Prepare nativephp/web-ui for public alpha

.github/SECURITY.md

@@ -0,0 +1,13 @@
+# Security Policy
+
+**PLEASE DON'T DISCLOSE SECURITY-RELATED ISSUES PUBLICLY, [SEE BELOW](#reporting-a-vulnerability).**
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability within this package, please send an
+email to support@nativephp.com. All security vulnerabilities will be promptly
+addressed.
+
+This package ships a browser-facing transport (sealed snapshots, hashed
+endpoints, uploads). Reports touching snapshot integrity, endpoint
+enumeration, or upload handling are especially welcome.

.github/funding.yml

@@ -0,0 +1 @@
+open_collective: nativephp

.github/workflows/pint.yml

@@ -0,0 +1,33 @@
+name: Pint
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  pint:
+    name: Code style (Pint)
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.4'
+          coverage: none
+
+      # Pint needs no project vendor/ (a full install would drag in the
+      # private nativephp/mobile auth), but install it under the SAME
+      # constraint as composer.json's require-dev so CI and a local
+      # `composer lint` agree on the version instead of drifting apart.
+      - name: Install Pint
+        run: composer global require "laravel/pint:^1.24" --no-interaction
+
+      - name: Check code style
+        run: pint --test

.gitignore

@@ -0,0 +1,6 @@
+/vendor/
+composer.lock
+.phpunit.result.cache
+.phpunit.cache/
+.DS_Store
+.idea/

CHANGELOG.md

@@ -0,0 +1,19 @@
+# Changelog
+
+All notable changes to `nativephp/web-ui` are documented here. The format
+follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+
+## [Unreleased]
+
+First public alpha, installable from `main`. Renders `Route::native()`
+screens as HTML in a browser from the same Blade source the mobile app
+ships.
+
+- Stateless Livewire-style protocol: sealed HMAC snapshots, APP_KEY-hashed
+  endpoints, uploads with progress.
+- Client runtime (`edge-web.js`): keyed DOM morph, event queue, SPA nav,
+  effects, polls, lazy boot, virtual-list windowing, overlay focus trap.
+- `edge:css` build-time Tailwind compilation and `edge:watch` live updates.
+- Browser drivers standing in for device APIs, with per-action loading and
+  dirty tracking.
+- Time-travel replay viewer for recorded tree sessions.

CONTRIBUTING.md

@@ -0,0 +1,71 @@
+# Contributing to nativephp/web-ui
+
+Thanks for helping out. This package is in **alpha**: the wire format, the
+`WebRunner` contract surface, and the renderer registry are all still moving.
+Small, focused pull requests land fastest.
+
+## Before you start
+
+- Read `docs/how-web-rendering-works.md` first. It explains the tree → HTML
+  pipeline and where each layer's responsibility ends.
+- Behaviour a component author writes against belongs in core
+  (`nativephp/mobile`); this package contributes only transport and HTML. If a
+  change needs both, open the core PR first and link it.
+- Open an issue before starting anything that touches `src/Protocol/` (the
+  snapshot and endpoint scheme) so we can agree on the wire-level change.
+
+## Local setup
+
+This package cannot be developed in isolation: it requires `nativephp/mobile`
+and its tests run inside the core suite.
+
+1. Clone `nativephp/mobile` and this repo as **siblings**, so this repo sits at
+   `../plugins/nativephp/web` relative to core. Core's dev autoload maps
+   `Native\Mobile\Edge\Web\` to that path.
+2. To try changes in a real app, add this repo to the app's `composer.json` as
+   a `path` repository and require `nativephp/web-ui:@dev` **from the app**.
+
+Do **not** run `composer install` or `composer update` inside this repo. It
+creates a nested `vendor/nativephp/mobile` that breaks the iOS build of any
+app consuming this checkout. If you need Pint locally, install it globally:
+
+```
+composer global require laravel/pint
+```
+
+## Running tests
+
+Tests for this package live in the core repo under `tests/Feature/Edge/` and
+`tests/Unit/Edge/` (files prefixed `Web`). From the core checkout:
+
+```
+vendor/bin/pest --filter Web
+```
+
+Core's architecture tests also assert that `src/Renderer/` never imports
+`Protocol` or `Bridge`. Keep it that way; the renderer is meant to be reusable
+by a future desktop shell with its own transport.
+
+## Code style
+
+Laravel Pint, default preset. CI runs `pint --test` on every PR.
+
+```
+pint
+```
+
+## Pull requests
+
+- One concern per PR. A rename and a behaviour change are two PRs.
+- Add or update a test in the core suite for any behaviour change. Link the
+  core PR from this one.
+- Update `docs/` when you change how something works, not just what it does.
+- Add a line to `CHANGELOG.md`.
+- Mention the consuming app you verified against (browser and, if relevant,
+  device) in the PR description.
+
+## Reporting bugs
+
+Include the `nativephp/mobile` version, the browser, and a minimal Blade
+screen that reproduces the issue. For anything security-related, see
+`.github/SECURITY.md` and email instead of opening an issue.

LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) Bifrost Technology LLC <support@nativephp.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

README.md

@@ -1,8 +1,10 @@
-# nativephp/mobile-web
+# nativephp/web-ui
 
-**PRIVATE — do not publish.** The EDGE web render target: the same
-`Route::native()` screens an app ships to phones, rendered as HTML in a
-browser from the identical Blade source.
+> **Alpha.** APIs and wire format may change between releases.
+
+The EDGE web render target: the same `Route::native()` screens an app
+ships to phones, rendered as HTML in a browser from the identical Blade
+source.
 
 ## How it plugs in
 
@@ -33,9 +35,22 @@ package changes nothing about the native app.
 
 ## Installing in an app
 
-Path repository + `composer require nativephp/mobile-web:@dev` — run
-composer in the **consuming app**, never in this repo (see
-`~/Herd/plugins/CLAUDE.md`).
+```
+composer require nativephp/web-ui:dev-main
+```
+
+Requires `nativephp/mobile` ^4.4. The service provider is auto-discovered;
+nothing else to register.
+
+Contributors working from a local checkout: add it as a path repository
+and run composer in the **consuming app**, never in this repo.
+
+## Contributing
+
+See `CONTRIBUTING.md`. Tests live in the core repo's suite
+(`tests/Feature/Edge/WebUpdateTest.php` etc.) via a dev-only autoload of
+this package's `src/`.
+
+## License
 
-Tests live in the core repo's suite (`tests/Feature/Edge/WebUpdateTest.php`
-etc.) via a dev-only autoload of this package's `src/`.
+MIT. See `LICENSE`.

composer.json

@@ -1,8 +1,16 @@
 {
-    "name": "nativephp/mobile-web",
+    "name": "nativephp/web-ui",
     "description": "EDGE web render target for NativePHP — the same screens as HTML in a browser",
+    "keywords": [
+        "nativephp",
+        "laravel",
+        "edge",
+        "mobile",
+        "web",
+        "ssr"
+    ],
     "type": "library",
-    "license": "proprietary",
+    "license": "MIT",
     "authors": [
         {
             "name": "NativePHP",
@@ -11,7 +19,7 @@
     ],
     "require": {
         "php": "^8.2",
-        "nativephp/mobile": "^4.0"
+        "nativephp/mobile": "^4.4"
     },
     "autoload": {
         "psr-4": {
@@ -24,5 +32,18 @@
                 "Native\\Mobile\\Edge\\Web\\WebServiceProvider"
             ]
         }
-    }
+    },
+    "require-dev": {
+        "laravel/pint": "^1.24"
+    },
+    "scripts": {
+        "lint": "pint",
+        "lint:test": "pint --test"
+    },
+    "funding": [
+        {
+            "type": "other",
+            "url": "https://nativephp.com/sponsor"
+        }
+    ]
 }