baa9799478d74cd20c5d687049b
+  data.tar.gz: f4afd91f97283fb009f02bf2765d5c82be2d7fd6fd0b338929c01b09c13c4c01031179d7b780b9ebef0e5a405943a897f8754311b3c6b62ea9eb0143c56eb180

data/README.md

@@ -231,8 +231,28 @@ there keep their clicks. `window.drag_height: 0` hands that back to you.
 Tabs and path rules ship two ways from that one source: baked into the app
 bundle for offline/first launch, and served live from
 `/everywhere/{ios,android}_v1.json`, so changing them deploys with your web app.
-`Everywhere.filter_tabs` lets you vary the tab bar per request — it shares the
-app's session, so signed-out users can get a different bar without a release.
+`Everywhere.tabs` lets you build the tab bar per request — feature flags, plan
+tiers, roles, anything your app can answer while serving a request:
+
+```ruby
+# config/initializers/everywhere.rb
+Rails.application.config.to_prepare do
+  Everywhere.current_user { |ctx| Session.find_by(id: ctx.cookies.signed[:session_id])&.user }
+
+  Everywhere.tabs do |tabs, ctx|
+    next [] unless ctx.current_user                    # [] hides the bar entirely
+
+    tabs.reject! { |tab| tab["title"] == "Labs" } unless Flipper.enabled?(:labs, ctx.current_user)
+    tabs << ctx.tab("Admin") if ctx.current_user.admin?
+    tabs
+  end
+end
+```
+
+The context carries `platform` (`"ios"`/`"android"`), `current_user`, and
+`session`/`cookies` normalized across Rails and Rack. `ctx.tab("Admin")` pulls in
+a tab declared `visible: false` in `everywhere.yml` — declared so the build
+validates its icon, hidden so nothing ships it until this block says otherwise.
 
 ## The JavaScript bridge
 

data/bridge/everywhere/bridge.js

@@ -907,7 +907,9 @@ export const Everywhere = {
       message: options.message,
       items,
       source: options.source
-    }).then((id) => (id == null ? null : items.find((item) => String(item.id) === String(id)) || null))
+      // presentMenu answers with the chosen item's position, so this is an index
+      // lookup, not an id match — see the note above presentMenu for why.
+    }).then((index) => (index == null ? null : items[parseInt(index, 10)] || null))
   },
 
   // Refresh the native tab bar / navigation config now (mobile only; a no-op
@@ -1330,9 +1332,18 @@ async function wireBiometricToggles() {
 // Picks the native action sheet in the mobile shell and a DOM bottom sheet
 // (native.css .everywhere-sheet) everywhere else. Resolves the chosen item's
 // id, or null on cancel/dismiss.
+// Items travel under their POSITION, never the caller's own `id`. `id` is
+// optional, so something has to be minted for the items that omit one — and
+// minting from position while passing other items' ids straight through put two
+// namespaces in one string space: an explicit `{ id: 0 }` collided with the
+// synthesized id of whatever sat at index 0, so a tap the user got right mapped
+// back to the wrong item. Positions cannot collide with each other. The caller's
+// `id` never needs to cross the bridge at all — Everywhere.menu() resolves it
+// from the index once the answer returns. handleMenuTrigger has always done it
+// this way; this is the other caller catching up.
 function presentMenu({ title, message, items, source }) {
   const list = (items || []).map((item, i) => ({
-    id: item.id != null ? String(item.id) : String(i),
+    id: String(i),
     title: item.title || "",
     image: item.image || null,
     style: item.style || "default",
@@ -1427,10 +1438,18 @@ function resolveNativeIcon(el, base) {
   return el.getAttribute(`${base}-${os}`) || el.getAttribute(base) || null
 }
 
+// A nav BUTTON's text is its label, so falling back to it is right.
 function navText(el) {
   return (el.getAttribute("data-everywhere-nav-title") || el.textContent || "").trim()
 }
 
+// A nav MENU's text is every item's label run together ("Edit Copy text
+// Delete") — never a title anyone meant. Only an explicit attribute counts;
+// both shells hide a blank one, which is what an untitled menu should get.
+function navMenuText(el) {
+  return (el.getAttribute("data-everywhere-nav-title") || "").trim()
+}
+
 function navSide(el) {
   return el.getAttribute("data-everywhere-nav-side") === "left" ? "left" : "right"
 }
@@ -1480,7 +1499,7 @@ function collectNavItems() {
     items.push({
       id,
       kind: "menu",
-      title: navText(menuEl),
+      title: navMenuText(menuEl),
       image: resolveNativeIcon(menuEl, "data-everywhere-nav-icon") || "ellipsis.circle",
       side: navSide(menuEl),
       children

data/bridge/package.json

@@ -8,6 +8,9 @@
     ".": "./everywhere/bridge.js",
     "./native.css": "./everywhere/native.css"
   },
+  "scripts": {
+    "test": "node --test \"test/**/*.test.mjs\""
+  },
   "files": ["everywhere/bridge.js", "everywhere/native.css", "README.md", "LICENSE"],
   "sideEffects": false,
   "keywords": ["rubyeverywhere", "tauri", "hotwire", "turbo", "rails", "desktop", "native", "bridge"],

data/lib/everywhere/android_sdk.rb

@@ -24,10 +24,32 @@ module Everywhere
     # version complaint — so we check before Gradle ever starts.
     MINIMUM_JDK = 17
 
-    # The API level the shell template compiles against. Named here (not in the
+    # What the shell template compiles against — `compileSdk` in
+    # support/mobile/android/app/build.gradle.kts. Named here (not in the
     # builder) because `every doctor` has to print the sdkmanager line for it
     # long before a build is attempted.
-    COMPILE_SDK = 35
+    COMPILE_SDK = 36
+
+    # `compileSdkMinor`, or nil for a level that has no minor version. Google
+    # minor-versions SDK platforms from API 37 on: the sdkmanager package and
+    # the platforms/ directory are both "android-37.0", never "android-37", and
+    # AGP wants the minor as its own DSL property. Nothing up to 36 carries a
+    # suffix, which is why this stayed invisible until the first 37 build.
+    COMPILE_SDK_MINOR = nil
+
+    # What the shell TARGETS — `targetSdk` in the same file, and a different
+    # question from COMPILE_SDK: compileSdk is which APIs the shell may call,
+    # targetSdk is which OS behaviour changes it opts into. Always a plain
+    # integer; AGP has no targetSdkMinor to go with compileSdkMinor.
+    TARGET_SDK = 36
+
+    # The lowest targetSdk Google Play accepts for a NEW upload today (36 as of
+    # 2026-08-31). Play raises this every August. Bump it when Google announces
+    # the next one: android_target_sdk_test then fails until the template
+    # catches up, which is the whole point of keeping it separate from
+    # TARGET_SDK. A stale targetSdk blocks new uploads only — apps already on
+    # the store keep working and keep updating.
+    PLAY_TARGET_SDK_FLOOR = 36
 
     # Android Studio's bundled JetBrains Runtime, per platform. Studio never
     # exports it, so these paths are the only way to find a JDK on a machine
@@ -273,17 +295,31 @@ module Everywhere
          .sort
     end
 
-    # `platform?(35)` and `platform?("android-35")` both work — callers spell it
-    # whichever way reads better where they are.
-    def platform?(api = COMPILE_SDK)
-      name = api.to_s.start_with?("android-") ? api.to_s : "android-#{api}"
-      installed_platforms.include?(name)
+    # How sdkmanager, AGP and the platforms/ directory all spell one platform,
+    # minor included. The single place that knows the naming rule.
+    def platform_hash(api = COMPILE_SDK, minor = COMPILE_SDK_MINOR)
+      minor.nil? ? "android-#{api}" : "android-#{api}.#{minor}"
     end
 
-    def platform!(api = COMPILE_SDK)
+    def platform_name(api) = api.to_s.start_with?("android-") ? api.to_s : "android-#{api}"
+
+    # `platform?`, `platform?(37)` and `platform?("android-37.0")` all work.
+    # A full name has to match exactly, because that is the string AGP resolves
+    # and a minor is not interchangeable with its siblings — compileSdk 37 +
+    # compileSdkMinor 0 wants android-37.0 and nothing else. A bare major
+    # matches any minor of that level instead, since the caller named none.
+    # "android-36-ext18" satisfies neither: the separator is a dot.
+    def platform?(api = platform_hash)
+      name = platform_name(api)
+      return installed_platforms.include?(name) if api.to_s.start_with?("android-")
+
+      installed_platforms.any? { |p| p == name || p.start_with?("#{name}.") }
+    end
+
+    def platform!(api = platform_hash)
       return true if platform?(api)
 
-      package = "platforms;android-#{api.to_s.delete_prefix("android-")}"
+      package = "platforms;#{platform_name(api)}"
       UI.die!("the Android SDK has no #{package} (installed: " \
               "#{installed_platforms.empty? ? "none" : installed_platforms.join(", ")}) — " \
               "#{install_hint(package)}")
@@ -317,10 +353,15 @@ module Everywhere
     # How to get a bootable AVD. The GUI route comes first because a machine
     # with Studio installed almost always has a device defined already, and
     # Device Manager also downloads the system image the CLI line assumes.
+    #
+    # System images are minor-versioned exactly like platforms
+    # (system-images;android-37.0;…), so they share platform_hash. Keyed to the
+    # compile level rather than TARGET_SDK because that one always names a
+    # package that exists; targetSdk carries no minor to resolve.
     def create_avd_hint
       "create one in Android Studio → Device Manager, or run: " \
       "#{(avdmanager || "avdmanager").shellescape} create avd -n Pixel_API_#{COMPILE_SDK} " \
-      "-k \"system-images;android-#{COMPILE_SDK};google_apis;#{host_abi}\""
+      "-k \"system-images;#{platform_hash};google_apis;#{host_abi}\""
     end
 
     # The system image ABI that runs at native speed on this host — an x86_64

data/lib/everywhere/builders/android.rb

@@ -332,11 +332,16 @@ module Everywhere
 
       # --- identity -------------------------------------------------------------
 
-      # app/build.gradle.kts reads these four values, so identity is stamped
+      # app/build.gradle.kts reads these five values, so identity is stamped
       # without ever editing a build script — the direct analogue of the iOS
       # App.xcconfig. The `everywhere.` prefix is the template's namespace:
       # its stamped(key) helper looks up "everywhere.$key", and the label
       # travels on to the frozen manifest as a placeholder.
+      #
+      # targetSdk is the one non-identity value here, and it is stamped rather
+      # than left to the template's default so `every build` records what the
+      # app actually shipped. Config#android_target_sdk is nil unless the app
+      # opted in, so the shell's own tested level is the default.
       def write_properties(work)
         File.write(File.join(work, "app", "everywhere.properties"), <<~PROPERTIES)
           # Written by `every build --target #{@target}` — do not edit; changes
@@ -345,6 +350,7 @@ module Everywhere
           everywhere.versionName=#{properties_value(@config.version(target: @target))}
           everywhere.versionCode=#{@version_code}
           everywhere.label=#{properties_value(name)}
+          everywhere.targetSdk=#{@config.android_target_sdk || AndroidSdk::TARGET_SDK}
         PROPERTIES
       end
 
@@ -617,7 +623,10 @@ module Everywhere
         # the outline — better to say so than to ship a lie.
         fillable = @config.native_android_icon_font_fetched?
 
-        problems = @config.tabs_for("android").filter_map do |tab|
+        # include_hidden: a `visible: false` tab is served by an Everywhere.tabs
+        # block at runtime, so its icon has to exist in the font that ships even
+        # though nothing bakes it.
+        problems = @config.tabs_for("android", include_hidden: true).filter_map do |tab|
           icon = tab["icon"].to_s
           base = icon.sub(/\.fill\z/, "")
           if base != icon && !fillable

data/lib/everywhere/builders/ios.rb

@@ -38,6 +38,15 @@ module Everywhere
       EXPORT_METHODS = %w[app-store-connect app-store ad-hoc development release-testing enterprise].freeze
       DEFAULT_EXPORT_METHOD = "app-store-connect"
 
+      # The entitlement capabilities a build can turn on, in the order their keys
+      # land in the generated App/App.entitlements. Each name pairs with a private
+      # `#<name>_entitlements` returning the keys that capability contributes, or
+      # {} when the app hasn't configured it — so adding one (push, App Groups,
+      # Sign in with Apple) is one entry here plus one method. Nothing downstream
+      # learns the new name: the plist writer only sees keys and values, and the
+      # xcconfig only asks whether ANY capability produced a key.
+      ENTITLEMENT_CAPABILITIES = %i[associated_domains].freeze
+
       # Distribution channels whose artifact has to reach App Store Connect: the
       # upload happens here, on the build host, because only this machine has the
       # archive and Xcode.
@@ -155,6 +164,10 @@ module Everywhere
       # Swift + generated registry). The pbxproj is never touched.
       def stamp!(work)
         UI.step("stamping shell #{UI.dim("(#{bundle_id} → #{UI.short_path(work)})")}")
+        # Entitlements first: the xcconfig's CODE_SIGN_ENTITLEMENTS only appears
+        # when a capability actually contributed a key, so the file that answers
+        # that question is resolved before the file that asks it.
+        write_entitlements(work)
         write_xcconfig(work)
         File.write(File.join(work, "App", "Resources", "everywhere.json"),
                    @config.to_shell_json(target: @target))
@@ -165,40 +178,94 @@ module Everywhere
         write_launch_background(work)
         write_usage_strings(work)
         write_url_scheme(work)
-        write_entitlements(work)
         write_app_icon(work)
         write_asset_catalog(work)
         write_extensions(work)
         write_native_packages(work)
       end
 
-      # Associated Domains entitlement for deep linking (everywhere.yml
-      # deep_linking:). Written only when configured — the default build stays
-      # entitlement-free, so the frozen template still compiles unchanged. The
-      # matching CODE_SIGN_ENTITLEMENTS is set in the xcconfig (write_xcconfig).
-      # applinks: for universal links, webcredentials: to match the association
-      # file's webcredentials section (password autofill / associated credentials).
+      # App/App.entitlements: one dict holding every active capability's keys.
+      # Written only when something is in it — with no capabilities configured
+      # the build stays entitlement-free, so the frozen template still compiles
+      # unsigned. The matching CODE_SIGN_ENTITLEMENTS is set in the xcconfig
+      # (write_xcconfig) under exactly the same condition.
       def write_entitlements(work)
-        domains = @config.deep_linking_domains
-        return unless @config.deep_linking? && domains.any?
+        keys = entitlement_keys
+        return if keys.empty?
 
-        values = domains.flat_map { |host| ["applinks:#{host}", "webcredentials:#{host}"] }
-        entries = values.map { |v| "\t\t<string>#{xml_escape(v)}</string>" }.join("\n")
-        UI.step("stamping associated domains #{UI.dim("(#{domains.join(", ")})")}")
+        # Keys are ours, not the app's — but they take the same escape as the
+        # values so a capability that ever derives one from config can't open a
+        # hole the reviewer of that capability has to remember to close.
+        body = keys.flat_map { |key, value| ["\t<key>#{xml_escape(key)}</key>", *plist_value(value)] }
         File.write(File.join(work, "App", "App.entitlements"), <<~PLIST)
           <?xml version="1.0" encoding="UTF-8"?>
           <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
           <plist version="1.0">
           <dict>
-          \t<key>com.apple.developer.associated-domains</key>
-          \t<array>
-          #{entries}
-          \t</array>
+          #{body.join("\n")}
           </dict>
           </plist>
         PLIST
       end
 
+      # Every active capability's keys, merged into that one dict. Apple
+      # namespaces entitlement keys per capability, so two capabilities can't
+      # collide over a key in practice; a key whose value came out empty is
+      # dropped, because an entitlement that grants nothing is not worth making
+      # an otherwise entitlement-free build carry a file (and an empty <array>
+      # is something codesign has to sign for no reason).
+      #
+      # Memoized because both writers ask — write_entitlements for the file,
+      # write_xcconfig for whether to point at one — and a capability announces
+      # itself with UI.step as it resolves, so asking twice would say it twice.
+      #
+      # The registry is read through self.class so the list is a subclass's to
+      # extend rather than something the merge hardcodes.
+      def entitlement_keys
+        @entitlement_keys ||=
+          self.class::ENTITLEMENT_CAPABILITIES
+              .inject({}) { |keys, capability| keys.merge(send(:"#{capability}_entitlements")) }
+              .reject { |_key, value| value.respond_to?(:empty?) && value.empty? }
+      end
+
+      # Associated Domains for deep linking (everywhere.yml deep_linking:) — the
+      # first capability, and the shape the rest follow: return {} when the app
+      # hasn't asked for it, otherwise the keys it grants. applinks: for universal
+      # links, webcredentials: to match the association file's webcredentials
+      # section (password autofill / associated credentials).
+      def associated_domains_entitlements
+        domains = @config.deep_linking_domains
+        return {} unless @config.deep_linking? && domains.any?
+
+        UI.step("stamping associated domains #{UI.dim("(#{domains.join(", ")})")}")
+        { "com.apple.developer.associated-domains" =>
+            domains.flat_map { |host| ["applinks:#{host}", "webcredentials:#{host}"] } }
+      end
+
+      # One entitlement value as the plist XML lines that follow its <key>, one
+      # tab in. Apple's app entitlements come in three shapes and no more: arrays
+      # of strings (associated domains, App Groups, keychain access groups),
+      # plain strings (aps-environment, the iCloud container environment), and
+      # booleans (HealthKit, HomeKit, and most other on/off capabilities) — which
+      # is why the dict is flat and nothing here recurses.
+      #
+      # Every string goes through xml_escape because these values carry
+      # app-supplied hostnames and identifiers; an unescaped "<" is at best a
+      # plist codesign refuses to read, at worst extra entitlement keys of the
+      # app author's choosing. An unsupported type is a bug in a capability
+      # method rather than something a user can reach, so it raises here instead
+      # of quietly writing a <key> with no value under it.
+      def plist_value(value)
+        case value
+        when Array
+          ["\t<array>", *value.map { |item| "\t\t<string>#{xml_escape(item)}</string>" }, "\t</array>"]
+        when String then ["\t<string>#{xml_escape(value)}</string>"]
+        when true, false then ["\t<#{value}/>"]
+        else raise ArgumentError, "entitlement values must be a string, boolean or array of strings, " \
+                                  "got #{value.class}"
+        end
+      end
+
       # Native extensions: the app repo's native/ios/*.swift copied into the
       # template's Extensions/ folder, plus a generated registry naming what
       # everywhere.yml declares (native.ios). Extensions/ is a filesystem-
@@ -416,9 +483,11 @@ module Everywhere
       end
 
       def write_xcconfig(work)
-        # Only point at an entitlements file when deep linking wrote one — an
-        # empty CODE_SIGN_ENTITLEMENTS would break the signing step.
-        entitlements = "CODE_SIGN_ENTITLEMENTS = App/App.entitlements\n" if @config.deep_linking? && @config.deep_linking_domains.any?
+        # Only point at an entitlements file when some capability wrote one — an
+        # empty CODE_SIGN_ENTITLEMENTS would break the signing step. Asked of the
+        # merged keys, not of any one capability, so a build that enables push
+        # and no deep linking gets the setting just the same.
+        entitlements = "CODE_SIGN_ENTITLEMENTS = App/App.entitlements\n" if entitlement_keys.any?
         File.write(File.join(work, "App", "App.xcconfig"), <<~XCCONFIG)
           // Written by `every build --target #{@target}` — do not edit; changes
           // belong in config/everywhere.yml.

data/lib/everywhere/commands/doctor.rb

@@ -237,7 +237,7 @@ module Everywhere
         ok &= fix_check(labelled("an Android virtual device", avds.first),
                         sdk.create_avd_hint) { avds.any? }
 
-        platform = "platforms;android-#{sdk::COMPILE_SDK}"
+        platform = "platforms;#{sdk.platform_hash}"
         ok &= fix_check(labelled(platform, listed(sdk.installed_platforms)),
                         sdk.install_hint(platform)) { sdk.platform? }
 

data/lib/everywhere/commands/install.rb

@@ -206,6 +206,10 @@ module Everywhere
           # Mobile tab bar (iOS today, Android soon). Served live from
           # /everywhere/ios_v1.json too, so tab changes deploy with the app —
           # no app-store release. Icons: ios = SF Symbol name.
+          #
+          # Vary the bar per request with Everywhere.tabs in an initializer —
+          # signed-in only, feature flags, roles. visible: false declares a tab
+          # without shipping it, for that block to add back (ctx.tab("Admin")).
           # tabs:
           #   - name: Home
           #     path: /
@@ -215,6 +219,11 @@ module Everywhere
           #     path: /settings
           #     icons:
           #       ios: gear
+          #   - name: Admin
+          #     path: /admin
+          #     icons:
+          #       ios: shield
+          #     visible: false
 
           # iOS-specific knobs (and native Swift you compile into the shell —
           # see /docs/diy/native-extensions).

data/lib/everywhere/config/app.rb

@@ -32,6 +32,50 @@ module Everywhere
 
           "#{at}.bundle_id #{value.inspect} is not a bundle id — reverse-DNS, " \
             "letters/digits/./- only (like com.example.app)"
+        end + android_target_sdk_errors
+      end
+
+      # `platforms.android.target_sdk` — the escape hatch for shipping ahead of
+      # a Google Play deadline that lands before our next release does. It is
+      # the ONLY SDK level an app may set, and deliberately not a general knob:
+      # targetSdk is a contract with the OS, not an app preference, and every
+      # behaviour change it opts into lands on the Kotlin in the frozen shell,
+      # which is only tested at AndroidSdk::TARGET_SDK. Setting it means "I
+      # accept untested OS behaviour".
+      #
+      # compileSdk stays unexposed on purpose: from API 37 on it needs a
+      # matching compileSdkMinor and an AGP that knows the level, so moving it
+      # is a template change, never a config one.
+      #
+      # nil when unset — the builder substitutes AndroidSdk::TARGET_SDK, so the
+      # default lives in one place rather than being duplicated here.
+      def android_target_sdk
+        raw = android_platform["target_sdk"]
+        Integer(raw.to_s, exception: false) unless raw.nil?
+      end
+
+      # Raising it is the supported direction. Lowering is refused: the shipped
+      # Kotlin assumes the behaviour of the level it was built for, and a
+      # target under Play's floor is rejected at upload — the exact failure
+      # AndroidSdk::PLAY_TARGET_SDK_FLOOR exists to catch. Nothing caps the top
+      # end, because targeting a level above compileSdk is the whole point (and
+      # AGP allows it: the manifest claims the level, the code compiled against
+      # ours).
+      def android_target_sdk_errors
+        raw = android_platform["target_sdk"]
+        return [] if raw.nil?
+
+        value = android_target_sdk
+        tested = AndroidSdk::TARGET_SDK
+
+        if value.nil?
+          ["platforms.android.target_sdk #{raw.inspect} is not an API level — " \
+           "a whole number like #{tested}"]
+        elsif value < tested
+          ["platforms.android.target_sdk #{value} is below the shell's tested level " \
+           "(#{tested}) — this option only raises it, to ship ahead of a Play deadline"]
+        else
+          []
         end
       end
 

data/lib/everywhere/config/data.rb

@@ -22,6 +22,14 @@ module Everywhere
 
       def android_target?(target) = self.class.os_of(target) == "android"
 
+      # `platforms.android` as a Hash, whatever the YAML actually held — a
+      # scalar there would make Hash#dig raise instead of reporting a config
+      # error.
+      def android_platform
+        value = platforms["android"]
+        value.is_a?(Hash) ? value : {}
+      end
+
       # Per-platform overrides, keyed by os (macos / ios / android / windows /
       # linux). Each value overrides the matching `app:` keys for that platform.
       def platforms = @data.fetch("platforms", nil) || {}

data/lib/everywhere/config/mobile.rb

@@ -12,11 +12,20 @@ module Everywhere
       #       icons:
       #         ios: hammer
       #         android: build
+      #     - name: Admin
+      #       path: /admin
+      #       visible: false          # declared, never shown until a hook adds it
       #
       # Tabs ship two ways from the same source: baked into the app's bundled
       # path-configuration.json at build time (offline/first-launch), and served
       # live from /everywhere/<platform>_v1.json (MobileConfigEndpoint) so tab
       # changes deploy with the web app — no app-store release.
+      #
+      # `visible: false` declares a tab without showing it anywhere: not baked,
+      # not served, but validated. It's the honest home for a tab an
+      # Everywhere.tabs block adds per request (`ctx.tab("Admin")`) — an
+      # undeclared tab renders blank on Android when its icon name is a typo,
+      # because the build only checks names it can see.
       def tabs
         entries = @data["tabs"]
         return [] unless entries.is_a?(Array)
@@ -26,14 +35,19 @@ module Everywhere
 
           path = tab["path"].start_with?("/") ? tab["path"] : "/#{tab["path"]}"
           { "name" => tab["name"], "path" => path,
-            "icon" => tab["icon"], "icons" => (tab["icons"] if tab["icons"].is_a?(Hash)) }.compact
+            "icon" => tab["icon"], "icons" => (tab["icons"] if tab["icons"].is_a?(Hash)),
+            "visible" => (false if tab["visible"] == false) }.compact
         end
       end
 
       # Tabs with the icon resolved for one platform: icons.<os>, then the
-      # shared icon, then a safe default.
-      def tabs_for(os)
-        tabs.map do |tab|
+      # shared icon, then a safe default. Hidden tabs are left out unless asked
+      # for — the build asks, to validate every icon name it can see, and so
+      # does RequestContext#tab, which exists to hand one back.
+      def tabs_for(os, include_hidden: false)
+        entries = tabs
+        entries = entries.reject { |tab| tab["visible"] == false } unless include_hidden
+        entries.map do |tab|
           { "title" => tab["name"], "path" => tab["path"],
             "icon" => tab.dig("icons", os.to_s) || tab["icon"] || DEFAULT_TAB_ICONS[os.to_s] }.compact
         end

data/lib/everywhere/config.rb

@@ -4,6 +4,7 @@ require "yaml"
 require_relative "error"
 require_relative "ui"
 require_relative "native_platform"
+require_relative "android_sdk" # AndroidSdk::TARGET_SDK bounds platforms.android.target_sdk
 require_relative "shell_pages"
 require_relative "tab_filter"
 require_relative "config/data"

data/lib/everywhere/mobile_config_endpoint.rb

@@ -76,7 +76,7 @@ module Everywhere
 
       os = match[1]
       config = Config.load(@root)
-      tabs = Everywhere.resolve_tabs(config.tabs_for(os), request_for(env))
+      tabs = Everywhere.resolve_tabs(config.tabs_for(os), request_for(env), platform: os, config: config)
       tabs = Jump.exit_tabs(config, os, tabs) if Jump.enabled?
       json(config.path_configuration_json(os, tabs: tabs))
     end

data/lib/everywhere/mobile_configs_controller.rb

@@ -31,7 +31,7 @@ module Everywhere
       response.headers["cache-control"] = "no-store"
 
       os = params[:platform_v1].delete_suffix("_v1")
-      tabs = Everywhere.resolve_tabs(config.tabs_for(os), request)
+      tabs = Everywhere.resolve_tabs(config.tabs_for(os), request, platform: os, config: config)
       tabs = Jump.exit_tabs(config, os, tabs) if Jump.enabled?
       render json: config.path_configuration_hash(os, tabs: tabs)
     end

data/lib/everywhere/native_helper.rb

@@ -211,6 +211,11 @@ module Everywhere
     #     <%= everywhere_menu_item "Share", share_path, icons: { ios: "square.and.arrow.up" } %>
     #     <%= everywhere_menu_item "Delete", note_path(@note), method: :delete, style: "destructive" %>
     #   <% end %>
+    #
+    # `title` heads the native menu (a UIMenu title on iOS, the sheet's header
+    # on Android); leave it off for a bare ⋯ and the shells render no header.
+    # Unlike a nav button, a menu never borrows its text from the page — that
+    # text is its items' labels.
     def everywhere_nav_menu(title = nil, icon: nil, icons: nil, side: "right",
                             css_class: nil, id: nil, &block)
       content = _everywhere_capture(&block)

data/lib/everywhere/request_context.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+require_relative "error"
+
+module Everywhere
+  # What a per-request hook — the tab bar block, the current-user resolver —
+  # gets handed instead of a bare request.
+  #
+  # It exists because the raw request isn't the same object on every path: Rails
+  # apps reach the mobile config endpoint through MobileConfigsController with an
+  # ActionDispatch::Request (signed/encrypted cookie jar), Sinatra and Hanami
+  # apps through MobileConfigEndpoint with a Rack::Request (plain cookie hash).
+  # A block written against one used to break on the other; #session and
+  # #cookies here read the same on both.
+  class RequestContext
+    # The framework-native request, for anything this class doesn't wrap
+    # (Warden lives at `request.env["warden"]`, for one).
+    attr_reader :request
+
+    # "ios" or "android" — which shell is asking. nil outside the mobile config
+    # endpoint.
+    attr_reader :platform
+
+    # The app's Everywhere::Config. nil outside the mobile config endpoint.
+    attr_reader :config
+
+    def initialize(request, platform: nil, config: nil)
+      @request = request
+      @platform = platform&.to_s
+      @config = config
+    end
+
+    def ios? = platform == "ios"
+    def android? = platform == "android"
+
+    # The session hash, or {} when the app runs no session middleware (and on
+    # the bare-env fallback, where `request` is a Hash rather than a Request).
+    def session
+      return @session if defined?(@session)
+
+      @session = (request.session if request.respond_to?(:session)) || {}
+    end
+
+    # Cookies. Rails' jar when the request carries one, so `cookies.signed[…]`
+    # and `cookies.encrypted[…]` work; Rack's name => value hash otherwise. Both
+    # answer `cookies[:name]`, which is the common case.
+    def cookies
+      return @cookies if defined?(@cookies)
+
+      @cookies =
+        if request.respond_to?(:cookie_jar) then request.cookie_jar
+        elsif request.respond_to?(:cookies) then request.cookies
+        else {}
+        end
+    end
+
+    # Whoever `Everywhere.current_user` resolves for this request — nil when no
+    # resolver is registered, so a hook that branches on it degrades to "signed
+    # out" rather than raising. Memoized: resolvers hit the database, and the
+    # tab block is free to ask several times.
+    def current_user
+      return @current_user if defined?(@current_user)
+
+      @current_user = Everywhere.resolve_current_user(self)
+    end
+
+    def signed_in? = !current_user.nil?
+
+    # A tab declared in config/everywhere.yml, by name, resolved for this
+    # platform — including `visible: false` ones, which is the point: declare a
+    # tab so the build validates its icon and bakes nothing, then add it back
+    # here for the users who should see it.
+    #
+    #   Everywhere.tabs do |tabs, ctx|
+    #     ctx.current_user.admin? ? tabs + [ctx.tab("Admin")] : tabs
+    #   end
+    #
+    # Raises on an unknown name rather than returning nil: a typo would
+    # otherwise drop the tab silently, and this fails in the endpoint where the
+    # message can name it.
+    def tab(name)
+      unless config && platform
+        raise Error, "RequestContext#tab needs the app config — it's available " \
+                     "inside an Everywhere.tabs block, not to a standalone context"
+      end
+
+      declared = config.tabs_for(platform, include_hidden: true)
+      wanted = name.to_s
+      found = declared.find { |tab| tab["title"] == wanted } ||
+              declared.find { |tab| tab["title"].to_s.casecmp?(wanted) }
+      return found if found
+
+      raise Error, "no tab named #{wanted.inspect} in config/everywhere.yml — " \
+                   "declared: #{declared.map { |tab| tab["title"] }.inspect}"
+    end
+  end
+end

data/lib/everywhere/tab_filter.rb

@@ -1,36 +1,95 @@
 # frozen_string_literal: true
 
+require_relative "request_context"
+
 module Everywhere
   class << self
-    # Register a per-request filter for the mobile tab bar. The block receives
-    # the resolved tab list (`[{ "title" =>, "path" =>, "icon" => }, …]`) and
-    # the current request, and returns the subset to show — return `[]` to hide
-    # the tab bar entirely (the shell falls back to single-screen navigation).
+    # Register the per-request tab bar hook. The block receives the tabs
+    # config/everywhere.yml declares (`[{ "title" =>, "path" =>, "icon" => }, …]`,
+    # already resolved for the asking platform) and an Everywhere::RequestContext,
+    # and returns the list to serve — return `[]` to hide the tab bar entirely
+    # (the shell falls back to single-screen navigation).
     #
-    # It runs inside the mobile config endpoint, which shares the app's session
-    # and cookies, so it can branch on auth or any request state:
+    # The list it returns is the list, so this adds and reorders as well as
+    # hides. Anything the app can answer during a request can decide it:
     #
     #   # config/initializers/everywhere.rb
-    #   Everywhere.filter_tabs do |tabs, request|
-    #     request.session[:user_id] ? tabs : []
+    #   Rails.application.config.to_prepare do
+    #     Everywhere.tabs do |tabs, ctx|
+    #       next [] unless ctx.current_user
+    #
+    #       tabs = tabs.reject { |tab| tab["title"] == "Labs" } unless
+    #         Flipper.enabled?(:labs, ctx.current_user)
+    #       tabs << ctx.tab("Admin") if ctx.current_user.admin?
+    #       tabs
+    #     end
     #   end
     #
+    # `ctx.tab("Admin")` pulls in a tab declared `visible: false` — see
+    # RequestContext#tab. `ctx.current_user` needs a resolver; see #current_user.
+    #
     # Live like the rest of the config: the shell re-reads it on launch and on
     # every foreground, so a sign-in shows the tabs on next foreground — no
-    # rebuild, no app-store release.
-    def filter_tabs(&block)
+    # rebuild, no app-store release. Wrap the registration in `to_prepare` so a
+    # reload in development doesn't leave the block closed over stale constants.
+    def tabs(&block)
+      raise ArgumentError, "Everywhere.tabs needs a block — Everywhere.tabs { |tabs, ctx| … }" unless block
+
       @tabs_filter = block
     end
 
-    # Apply the registered filter (identity when none is set). Always returns
+    # The original filter-only form, still supported: the block takes the
+    # framework-native request rather than a context, and can only subset the
+    # list it's given. #tabs is the one to write today.
+    def filter_tabs(&block)
+      raise ArgumentError, "Everywhere.filter_tabs needs a block" unless block
+
+      @tabs_filter = ->(tabs, context) { block.call(tabs, context.request) }
+    end
+
+    # Register how this app identifies the requester, once, for every hook that
+    # asks (`ctx.current_user`). The mobile config endpoint deliberately doesn't
+    # inherit ApplicationController — its before_actions would lock the shells
+    # out — so it can't reach `Current` or a `current_user` helper, and this is
+    # where the app closes that gap:
+    #
+    #   # config/initializers/everywhere.rb
+    #   Rails.application.config.to_prepare do
+    #     Everywhere.current_user do |ctx|
+    #       session_id = ctx.cookies.signed[:session_id]
+    #       Session.find_by(id: session_id)&.user if session_id
+    #     end
+    #   end
+    #
+    # Devise and anything else on Warden need no cookie work at all:
+    #
+    #   Everywhere.current_user { |ctx| ctx.request.env["warden"]&.user }
+    #
+    # Return nil for a signed-out request. Runs at most once per request.
+    def current_user(&block)
+      unless block
+        raise ArgumentError, "Everywhere.current_user needs a block — it registers the resolver " \
+                             "(ask a RequestContext for the user itself: ctx.current_user)"
+      end
+
+      @current_user_resolver = block
+    end
+
+    # Apply the registered tab hook (identity when none is set). Always returns
     # an Array so a stray nil/scalar from a block can't break serialization.
-    def resolve_tabs(tabs, request)
+    def resolve_tabs(tabs, request, platform: nil, config: nil)
       return tabs unless @tabs_filter
 
-      Array(@tabs_filter.call(tabs, request))
+      context = RequestContext.new(request, platform: platform, config: config)
+      Array(@tabs_filter.call(tabs, context))
+    end
+
+    # nil when no resolver is registered — hooks treat that as signed out.
+    def resolve_current_user(context)
+      @current_user_resolver&.call(context)
     end
 
-    # Test/reset hook.
-    attr_writer :tabs_filter
+    # Test/reset hooks.
+    attr_writer :tabs_filter, :current_user_resolver
   end
 end

data/lib/everywhere/version.rb

@@ -3,7 +3,7 @@
 require "json"
 
 module Everywhere
-  VERSION = "0.10.1"
+  VERSION = "0.11.0"
 
   # Version of the @rubyeverywhere/bridge JS this gem ships. bridge/ in the
   # gem IS the npm package (served to Rails apps by Everywhere::Engine,

data/support/agents/frameworks/rails-views.md

@@ -91,8 +91,11 @@ phone shell rebuilds its web views and re-fetches its tab bar:
 redirect_to everywhere_auth_redirect(after_authentication_url)
 ```
 
-**Tab bar, per request.** `Everywhere.filter_tabs { |tabs, request| … }` in an initializer
-varies the mobile tab bar — it shares the app's session; return `[]` to hide the bar.
+**Tab bar, per request.** `Everywhere.tabs { |tabs, ctx| … }` in an initializer (inside
+`to_prepare`) builds the mobile tab bar — return the list to serve, or `[]` to hide the bar.
+`ctx` carries `platform`, `session`/`cookies`, and `current_user` (register the lookup once
+with `Everywhere.current_user { |ctx| … }`). `ctx.tab("Name")` pulls in a tab declared
+`visible: false` in `everywhere.yml`.
 
 Styling helpers live in `everywhere/native.css`, including `.everywhere-titlebar-inset` for
 `window.title_bar: overlay`.

data/support/mobile/android/README.md

@@ -15,9 +15,11 @@ frozen. When `every build --target android-*` stamps a copy, it overwrites
 **exactly** these files and nothing else:
 
 1. `app/everywhere.properties` — applicationId, versionName, versionCode, app
-   label. The direct analogue of iOS's `App.xcconfig`: identity is stamped
-   without ever touching a build script. `app/build.gradle.kts` reads it at
-   configuration time.
+   label, targetSdk. The direct analogue of iOS's `App.xcconfig`: identity is
+   stamped without ever touching a build script. `app/build.gradle.kts` reads
+   it at configuration time. targetSdk is the one non-identity value, stamped
+   so `platforms.android.target_sdk` can raise it ahead of a Play deadline
+   without editing the frozen script.
 2. `app/src/main/assets/everywhere.json` — runtime config (remote URL, entry
    path, colours, permissions, auth, universal-link hosts);
    `Config#to_shell_json`.
@@ -103,7 +105,8 @@ no `+`, no version catalog. Moving a pin is a deliberate edit here.
 | Android Gradle Plugin | 8.13.2 |
 | Kotlin / kotlinx.serialization plugin | 2.3.0 |
 | `dev.hotwire:core`, `dev.hotwire:navigation-fragments` | 1.3.0 |
-| `compileSdk` / `targetSdk` | 35 |
+| `compileSdk` | 36 — frozen; from API 37 on it needs `compileSdkMinor` too |
+| `targetSdk` | 36 — Play's floor for new uploads from 2026-08-31; stamped, so `platforms.android.target_sdk` can raise it |
 | `minSdk` | 28 — Hotwire Native Android's floor, not negotiable |
 | Java toolchain / JVM target | 17 |
 

data/support/mobile/android/app/build.gradle.kts

@@ -32,7 +32,11 @@ android {
     // deliberately NOT the applicationId: apps rename their bundle id freely,
     // and a namespace change would move every generated class.
     namespace = "com.rubyeverywhere.shell"
-    compileSdk = 35
+    // Lockstep with Everywhere::AndroidSdk::COMPILE_SDK, which is what `every
+    // doctor` preflights and what names the sdkmanager package. From API 37 on
+    // a platform also needs `compileSdkMinor` (android-37.0, not android-37) —
+    // that's AndroidSdk::COMPILE_SDK_MINOR. android_target_sdk_test pins both.
+    compileSdk = 36
 
     defaultConfig {
         applicationId = stamped("applicationId", "com.rubyeverywhere.app")
@@ -43,7 +47,17 @@ android {
         // It also clears API 26 for Typeface.Builder.setFontVariationSettings,
         // which IconFont needs for the Material Symbols FILL axis.
         minSdk = 28
-        targetSdk = 35
+        // Which OS behaviour changes the shell opts into, and what Play gates
+        // new uploads on (36 from 2026-08-31). The default below is lockstep
+        // with Everywhere::AndroidSdk::TARGET_SDK, which must not fall below
+        // PLAY_TARGET_SDK_FLOOR; android_target_sdk_test pins the pair.
+        //
+        // Stamped, unlike compileSdk, so an app can raise it via
+        // platforms.android.target_sdk to ship ahead of a Play deadline that
+        // lands before our next release. It only goes up, and it means
+        // accepting OS behaviour this template hasn't been tested against —
+        // the behaviour changes land on the Kotlin here, not on the app.
+        targetSdk = stamped("targetSdk", "36").toInt()
 
         // Consumed by AndroidManifest.xml. The label is a placeholder so the
         // manifest itself stays frozen when the app is renamed.

data/support/mobile/android/app/everywhere.properties

@@ -6,3 +6,6 @@ everywhere.applicationId=com.rubyeverywhere.app
 everywhere.versionName=0.1.0
 everywhere.versionCode=1
 everywhere.label=RubyEverywhere
+# Not identity: the shell's tested targetSdk, which an app may raise via
+# platforms.android.target_sdk. build.gradle.kts defaults to the same number.
+everywhere.targetSdk=36

data/support/mobile/ios/App.xcodeproj/project.pbxproj

@@ -11,12 +11,6 @@
 		EBE000000000000000000032 /* SceneDelegate.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000014 /* SceneDelegate.swift */; };
 		EBE000000000000000000033 /* EverywhereConfig.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000015 /* EverywhereConfig.swift */; };
 		EBE000000000000000000034 /* ErrorViewController.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000016 /* ErrorViewController.swift */; };
-		EBE000000000000000000035 /* NotificationComponent.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000017 /* NotificationComponent.swift */; };
-		EBE000000000000000000044 /* HapticsComponent.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000043 /* HapticsComponent.swift */; };
-		EBE000000000000000000046 /* PermissionsComponent.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000045 /* PermissionsComponent.swift */; };
-		EBE000000000000000000058 /* BiometricsComponent.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000057 /* BiometricsComponent.swift */; };
-		EBE000000000000000000060 /* StorageComponent.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000059 /* StorageComponent.swift */; };
-		EBE000000000000000000068 /* MenuComponent.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000067 /* MenuComponent.swift */; };
 		EBE000000000000000000063 /* EverywhereHost.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000062 /* EverywhereHost.swift */; };
 		EBE000000000000000000070 /* AuthFlow.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000069 /* AuthFlow.swift */; };
 		EBE000000000000000000036 /* everywhere.json in Resources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000018 /* everywhere.json */; };
@@ -35,12 +29,6 @@
 		EBE000000000000000000014 /* SceneDelegate.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SceneDelegate.swift; sourceTree = "<group>"; };
 		EBE000000000000000000015 /* EverywhereConfig.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = EverywhereConfig.swift; sourceTree = "<group>"; };
 		EBE000000000000000000016 /* ErrorViewController.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ErrorViewController.swift; sourceTree = "<group>"; };
-		EBE000000000000000000017 /* NotificationComponent.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NotificationComponent.swift; sourceTree = "<group>"; };
-		EBE000000000000000000043 /* HapticsComponent.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = HapticsComponent.swift; sourceTree = "<group>"; };
-		EBE000000000000000000045 /* PermissionsComponent.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = PermissionsComponent.swift; sourceTree = "<group>"; };
-		EBE000000000000000000057 /* BiometricsComponent.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BiometricsComponent.swift; sourceTree = "<group>"; };
-		EBE000000000000000000059 /* StorageComponent.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = StorageComponent.swift; sourceTree = "<group>"; };
-		EBE000000000000000000067 /* MenuComponent.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = MenuComponent.swift; sourceTree = "<group>"; };
 		EBE000000000000000000018 /* everywhere.json */ = {isa = PBXFileReference; lastKnownFileType = text.json; path = everywhere.json; sourceTree = "<group>"; };
 		EBE000000000000000000019 /* path-configuration.json */ = {isa = PBXFileReference; lastKnownFileType = text.json; path = "path-configuration.json"; sourceTree = "<group>"; };
 		EBE000000000000000000020 /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = Assets.xcassets; sourceTree = "<group>"; };
@@ -50,6 +38,7 @@
 /* End PBXFileReference section */
 
 /* Begin PBXFileSystemSynchronizedRootGroup section */
+		EBE000000000000000000005 /* Bridge */ = {isa = PBXFileSystemSynchronizedRootGroup; explicitFileTypes = {}; explicitFolders = (); path = Bridge; sourceTree = "<group>"; };
 		EBE000000000000000000061 /* Extensions */ = {isa = PBXFileSystemSynchronizedRootGroup; explicitFileTypes = {}; explicitFolders = (); path = Extensions; sourceTree = "<group>"; };
 /* End PBXFileSystemSynchronizedRootGroup section */
 
@@ -102,19 +91,6 @@
 			path = App;
 			sourceTree = "<group>";
 		};
-		EBE000000000000000000005 /* Bridge */ = {
-			isa = PBXGroup;
-			children = (
-				EBE000000000000000000017 /* NotificationComponent.swift */,
-				EBE000000000000000000043 /* HapticsComponent.swift */,
-				EBE000000000000000000045 /* PermissionsComponent.swift */,
-				EBE000000000000000000057 /* BiometricsComponent.swift */,
-				EBE000000000000000000059 /* StorageComponent.swift */,
-				EBE000000000000000000067 /* MenuComponent.swift */,
-			);
-			path = Bridge;
-			sourceTree = "<group>";
-		};
 		EBE000000000000000000023 /* Resources */ = {
 			isa = PBXGroup;
 			children = (
@@ -140,6 +116,7 @@
 			dependencies = (
 			);
 			fileSystemSynchronizedGroups = (
+				EBE000000000000000000005 /* Bridge */,
 				EBE000000000000000000061 /* Extensions */,
 			);
 			name = App;
@@ -211,12 +188,6 @@
 				EBE000000000000000000032 /* SceneDelegate.swift in Sources */,
 				EBE000000000000000000033 /* EverywhereConfig.swift in Sources */,
 				EBE000000000000000000034 /* ErrorViewController.swift in Sources */,
-				EBE000000000000000000035 /* NotificationComponent.swift in Sources */,
-				EBE000000000000000000044 /* HapticsComponent.swift in Sources */,
-				EBE000000000000000000046 /* PermissionsComponent.swift in Sources */,
-				EBE000000000000000000058 /* BiometricsComponent.swift in Sources */,
-				EBE000000000000000000060 /* StorageComponent.swift in Sources */,
-				EBE000000000000000000068 /* MenuComponent.swift in Sources */,
 				EBE000000000000000000063 /* EverywhereHost.swift in Sources */,
 				EBE000000000000000000070 /* AuthFlow.swift in Sources */,
 			);

data/support/mobile/ios/README.md

@@ -22,13 +22,21 @@ this template, it overwrites **exactly** these files and nothing else:
 6. *(optionally)* `App/Info.plist`'s `CFBundleURLTypes` — the sign-in callback
    scheme, written **only** when `auth:` is set in `everywhere.yml` (alongside
    the permission usage strings, which are stamped the same way)
-7. *(optionally)* `App/App.entitlements` — the Associated Domains entitlement,
-   written **only** when `deep_linking:` is set in `everywhere.yml`. The matching
-   `CODE_SIGN_ENTITLEMENTS` is added to the xcconfig in the same case, so the
-   default build stays entitlement-free and the frozen template still compiles
-   unchanged. The gem serves the `/.well-known/apple-app-site-association` file
-   these domains point at; `SceneDelegate` routes an incoming universal link to
-   its in-app path.
+7. *(optionally)* `App/App.entitlements` — merged from every entitlement
+   capability the app has configured, written **only** when at least one grants
+   a key. The matching `CODE_SIGN_ENTITLEMENTS` is added to the xcconfig in
+   exactly that case, so the default build stays entitlement-free and the frozen
+   template still compiles unchanged.
+
+   Capabilities are an ordered registry in the builder
+   (`ENTITLEMENT_CAPABILITIES` in `lib/everywhere/builders/ios.rb`); each
+   contributes keys or nothing. Today the only member is Associated Domains,
+   written when `deep_linking:` is set in `everywhere.yml` — it grants
+   `applinks:` and `webcredentials:` per host. The gem serves the
+   `/.well-known/apple-app-site-association` file these domains point at;
+   `SceneDelegate` routes an incoming universal link to its in-app path. Note
+   that `webcredentials:` is what makes passkeys / WebAuthn work in the web
+   view, so deep linking is a de facto prerequisite for those.
 
 Everything the CLI needs to vary per app flows through those files. The product
 is always `App.app` (`PRODUCT_NAME = App` is hardcoded); identity comes from the
@@ -40,6 +48,16 @@ xcconfig (`PRODUCT_BUNDLE_IDENTIFIER`, `MARKETING_VERSION`,
 bumps) mean deliberately editing `project.pbxproj` here in the template and
 recommitting — never in a stamped copy.
 
+**Exception — `App/Bridge/` and `App/Extensions/`.** Both are
+`PBXFileSystemSynchronizedRootGroup`s, so Xcode picks up whatever is on disk:
+dropping a `.swift` file into either directory *is* the integration, and needs
+no pbxproj edit. That is the whole point of the synchronized group — a new
+bridge component costs one new file plus its registration in
+`AppDelegate.configureHotwire`, not four hand-written pbxproj entries with
+hand-assigned UUIDs. Files added to a synchronized group must not also get
+explicit `PBXBuildFile` / `PBXFileReference` / `PBXSourcesBuildPhase` entries,
+or they compile twice and the build fails on duplicate symbols.
+
 ## SPM pin policy
 
 The project depends on one remote package: the fork
@@ -67,6 +85,14 @@ xcodebuild build -project App.xcodeproj -scheme App -destination 'generic/platfo
 
 The shared `App` scheme is required for headless `xcodebuild` — do not delete it.
 
+**Running `xcodebuild` here rewrites `Package.resolved` as a side effect.** Xcode
+adds an `originHash` key and re-adds the source `branch` key to the pin, leaving
+the `revision` SHA correct but the file no longer matching the pin policy above.
+That trips `IosTemplatePinTest#test_package_resolved_state_has_no_branch`. It is
+a byproduct of invoking `xcodebuild`, not of any edit you made — revert it
+(`git checkout -- App.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved`)
+before committing.
+
 ## Dev loop
 
 The shell is remote-mode only (`remote_url` in everywhere.json). For local

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby_everywhere
 version: !ruby/object:Gem::Version
-  version: 0.10.1
+  version: 0.11.0
 platform: ruby
 authors:
 - Andrea Fomera
@@ -187,6 +187,7 @@ files:
 - lib/everywhere/raw_tty.rb
 - lib/everywhere/receipt.rb
 - lib/everywhere/relay.rb
+- lib/everywhere/request_context.rb
 - lib/everywhere/s3.rb
 - lib/everywhere/shell_pages.rb
 - lib/everywhere/shellout.rb