fix(native): read a notice button's href without a weak type

An action button carries no href, so a parameter typed as only an optional href refused the notice DTO; the button type now names its kind as well.
feat(native): everything the App Store and Google Play submissions need
2026-11-05 04:04:07 +00:00 · 2026-10-25 18:58:27 +01:00 · 2026-10-25 18:37:31 +01:00 · 2026-10-25 18:02:45 +01:00 · 2026-10-25 17:41:32 +01:00 · 2026-10-25 17:26:03 +01:00
1956 changed files with 15601 additions and 73137 deletions
@@ -1,7 +1,6 @@
 node_modules
 client/node_modules
 server/node_modules
-shared/node_modules
 client/dist
 shared/dist
 data
@@ -14,7 +14,7 @@ jobs:
    timeout-minutes: 45
    steps:
      - name: Close stale invalid-title issues
-        uses: actions/github-script@v9
+        uses: actions/github-script@v8
        with:
          script: |
            const badTitles = [
@@ -15,7 +15,7 @@ jobs:
    timeout-minutes: 45
    steps:
      - name: Close stale wrong-base-branch PRs
-        uses: actions/github-script@v9
+        uses: actions/github-script@v8
        with:
          script: |
            const { data: pulls } = await github.rest.pulls.list({
@@ -14,7 +14,7 @@ jobs:
    timeout-minutes: 45
    steps:
      - name: Flag or redirect issue
-        uses: actions/github-script@v9
+        uses: actions/github-script@v8
        with:
          script: |
            const title = context.payload.issue.title.trim();
@@ -5,13 +5,6 @@ name: Build & Push Docker Image (Prerelease)
 # :latest-pre, and tags the commit. Nothing moves :latest. Like the stable
 # release it refuses a commit whose ci-ok is not green. docker.yml with
 # bump=auto later finalizes the line once main carries it.
-#
-# A prerelease asks the TREK services issuer for a registration dialect of its
-# own -pre.N version (registration-dialect.yml, as the stable release does)
-# and builds it into the image; nothing of it is committed, dev keeps the
-# module of the last stable release, which it gets when main is merged back
-# into dev. Without one the image carries dev's module, with a warning when
-# that is the original one or old.

 on:
  workflow_dispatch:
@@ -96,23 +89,10 @@ jobs:
          echo "VERSION=$NEW_VERSION" >> "$GITHUB_OUTPUT"
          echo "$STABLE to $NEW_VERSION"

-  # The registration dialect of this prerelease, fetched and checked in a job
-  # without write access. It never fails the build.
-  dialect:
-    needs: version-bump
-    uses: ./.github/workflows/registration-dialect.yml
-    with:
-      version: ${{ needs.version-bump.outputs.version }}
-      ref: ${{ needs.version-bump.outputs.sha }}
-    secrets:
-      TREK_DIALECT_TOKEN: ${{ secrets.TREK_DIALECT_TOKEN }}
-
  build:
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 120
-    needs: [version-bump, dialect]
-    # Whatever became of the dialect job: without its artifact the image carries dev's module.
-    if: ${{ !cancelled() && needs.version-bump.result == 'success' }}
+    needs: version-bump
    strategy:
      fail-fast: false
      matrix:
@@ -131,51 +111,9 @@ jobs:
        with:
          ref: ${{ needs.version-bump.outputs.sha }}

-      - name: Take over the prerelease's dialect
-        id: take
-        uses: actions/download-artifact@v7
-        continue-on-error: true
-        with:
-          name: registration-dialect
-          path: ${{ runner.temp }}/dialect
-
-      # Into the build context only; the commit stays as it is. Without a
-      # dialect of its own the image speaks dev's module, which the issuer
-      # takes for new installations for 180 days after it was made (longer
-      # while it is the newest stable release's). That is warned about, never
-      # stopped on, and a date that cannot be read only warns as well.
-      - name: Place the dialect
-        env:
-          VERSION: ${{ needs.version-bump.outputs.version }}
-          TAKEN: ${{ steps.take.outcome }}
-          REPORT: ${{ matrix.platform == 'linux/amd64' }}
-        run: |
-          set -u
-          target=server/src/nest/service-identity/registration-dialect.ts
-          fetched="$RUNNER_TEMP/dialect/registration-dialect.ts"
-          if [ "$TAKEN" = success ] && [ -f "$fetched" ]; then
-            cp "$fetched" "$target"
-            echo "$VERSION registers in dialect $(sed -n "s/^const DIALECT = '\(.*\)';$/\1/p" "$target") of its own."
-            exit 0
-          fi
-          [ "$REPORT" = true ] || exit 0
-          id="$(sed -n "s/^const DIALECT = '\(.*\)';$/\1/p" "$target")"
-          created="$(sed -n "s/^  createdAt: '\(.*\)',$/\1/p" "$target")"
-          if [ "$id" = 0 ]; then
-            message="$VERSION got no dialect of its own and registers in the original one, which the issuer accepts only for a transition period."
-          elif made="$(date -u -d "$created" +%s 2>/dev/null)"; then
-            age=$(( ($(date -u +%s) - made) / 86400 ))
-            message="$VERSION got no dialect of its own and registers in dev's dialect $id from $created, $age days old."
-            [ "$age" -gt 150 ] || { echo "$message"; exit 0; }
-          else
-            message="$VERSION got no dialect of its own, and the date of dev's dialect cannot be read from $target."
-          fi
-          echo "::warning::$message"
-          printf '### Registration dialect\n%s\n' "$message" >> "$GITHUB_STEP_SUMMARY"
-
      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

-      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -218,7 +156,6 @@ jobs:
    runs-on: ubuntu-24.04
    timeout-minutes: 120
    needs: [version-bump, build]
-    if: ${{ !cancelled() && needs.build.result == 'success' }}
    steps:
      - uses: actions/checkout@v6
        with:
@@ -236,7 +173,7 @@ jobs:

      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

-      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -2,29 +2,17 @@ name: Build & Push Docker Image

 # The stable release. Dispatched by hand on main, it:
 #   1. refuses to run unless ci-ok passed on the main commit it releases,
-#   2. works out the version from the tags and the bump input,
-#   3. asks the TREK services issuer for the registration dialect of that
-#      version and checks it, in a job without write access
-#      (registration-dialect.yml); without one the release ships the dialect
-#      already on main, but only while that one still has 90 days to run,
-#   4. commits the bump to package.json, the lockfile, Chart.yaml and the
-#      dialect, tags it and pushes,
-#   5. builds both platforms from exactly that bump commit (never from
+#   2. works out the version from the tags and the bump input, commits the
+#      bump to package.json, the lockfile and Chart.yaml, tags it and pushes,
+#   3. builds both platforms from exactly that bump commit (never from
 #      whatever main points to by then) and publishes :VERSION,
 #      :MAJOR.MINOR, :MAJOR and :latest,
-#   6. publishes the Helm chart from the same commit.
+#   4. publishes the Helm chart from the same commit.
 #
 # Big or risky changes go out as a prerelease first (docker-dev.yml, tagged
 # :latest-pre and :<next>-pre.N); bump=auto here then finalizes that line.
 # Without a prerelease in flight there is no default: the run stops until
 # someone picks patch, minor or major.
-#
-# Each stable release registers new installations in a dialect of its own,
-# which the issuer accepts for 180 days, and for as long as it is the newest
-# release's; renewing a key needs none. dev gets the module when main is merged
-# back into dev after the release; a prerelease asks the issuer for one of its
-# own (docker-dev.yml). The issuer's side, and what to set up before the first
-# release with a dialect, is in the operations guide of the TREK services.

 on:
  workflow_dispatch:
@@ -38,14 +26,6 @@ on:
        description: "Type MAJOR (all caps) to confirm a major release"
        type: string
        default: ''
-      ci_from:
-        description: 'Take ci-ok from this earlier commit instead of the one on main, when main differs from it only under .github/ (a fix to a release workflow needs no second test run)'
-        type: string
-        default: ''
-      allow_stale_dialect:
-        description: 'Ship without a dialect of its own even if the one on main is the original one or has under 90 days left'
-        type: boolean
-        default: false

 permissions:
  contents: write
@@ -56,16 +36,13 @@ concurrency:
  cancel-in-progress: false

 jobs:
-  version:
+  version-bump:
    if: github.repository == 'liketrek/TREK'
    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    permissions:
-      contents: read
-      checks: read
+    timeout-minutes: 120
    outputs:
      version: ${{ steps.bump.outputs.VERSION }}
-      base: ${{ steps.base.outputs.SHA }}
+      sha: ${{ steps.bump.outputs.SHA }}
    steps:
      - name: Release from main only
        if: github.ref != 'refs/heads/main'
@@ -73,17 +50,17 @@ jobs:
          echo "::error::Dispatch this workflow on main, not on $GITHUB_REF."
          exit 1

+      - uses: actions/create-github-app-token@v3
+        id: app-token
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          fetch-tags: true
-          persist-credentials: false
-
-      # The bump job checks out exactly this commit, so what ci-ok was checked
-      # on is what gets released, however long the dialect takes.
-      - name: Note the commit being released
-        id: base
-        run: echo "SHA=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+          token: ${{ steps.app-token.outputs.token }}

      # The dev push, the main push and any manual run each leave a ci-ok on
      # this commit. scripts/ci/ci-ok-verdict.mjs counts the newest attempt of
@@ -91,7 +68,6 @@ jobs:
      # finished last to be green, so a later green run supersedes a flaky or
      # cancelled one. It prints the link of every run it counted.
      - name: Require a green ci-ok on the commit being released
-        if: inputs.ci_from == ''
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
@@ -101,43 +77,14 @@ jobs:
          gh api "repos/$GITHUB_REPOSITORY/commits/$sha/check-runs?check_name=ci-ok&filter=all&per_page=100" > "$runs"
          node scripts/ci/ci-ok-verdict.mjs "$runs" "$sha"

-      # ci_from: main carries only workflow changes on top of a commit that
-      # already passed. That commit must be an ancestor of main, everything
-      # outside .github/ must be identical, and one of its ci-ok runs must be
-      # green (its dev push, typically).
-      - name: Require a green ci-ok on the commit main's code comes from
-        if: inputs.ci_from != ''
-        env:
-          GH_TOKEN: ${{ github.token }}
-          CI_FROM: ${{ inputs.ci_from }}
-        run: |
-          set -euo pipefail
-          from="$(git rev-parse --verify "$CI_FROM^{commit}")"
-          if ! git merge-base --is-ancestor "$from" HEAD; then
-            echo "::error::$from is not an ancestor of main."
-            exit 1
-          fi
-          outside="$(git diff --name-only "$from" HEAD -- . ':(exclude).github/**')"
-          if [ -n "$outside" ]; then
-            echo "::error::main differs from $from outside .github/:"
-            echo "$outside"
-            exit 1
-          fi
-          green="$(gh api "repos/$GITHUB_REPOSITORY/commits/$from/check-runs?check_name=ci-ok&filter=all&per_page=100" \
-            --jq '[.check_runs[] | select(.status == "completed" and .conclusion == "success")] | length')"
-          if [ "$green" -lt 1 ]; then
-            echo "::error::$from has no green ci-ok."
-            exit 1
-          fi
-          echo "main differs from $from only under .github/, and $from has $green green ci-ok run(s)."
-
-      - name: Determine bump type and version
+      - name: Determine bump type and update version
        id: bump
        env:
          BUMP_INPUT: ${{ inputs.bump || 'auto' }}
          CONFIRM_MAJOR: ${{ inputs.confirm_major }}
        run: |
          set -eu
+          git fetch --tags

          # Derive version from git tags, no package.json dependency
          STABLE_TAG=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' | grep -v '\-pre\.' | sort -V | tail -1)
@@ -196,107 +143,6 @@ jobs:
          echo "VERSION=$NEW_VERSION" >> "$GITHUB_OUTPUT"
          echo "$STABLE to $NEW_VERSION ($BUMP)"

-  # The registration dialect of this version, fetched and checked in a job
-  # without write access. It never fails; without an artifact from it the
-  # bump decides below whether the dialect on main may ship.
-  dialect:
-    needs: version
-    uses: ./.github/workflows/registration-dialect.yml
-    with:
-      version: ${{ needs.version.outputs.version }}
-      ref: ${{ needs.version.outputs.base }}
-    secrets:
-      TREK_DIALECT_TOKEN: ${{ secrets.TREK_DIALECT_TOKEN }}
-
-  # Runs whatever became of the dialect job, a timeout or a lost runner
-  # included: no artifact means the dialect on main, if it may still ship.
-  version-bump:
-    needs: [version, dialect]
-    if: ${{ !cancelled() && needs.version.result == 'success' }}
-    runs-on: ubuntu-24.04
-    timeout-minutes: 120
-    outputs:
-      sha: ${{ steps.commit.outputs.SHA }}
-    steps:
-      - uses: actions/create-github-app-token@v3
-        id: app-token
-        with:
-          app-id: ${{ secrets.RELEASE_APP_ID }}
-          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
-
-      - uses: actions/checkout@v6
-        with:
-          ref: ${{ needs.version.outputs.base }}
-          fetch-depth: 0
-          fetch-tags: true
-          token: ${{ steps.app-token.outputs.token }}
-
-      - name: Take over the checked dialect
-        id: take
-        uses: actions/download-artifact@v7
-        continue-on-error: true
-        with:
-          name: registration-dialect
-          path: ${{ runner.temp }}/dialect
-
-      # Without a dialect of its own the release ships the one on main, but
-      # only while the issuer takes new registrations in it for 90 more days:
-      # dialect 0 closes on the issuer's transition date, and a dialect with
-      # little left would shut out new installations of this release soon after
-      # it is out. Then this stops before anything is committed, unless
-      # allow_stale_dialect says to ship anyway. The issuer keeps the newest
-      # release's dialect open past its date, so the date here is the least it
-      # has, not the most.
-      - name: Place the dialect
-        env:
-          VERSION: ${{ needs.version.outputs.version }}
-          TAKEN: ${{ steps.take.outcome }}
-          ALLOW_STALE: ${{ inputs.allow_stale_dialect }}
-        run: |
-          set -u
-          target=server/src/nest/service-identity/registration-dialect.ts
-          fetched="$RUNNER_TEMP/dialect/registration-dialect.ts"
-          dialect_id() { sed -n "s/^const DIALECT = '\(.*\)';$/\1/p" "$1"; }
-          report() {
-            echo "$2$1"
-            printf '### Registration dialect\n%s\n' "$1" >> "$GITHUB_STEP_SUMMARY"
-          }
-          if [ "$TAKEN" = success ] && [ -f "$fetched" ]; then
-            cp "$fetched" "$target"
-            report "$VERSION registers in dialect $(dialect_id "$target"), written by the issuer for it." ""
-            exit 0
-          fi
-          id="$(dialect_id "$target")"
-          created="$(sed -n "s/^  createdAt: '\(.*\)',$/\1/p" "$target")"
-          left=""
-          if [ -n "$id" ] && [ "$id" != 0 ] && made="$(date -u -d "$created" +%s 2>/dev/null)"; then
-            left=$(( (made + 180 * 86400 - $(date -u +%s)) / 86400 ))
-          fi
-          if [ -n "$left" ] && [ "$left" -ge 90 ]; then
-            report "$VERSION ships without a dialect of its own and registers in dialect $id from $created, which the issuer takes for new installations for $left more days at least. Its operator can write one by hand for the next patch." "::warning::"
-            exit 0
-          fi
-          if [ "$id" = 0 ]; then
-            what="the original registration, which the issuer accepts only until the end of its transition period"
-          elif [ -n "$left" ]; then
-            what="dialect $id from $created, which has $left days left"
-          else
-            what="a dialect whose id or date cannot be read from $target"
-          fi
-          if [ "$ALLOW_STALE" = true ]; then
-            report "$VERSION ships without a dialect of its own and registers in $what, as allow_stale_dialect asked." "::warning::"
-            exit 0
-          fi
-          report "$VERSION got no dialect of its own and would register in $what. Nothing was committed or pushed. Make sure the issuer runs with its dialect seed and release token and that TREK_DIALECT_TOKEN is set, then run the release again, or tick allow_stale_dialect to ship anyway." "::error::"
-          exit 1
-
-      - name: Update the version, commit, tag and push
-        id: commit
-        env:
-          NEW_VERSION: ${{ needs.version.outputs.version }}
-        run: |
-          set -eu
-
          # Update all workspace + root package.json files and the root lockfile in one shot
          npm version "$NEW_VERSION" --workspaces --include-workspace-root --no-git-tag-version
          sed -i "s/^version: .*/version: $NEW_VERSION/" charts/trek/Chart.yaml
@@ -307,8 +153,7 @@ jobs:
          # landed on main in the meantime.
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add package.json package-lock.json server/package.json client/package.json shared/package.json \
-            charts/trek/Chart.yaml server/src/nest/service-identity/registration-dialect.ts
+          git add package.json package-lock.json server/package.json client/package.json shared/package.json charts/trek/Chart.yaml
          git commit -m "chore: bump version to $NEW_VERSION [skip ci]"
          git tag -a "v$NEW_VERSION" -m "v$NEW_VERSION"
          git push origin HEAD:main --follow-tags
@@ -319,9 +164,7 @@ jobs:
  build:
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 120
-    needs: [version, version-bump]
-    # version-bump may run after a failed dialect job; that alone must not skip what follows it.
-    if: ${{ !cancelled() && needs.version-bump.result == 'success' }}
+    needs: version-bump
    strategy:
      fail-fast: false
      matrix:
@@ -342,7 +185,7 @@ jobs:

      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

-      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -362,7 +205,7 @@ jobs:
          outputs: type=image,name=mauriceboe/trek,push-by-digest=true,name-canonical=true,push=true
          no-cache: true
          build-args: |
-            APP_VERSION=${{ needs.version.outputs.version }}
+            APP_VERSION=${{ needs.version-bump.outputs.version }}
          labels: |
            org.opencontainers.image.revision=${{ steps.meta.outputs.revision }}
            org.opencontainers.image.created=${{ steps.meta.outputs.created }}
@@ -384,8 +227,7 @@ jobs:
  merge:
    runs-on: ubuntu-24.04
    timeout-minutes: 120
-    needs: [version, version-bump, build]
-    if: ${{ !cancelled() && needs.build.result == 'success' }}
+    needs: [version-bump, build]
    steps:
      - uses: actions/checkout@v6
        with:
@@ -401,7 +243,7 @@ jobs:

      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

-      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -410,7 +252,7 @@ jobs:
        working-directory: /tmp/digests
        run: |
          set -euo pipefail
-          VERSION="${{ needs.version.outputs.version }}"
+          VERSION="${{ needs.version-bump.outputs.version }}"
          MAJOR_TAG="$(echo "$VERSION" | cut -d. -f1)"
          # :MAJOR.MINOR takes the patches of one minor line and nothing else,
          # the conservative pin for an install that wants to wait out a
@@ -450,7 +292,6 @@ jobs:
    runs-on: ubuntu-24.04
    timeout-minutes: 120
    needs: version-bump
-    if: ${{ !cancelled() && needs.version-bump.result == 'success' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
@@ -16,7 +16,7 @@ jobs:

    steps:
      - name: Flag or clear wrong base branch
-        uses: actions/github-script@v9
+        uses: actions/github-script@v8
        with:
          script: |
            const base = context.payload.pull_request.base.ref;
@@ -36,7 +36,7 @@ jobs:

      - name: Comment on PR if checks failed
        if: steps.checks.outcome == 'failure'
-        uses: actions/github-script@v9
+        uses: actions/github-script@v8
        with:
          script: |
            await github.rest.issues.createComment({
@@ -0,0 +1,191 @@
+name: Native apps release
+
+# Builds the signed store builds of the iOS and Android apps and uploads them:
+# the Android App Bundle to a Google Play testing track, the iOS archive to
+# App Store Connect (TestFlight). Promotion to production stays a manual step
+# in both consoles.
+#
+# Runs only in liketrek/TREK, only by hand or on a version tag, and only after a
+# required reviewer approves the `store` environment, which holds every secret
+# (see wiki/Native-Apps.md for the list). Pull requests never reach it.
+#
+# Both stores get the same numbers: the version from client/package.json
+# without a prerelease suffix, and a build number that only grows. A prerelease
+# reuses its X.Y.Z with a higher build number and belongs on the internal track
+# and in TestFlight only.
+
+on:
+  workflow_dispatch:
+    inputs:
+      track:
+        description: Google Play track
+        type: choice
+        options: [internal, alpha, beta]
+        default: internal
+  push:
+    tags: ['v*']
+
+permissions:
+  contents: read
+
+concurrency:
+  group: native-release
+  cancel-in-progress: false
+
+jobs:
+  android:
+    if: github.repository == 'liketrek/TREK'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 40
+    environment: store
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 21
+          cache: gradle
+
+      - name: Version and build number
+        id: version
+        run: |
+          echo "version=$(node -p "require('./client/package.json').version.split('-')[0]")" >> "$GITHUB_OUTPUT"
+          echo "build=$((GITHUB_RUN_NUMBER + 1000))" >> "$GITHUB_OUTPUT"
+
+      - name: Install
+        run: npm ci --workspace=shared --workspace=client
+
+      - name: Build shared
+        run: npm run build --workspace=shared
+
+      - name: Build the address screen and sync it into the shell
+        working-directory: client
+        run: npm run cap:sync -- android
+
+      - name: Upload key
+        env:
+          KEYSTORE_B64: ${{ secrets.ANDROID_UPLOAD_KEYSTORE_B64 }}
+        run: printf '%s' "$KEYSTORE_B64" | base64 -d > "$RUNNER_TEMP/upload.jks"
+
+      - name: Build the signed App Bundle
+        working-directory: client/android
+        env:
+          ORG_GRADLE_PROJECT_trekKeystorePassword: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          ORG_GRADLE_PROJECT_trekKeyAlias: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ORG_GRADLE_PROJECT_trekKeyPassword: ${{ secrets.ANDROID_KEY_PASSWORD }}
+        run: >-
+          ./gradlew bundleRelease --no-daemon
+          -PtrekVersionName=${{ steps.version.outputs.version }}
+          -PtrekVersionCode=${{ steps.version.outputs.build }}
+          -PtrekKeystore="$RUNNER_TEMP/upload.jks"
+
+      - uses: actions/upload-artifact@v6
+        with:
+          name: trek-android-${{ steps.version.outputs.version }}-${{ steps.version.outputs.build }}
+          path: client/android/app/build/outputs/bundle/release/app-release.aab
+          retention-days: 30
+
+      # Play only accepts API uploads once one bundle was uploaded by hand
+      # (wiki/Native-Apps.md). `draft` until the app has left draft in the console.
+      - name: Upload to Google Play
+        uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
+        with:
+          serviceAccountJsonPlainText: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
+          packageName: com.liketrek.trek
+          releaseFiles: client/android/app/build/outputs/bundle/release/app-release.aab
+          track: ${{ inputs.track || 'internal' }}
+          status: draft
+
+      - name: Remove the upload key
+        if: always()
+        run: rm -f "$RUNNER_TEMP/upload.jks"
+
+  ios:
+    if: github.repository == 'liketrek/TREK'
+    runs-on: macos-15
+    timeout-minutes: 60
+    environment: store
+    steps:
+      - uses: actions/checkout@v6
+
+      # App Store uploads must be built with Xcode 26; the image's default is older.
+      - name: Select Xcode 26
+        run: |
+          XCODE=$(ls -d /Applications/Xcode_26*.app | sort -V | tail -1)
+          test -n "$XCODE"
+          sudo xcode-select -s "$XCODE"
+          xcodebuild -version
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+
+      - name: Version and build number
+        id: version
+        run: |
+          echo "version=$(node -p "require('./client/package.json').version.split('-')[0]")" >> "$GITHUB_OUTPUT"
+          echo "build=$((GITHUB_RUN_NUMBER + 1000))" >> "$GITHUB_OUTPUT"
+
+      - name: Install
+        run: npm ci --workspace=shared --workspace=client
+
+      - name: Build shared
+        run: npm run build --workspace=shared
+
+      - name: Build the address screen and sync it into the shell
+        working-directory: client
+        run: npm run cap:sync -- ios
+
+      - name: App Store Connect API key
+        env:
+          ASC_KEY_P8_B64: ${{ secrets.ASC_KEY_P8_B64 }}
+        run: printf '%s' "$ASC_KEY_P8_B64" | base64 -d > "$RUNNER_TEMP/AuthKey.p8"
+
+      - name: Archive
+        working-directory: client/ios/App
+        env:
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+        run: >-
+          xcodebuild archive
+          -project App.xcodeproj
+          -scheme App
+          -configuration Release
+          -destination 'generic/platform=iOS'
+          -archivePath "$RUNNER_TEMP/TREK.xcarchive"
+          MARKETING_VERSION=${{ steps.version.outputs.version }}
+          CURRENT_PROJECT_VERSION=${{ steps.version.outputs.build }}
+          DEVELOPMENT_TEAM="$APPLE_TEAM_ID"
+          -allowProvisioningUpdates
+          -authenticationKeyPath "$RUNNER_TEMP/AuthKey.p8"
+          -authenticationKeyID "$ASC_KEY_ID"
+          -authenticationKeyIssuerID "$ASC_ISSUER_ID"
+
+      # ExportOptions.plist says destination=upload, so this step sends the build
+      # to App Store Connect, where it shows up in TestFlight after processing.
+      - name: Export and upload to App Store Connect
+        working-directory: client/ios/App
+        env:
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+        run: >-
+          xcodebuild -exportArchive
+          -archivePath "$RUNNER_TEMP/TREK.xcarchive"
+          -exportOptionsPlist ../ExportOptions.plist
+          -exportPath "$RUNNER_TEMP/export"
+          -allowProvisioningUpdates
+          -authenticationKeyPath "$RUNNER_TEMP/AuthKey.p8"
+          -authenticationKeyID "$ASC_KEY_ID"
+          -authenticationKeyIssuerID "$ASC_ISSUER_ID"
+
+      - name: Remove the API key
+        if: always()
+        run: rm -f "$RUNNER_TEMP/AuthKey.p8"
@@ -0,0 +1,132 @@
+name: Native apps
+
+permissions:
+  contents: read
+
+# Builds the iOS and Android shells whenever they, their address screen or the
+# Capacitor plugins change. Nobody on the team has to own a Mac for the Swift
+# side to be compiled on every change, and every run leaves a debug APK to
+# install on a phone.
+#
+# Unsigned on purpose: signing and store uploads need secrets that fork PRs do
+# not get, and belong in a release workflow of their own.
+on:
+  pull_request:
+    paths:
+      - 'client/android/**'
+      - 'client/ios/**'
+      - 'client/native-shell/**'
+      - 'client/src/native/trekShell.ts'
+      - 'client/src/native/serverAddress.ts'
+      - 'client/capacitor.config.ts'
+      - 'client/vite.native.config.js'
+      - 'client/scripts/check-store-metadata.mjs'
+      - 'client/fastlane/**'
+      - 'client/package.json'
+      - 'package-lock.json'
+      - 'shared/src/i18n/*/native.ts'
+      - '.github/workflows/native.yml'
+  workflow_dispatch:
+
+concurrency:
+  group: native-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # The store texts fit their limits and every listing image has its size and
+  # no alpha channel (client/fastlane/README.md). Plain Node, no install.
+  metadata:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+
+      - name: Check the store listings
+        run: node client/scripts/check-store-metadata.mjs
+
+  android:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 21
+          cache: gradle
+
+      - name: Install
+        run: npm ci --workspace=shared --workspace=client
+
+      - name: Build shared
+        run: npm run build --workspace=shared
+
+      - name: Build the address screen and sync it into the shells
+        working-directory: client
+        run: npm run cap:sync -- android
+
+      # The release build runs R8 with the keep rules in proguard-rules.pro, so a
+      # rule that goes missing fails here rather than in the store build. It is
+      # unsigned: the upload key only exists in native-release.yml.
+      - name: Assemble debug and release APKs
+        working-directory: client/android
+        run: ./gradlew assembleDebug assembleRelease lintDebug --no-daemon
+
+      - uses: actions/upload-artifact@v6
+        with:
+          name: trek-android-debug
+          path: client/android/app/build/outputs/apk/debug/app-debug.apk
+          retention-days: 14
+
+  ios:
+    runs-on: macos-15
+    timeout-minutes: 40
+    steps:
+      - uses: actions/checkout@v6
+
+      # App Store uploads must be built with Xcode 26; the image's default is older.
+      - name: Select Xcode 26
+        run: |
+          XCODE=$(ls -d /Applications/Xcode_26*.app | sort -V | tail -1)
+          test -n "$XCODE"
+          sudo xcode-select -s "$XCODE"
+          xcodebuild -version
+
+      - name: Check the property lists
+        run: plutil -lint client/ios/App/App/Info.plist client/ios/ExportOptions.plist
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+
+      - name: Install
+        run: npm ci --workspace=shared --workspace=client
+
+      - name: Build shared
+        run: npm run build --workspace=shared
+
+      - name: Build the address screen and sync it into the shells
+        working-directory: client
+        run: npm run cap:sync -- ios
+
+      - name: Build for the simulator
+        working-directory: client/ios/App
+        run: |
+          xcodebuild build \
+            -project App.xcodeproj \
+            -scheme App \
+            -configuration Debug \
+            -sdk iphonesimulator \
+            -destination 'generic/platform=iOS Simulator' \
+            CODE_SIGNING_ALLOWED=NO
@@ -1,144 +0,0 @@
-name: Registration dialect
-
-# Asks the TREK services issuer for the registration dialect of one version and
-# checks it, for docker.yml (a stable release commits it with the version bump)
-# and docker-dev.yml (a prerelease only builds it into its image).
-#
-# The issuer's answer runs here, in a job that holds no write token and keeps
-# no git credentials; the token for the issuer is in the environment of the
-# one step that fetches. The answer is held to what a dialect is
-# (scripts/ci/check-registration-dialect.mjs), then type-checked and linted
-# the way TREK's CI would see it once it is on main and dev. Only a module that
-# passes all of it goes on, as the artifact `registration-dialect`; without
-# one the caller decides what ships. This workflow never fails its caller.
-
-on:
-  workflow_call:
-    inputs:
-      version:
-        description: 'The version the dialect is for, X.Y.Z or X.Y.Z-pre.N'
-        type: string
-        required: true
-      ref:
-        description: 'The commit whose checker, types and lint config the dialect is checked with'
-        type: string
-        required: true
-    secrets:
-      TREK_DIALECT_TOKEN:
-        required: false
-
-permissions:
-  contents: read
-
-jobs:
-  dialect:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 20
-    # A failed or timed-out run leaves no artifact, which the caller already
-    # handles; it must not fail the release around it.
-    continue-on-error: true
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          ref: ${{ inputs.ref }}
-          persist-credentials: false
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-          cache-dependency-path: package-lock.json
-
-      # The only step that sees the token. The URL is fixed; the answer is
-      # bounded in time and size and goes to a file nothing runs yet.
-      - name: Fetch the dialect from the issuer
-        id: fetch
-        timeout-minutes: 3
-        env:
-          TREK_DIALECT_TOKEN: ${{ secrets.TREK_DIALECT_TOKEN }}
-          VERSION: ${{ inputs.version }}
-        run: |
-          set -uo pipefail
-          out="$RUNNER_TEMP/registration-dialect.ts"
-          if [ -z "${TREK_DIALECT_TOKEN:-}" ]; then
-            echo "::warning::TREK_DIALECT_TOKEN is not set; the issuer was not asked for a dialect for $VERSION."
-            exit 0
-          fi
-          status=$(curl --silent --show-error --proto '=https' --tlsv1.2 --max-time 30 --retry 2 --retry-delay 5 \
-            --max-filesize 262144 -H "Authorization: Bearer $TREK_DIALECT_TOKEN" -H 'Content-Type: application/json' \
-            --data "{\"version\":\"$VERSION\"}" -o "$out" -w '%{http_code}' https://places.liketrek.com/v1/dialects) \
-            || status=000
-          if [ "$status" != 200 ] && [ "$status" != 201 ]; then
-            echo "::warning::The issuer handed out no registration dialect for $VERSION (HTTP $status)."
-            rm -f "$out"
-            exit 0
-          fi
-          if [ "$(wc -c < "$out")" -gt 262144 ]; then
-            echo "::warning::The issuer's registration dialect for $VERSION is larger than a dialect."
-            rm -f "$out"
-            exit 0
-          fi
-          echo "file=$out" >> "$GITHUB_OUTPUT"
-
-      # A module that computes for long is refused by the clock as well.
-      - name: Check the dialect
-        id: check
-        if: steps.fetch.outputs.file != ''
-        timeout-minutes: 2
-        env:
-          FILE: ${{ steps.fetch.outputs.file }}
-          VERSION: ${{ inputs.version }}
-        run: |
-          set -uo pipefail
-          if ! node scripts/ci/check-registration-dialect.mjs "$FILE" "$VERSION"; then
-            echo "::warning::The issuer's registration dialect for $VERSION failed its check."
-            exit 0
-          fi
-          echo "What changes against the dialect in the tree:"
-          git diff --no-index -- server/src/nest/service-identity/registration-dialect.ts "$FILE" || true
-          echo "ok=true" >> "$GITHUB_OUTPUT"
-
-      - name: Install the toolchain
-        if: steps.check.outputs.ok == 'true'
-        timeout-minutes: 8
-        run: |
-          npm ci --ignore-scripts --no-audit --no-fund
-          npm run build --workspace=shared
-
-      # The bump commit skips CI, so this is where the module meets the strict
-      # config (lint:strict lets a new file have no strict errors) and ESLint
-      # with --max-warnings 0 (lint:warnings starts a new file at none) before
-      # it lands on main.
-      - name: Type-check and lint the dialect
-        id: types
-        if: steps.check.outputs.ok == 'true'
-        timeout-minutes: 5
-        working-directory: server
-        env:
-          FILE: ${{ steps.fetch.outputs.file }}
-          VERSION: ${{ inputs.version }}
-        run: |
-          set -uo pipefail
-          cp "$FILE" src/nest/service-identity/registration-dialect.ts
-          # TypeScript 6 includes no @types by default and the dialect imports nothing
-          # from node, so checked on its own it would not know Buffer: name node here.
-          printf '%s\n' '{"extends": "./tsconfig.strict.json", "compilerOptions": {"types": ["node"]}, "include": [],' \
-            '"files": ["src/nest/service-identity/registration-dialect.ts"]}' > tsconfig.dialect-check.json
-          if ! npx tsc -p tsconfig.dialect-check.json --noEmit --pretty false; then
-            echo "::warning::The issuer's registration dialect for $VERSION does not type-check under the strict config."
-            exit 0
-          fi
-          if ! npx eslint --max-warnings 0 src/nest/service-identity/registration-dialect.ts; then
-            echo "::warning::The issuer's registration dialect for $VERSION does not pass ESLint."
-            exit 0
-          fi
-          echo "ok=true" >> "$GITHUB_OUTPUT"
-
-      - name: Hand the dialect on
-        if: steps.types.outputs.ok == 'true'
-        uses: actions/upload-artifact@v6
-        with:
-          name: registration-dialect
-          path: ${{ steps.fetch.outputs.file }}
-          if-no-files-found: error
-          retention-days: 1
@@ -74,12 +74,12 @@ jobs:
          load: true
          tags: trek:scan

-      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

-      - uses: docker/scout-action@e7e2a72bf1485d10a58f30696b6c513b261ce4fa # v1.29.0
+      - uses: docker/scout-action@221e7f4860634eeb1579e3bd7ca232e577bd1864 # v1.26.0
        with:
          command: cves
          image: trek:scan
@@ -1100,7 +1100,7 @@ jobs:
          path: plugin-sdk/coverage/

      - name: Scan
-        uses: SonarSource/sonarqube-scan-action@4d1dc0c91ee400dcf8a6dddf2f705ac36542e304 # v8.4.0
+        uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
        env:
          # SonarQube Cloud is the scan action's default host, so no
          # SONAR_HOST_URL — the token is a sonarcloud.io token for the
@@ -1161,7 +1161,7 @@ jobs:
          docker run -d --name trek-ci -p 127.0.0.1:3000:3000 \
            --read-only --tmpfs /tmp:noexec,nosuid,size=128m \
            --security-opt no-new-privileges:true \
-            --cap-drop ALL --cap-add CHOWN --cap-add SETUID --cap-add SETGID --cap-add KILL \
+            --cap-drop ALL --cap-add CHOWN --cap-add SETUID --cap-add SETGID \
            -v "$RUNNER_TEMP/trek/data:/app/data" \
            -v "$RUNNER_TEMP/trek/uploads:/app/uploads" \
            -e ENCRYPTION_KEY="$(openssl rand -hex 32)" \
@@ -1194,17 +1194,6 @@ jobs:
          curl -sf http://127.0.0.1:3000/ | grep -q '<div id="root">' \
            || { echo "::error::/ does not serve the client"; exit 1; }

-      # Same capabilities as the shipped compose file: dumb-init has to be able
-      # to pass the stop signal on to node, or docker stop ends in SIGKILL (137).
-      - name: Stop gracefully
-        run: |
-          set -euo pipefail
-          docker stop -t 30 trek-ci >/dev/null
-          code="$(docker inspect -f '{{.State.ExitCode}}' trek-ci)"
-          [ "$code" = "0" ] || { echo "::error::docker stop ended with exit code $code, not a graceful shutdown"; exit 1; }
-          docker logs trek-ci 2>&1 | grep 'SIGTERM received' >/dev/null \
-            || { echo "::error::the server never saw SIGTERM"; exit 1; }
-
      - name: Container log
        if: always()
        run: docker logs trek-ci 2>&1 || true
@@ -1263,39 +1252,11 @@ jobs:
            --set 'extraEnv[0].name=SESSION_DURATION' \
            --set 'extraEnv[0].value=7d' \
            --set 'extraEnvFrom[0].secretRef.name=trek-smtp' \
-            --set 'extraVolumes[0].name=kitinerary-extractors' \
-            --set 'extraVolumes[0].configMap.name=trek-kitinerary-extractors' \
-            --set 'extraVolumeMounts[0].name=kitinerary-extractors' \
-            --set 'extraVolumeMounts[0].mountPath=/usr/local/share/kitinerary/extractors' \
-            --set 'extraVolumeMounts[0].readOnly=true' \
            --set probes.liveness=null \
            > "$out/variants.yaml"
-          helm template trek charts/trek \
-            --set httpRoute.enabled=true \
-            --set 'httpRoute.parentRefs[0].name=gateway' \
-            > "$out/http-route.yaml"
-          helm template trek charts/trek \
-            --set podSecurityContext.runAsUser=1000 \
-            --set podSecurityContext.runAsGroup=1000 \
-            --set podSecurityContext.runAsNonRoot=true \
-            --set podSecurityContext.seccompProfile.type=RuntimeDefault \
-            --set securityContext.allowPrivilegeEscalation=false \
-            --set 'securityContext.capabilities.drop[0]=ALL' \
-            > "$out/non-root.yaml"
-          helm template trek charts/trek \
-            --set ingress.enabled=true \
-            --set fullnameOverride=custom-trek \
-            --set service.port=8080 \
-            --set-json 'httpRoute={"enabled":true,"parentRefs":[{"name":"gateway","namespace":"gateway-system","sectionName":"https"}],"hostnames":["trek.example.com"],"paths":["/","/api"],"annotations":{"example.com/note":"custom route"},"timeouts":{"request":"0s","backendRequest":"0s"}}' \
-            > "$out/http-route-variants.yaml"

      - name: Check the manifests against the Kubernetes schemas
-        # The pinned Gateway API schema adds HTTPRoute validation without skipping unknown resources.
-        run: >-
-          kubeconform -strict -summary
-          -schema-location default
-          -schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/041baf4c1d3740ca21461cab765e7432ecd073ef/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json'
-          "$RUNNER_TEMP"/rendered/*.yaml
+        run: kubeconform -strict -summary "$RUNNER_TEMP"/rendered/*.yaml

      - name: Check every compose file
        run: |
@@ -91,8 +91,7 @@ ENV KITINERARY_EXTRACTOR_PATH=/usr/local/bin/kitinerary-extractor

 COPY --chown=node:node --from=server-builder /app/server/dist ./server/dist
 # Runtime data assets read from server/assets at runtime: airports.json (flight
-# transport search) and atlas/*.geojson.gz + atlas/admin1/*.geojson.gz (Atlas
-# country/region map). The build
+# transport search) and atlas/*.geojson.gz (Atlas country/region map). The build
 # only emits dist, so these must be copied explicitly or the features silently
 # degrade to empty in the image.
 COPY --chown=node:node --from=server-builder /app/server/assets ./server/assets
@@ -5,9 +5,8 @@ TREK bundles and uses third-party data that requires attribution.
 ## geoBoundaries — country & sub-national boundaries

 The Atlas map's administrative boundaries (admin-0 countries and admin-1
-provinces/counties), shipped at `server/assets/atlas/admin0.geojson.gz`,
-`server/assets/atlas/admin1.geojson.gz` and `server/assets/atlas/admin1/<ISO_A2>.geojson.gz`
-(the same regions, one file per country) and generated by
+provinces/counties), shipped at `server/assets/atlas/admin0.geojson.gz` and
+`server/assets/atlas/admin1.geojson.gz` and generated by
 `server/scripts/build-atlas-geo.mjs`, are derived from **geoBoundaries**.

 > Runfola, D. et al. (2020) geoBoundaries: A global database of political
@@ -6,9 +6,14 @@
  <img src="docs/logo-trek-dark.svg" alt="TREK" height="96" />
 </picture>

-### Every part of your trip. One app you own.
+<br />
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/subtitle-light.png" />
+  <source media="(prefers-color-scheme: light)" srcset="docs/subtitle-dark.png" />
+  <img src="docs/subtitle-dark.png" alt="your trip. your plan." height="28" />
+</picture>

-TREK has grown from a travel planner into a whole ecosystem for trips: plan together in real time on a live map, build hikes, tours and road trips, keep bookings and shared costs in order, pack, write the journal, lay out the photo book and hand the busy work to the built-in AI. Self-hosted, on the web, on your phone and offline.
+A self-hosted, real-time collaborative travel planner — with maps, budgets, packing lists, a journal, and AI built in.

 <br />

@@ -27,16 +32,11 @@ TREK has grown from a travel planner into a whole ecosystem for trips: plan toge
 <a href="https://ko-fi.com/mauriceboe"><img alt="Ko-fi" src="https://img.shields.io/badge/Ko--fi-support-FF5E5B?style=for-the-badge" /></a>
 &nbsp;
 <a href="https://www.buymeacoffee.com/mauriceboe"><img alt="BMAC" src="https://img.shields.io/badge/BMAC-support-FFDD00?style=for-the-badge" /></a>
-&nbsp;
-<a href="LICENSE"><img alt="License" src="https://img.shields.io/badge/License-AGPL_v3-6B7280?style=for-the-badge" /></a>
-&nbsp;
-<a href="https://github.com/liketrek/TREK/releases"><img alt="Latest Release" src="https://img.shields.io/github/v/release/liketrek/trek?include_prereleases&style=for-the-badge&label=Release&color=6B7280" /></a>
-&nbsp;
-<a href="https://hub.docker.com/r/mauriceboe/trek"><img alt="Docker Pulls" src="https://img.shields.io/docker/pulls/mauriceboe/trek?style=for-the-badge&label=Docker%20pulls&color=6B7280" /></a>
-&nbsp;
-<a href="https://github.com/liketrek/TREK"><img alt="Stars" src="https://img.shields.io/github/stars/liketrek/trek?style=for-the-badge&label=Stars&color=6B7280" /></a>
-
-<sub>PUBLIC SERVICES PROUDLY SPONSORED BY</sub><br /><a href="https://cloud.dataforest.net/en?mtm_campaign=trek"><picture><source media="(prefers-color-scheme: dark)" srcset="docs/sponsors/dataforest-light.svg" /><source media="(prefers-color-scheme: light)" srcset="docs/sponsors/dataforest-dark.svg" /><img src="docs/sponsors/dataforest-dark.svg" alt="dataforest cloud" height="30" /></picture></a>
+<br />
+<a href="LICENSE"><img alt="License" src="https://img.shields.io/badge/license-AGPL_v3-6B7280?style=flat-square" /></a>
+<a href="https://github.com/liketrek/TREK/releases"><img alt="Latest Release" src="https://img.shields.io/github/v/release/liketrek/trek?include_prereleases&style=flat-square&color=6B7280" /></a>
+<a href="https://hub.docker.com/r/mauriceboe/trek"><img alt="Docker Pulls" src="https://img.shields.io/docker/pulls/mauriceboe/trek?style=flat-square&color=6B7280" /></a>
+<a href="https://github.com/liketrek/TREK"><img alt="Stars" src="https://img.shields.io/github/stars/liketrek/trek?style=flat-square&color=6B7280" /></a>
 </div>

 ---
@@ -182,7 +182,7 @@ Most of what follows is an addon an admin switches on or off. Lists, Costs, Docu

 #### 📱 Mobile and offline

- **Installable**: iOS and Android straight from the browser, no App Store, standalone with a themed status bar
+- **Apps**: TREK Travel Planner for iPhone, iPad and Android connects to any TREK server, and the browser installs TREK as a standalone app with a themed status bar too
 - **Phone layouts**: their own screens for every part of the app, with a bottom bar and dashboard widgets the user orders
 - **Offline reads**: the app shell is precached and trips, places, tours, files and nearby places live in a per-user IndexedDB store, so a trip opens with no network
 - **Offline writes**: changes queue and replay with an `X-Idempotency-Key`, and a stale edit waits for a keep-mine or keep-theirs choice
@@ -200,7 +200,7 @@ Most of what follows is an addon an admin switches on or off. Lists, Costs, Docu
 - **Admin panel**: users and the permission matrix, defaults for new users, categories and templates, addons, plugins, storage, notifications, MCP tokens, backups, audit log and releases
 - **Backups and storage**: scheduled backups with retention that restore their own secrets, and local or S3-compatible storage per content category with replicas
 - **Appearance**: light, dark or follow the OS, seven colour schemes plus a custom accent, transparency, density, reduced motion and text size
- **28 languages**: en, de, es, fr, it, nl, hu, ru, zh, zh-TW, pl, cs, ar (right to left), he (right to left), br, id, tr, ja, ko, uk, gr, sv, vi, ca, az, et, sk, th
+- **27 languages**: en, de, es, fr, it, nl, hu, ru, zh, zh-TW, pl, cs, ar (right to left), br, id, tr, ja, ko, uk, gr, sv, vi, ca, az, et, sk, th
 - **Help center**: a ? in the top bar with 381 step-by-step guides with screenshots, searched together with the wiki that ships in the image

 </td>
@@ -214,39 +214,7 @@ Most of what follows is an addon an admin switches on or off. Lists, Costs, Docu
 <div align="center">
  <a href="docs/screenshots/showcase-desktop-1.webp"><img src="docs/screenshots/showcase-desktop-1.webp" alt="Atlas · dashboard · trip planner" width="100%" /></a>
  <a href="docs/screenshots/showcase-mobile.webp"><img src="docs/screenshots/showcase-mobile.webp" alt="Mobile PWA · dashboard, day plan, map, costs" width="100%" /></a>
-</div>
-
-<br />
-
-## Powered by [dataforest cloud](https://cloud.dataforest.net/en?mtm_campaign=trek)
-
-<div align="center">
-
-<br />
-
-<a href="https://cloud.dataforest.net/en?mtm_campaign=trek">
-  <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="docs/sponsors/dataforest-light.svg" />
-    <source media="(prefers-color-scheme: light)" srcset="docs/sponsors/dataforest-dark.svg" />
-    <img src="docs/sponsors/dataforest-dark.svg" alt="dataforest cloud" height="60" />
-  </picture>
-</a>
-
-<br />
-<br />
-
-**Every TREK installation in the world searches through servers that [dataforest cloud](https://cloud.dataforest.net/en?mtm_campaign=trek) sponsors.**
-
-The place index with over 88 million places, the address search in every TREK language and the planet-wide routing all run on [dataforest cloud](https://cloud.dataforest.net/en?mtm_campaign=trek) in Frankfurt, Germany, free of charge for everyone who self-hosts TREK. Without this sponsorship, these services would not exist in this form.
-
-Thank you, [dataforest](https://cloud.dataforest.net/en?mtm_campaign=trek), for backing open source this generously. 💚
-
-<br />
-
-<a href="https://cloud.dataforest.net/en?mtm_campaign=trek"><img alt="Visit dataforest cloud" src="https://img.shields.io/badge/Visit-dataforest_cloud-02C382?style=for-the-badge" /></a>
-
-Looking for a server for your own TREK? [dataforest cloud](https://cloud.dataforest.net/en?mtm_campaign=trek) is where TREK's own services live.
-
+  <a href="docs/screenshots/showcase-desktop-2.webp"><img src="docs/screenshots/showcase-desktop-2.webp" alt="Collections · journey journal · costs" width="100%" /></a>
 </div>

 <br />
@@ -276,9 +244,6 @@ Open `http://localhost:3000`, or `http://<server-ip>:3000` from another machine.

 `COOKIE_SECURE=false` is only for trying TREK over plain HTTP: without it the browser drops the session cookie and the login does not stick. Once TREK sits behind HTTPS (see [Reverse Proxy](#reverse-proxy)), remove it.

-> [!TIP]
-> **No server yet?** TREK's own public services run on [**dataforest cloud**](https://cloud.dataforest.net/en?mtm_campaign=trek), our infrastructure sponsor. A small seed is plenty for a TREK instance and is ready within a minute.
-
 <div align="center">

 <a href="#docker-compose-production">Docker Compose</a>&nbsp;&nbsp;·&nbsp;&nbsp;<a href="#helm-kubernetes">Helm / Kubernetes</a>&nbsp;&nbsp;·&nbsp;&nbsp;<a href="#install-as-app-pwa">Install as PWA</a>&nbsp;&nbsp;·&nbsp;&nbsp;<a href="#reverse-proxy">Reverse Proxy</a>
@@ -335,7 +300,7 @@ See [`charts/README.md`](https://github.com/liketrek/TREK/blob/main/charts/READM

 <h2 id="install-as-app-pwa">Install as App (PWA)</h2>

-TREK works as a Progressive Web App — no App Store needed.
+TREK works as a Progressive Web App, and the TREK Travel Planner app for iPhone, iPad and Android connects to the same server ([Native Apps](https://github.com/liketrek/TREK/wiki/Native-Apps)). To install the web app instead:

 1. Open TREK in the browser (HTTPS required)
 2. **iOS**: Share ▸ *Add to Home Screen*
@@ -433,6 +398,16 @@ Caddy handles TLS and WebSockets automatically.
 Every variable, its default and what it does: see
 [Environment Variables](https://github.com/liketrek/TREK/wiki/Environment-Variables).

+## Star History
+
+<a href="https://www.star-history.com/?repos=liketrek%2FTREK&type=date&legend=bottom-right">
+ <picture>
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=liketrek/TREK&type=date&theme=dark&legend=bottom-right&sealed_token=tW9agibKugOyPk0yPURgSdnizM7K72zbJENGD9iyk24ZcwYHtCUn-hk9jh1gdacO0O7xJ3Io7LaNrwYD3mChzcpzZIqDC8_HevYG1qnT0XNTmN6Ez4UZrQ" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=liketrek/TREK&type=date&legend=bottom-right&sealed_token=tW9agibKugOyPk0yPURgSdnizM7K72zbJENGD9iyk24ZcwYHtCUn-hk9jh1gdacO0O7xJ3Io7LaNrwYD3mChzcpzZIqDC8_HevYG1qnT0XNTmN6Ez4UZrQ" />
+   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=liketrek/TREK&type=date&legend=bottom-right&sealed_token=tW9agibKugOyPk0yPURgSdnizM7K72zbJENGD9iyk24ZcwYHtCUn-hk9jh1gdacO0O7xJ3Io7LaNrwYD3mChzcpzZIqDC8_HevYG1qnT0XNTmN6Ez4UZrQ" />
+ </picture>
+</a>
+
 ## Data sources

 The Atlas map's country and sub-national (province/county) boundaries come from
@@ -5,10 +5,9 @@ This is a minimal Helm chart for deploying the TREK app.
 ## Features
 - Deploys the TREK container
 - Exposes port 3000 via Service
- Optional persistent storage for `/app/data` and `/app/uploads`, plus extra volumes and mounts
+- Optional persistent storage for `/app/data` and `/app/uploads`
 - Configurable environment variables and secrets
 - Optional generic Ingress support
- Optional Gateway API HTTPRoute support
 - Configurable health checks (liveness/readiness probes) on `/api/health`

 ## Helm Repository
@@ -28,7 +27,7 @@ helm install trek trek/trek
 Or install directly from the local chart:

 ```sh
-helm install trek ./charts/trek \
+helm install trek ./chart \
  --set ingress.enabled=true \
  --set ingress.hosts[0].host=yourdomain.com
 ```
@@ -48,7 +47,7 @@ See `values.yaml` for more options.
 - `JWT_SECRET` is managed entirely by the server — auto-generated into the data PVC on first start and rotatable via the admin panel (Settings → Danger Zone). No Helm configuration needed.
 - `ENCRYPTION_KEY` encrypts stored secrets (API keys, MFA, SMTP, OIDC) at rest. Recommended: set via `secretEnv.ENCRYPTION_KEY` or `existingSecret`. If left empty, the server falls back automatically: existing installs use `data/.jwt_secret` (no action needed on upgrade); fresh installs auto-generate a key persisted to the data PVC.
 - Liveness and readiness probes are configurable under `probes`. Overrides are merged over the defaults, so `--set probes.liveness.initialDelaySeconds=60` keeps the `httpGet` handler. When switching to `exec` or `tcpSocket`, clear `httpGet` in the same override. Set `probes.liveness: null` to remove a probe.
- If exposing TREK through an Ingress or HTTPRoute, set `env.ALLOWED_ORIGINS` and `env.APP_URL` to the public URL. The chart does not sync these automatically.
+- If using ingress, you must manually keep `env.ALLOWED_ORIGINS` and `ingress.hosts` in sync to ensure CORS works correctly. The chart does not sync these automatically.
 - Set `env.ALLOW_INTERNAL_NETWORK: "true"` if Immich or other integrated services are hosted on a private/RFC-1918 address (e.g. a pod on the same cluster or a NAS on your LAN). Loopback (`127.x`) and link-local/metadata addresses (`169.254.x`) remain blocked regardless.
 - Set `env.ALLOW_LINK_LOCAL_IPS` to a single link-local address (e.g. `"169.254.1.2"`) only when a service TREK needs sits behind one, such as a host gateway. Cloud metadata addresses (`169.254.169.x`, `169.254.170.x`) cannot be listed.
 - `FORCE_HTTPS` is optional. Set `env.FORCE_HTTPS: "true"` only when ingress (or another proxy) terminates TLS. It enables HTTPS redirects, HSTS, CSP `upgrade-insecure-requests`, and forces the session cookie `secure` flag. Requires `TRUST_PROXY` to be set.
@@ -56,5 +55,3 @@ See `values.yaml` for more options.
 - `COOKIE_SECURE` is auto-derived (on when `NODE_ENV=production` or `FORCE_HTTPS=true`). Set `env.COOKIE_SECURE: "false"` only during local testing without TLS. **Not recommended for production.**
 - Web Push needs no chart settings: TREK generates its key pair on first start and keeps it in the database on the data PVC. To bring your own pair, set `env.VAPID_PUBLIC_KEY` and `secretEnv.VAPID_PRIVATE_KEY` together (and optionally `env.VAPID_SUBJECT`); changing the pair later means every device has to turn push on again.
 - Set `env.OIDC_DISCOVERY_URL` to override the auto-constructed OIDC discovery endpoint. Required for providers (e.g. Authentik) that expose it at a non-standard path.
- `podSecurityContext` defaults to `fsGroup: 1000` with `fsGroupChangePolicy: OnRootMismatch`, and `securityContext` (the container's) is empty. The container then starts as root, hands any file under `/app/data` and `/app/uploads` that is not owned by `node` yet to `node`, and drops to `node`. To run as `node` from the start, for example under the `restricted` Pod Security Standard, set `podSecurityContext.runAsUser: 1000` and `runAsGroup: 1000`; the image then skips that step and the privilege drop. See the example in `values.yaml`.
- Use `extraVolumes` and `extraVolumeMounts` to add your own volumes to the pod. To give the booking import more KItinerary extractors, mount a ConfigMap at `/usr/local/share/kitinerary/extractors`, with one `.json` and one `.js` key for each extractor; see the example in `values.yaml`.
@@ -1,5 +1,5 @@
 apiVersion: v2
 name: trek
-version: 5.1.0
+version: 5.0.0
 description: Minimal Helm chart for TREK app
-appVersion: "5.1.0"
+appVersion: "5.0.0"
@@ -31,12 +31,3 @@
     The other values for that volume (size, storageClassName, annotations) are then ignored.
   - With `persistence.enabled=false` the volumes use an emptyDir — storage is ephemeral and is lost
     when the pod restarts. Use only for testing.
-{{- if .Values.httpRoute.enabled }}
-
-6. HTTPRoute:
-   - The chart creates an HTTPRoute v1 to the existing TREK Service. The Gateway, GatewayClass,
-     listeners, TLS certificates and allowedRoutes are managed by your cluster operator.
-   - Ingress and HTTPRoute may be enabled together.
-   - Timeout fields are Standard Channel in Gateway API v1.2, but controller support varies. Omit
-     them to use controller defaults; `0s` disables the corresponding timeout where supported.
-{{- end }}
@@ -112,21 +112,6 @@ data:
  {{- if .Values.env.TREK_PLACES_URL }}
  TREK_PLACES_URL: {{ .Values.env.TREK_PLACES_URL | quote }}
  {{- end }}
-  {{- if .Values.env.TREK_PLACES_CONTRIBUTE }}
-  TREK_PLACES_CONTRIBUTE: {{ .Values.env.TREK_PLACES_CONTRIBUTE | quote }}
-  {{- end }}
-  {{- if .Values.env.TREK_SERVICES }}
-  TREK_SERVICES: {{ .Values.env.TREK_SERVICES | quote }}
-  {{- end }}
-  {{- if .Values.env.TREK_SERVICES_HOSTS }}
-  TREK_SERVICES_HOSTS: {{ .Values.env.TREK_SERVICES_HOSTS | quote }}
-  {{- end }}
-  {{- if .Values.env.TREK_PHOTON_URL }}
-  TREK_PHOTON_URL: {{ .Values.env.TREK_PHOTON_URL | quote }}
-  {{- end }}
-  {{- if .Values.env.TREK_VALHALLA_URL }}
-  TREK_VALHALLA_URL: {{ .Values.env.TREK_VALHALLA_URL | quote }}
-  {{- end }}
  {{- if .Values.env.GOOGLE_LIST_DATA_BASE }}
  GOOGLE_LIST_DATA_BASE: {{ .Values.env.GOOGLE_LIST_DATA_BASE | quote }}
  {{- end }}
@@ -29,18 +29,12 @@ spec:
        - name: {{ .name }}
        {{- end }}
      {{- end }}
-      {{- with .Values.podSecurityContext }}
      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
+        fsGroup: 1000
      containers:
        - name: trek
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          {{- with .Values.securityContext }}
-          securityContext:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
          {{- with .Values.resources }}
          resources:
            {{- toYaml . | nindent 12 }}
@@ -91,12 +85,6 @@ spec:
                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
                  key: PLACES_API_KEY
                  optional: true
-            - name: TREK_SERVICES_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
-                  key: TREK_SERVICES_KEY
-                  optional: true
            - name: AMAP_API_KEY
              valueFrom:
                secretKeyRef:
@@ -147,9 +135,6 @@ spec:
              mountPath: /app/data
            - name: uploads
              mountPath: /app/uploads
-            {{- with .Values.extraVolumeMounts }}
-            {{- toYaml . | nindent 12 }}
-            {{- end }}
          {{- with (default dict .Values.probes).startup }}
          startupProbe:
            {{- toYaml . | nindent 12 }}
@@ -177,6 +162,3 @@ spec:
          {{- else }}
          emptyDir: {}
          {{- end }}
-        {{- with .Values.extraVolumes }}
-        {{- toYaml . | nindent 8 }}
-        {{- end }}
@@ -1,39 +0,0 @@
-{{- if .Values.httpRoute.enabled -}}
-{{- if not .Values.httpRoute.parentRefs }}
-{{- fail "httpRoute.parentRefs must include at least one parent" }}
-{{- end }}
-{{- if not .Values.httpRoute.paths }}
-{{- fail "httpRoute.paths must include at least one path" }}
-{{- end }}
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: {{ include "trek.fullname" . }}
-  labels:
-    app: {{ include "trek.name" . }}
-  {{- with .Values.httpRoute.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  parentRefs:
-    {{- toYaml .Values.httpRoute.parentRefs | nindent 4 }}
-  {{- with .Values.httpRoute.hostnames }}
-  hostnames:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  rules:
-    {{- range $path := .Values.httpRoute.paths }}
-    - matches:
-        - path:
-            type: PathPrefix
-            value: {{ $path | quote }}
-      backendRefs:
-        - name: {{ include "trek.fullname" $ }}
-          port: {{ $.Values.service.port }}
-      {{- with $.Values.httpRoute.timeouts }}
-      timeouts:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-    {{- end }}
-{{- end }}
@@ -23,9 +23,6 @@ data:
  {{- if .Values.secretEnv.PLACES_API_KEY }}
  PLACES_API_KEY: {{ .Values.secretEnv.PLACES_API_KEY | b64enc | quote }}
  {{- end }}
-  {{- if .Values.secretEnv.TREK_SERVICES_KEY }}
-  TREK_SERVICES_KEY: {{ .Values.secretEnv.TREK_SERVICES_KEY | b64enc | quote }}
-  {{- end }}
  {{- if .Values.secretEnv.AMAP_API_KEY }}
  AMAP_API_KEY: {{ .Values.secretEnv.AMAP_API_KEY | b64enc | quote }}
  {{- end }}
@@ -80,9 +77,6 @@ stringData:
  {{- if .Values.secretEnv.PLACES_API_KEY }}
  PLACES_API_KEY: {{ .Values.secretEnv.PLACES_API_KEY | quote }}
  {{- end }}
-  {{- if .Values.secretEnv.TREK_SERVICES_KEY }}
-  TREK_SERVICES_KEY: {{ .Values.secretEnv.TREK_SERVICES_KEY | quote }}
-  {{- end }}
  {{- if .Values.secretEnv.AMAP_API_KEY }}
  AMAP_API_KEY: {{ .Values.secretEnv.AMAP_API_KEY | quote }}
  {{- end }}
@@ -10,34 +10,6 @@ image:
 # processes on one host, which network filesystems do not provide.
 updateStrategy: Recreate

-# Pod-level security context. fsGroup gives the node user (uid/gid 1000) group access
-# to the data and uploads volumes; OnRootMismatch lets the kubelet skip its recursive
-# permission walk once the volume root already matches, so a big PVC does not hold up
-# every start.
-#
-# By default the container starts as root, hands any files that are not node's yet to
-# node, and then drops to node itself. To start it as node straight away (needed under
-# the "restricted" Pod Security Standard), add the user here and lock the container
-# down below; the image then skips the ownership step and the privilege drop:
-#   podSecurityContext:
-#     fsGroup: 1000
-#     fsGroupChangePolicy: OnRootMismatch
-#     runAsUser: 1000
-#     runAsGroup: 1000
-#     runAsNonRoot: true
-#     seccompProfile:
-#       type: RuntimeDefault
-#   securityContext:
-#     allowPrivilegeEscalation: false
-#     capabilities:
-#       drop: [ALL]
-podSecurityContext:
-  fsGroup: 1000
-  fsGroupChangePolicy: OnRootMismatch
-
-# Security context of the trek container itself. Empty by default.
-securityContext: {}
-
 # Optional image pull secrets for private registries
 imagePullSecrets: []
  # - name: my-registry-secret
@@ -64,7 +36,7 @@ env:
  # Browser/OS language is auto-detected first; this is the fallback when no match is found.
  # Supported: ar, az, br, ca, cs, de, en, es, et, fr, gr, hu, id, it, ja, ko, nl, pl, ru, sk, sv, th, tr, uk, vi, zh, zh-TW
  # ALLOWED_ORIGINS: ""
-  # NOTE: If using ingress or HTTPRoute, ensure env.ALLOWED_ORIGINS matches the public domains for proper CORS configuration.
+  # NOTE: If using ingress, ensure env.ALLOWED_ORIGINS matches the domains in ingress.hosts for proper CORS configuration.
  # APP_URL: "https://trek.example.com"
  # Public base URL of this instance. Required when OIDC is enabled — must match the redirect URI registered with your IdP.
  # Also used as the base URL for links in email notifications and other external links.
@@ -120,8 +92,7 @@ env:
  # Custom Nominatim base URL for every geocoding call the server makes (place search, reverse lookup, Atlas region
  # fill). When set it REPLACES the public OpenStreetMap service, with no fallback, so the instance behind it needs
  # the coverage you expect and has to speak the Nominatim API. TREK keeps its ~1 request per second spacing either
-  # way, and search and reverse lookups no longer go to the TREK services' Photon. Defaults to
-  # https://nominatim.openstreetmap.org.
+  # way. Defaults to https://nominatim.openstreetmap.org.
  # OVERPASS_URL: ""
  # Custom Overpass endpoint(s) for the map POI "explore" search, comma-separated. When set, REPLACES the bundled
  # public mirrors — point it at an internal/self-hosted Overpass instance when the public mirrors are unreachable
@@ -141,24 +112,6 @@ env:
  # Base URL of a copy of the Places API you run yourself; it has to answer the same /v1 API. Read from
  # configuration rather than typed by a user, so an in-cluster address works without ALLOW_INTERNAL_NETWORK.
  # Defaults to https://places.liketrek.com.
-  # TREK_PLACES_CONTRIBUTE: "off"
-  # Whether an admin may let this installation send the place details its users typed in (website, phone, e-mail,
-  # opening hours, description, picture) to the TREK Places API. "admin" leaves the choice to the admin panel, where
-  # it stays off until an admin agrees; "off" takes it away. Defaults to admin.
-  # TREK_SERVICES: "off"
-  # Places search identifies this installation with a key it registers by itself on first use and keeps in the
-  # database. "off" sends no key; searches then use the shared pool. A key issued to you goes under
-  # secretEnv.TREK_SERVICES_KEY. Defaults to auto.
-  # TREK_SERVICES_HOSTS: ""
-  # Comma-separated hosts that receive the installation key over https. Defaults to
-  # places.liketrek.com,photon.liketrek.com,valhalla.liketrek.com.
-  # TREK_PHOTON_URL: ""
-  # The address search (Photon) of the TREK services. With a key, search and reverse lookups ask it before
-  # Nominatim and fall back to Nominatim when it does not answer. Never asked when NOMINATIM_URL is set.
-  # Defaults to https://photon.liketrek.com.
-  # TREK_VALHALLA_URL: ""
-  # The Valhalla of the TREK services, which this server relays routing to unless the admin picks another
-  # routing service. The browser never talks to it. Defaults to https://valhalla.liketrek.com.
  # AMAP_API_BASE: ""
  # Send the Amap (高德地图) calls through an egress proxy, a cache or a gateway that speaks the same API instead of
  # restapi.amap.com directly. The key itself is a credential and goes under secretEnv.AMAP_API_KEY, or into
@@ -211,9 +164,6 @@ secretEnv:
  # with signing enabled, because such a key rejects every unsigned request. Leave empty
  # otherwise. The endpoint itself is not a secret and is set under env.AMAP_API_BASE.
  AMAP_API_SECRET: ""
-  # Optional key issued for this installation by the TREK services. Wins over the key TREK
-  # registers by itself and turns that registration off. Leave empty to let TREK register.
-  TREK_SERVICES_KEY: ""
  # Optional Web Push key pair, private half (base64url, 32 bytes). Only used together with
  # env.VAPID_PUBLIC_KEY; a pair whose halves do not belong together, or only one half, turns
  # push off with an error in the log until it is fixed, and every device stays registered.
@@ -229,7 +179,7 @@ generateEncryptionKey: false
 # If set, the chart renders no Secret of its own and instead reads every secret env
 # var from this existing Kubernetes secret. Expected keys: ENCRYPTION_KEY (rename via
 # existingSecretKey), ADMIN_EMAIL, ADMIN_PASSWORD, OIDC_CLIENT_SECRET,
-# UNSPLASH_ACCESS_KEY, PLACES_API_KEY, AMAP_API_KEY, AMAP_API_SECRET, TREK_SERVICES_KEY,
+# UNSPLASH_ACCESS_KEY, PLACES_API_KEY, AMAP_API_KEY, AMAP_API_SECRET,
 # VAPID_PRIVATE_KEY, SMTP_PASS, MAPBOX_ACCESS_TOKEN, CARTO_API_KEY, DEMO_ADMIN_PASS.
 # Missing keys are simply left unset (they are optional), so only provide the ones your
 # setup needs.
@@ -292,20 +242,6 @@ extraEnv: []
 #         name: trek-smtp
 extraEnvFrom: []

-# Further volumes for the pod. The chart does not create the objects they name.
-#   extraVolumes:
-#     - name: kitinerary-extractors
-#       configMap:
-#         name: trek-kitinerary-extractors
-extraVolumes: []
-# Where the trek container mounts them. For example, KItinerary
-# loads extractors for the booking import from this path:
-#   extraVolumeMounts:
-#     - name: kitinerary-extractors
-#       mountPath: /usr/local/share/kitinerary/extractors
-#       readOnly: true
-extraVolumeMounts: []
-
 resources:
  requests:
    cpu: 100m
@@ -326,20 +262,3 @@ ingress:
  #  - secretName: chart-example-tls
  #    hosts:
  #      - chart-example.local
-
-httpRoute:
-  enabled: false
-  annotations: {}
-  parentRefs: []
-  #   - name: gateway
-  #     namespace: gateway-system
-  #     sectionName: https
-  hostnames: []
-  #   - trek.example.com
-  paths:
-    - /
-  # Timeout fields are Standard Channel in Gateway API v1.2; controller support varies.
-  # Leave empty for controller defaults. Use "0s" to disable the corresponding timeout.
-  timeouts: {}
-  #   request: "0s"
-  #   backendRequest: "0s"
@@ -7,3 +7,7 @@ playwright/.cache/
 # vite-plugin-pwa dev output (devOptions.enabled)
 dev-dist/
 e2e/help/media.env
+
+# The native apps' address screen (npm run build:native), copied into
+# android/ and ios/ by `cap sync`
+native-dist/
@@ -0,0 +1,108 @@
+# Using Android gitignore template: https://github.com/github/gitignore/blob/HEAD/Android.gitignore
+
+# Built application files
+*.apk
+*.aar
+*.ap_
+*.aab
+
+# Files for the ART/Dalvik VM
+*.dex
+
+# Java class files
+*.class
+
+# Generated files
+bin/
+gen/
+out/
+#  Uncomment the following line in case you need and you don't have the release build type files in your app
+# release/
+
+# Gradle files
+.gradle/
+build/
+
+# Local configuration file (sdk path, etc)
+local.properties
+
+# Proguard folder generated by Eclipse
+proguard/
+
+# Log Files
+*.log
+
+# Android Studio Navigation editor temp files
+.navigation/
+
+# Android Studio captures folder
+captures/
+
+# IntelliJ
+*.iml
+.idea/workspace.xml
+.idea/tasks.xml
+.idea/gradle.xml
+.idea/assetWizardSettings.xml
+.idea/dictionaries
+.idea/libraries
+# Android Studio 3 in .gitignore file.
+.idea/caches
+.idea/modules.xml
+# Comment next line if keeping position of elements in Navigation Editor is relevant for you
+.idea/navEditor.xml
+
+# Keystore files and store credentials. The upload key and the Play service
+# account live only in the release workflow's secrets and in the owner's
+# offline backup, never in the repository.
+*.jks
+*.keystore
+keystore.properties
+*service-account*.json
+
+# External native build folder generated in Android Studio 2.2 and later
+.externalNativeBuild
+.cxx/
+
+# Google Services (e.g. APIs or Firebase)
+# Push is not wired up and the build does not apply the google-services plugin,
+# so no CI secret is needed. Kept ignored so a stray Firebase config never lands
+# in the repository.
+google-services.json
+app/google-services.json
+
+# Freeline
+freeline.py
+freeline/
+freeline_project_description.json
+
+# fastlane
+fastlane/report.xml
+fastlane/Preview.html
+fastlane/screenshots
+fastlane/test_output
+fastlane/readme.md
+
+# Version control
+vcs.xml
+
+# lint
+lint/intermediates/
+lint/generated/
+lint/outputs/
+lint/tmp/
+# lint/reports/
+
+# Android Profiling
+*.hprof
+
+# Cordova plugins for Capacitor
+capacitor-cordova-android-plugins
+
+# Copied web assets
+app/src/main/assets/public
+
+# Generated Config files
+app/src/main/assets/capacitor.config.json
+app/src/main/assets/capacitor.plugins.json
+app/src/main/res/xml/config.xml
@@ -0,0 +1,2 @@
+/build/*
+!/build/.npmkeep
@@ -0,0 +1,66 @@
+apply plugin: 'com.android.application'
+
+android {
+    namespace = "com.liketrek.trek"
+    compileSdk = rootProject.ext.compileSdkVersion
+    defaultConfig {
+        applicationId "com.liketrek.trek"
+        minSdkVersion rootProject.ext.minSdkVersion
+        targetSdkVersion rootProject.ext.targetSdkVersion
+        // The release workflow (.github/workflows/native-release.yml) passes both:
+        // the version from client/package.json and a build number that only grows.
+        // Local and PR builds fall back to these placeholders.
+        versionCode((project.findProperty('trekVersionCode') ?: '1') as Integer)
+        versionName(project.findProperty('trekVersionName') ?: '0.0.0-dev')
+        testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
+        aaptOptions {
+             // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.
+             // Default: https://android.googlesource.com/platform/frameworks/base/+/282e181b58cf72b6ca770dc7ca5f91f135444502/tools/aapt/AaptAssets.cpp#61
+            ignoreAssetsPattern = '!.svn:!.git:!.ds_store:!*.scc:.*:!CVS:!thumbs.db:!picasa.ini:!*~'
+        }
+    }
+    // The upload key only exists in the release workflow, which decodes it from a
+    // secret and passes its path and passwords as Gradle properties. Every other
+    // build (local, fork, PR) stays unsigned and needs no secret.
+    signingConfigs {
+        release {
+            if (project.hasProperty('trekKeystore')) {
+                storeFile file(project.property('trekKeystore'))
+                storePassword project.property('trekKeystorePassword')
+                keyAlias project.property('trekKeyAlias')
+                keyPassword project.property('trekKeyPassword')
+            }
+        }
+    }
+    buildTypes {
+        release {
+            if (project.hasProperty('trekKeystore')) {
+                signingConfig signingConfigs.release
+            }
+            minifyEnabled true
+            shrinkResources true
+            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
+        }
+    }
+}
+
+repositories {
+    flatDir{
+        dirs '../capacitor-cordova-android-plugins/src/main/libs', 'libs'
+    }
+}
+
+dependencies {
+    implementation fileTree(include: ['*.jar'], dir: 'libs')
+    implementation "androidx.appcompat:appcompat:$androidxAppCompatVersion"
+    implementation "androidx.coordinatorlayout:coordinatorlayout:$androidxCoordinatorLayoutVersion"
+    implementation "androidx.core:core-splashscreen:$coreSplashScreenVersion"
+    implementation "androidx.browser:browser:$androidxBrowserVersion"
+    implementation project(':capacitor-android')
+    testImplementation "junit:junit:$junitVersion"
+    androidTestImplementation "androidx.test.ext:junit:$androidxJunitVersion"
+    androidTestImplementation "androidx.test.espresso:espresso-core:$androidxEspressoCoreVersion"
+    implementation project(':capacitor-cordova-android-plugins')
+}
+
+apply from: 'capacitor.build.gradle'
@@ -0,0 +1,25 @@
+// DO NOT EDIT THIS FILE! IT IS GENERATED EACH TIME "capacitor update" IS RUN
+
+android {
+  compileOptions {
+      sourceCompatibility JavaVersion.VERSION_21
+      targetCompatibility JavaVersion.VERSION_21
+  }
+}
+
+apply from: "../capacitor-cordova-android-plugins/cordova.variables.gradle"
+dependencies {
+    implementation project(':capacitor-app')
+    implementation project(':capacitor-filesystem')
+    implementation project(':capacitor-haptics')
+    implementation project(':capacitor-keyboard')
+    implementation project(':capacitor-share')
+    implementation project(':capacitor-splash-screen')
+    implementation project(':capacitor-status-bar')
+
+}
+
+
+if (hasProperty('postBuildExtras')) {
+  postBuildExtras()
+}
@@ -0,0 +1,38 @@
+# Add project specific ProGuard rules here.
+# You can control the set of applied configuration files using the
+# proguardFiles setting in build.gradle.
+#
+# For more details, see
+#   http://developer.android.com/guide/developing/tools/proguard.html
+
+# If your project uses WebView with JS, uncomment the following
+# and specify the fully qualified class name to the JavaScript interface
+# class:
+#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
+#   public *;
+#}
+
+# Uncomment this to preserve the line number information for
+# debugging stack traces.
+#-keepattributes SourceFile,LineNumberTable
+
+# If you keep the line number information, uncomment this to
+# hide the original source file name.
+#-renamesourcefileattribute SourceFile
+
+# TREK's own classes: TrekShellPlugin is reached from JavaScript by name and its
+# methods through reflection, so R8 must neither rename nor drop them.
+-keep class com.liketrek.trek.** { *; }
+
+# Every Capacitor plugin: the bridge finds plugins by their annotation and calls
+# the annotated methods reflectively.
+-keep @com.getcapacitor.annotation.CapacitorPlugin public class * {
+    @com.getcapacitor.PluginMethod public <methods>;
+}
+
+# The WebView bridge: Capacitor's message handler is called from JavaScript
+# through @JavascriptInterface, and every plugin class is instantiated by name.
+-keepclassmembers class * {
+    @android.webkit.JavascriptInterface <methods>;
+}
+-keep public class * extends com.getcapacitor.Plugin
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools">
+
+    <application
+        android:allowBackup="false"
+        android:icon="@mipmap/ic_launcher"
+        android:label="@string/app_name"
+        android:networkSecurityConfig="@xml/network_security_config"
+        android:roundIcon="@mipmap/ic_launcher_round"
+        android:supportsRtl="true"
+        android:theme="@style/AppTheme">
+
+        <activity
+            android:configChanges="orientation|keyboardHidden|keyboard|screenSize|locale|smallestScreenSize|screenLayout|uiMode|navigation|density"
+            android:name=".MainActivity"
+            android:label="@string/title_activity_main"
+            android:theme="@style/AppTheme.NoActionBarLaunch"
+            android:launchMode="singleTask"
+            android:exported="true">
+
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+
+            <!-- Deep links.
+
+                 The scheme is @string/custom_url_scheme (com.liketrek.trek).
+                 launchMode is singleTask above, so a link delivers into the
+                 running task via onNewIntent rather than starting a second copy
+                 of the app on top of the first.
+
+                 This is the return path for SSO and passkey sign-in: TrekShell
+                 opens the server's login page in a Custom Tab, and after the
+                 hand-off it redirects to com.liketrek.trek://auth?code=…, which
+                 lands here and in TrekShellPlugin.handleOnNewIntent.
+
+                 Not an App Link (autoVerify + https). App Links are verified
+                 against a specific domain via assetlinks.json, and TREK is
+                 self-hosted — there is no single domain to verify against. A
+                 custom scheme is the only form that works for every user's
+                 server. -->
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="@string/custom_url_scheme" />
+            </intent-filter>
+
+        </activity>
+
+        <provider
+            android:name="androidx.core.content.FileProvider"
+            android:authorities="${applicationId}.fileprovider"
+            android:exported="false"
+            android:grantUriPermissions="true">
+            <meta-data
+                android:name="android.support.FILE_PROVIDER_PATHS"
+                android:resource="@xml/file_paths"></meta-data>
+        </provider>
+
+    </application>
+
+    <!-- Permissions. Only what the WebView itself needs: the file picker's
+         camera option and navigator.geolocation for "locate me" on the map,
+         both granted at runtime through Capacitor's WebChromeClient. -->
+
+    <uses-permission android:name="android.permission.INTERNET" />
+    <!-- COARSE is listed first because it is the weaker grant and is enough
+         for "what city am I in". -->
+    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
+    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
+    <!-- required="false" on purpose: TREK is a planner, and everything except
+         "locate me" works without GPS hardware. Marking it required would have
+         Play hide the app from tablets and other GPS-less devices. -->
+    <uses-feature android:name="android.hardware.location.gps" android:required="false" />
+    <uses-permission android:name="android.permission.CAMERA" />
+    <uses-feature android:name="android.hardware.camera" android:required="false" />
+</manifest>
@@ -0,0 +1,50 @@
+package com.liketrek.trek;
+
+import android.content.Intent;
+import android.os.Bundle;
+import android.view.View;
+import com.getcapacitor.BridgeActivity;
+
+public class MainActivity extends BridgeActivity {
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        registerPlugin(TrekShellPlugin.class);
+        // With a server picked, the WebView loads that server instead of the
+        // bundled address screen, so the UI arrives in the version the server
+        // runs and on its own origin. BridgeActivity reads `config` while it
+        // builds the bridge inside super.onCreate().
+        boolean restarting = TrekServerStore.consumeRestart(this);
+        String server = TrekServerStore.getUrl(this);
+        boolean onServer = server != null && !TrekServerStore.consumeShellOnce(this);
+        config = TrekServerStore.configFor(this, onServer ? server : null, restarting);
+        super.onCreate(savedInstanceState);
+        if (bridge == null) return;
+        // The UI asks for no overscroll effect (overscroll-behavior: none on html)
+        // and Chrome honours that, but the WebView draws the stretch on its root
+        // scroller natively. It scales the whole view, top bar and bottom dock included.
+        bridge.getWebView().setOverScrollMode(View.OVER_SCROLL_NEVER);
+        // Set before any WebView callback can run: they are posted to this thread.
+        if (onServer) bridge.setWebViewClient(new TrekWebViewClient(bridge, this::showAddressScreen));
+    }
+
+    private boolean leavingServer;
+
+    /**
+     * The server did not load: back to the address screen, which offers retry
+     * and change. A fresh task rather than recreate(), because this usually
+     * happens during launch, while the system splash is still up, and a
+     * recreated activity leaves that splash lying over the new page.
+     */
+    private void showAddressScreen() {
+        // A failed page can report more than one error; restart only once.
+        if (leavingServer) return;
+        leavingServer = true;
+        TrekServerStore.showShellOnce(this);
+        TrekServerStore.markRestart(this);
+        runOnUiThread(() -> {
+            startActivity(new Intent(this, MainActivity.class).addFlags(Intent.FLAG_ACTIVITY_NEW_TASK | Intent.FLAG_ACTIVITY_CLEAR_TASK));
+            overridePendingTransition(0, 0);
+        });
+    }
+}
@@ -0,0 +1,123 @@
+package com.liketrek.trek;
+
+import android.content.Context;
+import android.content.SharedPreferences;
+import com.getcapacitor.CapConfig;
+import com.getcapacitor.Logger;
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import org.json.JSONException;
+import org.json.JSONObject;
+
+/** The server the user picked, and the Capacitor configuration that loads it. */
+final class TrekServerStore {
+
+    private static final String PREFS = "trek_shell";
+    private static final String KEY_URL = "server_url";
+    private static final String KEY_SHELL_ONCE = "shell_once";
+    private static final String KEY_RESTART = "restart";
+    private static final String CONFIG_DIR = "trek-server-config";
+
+    private TrekServerStore() {}
+
+    static String getUrl(Context context) {
+        return prefs(context).getString(KEY_URL, null);
+    }
+
+    static void setUrl(Context context, String url) {
+        SharedPreferences.Editor editor = prefs(context).edit();
+        if (url == null) {
+            editor.remove(KEY_URL);
+        } else {
+            editor.putString(KEY_URL, url);
+        }
+        editor.commit();
+    }
+
+    /** Start the next launch on the bundled address screen, even with a server remembered. */
+    static void showShellOnce(Context context) {
+        prefs(context).edit().putBoolean(KEY_SHELL_ONCE, true).commit();
+    }
+
+    static boolean consumeShellOnce(Context context) {
+        return consume(context, KEY_SHELL_ONCE);
+    }
+
+    /** The next onCreate is the app restarting itself, not a launch. */
+    static void markRestart(Context context) {
+        prefs(context).edit().putBoolean(KEY_RESTART, true).commit();
+    }
+
+    static boolean consumeRestart(Context context) {
+        return consume(context, KEY_RESTART);
+    }
+
+    private static boolean consume(Context context, String key) {
+        boolean set = prefs(context).getBoolean(key, false);
+        if (set) prefs(context).edit().remove(key).commit();
+        return set;
+    }
+
+    /**
+     * The bundled capacitor.config.json, adjusted for this start. Capacitor only
+     * takes these settings from a config file, so this writes a copy into the
+     * app's private storage and loads that; null means the bundled one as it is.
+     *
+     * With a server: server.url set, and server.errorPath dropped, because that
+     * page would have no bridge on the server's origin (TrekWebViewClient
+     * handles a failed load instead).
+     *
+     * On a restart: no launch splash. The splash plugin shows it again after
+     * recreate() but cannot take it down when the page hides it early, which
+     * left it covering a fully rendered page. A restart has no launch to cover.
+     */
+    static CapConfig configFor(Context context, String url, boolean restarting) {
+        if (url == null && !restarting) return null;
+        try {
+            JSONObject json = new JSONObject(readAsset(context, "capacitor.config.json"));
+            if (url != null) {
+                JSONObject server = child(json, "server");
+                server.put("url", url);
+                server.remove("errorPath");
+            }
+            if (restarting) {
+                child(child(json, "plugins"), "SplashScreen").put("launchShowDuration", 0);
+            }
+
+            File dir = new File(context.getFilesDir(), CONFIG_DIR);
+            if (!dir.isDirectory() && !dir.mkdirs()) throw new IOException("Cannot create " + dir);
+            try (FileOutputStream out = new FileOutputStream(new File(dir, "capacitor.config.json"))) {
+                out.write(json.toString().getBytes(StandardCharsets.UTF_8));
+            }
+            return CapConfig.loadFromFile(context, dir.getAbsolutePath());
+        } catch (IOException | JSONException ex) {
+            Logger.error("TrekShell", "Could not adjust the app config for " + url, ex);
+            return null;
+        }
+    }
+
+    private static JSONObject child(JSONObject parent, String key) throws JSONException {
+        JSONObject existing = parent.optJSONObject(key);
+        if (existing != null) return existing;
+        JSONObject created = new JSONObject();
+        parent.put(key, created);
+        return created;
+    }
+
+    private static String readAsset(Context context, String name) throws IOException {
+        try (InputStream in = context.getAssets().open(name); ByteArrayOutputStream out = new ByteArrayOutputStream()) {
+            byte[] buffer = new byte[8192];
+            int read;
+            while ((read = in.read(buffer)) != -1) out.write(buffer, 0, read);
+            return out.toString("UTF-8");
+        }
+    }
+
+    private static SharedPreferences prefs(Context context) {
+        return context.getSharedPreferences(PREFS, Context.MODE_PRIVATE);
+    }
+}
@@ -0,0 +1,149 @@
+package com.liketrek.trek;
+
+import android.content.Intent;
+import android.net.Uri;
+import android.os.Handler;
+import android.os.Looper;
+import androidx.browser.customtabs.CustomTabsIntent;
+import com.getcapacitor.JSObject;
+import com.getcapacitor.Plugin;
+import com.getcapacitor.PluginCall;
+import com.getcapacitor.PluginMethod;
+import com.getcapacitor.annotation.CapacitorPlugin;
+import org.json.JSONObject;
+
+/** The native half of client/src/native/trekShell.ts. */
+@CapacitorPlugin(name = "TrekShell")
+public class TrekShellPlugin extends Plugin {
+
+    /** How long to wait after returning from the browser for the redirect to land. */
+    private static final long CANCEL_GRACE_MS = 600;
+
+    private String authCallId;
+    private String authScheme;
+    private boolean authBrowserOpen;
+    private final Handler handler = new Handler(Looper.getMainLooper());
+
+    @PluginMethod
+    public void getServer(PluginCall call) {
+        String url = TrekServerStore.getUrl(getContext());
+        JSObject result = new JSObject();
+        result.put("url", url == null ? JSONObject.NULL : url);
+        call.resolve(result);
+    }
+
+    @PluginMethod
+    public void setServer(PluginCall call) {
+        String url = call.getString("url");
+        Uri parsed = url == null ? null : Uri.parse(url);
+        if (parsed == null || parsed.getHost() == null || !("https".equals(parsed.getScheme()) || "http".equals(parsed.getScheme()))) {
+            call.reject("A http(s) URL is required");
+            return;
+        }
+        TrekServerStore.setUrl(getContext(), url);
+        call.resolve();
+        restart();
+    }
+
+    @PluginMethod
+    public void resetServer(PluginCall call) {
+        TrekServerStore.setUrl(getContext(), null);
+        call.resolve();
+        restart();
+    }
+
+    @PluginMethod
+    public void reload(PluginCall call) {
+        call.resolve();
+        restart();
+    }
+
+    /** The server URL is part of the bridge's configuration, so it takes a new activity. */
+    private void restart() {
+        TrekServerStore.markRestart(getContext());
+        getActivity().runOnUiThread(() -> getActivity().recreate());
+    }
+
+    @PluginMethod
+    public void authenticate(PluginCall call) {
+        String url = call.getString("url");
+        String scheme = call.getString("callbackScheme");
+        if (url == null || scheme == null) {
+            call.reject("url and callbackScheme are required");
+            return;
+        }
+        rejectPendingAuth("Superseded by a new sign-in");
+        call.setKeepAlive(true);
+        getBridge().saveCall(call);
+        authCallId = call.getCallbackId();
+        authScheme = scheme;
+        authBrowserOpen = true;
+        // A Custom Tab shares the browser's cookies, so a running SSO session at
+        // the identity provider carries over. The redirect back to the app's
+        // scheme arrives through the intent-filter in AndroidManifest.xml.
+        new CustomTabsIntent.Builder().build().launchUrl(getActivity(), Uri.parse(url));
+    }
+
+    @Override
+    protected void handleOnNewIntent(Intent intent) {
+        super.handleOnNewIntent(intent);
+        Uri data = intent.getData();
+        PluginCall call = pendingAuthCall();
+        if (call == null || data == null || !authScheme.equals(data.getScheme())) return;
+        JSObject result = new JSObject();
+        result.put("url", data.toString());
+        call.resolve(result);
+        finishAuth(call);
+    }
+
+    /**
+     * Back in the app without a redirect means the user closed the browser.
+     * onNewIntent runs before onResume when the redirect did arrive, so the
+     * grace period only covers devices that deliver the two out of order.
+     */
+    @Override
+    protected void handleOnResume() {
+        super.handleOnResume();
+        if (!authBrowserOpen) return;
+        authBrowserOpen = false;
+        handler.postDelayed(() -> {
+            PluginCall call = pendingAuthCall();
+            if (call == null) return;
+            call.reject("Sign-in cancelled", "CANCELLED");
+            finishAuth(call);
+        }, CANCEL_GRACE_MS);
+    }
+
+    private PluginCall pendingAuthCall() {
+        return authCallId == null ? null : getBridge().getSavedCall(authCallId);
+    }
+
+    private void rejectPendingAuth(String message) {
+        PluginCall call = pendingAuthCall();
+        if (call == null) return;
+        call.reject(message, "CANCELLED");
+        finishAuth(call);
+    }
+
+    private void finishAuth(PluginCall call) {
+        getBridge().releaseCall(call);
+        authCallId = null;
+        authScheme = null;
+        authBrowserOpen = false;
+    }
+
+    /** iOS only: Android keeps the service worker, which already starts TREK offline. */
+    @PluginMethod
+    public void refreshOfflineCopy(PluginCall call) {
+        JSObject result = new JSObject();
+        result.put("saved", false);
+        call.resolve(result);
+    }
+
+    @PluginMethod
+    public void openOfflineCopy(PluginCall call) {
+        JSObject result = new JSObject();
+        result.put("opened", false);
+        call.resolve(result);
+    }
+}
@@ -0,0 +1,49 @@
+package com.liketrek.trek;
+
+import android.webkit.WebResourceError;
+import android.webkit.WebResourceRequest;
+import android.webkit.WebResourceResponse;
+import android.webkit.WebView;
+import com.getcapacitor.Bridge;
+import com.getcapacitor.BridgeWebViewClient;
+
+/**
+ * Used while the WebView shows the user's server. When that server cannot be
+ * loaded, Capacitor would show server.errorPath, but on Android it injects
+ * its bridge only into the server's origin, so that local page could neither
+ * retry nor change the server and stayed blank. Instead the app restarts on
+ * the bundled address screen, where the bridge is present and the screen
+ * offers exactly those two things.
+ */
+class TrekWebViewClient extends BridgeWebViewClient {
+
+    private final Runnable onUnreachable;
+
+    TrekWebViewClient(Bridge bridge, Runnable onUnreachable) {
+        super(bridge);
+        this.onUnreachable = onUnreachable;
+    }
+
+    @Override
+    public void onReceivedError(WebView view, WebResourceRequest request, WebResourceError error) {
+        if (request.isForMainFrame()) {
+            onUnreachable.run();
+            return;
+        }
+        super.onReceivedError(view, request, error);
+    }
+
+    /**
+     * Only a 5xx on the page itself means the server is down (a proxy's 502 or
+     * 503 while TREK restarts). A 4xx page is left alone: the server answered,
+     * and TREK serves its UI for every other path.
+     */
+    @Override
+    public void onReceivedHttpError(WebView view, WebResourceRequest request, WebResourceResponse errorResponse) {
+        if (!request.isForMainFrame()) {
+            super.onReceivedHttpError(view, request, errorResponse);
+        } else if (errorResponse.getStatusCode() >= 500) {
+            onUnreachable.run();
+        }
+    }
+}
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+<androidx.coordinatorlayout.widget.CoordinatorLayout xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:app="http://schemas.android.com/apk/res-auto"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent"
+    tools:context=".MainActivity">
+
+    <WebView
+        android:layout_width="match_parent"
+        android:layout_height="match_parent" />
+</androidx.coordinatorlayout.widget.CoordinatorLayout>
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+    <background>
+        <inset android:drawable="@mipmap/ic_launcher_background" android:inset="16.7%" />
+    </background>
+    <foreground>
+        <inset android:drawable="@mipmap/ic_launcher_foreground" android:inset="16.7%" />
+    </foreground>
+    <monochrome>
+        <inset android:drawable="@mipmap/ic_launcher_foreground" android:inset="16.7%" />
+    </monochrome>
+</adaptive-icon>
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+    <background>
+        <inset android:drawable="@mipmap/ic_launcher_background" android:inset="16.7%" />
+    </background>
+    <foreground>
+        <inset android:drawable="@mipmap/ic_launcher_foreground" android:inset="16.7%" />
+    </foreground>
+    <monochrome>
+        <inset android:drawable="@mipmap/ic_launcher_foreground" android:inset="16.7%" />
+    </monochrome>
+</adaptive-icon>
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <color name="ic_launcher_background">#09090B</color>
+    <color name="launch_background">#09090B</color>
+</resources>
@@ -0,0 +1,7 @@
+<?xml version='1.0' encoding='utf-8'?>
+<resources>
+    <string name="app_name">TREK</string>
+    <string name="title_activity_main">TREK</string>
+    <string name="package_name">com.liketrek.trek</string>
+    <string name="custom_url_scheme">com.liketrek.trek</string>
+</resources>
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+
+    <!-- Base application theme. -->
+    <style name="AppTheme" parent="Theme.AppCompat.Light.DarkActionBar">
+        <!-- Customize your theme here. -->
+        <item name="colorPrimary">@color/colorPrimary</item>
+        <item name="colorPrimaryDark">@color/colorPrimaryDark</item>
+        <item name="colorAccent">@color/colorAccent</item>
+    </style>
+
+    <style name="AppTheme.NoActionBar" parent="Theme.AppCompat.DayNight.NoActionBar">
+        <item name="windowActionBar">false</item>
+        <item name="windowNoTitle">true</item>
+        <item name="android:background">@null</item>
+    </style>
+
+
+    <style name="AppTheme.NoActionBarLaunch" parent="Theme.SplashScreen">
+        <item name="android:background">@drawable/splash</item>
+        <!-- Android 12+ draws its own launch screen: the app icon on this colour.
+             The same near-black as the icon tile and the first painted frame. -->
+        <item name="windowSplashScreenBackground">@color/launch_background</item>
+    </style>
+</resources>
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<paths xmlns:android="http://schemas.android.com/apk/res/android">
+    <cache-path name="my_cache_images" path="." />
+</paths>
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  TREK is self-hosted: the user points the app at their own server, so we cannot
+  know its scheme or its certificate authority ahead of time. Two deliberate
+  relaxations, both required for that to work at all:
+
+  1. cleartextTrafficPermitted="true" — Android blocks http:// by default from
+     targetSdk 28 on. A bare LAN server (http://192.168.1.10:3001) and a
+     Tailscale host (100.64.0.0/10, which is NOT RFC1918, so a private-range
+     allowlist would not cover it) both need this. https:// is unaffected and
+     remains the recommended setup.
+
+  2. <certificates src="user" /> — since Android 7 apps ignore user-installed
+     CAs unless they opt in. Self-hosters running their own CA (step-ca, mkcert,
+     an internal PKI) install its root on the device; without this the app would
+     reject their perfectly valid https:// server. System CAs stay first so
+     public certs keep validating normally.
+
+  The tradeoff is that a user-installed CA can also be a MITM proxy's. That is
+  the same tradeoff the browser-based PWA already makes, and it is the price of
+  letting people run their own infrastructure.
+-->
+<network-security-config>
+    <base-config cleartextTrafficPermitted="true">
+        <trust-anchors>
+            <certificates src="system" />
+            <certificates src="user" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>
@@ -0,0 +1,28 @@
+// Top-level build file where you can add configuration options common to all sub-projects/modules.
+
+buildscript {
+    
+    repositories {
+        google()
+        mavenCentral()
+    }
+    dependencies {
+        classpath 'com.android.tools.build:gradle:8.13.0'
+
+        // NOTE: Do not place your application dependencies here; they belong
+        // in the individual module build.gradle files
+    }
+}
+
+apply from: "variables.gradle"
+
+allprojects {
+    repositories {
+        google()
+        mavenCentral()
+    }
+}
+
+task clean(type: Delete) {
+    delete rootProject.buildDir
+}
@@ -0,0 +1,24 @@
+// DO NOT EDIT THIS FILE! IT IS GENERATED EACH TIME "capacitor update" IS RUN
+include ':capacitor-android'
+project(':capacitor-android').projectDir = new File('../../node_modules/@capacitor/android/capacitor')
+
+include ':capacitor-app'
+project(':capacitor-app').projectDir = new File('../../node_modules/@capacitor/app/android')
+
+include ':capacitor-filesystem'
+project(':capacitor-filesystem').projectDir = new File('../../node_modules/@capacitor/filesystem/android')
+
+include ':capacitor-haptics'
+project(':capacitor-haptics').projectDir = new File('../../node_modules/@capacitor/haptics/android')
+
+include ':capacitor-keyboard'
+project(':capacitor-keyboard').projectDir = new File('../../node_modules/@capacitor/keyboard/android')
+
+include ':capacitor-share'
+project(':capacitor-share').projectDir = new File('../../node_modules/@capacitor/share/android')
+
+include ':capacitor-splash-screen'
+project(':capacitor-splash-screen').projectDir = new File('../../node_modules/@capacitor/splash-screen/android')
+
+include ':capacitor-status-bar'
+project(':capacitor-status-bar').projectDir = new File('../../node_modules/@capacitor/status-bar/android')
@@ -0,0 +1,22 @@
+# Project-wide Gradle settings.
+
+# IDE (e.g. Android Studio) users:
+# Gradle settings configured through the IDE *will override*
+# any settings specified in this file.
+
+# For more details on how to configure your build environment visit
+# http://www.gradle.org/docs/current/userguide/build_environment.html
+
+# Specifies the JVM arguments used for the daemon process.
+# The setting is particularly useful for tweaking memory settings.
+org.gradle.jvmargs=-Xmx1536m
+
+# When configured, Gradle will run in incubating parallel mode.
+# This option should only be used with decoupled projects. More details, visit
+# http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects
+# org.gradle.parallel=true
+
+# AndroidX package structure to make it clearer which packages are bundled with the
+# Android operating system, and which are packaged with your app's APK
+# https://developer.android.com/topic/libraries/support-library/androidx-rn
+android.useAndroidX=true
@@ -0,0 +1,7 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-all.zip
+networkTimeout=10000
+validateDistributionUrl=true
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists
@@ -0,0 +1,251 @@
+#!/bin/sh
+
+#
+# Copyright © 2015-2021 the original authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+##############################################################################
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
+##############################################################################
+
+# Attempt to set APP_HOME
+
+# Resolve links: $0 may be a link
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
+done
+
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD=maximum
+
+warn () {
+    echo "$*"
+} >&2
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+} >&2
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
+esac
+
+CLASSPATH="\\\"\\\""
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD=$JAVA_HOME/jre/sh/java
+    else
+        JAVACMD=$JAVA_HOME/bin/java
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD=java
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+fi
+
+# Increase the maximum file descriptors if we can.
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
+    esac
+fi
+
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
+        fi
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
+    done
+fi
+
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
+
+exec "$JAVACMD" "$@"
@@ -0,0 +1,94 @@
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
+
+@if "%DEBUG%"=="" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if %ERRORLEVEL% equ 0 goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=
+
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
+
+:end
+@rem End local scope for the variables with windows NT shell
+if %ERRORLEVEL% equ 0 goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Maurice	cb6149f8ba	fix(native): read a notice button's href without a weak type An action button carries no href, so a parameter typed as only an optional href refused the notice DTO; the button type now names its kind as well.	2026-10-25 18:58:27 +01:00
Maurice	8963180006	feat(native): everything the App Store and Google Play submissions need - iOS: microphone usage text for "Take Video", no-export-compliance flag, ExportOptions.plist for App Store Connect uploads, the unused push forwarders gone; CI builds with Xcode 26 and lints the property lists. - Android: version and signing from Gradle properties (unsigned without them), R8 with keep rules for TREK's and Capacitor's reflective classes, no Auto Backup of the session cookie, no external file provider path, template and Firebase leftovers removed, keystores and service accounts ignored, full-size adaptive icon layers with a monochrome layer; CI also builds the release APK. - native-release.yml: signed bundle to a Play testing track and archive to TestFlight, by hand or on a v* tag, behind the store environment. - Version handshake: the server reports nativeApi 1, the app refuses a server below its minimum and tolerates an app older than the offline copy. - Address screen: privacy policy link, "Try the demo" and "What is a TREK server?"; the privacy link also in the app's server settings. Three new native strings in all 27 locales. - Donation links and the notices asking for one are hidden in the app. - Store listings for "TREK Travel Planner" in client/fastlane: texts, review notes with placeholders, privacy and account deletion page drafts, the feature graphic and icon, a length and image check in CI, and a Playwright store project with the scripts that turn its captures into screenshots. - Docs: wiki/Native-Apps.md, README no longer says there is no store app.	2026-10-25 18:37:31 +01:00
Maurice	5c37dd43c5	fix(native): hide passkeys in the app through usePasskeys The flag in useAccountSettings grew the identical destructuring in both account views past the duplication threshold; the shared passkeys hook already decides when its card is hidden, so the app check lives there now.	2026-10-25 18:02:45 +01:00
Maurice	6f3c051c7c	fix(native): Prettier on the native client files, rate-limit e2e requests in sequence Formats the files the client formatting gate listed, and NATIVE-E2E-005 sends its twenty exchange attempts one after another: all at once they reset the test server's connections.	2026-10-25 17:41:32 +01:00
Maurice	99c1a2d6c7	fix(native): strict types in the address screen, Prettier on the native-auth e2e suite, file-local exports The address screen's element helper returns the plain element instead of Object.assign's intersection, which strict mode could not represent; the haptics test reads an optional argument as optional; three exports only their own file used are local now.	2026-10-25 17:26:03 +01:00
Maurice	a3b04887a1	fix(native): new lint warnings and the MapLibre protocol type after the dev merge Awaits that sat in loops in the native-auth tests run together, the hand-off hook marks its navigations as ignored, the native tests drop their non-null assertions, and the offline protocol answers with the data type MapLibre 6.15 expects.	2026-10-25 17:16:02 +01:00
Maurice	8b6a65023f	Merge dev into feat/native-apps Brings the native apps branch up to dev (NestJS-only server, MikroORM repositories, tracked sessions, per-domain locales, the lint ratchets) and ports its new code onto that architecture: - server: /api/auth/native moves onto injected services. The session is minted by the auth domain's new LoginSessionService (login bookkeeping and SessionsService.issue in one transaction), the one-time codes live behind a NativeHandoffStore port with a capped in-memory implementation that drops expired codes on write instead of running a timer, both routes declare response contracts, and the exchange answers { success: true }. Unit and e2e suites run on createTestModule and the ORM factories. - shared: native strings for az, et, sk and th, native wired into every locale, the address placeholder as a full URL. - client: the account and export changes go into dev's shared hooks (useAccountSettings, useTripExport), the native server card is a desktop/phone pair on useNativeServer, the hand-off call moves out of the page hook into native/, best-effort native failures go through reportError instead of the console, and the address screen is known to knip and lint:i18n-keys. - package-lock.json regenerated on Linux.	2026-10-25 17:04:15 +01:00
Maurice	7572c610a6	feat(native): TREK's own app icon and launch screen, named just TREK The shells still carried Capacitor's placeholder icon and splash, the blue X on a grid. They now show the white TREK mark on a dark, slightly glassy tile: a soft light from the top left and a sheen over the upper half, in the app's launch colour #09090b. Android 12+ draws its launch screen on the same colour instead of light grey. scripts/generate-app-icons.mjs renders the sources into assets/ from public/icons/icon-white.svg, and `npm run icons:app` turns them into every size both platforms ask for through @capacitor/assets. The Android foreground mark is sized for the adaptive icon's round mask. The home screen label is TREK: the old "TREK - Plan your trips!" was cut off under the icon, and the longer title belongs to the store listings.	2026-09-24 14:50:25 +02:00
Maurice	f567e15a99	fix(native): Android shows "server not reachable" instead of a blank page Capacitor injects its bridge on Android only into the server's origin once server.url is set, so the local error page it switches to when the server does not load had no bridge. It could neither retry nor change the server and stayed blank. TrekWebViewClient now catches a failed page load (a network error, or a 5xx from a proxy while TREK restarts) and the app starts over on the bundled address screen, where the bridge is present and the screen offers exactly those two choices. The server config no longer carries errorPath. Two traps on the way, both found in the emulator: a restart during launch has to be a fresh task, since recreate() leaves the system splash lying over the new page; and a restart shows no launch splash at all, because the splash plugin cannot take it down again when the page hides it early.	2026-09-24 13:59:08 +02:00
Maurice	b1479d939a	fix(native): no overscroll stretch on Android The UI asks for no overscroll effect with overscroll-behavior: none on html, and Chrome honours it. The Android WebView draws the stretch on its root scroller natively, though, and it scales the whole view, so the top bar and the bottom dock were pulled along with the page. Found in the emulator.	2026-09-24 13:36:27 +02:00
Maurice	71913eb6e2	fix(native): remember the login by default inside the app With the switch off the app got a session cookie, which dies with the app process, so every time the phone unloaded TREK the user had to sign in again. Found while running the Android build in the emulator.	2026-09-24 13:30:37 +02:00
Maurice	601ed66a38	test(mobile): the backup-code download revokes its URL after the shared delay The mobile twin of the AccountTab test still expected the object URL to be revoked in the same tick. Since both screens download through downloadBlob, the revoke happens after its 100 ms grace period.	2026-09-24 13:22:49 +02:00
Maurice	9a69b092e8	feat(native): the small things that give a WebView away - A short haptic tap on success, warning and error toasts, which is where every save and delete already reports. Info toasts stay silent. - No "‹ › Done" strip above the iOS keyboard. - No Safari preview when a link is long-pressed. - The swipe from the left edge goes back on iOS, through the same history Android's back button walks.	2026-09-24 13:11:25 +02:00
Maurice	be211c22ed	fix(native): keep the iOS offline copy inside the app loadSimulatedRequest went to the server URL without its trailing slash, and Capacitor keeps a navigation in the WebView only when it starts with the bridge's serverURL, slash included. The offline start page would have opened in Safari instead. Also covers the platform helpers and the hand-off API module.	2026-09-24 12:48:12 +02:00
Maurice	293b25466e	feat(native): offline vector maps in the iOS app In a browser the service worker answers MapLibre from the gl-map-offline cache that glPrefetcher fills for trips marked for offline. The iOS app has no service worker, so nothing read that cache there and the map went blank without network. A trek-offline:// protocol takes the service worker's place. Inside the iOS app the MapLibre style URL is rewritten to it, the handler rewrites every https URL inside the style and its TileJSON the same way, and then serves documents network first and tiles, glyphs and sprites cache first. Outside the iOS app nothing changes. The default OpenFreeMap basemap is covered; Mapbox GL has no protocol hook and stays online-only in the app, as does a custom raster template, whose opaque responses only a service worker can store.	2026-09-24 12:47:07 +02:00
Maurice	1ba58e8b89	ci(native): build the Android and iOS shells on every change to them Compiles the Swift side on a macOS runner so nobody needs a Mac to know it still builds, and leaves a debug APK on every run to install on a phone. Unsigned: signing and store uploads need secrets fork PRs do not get.	2026-09-24 12:43:06 +02:00
Maurice	ae0d4e4520	feat(native): the UI knows when it runs inside the app Everything the server's UI does differently inside the iOS and Android app lives under src/native and is inert in a browser. Sign-in: SSO and the passkey button go through the system browser (signInThroughBrowser), because identity providers refuse embedded browsers and WebAuthn needs a domain association no build can have for every server. The browser end is the new /native-handoff page: it signs the user in if needed and hands the session over only after an explicit tap, so a link carrying somebody else's challenge cannot pass a session on silently. The verifier is hashed with @noble/hashes because crypto.subtle is missing on the plain-http servers many home networks use. An OIDC-only install no longer bounces to the IdP inside the WebView, and passkey management is hidden in the app. Downloads: the WebView cannot save a blob, so downloadBlob, downloadFile and openFile write to the app cache and open the share sheet. The eight places that built their own download anchor now use downloadBlob, which they should have anyway. The rest: "Change server" on the login page and in the account settings, the splash hides after the first frame, Android's back button walks history before it leaves the app, the status bar follows the scheme, and on iOS the start page is refreshed and every chunk of the build (listed in the new asset-manifest.json) is pulled into WebKit's cache so the app can start without network.	2026-09-24 12:42:34 +02:00
Maurice	c5765bbf15	feat(native): the apps load the server's own UI The apps ship only an address screen now. Once a server is picked, the native side points the WebView at it: TrekBridgeViewController on iOS and a config copy with server.url on Android. The UI then comes from that server, in the version it runs and on its own origin, so the session cookie, uploads, /ws and plugins work exactly as in a browser and no app release has to keep pace with the servers out there. The address screen (native-shell/, built into native-dist/) probes /api/health/features through native HTTP, tries https before http when no scheme was typed, and refuses servers without the nativeApp flag. It also serves as the error page when the remembered server does not load: retry, change server, or on iOS the stored copy of the server's start page. TrekShell is the app's own plugin for all of that: remember, change and reload the server, sign in through ASWebAuthenticationSession or a Custom Tab, and on iOS keep and open the offline copy of the start page, because WKWebView runs no service worker for a domain the app does not list. Plugins the frame does not use are gone (push, camera, geolocation, calendar, file transfer, in-app browser and more): the WebView covers the camera and location itself, and push needs a relay before it is worth shipping. With them go the push entitlement, the calendar usage strings and the Firebase bits. The iOS scheme falls back to capacitor://, since Capacitor drops an iosScheme of https, and the arm64 capability replaces armv7.	2026-09-24 12:30:32 +02:00
Maurice	9832d12751	feat(auth): hand a browser sign-in over to the native app The native apps show the server's own UI in a WebView, where neither SSO nor passkeys can run. They sign in through the system browser instead and need a way to carry that session back. The app keeps a random verifier and sends only its sha256 into the browser. Once signed in there, the browser trades that challenge for a one-time code (cookie session only, so an API or MCP token cannot mint itself a browser session), and the WebView redeems the code together with the verifier. The code rides through a URL scheme any app could claim, so on its own it is worthless; it is single use and good for a minute. Also: /api/health/features reports nativeApp so the apps can refuse servers that predate this, and hashed files under assets/ are served immutable, which the iOS app needs to start offline without a service worker.	2026-09-24 12:19:10 +02:00
Maurice	14825df993	Merge remote-tracking branch 'origin/dev' into native-apps # Conflicts: # client/package.json # package-lock.json	2026-09-24 11:53:50 +02:00
jubnl	e12be0a185	Merge remote-tracking branch 'origin/dev' into feat/native-apps	2026-08-25 23:47:41 +02:00
jubnl	9f1f33213b	chore(capacitor): base plugins	2026-08-24 00:23:51 +02:00
jubnl	b2c029f02a	Merge remote-tracking branch 'origin/dev' into feat/native-apps	2026-08-23 15:27:42 +02:00
jubnl	915a1f64e6	chore(capacitor): base files for capacitor	2026-08-22 22:52:25 +02:00