docs: write Webview Bundle documentation (Guide / References / Config)

[seokju-na]

Summary

Restructures content/docs/ into three Fumadocs top-header tabs — Guide / References / Config — and writes 24 developer-facing English pages. All content was ground-truthed against the actual product source (webview-bundle, webview-bundle-android, webview-bundle-ios).

Structure

Tab	Pages
Guide	Introduction (Overview, Platform Support, Why Webview Bundle) · Features (bundle format, sources, protocol handling, remote bundles, platform integration) · Platforms (Electron, Tauri, Android, iOS, Deno Desktop) · CLI (commands, programmatic API) · Remote (building a remote, Local/AWS/Cloudflare providers)
References	Overview · Rust (docs.rs, external) · Node API · Deno API
Config	The wvb.config file · Remote / integrity / signature config

New coverage the previous draft lacked: the @wvb/bridge "for web developers" story, Deno Desktop, the three-role provider model (@wvb/remote-* / -provider / -provider-pulumi), Node & Deno API references, and rewritten Android/iOS guides using the real webview-bundle-android / -ios packages.

Wiring

• Tabs render in the top header via root: true folder meta.json + tabMode="top" in src/routes/docs/$.tsx.
• /docs 307-redirects to /docs/guide (src/routes/docs/index.tsx + splat loader).
• Home "Reference" nav link repointed from the removed /docs/cli to /docs/references.

Accuracy corrections

The previous draft (and in places the upstream rustdoc) were wrong on:

• Integrity is SHA-2 (sha256/sha384/sha512), not SHA-3
• Pack config field is outFile (no outFileName/--outdir)
• wvb upload --deploy defaults to false; version is the --version,-V flag, not a positional
• iOS 16 minimum; Android/iOS bindings are functional but pre-release (not on Maven Central / no SPM tag)
• Deno Desktop is experimental; Tauri ships as the wvb-tauri crate (no @wvb/tauri npm package)

Verification

• yarn build passes (client + server, all MDX compiles)
• yarn lint clean; all internal cross-links resolve; old flat pages removed
• Confirmed at runtime: 3 root tabs in the page tree, /docs → /docs/guide, all pages 200

Notes

The marketing home page (data.ts) still marks iOS/Android as "planned," which now contradicts the docs — left out of this PR; happy to update in a follow-up.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HhaZ2zL7bAqT3c8mRWTSs9

---

Summary by cubic

Rebuilt the docs into Guide / References / Config with a shared SiteHeader, per-endpoint Remote HTTP spec, @wvb/bridge reference, and a new Changelog; assets now load from static.wvb.dev. Also adds a small “Experimental” badge beside the Deno entries in the sidebar.

• Refactors

  • Docs IA: top tabs with /docs → /docs/guide; per-endpoint Remote HTTP Spec (+ Errors); add @wvb/bridge; split Node/Deno/Bridge references into category pages; Config split (remote/integrity/signature); Changelog added.
  • Layout/assets: shared header (tabs, search, language, GitHub, theme), notebook layout, full-screen mobile menu, left-drawer sidebar; serve media from static.wvb.dev (removed bundled assets).
  • Content polish: table rendering for .wvb layout; 2‑space code blocks; Deno Desktop marked Experimental; show a small “Experimental” badge next to Guide > Deno Desktop and References > Deno API in the sidebar.

• Bug Fixes

  • UI: hide redundant sidebar section dropdown ≥ md; fix collapsed Tabs blocks; adjust header fonts/mobile sizes; remove desktop sidebar top gap.
  • Accuracy/CI: SHA‑2 integrity; pack.outFile; wvb upload --deploy default false; version via --version; Deno page uses BundleProtocol; Node reference adds result types; config headers uses valid HeadersInit; redirect via to: '/docs/$'; build/lint/format pass.

^{Written for commit 61da95f. Summary will update on new commits.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	webview-bundle-website	61da95f	Commit Preview URL Branch Preview URL	Jun 30 2026, 06:16 PM

[cubic-dev-ai]

11 issues found across 45 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="AGENTS.md">

<violation number="1" location="AGENTS.md:8">
P2: "추천해 주고."는 연결 어미 '-고'로 문장을 끝맺음할 수 없습니다. 쉼표로 바꾸거나 '주세요'로 수정해야 합니다.</violation>

<violation number="2" location="AGENTS.md:10">
P2: 문서 유형 목록의 '설명'과 실제 소제목 '깊은 이해를 위한 문서'가 일치하지 않습니다. 같은 개념이라면 용어를 통일해야 독자가 혼동하지 않습니다.</violation>

<violation number="3" location="AGENTS.md:57">
P2: "참조 문서 작성 프롬프트를 작성할 때"는 다른 세 소제목('학습을 위한 문서를', '깊은 이해를 위한 문서를', '문제 해결 문서를')과 패턴이 다릅니다. '프롬프트를'을 제거하면 일관성이 생깁니다.</violation>
</file>

<file name="src/routes/docs/$.tsx">

<violation number="1" location="src/routes/docs/$.tsx:17">
P3: `redirect({ href: ... })` used for internal route; should use `to` per TanStack Router API. `href` is reserved for external/absolute URLs (e.g. https://...). Using `to` enables type-safe route resolution.</violation>
</file>

<file name="content/docs/guide/platforms/android.mdx">

<violation number="1" location="content/docs/guide/platforms/android.mdx:235">
P2: `update.version` won't compile because `update` is still nullable after `update?.isAvailable == true` guard. Kotlin does not smart-cast through this pattern.</violation>
</file>

<file name="content/docs/guide/providers/local.mdx">

<violation number="1" location="content/docs/guide/providers/local.mdx:125">
P3: `--silent` default is `false` per CLI ref; the local provider doc omits it (shows `—`)</violation>
</file>

<file name="content/docs/references/node.mdx">

<violation number="1" location="content/docs/references/node.mdx:85">
P2: Missing type definitions for 5 referenced types (BuildOptions, ListBundleItem, BundleSourceVersion, BundleManifestMetadata, BundleUpdateInfo). A reference page should define or link to the shape of every type it uses in public method signatures.</violation>
</file>

<file name="INDEX.md">

<violation number="1" location="INDEX.md:49">
P2: Config is a top-level tab alongside Guide and References, not a subsection of References. Use `# Config` (H1) to match the three-tab layout.</violation>
</file>

<file name="content/docs/config/index.mdx">

<violation number="1" location="content/docs/config/index.mdx:164">
P3: Invalid `HeadersInit` in array-style `headers` example: `['cache-control', 'max-age=0']` should be `[['cache-control', 'max-age=0']]`.</violation>
</file>

<file name="content/docs/guide/platforms/electron.mdx">

<violation number="1" location="content/docs/guide/platforms/electron.mdx:76">
P1: Bundle name mismatch: `loadURL('app://simple.wvb')` references bundle `simple`, but the pack command and all API calls use bundle `app`. Following this example as-written produces a blank window at runtime — the protocol handler finds no bundle named `simple` in the source.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

3 issues found across 19 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="content/docs/guide/why-webview-bundle.mdx">

<violation number="1" location="content/docs/guide/why-webview-bundle.mdx:143">
P2: `from '@wvb/bridge'` does not export `platform` — the bridge exposes only `invoke()`, `source`, `remote`, and `updater`. This code block would fail to compile.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: from '@wvb/bridge' does not export platform — the bridge exposes only invoke(), source, remote, and updater. This code block would fail to compile.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At content/docs/guide/why-webview-bundle.mdx, line 143:

<comment>`from '@wvb/bridge'` does not export `platform` — the bridge exposes only `invoke()`, `source`, `remote`, and `updater`. This code block would fail to compile.</comment>

<file context>
@@ -131,30 +137,25 @@ if (update.isAvailable) {
+The bridge resolves the platform at call time, so you never branch on it yourself:
+
+```ts title="Platform is detected for you"
+import { platform } from '@wvb/bridge';
+
+platform.type; // 'electron' | 'tauri' | 'android' | 'ios'
</file context>

[cubic-dev-ai]

3 issues found across 8 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/layouts/docs/LanguageDropdown.tsx">

<violation number="1" location="src/layouts/docs/LanguageDropdown.tsx:49">
P2: Custom dropdown lacks keyboard dismissal (Escape key) and focus/blur handling, leaving the popup and overlay mounted when keyboard users tab away.</violation>

<violation number="2" location="src/layouts/docs/LanguageDropdown.tsx:82">
P2: `language.available` is conflated with the active/selected language. Every available option shows "Active", and clicking an enabled option only closes the menu with no locale-switching or routing action. When additional languages become available, multiple items will incorrectly display "Active" at once.</violation>
</file>

<file name="content/docs/meta.json">

<violation number="1" location="content/docs/meta.json:2">
P2: Top-level docs metadata adds a fourth `changelog` entry, contradicting the PR's stated three-tab (Guide, References, Config) structure.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: language.available is conflated with the active/selected language. Every available option shows "Active", and clicking an enabled option only closes the menu with no locale-switching or routing action. When additional languages become available, multiple items will incorrectly display "Active" at once.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/layouts/docs/LanguageDropdown.tsx, line 82:

<comment>`language.available` is conflated with the active/selected language. Every available option shows "Active", and clicking an enabled option only closes the menu with no locale-switching or routing action. When additional languages become available, multiple items will incorrectly display "Active" at once.</comment>

<file context>
@@ -0,0 +1,95 @@
+                  )}
+                >
+                  <span>{language.label}</span>
+                  {language.available ? (
+                    <span className="text-brand">Active</span>
+                  ) : (
</file context>

[cubic-dev-ai]

P2: Custom dropdown lacks keyboard dismissal (Escape key) and focus/blur handling, leaving the popup and overlay mounted when keyboard users tab away.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/layouts/docs/LanguageDropdown.tsx, line 49:

<comment>Custom dropdown lacks keyboard dismissal (Escape key) and focus/blur handling, leaving the popup and overlay mounted when keyboard users tab away.</comment>

<file context>
@@ -0,0 +1,95 @@
+}
+
+export function LanguageDropdown() {
+  const [open, setOpen] = useState(false);
+
+  return (
</file context>

[cubic-dev-ai]

P2: Top-level docs metadata adds a fourth changelog entry, contradicting the PR's stated three-tab (Guide, References, Config) structure.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At content/docs/meta.json, line 2:

<comment>Top-level docs metadata adds a fourth `changelog` entry, contradicting the PR's stated three-tab (Guide, References, Config) structure.</comment>

<file context>
@@ -1,3 +1,3 @@
 {
-  "pages": ["guide", "references", "config"]
+  "pages": ["guide", "references", "config", "changelog"]
 }
</file context>

Suggested change

	"pages": ["guide", "references", "config", "changelog"]
	"pages": ["guide", "references", "config"]

[cubic-dev-ai]

1 issue found across 7 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/layouts/SiteHeader.tsx">

<violation number="1" location="src/layouts/SiteHeader.tsx:53">
P2: Active navigation state is only exposed via `data-active` for styling and lacks `aria-current`, making it inaccessible to assistive technologies. Additionally, the prefix-based matching `pathname.startsWith(link.href)` is fragile: it excludes non-docs landing-page links from ever showing active state, and can mark multiple or wrong tabs active when paths share prefixes.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Active navigation state is only exposed via data-active for styling and lacks aria-current, making it inaccessible to assistive technologies. Additionally, the prefix-based matching pathname.startsWith(link.href) is fragile: it excludes non-docs landing-page links from ever showing active state, and can mark multiple or wrong tabs active when paths share prefixes.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/layouts/SiteHeader.tsx, line 53:

<comment>Active navigation state is only exposed via `data-active` for styling and lacks `aria-current`, making it inaccessible to assistive technologies. Additionally, the prefix-based matching `pathname.startsWith(link.href)` is fragile: it excludes non-docs landing-page links from ever showing active state, and can mark multiple or wrong tabs active when paths share prefixes.</comment>

<file context>
@@ -0,0 +1,80 @@
+            <a
+              key={link.href}
+              href={link.href}
+              data-active={link.href.startsWith('/docs') && pathname.startsWith(link.href)}
+              className="transition-colors hover:text-zinc-900 data-[active=true]:text-brand dark:hover:text-zinc-100 dark:data-[active=true]:text-brand"
+            >
</file context>

[cubic-dev-ai]

5 issues found across 19 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="content/docs/guide/cli.mdx">

<violation number="1" location="content/docs/guide/cli.mdx:101">
P3: Grammatical error in Card title: 'Programmatically Usage' should be 'Programmatic Usage'</violation>
</file>

<file name="content/docs/guide/platforms/electron/forge.mdx">

<violation number="1" location="content/docs/guide/platforms/electron/forge.mdx:57">
P2: The documentation contradicts itself regarding whether `extraResource: ['bundles']` is required when using `@wvb/electron-forge`. The text states the plugin 'handles the bundles,' but the adjacent example still includes `extraResource: ['bundles']` alongside the plugin. This conflicts with the builder equivalent (`builder.mdx`), which explicitly states the plugin removes the need for manual `extraResources`. Users may ship stale local bundles or be confused about the plugin's role.</violation>

<violation number="2" location="content/docs/guide/platforms/electron/forge.mdx:79">
P1: The `ignore` regex example is unsafe: Electron Packager matches against absolute paths, so this pattern matches everything (including the `node_modules` it tries to preserve) and is overly restrictive for real apps.</violation>
</file>

<file name="content/docs/guide/platforms/electron/builder.mdx">

<violation number="1" location="content/docs/guide/platforms/electron/builder.mdx:62">
P2: Custom `bundlesDir` documentation conflicts with the hard-coded runtime lookup path</violation>
</file>

<file name="content/docs/guide/commands/remote.mdx">

<violation number="1" location="content/docs/guide/commands/remote.mdx:18">
P2: The `wvb remote current` docs list `signature` as an included output field without noting it is optional. For unsigned remotes, the signature header/field is not required and may be absent, so the documentation should qualify this.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: The ignore regex example is unsafe: Electron Packager matches against absolute paths, so this pattern matches everything (including the node_modules it tries to preserve) and is overly restrictive for real apps.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At content/docs/guide/platforms/electron/forge.mdx, line 79:

<comment>The `ignore` regex example is unsafe: Electron Packager matches against absolute paths, so this pattern matches everything (including the `node_modules` it tries to preserve) and is overly restrictive for real apps.</comment>

<file context>
@@ -0,0 +1,113 @@
+    asar: true,
+    extraResource: ['bundles'],
+    // Keep node_modules so the native @wvb/node addon is bundled.
+    ignore: [/^\/(?!node_modules|\.vite|package\.json)/],
+  },
+};
</file context>

[cubic-dev-ai]

P2: The documentation contradicts itself regarding whether extraResource: ['bundles'] is required when using @wvb/electron-forge. The text states the plugin 'handles the bundles,' but the adjacent example still includes extraResource: ['bundles'] alongside the plugin. This conflicts with the builder equivalent (builder.mdx), which explicitly states the plugin removes the need for manual extraResources. Users may ship stale local bundles or be confused about the plugin's role.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At content/docs/guide/platforms/electron/forge.mdx, line 57:

<comment>The documentation contradicts itself regarding whether `extraResource: ['bundles']` is required when using `@wvb/electron-forge`. The text states the plugin 'handles the bundles,' but the adjacent example still includes `extraResource: ['bundles']` alongside the plugin. This conflicts with the builder equivalent (`builder.mdx`), which explicitly states the plugin removes the need for manual `extraResources`. Users may ship stale local bundles or be confused about the plugin's role.</comment>

<file context>
@@ -0,0 +1,113 @@
+const config: ForgeConfig = {
+  packagerConfig: {
+    asar: true,
+    extraResource: ['bundles'], // ship the builtin bundles
+  },
+  plugins: [
</file context>

[cubic-dev-ai]

P2: Custom bundlesDir documentation conflicts with the hard-coded runtime lookup path

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At content/docs/guide/platforms/electron/builder.mdx, line 62:

<comment>Custom `bundlesDir` documentation conflicts with the hard-coded runtime lookup path</comment>

<file context>
@@ -0,0 +1,116 @@
+| ------------------------- | ------------------- | ----------- | --------------------------------------------------------------------------------- |
+| `root`                    | `string`            | (resolved)  | project root used to discover config and bundles                                  |
+| `builtin`                 | `BuiltinConfig`     | from config | inline builtin config, overriding the config file                                 |
+| `bundlesDir`              | `string`            | `'bundles'` | destination directory name under the packaged `Resources`                         |
+| `configFile`              | `string \| boolean` | `true`      | `true` auto-discovers and merges; a path loads explicitly; `false` is inline only |
+| `channel`                 | `string`            | —           | release channel to install bundles from (e.g. `"beta"`)                           |
</file context>

[cubic-dev-ai]

P2: The wvb remote current docs list signature as an included output field without noting it is optional. For unsigned remotes, the signature header/field is not required and may be absent, so the documentation should qualify this.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At content/docs/guide/commands/remote.mdx, line 18:

<comment>The `wvb remote current` docs list `signature` as an included output field without noting it is optional. For unsigned remotes, the signature header/field is not required and may be absent, so the documentation should qualify this.</comment>

<file context>
@@ -0,0 +1,100 @@
+
+## wvb remote current [BUNDLE]
+
+Show the current deployed version and its metadata for a bundle, without downloading the bundle itself. The output includes the version, ETag, integrity, signature, and last-modified values reported by the remote.
+
+```sh
</file context>

Suggested change

	Show the current deployed version and its metadata for a bundle, without downloading the bundle itself. The output includes the version, ETag, integrity, signature, and last-modified values reported by the remote.
	Show the current deployed version and its metadata for a bundle, without downloading the bundle itself. The output includes the version, ETag, integrity, and last-modified values reported by the remote, plus the signature when one is configured.

[cubic-dev-ai]

P3: Grammatical error in Card title: 'Programmatically Usage' should be 'Programmatic Usage'

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At content/docs/guide/cli.mdx, line 101:

<comment>Grammatical error in Card title: 'Programmatically Usage' should be 'Programmatic Usage'</comment>

<file context>
@@ -31,237 +31,74 @@ Three flags apply to every command. They control output formatting and logging o
   />
   <Card
-    title="Programmatic API"
+    title="Programmatically Usage"
     href="/docs/guide/cli-programmatic"
     description="Call pack, serve, upload, and more from JavaScript via @wvb/cli/api."
</file context>

Suggested change

	title="Programmatically Usage"
	title="Programmatic Usage"

[cubic-dev-ai]

2 issues found across 27 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="content/docs/references/node/source.mdx">

<violation number="1" location="content/docs/references/node/source.mdx:38">
P2: Reference page method signatures omit parameter types, making the API reference incomplete.</violation>
</file>

<file name="content/docs/references/node/bundle.mdx">

<violation number="1" location="content/docs/references/node/bundle.mdx:55">
P2: `IndexEntry.offset`, `len`, and `contentLength` may be incorrectly documented as `number` instead of `bigint`. The bundle format spec defines these fields as `u64`, and `Header.indexEndOffset()` (also a byte offset) is documented as returning `bigint`. If the Node binding exposes 64-bit values as `bigint`, this reference is inaccurate and could mislead users.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Reference page method signatures omit parameter types, making the API reference incomplete.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At content/docs/references/node/source.mdx, line 38:

<comment>Reference page method signatures omit parameter types, making the API reference incomplete.</comment>

<file context>
@@ -0,0 +1,92 @@
+| Method                     | Signature                                                        |
+| -------------------------- | ---------------------------------------------------------------- |
+| `listBundles`              | `(): Promise<ListBundleItem[]>`                                  |
+| `loadVersion`              | `(bundleName): Promise<BundleSourceVersion \| null>`             |
+| `updateRemoteVersion`      | `(bundleName, version): Promise<void>`                           |
+| `resolveFilepath`          | `(bundleName): Promise<string>`                                  |
</file context>

[cubic-dev-ai]

P2: IndexEntry.offset, len, and contentLength may be incorrectly documented as number instead of bigint. The bundle format spec defines these fields as u64, and Header.indexEndOffset() (also a byte offset) is documented as returning bigint. If the Node binding exposes 64-bit values as bigint, this reference is inaccurate and could mislead users.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At content/docs/references/node/bundle.mdx, line 55:

<comment>`IndexEntry.offset`, `len`, and `contentLength` may be incorrectly documented as `number` instead of `bigint`. The bundle format spec defines these fields as `u64`, and `Header.indexEndOffset()` (also a byte offset) is documented as returning `bigint`. If the Node binding exposes 64-bit values as `bigint`, this reference is inaccurate and could mislead users.</comment>

<file context>
@@ -0,0 +1,84 @@
+
+```ts
+type IndexEntry = {
+  offset: number;
+  len: number; // compressed length
+  isEmpty: boolean;
</file context>

[cubic-dev-ai]

12 issues found across 35 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="content/docs/guide/platforms/android.mdx">

<violation number="1" location="content/docs/guide/platforms/android.mdx:22">
P1: Android guide removed the pre-release warning and all build-from-source instructions while the package remains unpublished on Maven Central, leaving users with an unresolvable dependency snippet and no fallback path.</violation>
</file>

<file name="content/docs/guide/platform-support.mdx">

<violation number="1" location="content/docs/guide/platform-support.mdx:17">
P1: Mobile platform support is over-promoted as stable and omits important pre-release/publication/device-support caveats.</violation>
</file>

<file name="content/docs/guide/providers/cloudflare.mdx">

<violation number="1" location="content/docs/guide/providers/cloudflare.mdx:16">
P2: Docs incorrectly tell users to pin npm package versions in `wvb.config`, which has no field or mechanism for managing npm package versions. The install command also omits an explicit version, so the guidance does not actually show how to pin the packages.</violation>
</file>

<file name="content/docs/guide/platform-integration.mdx">

<violation number="1" location="content/docs/guide/platform-integration.mdx:164">
P1: The platform-integration overview page removed pre-release warnings for Android/iOS bindings and now presents a stable-looking installation path (including a Package.swift binaryTarget URL) while the PR description explicitly states these bindings are still pre-release, not on Maven Central, and without an SPM tag. The platform-support matrix also incorrectly labels Android/iOS as "Stable".</violation>
</file>

<file name="content/docs/references/bridge/testing.mdx">

<violation number="1" location="content/docs/references/bridge/testing.mdx:74">
P2: The `clearInvokeMocks` guidance incorrectly uses "global teardown hook" terminology. A global teardown runs once after the full suite; placing cleanup there would let mocks leak between tests. It should reference a per-test teardown hook such as `afterEach` instead.</violation>
</file>

<file name="content/docs/references/deno/updater.mdx">

<violation number="1" location="content/docs/references/deno/updater.mdx:77">
P2: `getUpdate` return type is documented as `BundleUpdateInfo` instead of `Promise<BundleUpdateInfo>`, contradicting the `await` usage example and the parallel Node docs.</violation>
</file>

<file name="content/docs/references/deno/index.mdx">

<violation number="1" location="content/docs/references/deno/index.mdx:48">
P1: Deno FFI loading examples omit required runtime permissions. Deno requires `--allow-ffi` for any FFI call, and the shown examples also likely need `--allow-read` (for `loadLib`), `--allow-net` (for `loadLibViaPlug`), and `--allow-env` (for `WVB_DENO_LIB`). Users following the reference will hit permission errors.</violation>
</file>

<file name="content/docs/references/deno/source.mdx">

<violation number="1" location="content/docs/references/deno/source.mdx:62">
P1: The `using protocol` binding at module scope will dispose the native FFI handle before `Deno.serve` handles any requests, because top-level `using` in a module is disposed when the module body finishes executing. Additionally, `source` is created but never disposed despite the page stating that FFI classes own native handles and must be cleaned up.</violation>
</file>

<file name="content/docs/guide/index.mdx">

<violation number="1" location="content/docs/guide/index.mdx:180">
P2: `@wvb/electron-builder` and `@wvb/electron-forge` are marked `Stable` in the `Version` column, but `content/docs/guide/platform-integration.mdx` still explicitly states these packages are 'not published to npm yet.' This contradicts the previous accurate `unpublished` labels and misleads users about availability. Additionally, `Stable` is not a version number, which breaks the semver pattern used by every other row in the table.</violation>
</file>

<file name="content/docs/references/deno/protocol.mdx">

<violation number="1" location="content/docs/references/deno/protocol.mdx:40">
P1: Top-level `using` disposes the native handle before the `Deno.serve` callback runs, because `using` cleans up when the module scope exits while the server continues asynchronously. This example will cause requests to fail or crash when `protocol.handle(...)` is called on a freed handle.</violation>

<violation number="2" location="content/docs/references/deno/protocol.mdx:43">
P2: The example hardcodes `'get'` instead of passing the actual request method to `protocol.handle(...)`, which would mislead developers copying the code into treating all HTTP methods as GET.</violation>
</file>

<file name="content/docs/references/bridge/errors.mdx">

<violation number="1" location="content/docs/references/bridge/errors.mdx:37">
P2: The error-handling example is not copy-paste valid: top-level `return` is invalid syntax in a module context, and `BridgeError` is imported but never used.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Android guide removed the pre-release warning and all build-from-source instructions while the package remains unpublished on Maven Central, leaving users with an unresolvable dependency snippet and no fallback path.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At content/docs/guide/platforms/android.mdx, line 22:

<comment>Android guide removed the pre-release warning and all build-from-source instructions while the package remains unpublished on Maven Central, leaving users with an unresolvable dependency snippet and no fallback path.</comment>

<file context>
@@ -28,35 +19,16 @@ The bridge attaches through `WebViewCompat.addWebMessageListener`. On a device w
 Runtime dependencies are pulled in transitively: JNA (`net.java.dev.jna:jna`, loads the native `libwvb_ffi.so`), `kotlinx-coroutines-core`, and `androidx.webkit`. Consumer R8/ProGuard rules ship with the library, so you do not add keep rules for the FFI yourself.
 
-Once a release is cut, the intended coordinates are:
+Add the dependency:
 
 ```kotlin title="build.gradle.kts"
</file context>

[cubic-dev-ai]

P1: Mobile platform support is over-promoted as stable and omits important pre-release/publication/device-support caveats.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At content/docs/guide/platform-support.mdx, line 17:

<comment>Mobile platform support is over-promoted as stable and omits important pre-release/publication/device-support caveats.</comment>

<file context>
@@ -1,24 +1,22 @@
+| [Electron](/docs/guide/platforms/electron)   | Chromium       | `@wvb/electron` 0.1.0 (npm)       | `electron >= 15`                                                                | Stable       |
+| [Tauri desktop](/docs/guide/platforms/tauri) | System WebView | `wvb-tauri` 0.1.0 (crate)         | Tauri v2                                                                        | Stable       |
+| Tauri mobile                                 | System WebView | `wvb-tauri` 0.1.0 (crate)         | See [Android](/docs/guide/platforms/android) / [iOS](/docs/guide/platforms/ios) | Stable       |
+| [Android](/docs/guide/platforms/android)     | System WebView | `webview-bundle-android` (Kotlin) | minSdk 24 / Android 7.0                                                         | Stable       |
+| [iOS](/docs/guide/platforms/ios)             | WKWebView      | `webview-bundle-ios` (Swift)      | iOS 16 / macOS 12                                                               | Stable       |
+| [Deno Desktop](/docs/guide/platforms/deno)   | Deno webview   | `@wvb/deno-desktop` (JSR)         | —                                                                               | Experimental |
</file context>

[cubic-dev-ai]

P1: The platform-integration overview page removed pre-release warnings for Android/iOS bindings and now presents a stable-looking installation path (including a Package.swift binaryTarget URL) while the PR description explicitly states these bindings are still pre-release, not on Maven Central, and without an SPM tag. The platform-support matrix also incorrectly labels Android/iOS as "Stable".

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At content/docs/guide/platform-integration.mdx, line 164:

<comment>The platform-integration overview page removed pre-release warnings for Android/iOS bindings and now presents a stable-looking installation path (including a Package.swift binaryTarget URL) while the PR description explicitly states these bindings are still pre-release, not on Maven Central, and without an SPM tag. The platform-support matrix also incorrectly labels Android/iOS as "Stable".</comment>

<file context>
@@ -149,32 +149,24 @@ val bundle = source.fetchBundle("app")
-    name: "WebViewBundleFFI",
-    url: "https://github.com/webview-bundle/webview-bundle/releases/download/ffi/0.1.0/WebViewBundleFFI.xcframework.zip",
-    checksum: "<sha256>"
+  name: "WebViewBundleFFI",
+  url: "https://github.com/webview-bundle/webview-bundle/releases/download/ffi/0.1.0/WebViewBundleFFI.xcframework.zip",
+  checksum: "<sha256>"
</file context>

[cubic-dev-ai]

P1: Deno FFI loading examples omit required runtime permissions. Deno requires --allow-ffi for any FFI call, and the shown examples also likely need --allow-read (for loadLib), --allow-net (for loadLibViaPlug), and --allow-env (for WVB_DENO_LIB). Users following the reference will hit permission errors.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At content/docs/references/deno/index.mdx, line 48:

<comment>Deno FFI loading examples omit required runtime permissions. Deno requires `--allow-ffi` for any FFI call, and the shown examples also likely need `--allow-read` (for `loadLib`), `--allow-net` (for `loadLibViaPlug`), and `--allow-env` (for `WVB_DENO_LIB`). Users following the reference will hit permission errors.</comment>

<file context>
@@ -0,0 +1,139 @@
+The Deno binding talks to a Rust cdylib over Deno FFI. Load it before constructing any class. You have
+two options.
+
+Use `loadLib(libPath)` when you already have the cdylib on disk and want to point at it directly:
+
+```ts title="main.ts"
</file context>

[cubic-dev-ai]

P1: The using protocol binding at module scope will dispose the native FFI handle before Deno.serve handles any requests, because top-level using in a module is disposed when the module body finishes executing. Additionally, source is created but never disposed despite the page stating that FFI classes own native handles and must be cleaned up.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At content/docs/references/deno/source.mdx, line 62:

<comment>The `using protocol` binding at module scope will dispose the native FFI handle before `Deno.serve` handles any requests, because top-level `using` in a module is disposed when the module body finishes executing. Additionally, `source` is created but never disposed despite the page stating that FFI classes own native handles and must be cleaned up.</comment>

<file context>
@@ -0,0 +1,87 @@
+  remoteDir: './bundles/remote',
+});
+
+using protocol = new BundleProtocol(lib, source);
+
+Deno.serve(async req => {
</file context>

[cubic-dev-ai]

P2: The clearInvokeMocks guidance incorrectly uses "global teardown hook" terminology. A global teardown runs once after the full suite; placing cleanup there would let mocks leak between tests. It should reference a per-test teardown hook such as afterEach instead.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At content/docs/references/bridge/testing.mdx, line 74:

<comment>The `clearInvokeMocks` guidance incorrectly uses "global teardown hook" terminology. A global teardown runs once after the full suite; placing cleanup there would let mocks leak between tests. It should reference a per-test teardown hook such as `afterEach` instead.</comment>

<file context>
@@ -0,0 +1,147 @@
+
+### clearInvokeMocks
+
+`clearInvokeMocks()` removes every registered command mock at once. Call it in a global teardown hook so no mock leaks into the next test.
+
+## Unit test example
</file context>

Suggested change

	`clearInvokeMocks()` removes every registered command mock at once. Call it in a global teardown hook so no mock leaks into the next test.
	`clearInvokeMocks()` removes every registered command mock at once. Call it in an `afterEach` hook (or equivalent per-test teardown) so no mock leaks into the next test.

[cubic-dev-ai]

P2: getUpdate return type is documented as BundleUpdateInfo instead of Promise<BundleUpdateInfo>, contradicting the await usage example and the parallel Node docs.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At content/docs/references/deno/updater.mdx, line 77:

<comment>`getUpdate` return type is documented as `BundleUpdateInfo` instead of `Promise<BundleUpdateInfo>`, contradicting the `await` usage example and the parallel Node docs.</comment>

<file context>
@@ -0,0 +1,111 @@
+
+| Method                         | Returns            | Description                                                             |
+| ------------------------------ | ------------------ | ----------------------------------------------------------------------- |
+| `getUpdate(bundleName)`        | `BundleUpdateInfo` | Check the remote for a newer version. Read `isAvailable` and `version`. |
+| `download(bundleName)`         | `Promise<void>`    | Fetch the current bundle from the remote into the local store.          |
+| `install(bundleName, version)` | `Promise<void>`    | Install a downloaded version so it is served on the next launch.        |
</file context>

Suggested change

	| `getUpdate(bundleName)` | `BundleUpdateInfo` | Check the remote for a newer version. Read `isAvailable` and `version`. |
	| `getUpdate(bundleName)` | `Promise<BundleUpdateInfo>` | Check the remote for a newer version. Read `isAvailable` and `version`. |

[cubic-dev-ai]

P2: @wvb/electron-builder and @wvb/electron-forge are marked Stable in the Version column, but content/docs/guide/platform-integration.mdx still explicitly states these packages are 'not published to npm yet.' This contradicts the previous accurate unpublished labels and misleads users about availability. Additionally, Stable is not a version number, which breaks the semver pattern used by every other row in the table.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At content/docs/guide/index.mdx, line 180:

<comment>`@wvb/electron-builder` and `@wvb/electron-forge` are marked `Stable` in the `Version` column, but `content/docs/guide/platform-integration.mdx` still explicitly states these packages are 'not published to npm yet.' This contradicts the previous accurate `unpublished` labels and misleads users about availability. Additionally, `Stable` is not a version number, which breaks the semver pattern used by every other row in the table.</comment>

<file context>
@@ -169,20 +169,20 @@ See [Remote, integrity & signature config](/docs/config/remote) for the full sch
+| `@wvb/node`                  | 0.1.0   | N-API bindings to the core for Node.js                                                         |
+| `@wvb/bridge`                | 0.1.0   | Bridge for the web app to talk to the native host                                              |
+| `@wvb/electron`              | 0.1.0   | Electron integration (protocols, IPC, updater)                                                 |
+| `@wvb/electron-builder`      | Stable  | electron-builder integration                                                                   |
+| `@wvb/electron-forge`        | Stable  | Electron Forge plugin                                                                          |
+| `wvb-tauri`                  | 0.1.0   | Tauri integration, published as a Rust crate on crates.io                                      |
</file context>

[cubic-dev-ai]

P2: The example hardcodes 'get' instead of passing the actual request method to protocol.handle(...), which would mislead developers copying the code into treating all HTTP methods as GET.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At content/docs/references/deno/protocol.mdx, line 43:

<comment>The example hardcodes `'get'` instead of passing the actual request method to `protocol.handle(...)`, which would mislead developers copying the code into treating all HTTP methods as GET.</comment>

<file context>
@@ -0,0 +1,74 @@
+using protocol = new BundleProtocol(lib, source);
+
+Deno.serve(async req => {
+  const res = await protocol.handle('get', req.url, Object.fromEntries(req.headers));
+  return toResponse(res);
+});
</file context>

[cubic-dev-ai]

P2: The error-handling example is not copy-paste valid: top-level return is invalid syntax in a module context, and BridgeError is imported but never used.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At content/docs/references/bridge/errors.mdx, line 37:

<comment>The error-handling example is not copy-paste valid: top-level `return` is invalid syntax in a module context, and `BridgeError` is imported but never used.</comment>

<file context>
@@ -0,0 +1,61 @@
+} catch (err) {
+  if (isBridgeError(err) && err.code === BridgeErrorCode.UpdaterNotInitialized) {
+    // The native host has no updater configured.
+    return;
+  }
+  throw err;
</file context>