style(i18n): wrap the long special theme hints the way Prettier wants

Adds a Special Themes row to Settings > Appearance > Theme. Halloween is a
scheme on the existing data-scheme axis that is always dark: the applier and
the boot script force .dark while it is on, and the color mode control is
dimmed with a hint.

- Palette for the whole app (surfaces, dashboard, Vacay glass, Journey,
  mobile chrome) in theme/special/halloween.tokens.css, loaded with index.css.
- Decor as a lazy chunk mounted by SpecialThemeLayer while the scheme is on:
  fog, embers, bat flocks, a passing ghost, corner cobwebs, spiders that drop
  on a thread and flee when poked, a pumpkin patch and an ember running along
  the navbar. Figures are pre-rendered 3D sprite sheets.
- Nothing is drawn over a map: the Atlas gets no decor, the trip planner only
  dresses its side panels. Marker clusters turn into lanterns.
- The 3D mascot plays its own Halloween clips in every scene (witch hat, a
  spider on the brim, a lit pumpkin beside it); the SVG fallback wears the
  same costume.
- Reduced motion stills everything, transparency off drops the fog, shared
  pages never show it.
- Navbar, bottom nav, notifications, Atlas and Collections read the dark flag
  off the .dark class instead of settings.dark_mode, so a forced dark theme
  reaches them.

.dockerignore

@@ -1,7 +1,6 @@
 node_modules
 client/node_modules
 server/node_modules
-shared/node_modules
 client/dist
 shared/dist
 data

.gitattributes

@@ -26,8 +26,5 @@
 *.eot  binary
 *.pdf  binary
 *.zip  binary
-# Ski area graphs (SGR1) as the Places host writes them, byte for byte
-*.sgr  binary
-*.gz   binary
 # A GPX fixture whose byte-order mark and CRLF line endings are what it tests
 server/tests/fixtures/gpx/bom-crlf.gpx -text

.github/workflows/close-stale-invalid-titles.yml

@@ -14,7 +14,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Close stale invalid-title issues
-        uses: actions/github-script@v9
+        uses: actions/github-script@v8
         with:
           script: |
             const badTitles = [

.github/workflows/close-stale-wrong-branch.yml

@@ -15,7 +15,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Close stale wrong-base-branch PRs
-        uses: actions/github-script@v9
+        uses: actions/github-script@v8
         with:
           script: |
             const { data: pulls } = await github.rest.pulls.list({

.github/workflows/close-untitled-issues.yml

@@ -14,7 +14,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Flag or redirect issue
-        uses: actions/github-script@v9
+        uses: actions/github-script@v8
         with:
           script: |
             const title = context.payload.issue.title.trim();

.github/workflows/docker-dev.yml

@@ -5,13 +5,6 @@ name: Build & Push Docker Image (Prerelease)
 # :latest-pre, and tags the commit. Nothing moves :latest. Like the stable
 # release it refuses a commit whose ci-ok is not green. docker.yml with
 # bump=auto later finalizes the line once main carries it.
-#
-# A prerelease asks the TREK services issuer for a registration dialect of its
-# own -pre.N version (registration-dialect.yml, as the stable release does)
-# and builds it into the image; nothing of it is committed, dev keeps the
-# module of the last stable release, which it gets when main is merged back
-# into dev. Without one the image carries dev's module, with a warning when
-# that is the original one or old.
 
 on:
   workflow_dispatch:
@@ -96,23 +89,10 @@ jobs:
           echo "VERSION=$NEW_VERSION" >> "$GITHUB_OUTPUT"
           echo "$STABLE to $NEW_VERSION"
 
-  # The registration dialect of this prerelease, fetched and checked in a job
-  # without write access. It never fails the build.
-  dialect:
-    needs: version-bump
-    uses: ./.github/workflows/registration-dialect.yml
-    with:
-      version: ${{ needs.version-bump.outputs.version }}
-      ref: ${{ needs.version-bump.outputs.sha }}
-    secrets:
-      TREK_DIALECT_TOKEN: ${{ secrets.TREK_DIALECT_TOKEN }}
-
   build:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 120
-    needs: [version-bump, dialect]
-    # Whatever became of the dialect job: without its artifact the image carries dev's module.
-    if: ${{ !cancelled() && needs.version-bump.result == 'success' }}
+    needs: version-bump
     strategy:
       fail-fast: false
       matrix:
@@ -131,51 +111,9 @@ jobs:
         with:
           ref: ${{ needs.version-bump.outputs.sha }}
 
-      - name: Take over the prerelease's dialect
-        id: take
-        uses: actions/download-artifact@v7
-        continue-on-error: true
-        with:
-          name: registration-dialect
-          path: ${{ runner.temp }}/dialect
-
-      # Into the build context only; the commit stays as it is. Without a
-      # dialect of its own the image speaks dev's module, which the issuer
-      # takes for new installations for 180 days after it was made (longer
-      # while it is the newest stable release's). That is warned about, never
-      # stopped on, and a date that cannot be read only warns as well.
-      - name: Place the dialect
-        env:
-          VERSION: ${{ needs.version-bump.outputs.version }}
-          TAKEN: ${{ steps.take.outcome }}
-          REPORT: ${{ matrix.platform == 'linux/amd64' }}
-        run: |
-          set -u
-          target=server/src/nest/service-identity/registration-dialect.ts
-          fetched="$RUNNER_TEMP/dialect/registration-dialect.ts"
-          if [ "$TAKEN" = success ] && [ -f "$fetched" ]; then
-            cp "$fetched" "$target"
-            echo "$VERSION registers in dialect $(sed -n "s/^const DIALECT = '\(.*\)';$/\1/p" "$target") of its own."
-            exit 0
-          fi
-          [ "$REPORT" = true ] || exit 0
-          id="$(sed -n "s/^const DIALECT = '\(.*\)';$/\1/p" "$target")"
-          created="$(sed -n "s/^  createdAt: '\(.*\)',$/\1/p" "$target")"
-          if [ "$id" = 0 ]; then
-            message="$VERSION got no dialect of its own and registers in the original one, which the issuer accepts only for a transition period."
-          elif made="$(date -u -d "$created" +%s 2>/dev/null)"; then
-            age=$(( ($(date -u +%s) - made) / 86400 ))
-            message="$VERSION got no dialect of its own and registers in dev's dialect $id from $created, $age days old."
-            [ "$age" -gt 150 ] || { echo "$message"; exit 0; }
-          else
-            message="$VERSION got no dialect of its own, and the date of dev's dialect cannot be read from $target."
-          fi
-          echo "::warning::$message"
-          printf '### Registration dialect\n%s\n' "$message" >> "$GITHUB_STEP_SUMMARY"
-
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
-      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -218,7 +156,6 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 120
     needs: [version-bump, build]
-    if: ${{ !cancelled() && needs.build.result == 'success' }}
     steps:
       - uses: actions/checkout@v6
         with:
@@ -236,7 +173,7 @@ jobs:
 
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
-      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/docker.yml

@@ -2,29 +2,17 @@ name: Build & Push Docker Image
 
 # The stable release. Dispatched by hand on main, it:
 #   1. refuses to run unless ci-ok passed on the main commit it releases,
-#   2. works out the version from the tags and the bump input,
-#   3. asks the TREK services issuer for the registration dialect of that
-#      version and checks it, in a job without write access
-#      (registration-dialect.yml); without one the release ships the dialect
-#      already on main, but only while that one still has 90 days to run,
-#   4. commits the bump to package.json, the lockfile, Chart.yaml and the
-#      dialect, tags it and pushes,
-#   5. builds both platforms from exactly that bump commit (never from
+#   2. works out the version from the tags and the bump input, commits the
+#      bump to package.json, the lockfile and Chart.yaml, tags it and pushes,
+#   3. builds both platforms from exactly that bump commit (never from
 #      whatever main points to by then) and publishes :VERSION,
 #      :MAJOR.MINOR, :MAJOR and :latest,
-#   6. publishes the Helm chart from the same commit.
+#   4. publishes the Helm chart from the same commit.
 #
 # Big or risky changes go out as a prerelease first (docker-dev.yml, tagged
 # :latest-pre and :<next>-pre.N); bump=auto here then finalizes that line.
 # Without a prerelease in flight there is no default: the run stops until
 # someone picks patch, minor or major.
-#
-# Each stable release registers new installations in a dialect of its own,
-# which the issuer accepts for 180 days, and for as long as it is the newest
-# release's; renewing a key needs none. dev gets the module when main is merged
-# back into dev after the release; a prerelease asks the issuer for one of its
-# own (docker-dev.yml). The issuer's side, and what to set up before the first
-# release with a dialect, is in the operations guide of the TREK services.
 
 on:
   workflow_dispatch:
@@ -38,14 +26,6 @@ on:
         description: "Type MAJOR (all caps) to confirm a major release"
         type: string
         default: ''
-      ci_from:
-        description: 'Take ci-ok from this earlier commit instead of the one on main, when main differs from it only under .github/ (a fix to a release workflow needs no second test run)'
-        type: string
-        default: ''
-      allow_stale_dialect:
-        description: 'Ship without a dialect of its own even if the one on main is the original one or has under 90 days left'
-        type: boolean
-        default: false
 
 permissions:
   contents: write
@@ -56,16 +36,13 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  version:
+  version-bump:
     if: github.repository == 'liketrek/TREK'
     runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    permissions:
-      contents: read
-      checks: read
+    timeout-minutes: 120
     outputs:
       version: ${{ steps.bump.outputs.VERSION }}
-      base: ${{ steps.base.outputs.SHA }}
+      sha: ${{ steps.bump.outputs.SHA }}
     steps:
       - name: Release from main only
         if: github.ref != 'refs/heads/main'
@@ -73,17 +50,17 @@ jobs:
           echo "::error::Dispatch this workflow on main, not on $GITHUB_REF."
           exit 1
 
+      - uses: actions/create-github-app-token@v3
+        id: app-token
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
           fetch-tags: true
-          persist-credentials: false
-
-      # The bump job checks out exactly this commit, so what ci-ok was checked
-      # on is what gets released, however long the dialect takes.
-      - name: Note the commit being released
-        id: base
-        run: echo "SHA=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+          token: ${{ steps.app-token.outputs.token }}
 
       # The dev push, the main push and any manual run each leave a ci-ok on
       # this commit. scripts/ci/ci-ok-verdict.mjs counts the newest attempt of
@@ -91,7 +68,6 @@ jobs:
       # finished last to be green, so a later green run supersedes a flaky or
       # cancelled one. It prints the link of every run it counted.
       - name: Require a green ci-ok on the commit being released
-        if: inputs.ci_from == ''
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
@@ -101,43 +77,14 @@ jobs:
           gh api "repos/$GITHUB_REPOSITORY/commits/$sha/check-runs?check_name=ci-ok&filter=all&per_page=100" > "$runs"
           node scripts/ci/ci-ok-verdict.mjs "$runs" "$sha"
 
-      # ci_from: main carries only workflow changes on top of a commit that
-      # already passed. That commit must be an ancestor of main, everything
-      # outside .github/ must be identical, and one of its ci-ok runs must be
-      # green (its dev push, typically).
-      - name: Require a green ci-ok on the commit main's code comes from
-        if: inputs.ci_from != ''
-        env:
-          GH_TOKEN: ${{ github.token }}
-          CI_FROM: ${{ inputs.ci_from }}
-        run: |
-          set -euo pipefail
-          from="$(git rev-parse --verify "$CI_FROM^{commit}")"
-          if ! git merge-base --is-ancestor "$from" HEAD; then
-            echo "::error::$from is not an ancestor of main."
-            exit 1
-          fi
-          outside="$(git diff --name-only "$from" HEAD -- . ':(exclude).github/**')"
-          if [ -n "$outside" ]; then
-            echo "::error::main differs from $from outside .github/:"
-            echo "$outside"
-            exit 1
-          fi
-          green="$(gh api "repos/$GITHUB_REPOSITORY/commits/$from/check-runs?check_name=ci-ok&filter=all&per_page=100" \
-            --jq '[.check_runs[] | select(.status == "completed" and .conclusion == "success")] | length')"
-          if [ "$green" -lt 1 ]; then
-            echo "::error::$from has no green ci-ok."
-            exit 1
-          fi
-          echo "main differs from $from only under .github/, and $from has $green green ci-ok run(s)."
-
-      - name: Determine bump type and version
+      - name: Determine bump type and update version
         id: bump
         env:
           BUMP_INPUT: ${{ inputs.bump || 'auto' }}
           CONFIRM_MAJOR: ${{ inputs.confirm_major }}
         run: |
           set -eu
+          git fetch --tags
 
           # Derive version from git tags, no package.json dependency
           STABLE_TAG=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' | grep -v '\-pre\.' | sort -V | tail -1)
@@ -196,107 +143,6 @@ jobs:
           echo "VERSION=$NEW_VERSION" >> "$GITHUB_OUTPUT"
           echo "$STABLE to $NEW_VERSION ($BUMP)"
 
-  # The registration dialect of this version, fetched and checked in a job
-  # without write access. It never fails; without an artifact from it the
-  # bump decides below whether the dialect on main may ship.
-  dialect:
-    needs: version
-    uses: ./.github/workflows/registration-dialect.yml
-    with:
-      version: ${{ needs.version.outputs.version }}
-      ref: ${{ needs.version.outputs.base }}
-    secrets:
-      TREK_DIALECT_TOKEN: ${{ secrets.TREK_DIALECT_TOKEN }}
-
-  # Runs whatever became of the dialect job, a timeout or a lost runner
-  # included: no artifact means the dialect on main, if it may still ship.
-  version-bump:
-    needs: [version, dialect]
-    if: ${{ !cancelled() && needs.version.result == 'success' }}
-    runs-on: ubuntu-24.04
-    timeout-minutes: 120
-    outputs:
-      sha: ${{ steps.commit.outputs.SHA }}
-    steps:
-      - uses: actions/create-github-app-token@v3
-        id: app-token
-        with:
-          app-id: ${{ secrets.RELEASE_APP_ID }}
-          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
-
-      - uses: actions/checkout@v6
-        with:
-          ref: ${{ needs.version.outputs.base }}
-          fetch-depth: 0
-          fetch-tags: true
-          token: ${{ steps.app-token.outputs.token }}
-
-      - name: Take over the checked dialect
-        id: take
-        uses: actions/download-artifact@v7
-        continue-on-error: true
-        with:
-          name: registration-dialect
-          path: ${{ runner.temp }}/dialect
-
-      # Without a dialect of its own the release ships the one on main, but
-      # only while the issuer takes new registrations in it for 90 more days:
-      # dialect 0 closes on the issuer's transition date, and a dialect with
-      # little left would shut out new installations of this release soon after
-      # it is out. Then this stops before anything is committed, unless
-      # allow_stale_dialect says to ship anyway. The issuer keeps the newest
-      # release's dialect open past its date, so the date here is the least it
-      # has, not the most.
-      - name: Place the dialect
-        env:
-          VERSION: ${{ needs.version.outputs.version }}
-          TAKEN: ${{ steps.take.outcome }}
-          ALLOW_STALE: ${{ inputs.allow_stale_dialect }}
-        run: |
-          set -u
-          target=server/src/nest/service-identity/registration-dialect.ts
-          fetched="$RUNNER_TEMP/dialect/registration-dialect.ts"
-          dialect_id() { sed -n "s/^const DIALECT = '\(.*\)';$/\1/p" "$1"; }
-          report() {
-            echo "$2$1"
-            printf '### Registration dialect\n%s\n' "$1" >> "$GITHUB_STEP_SUMMARY"
-          }
-          if [ "$TAKEN" = success ] && [ -f "$fetched" ]; then
-            cp "$fetched" "$target"
-            report "$VERSION registers in dialect $(dialect_id "$target"), written by the issuer for it." ""
-            exit 0
-          fi
-          id="$(dialect_id "$target")"
-          created="$(sed -n "s/^  createdAt: '\(.*\)',$/\1/p" "$target")"
-          left=""
-          if [ -n "$id" ] && [ "$id" != 0 ] && made="$(date -u -d "$created" +%s 2>/dev/null)"; then
-            left=$(( (made + 180 * 86400 - $(date -u +%s)) / 86400 ))
-          fi
-          if [ -n "$left" ] && [ "$left" -ge 90 ]; then
-            report "$VERSION ships without a dialect of its own and registers in dialect $id from $created, which the issuer takes for new installations for $left more days at least. Its operator can write one by hand for the next patch." "::warning::"
-            exit 0
-          fi
-          if [ "$id" = 0 ]; then
-            what="the original registration, which the issuer accepts only until the end of its transition period"
-          elif [ -n "$left" ]; then
-            what="dialect $id from $created, which has $left days left"
-          else
-            what="a dialect whose id or date cannot be read from $target"
-          fi
-          if [ "$ALLOW_STALE" = true ]; then
-            report "$VERSION ships without a dialect of its own and registers in $what, as allow_stale_dialect asked." "::warning::"
-            exit 0
-          fi
-          report "$VERSION got no dialect of its own and would register in $what. Nothing was committed or pushed. Make sure the issuer runs with its dialect seed and release token and that TREK_DIALECT_TOKEN is set, then run the release again, or tick allow_stale_dialect to ship anyway." "::error::"
-          exit 1
-
-      - name: Update the version, commit, tag and push
-        id: commit
-        env:
-          NEW_VERSION: ${{ needs.version.outputs.version }}
-        run: |
-          set -eu
-
           # Update all workspace + root package.json files and the root lockfile in one shot
           npm version "$NEW_VERSION" --workspaces --include-workspace-root --no-git-tag-version
           sed -i "s/^version: .*/version: $NEW_VERSION/" charts/trek/Chart.yaml
@@ -307,8 +153,7 @@ jobs:
           # landed on main in the meantime.
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add package.json package-lock.json server/package.json client/package.json shared/package.json \
-            charts/trek/Chart.yaml server/src/nest/service-identity/registration-dialect.ts
+          git add package.json package-lock.json server/package.json client/package.json shared/package.json charts/trek/Chart.yaml
           git commit -m "chore: bump version to $NEW_VERSION [skip ci]"
           git tag -a "v$NEW_VERSION" -m "v$NEW_VERSION"
           git push origin HEAD:main --follow-tags
@@ -319,9 +164,7 @@ jobs:
   build:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 120
-    needs: [version, version-bump]
-    # version-bump may run after a failed dialect job; that alone must not skip what follows it.
-    if: ${{ !cancelled() && needs.version-bump.result == 'success' }}
+    needs: version-bump
     strategy:
       fail-fast: false
       matrix:
@@ -342,7 +185,7 @@ jobs:
 
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
-      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -362,7 +205,7 @@ jobs:
           outputs: type=image,name=mauriceboe/trek,push-by-digest=true,name-canonical=true,push=true
           no-cache: true
           build-args: |
-            APP_VERSION=${{ needs.version.outputs.version }}
+            APP_VERSION=${{ needs.version-bump.outputs.version }}
           labels: |
             org.opencontainers.image.revision=${{ steps.meta.outputs.revision }}
             org.opencontainers.image.created=${{ steps.meta.outputs.created }}
@@ -384,8 +227,7 @@ jobs:
   merge:
     runs-on: ubuntu-24.04
     timeout-minutes: 120
-    needs: [version, version-bump, build]
-    if: ${{ !cancelled() && needs.build.result == 'success' }}
+    needs: [version-bump, build]
     steps:
       - uses: actions/checkout@v6
         with:
@@ -401,7 +243,7 @@ jobs:
 
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
-      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -410,7 +252,7 @@ jobs:
         working-directory: /tmp/digests
         run: |
           set -euo pipefail
-          VERSION="${{ needs.version.outputs.version }}"
+          VERSION="${{ needs.version-bump.outputs.version }}"
           MAJOR_TAG="$(echo "$VERSION" | cut -d. -f1)"
           # :MAJOR.MINOR takes the patches of one minor line and nothing else,
           # the conservative pin for an install that wants to wait out a
@@ -450,7 +292,6 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 120
     needs: version-bump
-    if: ${{ !cancelled() && needs.version-bump.result == 'success' }}
     steps:
       - name: Checkout
         uses: actions/checkout@v6

.github/workflows/enforce-target-branch.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Flag or clear wrong base branch
-        uses: actions/github-script@v9
+        uses: actions/github-script@v8
         with:
           script: |
             const base = context.payload.pull_request.base.ref;

.github/workflows/lint-prettier.yml

@@ -36,7 +36,7 @@ jobs:
 
       - name: Comment on PR if checks failed
         if: steps.checks.outcome == 'failure'
-        uses: actions/github-script@v9
+        uses: actions/github-script@v8
         with:
           script: |
             await github.rest.issues.createComment({

.github/workflows/native-release.yml

@@ -1,191 +0,0 @@
-name: Native apps release
-
-# Builds the signed store builds of the iOS and Android apps and uploads them:
-# the Android App Bundle to a Google Play testing track, the iOS archive to
-# App Store Connect (TestFlight). Promotion to production stays a manual step
-# in both consoles.
-#
-# Runs only in liketrek/TREK, only by hand or on a version tag, and only after a
-# required reviewer approves the `store` environment, which holds every secret
-# (see wiki/Native-Apps.md for the list). Pull requests never reach it.
-#
-# Both stores get the same numbers: the version from client/package.json
-# without a prerelease suffix, and a build number that only grows. A prerelease
-# reuses its X.Y.Z with a higher build number and belongs on the internal track
-# and in TestFlight only.
-
-on:
-  workflow_dispatch:
-    inputs:
-      track:
-        description: Google Play track
-        type: choice
-        options: [internal, alpha, beta]
-        default: internal
-  push:
-    tags: ['v*']
-
-permissions:
-  contents: read
-
-concurrency:
-  group: native-release
-  cancel-in-progress: false
-
-jobs:
-  android:
-    if: github.repository == 'liketrek/TREK'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 40
-    environment: store
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-
-      - uses: actions/setup-java@v5
-        with:
-          distribution: temurin
-          java-version: 21
-          cache: gradle
-
-      - name: Version and build number
-        id: version
-        run: |
-          echo "version=$(node -p "require('./client/package.json').version.split('-')[0]")" >> "$GITHUB_OUTPUT"
-          echo "build=$((GITHUB_RUN_NUMBER + 1000))" >> "$GITHUB_OUTPUT"
-
-      - name: Install
-        run: npm ci --workspace=shared --workspace=client
-
-      - name: Build shared
-        run: npm run build --workspace=shared
-
-      - name: Build the address screen and sync it into the shell
-        working-directory: client
-        run: npm run cap:sync -- android
-
-      - name: Upload key
-        env:
-          KEYSTORE_B64: ${{ secrets.ANDROID_UPLOAD_KEYSTORE_B64 }}
-        run: printf '%s' "$KEYSTORE_B64" | base64 -d > "$RUNNER_TEMP/upload.jks"
-
-      - name: Build the signed App Bundle
-        working-directory: client/android
-        env:
-          ORG_GRADLE_PROJECT_trekKeystorePassword: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
-          ORG_GRADLE_PROJECT_trekKeyAlias: ${{ secrets.ANDROID_KEY_ALIAS }}
-          ORG_GRADLE_PROJECT_trekKeyPassword: ${{ secrets.ANDROID_KEY_PASSWORD }}
-        run: >-
-          ./gradlew bundleRelease --no-daemon
-          -PtrekVersionName=${{ steps.version.outputs.version }}
-          -PtrekVersionCode=${{ steps.version.outputs.build }}
-          -PtrekKeystore="$RUNNER_TEMP/upload.jks"
-
-      - uses: actions/upload-artifact@v6
-        with:
-          name: trek-android-${{ steps.version.outputs.version }}-${{ steps.version.outputs.build }}
-          path: client/android/app/build/outputs/bundle/release/app-release.aab
-          retention-days: 30
-
-      # Play only accepts API uploads once one bundle was uploaded by hand
-      # (wiki/Native-Apps.md). `draft` until the app has left draft in the console.
-      - name: Upload to Google Play
-        uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
-        with:
-          serviceAccountJsonPlainText: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
-          packageName: com.liketrek.trek
-          releaseFiles: client/android/app/build/outputs/bundle/release/app-release.aab
-          track: ${{ inputs.track || 'internal' }}
-          status: draft
-
-      - name: Remove the upload key
-        if: always()
-        run: rm -f "$RUNNER_TEMP/upload.jks"
-
-  ios:
-    if: github.repository == 'liketrek/TREK'
-    runs-on: macos-15
-    timeout-minutes: 60
-    environment: store
-    steps:
-      - uses: actions/checkout@v6
-
-      # App Store uploads must be built with Xcode 26; the image's default is older.
-      - name: Select Xcode 26
-        run: |
-          XCODE=$(ls -d /Applications/Xcode_26*.app | sort -V | tail -1)
-          test -n "$XCODE"
-          sudo xcode-select -s "$XCODE"
-          xcodebuild -version
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-
-      - name: Version and build number
-        id: version
-        run: |
-          echo "version=$(node -p "require('./client/package.json').version.split('-')[0]")" >> "$GITHUB_OUTPUT"
-          echo "build=$((GITHUB_RUN_NUMBER + 1000))" >> "$GITHUB_OUTPUT"
-
-      - name: Install
-        run: npm ci --workspace=shared --workspace=client
-
-      - name: Build shared
-        run: npm run build --workspace=shared
-
-      - name: Build the address screen and sync it into the shell
-        working-directory: client
-        run: npm run cap:sync -- ios
-
-      - name: App Store Connect API key
-        env:
-          ASC_KEY_P8_B64: ${{ secrets.ASC_KEY_P8_B64 }}
-        run: printf '%s' "$ASC_KEY_P8_B64" | base64 -d > "$RUNNER_TEMP/AuthKey.p8"
-
-      - name: Archive
-        working-directory: client/ios/App
-        env:
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
-          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
-        run: >-
-          xcodebuild archive
-          -project App.xcodeproj
-          -scheme App
-          -configuration Release
-          -destination 'generic/platform=iOS'
-          -archivePath "$RUNNER_TEMP/TREK.xcarchive"
-          MARKETING_VERSION=${{ steps.version.outputs.version }}
-          CURRENT_PROJECT_VERSION=${{ steps.version.outputs.build }}
-          DEVELOPMENT_TEAM="$APPLE_TEAM_ID"
-          -allowProvisioningUpdates
-          -authenticationKeyPath "$RUNNER_TEMP/AuthKey.p8"
-          -authenticationKeyID "$ASC_KEY_ID"
-          -authenticationKeyIssuerID "$ASC_ISSUER_ID"
-
-      # ExportOptions.plist says destination=upload, so this step sends the build
-      # to App Store Connect, where it shows up in TestFlight after processing.
-      - name: Export and upload to App Store Connect
-        working-directory: client/ios/App
-        env:
-          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
-          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
-        run: >-
-          xcodebuild -exportArchive
-          -archivePath "$RUNNER_TEMP/TREK.xcarchive"
-          -exportOptionsPlist ../ExportOptions.plist
-          -exportPath "$RUNNER_TEMP/export"
-          -allowProvisioningUpdates
-          -authenticationKeyPath "$RUNNER_TEMP/AuthKey.p8"
-          -authenticationKeyID "$ASC_KEY_ID"
-          -authenticationKeyIssuerID "$ASC_ISSUER_ID"
-
-      - name: Remove the API key
-        if: always()
-        run: rm -f "$RUNNER_TEMP/AuthKey.p8"

.github/workflows/native.yml

@@ -1,132 +0,0 @@
-name: Native apps
-
-permissions:
-  contents: read
-
-# Builds the iOS and Android shells whenever they, their address screen or the
-# Capacitor plugins change. Nobody on the team has to own a Mac for the Swift
-# side to be compiled on every change, and every run leaves a debug APK to
-# install on a phone.
-#
-# Unsigned on purpose: signing and store uploads need secrets that fork PRs do
-# not get, and belong in a release workflow of their own.
-on:
-  pull_request:
-    paths:
-      - 'client/android/**'
-      - 'client/ios/**'
-      - 'client/native-shell/**'
-      - 'client/src/native/trekShell.ts'
-      - 'client/src/native/serverAddress.ts'
-      - 'client/capacitor.config.ts'
-      - 'client/vite.native.config.js'
-      - 'client/scripts/check-store-metadata.mjs'
-      - 'client/fastlane/**'
-      - 'client/package.json'
-      - 'package-lock.json'
-      - 'shared/src/i18n/*/native.ts'
-      - '.github/workflows/native.yml'
-  workflow_dispatch:
-
-concurrency:
-  group: native-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  # The store texts fit their limits and every listing image has its size and
-  # no alpha channel (client/fastlane/README.md). Plain Node, no install.
-  metadata:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-
-      - name: Check the store listings
-        run: node client/scripts/check-store-metadata.mjs
-
-  android:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-
-      - uses: actions/setup-java@v5
-        with:
-          distribution: temurin
-          java-version: 21
-          cache: gradle
-
-      - name: Install
-        run: npm ci --workspace=shared --workspace=client
-
-      - name: Build shared
-        run: npm run build --workspace=shared
-
-      - name: Build the address screen and sync it into the shells
-        working-directory: client
-        run: npm run cap:sync -- android
-
-      # The release build runs R8 with the keep rules in proguard-rules.pro, so a
-      # rule that goes missing fails here rather than in the store build. It is
-      # unsigned: the upload key only exists in native-release.yml.
-      - name: Assemble debug and release APKs
-        working-directory: client/android
-        run: ./gradlew assembleDebug assembleRelease lintDebug --no-daemon
-
-      - uses: actions/upload-artifact@v6
-        with:
-          name: trek-android-debug
-          path: client/android/app/build/outputs/apk/debug/app-debug.apk
-          retention-days: 14
-
-  ios:
-    runs-on: macos-15
-    timeout-minutes: 40
-    steps:
-      - uses: actions/checkout@v6
-
-      # App Store uploads must be built with Xcode 26; the image's default is older.
-      - name: Select Xcode 26
-        run: |
-          XCODE=$(ls -d /Applications/Xcode_26*.app | sort -V | tail -1)
-          test -n "$XCODE"
-          sudo xcode-select -s "$XCODE"
-          xcodebuild -version
-
-      - name: Check the property lists
-        run: plutil -lint client/ios/App/App/Info.plist client/ios/ExportOptions.plist
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-
-      - name: Install
-        run: npm ci --workspace=shared --workspace=client
-
-      - name: Build shared
-        run: npm run build --workspace=shared
-
-      - name: Build the address screen and sync it into the shells
-        working-directory: client
-        run: npm run cap:sync -- ios
-
-      - name: Build for the simulator
-        working-directory: client/ios/App
-        run: |
-          xcodebuild build \
-            -project App.xcodeproj \
-            -scheme App \
-            -configuration Debug \
-            -sdk iphonesimulator \
-            -destination 'generic/platform=iOS Simulator' \
-            CODE_SIGNING_ALLOWED=NO

.github/workflows/registration-dialect.yml

@@ -1,144 +0,0 @@
-name: Registration dialect
-
-# Asks the TREK services issuer for the registration dialect of one version and
-# checks it, for docker.yml (a stable release commits it with the version bump)
-# and docker-dev.yml (a prerelease only builds it into its image).
-#
-# The issuer's answer runs here, in a job that holds no write token and keeps
-# no git credentials; the token for the issuer is in the environment of the
-# one step that fetches. The answer is held to what a dialect is
-# (scripts/ci/check-registration-dialect.mjs), then type-checked and linted
-# the way TREK's CI would see it once it is on main and dev. Only a module that
-# passes all of it goes on, as the artifact `registration-dialect`; without
-# one the caller decides what ships. This workflow never fails its caller.
-
-on:
-  workflow_call:
-    inputs:
-      version:
-        description: 'The version the dialect is for, X.Y.Z or X.Y.Z-pre.N'
-        type: string
-        required: true
-      ref:
-        description: 'The commit whose checker, types and lint config the dialect is checked with'
-        type: string
-        required: true
-    secrets:
-      TREK_DIALECT_TOKEN:
-        required: false
-
-permissions:
-  contents: read
-
-jobs:
-  dialect:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 20
-    # A failed or timed-out run leaves no artifact, which the caller already
-    # handles; it must not fail the release around it.
-    continue-on-error: true
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          ref: ${{ inputs.ref }}
-          persist-credentials: false
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-          cache-dependency-path: package-lock.json
-
-      # The only step that sees the token. The URL is fixed; the answer is
-      # bounded in time and size and goes to a file nothing runs yet.
-      - name: Fetch the dialect from the issuer
-        id: fetch
-        timeout-minutes: 3
-        env:
-          TREK_DIALECT_TOKEN: ${{ secrets.TREK_DIALECT_TOKEN }}
-          VERSION: ${{ inputs.version }}
-        run: |
-          set -uo pipefail
-          out="$RUNNER_TEMP/registration-dialect.ts"
-          if [ -z "${TREK_DIALECT_TOKEN:-}" ]; then
-            echo "::warning::TREK_DIALECT_TOKEN is not set; the issuer was not asked for a dialect for $VERSION."
-            exit 0
-          fi
-          status=$(curl --silent --show-error --proto '=https' --tlsv1.2 --max-time 30 --retry 2 --retry-delay 5 \
-            --max-filesize 262144 -H "Authorization: Bearer $TREK_DIALECT_TOKEN" -H 'Content-Type: application/json' \
-            --data "{\"version\":\"$VERSION\"}" -o "$out" -w '%{http_code}' https://places.liketrek.com/v1/dialects) \
-            || status=000
-          if [ "$status" != 200 ] && [ "$status" != 201 ]; then
-            echo "::warning::The issuer handed out no registration dialect for $VERSION (HTTP $status)."
-            rm -f "$out"
-            exit 0
-          fi
-          if [ "$(wc -c < "$out")" -gt 262144 ]; then
-            echo "::warning::The issuer's registration dialect for $VERSION is larger than a dialect."
-            rm -f "$out"
-            exit 0
-          fi
-          echo "file=$out" >> "$GITHUB_OUTPUT"
-
-      # A module that computes for long is refused by the clock as well.
-      - name: Check the dialect
-        id: check
-        if: steps.fetch.outputs.file != ''
-        timeout-minutes: 2
-        env:
-          FILE: ${{ steps.fetch.outputs.file }}
-          VERSION: ${{ inputs.version }}
-        run: |
-          set -uo pipefail
-          if ! node scripts/ci/check-registration-dialect.mjs "$FILE" "$VERSION"; then
-            echo "::warning::The issuer's registration dialect for $VERSION failed its check."
-            exit 0
-          fi
-          echo "What changes against the dialect in the tree:"
-          git diff --no-index -- server/src/nest/service-identity/registration-dialect.ts "$FILE" || true
-          echo "ok=true" >> "$GITHUB_OUTPUT"
-
-      - name: Install the toolchain
-        if: steps.check.outputs.ok == 'true'
-        timeout-minutes: 8
-        run: |
-          npm ci --ignore-scripts --no-audit --no-fund
-          npm run build --workspace=shared
-
-      # The bump commit skips CI, so this is where the module meets the strict
-      # config (lint:strict lets a new file have no strict errors) and ESLint
-      # with --max-warnings 0 (lint:warnings starts a new file at none) before
-      # it lands on main.
-      - name: Type-check and lint the dialect
-        id: types
-        if: steps.check.outputs.ok == 'true'
-        timeout-minutes: 5
-        working-directory: server
-        env:
-          FILE: ${{ steps.fetch.outputs.file }}
-          VERSION: ${{ inputs.version }}
-        run: |
-          set -uo pipefail
-          cp "$FILE" src/nest/service-identity/registration-dialect.ts
-          # TypeScript 6 includes no @types by default and the dialect imports nothing
-          # from node, so checked on its own it would not know Buffer: name node here.
-          printf '%s\n' '{"extends": "./tsconfig.strict.json", "compilerOptions": {"types": ["node"]}, "include": [],' \
-            '"files": ["src/nest/service-identity/registration-dialect.ts"]}' > tsconfig.dialect-check.json
-          if ! npx tsc -p tsconfig.dialect-check.json --noEmit --pretty false; then
-            echo "::warning::The issuer's registration dialect for $VERSION does not type-check under the strict config."
-            exit 0
-          fi
-          if ! npx eslint --max-warnings 0 src/nest/service-identity/registration-dialect.ts; then
-            echo "::warning::The issuer's registration dialect for $VERSION does not pass ESLint."
-            exit 0
-          fi
-          echo "ok=true" >> "$GITHUB_OUTPUT"
-
-      - name: Hand the dialect on
-        if: steps.types.outputs.ok == 'true'
-        uses: actions/upload-artifact@v6
-        with:
-          name: registration-dialect
-          path: ${{ steps.fetch.outputs.file }}
-          if-no-files-found: error
-          retention-days: 1

.github/workflows/security.yml

@@ -74,12 +74,12 @@ jobs:
           load: true
           tags: trek:scan
 
-      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - uses: docker/scout-action@e7e2a72bf1485d10a58f30696b6c513b261ce4fa # v1.29.0
+      - uses: docker/scout-action@221e7f4860634eeb1579e3bd7ca232e577bd1864 # v1.26.0
         with:
           command: cves
           image: trek:scan

.github/workflows/test.yml

@@ -9,73 +9,23 @@ permissions:
 # analysis; pull requests get PR analysis with decoration on the PR itself
 # (the scanner picks the context up from the Actions environment).
 #
-# Job names read "<package>: <what>", so the checks list on a PR sorts by
-# package. What each job holds:
-#
-#   Repo: Changed Areas      decides what the change needs to run (below)
-#   Shared: i18n Parity      every locale has en's files and keys
-#   Shared: Coverage         shared's tests with coverage
-#   Server: Types            builds shared and the server, typechecks shared,
-#                            the server's src, tests and scripts, smokes the
-#                            production require chain, the strict ratchet,
-#                            the generated entities and Kysely types
-#   Server: Lint & Checks    ESLint (typed), errors and warning counts; then
-#                            Prettier, the plugin facts, the DB call graph,
-#                            the shared ratchet code, the source ratchets
-#                            (size, boundaries, dialect, tx, test SQL, test
-#                            mocks, hand-built services, query API, MCP zod,
-#                            error envelopes, response contracts), open
-#                            request schemas, knip
-#   Server: Tests n/7        one slice of the server suite, with coverage
-#   Server: Coverage         merges the slices, checks the per-domain
-#                            thresholds, uploads lcov
-#   Server: S3 Contract (MinIO)
-#                            the storage driver against MinIO
-#   Server: Postgres Probe   the repository SQL against Postgres
-#   Client: Types & Checks   typecheck and the strict ratchet; then the page
-#                            pattern and the source ratchets (RTL, size,
-#                            Prettier, layers, offline path, duplication,
-#                            desktop/phone pairs, skips, i18n keys, theme
-#                            tokens)
-#   Client: Lint             ESLint (typed), errors and warning counts
-#   Client: Tests n/7        one slice of the client suite, with coverage
-#   Client: Coverage         merges the slices, checks the thresholds,
-#                            uploads lcov
-#   Client: Bundle           the production build, one chunk per map engine
-#   Client: End-to-End       the app in Chromium and WebKit
-#   Plugin SDK: Types & Coverage
-#   Repo: Docker Image       builds the image and boots it until ready
-#   Repo: Helm Chart & Compose
-#   Repo: Sonar Scan         SonarCloud analysis, not required
-#   ci-ok                    the one required check (below)
-#
-# Job layout:
-#   - Everything starts right after changes: the gates and the tests run side
-#     by side, so a run takes as long as its slowest job and not the gates
-#     plus the tests. The tests used to wait for the gates, which put ~9
-#     minutes in front of every test result. The gates were one job per
-#     package (~8-9 minutes each); each is now two jobs of ~4-5 minutes,
-#     split where the time is (the server's typechecks, the client's lint),
-#     so neither outlasts a test shard.
-#   - The client and server suites run in shards (client-tests,
-#     server-tests), each running a slice with coverage and uploading a blob
-#     report; client-coverage and server-coverage merge the blobs, check the
-#     thresholds against the whole and upload lcov. A red shard is usually a
-#     failing test, a red merge job usually a threshold. None of the other
-#     test jobs feeds the scan.
-#   - Job count: GitHub runs at most 20 jobs of the organisation at once and
-#     does not say in which order it starts queued ones. A code change starts
-#     the 14 shards and about a dozen other jobs; seven of those (parity, the
-#     SDK, the bundle, S3, Postgres, shared coverage, the chart) are done in
-#     a minute or two, so what queues at the start waits about that long. The
-#     jobs that run for minutes (shards, gates, e2e, the image) must not
-#     outnumber the 20 slots, or one of them waits for another to finish and
-#     the run grows by a whole job: a layout with six gate jobs did exactly
-#     that. Check the count before adding a long job or a shard.
-#   - Scan `needs:` the gates and the four coverage jobs. A coverage job
-#     failing must stop the scan — a missing lcov file would make every line
-#     of that package report as uncovered, and the dashboard would show a
-#     collapse that did not happen.
+# Job layout — three tiers:
+#   - Preflight: plugin-facts, i18n-parity and the quality jobs
+#     (server-quality, client-quality, plugin-sdk-quality) hold the cheap
+#     generated-code/typecheck/lint/smoke gates. Every test job `needs:` all
+#     of them, so a gate failure stops the run before the expensive coverage
+#     fan-out spends ~15 runner-minutes on a result the gates already sank.
+#   - Tests: the *-coverage jobs run the suites and upload lcov; s3-contract
+#     runs the MinIO contract suite. Coverage jobs run tests only — with the
+#     gates cleared in preflight, they can only fail because tests failed.
+#     client-e2e drives the real app in Chromium and WebKit, client-bundle
+#     builds the client and checks each map engine keeps a chunk of its own,
+#     and postgres-probe runs the dialect helpers and the repository
+#     statements it reaches against a Postgres service. None of them feeds the scan.
+#   - Scan `needs:` exactly the four coverage jobs. A coverage job failing
+#     must stop the scan — a missing lcov file would make every line of that
+#     package report as uncovered, and the dashboard would show a collapse
+#     that did not happen. (The preflight gates stop it transitively.)
 #   - Fork PRs and runs Dependabot triggers don't receive the repo's Actions
 #     secrets, so the two jobs that need them skip themselves: s3-contract
 #     (MINIO_LICENSE_KEY) and scan (SONAR_TOKEN). ci-ok counts a skip as
@@ -88,7 +38,7 @@ permissions:
 #     required check that never reports blocks the PR for good.
 #   - docker-image builds the Dockerfile and boots the result, and
 #     deploy-manifests lints and renders the Helm chart and checks the
-#     compose files. Both run beside the gates rather than after them.
+#     compose files. Both run beside the preflight rather than after it.
 #   - ci-ok `needs:` every gate, test, image and chart job, and is the one
 #     check the branch ruleset requires. It fails when any of them failed or
 #     was cancelled and passes when they passed or were skipped (by changes,
@@ -119,7 +69,7 @@ concurrency:
 
 jobs:
   changes:
-    name: 'Repo: Changed Areas'
+    name: Changed Areas
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     outputs:
@@ -194,8 +144,36 @@ jobs:
             node scripts/ci/changed-areas.mjs --all
           fi
 
+  plugin-facts:
+    name: Plugin Permission Facts
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+          cache-dependency-path: package-lock.json
+
+      - name: Install dependencies
+        run: npm ci --workspace server
+
+      # The plugin permission facts live once, in
+      # server/src/nest/plugins/protocol/envelope.ts. Every other copy — the
+      # SDK's generated/host-facts.ts and shared's plugin-permissions.ts — is
+      # generated from it and checked in, because publish-plugin-sdk builds
+      # from a standalone checkout with no server present. This fails the run
+      # if a copy drifts, if a new permission has no admin.plugins.perm.*
+      # translation, or if the CLI has no hint for it.
+      - name: Check the generated plugin facts are in sync
+        run: cd server && npm run check:plugin-facts
+
   i18n-parity:
-    name: 'Shared: i18n Parity'
+    name: i18n Key Parity
     needs: changes
     if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-24.04
@@ -211,8 +189,8 @@ jobs:
       - name: Check i18n key parity
         run: node shared/scripts/i18n-parity.mjs --strict
 
-  server-types:
-    name: 'Server: Types'
+  server-quality:
+    name: Server Types & Lint
     needs: changes
     if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-24.04
@@ -261,11 +239,8 @@ jobs:
         # constructor parameter does not break its hand-wired call sites at
         # compile time: the argument arrives as undefined and throws at
         # runtime, if anything reads it at all. This is the step that
-        # catches it. src and tests together are past 570,000 lines and need
-        # about 4.3 GB, over Node's default heap.
+        # catches it.
         run: cd server && npm run typecheck:tests
-        env:
-          NODE_OPTIONS: --max-old-space-size=8192
 
       - name: Typecheck entity generator
         # tsconfig.scripts.json covers generate-entities.ts and migrate-encryption.ts;
@@ -282,36 +257,6 @@ jobs:
         # migration that changes a column regenerates it in the same change.
         run: cd server && npm run check:db-types
 
-  server-lint-checks:
-    name: 'Server: Lint & Checks'
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 45
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-          cache-dependency-path: package-lock.json
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Build shared
-        run: npm run build --workspace=shared
-
-      - name: Fetch the base the warnings are compared with
-        # lint:warnings names the file behind a grown count by linting it as
-        # it is on the base: the pushed-over commit on a push, the target
-        # branch on a pull request. A miss only drops that hint.
-        run: >-
-          git fetch --no-tags --depth=1 origin
-          "+${{ github.event_name == 'push' && github.event.before || format('refs/heads/{0}', github.base_ref || 'dev') }}:refs/remotes/lint-base"
-          || true
-
       - name: Lint
         # Errors fail, and the warnings per rule may not pass
         # scripts/eslint-baseline.json (src, tests and eslint-disable'd
@@ -319,19 +264,8 @@ jobs:
         # program, which outgrows Node's default ~4 GB heap on the runner.
         env:
           NODE_OPTIONS: --max-old-space-size=8192
-          TREK_LINT_BASE: refs/remotes/lint-base
         run: cd server && npm run lint:warnings
 
-      # The plugin permission facts live once, in
-      # server/src/nest/plugins/protocol/envelope.ts. Every other copy — the
-      # SDK's generated/host-facts.ts and shared's plugin-permissions.ts — is
-      # generated from it and checked in, because publish-plugin-sdk builds
-      # from a standalone checkout with no server present. This fails the run
-      # if a copy drifts, if a new permission has no admin.plugins.perm.*
-      # translation, or if the CLI has no hint for it.
-      - name: Check the generated plugin facts are in sync
-        run: cd server && npm run check:plugin-facts
-
       - name: Formatting check
         # Prettier over src/ and tests/: a file outside
         # scripts/format-baseline.json must be formatted, and the list only
@@ -425,12 +359,12 @@ jobs:
         # knip (knip.jsonc) over client, server and shared: unused files,
         # exports, types and dependencies per file may not rise above
         # scripts/ci/knip-baseline.json (scripts/ci/knip-ratchet.mjs). Here
-        # rather than in client-types-checks because it needs every workspace's
-        # dependencies, which the client jobs do not install.
+        # rather than in client-quality because it needs every workspace's
+        # dependencies, which only this job installs.
         run: npm run lint:knip
 
-  client-types-checks:
-    name: 'Client: Types & Checks'
+  client-quality:
+    name: Client Types & Lint
     needs: changes
     if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-24.04
@@ -446,7 +380,7 @@ jobs:
           cache-dependency-path: package-lock.json
 
       - name: Install dependencies
-        run: npm ci --workspace shared --workspace client
+        run: npm ci --workspace shared && npm ci --workspace client
 
       - name: Build shared
         run: npm run build --workspace=shared
@@ -461,6 +395,15 @@ jobs:
         # one included, has to be clean (scripts/strict-lint.mjs).
         run: cd client && npm run lint:strict
 
+      - name: Lint
+        # Fails on any ESLint error, like lint:check did, and on any rule
+        # whose warning count rises above scripts/eslint-baseline.json.
+        # Typed linting (no-floating-promises, no-misused-promises) loads the
+        # whole TypeScript program, so it gets the heap the server lint gets.
+        env:
+          NODE_OPTIONS: --max-old-space-size=8192
+        run: cd client && npm run lint:warnings
+
       - name: Page pattern check
         run: cd client && npm run lint:pages
 
@@ -524,12 +467,15 @@ jobs:
         # follow the user's scheme, accent and text size (scripts/theme-lint.mjs).
         run: cd client && npm run theme:lint
 
-  client-lint:
-    name: 'Client: Lint'
+  plugin-sdk-quality:
+    name: Plugin SDK Types
     needs: changes
     if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-24.04
     timeout-minutes: 45
+    defaults:
+      run:
+        working-directory: plugin-sdk
 
     steps:
       - uses: actions/checkout@v6
@@ -537,40 +483,20 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version-file: .nvmrc
-          cache: npm
-          cache-dependency-path: package-lock.json
 
+      # plugin-sdk is standalone (own lockfile, not a root workspace), so it
+      # installs from its own directory.
       - name: Install dependencies
-        run: npm ci --workspace shared --workspace client
+        run: npm ci
 
-      - name: Build shared
-        run: npm run build --workspace=shared
-
-      - name: Fetch the base the warnings are compared with
-        # lint:warnings names the file behind a grown count by linting it as
-        # it is on the base: the pushed-over commit on a push, the target
-        # branch on a pull request. A miss only drops that hint.
-        run: >-
-          git fetch --no-tags --depth=1 origin
-          "+${{ github.event_name == 'push' && github.event.before || format('refs/heads/{0}', github.base_ref || 'dev') }}:refs/remotes/lint-base"
-          || true
-
-      - name: Lint
-        # Fails on any ESLint error, like lint:check did, and on any rule
-        # whose warning count rises above scripts/eslint-baseline.json.
-        # Typed linting (no-floating-promises, no-misused-promises) loads the
-        # whole TypeScript program, so it gets the heap the server lint gets.
-        env:
-          NODE_OPTIONS: --max-old-space-size=8192
-          TREK_LINT_BASE: refs/remotes/lint-base
-        run: cd client && npm run lint:warnings
+      - name: Typecheck
+        run: npm run typecheck
 
   client-bundle:
-    name: 'Client: Bundle'
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
+    name: Client Bundle
     runs-on: ubuntu-24.04
     timeout-minutes: 45
+    needs: [plugin-facts, i18n-parity, server-quality, client-quality, plugin-sdk-quality]
     steps:
       - uses: actions/checkout@v6
 
@@ -581,7 +507,7 @@ jobs:
           cache-dependency-path: package-lock.json
 
       - name: Install dependencies
-        run: npm ci --workspace shared --workspace client
+        run: npm ci --workspace shared && npm ci --workspace client
 
       - name: Build shared
         run: npm run build --workspace=shared
@@ -597,11 +523,10 @@ jobs:
         run: cd client && npm run check:gl-split
 
   client-e2e:
-    name: 'Client: End-to-End'
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
+    name: Client End-to-End
     runs-on: ubuntu-24.04
     timeout-minutes: 45
+    needs: [plugin-facts, i18n-parity, server-quality, client-quality, plugin-sdk-quality]
     steps:
       - uses: actions/checkout@v6
 
@@ -655,17 +580,17 @@ jobs:
           retention-days: 7
 
   s3-contract:
-    name: 'Server: S3 Contract (MinIO)'
+    name: S3 Driver Contract (MinIO)
     runs-on: ubuntu-24.04
     timeout-minutes: 45
-    needs: changes
+    needs: [plugin-facts, i18n-parity, server-quality, client-quality, plugin-sdk-quality]
     # Fork PRs don't get repo secrets, so MINIO_LICENSE_KEY would be empty and
     # the AIStor container would fail to boot. A run Dependabot triggers gets
     # only Dependabot secrets, so its PRs (same repo, not a fork) hit the same
     # wall. Pushes and manual dispatches by anyone else do have secrets, so
-    # only those two are filtered out.
+    # only those two are filtered out. (The implicit success() on this
+    # expression also keeps the job skipped when a preflight fails.)
     if: >-
-      needs.changes.outputs.code == 'true' &&
       github.actor != 'dependabot[bot]' &&
       (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
 
@@ -681,14 +606,14 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Check @swc/core's native binding loads
-        # The server's SWC transform (server/vitest.config.ts) needs it. The
-        # lockfile carries the Linux binary, so npm ci installs it; this only
-        # names the cause if a lockfile regenerated without it ever lands. (It
-        # used to be installed here with --legacy-peer-deps, which pruned
-        # eight peer packages and left the tests on a tree the lockfile does
-        # not describe.)
-        run: node -e "require('@swc/core').transformSync('let a = 1')"
+      - name: Ensure @swc/core's Linux binary for unplugin-swc
+        # The lockfile was generated on Windows and omits @swc/core's Linux
+        # optional native binary, so npm ci/install skips it on the runner.
+        # Install the matching version explicitly so the server's SWC transform
+        # (server/vitest.config.ts) can load.
+        run: |
+          SWC_VERSION=$(node -p "require('@swc/core/package.json').version")
+          npm install --no-save --legacy-peer-deps "@swc/core-linux-x64-gnu@$SWC_VERSION"
 
       - name: Build shared
         run: npm run build --workspace=shared
@@ -746,10 +671,10 @@ jobs:
   # artifact seeds the file and a change that fixes a statement can lower it
   # without a local Postgres.
   postgres-probe:
-    name: 'Server: Postgres Probe'
+    name: Postgres Probe
     runs-on: ubuntu-24.04
     timeout-minutes: 10
-    needs: changes
+    needs: [changes, plugin-facts, i18n-parity, server-quality, client-quality, plugin-sdk-quality]
     if: needs.changes.outputs.code == 'true'
     services:
       postgres:
@@ -802,20 +727,11 @@ jobs:
           if-no-files-found: ignore
           retention-days: 14
 
-  # The server suite in seven slices. vitest.shard.config.ts is vitest.config.ts
-  # without the thresholds and the coverage reports: a slice's blob carries
-  # its coverage to server-coverage, which checks the whole. fail-fast is off,
-  # so one red run shows every failing slice and not just the first.
-  server-tests:
-    name: 'Server: Tests ${{ matrix.shard }}/7'
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
+  server-coverage:
+    name: Server Coverage
     runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    strategy:
-      fail-fast: false
-      matrix:
-        shard: [1, 2, 3, 4, 5, 6, 7]
+    timeout-minutes: 45
+    needs: [plugin-facts, i18n-parity, server-quality, client-quality, plugin-sdk-quality]
     steps:
       - uses: actions/checkout@v6
 
@@ -828,63 +744,20 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Check @swc/core's native binding loads
-        # The server's SWC transform (server/vitest.config.ts) needs it. The
-        # lockfile carries the Linux binary, so npm ci installs it; this only
-        # names the cause if a lockfile regenerated without it ever lands. (It
-        # used to be installed here with --legacy-peer-deps, which pruned
-        # eight peer packages and left the tests on a tree the lockfile does
-        # not describe.)
-        run: node -e "require('@swc/core').transformSync('let a = 1')"
+      - name: Ensure @swc/core's Linux binary for unplugin-swc
+        # The lockfile was generated on Windows and omits @swc/core's Linux
+        # optional native binary, so npm ci/install skips it on the runner.
+        # Install the matching version explicitly so the server's SWC transform
+        # (server/vitest.config.ts) can load.
+        run: |
+          SWC_VERSION=$(node -p "require('@swc/core/package.json').version")
+          npm install --no-save --legacy-peer-deps "@swc/core-linux-x64-gnu@$SWC_VERSION"
 
       - name: Build shared
         run: npm run build --workspace=shared
 
-      - name: Run a slice of the tests with coverage
-        run: >-
-          cd server && npx vitest run --config vitest.shard.config.ts --coverage
-          --shard=${{ matrix.shard }}/7
-          --reporter=default --reporter=github-actions --reporter=blob
-
-      - name: Upload the blob report
-        uses: actions/upload-artifact@v6
-        with:
-          name: server-blob-${{ matrix.shard }}
-          path: server/.vitest-reports/
-          include-hidden-files: true
-          if-no-files-found: error
-          retention-days: 1
-
-  server-coverage:
-    name: 'Server: Coverage'
-    needs: server-tests
-    runs-on: ubuntu-24.04
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-          cache-dependency-path: package-lock.json
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Download the blob reports
-        uses: actions/download-artifact@v7
-        with:
-          pattern: server-blob-*
-          path: server/.vitest-reports/
-          merge-multiple: true
-
-      - name: Merge the slices and check the thresholds
-        # Every blob holds a whole coverage map, and the merge reads them all
-        # into one process.
-        env:
-          NODE_OPTIONS: --max-old-space-size=6144
-        run: cd server && npx vitest run --merge-reports --coverage
+      - name: Run tests with coverage
+        run: cd server && npm run test:coverage
 
       - name: Upload coverage
         uses: actions/upload-artifact@v6
@@ -893,18 +766,11 @@ jobs:
           path: server/coverage/
           retention-days: 1
 
-  # The client suite in seven slices, the same way as server-tests. The two
-  # suites cost about the same per slice at seven each (~4-6 minutes).
-  client-tests:
-    name: 'Client: Tests ${{ matrix.shard }}/7'
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
+  client-coverage:
+    name: Client Coverage
     runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    strategy:
-      fail-fast: false
-      matrix:
-        shard: [1, 2, 3, 4, 5, 6, 7]
+    timeout-minutes: 45
+    needs: [plugin-facts, i18n-parity, server-quality, client-quality, plugin-sdk-quality]
     steps:
       - uses: actions/checkout@v6
 
@@ -919,56 +785,13 @@ jobs:
       # @testing-library/react) in the tree without the re-resolution dance
       # the folded coverage job used to need.
       - name: Install dependencies
-        run: npm ci --workspace shared --workspace client
+        run: npm ci --workspace shared && npm ci --workspace client
 
       - name: Build shared
         run: npm run build --workspace=shared
 
-      - name: Run a slice of the tests with coverage
-        run: >-
-          cd client && npx vitest run --config vitest.shard.config.ts --coverage
-          --shard=${{ matrix.shard }}/7
-          --reporter=default --reporter=github-actions --reporter=blob
-
-      - name: Upload the blob report
-        uses: actions/upload-artifact@v6
-        with:
-          name: client-blob-${{ matrix.shard }}
-          path: client/.vitest-reports/
-          include-hidden-files: true
-          if-no-files-found: error
-          retention-days: 1
-
-  client-coverage:
-    name: 'Client: Coverage'
-    needs: client-tests
-    runs-on: ubuntu-24.04
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-          cache-dependency-path: package-lock.json
-
-      - name: Install dependencies
-        run: npm ci --workspace shared --workspace client
-
-      - name: Download the blob reports
-        uses: actions/download-artifact@v7
-        with:
-          pattern: client-blob-*
-          path: client/.vitest-reports/
-          merge-multiple: true
-
-      - name: Merge the slices and check the thresholds
-        # Every blob holds a whole coverage map, and the merge reads them all
-        # into one process.
-        env:
-          NODE_OPTIONS: --max-old-space-size=6144
-        run: cd client && npx vitest run --merge-reports --coverage
+      - name: Run tests with coverage
+        run: cd client && npm run test:coverage
 
       - name: Upload coverage
         uses: actions/upload-artifact@v6
@@ -978,11 +801,10 @@ jobs:
           retention-days: 1
 
   shared-coverage:
-    name: 'Shared: Coverage'
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
+    name: Shared Coverage
     runs-on: ubuntu-24.04
     timeout-minutes: 45
+    needs: [plugin-facts, i18n-parity, server-quality, client-quality, plugin-sdk-quality]
     steps:
       - uses: actions/checkout@v6
 
@@ -1005,14 +827,11 @@ jobs:
           path: shared/coverage/
           retention-days: 1
 
-  # Typecheck and tests in one job: each takes seconds, and a runner of its
-  # own would cost more in setup than it saves.
-  plugin-sdk:
-    name: 'Plugin SDK: Types & Coverage'
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
+  plugin-sdk-coverage:
+    name: Plugin SDK Coverage
     runs-on: ubuntu-24.04
     timeout-minutes: 45
+    needs: [plugin-facts, i18n-parity, server-quality, client-quality, plugin-sdk-quality]
     defaults:
       run:
         working-directory: plugin-sdk
@@ -1031,9 +850,6 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Typecheck
-        run: npm run typecheck
-
       - name: Run tests with coverage
         run: npm run test:coverage
 
@@ -1045,7 +861,7 @@ jobs:
           retention-days: 1
 
   scan:
-    name: 'Repo: Sonar Scan'
+    name: Scan
     runs-on: ubuntu-24.04
     timeout-minutes: 45
     # Fork PRs and Dependabot runs don't receive SONAR_TOKEN, so skip the scan
@@ -1055,18 +871,9 @@ jobs:
       (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
     # Coverage jobs failing must stop the scan: a missing lcov file would make
     # every line of that package report as uncovered, and the dashboard would
-    # show a collapse that did not happen. The gates run beside the tests now,
-    # so they are listed here too, and a failed gate still stops the scan.
-    needs:
-      - i18n-parity
-      - server-types
-      - server-lint-checks
-      - client-types-checks
-      - client-lint
-      - server-coverage
-      - client-coverage
-      - shared-coverage
-      - plugin-sdk
+    # show a collapse that did not happen. The preflight gates already stop it
+    # transitively through these four, so they aren't repeated here.
+    needs: [server-coverage, client-coverage, shared-coverage, plugin-sdk-coverage]
 
     steps:
       - uses: actions/checkout@v6
@@ -1100,7 +907,7 @@ jobs:
           path: plugin-sdk/coverage/
 
       - name: Scan
-        uses: SonarSource/sonarqube-scan-action@4d1dc0c91ee400dcf8a6dddf2f705ac36542e304 # v8.4.0
+        uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
         env:
           # SonarQube Cloud is the scan action's default host, so no
           # SONAR_HOST_URL — the token is a sonarcloud.io token for the
@@ -1127,7 +934,7 @@ jobs:
   # reached dev unseen. It is separate from the vulnerability scan on purpose,
   # so a newly published CVE cannot hide a broken build or the other way round.
   docker-image:
-    name: 'Repo: Docker Image'
+    name: Docker Image
     needs: changes
     if: needs.changes.outputs.image == 'true'
     runs-on: ubuntu-24.04
@@ -1161,7 +968,7 @@ jobs:
           docker run -d --name trek-ci -p 127.0.0.1:3000:3000 \
             --read-only --tmpfs /tmp:noexec,nosuid,size=128m \
             --security-opt no-new-privileges:true \
-            --cap-drop ALL --cap-add CHOWN --cap-add SETUID --cap-add SETGID --cap-add KILL \
+            --cap-drop ALL --cap-add CHOWN --cap-add SETUID --cap-add SETGID \
             -v "$RUNNER_TEMP/trek/data:/app/data" \
             -v "$RUNNER_TEMP/trek/uploads:/app/uploads" \
             -e ENCRYPTION_KEY="$(openssl rand -hex 32)" \
@@ -1194,17 +1001,6 @@ jobs:
           curl -sf http://127.0.0.1:3000/ | grep -q '<div id="root">' \
             || { echo "::error::/ does not serve the client"; exit 1; }
 
-      # Same capabilities as the shipped compose file: dumb-init has to be able
-      # to pass the stop signal on to node, or docker stop ends in SIGKILL (137).
-      - name: Stop gracefully
-        run: |
-          set -euo pipefail
-          docker stop -t 30 trek-ci >/dev/null
-          code="$(docker inspect -f '{{.State.ExitCode}}' trek-ci)"
-          [ "$code" = "0" ] || { echo "::error::docker stop ended with exit code $code, not a graceful shutdown"; exit 1; }
-          docker logs trek-ci 2>&1 | grep 'SIGTERM received' >/dev/null \
-            || { echo "::error::the server never saw SIGTERM"; exit 1; }
-
       - name: Container log
         if: always()
         run: docker logs trek-ci 2>&1 || true
@@ -1215,7 +1011,7 @@ jobs:
   # the output checked against the Kubernetes API schemas. Both tools come
   # from their release pages, pinned by version and checksum.
   deploy-manifests:
-    name: 'Repo: Helm Chart & Compose'
+    name: Helm Chart & Compose
     needs: changes
     if: needs.changes.outputs.deploy == 'true'
     runs-on: ubuntu-24.04
@@ -1263,39 +1059,11 @@ jobs:
             --set 'extraEnv[0].name=SESSION_DURATION' \
             --set 'extraEnv[0].value=7d' \
             --set 'extraEnvFrom[0].secretRef.name=trek-smtp' \
-            --set 'extraVolumes[0].name=kitinerary-extractors' \
-            --set 'extraVolumes[0].configMap.name=trek-kitinerary-extractors' \
-            --set 'extraVolumeMounts[0].name=kitinerary-extractors' \
-            --set 'extraVolumeMounts[0].mountPath=/usr/local/share/kitinerary/extractors' \
-            --set 'extraVolumeMounts[0].readOnly=true' \
             --set probes.liveness=null \
             > "$out/variants.yaml"
-          helm template trek charts/trek \
-            --set httpRoute.enabled=true \
-            --set 'httpRoute.parentRefs[0].name=gateway' \
-            > "$out/http-route.yaml"
-          helm template trek charts/trek \
-            --set podSecurityContext.runAsUser=1000 \
-            --set podSecurityContext.runAsGroup=1000 \
-            --set podSecurityContext.runAsNonRoot=true \
-            --set podSecurityContext.seccompProfile.type=RuntimeDefault \
-            --set securityContext.allowPrivilegeEscalation=false \
-            --set 'securityContext.capabilities.drop[0]=ALL' \
-            > "$out/non-root.yaml"
-          helm template trek charts/trek \
-            --set ingress.enabled=true \
-            --set fullnameOverride=custom-trek \
-            --set service.port=8080 \
-            --set-json 'httpRoute={"enabled":true,"parentRefs":[{"name":"gateway","namespace":"gateway-system","sectionName":"https"}],"hostnames":["trek.example.com"],"paths":["/","/api"],"annotations":{"example.com/note":"custom route"},"timeouts":{"request":"0s","backendRequest":"0s"}}' \
-            > "$out/http-route-variants.yaml"
 
       - name: Check the manifests against the Kubernetes schemas
-        # The pinned Gateway API schema adds HTTPRoute validation without skipping unknown resources.
-        run: >-
-          kubeconform -strict -summary
-          -schema-location default
-          -schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/041baf4c1d3740ca21461cab765e7432ecd073ef/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json'
-          "$RUNNER_TEMP"/rendered/*.yaml
+        run: kubeconform -strict -summary "$RUNNER_TEMP"/rendered/*.yaml
 
       - name: Check every compose file
         run: |
@@ -1314,21 +1082,19 @@ jobs:
   ci-ok:
     needs:
       - changes
+      - plugin-facts
       - i18n-parity
-      - server-types
-      - server-lint-checks
-      - client-types-checks
-      - client-lint
+      - server-quality
+      - client-quality
+      - plugin-sdk-quality
       - client-bundle
       - client-e2e
       - s3-contract
       - postgres-probe
-      - server-tests
       - server-coverage
-      - client-tests
       - client-coverage
       - shared-coverage
-      - plugin-sdk
+      - plugin-sdk-coverage
       - docker-image
       - deploy-manifests
     # always(): without it a failed dependency would skip this job, and the

.gitignore

@@ -55,8 +55,6 @@ coverage
 coverage-*/
 *.lcov
 .nyc_output
-# Blob reports of a sharded vitest run (test.yml)
-.vitest-reports
 
 # Cache
 .npm

CLAUDE.md

@@ -134,10 +134,8 @@ These principles come out of a full-repo audit and shape all new code:
 
 ## Quality gates in CI
 
-`.github/workflows/test.yml` runs, per package: typecheck (server also `typecheck:tests`, client also the strict-mode ratchet `lint:strict`), lint (client and server through `lint:warnings`, which also holds the warning count per rule), `lint:pages`, `lint:rtl`, `lint:size` (client and server), the server's `lint:strict`, `lint:boundaries`, `lint:tx`, `lint:dialect`, `lint:test-sql`, `lint:test-mocks`, `lint:test-new-service`, `lint:query-api`, `lint:mcp-zod`, `lint:service-http` and `lint:response-contracts`, the client's and server's `lint:format`, `lint:layers`, `lint:offline`, `lint:dup`, `lint:pairs`, `lint:skips`, `lint:i18n-keys` and `theme:lint`, shared's `contracts:open`, the repo-wide `lint:knip` (in server-lint-checks), `check:plugin-facts`, `i18n:parity:strict` (with the untranslated-strings ratchet), the S3 contract suite, the Postgres probe (`postgres-probe`: every dialect helper on SQLite and Postgres, and the statements every repository method reaches with sample arguments against a Postgres service; the SQL errors per method and the list of methods it cannot measure are held to a baseline that only shrinks and fails while it is still unmeasured; see `server/CLAUDE.md`), the browser end-to-end flows (Chromium and WebKit), a client build with `check:gl-split`, coverage for all four packages, then a SonarCloud scan. It also builds the Docker image and boots it until `/api/health/ready` answers (`docker-image`), and lints and renders the Helm chart against the Kubernetes schemas and runs `docker compose config` on every compose file (`deploy-manifests`). `lint-prettier.yml` additionally runs `lint` + `lint:format` on `shared/`, both check-only. `plugin-sdk` has no lint script and is outside the eslint gates. **Not in CI**: the screenshot and help-media Playwright projects; run them locally. There are no git hooks; nothing runs before a commit except you. Other workflows build Docker images, scan them, and publish `trek-plugin-sdk` on `plugin-sdk-v*` tags.
+`.github/workflows/test.yml` runs, per package: typecheck (server also `typecheck:tests`, client also the strict-mode ratchet `lint:strict`), lint (client and server through `lint:warnings`, which also holds the warning count per rule), `lint:pages`, `lint:rtl`, `lint:size` (client and server), the server's `lint:strict`, `lint:boundaries`, `lint:tx`, `lint:dialect`, `lint:test-sql`, `lint:test-mocks`, `lint:test-new-service`, `lint:query-api`, `lint:mcp-zod`, `lint:service-http` and `lint:response-contracts`, the client's and server's `lint:format`, `lint:layers`, `lint:offline`, `lint:dup`, `lint:pairs`, `lint:skips`, `lint:i18n-keys` and `theme:lint`, shared's `contracts:open`, the repo-wide `lint:knip` (in server-quality), `check:plugin-facts`, `i18n:parity:strict` (with the untranslated-strings ratchet), the S3 contract suite, the Postgres probe (`postgres-probe`: every dialect helper on SQLite and Postgres, and the statements every repository method reaches with sample arguments against a Postgres service; the SQL errors per method and the list of methods it cannot measure are held to a baseline that only shrinks and fails while it is still unmeasured; see `server/CLAUDE.md`), the browser end-to-end flows (Chromium and WebKit), a client build with `check:gl-split`, coverage for all four packages, then a SonarCloud scan. It also builds the Docker image and boots it until `/api/health/ready` answers (`docker-image`), and lints and renders the Helm chart against the Kubernetes schemas and runs `docker compose config` on every compose file (`deploy-manifests`). `lint-prettier.yml` additionally runs `lint` + `lint:format` on `shared/`, both check-only. `plugin-sdk` has no lint script and is outside the eslint gates. **Not in CI**: the screenshot and help-media Playwright projects; run them locally. There are no git hooks; nothing runs before a commit except you. Other workflows build Docker images, scan them, and publish `trek-plugin-sdk` on `plugin-sdk-v*` tags.
 
-- **Job names read "package: what"** (`Server: Types`, `Client: Tests 3/7`), and the list at the top of `test.yml` says what each job holds. A new job follows the scheme and joins that list, and the job-count note there says when a long job needs a slot freed first.
-- **Tests run beside the gates, in shards.** The client and server suites run in slices on parallel runners (`client-tests`, `server-tests`, through each package's `vitest.shard.config.ts`), and `client-coverage`/`server-coverage` merge their blob reports and check the thresholds against the whole. A red slice is usually a failing test, a red merge job usually a threshold.
 - **`ci-ok` is the required check.** The branch ruleset requires `ci-ok` (plus `lint` and `check-target` from their own workflows), and `ci-ok` needs every job above except the scan. It fails if any of them failed or was cancelled and passes if they passed or were skipped. A new gate job counts only once it is listed in `ci-ok`'s `needs:`.
 - **Guides name paths that exist**: the `changes` job runs `scripts/ci/doc-paths.mjs`, which resolves every backtick path in the CLAUDE.md files, `README.md`, `server/src/nest/README.md` and the wiki against the tracked files; the missing ones are listed in `scripts/ci/doc-paths-baseline.json`, which only shrinks (`--update` after a fix).
 - **What runs is decided by `changes`, not by `on.paths`**: `scripts/ci/changed-areas.mjs` maps the changed files to the `code`, `image` and `deploy` areas (tests: `npm run test:ci-scripts`). A path filter on the workflow would leave `ci-ok` unreported on a docs-only PR and block it. Add a new top-level file the build reads to the right area there.

Dockerfile

@@ -22,6 +22,7 @@ WORKDIR /app
 COPY package.json package-lock.json ./
 COPY shared/package.json ./shared/
 COPY client/package.json ./client/
+COPY client/scripts/patch-maplibre.mjs ./client/scripts/
 RUN npm ci --workspace=client
 COPY --from=shared-builder /app/shared/dist ./shared/dist
 COPY client/ ./client/
@@ -91,8 +92,7 @@ ENV KITINERARY_EXTRACTOR_PATH=/usr/local/bin/kitinerary-extractor
 
 COPY --chown=node:node --from=server-builder /app/server/dist ./server/dist
 # Runtime data assets read from server/assets at runtime: airports.json (flight
-# transport search) and atlas/*.geojson.gz + atlas/admin1/*.geojson.gz (Atlas
-# country/region map). The build
+# transport search) and atlas/*.geojson.gz (Atlas country/region map). The build
 # only emits dist, so these must be copied explicitly or the features silently
 # degrade to empty in the image.
 COPY --chown=node:node --from=server-builder /app/server/assets ./server/assets

NOTICE.md

@@ -5,9 +5,8 @@ TREK bundles and uses third-party data that requires attribution.
 ## geoBoundaries — country & sub-national boundaries
 
 The Atlas map's administrative boundaries (admin-0 countries and admin-1
-provinces/counties), shipped at `server/assets/atlas/admin0.geojson.gz`,
-`server/assets/atlas/admin1.geojson.gz` and `server/assets/atlas/admin1/<ISO_A2>.geojson.gz`
-(the same regions, one file per country) and generated by
+provinces/counties), shipped at `server/assets/atlas/admin0.geojson.gz` and
+`server/assets/atlas/admin1.geojson.gz` and generated by
 `server/scripts/build-atlas-geo.mjs`, are derived from **geoBoundaries**.
 
 > Runfola, D. et al. (2020) geoBoundaries: A global database of political
@@ -54,54 +53,3 @@ own switch in the admin panel. https://cloud.google.com/maps-platform/terms
 
 `server/assets/airports.json` is built from **OurAirports**
 (https://ourairports.com/data/), released into the public domain.
-
-## Typefaces: Studio books and the app
-
-Every typeface a book can be set in, and the app's own (Poppins, MuseoModerno,
-Geist), is self-hosted from the **@fontsource** npm packages, which redistribute
-the families published on Google Fonts split into subsets by script. The catalogue of book faces is
-`shared/src/book/book-fonts.data.ts`. Each package carries its licence and the
-copyright notice of the family's authors in its `LICENSE` file.
-
-Both licences allow a font to be bundled with software and embedded in a
-document made with it, so a printed or exported book may carry the faces it is
-set in. No family is renamed, redrawn or sold on its own. SIL OFL 1.1: https://openfontlicense.org. Apache 2.0:
-https://www.apache.org/licenses/LICENSE-2.0
-
-| Family | Package | Licence |
-|---|---|---|
-| Abril Fatface | `@fontsource/abril-fatface` | SIL Open Font License 1.1 |
-| Alfa Slab One | `@fontsource/alfa-slab-one` | SIL Open Font License 1.1 |
-| Allura | `@fontsource/allura` | SIL Open Font License 1.1 |
-| Anton | `@fontsource/anton` | SIL Open Font License 1.1 |
-| Archivo Black | `@fontsource/archivo-black` | SIL Open Font License 1.1 |
-| Bebas Neue | `@fontsource/bebas-neue` | SIL Open Font License 1.1 |
-| Big Shoulders Display | `@fontsource/big-shoulders-display` | SIL Open Font License 1.1 |
-| Bodoni Moda | `@fontsource/bodoni-moda` | SIL Open Font License 1.1 |
-| Bricolage Grotesque | `@fontsource/bricolage-grotesque` | SIL Open Font License 1.1 |
-| Caveat | `@fontsource/caveat` | SIL Open Font License 1.1 |
-| Cormorant Garamond | `@fontsource/cormorant-garamond` | SIL Open Font License 1.1 |
-| Dancing Script | `@fontsource/dancing-script` | SIL Open Font License 1.1 |
-| DM Mono | `@fontsource/dm-mono` | SIL Open Font License 1.1 |
-| DM Serif Display | `@fontsource/dm-serif-display` | SIL Open Font License 1.1 |
-| EB Garamond | `@fontsource/eb-garamond` | SIL Open Font License 1.1 |
-| Fraunces | `@fontsource/fraunces` | SIL Open Font License 1.1 |
-| Great Vibes | `@fontsource/great-vibes` | SIL Open Font License 1.1 |
-| Homemade Apple | `@fontsource/homemade-apple` | Apache License 2.0 |
-| Inter | `@fontsource/inter` | SIL Open Font License 1.1 |
-| Kaushan Script | `@fontsource/kaushan-script` | SIL Open Font License 1.1 |
-| League Gothic | `@fontsource/league-gothic` | SIL Open Font License 1.1 |
-| Lora | `@fontsource/lora` | SIL Open Font License 1.1 |
-| Montserrat | `@fontsource/montserrat` | SIL Open Font License 1.1 |
-| MuseoModerno | `@fontsource/museomoderno` | SIL Open Font License 1.1 |
-| Oswald | `@fontsource/oswald` | SIL Open Font License 1.1 |
-| Pacifico | `@fontsource/pacifico` | SIL Open Font License 1.1 |
-| Parisienne | `@fontsource/parisienne` | SIL Open Font License 1.1 |
-| Permanent Marker | `@fontsource/permanent-marker` | Apache License 2.0 |
-| Playfair Display | `@fontsource/playfair-display` | SIL Open Font License 1.1 |
-| Poppins | `@fontsource/poppins` | SIL Open Font License 1.1 |
-| Sacramento | `@fontsource/sacramento` | SIL Open Font License 1.1 |
-| Satisfy | `@fontsource/satisfy` | Apache License 2.0 |
-| Shrikhand | `@fontsource/shrikhand` | SIL Open Font License 1.1 |
-| Yellowtail | `@fontsource/yellowtail` | Apache License 2.0 |
-| Geist Sans | `@fontsource/geist-sans` | SIL Open Font License 1.1 |

README.md

@@ -6,9 +6,14 @@
   <img src="docs/logo-trek-dark.svg" alt="TREK" height="96" />
 </picture>
 
-### Every part of your trip. One app you own.
+<br />
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/subtitle-light.png" />
+  <source media="(prefers-color-scheme: light)" srcset="docs/subtitle-dark.png" />
+  <img src="docs/subtitle-dark.png" alt="your trip. your plan." height="28" />
+</picture>
 
-TREK has grown from a travel planner into a whole ecosystem for trips: plan together in real time on a live map, build hikes, tours and road trips, keep bookings and shared costs in order, pack, write the journal, lay out the photo book and hand the busy work to the built-in AI. Self-hosted, on the web, on your phone and offline.
+A self-hosted, real-time collaborative travel planner — with maps, budgets, packing lists, a journal, and AI built in.
 
 <br />
 
@@ -27,16 +32,11 @@ TREK has grown from a travel planner into a whole ecosystem for trips: plan toge
 <a href="https://ko-fi.com/mauriceboe"><img alt="Ko-fi" src="https://img.shields.io/badge/Ko--fi-support-FF5E5B?style=for-the-badge" /></a>
 &nbsp;
 <a href="https://www.buymeacoffee.com/mauriceboe"><img alt="BMAC" src="https://img.shields.io/badge/BMAC-support-FFDD00?style=for-the-badge" /></a>
-&nbsp;
-<a href="LICENSE"><img alt="License" src="https://img.shields.io/badge/License-AGPL_v3-6B7280?style=for-the-badge" /></a>
-&nbsp;
-<a href="https://github.com/liketrek/TREK/releases"><img alt="Latest Release" src="https://img.shields.io/github/v/release/liketrek/trek?include_prereleases&style=for-the-badge&label=Release&color=6B7280" /></a>
-&nbsp;
-<a href="https://hub.docker.com/r/mauriceboe/trek"><img alt="Docker Pulls" src="https://img.shields.io/docker/pulls/mauriceboe/trek?style=for-the-badge&label=Docker%20pulls&color=6B7280" /></a>
-&nbsp;
-<a href="https://github.com/liketrek/TREK"><img alt="Stars" src="https://img.shields.io/github/stars/liketrek/trek?style=for-the-badge&label=Stars&color=6B7280" /></a>
-
-<sub>PUBLIC SERVICES PROUDLY SPONSORED BY</sub><br /><a href="https://cloud.dataforest.net/en?mtm_campaign=trek"><picture><source media="(prefers-color-scheme: dark)" srcset="docs/sponsors/dataforest-light.svg" /><source media="(prefers-color-scheme: light)" srcset="docs/sponsors/dataforest-dark.svg" /><img src="docs/sponsors/dataforest-dark.svg" alt="dataforest cloud" height="30" /></picture></a>
+<br />
+<a href="LICENSE"><img alt="License" src="https://img.shields.io/badge/license-AGPL_v3-6B7280?style=flat-square" /></a>
+<a href="https://github.com/liketrek/TREK/releases"><img alt="Latest Release" src="https://img.shields.io/github/v/release/liketrek/trek?include_prereleases&style=flat-square&color=6B7280" /></a>
+<a href="https://hub.docker.com/r/mauriceboe/trek"><img alt="Docker Pulls" src="https://img.shields.io/docker/pulls/mauriceboe/trek?style=flat-square&color=6B7280" /></a>
+<a href="https://github.com/liketrek/TREK"><img alt="Stars" src="https://img.shields.io/github/stars/liketrek/trek?style=flat-square&color=6B7280" /></a>
 </div>
 
 ---
@@ -62,7 +62,7 @@ TREK has grown from a travel planner into a whole ecosystem for trips: plan toge
 
 <br />
 
-Most of what follows is an addon an admin switches on or off. Lists, Costs, Documents, Collab, Tours, Vacay and Atlas ship on; Journey, Collections, MCP, the AI assistant, AI Parsing, Road trip, Dawarich and AirTrail ship off and are marked below.
+Most of what follows is an addon an admin switches on or off. Lists, Costs, Documents, Collab, Vacay and Atlas ship on; Journey, Collections, MCP, AI Parsing and AirTrail ship off and are marked below.
 
 <table>
 <tr>
@@ -70,110 +70,76 @@ Most of what follows is an addon an admin switches on or off. Lists, Costs, Docu
 
 #### 🧭 Planning
 
-- **Day plans**: drag places, notes and bookings between days with undo, or drop a map marker straight onto a day
-- **Maps**: Leaflet, Mapbox GL or MapLibre GL (OpenFreeMap, no token) with clustering, photo markers, route lines and a whole-trip route overview
-- **Places**: search the TREK Places index and OpenStreetMap with no key, or Google Places and Amap with one. Descriptions, hours and photos from Wikipedia, Wikidata and Wikimedia Commons, plus a rating and a custom image per place
-- **Explore**: nearby places by category for the map view, from the TREK Places index with Overpass as fallback
-- **Routes**: auto-sort a day (nearest neighbour then 2-opt, locked stops and hotels stay put), a travel mode per leg over OSRM or Valhalla, then open the day in Google Maps or CoMaps and a place in seven navigation apps
-- **Public transport**: door-to-door itineraries over Transitous, or Google where Transitous has no data
-- **Import and export**: Google Maps and Naver Maps lists, Google Maps directions links, GPX, KML and KMZ in; GPX and an ICS feed per trip or across all trips out
-- **Weather**: 16-day forecast from Open-Meteo, no key, and the archive for dates beyond it
-- **Trip dates**: move a trip and its days re-date themselves, with the bookings along or re-anchored. Trips also copy and archive
-- **Road trip** (off by default): drives with stops, day windows and arrival times that recompute, route alternatives, hazards and EV charging with range
+- **Day plans**: drag places between days and reorder inside a day, with undo. Notes and bookings drag the same way, and a map marker drops straight onto a day
+- **Maps**: Leaflet, Mapbox GL or MapLibre GL (OpenFreeMap, no token), with clustering, photo markers and route lines. 3D buildings and terrain are Mapbox only
+- **Place search**: Google Places when a key is set (photos, ratings, opening hours), otherwise OpenStreetMap with no key
+- **Place enrichment**: descriptions, facts, hours and photo candidates from OpenStreetMap, Wikipedia, Wikidata and Wikimedia Commons
+- **POI explore**: pull OpenStreetMap POIs by category for the current viewport over Overpass
+- **Import**: shared Google Maps and Naver Maps lists, plus GPX, KML and KMZ files
+- **Export**: GPX of a trip's places and tracks, and an ICS feed per trip or across all of them
+- **Routes**: auto-sort a day (nearest neighbour then 2-opt, locked stops and hotel anchors stay put), driving, walking or cycling profiles over OSRM, then open it in Google Maps or CoMaps
+- **Public transport**: door-to-door itineraries over Transitous
+- **Weather**: 16-day forecast from Open-Meteo, no key. Dates outside that window read the archive for the same date instead
+- **Day notes**: markdown body with an icon and a colour, reordered by drag and drop or moved to another day
+- **Trip dates**: move a trip and the days re-date themselves, either dragging the bookings along or re-anchoring them. Trips also copy and archive
 
 </td>
 <td width="50%" valign="top">
 
-#### 🥾 Tours
-
-- **Seven tour types**: hike, city walk, run, bike (touring, road, gravel, MTB), paddle (kayak, canoe, SUP), horse ride, and ski and winter (alpine, cross-country, touring, snowshoe, winter hike)
-- **Routing**: legs routed over Valhalla with shaping points, hand-drawn legs, route variants, round hikes of a wished length and trip places as stops, all with undo
-- **Hikes**: routed within a maximum SAC grade (T1 to T6), the trail grades along the way, and via ferratas on the map
-- **Terrain**: elevation profile, ascent and descent, and a 3D terrain map with grade colouring and a flyover, no token needed. Topo, hiking, cycling and satellite bases with sea marks and ski pistes as overlays
-- **Multi-day tours**: one route cut into stages and spread across the trip's days
-- **Along the way**: viewpoints, huts, water, food and more within a corridor of the route, inserted as a stop with the detour it adds
-- **Ski, paddle and city walks**: a piste router by difficulty and lift type; a water router with portages, locks and a wind forecast; city walks with stays, opening hours and transit between stops
-- **Plan against reality**: link a recorded GPX to a planned day and compare distance, ascent and time. Import trails from a wanderer instance, save tours to a collection and take them into another trip
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
 #### 🧳 Bookings and money
 
-- **Reservations**: 18 booking types with status, confirmation code, travellers and attached files
-- **Flights and trains**: several legs with stopovers and endpoint timezones, against 4,045 bundled airports so local times resolve without a key
-- **Accommodation**: a stay spans a range of nights with a check-in window
-- **Booking import**: EML, PDF, PKPass, HTML, TXT and photos of confirmations, through [KItinerary](https://invent.kde.org/pim/kitinerary) or an AI model, with a review step before anything is saved. Prices become linked costs
-- **AirTrail** (off by default): import flights from a self-hosted AirTrail instance and keep them in sync
-- **Costs**: split in integer cents with equal or custom shares, several payers, settle-up suggestions, a per-person summary, a settlement log and CSV export. A receipt photo can fill in an expense
-- **Currencies**: one per expense with the rate frozen at entry, from Frankfurter with no key
-- **Packing lists and to-dos**: categories, templates, assignees and visibility tiers; bags with weights as an admin switch; to-dos with due dates, priorities and reminders
-- **Files**: attach to a trip, place, day or booking, 50 MB each and 500 MB for video, with trash and restore
-- **PDF export**: cover, place photos, day notes, bookings and costs, with an optional page break per day
+- **Reservations**: 16 booking types with status, confirmation code, travellers and attached files
+- **Flights and trains**: several legs with stopovers, per-leg times and endpoint timezones, against 4,045 bundled airports so local times resolve without a key
+- **Accommodation**: a stay spans a range of days with a check-in window, and shows on every night it covers
+- **Booking import**: EML, PDF, PKPass, HTML and TXT confirmations through [KItinerary](https://invent.kde.org/pim/kitinerary). Needs the `kitinerary-extractor` binary, which ships in the Docker image
+- **AirTrail** (off by default): link a self-hosted AirTrail instance to import flights as reservations and keep them in sync
+- **Costs**: split expenses in integer cents with equal or custom shares, several payers per expense, settle-up suggestions, a settlement log, and CSV export
+- **Currencies**: a currency per expense with the rate frozen at entry. Rates come from Frankfurter, no key
+- **Packing lists**: categories, admin-managed templates, assignees, three visibility tiers, and a packed-of-total line. Bags with weight roll-up are a separate admin switch, off by default
+- **To-dos**: assignee, due date, priority, and a reminder before one falls due
+- **Files**: attach to a trip, place, day entry or reservation. 50 MB each, 500 MB for video, with trash and restore
+- **PDF export**: cover page, place photos, day notes, bookings and costs, with an optional page break per day
 
 </td>
+</tr>
+<tr>
 <td width="50%" valign="top">
 
 #### 👥 Collaboration
 
-- **Real-time sync** (WebSocket): edits land live for everyone who has the trip open
-- **Members**: add by email or username, hand over ownership, or add guests who have no login at all
-- **Permissions**: an admin maps each of 17 trip actions to admin, trip owner, trip member or everybody
-- **Invites**: one reusable link per trip with an optional expiry, and admin signup invites that drop a new account straight into a trip
-- **Public share**: a read-only trip page without an account, with switches for map, bookings, packing, costs and chat
-- **Collab**: group chat with replies, reactions and link previews, shared notes, links, polls and a What's Next list, each one its own switch
-- **Notifications**: an inbox grouped by day with answers right from the notification, and a per-user matrix of events against in-app, email, webhook, ntfy, Web Push and plugin channels
+- **Real-time sync** (WebSocket): edits land live for everyone who has that trip open
+- **Members**: add by email or username, hand ownership to someone else, or add guests who have no login at all
+- **Permissions**: an admin maps each of 16 trip actions to admin, trip owner, trip member or everybody
+- **Invite links**: one reusable link per trip with an optional expiry. Admins can also issue signup invites with a use limit that drop the new account straight into a trip
+- **Public share**: a read-only trip page anyone can open without an account
+- **Collab**: group chat with replies, reactions and link previews, shared notes with attachments, polls, and a What's Next list of upcoming activities. Each of the four switches on its own
 
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
+#### 📔 Journal, Atlas and Vacay
 
-#### 📔 Journey and TREK Studio
-
-- **Journey** (off by default): dated entries with story, mood, weather and tags, photos and video from uploads, [Immich](https://immich.app) or Synology Photos, map views, co-authors, drafts and a public share link
-- **Linked journal**: a trip can show one journal as its own, with the members picked on the trip as viewers or editors
-- **Recorded days** (with Dawarich): keep a day's recorded route and turn its stays into entries
-- **TREK Studio**: turn a journal into a printable photo book. 34 print-licensed typefaces, 17 themes, 108 designed pages in twelve styles, 160 recolourable stickers, text effects, layers and a Travel tab with route maps, country stamps and trip figures
-- **Auto layout**: lays the whole book on the designed pages in the style of its theme, every photo in a frame, or rebuilds one spread
-- **Print and share**: PDF export as pages or spreads with crop marks, several people editing at once, and design files to move a spread into another book
-
-</td>
-<td width="50%" valign="top">
-
-#### 🗺️ Atlas, Vacay and Collections
-
-- **Atlas**: countries and regions visited on [geoBoundaries](https://www.geoboundaries.org/) outlines, a bucket list, travel stats, and a tour activities tab with planned against recorded totals
-- **Vacay**: leave calendar with half days, public holidays from date.nager.at, school holidays for 16 European countries, company holidays, carry-over between years, and joint or read-only sharing
-- **Collections** (off by default): a place library outside any trip with lists, labels, ratings, a status per place, cover images, GPX and file export, copy into a trip, and sharing by invite
-- **Dawarich** (off by default): link a Dawarich instance for recorded tracks, suggested stays and countries for the Atlas
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-#### 🤖 AI assistant and MCP
-
-- **AI assistant** (off by default): a chat that plans with you in a trip, across all your trips, in a journal and in Studio, and works with tours, costs, bookings, packing, Vacay and the Atlas
-- **Your own model**: an API key for Anthropic, OpenAI, Gemini or OpenRouter, a ChatGPT plan, or any OpenAI-compatible endpoint, set for the instance or per user
-- **You stay in charge**: reads run at once, every change waits as a card to apply or discard and can be undone for 15 minutes. Nothing leaves before you agree to the provider, and a file's text only with your consent
-- **Attachments**: drop a booking confirmation, a GPX file or a photo into the chat, and the assistant offers what to do with it
-- **MCP server** (off by default): OAuth 2.1 with mandatory PKCE and dynamic client registration, 410 tools, 30 resources and 4 prompts, 35 scopes in 17 groups ticked on the consent screen, and every call in the audit log
-- **Addon-aware**: twelve addon gates decide which tools a session sees, and flipping one re-registers live sessions
+- **Journey** (off by default): dated entries with story, mood, weather and tags, photos and video from uploads or a linked [Immich](https://immich.app) or Synology Photos library, map views, co-authors, and a public share link
+- **Atlas**: mark countries and sub-national regions visited on [geoBoundaries](https://www.geoboundaries.org/) outlines, plus a bucket list, travel stats and a consecutive-years-travelled count
+- **Vacay**: leave calendar with half days, public holidays from date.nager.at, school holiday overlays for 16 European countries, carry-over between years, and joint or read-only sharing of a plan
+- **Collections** (off by default): a place library outside any trip, with labels, ratings, a custom image per place, copy-into-a-trip, and sharing by invite
 
 </td>
 <td width="50%" valign="top">
 
 #### 🧩 Plugins
 
-- **Third-party plugins**: install from the TREK registry or sideload a zip, with their own pages under `/plugins/<id>`
-- **Sandboxed**: one child process per plugin, 66 grantable permissions, an admin-edited outbound host allowlist, memory and call caps
-- **Trust**: registry downloads are pinned by sha256 and checked against the author's minisign key, a sideloaded zip is marked unverified, and `TREK_PLUGINS_ENABLED=false` turns the whole system off
-- **Extension points**: map layers, place details, day schedules, PDF sections, Atlas layers, journal rows, trip warnings, search and photo providers, route profiles, notification channels and MCP tools
-- **SDK**: [`trek-plugin-sdk`](https://www.npmjs.com/package/trek-plugin-sdk) with a CLI to create, validate, run against real data, sign and publish
+- **Third-party plugins**: install from the TREK registry or sideload a zip, switch on per instance, with their own pages under `/plugins/<id>`
+- **Sandboxed**: one child process per plugin, 63 grantable permissions, an admin-edited outbound host allowlist, memory and RPC caps, and daily caps on AI and notification calls
+- **Trust**: registry downloads are pinned by sha256 and checked against the author's minisign key. A sideloaded zip is marked unverified, and `TREK_PLUGINS_ENABLED=false` turns the whole system off
+- **Extension points**: map markers and layers, place details, day schedules, PDF sections, Atlas layers, journal rows, trip warnings, calendar sources, route profiles and notification channels. Plugin pages run in an opaque-origin iframe
+- **SDK**: [`trek-plugin-sdk`](https://www.npmjs.com/package/trek-plugin-sdk) on npm, with a manifest validator, a mock host, and a dev-link mode that runs a local build against real data
+
+#### 🤖 AI and MCP
+
+- **MCP server** (off by default): OAuth 2.1 with mandatory PKCE and dynamic client registration. 199 tools, 30 resources, 4 prompts
+- **Scopes**: 29 scopes in 14 groups, each one tickable on the consent screen. Tokens are bound to the `/mcp` resource, and every tool call lands in the audit log
+- **Reach**: create trips and days, edit places, packing lists, to-dos, costs, reservations, collections and journeys, mark countries visited, all inside the scopes the token holds
+- **Prompts**: `trip-summary`, plus `packing-list` and `budget-overview` when those addons are on
+- **Addon-aware**: seven addon gates decide which tools and resources a session sees. Flipping one drops live sessions so the surface re-registers
+- **Booking extraction** (off by default): read a confirmation with a local Ollama server, any OpenAI-compatible endpoint, or Anthropic, configured instance-wide or per user
 
 </td>
 </tr>
@@ -182,26 +148,30 @@ Most of what follows is an addon an admin switches on or off. Lists, Costs, Docu
 
 #### 📱 Mobile and offline
 
-- **Apps**: TREK Travel Planner for iPhone, iPad and Android connects to any TREK server, and the browser installs TREK as a standalone app with a themed status bar too
-- **Phone layouts**: their own screens for every part of the app, with a bottom bar and dashboard widgets the user orders
-- **Offline reads**: the app shell is precached and trips, places, tours, files and nearby places live in a per-user IndexedDB store, so a trip opens with no network
-- **Offline writes**: changes queue and replay with an `X-Idempotency-Key`, and a stale edit waits for a keep-mine or keep-theirs choice
-- **Offline maps**: raster and vector tiles of a trip downloaded ahead, and a switch that takes the whole app offline on purpose
+- **Installable**: iOS and Android straight from the browser, no App Store. Runs standalone without browser chrome, with the status bar tinted per theme
+- **Phone layouts**: a separate shell below 768px with its own tokens, a bottom bar and safe-area insets. Which items sit in that bar is up to the user
+- **Offline reads**: the app shell and every route chunk are precached, and trips, places and file blobs live in a per-user IndexedDB store, so a trip opens with no network
+- **Offline writes**: mutations queue and replay with an `X-Idempotency-Key`, so a reconnect cannot double-apply. A stale edit is parked for a keep-mine or keep-theirs choice
+- **Offline maps**: pre-download a trip's raster tiles, and clear them again
+- **API responses are never cached** by the service worker. They vary per session, so they always come from the network
 
 </td>
 <td width="50%" valign="top">
 
 #### ⚙️ Admin, accounts and security
 
-- **Sign-in**: password, OIDC and passkeys each switch on and off on their own, `OIDC_ONLY` leaves SSO as the only way in, and an OIDC claim can grant admin
-- **SSO and 2FA**: one OIDC provider by discovery with PKCE (Authentik, Keycloak, Google and the like), TOTP with backup codes that an admin can require, and passkeys that count as the second factor
-- **Sessions**: every sign-in is a session you can see and end, one by one or all others at once
-- **Hardening**: rate limits on sign-in, reset and 2FA, a password policy, secrets encrypted at rest and masked on read, and an SSRF guard on every URL you configure
-- **Admin panel**: users and the permission matrix, defaults for new users, categories and templates, addons, plugins, storage, notifications, MCP tokens, backups, audit log and releases
-- **Backups and storage**: scheduled backups with retention that restore their own secrets, and local or S3-compatible storage per content category with replicas
-- **Appearance**: light, dark or follow the OS, seven colour schemes plus a custom accent, transparency, density, reduced motion and text size
-- **28 languages**: en, de, es, fr, it, nl, hu, ru, zh, zh-TW, pl, cs, ar (right to left), he (right to left), br, id, tr, ja, ko, uk, gr, sv, vi, ca, az, et, sk, th
-- **Help center**: a ? in the top bar with 381 step-by-step guides with screenshots, searched together with the wiki that ships in the image
+- **Login methods**: password login, password registration, OIDC login, OIDC registration and passkey login each switch on and off on their own. `OIDC_ONLY` leaves SSO as the only way in
+- **SSO (OIDC)**: one provider by discovery, with PKCE and `id_token` verification (Authentik, Keycloak, Google and the like)
+- **2FA**: TOTP with ten single-use backup codes, and an admin can require it instance-wide
+- **Passkeys**: WebAuthn login by fingerprint, face, PIN or security key, off until an admin enables it. A passkey also satisfies the 2FA requirement
+- **Hardening**: per-IP limits on login, password reset and 2FA attempts, a password policy, secrets encrypted at rest and masked on read, and an SSRF guard on every URL you configure
+- **Admin panel**: users and invites, the permission matrix, packing templates, categories, addons, plugins, API keys, MCP tokens and OAuth sessions, backups, storage, audit log, and GitHub releases
+- **Backups**: manual or scheduled hourly, daily, weekly or monthly, with retention in days. The zip carries the at-rest key, so a restore can decrypt its own secrets
+- **Storage**: pluggable storage backends per content category — keep everything on local disk, or add S3-compatible backends and replicate any category to them, configured entirely from the admin panel
+- **Notifications**: a per-user matrix of events against in-app, email (SMTP), webhook, ntfy and Web Push (on every device you turn it on for, even with TREK closed), plus any channel a plugin registers
+- **Appearance**: light, dark or follow the OS, seven colour schemes plus a custom accent, transparency, compact density, reduce motion, and text size per tier
+- **27 languages**: en, de, es, fr, it, nl, hu, ru, zh, zh-TW, pl, cs, ar (right to left), br, id, tr, ja, ko, uk, gr, sv, vi, ca, az, et, sk, th
+- **In-app help**: the wiki ships inside the image and is served from disk at `/help`, so the docs match the version you are running
 
 </td>
 </tr>
@@ -214,39 +184,7 @@ Most of what follows is an addon an admin switches on or off. Lists, Costs, Docu
 <div align="center">
   <a href="docs/screenshots/showcase-desktop-1.webp"><img src="docs/screenshots/showcase-desktop-1.webp" alt="Atlas · dashboard · trip planner" width="100%" /></a>
   <a href="docs/screenshots/showcase-mobile.webp"><img src="docs/screenshots/showcase-mobile.webp" alt="Mobile PWA · dashboard, day plan, map, costs" width="100%" /></a>
-</div>
-
-<br />
-
-## Powered by [dataforest cloud](https://cloud.dataforest.net/en?mtm_campaign=trek)
-
-<div align="center">
-
-<br />
-
-<a href="https://cloud.dataforest.net/en?mtm_campaign=trek">
-  <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="docs/sponsors/dataforest-light.svg" />
-    <source media="(prefers-color-scheme: light)" srcset="docs/sponsors/dataforest-dark.svg" />
-    <img src="docs/sponsors/dataforest-dark.svg" alt="dataforest cloud" height="60" />
-  </picture>
-</a>
-
-<br />
-<br />
-
-**Every TREK installation in the world searches through servers that [dataforest cloud](https://cloud.dataforest.net/en?mtm_campaign=trek) sponsors.**
-
-The place index with over 88 million places, the address search in every TREK language and the planet-wide routing all run on [dataforest cloud](https://cloud.dataforest.net/en?mtm_campaign=trek) in Frankfurt, Germany, free of charge for everyone who self-hosts TREK. Without this sponsorship, these services would not exist in this form.
-
-Thank you, [dataforest](https://cloud.dataforest.net/en?mtm_campaign=trek), for backing open source this generously. 💚
-
-<br />
-
-<a href="https://cloud.dataforest.net/en?mtm_campaign=trek"><img alt="Visit dataforest cloud" src="https://img.shields.io/badge/Visit-dataforest_cloud-02C382?style=for-the-badge" /></a>
-
-Looking for a server for your own TREK? [dataforest cloud](https://cloud.dataforest.net/en?mtm_campaign=trek) is where TREK's own services live.
-
+  <a href="docs/screenshots/showcase-desktop-2.webp"><img src="docs/screenshots/showcase-desktop-2.webp" alt="Collections · journey journal · costs" width="100%" /></a>
 </div>
 
 <br />
@@ -266,18 +204,12 @@ the details.
 ## Get started in 30 seconds
 
 ```bash
-ENCRYPTION_KEY=$(openssl rand -hex 32) docker run -d --name trek -p 3000:3000 \
+ENCRYPTION_KEY=$(openssl rand -hex 32) docker run -d -p 3000:3000 \
   -e ENCRYPTION_KEY=$ENCRYPTION_KEY \
-  -e COOKIE_SECURE=false \
   -v ./data:/app/data -v ./uploads:/app/uploads mauriceboe/trek
 ```
 
-Open `http://localhost:3000`, or `http://<server-ip>:3000` from another machine. On first boot TREK seeds an admin account — if you set `ADMIN_EMAIL`/`ADMIN_PASSWORD` those are used, otherwise the credentials are printed to the container log (`docker logs trek`).
-
-`COOKIE_SECURE=false` is only for trying TREK over plain HTTP: without it the browser drops the session cookie and the login does not stick. Once TREK sits behind HTTPS (see [Reverse Proxy](#reverse-proxy)), remove it.
-
-> [!TIP]
-> **No server yet?** TREK's own public services run on [**dataforest cloud**](https://cloud.dataforest.net/en?mtm_campaign=trek), our infrastructure sponsor. A small seed is plenty for a TREK instance and is ready within a minute.
+Open `http://localhost:3000`. On first boot TREK seeds an admin account — if you set `ADMIN_EMAIL`/`ADMIN_PASSWORD` those are used, otherwise the credentials are printed to the container log (`docker logs trek`).
 
 <div align="center">
 
@@ -335,7 +267,7 @@ See [`charts/README.md`](https://github.com/liketrek/TREK/blob/main/charts/READM
 
 <h2 id="install-as-app-pwa">Install as App (PWA)</h2>
 
-TREK works as a Progressive Web App, and the TREK Travel Planner app for iPhone, iPad and Android connects to the same server ([Native Apps](https://github.com/liketrek/TREK/wiki/Native-Apps)). To install the web app instead:
+TREK works as a Progressive Web App — no App Store needed.
 
 1. Open TREK in the browser (HTTPS required)
 2. **iOS**: Share ▸ *Add to Home Screen*
@@ -433,6 +365,16 @@ Caddy handles TLS and WebSockets automatically.
 Every variable, its default and what it does: see
 [Environment Variables](https://github.com/liketrek/TREK/wiki/Environment-Variables).
 
+## Star History
+
+<a href="https://www.star-history.com/?repos=liketrek%2FTREK&type=date&legend=bottom-right">
+ <picture>
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=liketrek/TREK&type=date&theme=dark&legend=bottom-right&sealed_token=tW9agibKugOyPk0yPURgSdnizM7K72zbJENGD9iyk24ZcwYHtCUn-hk9jh1gdacO0O7xJ3Io7LaNrwYD3mChzcpzZIqDC8_HevYG1qnT0XNTmN6Ez4UZrQ" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=liketrek/TREK&type=date&legend=bottom-right&sealed_token=tW9agibKugOyPk0yPURgSdnizM7K72zbJENGD9iyk24ZcwYHtCUn-hk9jh1gdacO0O7xJ3Io7LaNrwYD3mChzcpzZIqDC8_HevYG1qnT0XNTmN6Ez4UZrQ" />
+   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=liketrek/TREK&type=date&legend=bottom-right&sealed_token=tW9agibKugOyPk0yPURgSdnizM7K72zbJENGD9iyk24ZcwYHtCUn-hk9jh1gdacO0O7xJ3Io7LaNrwYD3mChzcpzZIqDC8_HevYG1qnT0XNTmN6Ez4UZrQ" />
+ </picture>
+</a>
+
 ## Data sources
 
 The Atlas map's country and sub-national (province/county) boundaries come from

charts/README.md

@@ -5,10 +5,9 @@ This is a minimal Helm chart for deploying the TREK app.
 ## Features
 - Deploys the TREK container
 - Exposes port 3000 via Service
-- Optional persistent storage for `/app/data` and `/app/uploads`, plus extra volumes and mounts
+- Optional persistent storage for `/app/data` and `/app/uploads`
 - Configurable environment variables and secrets
 - Optional generic Ingress support
-- Optional Gateway API HTTPRoute support
 - Configurable health checks (liveness/readiness probes) on `/api/health`
 
 ## Helm Repository
@@ -28,7 +27,7 @@ helm install trek trek/trek
 Or install directly from the local chart:
 
 ```sh
-helm install trek ./charts/trek \
+helm install trek ./chart \
   --set ingress.enabled=true \
   --set ingress.hosts[0].host=yourdomain.com
 ```
@@ -48,7 +47,7 @@ See `values.yaml` for more options.
 - `JWT_SECRET` is managed entirely by the server — auto-generated into the data PVC on first start and rotatable via the admin panel (Settings → Danger Zone). No Helm configuration needed.
 - `ENCRYPTION_KEY` encrypts stored secrets (API keys, MFA, SMTP, OIDC) at rest. Recommended: set via `secretEnv.ENCRYPTION_KEY` or `existingSecret`. If left empty, the server falls back automatically: existing installs use `data/.jwt_secret` (no action needed on upgrade); fresh installs auto-generate a key persisted to the data PVC.
 - Liveness and readiness probes are configurable under `probes`. Overrides are merged over the defaults, so `--set probes.liveness.initialDelaySeconds=60` keeps the `httpGet` handler. When switching to `exec` or `tcpSocket`, clear `httpGet` in the same override. Set `probes.liveness: null` to remove a probe.
-- If exposing TREK through an Ingress or HTTPRoute, set `env.ALLOWED_ORIGINS` and `env.APP_URL` to the public URL. The chart does not sync these automatically.
+- If using ingress, you must manually keep `env.ALLOWED_ORIGINS` and `ingress.hosts` in sync to ensure CORS works correctly. The chart does not sync these automatically.
 - Set `env.ALLOW_INTERNAL_NETWORK: "true"` if Immich or other integrated services are hosted on a private/RFC-1918 address (e.g. a pod on the same cluster or a NAS on your LAN). Loopback (`127.x`) and link-local/metadata addresses (`169.254.x`) remain blocked regardless.
 - Set `env.ALLOW_LINK_LOCAL_IPS` to a single link-local address (e.g. `"169.254.1.2"`) only when a service TREK needs sits behind one, such as a host gateway. Cloud metadata addresses (`169.254.169.x`, `169.254.170.x`) cannot be listed.
 - `FORCE_HTTPS` is optional. Set `env.FORCE_HTTPS: "true"` only when ingress (or another proxy) terminates TLS. It enables HTTPS redirects, HSTS, CSP `upgrade-insecure-requests`, and forces the session cookie `secure` flag. Requires `TRUST_PROXY` to be set.
@@ -56,5 +55,3 @@ See `values.yaml` for more options.
 - `COOKIE_SECURE` is auto-derived (on when `NODE_ENV=production` or `FORCE_HTTPS=true`). Set `env.COOKIE_SECURE: "false"` only during local testing without TLS. **Not recommended for production.**
 - Web Push needs no chart settings: TREK generates its key pair on first start and keeps it in the database on the data PVC. To bring your own pair, set `env.VAPID_PUBLIC_KEY` and `secretEnv.VAPID_PRIVATE_KEY` together (and optionally `env.VAPID_SUBJECT`); changing the pair later means every device has to turn push on again.
 - Set `env.OIDC_DISCOVERY_URL` to override the auto-constructed OIDC discovery endpoint. Required for providers (e.g. Authentik) that expose it at a non-standard path.
-- `podSecurityContext` defaults to `fsGroup: 1000` with `fsGroupChangePolicy: OnRootMismatch`, and `securityContext` (the container's) is empty. The container then starts as root, hands `/app/data` and `/app/uploads` to `node` (uid 1000) if the directory or anything directly inside it is not owned by `node` yet, and drops to `node`. Deeper files are not checked. Only the owning user is changed (plus a `root` group), so a different `fsGroup` stays in place. A volume that refuses `chown` (NFS with `root_squash`) logs a warning instead; set `runAsUser: 1000` then. To run as `node` from the start, for example under the `restricted` Pod Security Standard, set `podSecurityContext.runAsUser: 1000` and `runAsGroup: 1000`; the image then skips that step and the privilege drop. See the example in `values.yaml`.
-- Use `extraVolumes` and `extraVolumeMounts` to add your own volumes to the pod. To give the booking import more KItinerary extractors, mount a ConfigMap at `/usr/local/share/kitinerary/extractors`, with one `.json` and one `.js` key for each extractor; see the example in `values.yaml`.

charts/trek/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
 name: trek
-version: 5.1.0
+version: 4.3.3
 description: Minimal Helm chart for TREK app
-appVersion: "5.1.0"
+appVersion: "4.3.3"

charts/trek/templates/NOTES.txt

@@ -31,12 +31,3 @@
      The other values for that volume (size, storageClassName, annotations) are then ignored.
    - With `persistence.enabled=false` the volumes use an emptyDir — storage is ephemeral and is lost
      when the pod restarts. Use only for testing.
-{{- if .Values.httpRoute.enabled }}
-
-6. HTTPRoute:
-   - The chart creates an HTTPRoute v1 to the existing TREK Service. The Gateway, GatewayClass,
-     listeners, TLS certificates and allowedRoutes are managed by your cluster operator.
-   - Ingress and HTTPRoute may be enabled together.
-   - Timeout fields are Standard Channel in Gateway API v1.2, but controller support varies. Omit
-     them to use controller defaults; `0s` disables the corresponding timeout where supported.
-{{- end }}

charts/trek/templates/configmap.yaml

@@ -112,24 +112,6 @@ data:
   {{- if .Values.env.TREK_PLACES_URL }}
   TREK_PLACES_URL: {{ .Values.env.TREK_PLACES_URL | quote }}
   {{- end }}
-  {{- if .Values.env.TREK_PLACES_CONTRIBUTE }}
-  TREK_PLACES_CONTRIBUTE: {{ .Values.env.TREK_PLACES_CONTRIBUTE | quote }}
-  {{- end }}
-  {{- if .Values.env.TREK_SERVICES }}
-  TREK_SERVICES: {{ .Values.env.TREK_SERVICES | quote }}
-  {{- end }}
-  {{- if .Values.env.TREK_SERVICES_HOSTS }}
-  TREK_SERVICES_HOSTS: {{ .Values.env.TREK_SERVICES_HOSTS | quote }}
-  {{- end }}
-  {{- if .Values.env.TREK_PHOTON_URL }}
-  TREK_PHOTON_URL: {{ .Values.env.TREK_PHOTON_URL | quote }}
-  {{- end }}
-  {{- if .Values.env.TREK_VALHALLA_URL }}
-  TREK_VALHALLA_URL: {{ .Values.env.TREK_VALHALLA_URL | quote }}
-  {{- end }}
-  {{- if .Values.env.GOOGLE_LIST_DATA_BASE }}
-  GOOGLE_LIST_DATA_BASE: {{ .Values.env.GOOGLE_LIST_DATA_BASE | quote }}
-  {{- end }}
   {{- if .Values.env.AMAP_API_BASE }}
   AMAP_API_BASE: {{ .Values.env.AMAP_API_BASE | quote }}
   {{- end }}

charts/trek/templates/deployment.yaml

@@ -29,18 +29,12 @@ spec:
         - name: {{ .name }}
         {{- end }}
       {{- end }}
-      {{- with .Values.podSecurityContext }}
       securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
+        fsGroup: 1000
       containers:
         - name: trek
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
-          {{- with .Values.securityContext }}
-          securityContext:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
           {{- with .Values.resources }}
           resources:
             {{- toYaml . | nindent 12 }}
@@ -91,12 +85,6 @@ spec:
                   name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
                   key: PLACES_API_KEY
                   optional: true
-            - name: TREK_SERVICES_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
-                  key: TREK_SERVICES_KEY
-                  optional: true
             - name: AMAP_API_KEY
               valueFrom:
                 secretKeyRef:
@@ -147,9 +135,6 @@ spec:
               mountPath: /app/data
             - name: uploads
               mountPath: /app/uploads
-            {{- with .Values.extraVolumeMounts }}
-            {{- toYaml . | nindent 12 }}
-            {{- end }}
           {{- with (default dict .Values.probes).startup }}
           startupProbe:
             {{- toYaml . | nindent 12 }}
@@ -177,6 +162,3 @@ spec:
           {{- else }}
           emptyDir: {}
           {{- end }}
-        {{- with .Values.extraVolumes }}
-        {{- toYaml . | nindent 8 }}
-        {{- end }}

charts/trek/templates/httproute.yaml

@@ -1,39 +0,0 @@
-{{- if .Values.httpRoute.enabled -}}
-{{- if not .Values.httpRoute.parentRefs }}
-{{- fail "httpRoute.parentRefs must include at least one parent" }}
-{{- end }}
-{{- if not .Values.httpRoute.paths }}
-{{- fail "httpRoute.paths must include at least one path" }}
-{{- end }}
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: {{ include "trek.fullname" . }}
-  labels:
-    app: {{ include "trek.name" . }}
-  {{- with .Values.httpRoute.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  parentRefs:
-    {{- toYaml .Values.httpRoute.parentRefs | nindent 4 }}
-  {{- with .Values.httpRoute.hostnames }}
-  hostnames:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  rules:
-    {{- range $path := .Values.httpRoute.paths }}
-    - matches:
-        - path:
-            type: PathPrefix
-            value: {{ $path | quote }}
-      backendRefs:
-        - name: {{ include "trek.fullname" $ }}
-          port: {{ $.Values.service.port }}
-      {{- with $.Values.httpRoute.timeouts }}
-      timeouts:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-    {{- end }}
-{{- end }}

charts/trek/templates/secret.yaml

@@ -23,9 +23,6 @@ data:
   {{- if .Values.secretEnv.PLACES_API_KEY }}
   PLACES_API_KEY: {{ .Values.secretEnv.PLACES_API_KEY | b64enc | quote }}
   {{- end }}
-  {{- if .Values.secretEnv.TREK_SERVICES_KEY }}
-  TREK_SERVICES_KEY: {{ .Values.secretEnv.TREK_SERVICES_KEY | b64enc | quote }}
-  {{- end }}
   {{- if .Values.secretEnv.AMAP_API_KEY }}
   AMAP_API_KEY: {{ .Values.secretEnv.AMAP_API_KEY | b64enc | quote }}
   {{- end }}
@@ -80,9 +77,6 @@ stringData:
   {{- if .Values.secretEnv.PLACES_API_KEY }}
   PLACES_API_KEY: {{ .Values.secretEnv.PLACES_API_KEY | quote }}
   {{- end }}
-  {{- if .Values.secretEnv.TREK_SERVICES_KEY }}
-  TREK_SERVICES_KEY: {{ .Values.secretEnv.TREK_SERVICES_KEY | quote }}
-  {{- end }}
   {{- if .Values.secretEnv.AMAP_API_KEY }}
   AMAP_API_KEY: {{ .Values.secretEnv.AMAP_API_KEY | quote }}
   {{- end }}

charts/trek/values.yaml

@@ -10,34 +10,6 @@ image:
 # processes on one host, which network filesystems do not provide.
 updateStrategy: Recreate
 
-# Pod-level security context. fsGroup gives the node user (uid/gid 1000) group access
-# to the data and uploads volumes; OnRootMismatch lets the kubelet skip its recursive
-# permission walk once the volume root already matches, so a big PVC does not hold up
-# every start.
-#
-# By default the container starts as root, hands any files that are not node's yet to
-# node, and then drops to node itself. To start it as node straight away (needed under
-# the "restricted" Pod Security Standard), add the user here and lock the container
-# down below; the image then skips the ownership step and the privilege drop:
-#   podSecurityContext:
-#     fsGroup: 1000
-#     fsGroupChangePolicy: OnRootMismatch
-#     runAsUser: 1000
-#     runAsGroup: 1000
-#     runAsNonRoot: true
-#     seccompProfile:
-#       type: RuntimeDefault
-#   securityContext:
-#     allowPrivilegeEscalation: false
-#     capabilities:
-#       drop: [ALL]
-podSecurityContext:
-  fsGroup: 1000
-  fsGroupChangePolicy: OnRootMismatch
-
-# Security context of the trek container itself. Empty by default.
-securityContext: {}
-
 # Optional image pull secrets for private registries
 imagePullSecrets: []
   # - name: my-registry-secret
@@ -64,7 +36,7 @@ env:
   # Browser/OS language is auto-detected first; this is the fallback when no match is found.
   # Supported: ar, az, br, ca, cs, de, en, es, et, fr, gr, hu, id, it, ja, ko, nl, pl, ru, sk, sv, th, tr, uk, vi, zh, zh-TW
   # ALLOWED_ORIGINS: ""
-  # NOTE: If using ingress or HTTPRoute, ensure env.ALLOWED_ORIGINS matches the public domains for proper CORS configuration.
+  # NOTE: If using ingress, ensure env.ALLOWED_ORIGINS matches the domains in ingress.hosts for proper CORS configuration.
   # APP_URL: "https://trek.example.com"
   # Public base URL of this instance. Required when OIDC is enabled — must match the redirect URI registered with your IdP.
   # Also used as the base URL for links in email notifications and other external links.
@@ -120,8 +92,7 @@ env:
   # Custom Nominatim base URL for every geocoding call the server makes (place search, reverse lookup, Atlas region
   # fill). When set it REPLACES the public OpenStreetMap service, with no fallback, so the instance behind it needs
   # the coverage you expect and has to speak the Nominatim API. TREK keeps its ~1 request per second spacing either
-  # way, and search and reverse lookups no longer go to the TREK services' Photon. Defaults to
-  # https://nominatim.openstreetmap.org.
+  # way. Defaults to https://nominatim.openstreetmap.org.
   # OVERPASS_URL: ""
   # Custom Overpass endpoint(s) for the map POI "explore" search, comma-separated. When set, REPLACES the bundled
   # public mirrors — point it at an internal/self-hosted Overpass instance when the public mirrors are unreachable
@@ -131,34 +102,15 @@ env:
   # lower value hangs up on answers that were still coming. Raise it for a slow self-hosted Overpass instance.
   # Defaults to 25000.
   # TREK_PLACES_ENABLED: "false"
-  # Place search (suggestions, full search, category buttons, Road trip search, import geocoding, offline downloads,
-  # and the OpenStreetMap ways and horse routes Tours reads) asks the TREK Places API at https://places.liketrek.com by default, so the pod makes outbound requests to that
+  # Place search (suggestions, full search, category buttons, Road trip search, import geocoding, offline downloads)
+  # asks the TREK Places API at https://places.liketrek.com by default, so the pod makes outbound requests to that
   # host. Set "false" to search the way it did before 4.3.0 (OpenStreetMap, or your Google/Amap key) and send
   # nothing there. There is no switch in the admin panel on purpose: whether searches leave the instance is decided
   # here. Defaults to on.
   # TREK_PLACES_URL: ""
-  # GOOGLE_LIST_DATA_BASE: ""
   # Base URL of a copy of the Places API you run yourself; it has to answer the same /v1 API. Read from
   # configuration rather than typed by a user, so an in-cluster address works without ALLOW_INTERNAL_NETWORK.
   # Defaults to https://places.liketrek.com.
-  # TREK_PLACES_CONTRIBUTE: "off"
-  # Whether an admin may let this installation send the place details its users typed in (website, phone, e-mail,
-  # opening hours, description, picture) to the TREK Places API. "admin" leaves the choice to the admin panel, where
-  # it stays off until an admin agrees; "off" takes it away. Defaults to admin.
-  # TREK_SERVICES: "off"
-  # Places search identifies this installation with a key it registers by itself on first use and keeps in the
-  # database. "off" sends no key; searches then use the shared pool. A key issued to you goes under
-  # secretEnv.TREK_SERVICES_KEY. Defaults to auto.
-  # TREK_SERVICES_HOSTS: ""
-  # Comma-separated hosts that receive the installation key over https. Defaults to
-  # places.liketrek.com,photon.liketrek.com,valhalla.liketrek.com.
-  # TREK_PHOTON_URL: ""
-  # The address search (Photon) of the TREK services. With a key, search and reverse lookups ask it before
-  # Nominatim and fall back to Nominatim when it does not answer. Never asked when NOMINATIM_URL is set.
-  # Defaults to https://photon.liketrek.com.
-  # TREK_VALHALLA_URL: ""
-  # The Valhalla of the TREK services, which this server relays routing to unless the admin picks another
-  # routing service. The browser never talks to it. Defaults to https://valhalla.liketrek.com.
   # AMAP_API_BASE: ""
   # Send the Amap (高德地图) calls through an egress proxy, a cache or a gateway that speaks the same API instead of
   # restapi.amap.com directly. The key itself is a credential and goes under secretEnv.AMAP_API_KEY, or into
@@ -211,9 +163,6 @@ secretEnv:
   # with signing enabled, because such a key rejects every unsigned request. Leave empty
   # otherwise. The endpoint itself is not a secret and is set under env.AMAP_API_BASE.
   AMAP_API_SECRET: ""
-  # Optional key issued for this installation by the TREK services. Wins over the key TREK
-  # registers by itself and turns that registration off. Leave empty to let TREK register.
-  TREK_SERVICES_KEY: ""
   # Optional Web Push key pair, private half (base64url, 32 bytes). Only used together with
   # env.VAPID_PUBLIC_KEY; a pair whose halves do not belong together, or only one half, turns
   # push off with an error in the log until it is fixed, and every device stays registered.
@@ -229,7 +178,7 @@ generateEncryptionKey: false
 # If set, the chart renders no Secret of its own and instead reads every secret env
 # var from this existing Kubernetes secret. Expected keys: ENCRYPTION_KEY (rename via
 # existingSecretKey), ADMIN_EMAIL, ADMIN_PASSWORD, OIDC_CLIENT_SECRET,
-# UNSPLASH_ACCESS_KEY, PLACES_API_KEY, AMAP_API_KEY, AMAP_API_SECRET, TREK_SERVICES_KEY,
+# UNSPLASH_ACCESS_KEY, PLACES_API_KEY, AMAP_API_KEY, AMAP_API_SECRET,
 # VAPID_PRIVATE_KEY, SMTP_PASS, MAPBOX_ACCESS_TOKEN, CARTO_API_KEY, DEMO_ADMIN_PASS.
 # Missing keys are simply left unset (they are optional), so only provide the ones your
 # setup needs.
@@ -292,20 +241,6 @@ extraEnv: []
 #         name: trek-smtp
 extraEnvFrom: []
 
-# Further volumes for the pod. The chart does not create the objects they name.
-#   extraVolumes:
-#     - name: kitinerary-extractors
-#       configMap:
-#         name: trek-kitinerary-extractors
-extraVolumes: []
-# Where the trek container mounts them. For example, KItinerary
-# loads extractors for the booking import from this path:
-#   extraVolumeMounts:
-#     - name: kitinerary-extractors
-#       mountPath: /usr/local/share/kitinerary/extractors
-#       readOnly: true
-extraVolumeMounts: []
-
 resources:
   requests:
     cpu: 100m
@@ -326,20 +261,3 @@ ingress:
   #  - secretName: chart-example-tls
   #    hosts:
   #      - chart-example.local
-
-httpRoute:
-  enabled: false
-  annotations: {}
-  parentRefs: []
-  #   - name: gateway
-  #     namespace: gateway-system
-  #     sectionName: https
-  hostnames: []
-  #   - trek.example.com
-  paths:
-    - /
-  # Timeout fields are Standard Channel in Gateway API v1.2; controller support varies.
-  # Leave empty for controller defaults. Use "0s" to disable the corresponding timeout.
-  timeouts: {}
-  #   request: "0s"
-  #   backendRequest: "0s"

client/.gitignore

@@ -7,7 +7,3 @@ playwright/.cache/
 # vite-plugin-pwa dev output (devOptions.enabled)
 dev-dist/
 e2e/help/media.env
-
-# The native apps' address screen (npm run build:native), copied into
-# android/ and ios/ by `cap sync`
-native-dist/

client/android/.gitignore

@@ -1,108 +0,0 @@
-# Using Android gitignore template: https://github.com/github/gitignore/blob/HEAD/Android.gitignore
-
-# Built application files
-*.apk
-*.aar
-*.ap_
-*.aab
-
-# Files for the ART/Dalvik VM
-*.dex
-
-# Java class files
-*.class
-
-# Generated files
-bin/
-gen/
-out/
-#  Uncomment the following line in case you need and you don't have the release build type files in your app
-# release/
-
-# Gradle files
-.gradle/
-build/
-
-# Local configuration file (sdk path, etc)
-local.properties
-
-# Proguard folder generated by Eclipse
-proguard/
-
-# Log Files
-*.log
-
-# Android Studio Navigation editor temp files
-.navigation/
-
-# Android Studio captures folder
-captures/
-
-# IntelliJ
-*.iml
-.idea/workspace.xml
-.idea/tasks.xml
-.idea/gradle.xml
-.idea/assetWizardSettings.xml
-.idea/dictionaries
-.idea/libraries
-# Android Studio 3 in .gitignore file.
-.idea/caches
-.idea/modules.xml
-# Comment next line if keeping position of elements in Navigation Editor is relevant for you
-.idea/navEditor.xml
-
-# Keystore files and store credentials. The upload key and the Play service
-# account live only in the release workflow's secrets and in the owner's
-# offline backup, never in the repository.
-*.jks
-*.keystore
-keystore.properties
-*service-account*.json
-
-# External native build folder generated in Android Studio 2.2 and later
-.externalNativeBuild
-.cxx/
-
-# Google Services (e.g. APIs or Firebase)
-# Push is not wired up and the build does not apply the google-services plugin,
-# so no CI secret is needed. Kept ignored so a stray Firebase config never lands
-# in the repository.
-google-services.json
-app/google-services.json
-
-# Freeline
-freeline.py
-freeline/
-freeline_project_description.json
-
-# fastlane
-fastlane/report.xml
-fastlane/Preview.html
-fastlane/screenshots
-fastlane/test_output
-fastlane/readme.md
-
-# Version control
-vcs.xml
-
-# lint
-lint/intermediates/
-lint/generated/
-lint/outputs/
-lint/tmp/
-# lint/reports/
-
-# Android Profiling
-*.hprof
-
-# Cordova plugins for Capacitor
-capacitor-cordova-android-plugins
-
-# Copied web assets
-app/src/main/assets/public
-
-# Generated Config files
-app/src/main/assets/capacitor.config.json
-app/src/main/assets/capacitor.plugins.json
-app/src/main/res/xml/config.xml

client/android/app/.gitignore

@@ -1,2 +0,0 @@
-/build/*
-!/build/.npmkeep

client/android/app/build.gradle

@@ -1,66 +0,0 @@
-apply plugin: 'com.android.application'
-
-android {
-    namespace = "com.liketrek.trek"
-    compileSdk = rootProject.ext.compileSdkVersion
-    defaultConfig {
-        applicationId "com.liketrek.trek"
-        minSdkVersion rootProject.ext.minSdkVersion
-        targetSdkVersion rootProject.ext.targetSdkVersion
-        // The release workflow (.github/workflows/native-release.yml) passes both:
-        // the version from client/package.json and a build number that only grows.
-        // Local and PR builds fall back to these placeholders.
-        versionCode((project.findProperty('trekVersionCode') ?: '1') as Integer)
-        versionName(project.findProperty('trekVersionName') ?: '0.0.0-dev')
-        testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
-        aaptOptions {
-             // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.
-             // Default: https://android.googlesource.com/platform/frameworks/base/+/282e181b58cf72b6ca770dc7ca5f91f135444502/tools/aapt/AaptAssets.cpp#61
-            ignoreAssetsPattern = '!.svn:!.git:!.ds_store:!*.scc:.*:!CVS:!thumbs.db:!picasa.ini:!*~'
-        }
-    }
-    // The upload key only exists in the release workflow, which decodes it from a
-    // secret and passes its path and passwords as Gradle properties. Every other
-    // build (local, fork, PR) stays unsigned and needs no secret.
-    signingConfigs {
-        release {
-            if (project.hasProperty('trekKeystore')) {
-                storeFile file(project.property('trekKeystore'))
-                storePassword project.property('trekKeystorePassword')
-                keyAlias project.property('trekKeyAlias')
-                keyPassword project.property('trekKeyPassword')
-            }
-        }
-    }
-    buildTypes {
-        release {
-            if (project.hasProperty('trekKeystore')) {
-                signingConfig signingConfigs.release
-            }
-            minifyEnabled true
-            shrinkResources true
-            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
-        }
-    }
-}
-
-repositories {
-    flatDir{
-        dirs '../capacitor-cordova-android-plugins/src/main/libs', 'libs'
-    }
-}
-
-dependencies {
-    implementation fileTree(include: ['*.jar'], dir: 'libs')
-    implementation "androidx.appcompat:appcompat:$androidxAppCompatVersion"
-    implementation "androidx.coordinatorlayout:coordinatorlayout:$androidxCoordinatorLayoutVersion"
-    implementation "androidx.core:core-splashscreen:$coreSplashScreenVersion"
-    implementation "androidx.browser:browser:$androidxBrowserVersion"
-    implementation project(':capacitor-android')
-    testImplementation "junit:junit:$junitVersion"
-    androidTestImplementation "androidx.test.ext:junit:$androidxJunitVersion"
-    androidTestImplementation "androidx.test.espresso:espresso-core:$androidxEspressoCoreVersion"
-    implementation project(':capacitor-cordova-android-plugins')
-}
-
-apply from: 'capacitor.build.gradle'

client/android/app/capacitor.build.gradle

@@ -1,25 +0,0 @@
-// DO NOT EDIT THIS FILE! IT IS GENERATED EACH TIME "capacitor update" IS RUN
-
-android {
-  compileOptions {
-      sourceCompatibility JavaVersion.VERSION_21
-      targetCompatibility JavaVersion.VERSION_21
-  }
-}
-
-apply from: "../capacitor-cordova-android-plugins/cordova.variables.gradle"
-dependencies {
-    implementation project(':capacitor-app')
-    implementation project(':capacitor-filesystem')
-    implementation project(':capacitor-haptics')
-    implementation project(':capacitor-keyboard')
-    implementation project(':capacitor-share')
-    implementation project(':capacitor-splash-screen')
-    implementation project(':capacitor-status-bar')
-
-}
-
-
-if (hasProperty('postBuildExtras')) {
-  postBuildExtras()
-}

client/android/app/proguard-rules.pro

@@ -1,38 +0,0 @@
-# Add project specific ProGuard rules here.
-# You can control the set of applied configuration files using the
-# proguardFiles setting in build.gradle.
-#
-# For more details, see
-#   http://developer.android.com/guide/developing/tools/proguard.html
-
-# If your project uses WebView with JS, uncomment the following
-# and specify the fully qualified class name to the JavaScript interface
-# class:
-#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
-#   public *;
-#}
-
-# Uncomment this to preserve the line number information for
-# debugging stack traces.
-#-keepattributes SourceFile,LineNumberTable
-
-# If you keep the line number information, uncomment this to
-# hide the original source file name.
-#-renamesourcefileattribute SourceFile
-
-# TREK's own classes: TrekShellPlugin is reached from JavaScript by name and its
-# methods through reflection, so R8 must neither rename nor drop them.
--keep class com.liketrek.trek.** { *; }
-
-# Every Capacitor plugin: the bridge finds plugins by their annotation and calls
-# the annotated methods reflectively.
--keep @com.getcapacitor.annotation.CapacitorPlugin public class * {
-    @com.getcapacitor.PluginMethod public <methods>;
-}
-
-# The WebView bridge: Capacitor's message handler is called from JavaScript
-# through @JavascriptInterface, and every plugin class is instantiated by name.
--keepclassmembers class * {
-    @android.webkit.JavascriptInterface <methods>;
-}
--keep public class * extends com.getcapacitor.Plugin

client/android/app/src/main/AndroidManifest.xml

@@ -1,80 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools">
-
-    <application
-        android:allowBackup="false"
-        android:icon="@mipmap/ic_launcher"
-        android:label="@string/app_name"
-        android:networkSecurityConfig="@xml/network_security_config"
-        android:roundIcon="@mipmap/ic_launcher_round"
-        android:supportsRtl="true"
-        android:theme="@style/AppTheme">
-
-        <activity
-            android:configChanges="orientation|keyboardHidden|keyboard|screenSize|locale|smallestScreenSize|screenLayout|uiMode|navigation|density"
-            android:name=".MainActivity"
-            android:label="@string/title_activity_main"
-            android:theme="@style/AppTheme.NoActionBarLaunch"
-            android:launchMode="singleTask"
-            android:exported="true">
-
-            <intent-filter>
-                <action android:name="android.intent.action.MAIN" />
-                <category android:name="android.intent.category.LAUNCHER" />
-            </intent-filter>
-
-            <!-- Deep links.
-
-                 The scheme is @string/custom_url_scheme (com.liketrek.trek).
-                 launchMode is singleTask above, so a link delivers into the
-                 running task via onNewIntent rather than starting a second copy
-                 of the app on top of the first.
-
-                 This is the return path for SSO and passkey sign-in: TrekShell
-                 opens the server's login page in a Custom Tab, and after the
-                 hand-off it redirects to com.liketrek.trek://auth?code=…, which
-                 lands here and in TrekShellPlugin.handleOnNewIntent.
-
-                 Not an App Link (autoVerify + https). App Links are verified
-                 against a specific domain via assetlinks.json, and TREK is
-                 self-hosted — there is no single domain to verify against. A
-                 custom scheme is the only form that works for every user's
-                 server. -->
-            <intent-filter>
-                <action android:name="android.intent.action.VIEW" />
-                <category android:name="android.intent.category.DEFAULT" />
-                <category android:name="android.intent.category.BROWSABLE" />
-                <data android:scheme="@string/custom_url_scheme" />
-            </intent-filter>
-
-        </activity>
-
-        <provider
-            android:name="androidx.core.content.FileProvider"
-            android:authorities="${applicationId}.fileprovider"
-            android:exported="false"
-            android:grantUriPermissions="true">
-            <meta-data
-                android:name="android.support.FILE_PROVIDER_PATHS"
-                android:resource="@xml/file_paths"></meta-data>
-        </provider>
-
-    </application>
-
-    <!-- Permissions. Only what the WebView itself needs: the file picker's
-         camera option and navigator.geolocation for "locate me" on the map,
-         both granted at runtime through Capacitor's WebChromeClient. -->
-
-    <uses-permission android:name="android.permission.INTERNET" />
-    <!-- COARSE is listed first because it is the weaker grant and is enough
-         for "what city am I in". -->
-    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
-    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
-    <!-- required="false" on purpose: TREK is a planner, and everything except
-         "locate me" works without GPS hardware. Marking it required would have
-         Play hide the app from tablets and other GPS-less devices. -->
-    <uses-feature android:name="android.hardware.location.gps" android:required="false" />
-    <uses-permission android:name="android.permission.CAMERA" />
-    <uses-feature android:name="android.hardware.camera" android:required="false" />
-</manifest>

client/android/app/src/main/java/com/liketrek/trek/MainActivity.java

@@ -1,50 +0,0 @@
-package com.liketrek.trek;
-
-import android.content.Intent;
-import android.os.Bundle;
-import android.view.View;
-import com.getcapacitor.BridgeActivity;
-
-public class MainActivity extends BridgeActivity {
-
-    @Override
-    protected void onCreate(Bundle savedInstanceState) {
-        registerPlugin(TrekShellPlugin.class);
-        // With a server picked, the WebView loads that server instead of the
-        // bundled address screen, so the UI arrives in the version the server
-        // runs and on its own origin. BridgeActivity reads `config` while it
-        // builds the bridge inside super.onCreate().
-        boolean restarting = TrekServerStore.consumeRestart(this);
-        String server = TrekServerStore.getUrl(this);
-        boolean onServer = server != null && !TrekServerStore.consumeShellOnce(this);
-        config = TrekServerStore.configFor(this, onServer ? server : null, restarting);
-        super.onCreate(savedInstanceState);
-        if (bridge == null) return;
-        // The UI asks for no overscroll effect (overscroll-behavior: none on html)
-        // and Chrome honours that, but the WebView draws the stretch on its root
-        // scroller natively. It scales the whole view, top bar and bottom dock included.
-        bridge.getWebView().setOverScrollMode(View.OVER_SCROLL_NEVER);
-        // Set before any WebView callback can run: they are posted to this thread.
-        if (onServer) bridge.setWebViewClient(new TrekWebViewClient(bridge, this::showAddressScreen));
-    }
-
-    private boolean leavingServer;
-
-    /**
-     * The server did not load: back to the address screen, which offers retry
-     * and change. A fresh task rather than recreate(), because this usually
-     * happens during launch, while the system splash is still up, and a
-     * recreated activity leaves that splash lying over the new page.
-     */
-    private void showAddressScreen() {
-        // A failed page can report more than one error; restart only once.
-        if (leavingServer) return;
-        leavingServer = true;
-        TrekServerStore.showShellOnce(this);
-        TrekServerStore.markRestart(this);
-        runOnUiThread(() -> {
-            startActivity(new Intent(this, MainActivity.class).addFlags(Intent.FLAG_ACTIVITY_NEW_TASK | Intent.FLAG_ACTIVITY_CLEAR_TASK));
-            overridePendingTransition(0, 0);
-        });
-    }
-}

client/android/app/src/main/java/com/liketrek/trek/TrekServerStore.java

@@ -1,123 +0,0 @@
-package com.liketrek.trek;
-
-import android.content.Context;
-import android.content.SharedPreferences;
-import com.getcapacitor.CapConfig;
-import com.getcapacitor.Logger;
-import java.io.ByteArrayOutputStream;
-import java.io.File;
-import java.io.FileOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.charset.StandardCharsets;
-import org.json.JSONException;
-import org.json.JSONObject;
-
-/** The server the user picked, and the Capacitor configuration that loads it. */
-final class TrekServerStore {
-
-    private static final String PREFS = "trek_shell";
-    private static final String KEY_URL = "server_url";
-    private static final String KEY_SHELL_ONCE = "shell_once";
-    private static final String KEY_RESTART = "restart";
-    private static final String CONFIG_DIR = "trek-server-config";
-
-    private TrekServerStore() {}
-
-    static String getUrl(Context context) {
-        return prefs(context).getString(KEY_URL, null);
-    }
-
-    static void setUrl(Context context, String url) {
-        SharedPreferences.Editor editor = prefs(context).edit();
-        if (url == null) {
-            editor.remove(KEY_URL);
-        } else {
-            editor.putString(KEY_URL, url);
-        }
-        editor.commit();
-    }
-
-    /** Start the next launch on the bundled address screen, even with a server remembered. */
-    static void showShellOnce(Context context) {
-        prefs(context).edit().putBoolean(KEY_SHELL_ONCE, true).commit();
-    }
-
-    static boolean consumeShellOnce(Context context) {
-        return consume(context, KEY_SHELL_ONCE);
-    }
-
-    /** The next onCreate is the app restarting itself, not a launch. */
-    static void markRestart(Context context) {
-        prefs(context).edit().putBoolean(KEY_RESTART, true).commit();
-    }
-
-    static boolean consumeRestart(Context context) {
-        return consume(context, KEY_RESTART);
-    }
-
-    private static boolean consume(Context context, String key) {
-        boolean set = prefs(context).getBoolean(key, false);
-        if (set) prefs(context).edit().remove(key).commit();
-        return set;
-    }
-
-    /**
-     * The bundled capacitor.config.json, adjusted for this start. Capacitor only
-     * takes these settings from a config file, so this writes a copy into the
-     * app's private storage and loads that; null means the bundled one as it is.
-     *
-     * With a server: server.url set, and server.errorPath dropped, because that
-     * page would have no bridge on the server's origin (TrekWebViewClient
-     * handles a failed load instead).
-     *
-     * On a restart: no launch splash. The splash plugin shows it again after
-     * recreate() but cannot take it down when the page hides it early, which
-     * left it covering a fully rendered page. A restart has no launch to cover.
-     */
-    static CapConfig configFor(Context context, String url, boolean restarting) {
-        if (url == null && !restarting) return null;
-        try {
-            JSONObject json = new JSONObject(readAsset(context, "capacitor.config.json"));
-            if (url != null) {
-                JSONObject server = child(json, "server");
-                server.put("url", url);
-                server.remove("errorPath");
-            }
-            if (restarting) {
-                child(child(json, "plugins"), "SplashScreen").put("launchShowDuration", 0);
-            }
-
-            File dir = new File(context.getFilesDir(), CONFIG_DIR);
-            if (!dir.isDirectory() && !dir.mkdirs()) throw new IOException("Cannot create " + dir);
-            try (FileOutputStream out = new FileOutputStream(new File(dir, "capacitor.config.json"))) {
-                out.write(json.toString().getBytes(StandardCharsets.UTF_8));
-            }
-            return CapConfig.loadFromFile(context, dir.getAbsolutePath());
-        } catch (IOException | JSONException ex) {
-            Logger.error("TrekShell", "Could not adjust the app config for " + url, ex);
-            return null;
-        }
-    }
-
-    private static JSONObject child(JSONObject parent, String key) throws JSONException {
-        JSONObject existing = parent.optJSONObject(key);
-        if (existing != null) return existing;
-        JSONObject created = new JSONObject();
-        parent.put(key, created);
-        return created;
-    }
-
-    private static String readAsset(Context context, String name) throws IOException {
-        try (InputStream in = context.getAssets().open(name); ByteArrayOutputStream out = new ByteArrayOutputStream()) {
-            byte[] buffer = new byte[8192];
-            int read;
-            while ((read = in.read(buffer)) != -1) out.write(buffer, 0, read);
-            return out.toString("UTF-8");
-        }
-    }
-
-    private static SharedPreferences prefs(Context context) {
-        return context.getSharedPreferences(PREFS, Context.MODE_PRIVATE);
-    }
-}

client/android/app/src/main/java/com/liketrek/trek/TrekShellPlugin.java

@@ -1,149 +0,0 @@
-package com.liketrek.trek;
-
-import android.content.Intent;
-import android.net.Uri;
-import android.os.Handler;
-import android.os.Looper;
-import androidx.browser.customtabs.CustomTabsIntent;
-import com.getcapacitor.JSObject;
-import com.getcapacitor.Plugin;
-import com.getcapacitor.PluginCall;
-import com.getcapacitor.PluginMethod;
-import com.getcapacitor.annotation.CapacitorPlugin;
-import org.json.JSONObject;
-
-/** The native half of client/src/native/trekShell.ts. */
-@CapacitorPlugin(name = "TrekShell")
-public class TrekShellPlugin extends Plugin {
-
-    /** How long to wait after returning from the browser for the redirect to land. */
-    private static final long CANCEL_GRACE_MS = 600;
-
-    private String authCallId;
-    private String authScheme;
-    private boolean authBrowserOpen;
-    private final Handler handler = new Handler(Looper.getMainLooper());
-
-    @PluginMethod
-    public void getServer(PluginCall call) {
-        String url = TrekServerStore.getUrl(getContext());
-        JSObject result = new JSObject();
-        result.put("url", url == null ? JSONObject.NULL : url);
-        call.resolve(result);
-    }
-
-    @PluginMethod
-    public void setServer(PluginCall call) {
-        String url = call.getString("url");
-        Uri parsed = url == null ? null : Uri.parse(url);
-        if (parsed == null || parsed.getHost() == null || !("https".equals(parsed.getScheme()) || "http".equals(parsed.getScheme()))) {
-            call.reject("A http(s) URL is required");
-            return;
-        }
-        TrekServerStore.setUrl(getContext(), url);
-        call.resolve();
-        restart();
-    }
-
-    @PluginMethod
-    public void resetServer(PluginCall call) {
-        TrekServerStore.setUrl(getContext(), null);
-        call.resolve();
-        restart();
-    }
-
-    @PluginMethod
-    public void reload(PluginCall call) {
-        call.resolve();
-        restart();
-    }
-
-    /** The server URL is part of the bridge's configuration, so it takes a new activity. */
-    private void restart() {
-        TrekServerStore.markRestart(getContext());
-        getActivity().runOnUiThread(() -> getActivity().recreate());
-    }
-
-    @PluginMethod
-    public void authenticate(PluginCall call) {
-        String url = call.getString("url");
-        String scheme = call.getString("callbackScheme");
-        if (url == null || scheme == null) {
-            call.reject("url and callbackScheme are required");
-            return;
-        }
-        rejectPendingAuth("Superseded by a new sign-in");
-        call.setKeepAlive(true);
-        getBridge().saveCall(call);
-        authCallId = call.getCallbackId();
-        authScheme = scheme;
-        authBrowserOpen = true;
-        // A Custom Tab shares the browser's cookies, so a running SSO session at
-        // the identity provider carries over. The redirect back to the app's
-        // scheme arrives through the intent-filter in AndroidManifest.xml.
-        new CustomTabsIntent.Builder().build().launchUrl(getActivity(), Uri.parse(url));
-    }
-
-    @Override
-    protected void handleOnNewIntent(Intent intent) {
-        super.handleOnNewIntent(intent);
-        Uri data = intent.getData();
-        PluginCall call = pendingAuthCall();
-        if (call == null || data == null || !authScheme.equals(data.getScheme())) return;
-        JSObject result = new JSObject();
-        result.put("url", data.toString());
-        call.resolve(result);
-        finishAuth(call);
-    }
-
-    /**
-     * Back in the app without a redirect means the user closed the browser.
-     * onNewIntent runs before onResume when the redirect did arrive, so the
-     * grace period only covers devices that deliver the two out of order.
-     */
-    @Override
-    protected void handleOnResume() {
-        super.handleOnResume();
-        if (!authBrowserOpen) return;
-        authBrowserOpen = false;
-        handler.postDelayed(() -> {
-            PluginCall call = pendingAuthCall();
-            if (call == null) return;
-            call.reject("Sign-in cancelled", "CANCELLED");
-            finishAuth(call);
-        }, CANCEL_GRACE_MS);
-    }
-
-    private PluginCall pendingAuthCall() {
-        return authCallId == null ? null : getBridge().getSavedCall(authCallId);
-    }
-
-    private void rejectPendingAuth(String message) {
-        PluginCall call = pendingAuthCall();
-        if (call == null) return;
-        call.reject(message, "CANCELLED");
-        finishAuth(call);
-    }
-
-    private void finishAuth(PluginCall call) {
-        getBridge().releaseCall(call);
-        authCallId = null;
-        authScheme = null;
-        authBrowserOpen = false;
-    }
-
-    /** iOS only: Android keeps the service worker, which already starts TREK offline. */
-    @PluginMethod
-    public void refreshOfflineCopy(PluginCall call) {
-        JSObject result = new JSObject();
-        result.put("saved", false);
-        call.resolve(result);
-    }
-
-    @PluginMethod
-    public void openOfflineCopy(PluginCall call) {
-        JSObject result = new JSObject();
-        result.put("opened", false);
-        call.resolve(result);
-    }
-}

client/android/app/src/main/java/com/liketrek/trek/TrekWebViewClient.java

@@ -1,49 +0,0 @@
-package com.liketrek.trek;
-
-import android.webkit.WebResourceError;
-import android.webkit.WebResourceRequest;
-import android.webkit.WebResourceResponse;
-import android.webkit.WebView;
-import com.getcapacitor.Bridge;
-import com.getcapacitor.BridgeWebViewClient;
-
-/**
- * Used while the WebView shows the user's server. When that server cannot be
- * loaded, Capacitor would show server.errorPath, but on Android it injects
- * its bridge only into the server's origin, so that local page could neither
- * retry nor change the server and stayed blank. Instead the app restarts on
- * the bundled address screen, where the bridge is present and the screen
- * offers exactly those two things.
- */
-class TrekWebViewClient extends BridgeWebViewClient {
-
-    private final Runnable onUnreachable;
-
-    TrekWebViewClient(Bridge bridge, Runnable onUnreachable) {
-        super(bridge);
-        this.onUnreachable = onUnreachable;
-    }
-
-    @Override
-    public void onReceivedError(WebView view, WebResourceRequest request, WebResourceError error) {
-        if (request.isForMainFrame()) {
-            onUnreachable.run();
-            return;
-        }
-        super.onReceivedError(view, request, error);
-    }
-
-    /**
-     * Only a 5xx on the page itself means the server is down (a proxy's 502 or
-     * 503 while TREK restarts). A 4xx page is left alone: the server answered,
-     * and TREK serves its UI for every other path.
-     */
-    @Override
-    public void onReceivedHttpError(WebView view, WebResourceRequest request, WebResourceResponse errorResponse) {
-        if (!request.isForMainFrame()) {
-            super.onReceivedHttpError(view, request, errorResponse);
-        } else if (errorResponse.getStatusCode() >= 500) {
-            onUnreachable.run();
-        }
-    }
-}

client/android/app/src/main/res/layout/activity_main.xml

@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<androidx.coordinatorlayout.widget.CoordinatorLayout xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:app="http://schemas.android.com/apk/res-auto"
-    xmlns:tools="http://schemas.android.com/tools"
-    android:layout_width="match_parent"
-    android:layout_height="match_parent"
-    tools:context=".MainActivity">
-
-    <WebView
-        android:layout_width="match_parent"
-        android:layout_height="match_parent" />
-</androidx.coordinatorlayout.widget.CoordinatorLayout>

client/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml

@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background>
-        <inset android:drawable="@mipmap/ic_launcher_background" android:inset="16.7%" />
-    </background>
-    <foreground>
-        <inset android:drawable="@mipmap/ic_launcher_foreground" android:inset="16.7%" />
-    </foreground>
-    <monochrome>
-        <inset android:drawable="@mipmap/ic_launcher_foreground" android:inset="16.7%" />
-    </monochrome>
-</adaptive-icon>

client/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml

@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background>
-        <inset android:drawable="@mipmap/ic_launcher_background" android:inset="16.7%" />
-    </background>
-    <foreground>
-        <inset android:drawable="@mipmap/ic_launcher_foreground" android:inset="16.7%" />
-    </foreground>
-    <monochrome>
-        <inset android:drawable="@mipmap/ic_launcher_foreground" android:inset="16.7%" />
-    </monochrome>
-</adaptive-icon>

client/android/app/src/main/res/values/ic_launcher_background.xml

@@ -1,5 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<resources>
-    <color name="ic_launcher_background">#09090B</color>
-    <color name="launch_background">#09090B</color>
-</resources>

client/android/app/src/main/res/values/strings.xml

@@ -1,7 +0,0 @@
-<?xml version='1.0' encoding='utf-8'?>
-<resources>
-    <string name="app_name">TREK</string>
-    <string name="title_activity_main">TREK</string>
-    <string name="package_name">com.liketrek.trek</string>
-    <string name="custom_url_scheme">com.liketrek.trek</string>
-</resources>

client/android/app/src/main/res/values/styles.xml

@@ -1,25 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<resources>
-
-    <!-- Base application theme. -->
-    <style name="AppTheme" parent="Theme.AppCompat.Light.DarkActionBar">
-        <!-- Customize your theme here. -->
-        <item name="colorPrimary">@color/colorPrimary</item>
-        <item name="colorPrimaryDark">@color/colorPrimaryDark</item>
-        <item name="colorAccent">@color/colorAccent</item>
-    </style>
-
-    <style name="AppTheme.NoActionBar" parent="Theme.AppCompat.DayNight.NoActionBar">
-        <item name="windowActionBar">false</item>
-        <item name="windowNoTitle">true</item>
-        <item name="android:background">@null</item>
-    </style>
-
-
-    <style name="AppTheme.NoActionBarLaunch" parent="Theme.SplashScreen">
-        <item name="android:background">@drawable/splash</item>
-        <!-- Android 12+ draws its own launch screen: the app icon on this colour.
-             The same near-black as the icon tile and the first painted frame. -->
-        <item name="windowSplashScreenBackground">@color/launch_background</item>
-    </style>
-</resources>

client/android/app/src/main/res/xml/file_paths.xml

@@ -1,4 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<paths xmlns:android="http://schemas.android.com/apk/res/android">
-    <cache-path name="my_cache_images" path="." />
-</paths>

client/android/app/src/main/res/xml/network_security_config.xml

@@ -1,30 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
-  TREK is self-hosted: the user points the app at their own server, so we cannot
-  know its scheme or its certificate authority ahead of time. Two deliberate
-  relaxations, both required for that to work at all:
-
-  1. cleartextTrafficPermitted="true" — Android blocks http:// by default from
-     targetSdk 28 on. A bare LAN server (http://192.168.1.10:3001) and a
-     Tailscale host (100.64.0.0/10, which is NOT RFC1918, so a private-range
-     allowlist would not cover it) both need this. https:// is unaffected and
-     remains the recommended setup.
-
-  2. <certificates src="user" /> — since Android 7 apps ignore user-installed
-     CAs unless they opt in. Self-hosters running their own CA (step-ca, mkcert,
-     an internal PKI) install its root on the device; without this the app would
-     reject their perfectly valid https:// server. System CAs stay first so
-     public certs keep validating normally.
-
-  The tradeoff is that a user-installed CA can also be a MITM proxy's. That is
-  the same tradeoff the browser-based PWA already makes, and it is the price of
-  letting people run their own infrastructure.
--->
-<network-security-config>
-    <base-config cleartextTrafficPermitted="true">
-        <trust-anchors>
-            <certificates src="system" />
-            <certificates src="user" />
-        </trust-anchors>
-    </base-config>
-</network-security-config>

client/android/build.gradle

@@ -1,28 +0,0 @@
-// Top-level build file where you can add configuration options common to all sub-projects/modules.
-
-buildscript {
-    
-    repositories {
-        google()
-        mavenCentral()
-    }
-    dependencies {
-        classpath 'com.android.tools.build:gradle:8.13.0'
-
-        // NOTE: Do not place your application dependencies here; they belong
-        // in the individual module build.gradle files
-    }
-}
-
-apply from: "variables.gradle"
-
-allprojects {
-    repositories {
-        google()
-        mavenCentral()
-    }
-}
-
-task clean(type: Delete) {
-    delete rootProject.buildDir
-}

client/android/capacitor.settings.gradle

@@ -1,24 +0,0 @@
-// DO NOT EDIT THIS FILE! IT IS GENERATED EACH TIME "capacitor update" IS RUN
-include ':capacitor-android'
-project(':capacitor-android').projectDir = new File('../../node_modules/@capacitor/android/capacitor')
-
-include ':capacitor-app'
-project(':capacitor-app').projectDir = new File('../../node_modules/@capacitor/app/android')
-
-include ':capacitor-filesystem'
-project(':capacitor-filesystem').projectDir = new File('../../node_modules/@capacitor/filesystem/android')
-
-include ':capacitor-haptics'
-project(':capacitor-haptics').projectDir = new File('../../node_modules/@capacitor/haptics/android')
-
-include ':capacitor-keyboard'
-project(':capacitor-keyboard').projectDir = new File('../../node_modules/@capacitor/keyboard/android')
-
-include ':capacitor-share'
-project(':capacitor-share').projectDir = new File('../../node_modules/@capacitor/share/android')
-
-include ':capacitor-splash-screen'
-project(':capacitor-splash-screen').projectDir = new File('../../node_modules/@capacitor/splash-screen/android')
-
-include ':capacitor-status-bar'
-project(':capacitor-status-bar').projectDir = new File('../../node_modules/@capacitor/status-bar/android')

client/android/gradle.properties

@@ -1,22 +0,0 @@
-# Project-wide Gradle settings.
-
-# IDE (e.g. Android Studio) users:
-# Gradle settings configured through the IDE *will override*
-# any settings specified in this file.
-
-# For more details on how to configure your build environment visit
-# http://www.gradle.org/docs/current/userguide/build_environment.html
-
-# Specifies the JVM arguments used for the daemon process.
-# The setting is particularly useful for tweaking memory settings.
-org.gradle.jvmargs=-Xmx1536m
-
-# When configured, Gradle will run in incubating parallel mode.
-# This option should only be used with decoupled projects. More details, visit
-# http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects
-# org.gradle.parallel=true
-
-# AndroidX package structure to make it clearer which packages are bundled with the
-# Android operating system, and which are packaged with your app's APK
-# https://developer.android.com/topic/libraries/support-library/androidx-rn
-android.useAndroidX=true