feat(native): TREK's own app icon and launch screen, named just TREK

The shells still carried Capacitor's placeholder icon and splash, the blue
X on a grid. They now show the white TREK mark on a dark, slightly glassy
tile: a soft light from the top left and a sheen over the upper half, in
the app's launch colour #09090b. Android 12+ draws its launch screen on the
same colour instead of light grey.

scripts/generate-app-icons.mjs renders the sources into assets/ from
public/icons/icon-white.svg, and `npm run icons:app` turns them into every
size both platforms ask for through @capacitor/assets. The Android
foreground mark is sized for the adaptive icon's round mask.

The home screen label is TREK: the old "TREK - Plan your trips!" was cut
off under the icon, and the longer title belongs to the store listings.

.git-blame-ignore-revs

@@ -1,6 +0,0 @@
-# Commits that only reformat code. git blame skips them with
-#   git config blame.ignoreRevsFile .git-blame-ignore-revs
-# (GitHub reads this file on its own).
-
-# style: format server and shared with prettier
-724c88c201b2c16d31317eaea5f59f43d314b833

.github/dependabot.yml

@@ -1,71 +0,0 @@
-# Version updates, weekly, into dev. Minor and patch bumps of one ecosystem
-# arrive as a single grouped PR; a major bump gets a PR of its own so its
-# breaking notes are read on their own.
-#
-# Security updates are a repository setting, not part of this file, and
-# GitHub opens them against the default branch whatever target-branch says.
-# enforce-target-branch.yml moves those onto dev.
-#
-# Every PR runs test.yml like any other, so ci-ok decides whether it can
-# merge. Dependabot runs get no Actions secrets, so s3-contract and the Sonar
-# scan skip themselves on these PRs and ci-ok counts the skip as passed.
-version: 2
-updates:
-  # The root lockfile covers the client, server and shared workspaces.
-  - package-ecosystem: npm
-    directory: /
-    target-branch: dev
-    schedule:
-      interval: weekly
-      day: monday
-    open-pull-requests-limit: 5
-    commit-message:
-      prefix: chore(deps)
-      prefix-development: chore(deps-dev)
-    groups:
-      npm-minor-and-patch:
-        update-types: [minor, patch]
-
-  # plugin-sdk is standalone with a lockfile of its own and ships to npm.
-  - package-ecosystem: npm
-    directory: /plugin-sdk
-    target-branch: dev
-    schedule:
-      interval: weekly
-      day: monday
-    open-pull-requests-limit: 3
-    commit-message:
-      prefix: chore(plugin-sdk)
-      prefix-development: chore(plugin-sdk)
-    groups:
-      plugin-sdk-minor-and-patch:
-        update-types: [minor, patch]
-
-  # Keeps the SHA pins of third-party actions current, comment included.
-  - package-ecosystem: github-actions
-    directory: /
-    target-branch: dev
-    schedule:
-      interval: weekly
-      day: monday
-    open-pull-requests-limit: 3
-    commit-message:
-      prefix: ci
-    groups:
-      actions-minor-and-patch:
-        update-types: [minor, patch]
-
-  # The Dockerfile's base images. The Node major follows .nvmrc and the
-  # engines ranges, so it moves by hand, together with them.
-  - package-ecosystem: docker
-    directory: /
-    target-branch: dev
-    schedule:
-      interval: weekly
-      day: monday
-    open-pull-requests-limit: 3
-    commit-message:
-      prefix: chore(docker)
-    ignore:
-      - dependency-name: node
-        update-types: [version-update:semver-major]

.github/workflows/close-stale-invalid-titles.yml

@@ -10,11 +10,10 @@ permissions:
 jobs:
   close-stale:
     if: github.repository == 'liketrek/TREK'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
-    timeout-minutes: 45
     steps:
       - name: Close stale invalid-title issues
-        uses: actions/github-script@v8
+        uses: actions/github-script@v7
         with:
           script: |
             const badTitles = [

.github/workflows/close-stale-wrong-branch.yml

@@ -11,11 +11,10 @@ permissions:
 jobs:
   close-stale:
     if: github.repository == 'liketrek/TREK'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
-    timeout-minutes: 45
     steps:
       - name: Close stale wrong-base-branch PRs
-        uses: actions/github-script@v8
+        uses: actions/github-script@v7
         with:
           script: |
             const { data: pulls } = await github.rest.pulls.list({

.github/workflows/close-untitled-issues.yml

@@ -10,11 +10,10 @@ permissions:
 jobs:
   check-title:
     if: github.repository == 'liketrek/TREK'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
-    timeout-minutes: 45
     steps:
       - name: Flag or redirect issue
-        uses: actions/github-script@v8
+        uses: actions/github-script@v7
         with:
           script: |
             const title = context.payload.issue.title.trim();

.github/workflows/docker-dev.yml

@@ -1,11 +1,5 @@
 name: Build & Push Docker Image (Prerelease)
 
-# The canary. Dispatched by hand, usually on dev, it builds the dispatched
-# commit as <next minor or major>-pre.N, publishes :VERSION, :MAJOR-pre and
-# :latest-pre, and tags the commit. Nothing moves :latest. Like the stable
-# release it refuses a commit whose ci-ok is not green. docker.yml with
-# bump=auto later finalizes the line once main carries it.
-
 on:
   workflow_dispatch:
     inputs:
@@ -17,7 +11,6 @@ on:
 
 permissions:
   contents: write
-  checks: read
 
 concurrency:
   group: prerelease-build
@@ -26,41 +19,23 @@ concurrency:
 jobs:
   version-bump:
     if: github.repository == 'liketrek/TREK'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
-    timeout-minutes: 120
     outputs:
       version: ${{ steps.bump.outputs.VERSION }}
       sha: ${{ steps.bump.outputs.SHA }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
 
-      # The dev push, the main push and any manual run each leave a ci-ok on
-      # this commit. scripts/ci/ci-ok-verdict.mjs counts the newest attempt of
-      # each, refuses while one is still going, and requires the one that
-      # finished last to be green, so a later green run supersedes a flaky or
-      # cancelled one. It prints the link of every run it counted.
-      - name: Require a green ci-ok on the commit being built
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          sha="$(git rev-parse HEAD)"
-          runs="$RUNNER_TEMP/ci-ok-runs.json"
-          gh api "repos/$GITHUB_REPOSITORY/commits/$sha/check-runs?check_name=ci-ok&filter=all&per_page=100" > "$runs"
-          node scripts/ci/ci-ok-verdict.mjs "$runs" "$sha"
-
       - name: Determine prerelease version
         id: bump
-        env:
-          BUMP_INPUT: ${{ inputs.bump || 'auto' }}
         run: |
           git fetch --tags
 
           # Capture the exact commit we're building so build/merge jobs are pinned to it
-          echo "SHA=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+          echo "SHA=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
 
           # Get latest stable tag (exclude prerelease tags)
           STABLE_TAG=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' | grep -v '\-pre\.' | sort -V | tail -1)
@@ -68,12 +43,14 @@ jobs:
           STABLE="${STABLE:-0.0.0}"
           echo "Latest stable: $STABLE"
 
-          IFS='.' read -r MAJOR MINOR _ <<< "$STABLE"
+          IFS='.' read -r MAJOR MINOR PATCH <<< "$STABLE"
 
           # Detect any in-flight major prerelease (v(MAJOR+1).0.0-pre.*). Stay on that line if found.
           NEXT_MAJOR="$((MAJOR + 1)).0.0"
           MAJOR_PRE_EXISTS=$(git tag -l "v${NEXT_MAJOR}-pre.*" | head -1)
 
+          BUMP_INPUT="${{ github.event.inputs.bump || 'auto' }}"
+
           if [ "$BUMP_INPUT" = "major" ] || { [ "$BUMP_INPUT" = "auto" ] && [ -n "$MAJOR_PRE_EXISTS" ]; }; then
             TARGET="$NEXT_MAJOR"
           else
@@ -86,47 +63,38 @@ jobs:
           N=$(( ${LAST_N:-0} + 1 ))
 
           NEW_VERSION="${TARGET}-pre.${N}"
-          echo "VERSION=$NEW_VERSION" >> "$GITHUB_OUTPUT"
+          echo "VERSION=$NEW_VERSION" >> $GITHUB_OUTPUT
-          echo "$STABLE to $NEW_VERSION"
+          echo "$STABLE → $NEW_VERSION"
 
   build:
     runs-on: ${{ matrix.runner }}
-    timeout-minutes: 120
     needs: version-bump
     strategy:
       fail-fast: false
       matrix:
         include:
           - platform: linux/amd64
-            runner: ubuntu-24.04
+            runner: ubuntu-latest
           - platform: linux/arm64
             runner: ubuntu-24.04-arm
     steps:
       - name: Prepare platform tag-safe name
-        env:
+        run: echo "PLATFORM_PAIR=$(echo ${{ matrix.platform }} | sed 's|/|-|g')" >> $GITHUB_ENV
-          PLATFORM: ${{ matrix.platform }}
-        run: echo "PLATFORM_PAIR=${PLATFORM//\//-}" >> "$GITHUB_ENV"
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
         with:
           ref: ${{ needs.version-bump.outputs.sha }}
 
-      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/setup-buildx-action@v3
 
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Image metadata
-        id: meta
-        run: |
-          echo "revision=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
-
       - name: Build and push by digest
         id: build
-        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        uses: docker/build-push-action@v6
         with:
           context: .
           platforms: ${{ matrix.platform }}
@@ -134,9 +102,6 @@ jobs:
           no-cache: true
           build-args: |
             APP_VERSION=${{ needs.version-bump.outputs.version }}
-          labels: |
-            org.opencontainers.image.revision=${{ steps.meta.outputs.revision }}
-            org.opencontainers.image.created=${{ steps.meta.outputs.created }}
 
       - name: Export digest
         run: |
@@ -145,7 +110,7 @@ jobs:
           touch "/tmp/digests/${digest#sha256:}"
 
       - name: Upload digest artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
         with:
           name: digests-${{ env.PLATFORM_PAIR }}
           path: /tmp/digests/*
@@ -153,27 +118,26 @@ jobs:
           retention-days: 1
 
   merge:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
-    timeout-minutes: 120
     needs: [version-bump, build]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
         with:
           ref: ${{ needs.version-bump.outputs.sha }}
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Download build digests
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v4
         with:
           path: /tmp/digests
           pattern: digests-*
           # Deliberately NOT merged: the per-platform folder names are what lets
           # the manifest below be assembled in a fixed order.
 
-      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/setup-buildx-action@v3
 
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -199,12 +163,7 @@ jobs:
               digests+=("mauriceboe/trek@sha256:$(basename "$f")")
             done
           done
-          # The labels live on each platform image; the index gets the ones a
-          # client reads before it picks a platform (#1498).
           docker buildx imagetools create \
-            --annotation "index:org.opencontainers.image.source=https://github.com/liketrek/TREK" \
-            --annotation "index:org.opencontainers.image.version=$VERSION" \
-            --annotation "index:org.opencontainers.image.licenses=AGPL-3.0-only" \
             -t "mauriceboe/trek:latest-pre" \
             -t "mauriceboe/trek:$MAJOR_TAG" \
             -t "mauriceboe/trek:$VERSION" \
@@ -227,7 +186,7 @@ jobs:
         run: |
           KEEP=20
           VERSION="${{ needs.version-bump.outputs.version }}"
-          BASE_VERSION="${VERSION%%-pre.*}"
+          BASE_VERSION="$(echo "$VERSION" | sed 's/-pre\..*//')"
           git fetch --tags
           # Sort by numeric prerelease N (field after -pre.) to get correct ascending order
           mapfile -t ALL_TAGS < <(git tag -l "v${BASE_VERSION}-pre.*" | awk -F'-pre\\.' '{print $2" "$0}' | sort -n | awk '{print $2}')

.github/workflows/docker.yml

@@ -1,24 +1,10 @@
 name: Build & Push Docker Image
 
-# The stable release. Dispatched by hand on main, it:
-#   1. refuses to run unless ci-ok passed on the main commit it releases,
-#   2. works out the version from the tags and the bump input, commits the
-#      bump to package.json, the lockfile and Chart.yaml, tags it and pushes,
-#   3. builds both platforms from exactly that bump commit (never from
-#      whatever main points to by then) and publishes :VERSION,
-#      :MAJOR.MINOR, :MAJOR and :latest,
-#   4. publishes the Helm chart from the same commit.
-#
-# Big or risky changes go out as a prerelease first (docker-dev.yml, tagged
-# :latest-pre and :<next>-pre.N); bump=auto here then finalizes that line.
-# Without a prerelease in flight there is no default: the run stops until
-# someone picks patch, minor or major.
-
 on:
   workflow_dispatch:
     inputs:
       bump:
-        description: 'auto finalizes the prerelease in flight; otherwise pick patch, minor or major'
+        description: 'Force bump line (auto = patch/finalize as today)'
         type: choice
         options: [auto, patch, minor, major]
         default: auto
@@ -29,7 +15,6 @@ on:
 
 permissions:
   contents: write
-  checks: read
 
 concurrency:
   group: stable-build
@@ -38,65 +23,39 @@ concurrency:
 jobs:
   version-bump:
     if: github.repository == 'liketrek/TREK'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
-    timeout-minutes: 120
     outputs:
       version: ${{ steps.bump.outputs.VERSION }}
-      sha: ${{ steps.bump.outputs.SHA }}
     steps:
-      - name: Release from main only
+      - uses: actions/create-github-app-token@v1
-        if: github.ref != 'refs/heads/main'
-        run: |
-          echo "::error::Dispatch this workflow on main, not on $GITHUB_REF."
-          exit 1
-
-      - uses: actions/create-github-app-token@v3
         id: app-token
         with:
           app-id: ${{ secrets.RELEASE_APP_ID }}
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
           fetch-tags: true
           token: ${{ steps.app-token.outputs.token }}
 
-      # The dev push, the main push and any manual run each leave a ci-ok on
-      # this commit. scripts/ci/ci-ok-verdict.mjs counts the newest attempt of
-      # each, refuses while one is still going, and requires the one that
-      # finished last to be green, so a later green run supersedes a flaky or
-      # cancelled one. It prints the link of every run it counted.
-      - name: Require a green ci-ok on the commit being released
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          sha="$(git rev-parse HEAD)"
-          runs="$RUNNER_TEMP/ci-ok-runs.json"
-          gh api "repos/$GITHUB_REPOSITORY/commits/$sha/check-runs?check_name=ci-ok&filter=all&per_page=100" > "$runs"
-          node scripts/ci/ci-ok-verdict.mjs "$runs" "$sha"
-
       - name: Determine bump type and update version
         id: bump
-        env:
-          BUMP_INPUT: ${{ inputs.bump || 'auto' }}
-          CONFIRM_MAJOR: ${{ inputs.confirm_major }}
         run: |
-          set -eu
           git fetch --tags
 
-          # Derive version from git tags, no package.json dependency
+          # Derive version from git tags — no package.json dependency
           STABLE_TAG=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' | grep -v '\-pre\.' | sort -V | tail -1)
           STABLE="${STABLE_TAG#v}"
           STABLE="${STABLE:-0.0.0}"
 
           PRE_TAG=$(git tag -l 'v*-pre.*' | sort -V | tail -1)
 
+          BUMP_INPUT="${{ github.event.inputs.bump || 'auto' }}"
           IFS='.' read -r MAJOR MINOR PATCH <<< "$STABLE"
 
           if [ "$BUMP_INPUT" = "major" ]; then
-            if [ "$CONFIRM_MAJOR" != "MAJOR" ]; then
+            if [ "${{ github.event.inputs.confirm_major }}" != "MAJOR" ]; then
               echo "::error::confirm_major must equal 'MAJOR' to cut a major release"
               exit 1
             fi
@@ -109,96 +68,79 @@ jobs:
             NEW_VERSION="${MAJOR}.${MINOR}.$((PATCH + 1))"
             BUMP="patch"
           else
-            # auto finalizes the in-flight prerelease and nothing else. It used
+            # auto: finalize in-flight prerelease if one exists, else patch
-            # to fall back to a patch, which would have shipped any change,
-            # however big, as a patch nobody chose.
-            PRE_BASE=""
             if [ -n "$PRE_TAG" ]; then
               PRE_BASE="${PRE_TAG#v}"
               PRE_BASE="${PRE_BASE%-pre.*}"
-            fi
-            HIGHEST=$(printf '%s\n' "$PRE_BASE" "$STABLE" | sort -V | tail -1)
-            if [ -z "$PRE_BASE" ] || [ "$HIGHEST" != "$PRE_BASE" ] || [ "$PRE_BASE" = "$STABLE" ]; then
-              echo "::error::No prerelease above $STABLE is in flight, so bump=auto has nothing to finalize. Dispatch again with bump=patch, minor or major."
-              exit 1
-            fi
               PRE_MAJOR="$(echo "$PRE_BASE" | cut -d. -f1)"
-            # Refuse to auto-finalize a major bump, it would bypass confirm_major
+              # Refuse to auto-finalize a major bump — it bypasses confirm_major
               if [ "$PRE_MAJOR" -gt "$MAJOR" ]; then
-              echo "::error::In-flight prerelease $PRE_TAG is a major bump ($STABLE to $PRE_BASE). Use bump=major with confirm_major=MAJOR to finalize."
+                echo "::error::In-flight prerelease $PRE_TAG is a major bump ($STABLE → $PRE_BASE). Use bump=major with confirm_major=MAJOR to finalize."
                 exit 1
               fi
+              # If prerelease base is strictly greater than stable, finalize it
+              HIGHEST=$(printf '%s\n' "$PRE_BASE" "$STABLE" | sort -V | tail -1)
+              if [ "$HIGHEST" = "$PRE_BASE" ] && [ "$PRE_BASE" != "$STABLE" ]; then
                 NEW_VERSION="$PRE_BASE"
                 BUMP="finalize"
+              else
+                PATCH=$((PATCH + 1))
+                NEW_VERSION="${MAJOR}.${MINOR}.${PATCH}"
+                BUMP="patch"
+              fi
+            else
+              PATCH=$((PATCH + 1))
+              NEW_VERSION="${MAJOR}.${MINOR}.${PATCH}"
+              BUMP="patch"
             fi
-
-          # Patch releases have carried migrations before, so this only warns:
-          # whoever pinned :MAJOR.MINOR gets this schema change too.
-          if [ "$BUMP" = "patch" ] && [ -n "$STABLE_TAG" ] \
-            && [ -n "$(git diff --name-only --diff-filter=A "$STABLE_TAG" HEAD -- server/src/db/migrations/)" ]; then
-            echo "::warning::$NEW_VERSION is a patch release that adds database migrations."
           fi
 
           echo "Bump type: $BUMP"
-          echo "VERSION=$NEW_VERSION" >> "$GITHUB_OUTPUT"
+          echo "VERSION=$NEW_VERSION" >> $GITHUB_OUTPUT
-          echo "$STABLE to $NEW_VERSION ($BUMP)"
+          echo "$STABLE → $NEW_VERSION ($BUMP)"
 
           # Update all workspace + root package.json files and the root lockfile in one shot
           npm version "$NEW_VERSION" --workspaces --include-workspace-root --no-git-tag-version
           sed -i "s/^version: .*/version: $NEW_VERSION/" charts/trek/Chart.yaml
           sed -i "s/^appVersion: .*/appVersion: \"$NEW_VERSION\"/" charts/trek/Chart.yaml
 
-          # Commit and tag. The push fast-forwards main from the commit ci-ok
+          # Commit and tag
-          # was checked on, so it fails rather than release past anything that
-          # landed on main in the meantime.
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git add package.json package-lock.json server/package.json client/package.json shared/package.json charts/trek/Chart.yaml
           git commit -m "chore: bump version to $NEW_VERSION [skip ci]"
           git tag -a "v$NEW_VERSION" -m "v$NEW_VERSION"
-          git push origin HEAD:main --follow-tags
+          git push origin main --follow-tags
-
-          # build, merge and release-helm check out exactly this commit.
-          echo "SHA=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
   build:
     runs-on: ${{ matrix.runner }}
-    timeout-minutes: 120
     needs: version-bump
     strategy:
       fail-fast: false
       matrix:
         include:
           - platform: linux/amd64
-            runner: ubuntu-24.04
+            runner: ubuntu-latest
           - platform: linux/arm64
             runner: ubuntu-24.04-arm
     steps:
       - name: Prepare platform tag-safe name
-        env:
+        run: echo "PLATFORM_PAIR=$(echo ${{ matrix.platform }} | sed 's|/|-|g')" >> $GITHUB_ENV
-          PLATFORM: ${{ matrix.platform }}
-        run: echo "PLATFORM_PAIR=${PLATFORM//\//-}" >> "$GITHUB_ENV"
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
         with:
-          ref: ${{ needs.version-bump.outputs.sha }}
+          ref: main
 
-      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/setup-buildx-action@v3
 
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Image metadata
-        id: meta
-        run: |
-          echo "revision=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
-
       - name: Build and push by digest
         id: build
-        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        uses: docker/build-push-action@v6
         with:
           context: .
           platforms: ${{ matrix.platform }}
@@ -206,9 +148,6 @@ jobs:
           no-cache: true
           build-args: |
             APP_VERSION=${{ needs.version-bump.outputs.version }}
-          labels: |
-            org.opencontainers.image.revision=${{ steps.meta.outputs.revision }}
-            org.opencontainers.image.created=${{ steps.meta.outputs.created }}
 
       - name: Export digest
         run: |
@@ -217,7 +156,7 @@ jobs:
           touch "/tmp/digests/${digest#sha256:}"
 
       - name: Upload digest artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
         with:
           name: digests-${{ env.PLATFORM_PAIR }}
           path: /tmp/digests/*
@@ -225,25 +164,24 @@ jobs:
           retention-days: 1
 
   merge:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
-    timeout-minutes: 120
     needs: [version-bump, build]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
         with:
-          ref: ${{ needs.version-bump.outputs.sha }}
+          ref: main
 
       - name: Download build digests
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v4
         with:
           path: /tmp/digests
           pattern: digests-*
           # Deliberately NOT merged: the per-platform folder names are what lets
           # the manifest below be assembled in a fixed order.
 
-      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/setup-buildx-action@v3
 
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -254,10 +192,6 @@ jobs:
           set -euo pipefail
           VERSION="${{ needs.version-bump.outputs.version }}"
           MAJOR_TAG="$(echo "$VERSION" | cut -d. -f1)"
-          # :MAJOR.MINOR takes the patches of one minor line and nothing else,
-          # the conservative pin for an install that wants to wait out a
-          # release that migrates.
-          MINOR_TAG="$(echo "$VERSION" | cut -d. -f1-2)"
           # amd64 first, always. This used to be a glob over hash-named files, so
           # the order changed from one release to the next: 3.4.1 listed amd64
           # first and 4.0.0 listed arm64 first. Clients that read the first entry
@@ -273,15 +207,9 @@ jobs:
               digests+=("mauriceboe/trek@sha256:$(basename "$f")")
             done
           done
-          # The labels live on each platform image; the index gets the ones a
-          # client reads before it picks a platform (#1498).
           docker buildx imagetools create \
-            --annotation "index:org.opencontainers.image.source=https://github.com/liketrek/TREK" \
-            --annotation "index:org.opencontainers.image.version=$VERSION" \
-            --annotation "index:org.opencontainers.image.licenses=AGPL-3.0-only" \
             -t "mauriceboe/trek:latest" \
             -t "mauriceboe/trek:$MAJOR_TAG" \
-            -t "mauriceboe/trek:$MINOR_TAG" \
             -t "mauriceboe/trek:$VERSION" \
             "${digests[@]}"
 
@@ -289,17 +217,16 @@ jobs:
         run: docker buildx imagetools inspect mauriceboe/trek:latest
 
   release-helm:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
-    timeout-minutes: 120
     needs: version-bump
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
         with:
-          ref: ${{ needs.version-bump.outputs.sha }}
+          ref: main
 
       - name: Publish Helm chart
-        uses: stefanprodan/helm-gh-pages@0ad2bb377311d61ac04ad9eb6f252fb68e207260 # v1.7.0
+        uses: stefanprodan/helm-gh-pages@v1.7.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           charts_dir: charts

.github/workflows/enforce-target-branch.yml

@@ -7,8 +7,7 @@ on:
 jobs:
   check-target:
     if: github.repository == 'liketrek/TREK'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
-    timeout-minutes: 45
     permissions:
       pull-requests: write
       issues: write
@@ -16,7 +15,7 @@ jobs:
 
     steps:
       - name: Flag or clear wrong base branch
-        uses: actions/github-script@v8
+        uses: actions/github-script@v7
         with:
           script: |
             const base = context.payload.pull_request.base.ref;
@@ -69,12 +68,12 @@ jobs:
               return;
             }
 
-            // Dependabot's security updates cannot be pointed at dev. `target-branch`
+            // Dependabot cannot be pointed at dev. `target-branch` in dependabot.yml
-            // in .github/dependabot.yml applies to version updates only; security
+            // applies to version updates only; security updates always open against
-            // updates always open against the default branch. Labelling them meant
+            // the default branch, and security updates are all this repository gets
-            // close-stale-wrong-branch shut them 24 hours later, which is how 13 of
+            // (there is no dependabot.yml). Labelling them meant close-stale-wrong-branch
-            // them died. Retarget instead: a bot cannot click "Edit" the way the
+            // shut them 24 hours later, which is how 13 of them died. Retarget instead:
-            // comment below asks a human to.
+            // a bot cannot click "Edit" the way the comment below asks a human to.
             if (context.payload.pull_request.user.login === 'dependabot[bot]') {
               try {
                 await github.rest.pulls.update({

.github/workflows/lint-prettier.yml

@@ -9,34 +9,29 @@ concurrency:
 
 jobs:
   lint:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
-    timeout-minutes: 45
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v4
         with:
-          node-version-file: .nvmrc
+          node-version: '24'
 
       - name: Install dependencies
         run: npm install
 
       - name: Run lint & format check
-        # Both are check-only: lint used to run eslint --fix, which rewrote the
-        # files before format:check looked at them, so neither could fail on
-        # formatting. lint:format holds every file outside
-        # scripts/format-baseline.json to Prettier; the list only shrinks.
         id: checks
         continue-on-error: true
         run: |
           cd shared
           npm run lint
-          npm run lint:format
+          npm run format:check
 
       - name: Comment on PR if checks failed
         if: steps.checks.outcome == 'failure'
-        uses: actions/github-script@v8
+        uses: actions/github-script@v7
         with:
           script: |
             await github.rest.issues.createComment({
@@ -50,9 +45,8 @@ jobs:
                 '',
                 '```bash',
                 'cd shared',
-                'npm run lint:fix',
+                'npm run lint',
-                'npx prettier --write <file>   # each file lint:format names',
+                'npm run format',
-                'npm run lint:format -- --update   # when a listed file is formatted now',
                 '```',
                 '',
                 'Then commit and push the changes.',

.github/workflows/native.yml

@@ -0,0 +1,101 @@
+name: Native apps
+
+permissions:
+  contents: read
+
+# Builds the iOS and Android shells whenever they, their address screen or the
+# Capacitor plugins change. Nobody on the team has to own a Mac for the Swift
+# side to be compiled on every change, and every run leaves a debug APK to
+# install on a phone.
+#
+# Unsigned on purpose: signing and store uploads need secrets that fork PRs do
+# not get, and belong in a release workflow of their own.
+on:
+  pull_request:
+    paths:
+      - 'client/android/**'
+      - 'client/ios/**'
+      - 'client/native-shell/**'
+      - 'client/src/native/trekShell.ts'
+      - 'client/src/native/serverAddress.ts'
+      - 'client/capacitor.config.ts'
+      - 'client/vite.native.config.js'
+      - 'client/package.json'
+      - 'package-lock.json'
+      - 'shared/src/i18n/*/native.ts'
+      - '.github/workflows/native.yml'
+  workflow_dispatch:
+
+concurrency:
+  group: native-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  android:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: npm
+
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 21
+          cache: gradle
+
+      - name: Install
+        run: npm ci --workspace shared && npm ci --workspace client
+
+      - name: Build shared
+        run: npm run build --workspace=shared
+
+      - name: Build the address screen and sync it into the shells
+        working-directory: client
+        run: npm run cap:sync -- android
+
+      - name: Assemble debug APK
+        working-directory: client/android
+        run: ./gradlew assembleDebug lintDebug --no-daemon
+
+      - uses: actions/upload-artifact@v6
+        with:
+          name: trek-android-debug
+          path: client/android/app/build/outputs/apk/debug/app-debug.apk
+          retention-days: 14
+
+  ios:
+    runs-on: macos-15
+    timeout-minutes: 40
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install
+        run: npm ci --workspace shared && npm ci --workspace client
+
+      - name: Build shared
+        run: npm run build --workspace=shared
+
+      - name: Build the address screen and sync it into the shells
+        working-directory: client
+        run: npm run cap:sync -- ios
+
+      - name: Build for the simulator
+        working-directory: client/ios/App
+        run: |
+          xcodebuild build \
+            -project App.xcodeproj \
+            -scheme App \
+            -configuration Debug \
+            -sdk iphonesimulator \
+            -destination 'generic/platform=iOS Simulator' \
+            CODE_SIGNING_ALLOWED=NO

.github/workflows/publish-plugin-sdk.yml

@@ -15,18 +15,17 @@ permissions:
 jobs:
   publish:
     if: github.repository == 'liketrek/TREK'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
-    timeout-minutes: 45
     defaults:
       run:
         working-directory: plugin-sdk
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v4
         with:
-          # The Node the TREK image runs the plugins on. It has the node:sqlite
+          # 22 matches the TREK server runtime and has node:sqlite, which the
-          # the dev-server tests exercise.
+          # dev-server tests exercise.
-          node-version-file: .nvmrc
+          node-version: 22
           registry-url: 'https://registry.npmjs.org'
       - run: npm ci
       - run: npm publish

.github/workflows/security.yml

@@ -1,27 +1,12 @@
 name: Security Scan
 
-# Neither job is a required check. What they report depends on the advisory
-# databases as much as on the change: a CVE published overnight would turn
-# every open PR red at once, including the ones that cannot fix it. The
-# security floors that hold the fixes live in the root package.json's
-# overrides, which a regenerated lockfile keeps.
-#
-#   - npm-audit reads the lockfile only, so it runs in seconds on every PR
-#     and push into dev and main. It audits what the image installs (the
-#     server and shared workspaces without dev dependencies) and the
-#     standalone plugin-sdk.
-#   - scout scans the built image, base image packages included. It needs
-#     the Docker Hub login, so it runs on PRs and pushes into main only and
-#     skips fork PRs. Whether the image builds at all is test.yml's
-#     docker-image job, which a red scan cannot hide.
 on:
   pull_request:
-    branches: [main, dev]
+    branches: [main]
   push:
-    branches: [main, dev]
+    branches: [main]
 
 permissions:
-  contents: read
   pull-requests: write
 
 concurrency:
@@ -29,57 +14,29 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  npm-audit:
-    name: npm audit
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-
-      # The client's dependencies end up in a browser bundle, not in the
-      # image, and are audited by hand until maplibre-gl's fix (a major) lands.
-      - name: Audit the image's runtime dependencies
-        run: npm audit --package-lock-only --omit=dev --audit-level=high --workspace=server --workspace=shared
-
-      - name: Audit trek-plugin-sdk
-        working-directory: plugin-sdk
-        run: npm audit --package-lock-only --omit=dev --audit-level=high
-
   scout:
     # Docker Hub secrets are not exposed to pull requests from forks, so the
     # Scout login can never succeed there.
-    if: >-
+    if: github.repository == 'liketrek/TREK' && github.event.pull_request.head.repo.fork != true
-      github.repository == 'liketrek/TREK'
+    runs-on: ubuntu-latest
-      && github.event.pull_request.head.repo.fork != true
-      && (github.base_ref == 'main' || github.ref == 'refs/heads/main')
-    runs-on: ubuntu-24.04
-    timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
 
-      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/setup-buildx-action@v3
 
-      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+      - uses: docker/build-push-action@v5
         with:
           context: .
           push: false
           load: true
           tags: trek:scan
 
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - uses: docker/scout-action@221e7f4860634eeb1579e3bd7ca232e577bd1864 # v1.26.0
+      - uses: docker/scout-action@v1
         with:
           command: cves
           image: trek:scan

.github/workflows/wiki.yml

@@ -18,11 +18,10 @@ concurrency:
 jobs:
   deploy:
     if: github.repository == 'liketrek/TREK'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
-    timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
       - name: Publish to GitHub wiki
-        uses: Andrew-Chen-Wang/github-wiki-action@1bbb4280446f9630e8e21a18012cbacf3b0f992e # v5.0.6
+        uses: Andrew-Chen-Wang/github-wiki-action@v5
         with:
           strategy: clone

.gitignore

@@ -4,7 +4,6 @@ node_modules/
 # Build output
 client/dist/
 server/dist/
-server/VERSION
 shared/dist/
 server/public/*
 !server/public/.gitkeep

.nvmrc

@@ -1 +0,0 @@
-24

CLAUDE.md

@@ -20,9 +20,8 @@ Run from the repo root unless noted. **Use `npm run ... --workspace=<pkg>`, not
 ```bash
 npm run dev                       # build shared, then watch shared + server + client concurrently
 npm run build                     # build shared → server → client (order matters)
-npm run lint                      # lint all three workspaces, check-only (npm run lint:fix applies the fixes in shared and server)
+npm run lint                      # lint all three workspaces (server and shared run eslint --fix and rewrite files; client is check-only)
 npm run format                    # prettier --write all three
-npm run lint:knip                 # knip over client/server/shared (knip.jsonc): unused files, exports, types, deps may only shrink against scripts/ci/knip-baseline.json (CI gate; --update lowers it)
 ```
 
 Tests:
@@ -33,34 +32,9 @@ npm run test --workspace=server                    # vitest run (server); also t
 npm run test:e2e                                   # server e2e (boots Nest against a temp SQLite)
 npm run test:cov                                   # coverage (lcov) for all four packages incl. plugin-sdk
 cd client && npm run test                          # client vitest run
-cd client && npm run e2e                           # Playwright (CI runs the public and app projects; the screenshot and help-media ones are local)
+cd client && npm run e2e                           # Playwright (local only)
 cd client && npm run lint:pages                    # enforce the Page pattern (CI gate)
-cd client && npm run lint:rtl                      # physical left/right sides may only shrink per file (CI gate)
+cd client && npm run theme:lint                    # flag styling that bypasses appearance tokens (local only)
-cd client && npm run lint:dup                      # lines in copied code may only shrink per file, at SonarCloud's thresholds (CI gate)
-cd client && npm run lint:pairs                    # desktop and phone views of a feature import its shared hook; every phone screen is listed (CI gate)
-cd client && npm run lint:size                     # no source file past 1000 lines, longer ones only shrink (CI gate; server has the same)
-cd client && npm run lint:strict                   # strictNullChecks + noImplicitAny errors may only shrink per file; new files start at zero (CI gate)
-cd client && npm run lint:warnings                 # eslint (typed) errors fail, warnings per rule may only shrink, new rules start frozen (CI gate)
-cd server && npm run lint:warnings                 # the same for the server, against server/scripts/eslint-baseline.json (CI gate)
-cd server && npm run lint:format                   # Prettier outside the baseline list (CI gate; shared has the same in lint-prettier.yml)
-cd server && npm run lint:strict                   # strict type errors per file may only shrink, a new file has none (CI gate)
-cd client && npm run lint:format                   # Prettier outside the baseline list (CI gate)
-cd client && npm run lint:layers                   # components never import pages/ or mobile/ (CI gate)
-cd client && npm run lint:offline                  # views may not import src/api/ beyond the baseline (CI gate)
-cd client && npm run lint:skips                    # no .only; skipped tests may only shrink (CI gate)
-cd client && npm run lint:i18n-keys                # every key the client names exists in en; unused en keys may only shrink (CI gate)
-cd server && npm run lint:boundaries               # no new import cycles or cross-domain reach-ins (CI gate)
-cd server && npm run lint:dialect                  # SQLite-only SQL spellings may only shrink (CI gate; rules in server/CLAUDE.md)
-cd server && npm run probe:pg                      # dialect helpers + the repository statements it reaches against Postgres (CI job; needs TREK_PG_PROBE_URL)
-cd server && npm run lint:tx                       # no new method writing twice outside one transaction (CI gate)
-cd server && npm run lint:test-sql                 # raw SQL fixtures in tests/ may only shrink; seed through tests/helpers/factories (CI gate)
-cd server && npm run lint:test-mocks               # vi.mock of config, realtime and db modules in tests/ may only shrink (CI gate)
-cd server && npm run lint:test-new-service         # hand-built services and repositories in tests/ may only shrink (CI gate)
-cd server && npm run lint:query-api                # MikroORM QueryBuilder calls in the repositories may only shrink (CI gate)
-cd server && npm run lint:mcp-zod                  # inline zod in the MCP tool files may only shrink; fields derive from @trek/shared (CI gate)
-cd server && npm run lint:service-http             # { error, status } results and their caller-side branches may only shrink; services throw DomainError (CI gate)
-cd server && npm run lint:response-contracts        # route handlers without @ResponseContract may only shrink (CI gate)
-cd client && npm run theme:lint                    # styling that bypasses appearance tokens may only shrink per file (CI gate)
 npm run typecheck --workspace=server               # tsc --noEmit (also client/shared; server also has typecheck:tests)
 ```
 
@@ -78,7 +52,7 @@ npm run i18n:parity --workspace=shared            # audit (exit 0)
 npm run i18n:parity:strict --workspace=shared     # CI gate (exit 1 on drift)
 ```
 
-Dev ports: the server listens on **3001**; the Vite dev server proxies the API, websocket, uploads, MCP and OAuth paths to it (see `client/vite.config.js`). `.nvmrc` pins the Node major the Docker image runs and every CI job reads; `engines` in each package.json states the range that installs (npm only warns outside it). `server/.env.example` is the env-var reference.
+Dev ports: the server listens on **3001**; the Vite dev server proxies the API, websocket, uploads, MCP and OAuth paths to it (see `client/vite.config.js`). There is no Node version pin — the CI workflows and the Dockerfile define what is tested. `server/.env.example` is the env-var reference.
 
 ## Server invariants
 
@@ -88,8 +62,8 @@ Nest owns everything: every domain is a DI module under `server/src/nest/<domain
 - **`/mcp` bodies are raw by design** — the parser wrappers exempt `/mcp` so the MCP SDK reads the untouched stream; never `@Body()` a `/mcp` route.
 - **Auth is default-deny**: global guards run as `APP_GUARD`s; public routes opt out with `@Public()`, and a boot-time ratchet (`validate-route-guards.ts`) refuses any public route not on its allow-list.
 - **Trip-scoped routes** verify trip access (404) and the permission (403) — `@UseGuards(JwtAuthGuard, TripAccessGuard)` + `@RequirePermission('<action>')` per handler — and forward `X-Socket-Id` to the broadcast so the originating client doesn't echo its own change. **Never gate a multipart upload with a guard** (the client sees ECONNRESET instead of 403 — check in the handler).
-- **DB** (`server/src/db/`): `better-sqlite3`, WAL, FK on. MikroORM's migrations (`db/migrations/`) are the only schema source, **including for tests** — the hand-kept `schema.ts`/`migrations.ts`/`seeds.ts` test builders are gone. Seeding is MikroORM's too (`db/seeders/`), applied at boot from `buildApp()`; the ORM shares the one better-sqlite3 connection (bound in `server/src/db/orm-driver.ts`) rather than opening its own. Queries go through repositories (`server/src/db/repositories/`) and `UnitOfWork` (`server/src/nest/database/unit-of-work.ts`) for transactions — there is no `DatabaseService`. `better-sqlite3` itself is ESLint-restricted to `src/db/` plus a short, named allow-list (`server/eslint.config.mjs`), so a domain reaching for the driver directly fails lint. `NODE_ENV=test` gives each vitest worker an isolated `:memory:` DB.
+- **DB** (`server/src/db/`): `better-sqlite3`, WAL, FK on. Migrations are positional and append-only. `NODE_ENV=test` gives each vitest worker an isolated `:memory:` DB.
-- **Realtime**: `/ws` is a Nest gateway in `server/src/nest/realtime/` — inject `RealtimeService`. Tests observe broadcasts through a `FakeRealtimeService` (`server/tests/helpers/fake-realtime.ts`), never by mocking the transport module.
+- **Realtime**: `/ws` is a Nest gateway in `server/src/nest/realtime/` — inject `RealtimeService`; `server/src/websocket.ts` is a legacy re-export stub.
 - **MCP**: tools are declared in `<domain>.mcp.ts` files beside each module, on the `server/src/nest-mcp/` decorator layer. A validation or permission change on a REST route must land in the parallel MCP tool in the same change. See `MCP.md`.
 - **Addons** are admin-toggleable feature modules keyed by `ADDON_IDS` in `server/src/addons.ts`.
 - **Plugins** (`server/src/nest/plugins/`): one forked child process per plugin, permission-gated RPC (a handler is registered only if the plugin holds the unlocking permission), install-time manifest/signature/egress/version-range gates. The protocol tables are **generated** into `plugin-sdk/` and `shared/` by `gen:plugin-facts`; `check:plugin-facts` is the CI gate. Author tooling is `plugin-sdk/`; the `trek-plugin-dev` skill covers authoring.
@@ -101,16 +75,14 @@ Nest owns everything: every domain is a DI module under `server/src/nest/<domain
 Offline-first, with a layered data flow. A Page never owns state directly:
 
 - **Page pattern** (enforced by `lint:pages`, spec in `client/src/pages/PATTERN.md`): a `*Page.tsx` is a **wiring container** composing a co-located `use<Page>()` hook; it must not call React state/effect/memo hooks itself.
-- **Data flow**: `store (Zustand, client/src/store/) → repo (client/src/repo/) → api (client/src/api/) | Dexie (client/src/db/offlineDb.ts)`. Writes go through `client/src/sync/mutationQueue.ts`: optimistic Dexie write, then a replay with an `X-Idempotency-Key` header on reconnect. `client/src/store/slices/remoteEventHandler.ts` applies incoming WebSocket events. Components never call the API directly.
+- **Data flow**: `store (Zustand, client/src/store/) → repo (client/src/repo/) → api (client/src/api/) | Dexie (client/src/db/offlineDb.ts)`. Writes go through `sync/mutationQueue.ts`: optimistic Dexie write, then a replay with an `X-Idempotency-Key` header on reconnect. `store/slices/remoteEventHandler.ts` applies incoming WebSocket events. Components never call the API directly.
-- **Styling**: semantic Tailwind tokens (`bg-surface*`, `text-content*`, `border-edge*`, `bg-accent*`) or the underlying `var(--token)` variables — never color literals, arbitrary-value color classes or numeric inline `fontSize`, so user-chosen scheme/transparency/text-size keep working. `theme:lint` holds the bypasses per file to a baseline that only shrinks (CI gate); mark intentional exceptions (map/PDF/brand) with a `theme-lint-disable` line comment, which is counted too.
+- **Styling**: semantic Tailwind tokens (`bg-surface*`, `text-content*`, `border-edge*`, `bg-accent*`) or the underlying `var(--token)` variables — never color literals, arbitrary-value color classes or numeric inline `fontSize`, so user-chosen scheme/transparency/text-size keep working. `theme:lint` flags bypasses; suppress intentional exceptions (map/PDF/brand) with a `theme-lint-disable` line comment.
-- **Reading direction**: Arabic runs the app right to left, so spacing, insets and alignment that follow the text use the logical forms (`ms-`/`me-`/`ps-`/`pe-`/`start-`/`end-`/`text-start`/`border-s`/`rounded-s`, `marginInlineStart`, `insetInlineEnd`, `textAlign: 'start'`). `lint:rtl` counts the physical ones per file against `client/scripts/rtl-baseline.json`, which may only shrink; geometry that is physical on purpose in new code (maps, measured positions, time axes) carries an `rtl-lint-disable` comment.
 - **PWA**: `vite-plugin-pwa` + Workbox cache tiles, API and uploads; `prebuild` generates icons.
 
 ## Shared contracts & i18n
 
 - A route is "done" only once its contract lives in `shared/` and both sides import the inferred types. Edit the Zod schema, rebuild shared, then server (validation + DTO types) and client (typed requests) pick it up.
 - Locale files live in `shared/src/i18n/<locale>/`, one file per domain; `en/` is canonical. When you add or change a key, **add a real translation to every locale** — parity fails CI on missing keys, and an English placeholder is not acceptable in a non-`en` locale.
-- Count-bearing strings are plural groups: the key holds the general form and `key.one`, `.few` … the forms the language's `Intl.PluralRules` selects. Pass `{ count }` as a number and never choose between two keys with `count === 1`; details in `shared/CLAUDE.md`.
 
 ## Project direction
 
@@ -118,7 +90,7 @@ These principles come out of a full-repo audit and shape all new code:
 
 - **Protect the crown jewels.** The client's offline-first data core (repos + mutation queue + Dexie), the out-of-process plugin sandbox, the Zod contract layer, and the auth primitives are production-grade. Extend them; never route around them or rewrite them in anger.
 - **No "modern shell over legacy core."** The debt pattern is a modern frame delegating to the old approach underneath (on the client: feature components calling the raw API past the offline core). New code goes all-in on the target architecture; when touching a legacy seam, migrate it rather than adding another wrapper.
-- **Single source of truth over manual synchronization.** Never add a hand-mirrored copy of state, schema, or contract (server↔Dexie↔Zustand, schema↔SQL, the plugin contract). Derive from one source, or guard the copy with a parity test that cannot silently skip — the server entities are the precedent: `npm run gen:entities`/`check:entities --workspace=server` (`server/scripts/generate-entities.ts`) regenerate them from the live migrated schema instead of hand-editing, and a parity test (PARITY-009) pins entity-vs-DB drift (delete rules, index names) at zero skips. The Kysely table types the repositories query through are generated the same way (`gen:db-types`/`check:db-types`, `server/scripts/generate-db-types.ts`).
+- **Single source of truth over manual synchronization.** Never add a hand-mirrored copy of state, schema, or contract (server↔Dexie↔Zustand, schema↔SQL, the plugin contract). Derive from one source, or guard the copy with a parity test that cannot silently skip.
 - **DI over global mutable module state.** New server code injects its dependencies; new client code avoids `window`-global buses and mutable module state.
 - **Use the runtime's native idioms.** Prefer React 19 features (`useOptimistic`, Actions, `use()`/Suspense) and Nest subsystems (providers, pipes, guards, `@nestjs/schedule`) over hand-rolled equivalents.
 - **Fail closed, gates stay on.** Security switches default to safe; misconfiguration must refuse, not degrade. Never lower a quality gate to land a change — no new `any`, no new `eslint-disable`, no downgrading rules to `warn`, no lowered coverage thresholds.
@@ -134,14 +106,7 @@ These principles come out of a full-repo audit and shape all new code:
 
 ## Quality gates in CI
 
-`.github/workflows/test.yml` runs, per package: typecheck (server also `typecheck:tests`, client also the strict-mode ratchet `lint:strict`), lint (client and server through `lint:warnings`, which also holds the warning count per rule), `lint:pages`, `lint:rtl`, `lint:size` (client and server), the server's `lint:strict`, `lint:boundaries`, `lint:tx`, `lint:dialect`, `lint:test-sql`, `lint:test-mocks`, `lint:test-new-service`, `lint:query-api`, `lint:mcp-zod`, `lint:service-http` and `lint:response-contracts`, the client's and server's `lint:format`, `lint:layers`, `lint:offline`, `lint:dup`, `lint:pairs`, `lint:skips`, `lint:i18n-keys` and `theme:lint`, shared's `contracts:open`, the repo-wide `lint:knip` (in server-quality), `check:plugin-facts`, `i18n:parity:strict` (with the untranslated-strings ratchet), the S3 contract suite, the Postgres probe (`postgres-probe`: every dialect helper on SQLite and Postgres, and the statements every repository method reaches with sample arguments against a Postgres service; the SQL errors per method and the list of methods it cannot measure are held to a baseline that only shrinks and fails while it is still unmeasured; see `server/CLAUDE.md`), the browser end-to-end flows (Chromium and WebKit), a client build with `check:gl-split`, coverage for all four packages, then a SonarCloud scan. It also builds the Docker image and boots it until `/api/health/ready` answers (`docker-image`), and lints and renders the Helm chart against the Kubernetes schemas and runs `docker compose config` on every compose file (`deploy-manifests`). `lint-prettier.yml` additionally runs `lint` + `lint:format` on `shared/`, both check-only. `plugin-sdk` has no lint script and is outside the eslint gates. **Not in CI**: the screenshot and help-media Playwright projects; run them locally. There are no git hooks; nothing runs before a commit except you. Other workflows build Docker images, scan them, and publish `trek-plugin-sdk` on `plugin-sdk-v*` tags.
+`.github/workflows/test.yml` runs, per package: typecheck (server also `typecheck:tests`), `lint:check`, `lint:pages`, `check:plugin-facts`, `i18n:parity:strict`, the S3 contract suite, coverage for all four packages, then a SonarCloud scan. `lint-prettier.yml` additionally runs `lint` + `format:check` on `shared/`. `plugin-sdk` has no lint script and is outside the eslint gates. **Not in CI**: `theme:lint`, Playwright, `check:gl-split` — run them locally. There are no git hooks; nothing runs before a commit except you. Other workflows build Docker images, scan them, and publish `trek-plugin-sdk` on `plugin-sdk-v*` tags.
-
-- **`ci-ok` is the required check.** The branch ruleset requires `ci-ok` (plus `lint` and `check-target` from their own workflows), and `ci-ok` needs every job above except the scan. It fails if any of them failed or was cancelled and passes if they passed or were skipped. A new gate job counts only once it is listed in `ci-ok`'s `needs:`.
-- **Guides name paths that exist**: the `changes` job runs `scripts/ci/doc-paths.mjs`, which resolves every backtick path in the CLAUDE.md files, `README.md`, `server/src/nest/README.md` and the wiki against the tracked files; the missing ones are listed in `scripts/ci/doc-paths-baseline.json`, which only shrinks (`--update` after a fix).
-- **What runs is decided by `changes`, not by `on.paths`**: `scripts/ci/changed-areas.mjs` maps the changed files to the `code`, `image` and `deploy` areas (tests: `npm run test:ci-scripts`). A path filter on the workflow would leave `ci-ok` unreported on a docs-only PR and block it. Add a new top-level file the build reads to the right area there.
-- **Runners and Node**: jobs run on `ubuntu-24.04`, not `ubuntu-latest`, and every `setup-node` reads `.nvmrc`. Third-party actions (anything outside `actions/*`) are pinned by commit SHA with the tag in a comment; Dependabot keeps both current.
-- **Security scans are advisory.** `security.yml` runs `npm audit` (what the image installs, plus `plugin-sdk`) on every PR and push into dev and main, and Docker Scout on the built image for main. Neither is required: a newly published advisory would turn every open PR red at once. Fixes are held as floors in the root `package.json` `overrides`; npm ignores an `overrides` block in a workspace `package.json`, so never put one there.
-- **Releases** are dispatched by hand and refuse a commit whose `ci-ok` is not green. `docker-dev.yml` (any branch, usually dev) is the canary: it builds the dispatched commit as the next minor or major `-pre.N` and moves only `:latest-pre` and `:<major>-pre`. `docker.yml` (main only) bumps the version, commits and tags it, builds both platforms from exactly that commit and moves `:latest`, `:<major>`, `:<major>.<minor>` and `:<version>`. Its `bump=auto` only finalizes a prerelease in flight; without one it stops and asks for patch, minor or major. Ship a release that migrates or changes a lot as a prerelease first, and as a minor, so installs pinned to `:<major>.<minor>` can wait it out.
 
 **SonarCloud** (project `liketrek_TREK`, the built-in Sonar way gate; the run takes 20–25 min, so get it right before pushing) measures **new code only** on a PR; any failing condition blocks it:
 
@@ -152,7 +117,7 @@ These principles come out of a full-repo audit and shape all new code:
 | Security / reliability / maintainability rating | A |
 | Security hotspots reviewed | 100% |
 
-- **Duplication is the one that bites.** Desktop and phone shells (`client/src/components/<X>` ↔ `client/src/mobile/screens/.../M<X>`) are deliberate mirrors of each other's markup; their logic lives in one shared hook per feature. Every line added identically to both counts against the 3% budget, so a feature touching both shells fails on its own. Put the logic in ONE hook/module (precedents: `useInstanceSettings`, `useRangeBypass` under `client/src/components/Admin/`) and leave only markup in each shell. `lint:dup` finds the same copies in `client/src` before the push and holds every file to `client/scripts/dup-baseline.json`; `lint:pairs` holds each pair in `client/scripts/feature-pairs.json` to its shared hook and makes every new phone screen either join a pair or say why it has no twin. Locale files are excluded from duplication, so i18n additions are free.
+- **Duplication is the one that bites.** Desktop and phone shells (`client/src/components/<X>` ↔ `client/src/mobile/screens/.../M<X>`) are deliberate mirrors that are already heavily duplicated. Every line added identically to both counts against the 3% budget, so a feature touching both shells fails on its own. Put the logic in ONE hook/module (precedents: `useInstanceSettings`, `useRangeBypass` under `client/src/components/Admin/`) and leave only markup in each shell. Locale files are excluded from duplication, so i18n additions are free.
 - **Coverage is per new line across all four packages.** A new file without tests drags the PR under 80%. Files in `sonar.coverage.exclusions` don't count either way.
 - **Ratings are about new issues.** One new bug drops reliability; one new vulnerability drops security. Don't introduce hotspot patterns (`Math.random` in anything security-adjacent, `child_process` through PATH, backtracking regexes, secret-looking strings). Path-wide suppressions live only in `sonar-project.properties` with a written justification; one-off findings are resolved on SonarCloud, never with an inline `// NOSONAR`.
 - **Check it yourself.** The `sonarqube` MCP is connected: `list_pull_requests` → `get_project_quality_gate_status` shows each condition's value; `search_duplicated_files` + `get_duplications` show what tripped duplication; `search_sonar_issues_in_projects` lists new issues. Test files are excluded from analysis — when duplication fires, the source is the problem.

Dockerfile

@@ -2,10 +2,8 @@
 # Rebuild gosu with a current Go toolchain so the runtime image ships no stale
 # Go stdlib (Debian's apt gosu is built with an old Go that trips CVE scanners).
 # The binary and its runtime behaviour are identical to the apt package.
-FROM golang:1.26-alpine AS gosu-build
+FROM golang:1.25-alpine AS gosu-build
-# Pinned to the commit of gosu's 1.19 tag: @latest made every build pick up whatever
+RUN CGO_ENABLED=0 GOBIN=/out go install github.com/tianon/gosu@latest
-# was pushed last, and the tag itself is not a semver version go install accepts.
-RUN CGO_ENABLED=0 GOBIN=/out go install github.com/tianon/gosu@6456aaa0f3c854d199d0f037f068eb97515b7513
 
 # ── Stage 1: shared ──────────────────────────────────────────────────────────
 FROM node:24-alpine AS shared-builder
@@ -26,9 +24,6 @@ COPY client/scripts/patch-maplibre.mjs ./client/scripts/
 RUN npm ci --workspace=client
 COPY --from=shared-builder /app/shared/dist ./shared/dist
 COPY client/ ./client/
-# A prerelease build does not bump client/package.json, so the bundle takes its
-# version from the same build argument the server's VERSION file comes from.
-ARG APP_VERSION=dev
 RUN npm run build --workspace=client
 
 # ── Stage 3: server ──────────────────────────────────────────────────────────
@@ -42,9 +37,7 @@ COPY server/package.json ./server/
 RUN npm ci --workspace=server --ignore-scripts
 COPY --from=shared-builder /app/shared/dist ./shared/dist
 COPY server/ ./server/
-# tsc needs more than the 2 GB heap Node picks on a host with about 12 GB of RAM;
+RUN npm run build --workspace=server
-# on a bigger build machine the default is larger, so only small hosts failed.
-RUN NODE_OPTIONS=--max-old-space-size=4096 npm run build --workspace=server
 
 # ── Stage 4: production runtime ──────────────────────────────────────────────
 FROM node:24-trixie-slim
@@ -75,7 +68,7 @@ RUN apt-get update && \
     apt-get install -y --no-install-recommends tzdata dumb-init wget ca-certificates \
     libkitinerary-bin libsqlite3-0 && \
     npm ci --workspace=server --omit=dev --ignore-scripts && \
-    { ln -sf "$(find /usr/lib -name kitinerary-extractor -type f | head -1)" /usr/local/bin/kitinerary-extractor || true; } && \
+    ln -sf "$(find /usr/lib -name kitinerary-extractor -type f | head -1)" /usr/local/bin/kitinerary-extractor; \
     rm -rf /var/lib/apt/lists/* /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx && \
     chown -R node:node /app
 
@@ -127,29 +120,13 @@ RUN mkdir -p /app/data/logs /app/uploads/files /app/uploads/covers /app/uploads/
 ENV NODE_ENV=production
 ENV NODE_USE_ENV_PROXY=1
 ENV PORT=3000
-# The version goes into a file, not into ENV. A container keeps its environment
-# when it is recreated on a newer image (Portainer's recreate, a copied run
-# config), so an APP_VERSION env var would keep announcing the old release and
-# the clients would never pick up the new bundle. The server reads this file
-# first (server/src/app-config/image-version.ts).
 ARG APP_VERSION=dev
-RUN if [ "$APP_VERSION" != "dev" ]; then printf '%s\n' "$APP_VERSION" > /app/server/VERSION; fi
+ENV APP_VERSION=${APP_VERSION}
-
-# OCI metadata: Renovate, Watchtower and the registries read the source label to
-# link an image update to its release notes (#1498). The release workflows add
-# the commit and the build time; a local build carries everything else.
-LABEL org.opencontainers.image.title="TREK" \
-      org.opencontainers.image.description="Self-hosted collaborative travel planner" \
-      org.opencontainers.image.url="https://github.com/liketrek/TREK" \
-      org.opencontainers.image.source="https://github.com/liketrek/TREK" \
-      org.opencontainers.image.documentation="https://github.com/liketrek/TREK/wiki" \
-      org.opencontainers.image.licenses="AGPL-3.0-only" \
-      org.opencontainers.image.version="${APP_VERSION}"
 
 EXPOSE 3000
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
-  CMD wget -qO- "http://localhost:${PORT:-3000}/api/health" || exit 1
+  CMD wget -qO- http://localhost:3000/api/health || exit 1
 
 # Start-up lives in a script, not an inline `sh -c` string: container management
 # UIs re-tokenise Config.Cmd when you edit a container in place, and a command

README.md

@@ -43,7 +43,7 @@ A self-hosted, real-time collaborative travel planner — with maps, budgets, pa
 
 <div align="center">
 
-<img src="https://github.com/mauriceboe/trek-media/releases/download/readme-assets/TREK2.webp" alt="TREK, a tour of the app" width="100%" />
+<img src="https://github.com/mauriceboe/trek-media/releases/download/readme-assets/TREK1.webp" alt="TREK, a tour of the app" width="100%" />
 
 </div>
 
@@ -168,9 +168,9 @@ Most of what follows is an addon an admin switches on or off. Lists, Costs, Docu
 - **Admin panel**: users and invites, the permission matrix, packing templates, categories, addons, plugins, API keys, MCP tokens and OAuth sessions, backups, storage, audit log, and GitHub releases
 - **Backups**: manual or scheduled hourly, daily, weekly or monthly, with retention in days. The zip carries the at-rest key, so a restore can decrypt its own secrets
 - **Storage**: pluggable storage backends per content category — keep everything on local disk, or add S3-compatible backends and replicate any category to them, configured entirely from the admin panel
-- **Notifications**: a per-user matrix of events against in-app, email (SMTP), webhook, ntfy and Web Push (on every device you turn it on for, even with TREK closed), plus any channel a plugin registers
+- **Notifications**: a per-user matrix of events against in-app, email (SMTP), webhook and ntfy, plus any channel a plugin registers
 - **Appearance**: light, dark or follow the OS, seven colour schemes plus a custom accent, transparency, compact density, reduce motion, and text size per tier
-- **27 languages**: en, de, es, fr, it, nl, hu, ru, zh, zh-TW, pl, cs, ar (right to left), br, id, tr, ja, ko, uk, gr, sv, vi, ca, az, et, sk, th
+- **23 languages**: en, de, es, fr, it, nl, hu, ru, zh, zh-TW, pl, cs, ar (right to left), br, id, tr, ja, ko, uk, gr, sv, vi, ca
 - **In-app help**: the wiki ships inside the image and is served from disk at `/help`, so the docs match the version you are running
 
 </td>
@@ -223,7 +223,7 @@ Open `http://localhost:3000`. On first boot TREK seeds an admin account — if y
 
 <div align="center">
 
-![Node.js](https://img.shields.io/badge/Node.js_24-339933?style=flat-square&logo=node.js&logoColor=white)
+![Node.js](https://img.shields.io/badge/Node.js_22-339933?style=flat-square&logo=node.js&logoColor=white)
 ![NestJS](https://img.shields.io/badge/NestJS_11-E0234E?style=flat-square&logo=nestjs&logoColor=white)
 ![SQLite](https://img.shields.io/badge/SQLite-003B57?style=flat-square&logo=sqlite&logoColor=white)
 ![React](https://img.shields.io/badge/React_19-61DAFB?style=flat-square&logo=react&logoColor=black)

charts/README.md

@@ -53,5 +53,4 @@ See `values.yaml` for more options.
 - `FORCE_HTTPS` is optional. Set `env.FORCE_HTTPS: "true"` only when ingress (or another proxy) terminates TLS. It enables HTTPS redirects, HSTS, CSP `upgrade-insecure-requests`, and forces the session cookie `secure` flag. Requires `TRUST_PROXY` to be set.
 - Set `env.TRUST_PROXY: "1"` (or the number of proxy hops) when running behind ingress or a load balancer. Required for `FORCE_HTTPS` to detect the forwarded protocol correctly. In production it defaults to `1` automatically.
 - `COOKIE_SECURE` is auto-derived (on when `NODE_ENV=production` or `FORCE_HTTPS=true`). Set `env.COOKIE_SECURE: "false"` only during local testing without TLS. **Not recommended for production.**
-- Web Push needs no chart settings: TREK generates its key pair on first start and keeps it in the database on the data PVC. To bring your own pair, set `env.VAPID_PUBLIC_KEY` and `secretEnv.VAPID_PRIVATE_KEY` together (and optionally `env.VAPID_SUBJECT`); changing the pair later means every device has to turn push on again.
 - Set `env.OIDC_DISCOVERY_URL` to override the auto-constructed OIDC discovery endpoint. Required for providers (e.g. Authentik) that expose it at a non-standard path.

charts/trek/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
 name: trek
-version: 4.3.3
+version: 4.3.1
 description: Minimal Helm chart for TREK app
-appVersion: "4.3.3"
+appVersion: "4.3.1"

charts/trek/templates/NOTES.txt

@@ -2,12 +2,8 @@
    - ENCRYPTION_KEY encrypts stored secrets (API keys, MFA, SMTP, OIDC) at rest.
    - By default, the chart creates a Kubernetes Secret from `secretEnv.ENCRYPTION_KEY` in values.yaml.
    - To generate a random key at install (preserved across upgrades), set `generateEncryptionKey: true`.
-   - To use an existing Kubernetes secret, set `existingSecret` to the secret name. The chart then
+   - To use an existing Kubernetes secret, set `existingSecret` to the secret name. The secret must
-     renders no Secret of its own and reads every secret env var from that secret: `ENCRYPTION_KEY`
+     contain a key matching `existingSecretKey` (defaults to `ENCRYPTION_KEY`).
-     (renamable via `existingSecretKey`), plus `ADMIN_EMAIL`, `ADMIN_PASSWORD`, `OIDC_CLIENT_SECRET`,
-     `UNSPLASH_ACCESS_KEY`, `PLACES_API_KEY`, `AMAP_API_KEY`, `AMAP_API_SECRET`,
-     `VAPID_PRIVATE_KEY`, `SMTP_PASS`, `MAPBOX_ACCESS_TOKEN`, `CARTO_API_KEY` and
-     `DEMO_ADMIN_PASS`. Missing keys are simply left unset, so only provide the ones you use.
    - If left empty, the server resolves the key automatically: existing installs fall back to
      data/.jwt_secret (encrypted data stays readable with no manual action); fresh installs
      auto-generate a key persisted to the data PVC.

charts/trek/templates/configmap.yaml

@@ -16,12 +16,6 @@ data:
   {{- if .Values.env.TREK_WIKI_DIR }}
   TREK_WIKI_DIR: {{ .Values.env.TREK_WIKI_DIR | quote }}
   {{- end }}
-  {{- if .Values.env.DEFAULT_LANGUAGE }}
-  DEFAULT_LANGUAGE: {{ .Values.env.DEFAULT_LANGUAGE | quote }}
-  {{- end }}
-  {{- if .Values.env.MCP_MAX_SESSION_PER_USER }}
-  MCP_MAX_SESSION_PER_USER: {{ .Values.env.MCP_MAX_SESSION_PER_USER | quote }}
-  {{- end }}
   {{- if .Values.env.ALLOWED_ORIGINS }}
   ALLOWED_ORIGINS: {{ .Values.env.ALLOWED_ORIGINS | quote }}
   {{- end }}
@@ -70,21 +64,9 @@ data:
   {{- if .Values.env.OIDC_ADMIN_VALUE }}
   OIDC_ADMIN_VALUE: {{ .Values.env.OIDC_ADMIN_VALUE | quote }}
   {{- end }}
-  {{- if .Values.env.OIDC_USERNAME_CLAIM }}
-  OIDC_USERNAME_CLAIM: {{ .Values.env.OIDC_USERNAME_CLAIM | quote }}
-  {{- end }}
   {{- if .Values.env.OIDC_SCOPE }}
   OIDC_SCOPE: {{ .Values.env.OIDC_SCOPE | quote }}
   {{- end }}
-  {{- if .Values.env.HTTP_PROXY }}
-  HTTP_PROXY: {{ .Values.env.HTTP_PROXY | quote }}
-  {{- end }}
-  {{- if .Values.env.HTTPS_PROXY }}
-  HTTPS_PROXY: {{ .Values.env.HTTPS_PROXY | quote }}
-  {{- end }}
-  {{- if .Values.env.NO_PROXY }}
-  NO_PROXY: {{ .Values.env.NO_PROXY | quote }}
-  {{- end }}
   {{- if .Values.env.OIDC_DISCOVERY_URL }}
   OIDC_DISCOVERY_URL: {{ .Values.env.OIDC_DISCOVERY_URL | quote }}
   {{- end }}
@@ -115,9 +97,3 @@ data:
   {{- if .Values.env.AMAP_API_BASE }}
   AMAP_API_BASE: {{ .Values.env.AMAP_API_BASE | quote }}
   {{- end }}
-  {{- if .Values.env.VAPID_PUBLIC_KEY }}
-  VAPID_PUBLIC_KEY: {{ .Values.env.VAPID_PUBLIC_KEY | quote }}
-  {{- end }}
-  {{- if .Values.env.VAPID_SUBJECT }}
-  VAPID_SUBJECT: {{ .Values.env.VAPID_SUBJECT | quote }}
-  {{- end }}

charts/trek/templates/deployment.yaml

@@ -9,7 +9,7 @@ spec:
   # TREK is a single-writer SQLite app on a ReadWriteOnce PVC, so the default
   # RollingUpdate would start a second pod holding the same volume before the old one
   # exits — a Multi-Attach deadlock, or two processes on one travel.db. Recreate tears
-  # the old pod down first. Keep it, see updateStrategy in values.yaml.
+  # the old pod down first. Override to RollingUpdate only with a ReadWriteMany volume.
   strategy:
     type: {{ .Values.updateStrategy | default "Recreate" }}
   selector:
@@ -40,14 +40,10 @@ spec:
             {{- toYaml . | nindent 12 }}
           {{- end }}
           ports:
-            - name: http
+            - containerPort: 3000
-              containerPort: {{ .Values.env.PORT | default 3000 }}
           envFrom:
             - configMapRef:
                 name: {{ include "trek.fullname" . }}-config
-            {{- with .Values.extraEnvFrom }}
-            {{- toYaml . | nindent 12 }}
-            {{- end }}
           env:
             - name: ENCRYPTION_KEY
               valueFrom:
@@ -79,12 +75,6 @@ spec:
                   name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
                   key: UNSPLASH_ACCESS_KEY
                   optional: true
-            - name: PLACES_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
-                  key: PLACES_API_KEY
-                  optional: true
             - name: AMAP_API_KEY
               valueFrom:
                 secretKeyRef:
@@ -97,48 +87,11 @@ spec:
                   name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
                   key: AMAP_API_SECRET
                   optional: true
-            - name: VAPID_PRIVATE_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
-                  key: VAPID_PRIVATE_KEY
-                  optional: true
-            - name: SMTP_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
-                  key: SMTP_PASS
-                  optional: true
-            - name: MAPBOX_ACCESS_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
-                  key: MAPBOX_ACCESS_TOKEN
-                  optional: true
-            - name: CARTO_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
-                  key: CARTO_API_KEY
-                  optional: true
-            - name: DEMO_ADMIN_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
-                  key: DEMO_ADMIN_PASS
-                  optional: true
-          {{- with .Values.extraEnv }}
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
           volumeMounts:
             - name: data
               mountPath: /app/data
             - name: uploads
               mountPath: /app/uploads
-          {{- with (default dict .Values.probes).startup }}
-          startupProbe:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
           {{- with (default dict .Values.probes).liveness }}
           livenessProbe:
             {{- toYaml . | nindent 12 }}

charts/trek/templates/secret.yaml

@@ -20,30 +20,12 @@ data:
   {{- if .Values.secretEnv.UNSPLASH_ACCESS_KEY }}
   UNSPLASH_ACCESS_KEY: {{ .Values.secretEnv.UNSPLASH_ACCESS_KEY | b64enc | quote }}
   {{- end }}
-  {{- if .Values.secretEnv.PLACES_API_KEY }}
-  PLACES_API_KEY: {{ .Values.secretEnv.PLACES_API_KEY | b64enc | quote }}
-  {{- end }}
   {{- if .Values.secretEnv.AMAP_API_KEY }}
   AMAP_API_KEY: {{ .Values.secretEnv.AMAP_API_KEY | b64enc | quote }}
   {{- end }}
   {{- if .Values.secretEnv.AMAP_API_SECRET }}
   AMAP_API_SECRET: {{ .Values.secretEnv.AMAP_API_SECRET | b64enc | quote }}
   {{- end }}
-  {{- if .Values.secretEnv.VAPID_PRIVATE_KEY }}
-  VAPID_PRIVATE_KEY: {{ .Values.secretEnv.VAPID_PRIVATE_KEY | b64enc | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.SMTP_PASS }}
-  SMTP_PASS: {{ .Values.secretEnv.SMTP_PASS | b64enc | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.MAPBOX_ACCESS_TOKEN }}
-  MAPBOX_ACCESS_TOKEN: {{ .Values.secretEnv.MAPBOX_ACCESS_TOKEN | b64enc | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.CARTO_API_KEY }}
-  CARTO_API_KEY: {{ .Values.secretEnv.CARTO_API_KEY | b64enc | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.DEMO_ADMIN_PASS }}
-  DEMO_ADMIN_PASS: {{ .Values.secretEnv.DEMO_ADMIN_PASS | b64enc | quote }}
-  {{- end }}
 {{- end }}
 
 {{- if and (not .Values.existingSecret) (.Values.generateEncryptionKey) }}
@@ -58,44 +40,26 @@ metadata:
 type: Opaque
 stringData:
   {{- if and $existingSecret $existingSecret.data }}
-  {{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}: {{ index $existingSecret.data (.Values.existingSecretKey | default "ENCRYPTION_KEY") | b64dec | quote }}
+  {{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}: {{ index $existingSecret.data (.Values.existingSecretKey | default "ENCRYPTION_KEY") | b64dec }}
   {{- else }}
-  {{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}: {{ randAlphaNum 32 | quote }}
+  {{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}: {{ randAlphaNum 32 }}
   {{- end }}
   {{- if .Values.secretEnv.ADMIN_EMAIL }}
-  ADMIN_EMAIL: {{ .Values.secretEnv.ADMIN_EMAIL | quote }}
+  ADMIN_EMAIL: {{ .Values.secretEnv.ADMIN_EMAIL }}
   {{- end }}
   {{- if .Values.secretEnv.ADMIN_PASSWORD }}
-  ADMIN_PASSWORD: {{ .Values.secretEnv.ADMIN_PASSWORD | quote }}
+  ADMIN_PASSWORD: {{ .Values.secretEnv.ADMIN_PASSWORD }}
   {{- end }}
   {{- if .Values.secretEnv.OIDC_CLIENT_SECRET }}
-  OIDC_CLIENT_SECRET: {{ .Values.secretEnv.OIDC_CLIENT_SECRET | quote }}
+  OIDC_CLIENT_SECRET: {{ .Values.secretEnv.OIDC_CLIENT_SECRET }}
   {{- end }}
   {{- if .Values.secretEnv.UNSPLASH_ACCESS_KEY }}
-  UNSPLASH_ACCESS_KEY: {{ .Values.secretEnv.UNSPLASH_ACCESS_KEY | quote }}
+  UNSPLASH_ACCESS_KEY: {{ .Values.secretEnv.UNSPLASH_ACCESS_KEY }}
-  {{- end }}
-  {{- if .Values.secretEnv.PLACES_API_KEY }}
-  PLACES_API_KEY: {{ .Values.secretEnv.PLACES_API_KEY | quote }}
   {{- end }}
   {{- if .Values.secretEnv.AMAP_API_KEY }}
-  AMAP_API_KEY: {{ .Values.secretEnv.AMAP_API_KEY | quote }}
+  AMAP_API_KEY: {{ .Values.secretEnv.AMAP_API_KEY }}
   {{- end }}
   {{- if .Values.secretEnv.AMAP_API_SECRET }}
-  AMAP_API_SECRET: {{ .Values.secretEnv.AMAP_API_SECRET | quote }}
+  AMAP_API_SECRET: {{ .Values.secretEnv.AMAP_API_SECRET }}
-  {{- end }}
-  {{- if .Values.secretEnv.VAPID_PRIVATE_KEY }}
-  VAPID_PRIVATE_KEY: {{ .Values.secretEnv.VAPID_PRIVATE_KEY | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.SMTP_PASS }}
-  SMTP_PASS: {{ .Values.secretEnv.SMTP_PASS | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.MAPBOX_ACCESS_TOKEN }}
-  MAPBOX_ACCESS_TOKEN: {{ .Values.secretEnv.MAPBOX_ACCESS_TOKEN | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.CARTO_API_KEY }}
-  CARTO_API_KEY: {{ .Values.secretEnv.CARTO_API_KEY | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.DEMO_ADMIN_PASS }}
-  DEMO_ADMIN_PASS: {{ .Values.secretEnv.DEMO_ADMIN_PASS | quote }}
   {{- end }}
 {{- end }}

charts/trek/templates/service.yaml

@@ -8,7 +8,7 @@ spec:
   type: {{ .Values.service.type }}
   ports:
     - port: {{ .Values.service.port }}
-      targetPort: http
+      targetPort: 3000
       protocol: TCP
       name: http
   selector:

charts/trek/values.yaml

@@ -4,10 +4,9 @@ image:
   # tag: latest
   pullPolicy: IfNotPresent
 
-# Deployment update strategy. Keep Recreate: TREK is a single-writer SQLite app, and
+# Deployment update strategy. Recreate is the safe default for the single-writer SQLite
-# during a RollingUpdate the new pod migrates the database while the old one still
+# DB on a ReadWriteOnce volume (the old pod is torn down before the new one starts).
-# writes to it. A ReadWriteMany volume does not make that safe; SQLite's WAL needs both
+# Set to RollingUpdate only if you back the data volume with ReadWriteMany storage.
-# processes on one host, which network filesystems do not provide.
 updateStrategy: Recreate
 
 # Optional image pull secrets for private registries
@@ -34,7 +33,7 @@ env:
   # DEFAULT_LANGUAGE: "en"
   # Default language on the login page for users with no saved preference.
   # Browser/OS language is auto-detected first; this is the fallback when no match is found.
-  # Supported: ar, az, br, ca, cs, de, en, es, et, fr, gr, hu, id, it, ja, ko, nl, pl, ru, sk, sv, th, tr, uk, vi, zh, zh-TW
+  # Supported: de, en, es, fr, hu, nl, br, cs, pl, ru, zh, zh-TW, it, ar
   # ALLOWED_ORIGINS: ""
   # NOTE: If using ingress, ensure env.ALLOWED_ORIGINS matches the domains in ingress.hosts for proper CORS configuration.
   # APP_URL: "https://trek.example.com"
@@ -72,16 +71,10 @@ env:
   # OIDC claim used to identify admin users.
   # OIDC_ADMIN_VALUE: ""
   # Value of the OIDC claim that grants admin role.
-  # OIDC_USERNAME_CLAIM: ""
-  # Claim a new account's username comes from, e.g. "preferred_username". Unset: name, then preferred_username.
   # OIDC_SCOPE: "openid email profile groups"
   # Space-separated OIDC scopes to request. Must include scopes for any claim used by OIDC_ADMIN_CLAIM.
   # OIDC_DISCOVERY_URL: ""
   # Override the OIDC discovery endpoint for providers with non-standard paths (e.g. Authentik).
-  # HTTP_PROXY: ""
-  # HTTPS_PROXY: ""
-  # NO_PROXY: "localhost,127.0.0.1"
-  # Outbound proxy for TREK's requests to the internet; NO_PROXY lists hosts that bypass it.
   # DEMO_MODE: "false"
   # Enable demo mode (hourly data resets).
   # MCP_RATE_LIMIT: "300"
@@ -115,15 +108,6 @@ env:
   # Send the Amap (高德地图) calls through an egress proxy, a cache or a gateway that speaks the same API instead of
   # restapi.amap.com directly. The key itself is a credential and goes under secretEnv.AMAP_API_KEY, or into
   # Admin > Settings > API Keys. Defaults to https://restapi.amap.com.
-  # VAPID_PUBLIC_KEY: ""
-  # Web Push key pair, public half (base64url, 65 bytes). Leave both halves empty and TREK generates a pair on
-  # first start and keeps it in the database, so it travels with backups. To use your own pair, set this and
-  # secretEnv.VAPID_PRIVATE_KEY together, e.g. from `npx web-push generate-vapid-keys`. Changing the pair later
-  # means every device has to turn push on again.
-  # VAPID_SUBJECT: ""
-  # The contact push services see with every Web Push message: a mailto: address or an https:// URL. Defaults to
-  # APP_URL when it is an https:// address other than localhost, else https://github.com/liketrek/TREK. No email
-  # address is sent unless you set one here.
 
 
 # Secret environment variables stored in a Kubernetes Secret.
@@ -149,11 +133,6 @@ secretEnv:
   # Get a free key at https://unsplash.com/developers. Can also be set per-admin
   # in Admin > Settings; this value overrides that. Leave empty to disable.
   UNSPLASH_ACCESS_KEY: ""
-  # Optional Google Maps API key (Places API (New) enabled) for place search, photos,
-  # details and Google transit. Overrides the key set in Admin > Settings > API Keys,
-  # whose field then shows this variable read-only. Leave empty to use the key from the
-  # admin panel, or none.
-  PLACES_API_KEY: ""
   # Optional Amap (高德地图) Web 服务 key for place search and geocoding inside mainland
   # China. Overrides the key set in Admin > Settings > API Keys. A Web 端 (JS API) key is
   # a different credential and is rejected with INVALID_USER_KEY. Leave empty to use the
@@ -163,25 +142,11 @@ secretEnv:
   # with signing enabled, because such a key rejects every unsigned request. Leave empty
   # otherwise. The endpoint itself is not a secret and is set under env.AMAP_API_BASE.
   AMAP_API_SECRET: ""
-  # Optional Web Push key pair, private half (base64url, 32 bytes). Only used together with
-  # env.VAPID_PUBLIC_KEY; a pair whose halves do not belong together, or only one half, turns
-  # push off with an error in the log until it is fixed, and every device stays registered.
-  # Leave both empty to let TREK keep a generated pair in its database.
-  VAPID_PRIVATE_KEY: ""
 
-# If true, a random ENCRYPTION_KEY is generated at install and preserved across upgrades.
+# If true, a random ENCRYPTION_KEY is generated at install and preserved across upgrades
-# Only with helm install/upgrade against the cluster: under `helm template`, ArgoCD or Flux
-# the chart cannot read the existing secret and renders a new key every time. TREK then
-# refuses to start rather than lose its secrets; use existingSecret in those setups.
 generateEncryptionKey: false
 
-# If set, the chart renders no Secret of its own and instead reads every secret env
+# If set, use an existing Kubernetes secret that contains ENCRYPTION_KEY
-# var from this existing Kubernetes secret. Expected keys: ENCRYPTION_KEY (rename via
-# existingSecretKey), ADMIN_EMAIL, ADMIN_PASSWORD, OIDC_CLIENT_SECRET,
-# UNSPLASH_ACCESS_KEY, PLACES_API_KEY, AMAP_API_KEY, AMAP_API_SECRET,
-# VAPID_PRIVATE_KEY, SMTP_PASS, MAPBOX_ACCESS_TOKEN, CARTO_API_KEY, DEMO_ADMIN_PASS.
-# Missing keys are simply left unset (they are optional), so only provide the ones your
-# setup needs.
 existingSecret: ""
 existingSecretKey: ENCRYPTION_KEY
 
@@ -207,40 +172,20 @@ persistence:
 # httpGet handler. Switching handler means clearing the old one in the same override
 # (httpGet: null together with tcpSocket), otherwise the API rejects the pod with
 # "may not specify more than 1 handler type". Set probes.liveness to null to drop a probe.
-#
-# The startup probe gives a first boot, a long migration or a restore at boot up to ten
-# minutes before liveness takes over; liveness alone killed such a boot after about
-# 105 s, and the next start began it again. Readiness asks the database, so a pod whose
-# database does not answer stops getting traffic without being restarted.
 probes:
-  startup:
-    httpGet:
-      path: /api/health
-      port: http
-    periodSeconds: 10
-    failureThreshold: 60
   liveness:
     httpGet:
       path: /api/health
-      port: http
+      port: 3000
+    initialDelaySeconds: 15
     periodSeconds: 30
   readiness:
     httpGet:
-      path: /api/health/ready
+      path: /api/health
-      port: http
+      port: 3000
+    initialDelaySeconds: 5
     periodSeconds: 10
 
-# Further environment variables, for any setting the env block above does not list.
-#   extraEnv:
-#     - name: SESSION_DURATION
-#       value: 7d
-extraEnv: []
-# Whole ConfigMaps or Secrets:
-#   extraEnvFrom:
-#     - secretRef:
-#         name: trek-smtp
-extraEnvFrom: []
-
 resources:
   requests:
     cpu: 100m

client/.gitignore

@@ -6,4 +6,7 @@ playwright/.cache/
 
 # vite-plugin-pwa dev output (devOptions.enabled)
 dev-dist/
-e2e/help/media.env
+
+# The native apps' address screen (npm run build:native), copied into
+# android/ and ios/ by `cap sync`
+native-dist/

client/CLAUDE.md

@@ -8,28 +8,15 @@ Scope: the **`@trek/client`** workspace (React 19 + Vite + Zustand + Tailwind PW
 npm run dev               # Vite dev server; proxies the API/ws/uploads/MCP/OAuth paths → http://localhost:3001
 npm run build             # prebuild generates PWA icons, then vite build
 npm run typecheck         # tsc --noEmit (CI)
-npm run lint:strict       # tsc over tsconfig.strict.json (strictNullChecks + noImplicitAny): errors per file may only shrink against scripts/strict-baseline.json, a new file starts at zero (CI gate; --list shows them, --update lowers it)
+npm run lint              # eslint .   (lint:check in CI)
-npm run lint              # eslint .   (CI runs lint:warnings instead, which fails on the same errors)
-npm run lint:warnings     # eslint (typed), failing on any error and on any warning count per rule above scripts/eslint-baseline.json and on any entry above its count (app code, tests and eslint-disable'd messages counted apart; a `/* eslint <rule>: ... */` config comment fails outright; --update lowers it). Frozen as warnings: floating/misused promises, `.catch(() => {})` (trek/no-swallowed-catch), react-hooks v7 recommended, complexity/max-depth/max-params/max-lines-per-function (120 per .ts function, 300 per .tsx), `use*Store()` without a selector, `window.__*` and window.dispatchEvent buses (trek/no-window-globals), no-console, no-non-null-assertion; the local rules live in scripts/lib/eslint-rules.mjs
 npm run lint:pages        # enforce the Page pattern (CI gate)
-npm run lint:rtl          # physical left/right sides and rtl-lint-disable comments may only shrink per file (CI gate; --list shows them, --update lowers both baselines)
-npm run lint:size         # no source file or stylesheet past 1000 lines, no test (Playwright specs and fixtures under e2e/ included) past 2000, counted wrapped at 120 columns; longer ones may only shrink (CI gate; --update lowers the baseline)
-npm run lint:format       # Prettier: every .ts/.tsx/.mjs/.css file under src/, tests/, e2e/ and scripts/ outside scripts/format-baseline.json must be formatted, the list only shrinks (CI gate; npx prettier --write <file>, then --update)
-npm run lint:layers       # imports go downwards: components never import pages/ or mobile/, nothing under the views imports a view; per-file counts may only shrink (CI gate; --list, --update)
-npm run lint:offline      # no view file (components/mobile/pages/hooks) imports src/api/ beyond scripts/offline-baseline.json, which only shrinks (CI gate; --list, --update)
-npm run lint:pairs        # each desktop/phone pair in scripts/feature-pairs.json imports its shared hooks, and every file under src/mobile/screens is listed there, in a pair or under mobileOnly with a reason (CI gate; --list prints the pairs)
-npm run lint:dup          # copied code: the lines of a file inside a block that repeats elsewhere (100 tokens over 10 lines, SonarCloud's thresholds; .ts and .tsx read as one language) may only shrink against scripts/dup-baseline.json (CI gate; --list shows each block with its other side, --update lowers it)
-npm run lint:skips        # no .only anywhere; skipped/todo/fixme tests per file may only shrink against scripts/skip-baseline.json (CI gate; skipIf/runIf and Playwright's test.skip(condition, 'why') are fine, but skipIf(true) and runIf(false) count as skips)
-npm run lint:i18n-keys    # every translation key src/ names exists in shared en, and en keys nothing in src/, server/src or plugin-sdk/src reaches may only shrink per en file against scripts/i18n-unused-baseline.json (CI gate; --unused lists them, --update lowers the baseline)
 npm run test              # vitest run (tests/** + co-located src/**/*.test.{ts,tsx}); also test:unit / test:integration / test:coverage
-npm run e2e               # Playwright (CI runs --project=public --project=app; e2e:report opens the last report)
+npm run e2e               # Playwright (local only; e2e:report opens the last report)
 npm run shots             # Playwright screenshot project (shots:promote to accept)
-npm run theme:lint        # colour literals, palette classes, raw text sizes, z-index literals above z-50 and dark_mode reads may only shrink per file, theme-lint-disable markers too (CI gate; --list shows them, --update lowers both baselines)
+npm run theme:lint        # theme conformance audit (theme:lint:strict exits 1; local only)
-npm run check:gl-split    # after build: fails if one chunk bundles both mapbox-gl and maplibre-gl (CI gate)
+npm run check:gl-split    # after build: fails if one chunk bundles both mapbox-gl and maplibre-gl (local only)
 ```
 
-Every baseline ratchet above also fails on an entry that allows more than the tree holds: a count above what its file or rule has now, or a file that is gone. Run the check with `--update` in the change that made it smaller, so a fixed file cannot grow back to its old entry and a new file at a deleted path does not inherit one.
-
 Single test: `npx vitest run src/store/slices/budgetSlice.test.ts`, or `npx vitest run -t "optimistically adds the place"`.
 
 The dev server needs the API on **:3001** — run `npm run dev` at the repo root to start both.
@@ -45,16 +32,15 @@ The layering is **component → feature hook → store/slice → `repo/` → `ap
 - **`src/store/`** — Zustand. `tripStore.ts` is composed from slices in `store/slices/`; `slices/remoteEventHandler.ts` applies inbound WebSocket events to local state.
 - **`src/repo/`** — per-entity repositories mediating between the network and the offline cache: online, call REST and upsert into Dexie; offline, read Dexie. Always go through a repo for trip data.
 - **`src/api/client.ts`** — the single Axios instance, typed from `@trek/shared`. New API surface goes in a per-domain `api/<domain>.ts`, not the god module.
-- **`src/db/offlineDb.ts`** — the Dexie schema. Database and table names are the on-device contract — renaming one orphans every user's cache. Versions are append-only: a new `this.version(N)` adds its stores to `HISTORY` and a case to `UPGRADE_CASES` in `tests/unit/db/offlineDb.upgrade.test.ts`, which opens the previous version with seeded rows in fake-indexeddb and upgrades it to the current one; a guard there fails on a declared version without both. Never edit a shipped version's stores or `upgrade()`.
+- **`src/db/offlineDb.ts`** — the Dexie schema. Database and table names are the on-device contract — renaming one orphans every user's cache.
-- **`src/sync/`**: in `mutationQueue.ts`, offline writes do an optimistic Dexie write (temporary **negative id** for creates), then `flush()` replays REST on reconnect with the mutation's UUID as the **`X-Idempotency-Key`** header (matching the server interceptor) and reconciles the row. Writes to one entity keep their order: a write parked as `failed` or `conflict` holds back the later writes to the same `resource` + entity id until the user retries, resolves or discards it, and only that action deletes a parked row (trip eviction never does). Every row `enqueue()` writes carries `schemaVersion` (`MUTATION_SCHEMA_VERSION` in `offlineDb.ts`) and `buildVersion`; bump the constant when a row's fields or the way the replay reads them change incompatibly. A flush replays its own format and older ones (an unstamped row is format 1) and skips a row from a newer format without sending, marking or dropping it, holding back the later writes to its entity, so a tab still on an older bundle never replays a shape it does not know. The guard exists only from the release that introduced `schemaVersion` on; a bundle older than that replays every row, so the first bump of `MUTATION_SCHEMA_VERSION` must not ship while a rollback target older than the guard is still in play. A skipped row stays `pending` with no retry or discard path, so on a rolled-back install it holds its entity until the user clears the cache. Repos whose writes carry no version token (visits, day clears, tours, driving settings) ask `mutationQueue.mustQueue()` before an online write and queue it while an older write to the entity is still queued, so a retried write cannot land over a newer one made here online; places and packing items send `X-Base-Updated-At`, so the server refuses the stale replay with a 409 instead. `flush()` takes the Web Lock `trek-mutation-flush:<db name>` so only one tab replays at a time; a tab that finds it taken waits for it, and a `flush()` called while this tab's flush runs or waits for the lock gets that same flush back (with one more pass asked for), so `flush()` never resolves while a tab is still replaying and a re-seed chained onto it cannot lay older server rows over those writes (the in-tab flush alone where the API is missing). The rest of the directory drives reconnection sync, the auth gate that stops background loops before logout swaps the DB, offline preferences, and map pre-download (raster and vector prefetchers).
+- **`src/sync/`** — `mutationQueue.ts`: offline writes do an optimistic Dexie write (temporary **negative id** for creates), then `flush()` replays REST on reconnect with the mutation's UUID as the **`X-Idempotency-Key`** header (matching the server interceptor) and reconciles the row. The rest of the directory drives reconnection sync, the auth gate that stops background loops before logout swaps the DB, offline preferences, and map pre-download (raster and vector prefetchers).
 
 ## Rules for new code
 
 The offline core is flagship work surrounded by a periphery that ignores it. New code extends the core's discipline, not the periphery's shortcuts:
 
-- **One data path, no layer skips.** Never import `api/client` (or raw fetch/axios) from a component or modal, and especially never *write* from one. `lint:offline` enforces it: a file under `components/`, `mobile/`, `pages/` or `hooks/` may not import anything from `src/api/` except types. The long tail that already does is listed in `scripts/offline-baseline.json`; the list only shrinks (a file that stops leaves it via `--update`) and is debt, not precedent. A domain that is online-only on purpose (admin, auth) still puts its calls in a store or repo, not in the view.
+- **One data path, no layer skips.** Never import `api/client` (or raw fetch/axios) from a component or modal — especially never *write* from one. A long tail of existing files bypasses the layering and no lint ratchet holds the line yet; that is debt, not precedent.
 - **Offline-first is the product promise.** New domains get a repo with read-through and offline writes (temp id → optimistic Dexie write → idempotent queue entry). If a domain is deliberately online-only, say so explicitly.
-- **Imports go downwards** (`lint:layers`, rules in `scripts/lib/layers.mjs`). A component never imports `pages/` or `mobile/`, a shared hook no view, and stores, repos, sync, api, db and the helpers no view at all; a file directly in `src/` is the layer of its name, so `src/types.ts` follows the `types/` rules. A model or helper both sides need moves down (`utils/`, `hooks/`, `types/`); the counts in `scripts/layers-baseline.json` are debt, not precedent.
 - **No god components or god hooks.** The page pattern is a floor, not a ceiling. Decompose hooks by concern, split renders into memoizable sections, and don't pass huge prop bags with inline-arrow callbacks.
 - **Prefer React 19 idioms**: `useOptimistic`, `useActionState`/`useFormStatus`, `use()` + Suspense, `useSyncExternalStore` for external subscriptions (`hooks/useNetworkMode` is the reference).
 - **Optimistic writes must reconcile** — rollback + user-visible toast on failure. No `.catch(() => {})`, no bare `catch {}`.
@@ -64,25 +50,19 @@ The offline core is flagship work surrounded by a periphery that ignores it. New
 - **Rendering security**: never interpolate user content into HTML strings (map popups included — build via DOM + `textContent`, or `escapeHtml` from `@trek/shared`); untrusted markdown gets `rehype-sanitize`; never `rehype-raw` near it.
 - **No `window` event buses or global mutable `window` state.** No `any` at boundaries: WS payloads and map renderer props get real types.
 - **Hygiene**: error boundaries around new shells/routes (`components/shared/ErrorBoundary.tsx`); every async `.then(setState)` needs a cancelled flag or `AbortController`; no routine `eslint-disable exhaustive-deps` (a missing dep has already shipped wrong money on screen); no sequential-await N+1 fetch loops; search for an existing utility before writing a duplicate.
-- **Theming**: use the semantic Tailwind tokens defined in `tailwind.config.js` (`bg-surface*`, `text-content*`, `border-edge*`, `bg-accent*`, status colors) — no palette classes, hex literals, arbitrary-value color classes, or invented CSS vars. Only `applyAppearance()` in `src/theme/` mutates `<html>` styling (see `src/theme/README.md`). `theme:lint` counts literals, `bg-[#...]`-style and palette classes, raw `text-sm`- and `text-[13px]`-style sizes, z-index literals and `dark_mode` reads per file against `scripts/theme-baseline.json`.
+- **Theming**: use the semantic Tailwind tokens defined in `tailwind.config.js` (`bg-surface*`, `text-content*`, `border-edge*`, `bg-accent*`, status colors) — no palette classes, hex literals, arbitrary-value color classes, or invented CSS vars. Only `applyAppearance()` in `src/theme/` mutates `<html>` styling (see `src/theme/README.md`). `theme:lint` catches literals and `bg-[#...]`-style classes but not named palette classes — review those by hand.
 
 ## Big-picture pieces
 
 - **Maps** (`src/components/Map/`): two interchangeable renderers — Leaflet and Mapbox/MapLibre GL — chosen at runtime by `MapViewAuto.tsx`. Keep both in sync when changing map features, and keep `mapbox-gl` and `maplibre-gl` in separate chunks (`check:gl-split`). The raster prefetcher fetches tiles `no-cors` so custom tile providers without CORS headers keep working; the vector prefetcher deliberately uses `cors` because it has to read the responses — don't "align" one with the other.
-- **i18n** (`src/i18n/TranslationContext.tsx`): `en` is bundled; every other locale is a dynamic `import('@trek/shared/i18n/<locale>')` so Vite emits one chunk per locale. Strings live in `shared/`, never here. `t()` returns an unknown key unchanged, so `lint:i18n-keys` (`scripts/i18n-keys.mjs`) resolves every literal key in `t()`, `tHtml()`, `tr()`, `<TransHtml html>`, `translateApiError` and `*Key` props against `shared/src/i18n/en`; a template whose interpolations only choose between string literals is expanded and each branch checked as a key; any other template key is read with each interpolation as one key segment and passes by itself only when it reaches between 1 and `MAX_IMPLICIT_MATCHES` (30) en keys; a wider one, or one with no fixed dotted prefix, needs a `DYNAMIC_ALLOWED` entry keyed by file and template that says what bounds the value, and an entry the check no longer needs fails. Pass counts as numbers, and let a plural group pick the wording instead of switching keys on the count.
+- **i18n** (`src/i18n/TranslationContext.tsx`): `en` is bundled; every other locale is a dynamic `import('@trek/shared/i18n/<locale>')` so Vite emits one chunk per locale. Strings live in `shared/`, never here.
-- **Mobile shell** (`src/mobile/`): below the phone breakpoint (`useIsPhone`) `App.tsx` wraps routes in `MobileShell` and the `M*` screens under `mobile/screens/` take over. A UI change to a domain with an `M*` twin usually needs both, and the logic change goes into the shared hook (see "Desktop and phone views" below).
+- **Mobile shell** (`src/mobile/`): below the phone breakpoint (`useIsPhone`) `App.tsx` wraps routes in `MobileShell` and the `M*` screens under `mobile/screens/` take over. A UI change to a domain with an `M*` twin usually needs both — and the shared-hook rule below.
 - **Plugins UI** (`src/components/Plugins/`): third-party surfaces render only inside the sandboxed `PluginFrame` iframe (postMessage bridge, live theme-token sync). Host-rendered contribution points (widgets, schedule rows, map layers, planner columns/actions) render server-normalized primitives only — plugin markup never runs inline. Authoring is covered by the `trek-plugin-dev` skill.
 - **Managed installs** (`src/managed/index.tsx`): the attachment point for screens that only exist on a centrally administered install. Empty here by design — an operator replaces it at build time. Don't put features there.
 
-## Desktop and phone views
+## Desktop ↔ mobile shells and the SonarQube duplication gate
 
-Most features have a desktop view (`components/`, `pages/`) and a phone view (`mobile/screens/`). They share one hook or model per feature that holds the logic (state, effects, loading, handlers, validation, derived values, store and repo calls); each view keeps only its own markup, layout and dialogs or sheets. `useInstanceSettings` and `useRangeBypass` under `components/Admin/` show the shape. `scripts/feature-pairs.json` lists every pair with its hooks.
+Every desktop component with a phone twin is a deliberate copy that is already heavily duplicated. CI's SonarCloud gate allows **≤ 3% duplicated lines on the PR's new code**, so adding the same lines to both shells fails the PR by itself. Put logic in one shared hook/module (`useInstanceSettings`, `useRangeBypass` under `components/Admin/` are the pattern) and keep only markup in each shell. Full gate rules in the root `CLAUDE.md`.
-
-- **Changing a feature:** change the shared hook, not one view. A behaviour that really differs between the two views is a parameter of the hook, so both stay visible in one place and its test covers both.
-- **A new feature with both views:** write the hook first under `components/<Feature>/` (or `hooks/`/`utils/` when it is not bound to one feature; a page's own logic stays in its `use<Page>` hook and models in `pages/<page>/`, which the phone shell imports too), give it its own test, build both views on it and add the pair to `scripts/feature-pairs.json`.
-- **A new phone screen:** list it in `scripts/feature-pairs.json`, as a view of the pair whose hook it runs on or under `mobileOnly` with the reason it has no twin. A file under `mobile/screens/` that is in neither fails `lint:pairs`.
-
-Two CI gates hold this: `lint:pairs` fails when a listed view stops importing its pair's hook or a phone screen is not listed, and `lint:dup` holds the lines inside copied blocks to `scripts/dup-baseline.json`, so a copy that looks alike fails too. SonarCloud allows **≤ 3% duplicated lines on the PR's new code**, so the same lines added to both views fail a PR by themselves. Full gate rules in the root `CLAUDE.md`.
 
 ## Tests
 

client/android/.gitignore

@@ -0,0 +1,107 @@
+# Using Android gitignore template: https://github.com/github/gitignore/blob/HEAD/Android.gitignore
+
+# Built application files
+*.apk
+*.aar
+*.ap_
+*.aab
+
+# Files for the ART/Dalvik VM
+*.dex
+
+# Java class files
+*.class
+
+# Generated files
+bin/
+gen/
+out/
+#  Uncomment the following line in case you need and you don't have the release build type files in your app
+# release/
+
+# Gradle files
+.gradle/
+build/
+
+# Local configuration file (sdk path, etc)
+local.properties
+
+# Proguard folder generated by Eclipse
+proguard/
+
+# Log Files
+*.log
+
+# Android Studio Navigation editor temp files
+.navigation/
+
+# Android Studio captures folder
+captures/
+
+# IntelliJ
+*.iml
+.idea/workspace.xml
+.idea/tasks.xml
+.idea/gradle.xml
+.idea/assetWizardSettings.xml
+.idea/dictionaries
+.idea/libraries
+# Android Studio 3 in .gitignore file.
+.idea/caches
+.idea/modules.xml
+# Comment next line if keeping position of elements in Navigation Editor is relevant for you
+.idea/navEditor.xml
+
+# Keystore files
+# Uncomment the following lines if you do not want to check your keystore files in.
+#*.jks
+#*.keystore
+
+# External native build folder generated in Android Studio 2.2 and later
+.externalNativeBuild
+.cxx/
+
+# Google Services (e.g. APIs or Firebase)
+# Deliberately ignored: this file pins the build to one Firebase project.
+# Committing it would make every fork's builds register against the upstream
+# FCM project, and rotating the project would become a repo change. Official
+# builds inject it from a CI secret; see google-services.json.example.
+# app/build.gradle already tolerates its absence (push is simply inert).
+google-services.json
+app/google-services.json
+
+# Freeline
+freeline.py
+freeline/
+freeline_project_description.json
+
+# fastlane
+fastlane/report.xml
+fastlane/Preview.html
+fastlane/screenshots
+fastlane/test_output
+fastlane/readme.md
+
+# Version control
+vcs.xml
+
+# lint
+lint/intermediates/
+lint/generated/
+lint/outputs/
+lint/tmp/
+# lint/reports/
+
+# Android Profiling
+*.hprof
+
+# Cordova plugins for Capacitor
+capacitor-cordova-android-plugins
+
+# Copied web assets
+app/src/main/assets/public
+
+# Generated Config files
+app/src/main/assets/capacitor.config.json
+app/src/main/assets/capacitor.plugins.json
+app/src/main/res/xml/config.xml

client/android/app/.gitignore

@@ -0,0 +1,2 @@
+/build/*
+!/build/.npmkeep

client/android/app/build.gradle

@@ -0,0 +1,55 @@
+apply plugin: 'com.android.application'
+
+android {
+    namespace = "com.liketrek.trek"
+    compileSdk = rootProject.ext.compileSdkVersion
+    defaultConfig {
+        applicationId "com.liketrek.trek"
+        minSdkVersion rootProject.ext.minSdkVersion
+        targetSdkVersion rootProject.ext.targetSdkVersion
+        versionCode 1
+        versionName "1.0"
+        testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
+        aaptOptions {
+             // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.
+             // Default: https://android.googlesource.com/platform/frameworks/base/+/282e181b58cf72b6ca770dc7ca5f91f135444502/tools/aapt/AaptAssets.cpp#61
+            ignoreAssetsPattern = '!.svn:!.git:!.ds_store:!*.scc:.*:!CVS:!thumbs.db:!picasa.ini:!*~'
+        }
+    }
+    buildTypes {
+        release {
+            minifyEnabled false
+            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
+        }
+    }
+}
+
+repositories {
+    flatDir{
+        dirs '../capacitor-cordova-android-plugins/src/main/libs', 'libs'
+    }
+}
+
+dependencies {
+    implementation fileTree(include: ['*.jar'], dir: 'libs')
+    implementation "androidx.appcompat:appcompat:$androidxAppCompatVersion"
+    implementation "androidx.coordinatorlayout:coordinatorlayout:$androidxCoordinatorLayoutVersion"
+    implementation "androidx.core:core-splashscreen:$coreSplashScreenVersion"
+    implementation "androidx.browser:browser:$androidxBrowserVersion"
+    implementation project(':capacitor-android')
+    testImplementation "junit:junit:$junitVersion"
+    androidTestImplementation "androidx.test.ext:junit:$androidxJunitVersion"
+    androidTestImplementation "androidx.test.espresso:espresso-core:$androidxEspressoCoreVersion"
+    implementation project(':capacitor-cordova-android-plugins')
+}
+
+apply from: 'capacitor.build.gradle'
+
+try {
+    def servicesJSON = file('google-services.json')
+    if (servicesJSON.text) {
+        apply plugin: 'com.google.gms.google-services'
+    }
+} catch(Exception e) {
+    logger.info("google-services.json not found, google-services plugin not applied. Push Notifications won't work")
+}

client/android/app/capacitor.build.gradle

@@ -0,0 +1,25 @@
+// DO NOT EDIT THIS FILE! IT IS GENERATED EACH TIME "capacitor update" IS RUN
+
+android {
+  compileOptions {
+      sourceCompatibility JavaVersion.VERSION_21
+      targetCompatibility JavaVersion.VERSION_21
+  }
+}
+
+apply from: "../capacitor-cordova-android-plugins/cordova.variables.gradle"
+dependencies {
+    implementation project(':capacitor-app')
+    implementation project(':capacitor-filesystem')
+    implementation project(':capacitor-haptics')
+    implementation project(':capacitor-keyboard')
+    implementation project(':capacitor-share')
+    implementation project(':capacitor-splash-screen')
+    implementation project(':capacitor-status-bar')
+
+}
+
+
+if (hasProperty('postBuildExtras')) {
+  postBuildExtras()
+}

client/android/app/proguard-rules.pro

@@ -0,0 +1,21 @@
+# Add project specific ProGuard rules here.
+# You can control the set of applied configuration files using the
+# proguardFiles setting in build.gradle.
+#
+# For more details, see
+#   http://developer.android.com/guide/developing/tools/proguard.html
+
+# If your project uses WebView with JS, uncomment the following
+# and specify the fully qualified class name to the JavaScript interface
+# class:
+#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
+#   public *;
+#}
+
+# Uncomment this to preserve the line number information for
+# debugging stack traces.
+#-keepattributes SourceFile,LineNumberTable
+
+# If you keep the line number information, uncomment this to
+# hide the original source file name.
+#-renamesourcefileattribute SourceFile

client/android/app/src/androidTest/java/com/getcapacitor/myapp/ExampleInstrumentedTest.java

@@ -0,0 +1,26 @@
+package com.getcapacitor.myapp;
+
+import static org.junit.Assert.*;
+
+import android.content.Context;
+import androidx.test.ext.junit.runners.AndroidJUnit4;
+import androidx.test.platform.app.InstrumentationRegistry;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+/**
+ * Instrumented test, which will execute on an Android device.
+ *
+ * @see <a href="http://d.android.com/tools/testing">Testing documentation</a>
+ */
+@RunWith(AndroidJUnit4.class)
+public class ExampleInstrumentedTest {
+
+    @Test
+    public void useAppContext() throws Exception {
+        // Context of the app under test.
+        Context appContext = InstrumentationRegistry.getInstrumentation().getTargetContext();
+
+        assertEquals("com.getcapacitor.app", appContext.getPackageName());
+    }
+}

client/android/app/src/main/AndroidManifest.xml

@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools">
+
+    <application
+        android:allowBackup="true"
+        android:icon="@mipmap/ic_launcher"
+        android:label="@string/app_name"
+        android:networkSecurityConfig="@xml/network_security_config"
+        android:roundIcon="@mipmap/ic_launcher_round"
+        android:supportsRtl="true"
+        android:theme="@style/AppTheme">
+
+        <activity
+            android:configChanges="orientation|keyboardHidden|keyboard|screenSize|locale|smallestScreenSize|screenLayout|uiMode|navigation|density"
+            android:name=".MainActivity"
+            android:label="@string/title_activity_main"
+            android:theme="@style/AppTheme.NoActionBarLaunch"
+            android:launchMode="singleTask"
+            android:exported="true">
+
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+
+            <!-- Deep links.
+
+                 The scheme is @string/custom_url_scheme (com.liketrek.trek).
+                 launchMode is singleTask above, so a link delivers into the
+                 running task via onNewIntent rather than starting a second copy
+                 of the app on top of the first.
+
+                 This is the return path for SSO and passkey sign-in: TrekShell
+                 opens the server's login page in a Custom Tab, and after the
+                 hand-off it redirects to com.liketrek.trek://auth?code=…, which
+                 lands here and in TrekShellPlugin.handleOnNewIntent.
+
+                 Not an App Link (autoVerify + https). App Links are verified
+                 against a specific domain via assetlinks.json, and TREK is
+                 self-hosted — there is no single domain to verify against. A
+                 custom scheme is the only form that works for every user's
+                 server. -->
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="@string/custom_url_scheme" />
+            </intent-filter>
+
+        </activity>
+
+        <provider
+            android:name="androidx.core.content.FileProvider"
+            android:authorities="${applicationId}.fileprovider"
+            android:exported="false"
+            android:grantUriPermissions="true">
+            <meta-data
+                android:name="android.support.FILE_PROVIDER_PATHS"
+                android:resource="@xml/file_paths"></meta-data>
+        </provider>
+
+    </application>
+
+    <!-- Permissions. Only what the WebView itself needs: the file picker's
+         camera option and navigator.geolocation for "locate me" on the map,
+         both granted at runtime through Capacitor's WebChromeClient. -->
+
+    <uses-permission android:name="android.permission.INTERNET" />
+    <!-- COARSE is listed first because it is the weaker grant and is enough
+         for "what city am I in". -->
+    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
+    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
+    <!-- required="false" on purpose: TREK is a planner, and everything except
+         "locate me" works without GPS hardware. Marking it required would have
+         Play hide the app from tablets and other GPS-less devices. -->
+    <uses-feature android:name="android.hardware.location.gps" android:required="false" />
+    <uses-permission android:name="android.permission.CAMERA" />
+    <uses-feature android:name="android.hardware.camera" android:required="false" />
+</manifest>

client/android/app/src/main/java/com/liketrek/trek/MainActivity.java

@@ -0,0 +1,50 @@
+package com.liketrek.trek;
+
+import android.content.Intent;
+import android.os.Bundle;
+import android.view.View;
+import com.getcapacitor.BridgeActivity;
+
+public class MainActivity extends BridgeActivity {
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        registerPlugin(TrekShellPlugin.class);
+        // With a server picked, the WebView loads that server instead of the
+        // bundled address screen, so the UI arrives in the version the server
+        // runs and on its own origin. BridgeActivity reads `config` while it
+        // builds the bridge inside super.onCreate().
+        boolean restarting = TrekServerStore.consumeRestart(this);
+        String server = TrekServerStore.getUrl(this);
+        boolean onServer = server != null && !TrekServerStore.consumeShellOnce(this);
+        config = TrekServerStore.configFor(this, onServer ? server : null, restarting);
+        super.onCreate(savedInstanceState);
+        if (bridge == null) return;
+        // The UI asks for no overscroll effect (overscroll-behavior: none on html)
+        // and Chrome honours that, but the WebView draws the stretch on its root
+        // scroller natively. It scales the whole view, top bar and bottom dock included.
+        bridge.getWebView().setOverScrollMode(View.OVER_SCROLL_NEVER);
+        // Set before any WebView callback can run: they are posted to this thread.
+        if (onServer) bridge.setWebViewClient(new TrekWebViewClient(bridge, this::showAddressScreen));
+    }
+
+    private boolean leavingServer;
+
+    /**
+     * The server did not load: back to the address screen, which offers retry
+     * and change. A fresh task rather than recreate(), because this usually
+     * happens during launch, while the system splash is still up, and a
+     * recreated activity leaves that splash lying over the new page.
+     */
+    private void showAddressScreen() {
+        // A failed page can report more than one error; restart only once.
+        if (leavingServer) return;
+        leavingServer = true;
+        TrekServerStore.showShellOnce(this);
+        TrekServerStore.markRestart(this);
+        runOnUiThread(() -> {
+            startActivity(new Intent(this, MainActivity.class).addFlags(Intent.FLAG_ACTIVITY_NEW_TASK | Intent.FLAG_ACTIVITY_CLEAR_TASK));
+            overridePendingTransition(0, 0);
+        });
+    }
+}

client/android/app/src/main/java/com/liketrek/trek/TrekServerStore.java

@@ -0,0 +1,123 @@
+package com.liketrek.trek;
+
+import android.content.Context;
+import android.content.SharedPreferences;
+import com.getcapacitor.CapConfig;
+import com.getcapacitor.Logger;
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import org.json.JSONException;
+import org.json.JSONObject;
+
+/** The server the user picked, and the Capacitor configuration that loads it. */
+final class TrekServerStore {
+
+    private static final String PREFS = "trek_shell";
+    private static final String KEY_URL = "server_url";
+    private static final String KEY_SHELL_ONCE = "shell_once";
+    private static final String KEY_RESTART = "restart";
+    private static final String CONFIG_DIR = "trek-server-config";
+
+    private TrekServerStore() {}
+
+    static String getUrl(Context context) {
+        return prefs(context).getString(KEY_URL, null);
+    }
+
+    static void setUrl(Context context, String url) {
+        SharedPreferences.Editor editor = prefs(context).edit();
+        if (url == null) {
+            editor.remove(KEY_URL);
+        } else {
+            editor.putString(KEY_URL, url);
+        }
+        editor.commit();
+    }
+
+    /** Start the next launch on the bundled address screen, even with a server remembered. */
+    static void showShellOnce(Context context) {
+        prefs(context).edit().putBoolean(KEY_SHELL_ONCE, true).commit();
+    }
+
+    static boolean consumeShellOnce(Context context) {
+        return consume(context, KEY_SHELL_ONCE);
+    }
+
+    /** The next onCreate is the app restarting itself, not a launch. */
+    static void markRestart(Context context) {
+        prefs(context).edit().putBoolean(KEY_RESTART, true).commit();
+    }
+
+    static boolean consumeRestart(Context context) {
+        return consume(context, KEY_RESTART);
+    }
+
+    private static boolean consume(Context context, String key) {
+        boolean set = prefs(context).getBoolean(key, false);
+        if (set) prefs(context).edit().remove(key).commit();
+        return set;
+    }
+
+    /**
+     * The bundled capacitor.config.json, adjusted for this start. Capacitor only
+     * takes these settings from a config file, so this writes a copy into the
+     * app's private storage and loads that; null means the bundled one as it is.
+     *
+     * With a server: server.url set, and server.errorPath dropped, because that
+     * page would have no bridge on the server's origin (TrekWebViewClient
+     * handles a failed load instead).
+     *
+     * On a restart: no launch splash. The splash plugin shows it again after
+     * recreate() but cannot take it down when the page hides it early, which
+     * left it covering a fully rendered page. A restart has no launch to cover.
+     */
+    static CapConfig configFor(Context context, String url, boolean restarting) {
+        if (url == null && !restarting) return null;
+        try {
+            JSONObject json = new JSONObject(readAsset(context, "capacitor.config.json"));
+            if (url != null) {
+                JSONObject server = child(json, "server");
+                server.put("url", url);
+                server.remove("errorPath");
+            }
+            if (restarting) {
+                child(child(json, "plugins"), "SplashScreen").put("launchShowDuration", 0);
+            }
+
+            File dir = new File(context.getFilesDir(), CONFIG_DIR);
+            if (!dir.isDirectory() && !dir.mkdirs()) throw new IOException("Cannot create " + dir);
+            try (FileOutputStream out = new FileOutputStream(new File(dir, "capacitor.config.json"))) {
+                out.write(json.toString().getBytes(StandardCharsets.UTF_8));
+            }
+            return CapConfig.loadFromFile(context, dir.getAbsolutePath());
+        } catch (IOException | JSONException ex) {
+            Logger.error("TrekShell", "Could not adjust the app config for " + url, ex);
+            return null;
+        }
+    }
+
+    private static JSONObject child(JSONObject parent, String key) throws JSONException {
+        JSONObject existing = parent.optJSONObject(key);
+        if (existing != null) return existing;
+        JSONObject created = new JSONObject();
+        parent.put(key, created);
+        return created;
+    }
+
+    private static String readAsset(Context context, String name) throws IOException {
+        try (InputStream in = context.getAssets().open(name); ByteArrayOutputStream out = new ByteArrayOutputStream()) {
+            byte[] buffer = new byte[8192];
+            int read;
+            while ((read = in.read(buffer)) != -1) out.write(buffer, 0, read);
+            return out.toString("UTF-8");
+        }
+    }
+
+    private static SharedPreferences prefs(Context context) {
+        return context.getSharedPreferences(PREFS, Context.MODE_PRIVATE);
+    }
+}

client/android/app/src/main/java/com/liketrek/trek/TrekShellPlugin.java

@@ -0,0 +1,149 @@
+package com.liketrek.trek;
+
+import android.content.Intent;
+import android.net.Uri;
+import android.os.Handler;
+import android.os.Looper;
+import androidx.browser.customtabs.CustomTabsIntent;
+import com.getcapacitor.JSObject;
+import com.getcapacitor.Plugin;
+import com.getcapacitor.PluginCall;
+import com.getcapacitor.PluginMethod;
+import com.getcapacitor.annotation.CapacitorPlugin;
+import org.json.JSONObject;
+
+/** The native half of client/src/native/trekShell.ts. */
+@CapacitorPlugin(name = "TrekShell")
+public class TrekShellPlugin extends Plugin {
+
+    /** How long to wait after returning from the browser for the redirect to land. */
+    private static final long CANCEL_GRACE_MS = 600;
+
+    private String authCallId;
+    private String authScheme;
+    private boolean authBrowserOpen;
+    private final Handler handler = new Handler(Looper.getMainLooper());
+
+    @PluginMethod
+    public void getServer(PluginCall call) {
+        String url = TrekServerStore.getUrl(getContext());
+        JSObject result = new JSObject();
+        result.put("url", url == null ? JSONObject.NULL : url);
+        call.resolve(result);
+    }
+
+    @PluginMethod
+    public void setServer(PluginCall call) {
+        String url = call.getString("url");
+        Uri parsed = url == null ? null : Uri.parse(url);
+        if (parsed == null || parsed.getHost() == null || !("https".equals(parsed.getScheme()) || "http".equals(parsed.getScheme()))) {
+            call.reject("A http(s) URL is required");
+            return;
+        }
+        TrekServerStore.setUrl(getContext(), url);
+        call.resolve();
+        restart();
+    }
+
+    @PluginMethod
+    public void resetServer(PluginCall call) {
+        TrekServerStore.setUrl(getContext(), null);
+        call.resolve();
+        restart();
+    }
+
+    @PluginMethod
+    public void reload(PluginCall call) {
+        call.resolve();
+        restart();
+    }
+
+    /** The server URL is part of the bridge's configuration, so it takes a new activity. */
+    private void restart() {
+        TrekServerStore.markRestart(getContext());
+        getActivity().runOnUiThread(() -> getActivity().recreate());
+    }
+
+    @PluginMethod
+    public void authenticate(PluginCall call) {
+        String url = call.getString("url");
+        String scheme = call.getString("callbackScheme");
+        if (url == null || scheme == null) {
+            call.reject("url and callbackScheme are required");
+            return;
+        }
+        rejectPendingAuth("Superseded by a new sign-in");
+        call.setKeepAlive(true);
+        getBridge().saveCall(call);
+        authCallId = call.getCallbackId();
+        authScheme = scheme;
+        authBrowserOpen = true;
+        // A Custom Tab shares the browser's cookies, so a running SSO session at
+        // the identity provider carries over. The redirect back to the app's
+        // scheme arrives through the intent-filter in AndroidManifest.xml.
+        new CustomTabsIntent.Builder().build().launchUrl(getActivity(), Uri.parse(url));
+    }
+
+    @Override
+    protected void handleOnNewIntent(Intent intent) {
+        super.handleOnNewIntent(intent);
+        Uri data = intent.getData();
+        PluginCall call = pendingAuthCall();
+        if (call == null || data == null || !authScheme.equals(data.getScheme())) return;
+        JSObject result = new JSObject();
+        result.put("url", data.toString());
+        call.resolve(result);
+        finishAuth(call);
+    }
+
+    /**
+     * Back in the app without a redirect means the user closed the browser.
+     * onNewIntent runs before onResume when the redirect did arrive, so the
+     * grace period only covers devices that deliver the two out of order.
+     */
+    @Override
+    protected void handleOnResume() {
+        super.handleOnResume();
+        if (!authBrowserOpen) return;
+        authBrowserOpen = false;
+        handler.postDelayed(() -> {
+            PluginCall call = pendingAuthCall();
+            if (call == null) return;
+            call.reject("Sign-in cancelled", "CANCELLED");
+            finishAuth(call);
+        }, CANCEL_GRACE_MS);
+    }
+
+    private PluginCall pendingAuthCall() {
+        return authCallId == null ? null : getBridge().getSavedCall(authCallId);
+    }
+
+    private void rejectPendingAuth(String message) {
+        PluginCall call = pendingAuthCall();
+        if (call == null) return;
+        call.reject(message, "CANCELLED");
+        finishAuth(call);
+    }
+
+    private void finishAuth(PluginCall call) {
+        getBridge().releaseCall(call);
+        authCallId = null;
+        authScheme = null;
+        authBrowserOpen = false;
+    }
+
+    /** iOS only: Android keeps the service worker, which already starts TREK offline. */
+    @PluginMethod
+    public void refreshOfflineCopy(PluginCall call) {
+        JSObject result = new JSObject();
+        result.put("saved", false);
+        call.resolve(result);
+    }
+
+    @PluginMethod
+    public void openOfflineCopy(PluginCall call) {
+        JSObject result = new JSObject();
+        result.put("opened", false);
+        call.resolve(result);
+    }
+}

client/android/app/src/main/java/com/liketrek/trek/TrekWebViewClient.java

@@ -0,0 +1,49 @@
+package com.liketrek.trek;
+
+import android.webkit.WebResourceError;
+import android.webkit.WebResourceRequest;
+import android.webkit.WebResourceResponse;
+import android.webkit.WebView;
+import com.getcapacitor.Bridge;
+import com.getcapacitor.BridgeWebViewClient;
+
+/**
+ * Used while the WebView shows the user's server. When that server cannot be
+ * loaded, Capacitor would show server.errorPath, but on Android it injects
+ * its bridge only into the server's origin, so that local page could neither
+ * retry nor change the server and stayed blank. Instead the app restarts on
+ * the bundled address screen, where the bridge is present and the screen
+ * offers exactly those two things.
+ */
+class TrekWebViewClient extends BridgeWebViewClient {
+
+    private final Runnable onUnreachable;
+
+    TrekWebViewClient(Bridge bridge, Runnable onUnreachable) {
+        super(bridge);
+        this.onUnreachable = onUnreachable;
+    }
+
+    @Override
+    public void onReceivedError(WebView view, WebResourceRequest request, WebResourceError error) {
+        if (request.isForMainFrame()) {
+            onUnreachable.run();
+            return;
+        }
+        super.onReceivedError(view, request, error);
+    }
+
+    /**
+     * Only a 5xx on the page itself means the server is down (a proxy's 502 or
+     * 503 while TREK restarts). A 4xx page is left alone: the server answered,
+     * and TREK serves its UI for every other path.
+     */
+    @Override
+    public void onReceivedHttpError(WebView view, WebResourceRequest request, WebResourceResponse errorResponse) {
+        if (!request.isForMainFrame()) {
+            super.onReceivedHttpError(view, request, errorResponse);
+        } else if (errorResponse.getStatusCode() >= 500) {
+            onUnreachable.run();
+        }
+    }
+}

client/android/app/src/main/res/drawable-v24/ic_launcher_foreground.xml

@@ -0,0 +1,34 @@
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:aapt="http://schemas.android.com/aapt"
+    android:width="108dp"
+    android:height="108dp"
+    android:viewportHeight="108"
+    android:viewportWidth="108">
+    <path
+        android:fillType="evenOdd"
+        android:pathData="M32,64C32,64 38.39,52.99 44.13,50.95C51.37,48.37 70.14,49.57 70.14,49.57L108.26,87.69L108,109.01L75.97,107.97L32,64Z"
+        android:strokeColor="#00000000"
+        android:strokeWidth="1">
+        <aapt:attr name="android:fillColor">
+            <gradient
+                android:endX="78.5885"
+                android:endY="90.9159"
+                android:startX="48.7653"
+                android:startY="61.0927"
+                android:type="linear">
+                <item
+                    android:color="#44000000"
+                    android:offset="0.0" />
+                <item
+                    android:color="#00000000"
+                    android:offset="1.0" />
+            </gradient>
+        </aapt:attr>
+    </path>
+    <path
+        android:fillColor="#FFFFFF"
+        android:fillType="nonZero"
+        android:pathData="M66.94,46.02L66.94,46.02C72.44,50.07 76,56.61 76,64L32,64C32,56.61 35.56,50.11 40.98,46.06L36.18,41.19C35.45,40.45 35.45,39.3 36.18,38.56C36.91,37.81 38.05,37.81 38.78,38.56L44.25,44.05C47.18,42.57 50.48,41.71 54,41.71C57.48,41.71 60.78,42.57 63.68,44.05L69.11,38.56C69.84,37.81 70.98,37.81 71.71,38.56C72.44,39.3 72.44,40.45 71.71,41.19L66.94,46.02ZM62.94,56.92C64.08,56.92 65,56.01 65,54.88C65,53.76 64.08,52.85 62.94,52.85C61.8,52.85 60.88,53.76 60.88,54.88C60.88,56.01 61.8,56.92 62.94,56.92ZM45.06,56.92C46.2,56.92 47.13,56.01 47.13,54.88C47.13,53.76 46.2,52.85 45.06,52.85C43.92,52.85 43,53.76 43,54.88C43,56.01 43.92,56.92 45.06,56.92Z"
+        android:strokeColor="#00000000"
+        android:strokeWidth="1" />
+</vector>

client/android/app/src/main/res/drawable/ic_launcher_background.xml

@@ -0,0 +1,170 @@
+<?xml version="1.0" encoding="utf-8"?>
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="108dp"
+    android:height="108dp"
+    android:viewportHeight="108"
+    android:viewportWidth="108">
+    <path
+        android:fillColor="#26A69A"
+        android:pathData="M0,0h108v108h-108z" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M9,0L9,108"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M19,0L19,108"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M29,0L29,108"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M39,0L39,108"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M49,0L49,108"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M59,0L59,108"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M69,0L69,108"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M79,0L79,108"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M89,0L89,108"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M99,0L99,108"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,9L108,9"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,19L108,19"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,29L108,29"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,39L108,39"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,49L108,49"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,59L108,59"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,69L108,69"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,79L108,79"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,89L108,89"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,99L108,99"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M19,29L89,29"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M19,39L89,39"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M19,49L89,49"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M19,59L89,59"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M19,69L89,69"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M19,79L89,79"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M29,19L29,89"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M39,19L39,89"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M49,19L49,89"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M59,19L59,89"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M69,19L69,89"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M79,19L79,89"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+</vector>

client/android/app/src/main/res/layout/activity_main.xml

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+<androidx.coordinatorlayout.widget.CoordinatorLayout xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:app="http://schemas.android.com/apk/res-auto"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent"
+    tools:context=".MainActivity">
+
+    <WebView
+        android:layout_width="match_parent"
+        android:layout_height="match_parent" />
+</androidx.coordinatorlayout.widget.CoordinatorLayout>

client/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+    <background>
+        <inset android:drawable="@mipmap/ic_launcher_background" android:inset="16.7%" />
+    </background>
+    <foreground>
+        <inset android:drawable="@mipmap/ic_launcher_foreground" android:inset="16.7%" />
+    </foreground>
+</adaptive-icon>

client/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+    <background>
+        <inset android:drawable="@mipmap/ic_launcher_background" android:inset="16.7%" />
+    </background>
+    <foreground>
+        <inset android:drawable="@mipmap/ic_launcher_foreground" android:inset="16.7%" />
+    </foreground>
+</adaptive-icon>