16 Commits

Author	SHA1	Message	Date
jubnl	d7c4324afc	chore(capacitor): base files for capacitor (#2020) ... * chore(capacitor): base files for capacitor * chore(capacitor): base plugins * feat(auth): hand a browser sign-in over to the native app The native apps show the server's own UI in a WebView, where neither SSO nor passkeys can run. They sign in through the system browser instead and need a way to carry that session back. The app keeps a random verifier and sends only its sha256 into the browser. Once signed in there, the browser trades that challenge for a one-time code (cookie session only, so an API or MCP token cannot mint itself a browser session), and the WebView redeems the code together with the verifier. The code rides through a URL scheme any app could claim, so on its own it is worthless; it is single use and good for a minute. Also: /api/health/features reports nativeApp so the apps can refuse servers that predate this, and hashed files under assets/ are served immutable, which the iOS app needs to start offline without a service worker. * feat(native): the apps load the server's own UI The apps ship only an address screen now. Once a server is picked, the native side points the WebView at it: TrekBridgeViewController on iOS and a config copy with server.url on Android. The UI then comes from that server, in the version it runs and on its own origin, so the session cookie, uploads, /ws and plugins work exactly as in a browser and no app release has to keep pace with the servers out there. The address screen (native-shell/, built into native-dist/) probes /api/health/features through native HTTP, tries https before http when no scheme was typed, and refuses servers without the nativeApp flag. It also serves as the error page when the remembered server does not load: retry, change server, or on iOS the stored copy of the server's start page. TrekShell is the app's own plugin for all of that: remember, change and reload the server, sign in through ASWebAuthenticationSession or a Custom Tab, and on iOS keep and open the offline copy of the start page, because WKWebView runs no service worker for a domain the app does not list. Plugins the frame does not use are gone (push, camera, geolocation, calendar, file transfer, in-app browser and more): the WebView covers the camera and location itself, and push needs a relay before it is worth shipping. With them go the push entitlement, the calendar usage strings and the Firebase bits. The iOS scheme falls back to capacitor://, since Capacitor drops an iosScheme of https, and the arm64 capability replaces armv7. * feat(native): the UI knows when it runs inside the app Everything the server's UI does differently inside the iOS and Android app lives under src/native and is inert in a browser. Sign-in: SSO and the passkey button go through the system browser (signInThroughBrowser), because identity providers refuse embedded browsers and WebAuthn needs a domain association no build can have for every server. The browser end is the new /native-handoff page: it signs the user in if needed and hands the session over only after an explicit tap, so a link carrying somebody else's challenge cannot pass a session on silently. The verifier is hashed with @noble/hashes because crypto.subtle is missing on the plain-http servers many home networks use. An OIDC-only install no longer bounces to the IdP inside the WebView, and passkey management is hidden in the app. Downloads: the WebView cannot save a blob, so downloadBlob, downloadFile and openFile write to the app cache and open the share sheet. The eight places that built their own download anchor now use downloadBlob, which they should have anyway. The rest: "Change server" on the login page and in the account settings, the splash hides after the first frame, Android's back button walks history before it leaves the app, the status bar follows the scheme, and on iOS the start page is refreshed and every chunk of the build (listed in the new asset-manifest.json) is pulled into WebKit's cache so the app can start without network. * ci(native): build the Android and iOS shells on every change to them Compiles the Swift side on a macOS runner so nobody needs a Mac to know it still builds, and leaves a debug APK on every run to install on a phone. Unsigned: signing and store uploads need secrets fork PRs do not get. * feat(native): offline vector maps in the iOS app In a browser the service worker answers MapLibre from the gl-map-offline cache that glPrefetcher fills for trips marked for offline. The iOS app has no service worker, so nothing read that cache there and the map went blank without network. A trek-offline:// protocol takes the service worker's place. Inside the iOS app the MapLibre style URL is rewritten to it, the handler rewrites every https URL inside the style and its TileJSON the same way, and then serves documents network first and tiles, glyphs and sprites cache first. Outside the iOS app nothing changes. The default OpenFreeMap basemap is covered; Mapbox GL has no protocol hook and stays online-only in the app, as does a custom raster template, whose opaque responses only a service worker can store. * fix(native): keep the iOS offline copy inside the app loadSimulatedRequest went to the server URL without its trailing slash, and Capacitor keeps a navigation in the WebView only when it starts with the bridge's serverURL, slash included. The offline start page would have opened in Safari instead. Also covers the platform helpers and the hand-off API module. * feat(native): the small things that give a WebView away - A short haptic tap on success, warning and error toasts, which is where every save and delete already reports. Info toasts stay silent. - No "‹ › Done" strip above the iOS keyboard. - No Safari preview when a link is long-pressed. - The swipe from the left edge goes back on iOS, through the same history Android's back button walks. * test(mobile): the backup-code download revokes its URL after the shared delay The mobile twin of the AccountTab test still expected the object URL to be revoked in the same tick. Since both screens download through downloadBlob, the revoke happens after its 100 ms grace period. * fix(native): remember the login by default inside the app With the switch off the app got a session cookie, which dies with the app process, so every time the phone unloaded TREK the user had to sign in again. Found while running the Android build in the emulator. * fix(native): no overscroll stretch on Android The UI asks for no overscroll effect with overscroll-behavior: none on html, and Chrome honours it. The Android WebView draws the stretch on its root scroller natively, though, and it scales the whole view, so the top bar and the bottom dock were pulled along with the page. Found in the emulator. * fix(native): Android shows "server not reachable" instead of a blank page Capacitor injects its bridge on Android only into the server's origin once server.url is set, so the local error page it switches to when the server does not load had no bridge. It could neither retry nor change the server and stayed blank. TrekWebViewClient now catches a failed page load (a network error, or a 5xx from a proxy while TREK restarts) and the app starts over on the bundled address screen, where the bridge is present and the screen offers exactly those two choices. The server config no longer carries errorPath. Two traps on the way, both found in the emulator: a restart during launch has to be a fresh task, since recreate() leaves the system splash lying over the new page; and a restart shows no launch splash at all, because the splash plugin cannot take it down again when the page hides it early. * feat(native): TREK's own app icon and launch screen, named just TREK The shells still carried Capacitor's placeholder icon and splash, the blue X on a grid. They now show the white TREK mark on a dark, slightly glassy tile: a soft light from the top left and a sheen over the upper half, in the app's launch colour #09090b. Android 12+ draws its launch screen on the same colour instead of light grey. scripts/generate-app-icons.mjs renders the sources into assets/ from public/icons/icon-white.svg, and `npm run icons:app` turns them into every size both platforms ask for through @capacitor/assets. The Android foreground mark is sized for the adaptive icon's round mask. The home screen label is TREK: the old "TREK - Plan your trips!" was cut off under the icon, and the longer title belongs to the store listings. * fix(native): new lint warnings and the MapLibre protocol type after the dev merge Awaits that sat in loops in the native-auth tests run together, the hand-off hook marks its navigations as ignored, the native tests drop their non-null assertions, and the offline protocol answers with the data type MapLibre 6.15 expects. * fix(native): strict types in the address screen, Prettier on the native-auth e2e suite, file-local exports The address screen's element helper returns the plain element instead of Object.assign's intersection, which strict mode could not represent; the haptics test reads an optional argument as optional; three exports only their own file used are local now. * fix(native): Prettier on the native client files, rate-limit e2e requests in sequence Formats the files the client formatting gate listed, and NATIVE-E2E-005 sends its twenty exchange attempts one after another: all at once they reset the test server's connections. * fix(native): hide passkeys in the app through usePasskeys The flag in useAccountSettings grew the identical destructuring in both account views past the duplication threshold; the shared passkeys hook already decides when its card is hidden, so the app check lives there now. * feat(native): everything the App Store and Google Play submissions need - iOS: microphone usage text for "Take Video", no-export-compliance flag, ExportOptions.plist for App Store Connect uploads, the unused push forwarders gone; CI builds with Xcode 26 and lints the property lists. - Android: version and signing from Gradle properties (unsigned without them), R8 with keep rules for TREK's and Capacitor's reflective classes, no Auto Backup of the session cookie, no external file provider path, template and Firebase leftovers removed, keystores and service accounts ignored, full-size adaptive icon layers with a monochrome layer; CI also builds the release APK. - native-release.yml: signed bundle to a Play testing track and archive to TestFlight, by hand or on a v* tag, behind the store environment. - Version handshake: the server reports nativeApi 1, the app refuses a server below its minimum and tolerates an app older than the offline copy. - Address screen: privacy policy link, "Try the demo" and "What is a TREK server?"; the privacy link also in the app's server settings. Three new native strings in all 27 locales. - Donation links and the notices asking for one are hidden in the app. - Store listings for "TREK Travel Planner" in client/fastlane: texts, review notes with placeholders, privacy and account deletion page drafts, the feature graphic and icon, a length and image check in CI, and a Playwright store project with the scripts that turn its captures into screenshots. - Docs: wiki/Native-Apps.md, README no longer says there is no store app. * fix(native): read a notice button's href without a weak type An action button carries no href, so a parameter typed as only an optional href refused the notice DTO; the button type now names its kind as well. * feat(native): a welcoming onboarding for the address screen The app's own screen now opens on a welcome: the TREK mark, a line about what TREK is, and two clear paths — connect the TREK you already open in the browser, or get TREK Cloud. Both lead to polished screens: the address field with live validation, a shake and haptic on a bad address and a success tick before the server takes over; and a TREK Cloud intro with what it offers and a way in. Screens slide and stagger in, buttons give a tap, and it all respects the safe areas, light and dark, and reduced motion. Self-hosters are unaffected: cloud is its own path, never in the way. New native strings are added across all locales (English placeholders outside en/de, to translate). * feat(native): a plan picker for TREK Cloud, with live prices The Get TREK Cloud path now leads to a plan picker that reads the live plans from the site (/api/plans), so the prices and quotas always match the website. Monthly and yearly in a segmented toggle, the year marked with its saving, each plan a card with its price and what it includes. Subscribe is wired to finish on the web order for now; it becomes an Apple/Google in-app purchase once the store products exist. New strings across all locales (en and de translated). * feat(native): light status bar and a Go key on the address screen The address screen sits on the near-black surface, so set the status bar to draw its clock and icons in light while it is up; the server's own UI takes over the style once it loads. The address field's on-screen return key now reads Go. Both fail quietly where there is no native status bar (web, the simulator). * i18n(native): translate the onboarding into es, fr, it, nl and pl The welcome, TREK Cloud and plan-picker strings were English placeholders in every locale but en and de. The five largest remaining European languages are now translated in full; the others still carry the English text and are a follow-up for native speakers. * feat(native): the in-app TREK Cloud subscription flow After picking a plan, the app now carries the whole purchase itself when the build can take one: choose your address (checked for free as you type, against the same endpoint the website uses), your email, and subscribe. The receipt goes to /api/iap/redeem, and a Setting up your TREK screen waits on the new address and loads it the moment it answers. The purchase sits behind an IapClient seam (src/native/iap.ts): a fake drives the whole flow in development and preview, the native client reports itself unavailable until the store plugin and products exist, and until then the plan picker still finishes on the web, so nothing half-wired faces a customer. New claim and provisioning strings across all locales (en, de and the five largest European languages translated). * i18n(native): translate the app into the remaining 20 languages The onboarding, plan picker, claim and provisioning strings were English placeholders outside en, de and the five largest European languages. They are now translated in full across the other 20 locales (ar, az, br, ca, cs, et, gr, hu, id, ja, ko, ru, sk, sv, th, tr, uk, vi, zh, zh-TW), placeholders and brand kept. The app now speaks every language TREK does. * fix(i18n): add the Hebrew native strings, and correct the LoginPage size baseline The he locale had every domain but native.ts, which broke i18n parity, the shared coverage specs and the client parity test once the native strings existed. Add he/native.ts with all native keys translated. Also correct the LoginPage size baseline to its current line count. * i18n(native): excuse the TREK Cloud brand, mark Email same-as-en, exempt the quota counts The strict i18n checks, which the feature-branch CI does not run, catch three things now that the native strings exist in every locale: TREK Cloud read as an untranslated English phrase (it is a product name, like Vacay and Atlas, so add it to the brand list); Email left identical in Italian, Indonesian and Vietnamese, where it is the local word too (mark same-as-en) and in Greek (give it a Greek term); and the GB and AI-document quota strings carrying {n} without being plural groups (both are figures that never show a singular, like the other unit-symbol counts in NOT_PLURAL). * fix(native): typecheck, lint and knip on the native code; wire he's native bundle The full suite, which the feature-branch CI does not run, catches four things the native work still had: a non-narrowed union in the claim flow (tsc), a helper named useFake that the react-hooks rule read as a hook (eslint), two iap types exported but used only inside the file (knip), and the Hebrew native strings present as a file but never spread into he's merged bundle (the aggregated key parity test). All four fixed. * fix(native): a flat redeem result, so the claim flow typechecks The discriminated union did not narrow under the native-shell tsconfig, so the failure code read as absent on the whole type. Use a flat result with optional instanceUrl and code instead: both are always present on the type, no narrowing needed, and the ok plus instanceUrl guard still routes success from refusal. * style: prettier-format the native and i18n changes The feature-branch CI does not run the formatting check, so the conflict-resolved files (AboutTab, useAccountSettings, useTripExport), the native shell and iap module, and the i18n files touched by the translation scripts were never run through Prettier. Format them all; no behaviour changes. * chore(native): re-trigger CI on the formatted tree --------- Co-authored-by: Maurice <mauriceboe@icloud.com>	2026-11-05 21:09:04 +01:00
Maurice	a8326b6f5a	chore(client): the shape name entry at the end of the dynamic key list, beside the sticker one	2026-10-24 11:07:16 +02:00
Maurice	9695e269e3	fix(studio): shapes named in every language, the align target kept across selections, up and down in a tab grid	2026-10-24 11:07:16 +02:00
Maurice	bdf5767a5f	feat(studio): rebuild both side panels around one head, one row and one order ... The rail lists its sections in the order a book is made: Pages, Content, Layouts, Elements and Travel, then Theme and Layers set apart below a rule. Stickers are a tab of Elements beside the icons instead of a rail section of their own, and Elements has six tabs (text, shapes, lines, frames with the grids, icons, stickers). The quotation mark moved to the text styles, the outline rectangle to the basic shapes and the plain rule to the lines. The rail and every tab row are tab lists the arrow keys walk through, and a long name wraps instead of being cut. The icon and sticker searches say in the field how many match, which the sticker library's own head used to. Every panel on both sides opens on the same head, and every labelled control uses one row that moves the control under its label when the two do not fit, so no label sits in a fixed column any more. Number fields, chips, sliders, tab labels, theme names and travel cards wrap the same way, a country beside a stop wraps under itself, and an upload cell holds its words to two lines with the whole label in its tooltip. The heads, shelves and groups are real headings, so a screen reader can walk the panels by them. The inspector shows every kind in one order: what the element is and says, its position and size, its look, its effects, then Arrange. Align and the stacking buttons are one Arrange group with a button that opens the page in Layers; its rows sit under their labels, each in two sets that move to a second line whole. Rarely used groups start folded and open on an element that already uses them (a turned element, a map held at a zoom, a summary set in another face), and every group mounts afresh for the next selection. A sticker's duplicate angle and opacity are gone in favour of the shared position group, which now has the turn buttons for every kind. With several elements selected it keeps their angle, opacity and turn, and the mirror when all of them are stickers, and leaves the frame's numbers to one element. A photo's fill page and fill spread sit under its crop. With nothing selected the inspector shows the page background, the book's theme with the way to the Theme panel, and the page numbers. Seventeen translation keys nothing has used since before the rebuild (the old inspector title, the empty spread note, the summary and country list names, the roads buttons and others) are gone from every language. The broad key template the old panels used had counted them as reached; the format names, the empty photo grid messages and the map source hints are now named where the key check can read them. Also fixed on the way: the travel stops list shared its class with the gradient stops and was laid out as sixteen pixel handles; the alignment buttons were named in raw English; the map's print resolution note joined its two halves with a dash.	2026-10-24 03:08:27 +00:00
Maurice	8c0707f34c	fix(i18n): the sticker entry of the dynamic key list goes at its end	2026-10-23 21:06:10 +02:00
Maurice	8c6f5deab2	feat(studio): a sticker library of 148 hand-drawn illustrations, placed, recoloured and searched by people and the assistant ... A new element kind, sticker, draws layered vector illustrations from a library in twelve themes, behind its own entry point @trek/shared/stickers. Studio gets a Stickers rail section (themes, localized search, recently used, click or drag to place) and an inspector for colour slots, mirroring, turning and opacity. The assistant gets list_book_assets, add and style of stickers in edit_book_page, stickers in describe_book_page and an overlap warning for a sticker over words. BOOK_SCHEMA_REV goes to 2.	2026-10-23 21:06:09 +02:00
Maurice	92f059f313	fix(ci): the book engine's template names count as reached, and formatting	2026-10-22 21:34:14 +00:00
Maurice	3967ca2790	feat(assistant): a card framework every addon package plugs into	2026-10-22 21:30:39 +00:00
Maurice	6d6efddc4e	feat(assistant): expenses, shares, wind, journey tracks and Dawarich checks as MCP tools ... - list_budget_items lists a trip's expenses with their ids, payers and splits, page by page so no page is cut down on its way to a model; get_budget_per_person answers who paid and owes what. Both in a new budget-items.mcp.ts, checked like their REST twins. - get_wind_forecast reads the hourly wind, gusts and direction of a day. - get_journey_tracks lists a journey's GPX tracks; the line for drawing rides under a key the provider never receives. - The Dawarich wishlist scan and the countries the recordings suggest become tools, with their confirming writes, in DawarichAtlasMcp in the Atlas group; the shared time window check refuses alike on REST and MCP, and the model never sees when the user was last seen in a city. - The journal's map, tracks and recorded days load with the journey group instead of riding in the core of every step. - The prompt points at list_budget_items for expense ids (the trip summary never carried them) and names the shares and the wind tools; each new read has its own live step.	2026-10-22 21:30:38 +00:00
Maurice	e3983ef857	feat(tours): tidy the tour editor and tour list, set points only on purpose, name waypoints on the map	2026-10-14 20:21:39 +02:00
Maurice	b31c2ff1d2	ci(client): hold the en keys nothing reaches to a baseline that only shrinks ... lint:i18n-keys only listed unused en keys as information, and it looked for references in client/src alone, so every key the server sends (system notice and notification channel keys in its registries) read as dead. The reference search now also reads server/src and plugin-sdk/src; those references only mark keys as reached and are not held to the client's key rules. The unused keys per en domain file are counted against scripts/i18n-unused-baseline.json, which only shrinks and fails on an entry above its count until --update lowers it. Today's 841 unused keys in 44 files are frozen, none deleted.	2026-10-10 21:33:29 +02:00
Maurice	3de3ffcd1c	refactor(bookings): draw the shared phone booking fields with one component ... The phone booking and transport sheets each carried their own copy of the booking code and status row, the notes field, the traveler picker with its avatar, and the transport sheet drew the card of a route stop twice, once for flights and once for trains and cruises. They now render the same components from MBookingFields next to the sheets, which take the sheet's own translate function so every string stays what it was. The rendered markup is unchanged.	2026-10-09 16:29:40 +02:00
Maurice	13584d1bf6	style(client): format the i18n key check and its test ... The new lint:format ratchet admits no unformatted file outside its baseline, and these two arrived after it was taken.	2026-10-08 13:27:38 +02:00
Maurice	c0516dd9bf	fix(client): check each literal branch of a template key ... A template key was read as a pattern in which every interpolation is a wildcard, so t(`roadtrip.window.${a ? 'onRoute' : 'onRoutTypo'}`) passed as long as some other roadtrip.window key existed, and the typo rendered as raw text. An interpolation that can only produce string literals (a ternary chain of them, in parentheses or not) is now expanded, and each resulting key is checked like a literal one. Thirteen call sites become literal keys that way. Where data is involved, a literal fallback (`${role ?? 'editor'}`) is still checked as a key, with the template kept as a pattern under its own allow-list site. Literals in a condition (`phase === 'start'`) are never taken for results. Narrow templates over data still pass without an allow-list entry. The script header now says plainly what that leaves unchecked: a runtime value with no key under a narrow prefix, which needs the value's type.	2026-10-08 13:04:42 +02:00
Maurice	33f004ed04	fix(client): a wide template key needs a reviewed allow-list entry ... lint:i18n-keys let any template key through as long as its fixed parts matched one en key, and each interpolation could stand for any run of characters, dots included. `settings.${mode}` therefore reached all 574 settings keys and `help.guide.${id}.${part}` nearly 2000, so a wrong suffix behind such a prefix could never fail, and none of the 109 templates had been looked at. An interpolation now stands for one key segment, and a template passes by itself only when it reaches between 1 and MAX_IMPLICIT_MATCHES (30) en keys, the size of an enum such as the docsync error codes. A wider one fails unless DYNAMIC_ALLOWED has an entry for that file and template saying what bounds the value. The twelve wide templates in use today get one each: the help key builders (checked by the registry test), literal tuples beside the call, typed unions, the generated plugin permissions and the seeded photo provider fields. An entry whose file no longer uses the template, or whose template has become narrow enough to pass alone, fails, so the list stays short and current. Listing all 109 templates instead was considered and left out: the narrow ones would only restate their own prefix, and the bound already keeps a mistake inside one small namespace.	2026-10-08 13:04:42 +02:00
Maurice	f00c354d0d	fix(i18n): add the two keys the client named without en having them ... BudgetPanel titled its add button with budget.addCategory (since April) and the trip form labelled its cover remove button with common.remove (since August). Neither key was ever in en, and t() returns an unknown key unchanged, so both rendered as the raw key in every language. Both are added to all 27 locales. Locale parity compares the locales with en, never en with the code, so nothing could catch this. client/scripts/i18n-keys.mjs (npm run lint:i18n-keys) now resolves every literal key src/ names against en: the first argument of t(), tHtml() and tr() (both sides of a conditional included), <TransHtml html>, the fallback of translateApiError and any *Key property or prop. A template key, a prefix with the rest appended and the help registry's key builders pass when their fixed parts match an en key; the one template with no fixed part is on an allow-list that names the keys it resolves to, and an entry nothing uses fails. With --unused it lists the en keys nothing reaches, as information only. en is read with shared/scripts/i18n-catalog.mjs, a reader for the locale tables as text that the parity tooling will share. It refuses a value that is not one string literal instead of skipping the key.	2026-10-08 13:04:41 +02:00