Nija 0.5.0

Unsigned builds: see docs/release.md for Gatekeeper / SmartScreen steps.
Verify downloads with SHA256SUMS.txt, and their origin with
gh attestation verify <file> --repo appfide/nija.
An SPDX bill of materials ships with the release.

What changed in 0.5.0

Added

• Delete history (Settings → Data): Delete history on this device removes every local clip, pinned ones too, and leaves the database alone; clips already there are not downloaded again. Delete history in the database removes every clip and deletion record from the connected database for all devices. Devices, pairing and keys stay, so sync carries on. In a signed group only the admin, or a member it gave the permission, can do this.
• Pause a device (Settings → Devices → Manage devices, admin only): a paused device stays paired and keeps its credentials but sends and receives nothing. Clips copied elsewhere while it is paused never reach it, and what it copies meanwhile stays on it. Resume brings it back. Unlike Block, it does not have to be paired again. Devices on 0.4.2 or older do not know this status and keep syncing.
• Permissions and more admins (Manage devices, admin of a signed group): Permissions… lets a member delete the database history without becoming an admin; Make admin… hands a paired device the group admin key, sealed to it, so it can manage the group too. Both are signed with the membership, so a member cannot grant them to itself. Supabase and PocketBase need two new device columns for this (upgrade notes); without them the app refuses the grant and leaves the device unchanged.
• Leave this group and Start a new group on this database (Settings → Devices). Leaving removes this device from the group and forgets its credentials and keys; starting a new group wipes the database's clips and devices and makes this device the admin of a fresh group with new keys. The second is also the way back when the admin device is lost.
• Sync with the database switch (Settings → Sync): turns database sync off on this device only. Clipboard history keeps being recorded locally; nothing copied while it is off is sent, and clips from other devices arrive once it is back on.

Changed

• Universal Clipboard no longer relabels clips. A copy that reached a Mac or iPhone through Apple's Universal Clipboard was recorded again on that device under its own name, and the original from the device that made it was then dropped as an echo, so every device showed the clip as its own. While syncing, Nija now leaves such copies to the device they came from (Settings → Capture → Leave Universal Clipboard to its device, on by default).
• A clip can only be deleted from the group by the device that copied it. On every other device the menu now says Delete on this device and only removes the local copy. Before, deleting another device's clip pushed a deletion signed with the wrong key: the database copy was emptied, but signed groups rejected the deletion, so other devices kept the clip and the device that copied it never saw the change. The sync engine now refuses to push such a deletion.
• Dropping and recreating the database tables no longer disconnects every device. A device whose row is missing now disconnects only if a device it already knew is still listed; otherwise the database was reset, and it registers again (the admin also signs its own row again), whichever device gets back first. Before, each device concluded it had been removed and deleted its credentials and passphrase.
• Supabase with missing tables or columns now reports Connected plus a schema check listing what is missing, and two ways to fix it. Set up automatically asks once for a Supabase personal access token and runs the setup through the Supabase Management API; the token is sent only to Supabase, for that one request, is never stored, and clipboard capture is paused while the dialog is open so copying it is not recorded. Copy setup SQL gives the same script to run by hand: generated for your table names and sign-in mode, it creates the tables or adds the missing columns, turns on row level security and enables realtime, and is safe to run again. Before, the app said Connection failed: Could not find the table 'public.clip_items' in the schema cache. Sync shows the same advice and retries until the tables exist.
• A keychain that times out is no longer read as "no keys": this device's signing keys are never replaced because of a slow keychain prompt (peers would reject every clip signed with new ones), and a credential delete the keychain did not confirm is retried rather than coming back on the next launch. Secret fields of the database form are read together, so a pending prompt costs one wait instead of one per field.
• Supabase personal access tokens (sbp_…) are recognised as credentials: Skip keys and tokens skips them and logs redact them.
• The macOS app renders with Skia instead of Impeller: on Flutter 3.47 Impeller dropped or garbled single letters in labels.
• App Store and Mac App Store builds (STORE_BUILD=true, set by scripts/build_appstore.sh) leave out the installers for other platforms and, in the sandboxed Mac build, Start at login. The script now also regenerates the Flutter config before the macOS archive (it used to ship the version of whatever was built last) and puts the provisioning profile on the Release configuration.
• On iPad and other wide layouts the side rail keeps clear of the status bar; the database tiles no longer overflow on 430 pt wide phones.
• Store screenshots are generated from the app itself: test_screenshots/store_shots_test.dart renders the screens with demo data, tool/store_shots/compose.py frames them.
• CI and release builds use Flutter 3.47.5 (from 3.44.4).

What's Changed

• feat: 0.5.0, data controls, device permissions and store builds by @dhipin in #50

Full Changelog: v0.4.2...v0.5.0