ci(plugin-sdk): publish on Node 22; skip the dev-db bind test without node:sqlite

fix(plugin-sdk): dev db binds an args array like the real host, and a failed onLoad stops the routes
fix(plugins): tolerate a UTF-8 BOM in trek-plugin.json
2026-11-10 14:20:56 +00:00 · 2026-07-04 21:34:25 +02:00 · 2026-07-04 20:21:06 +02:00 · 2026-07-04 20:21:06 +02:00 · 2026-07-04 20:21:06 +02:00 · 2026-07-04 19:11:23 +02:00
13726 changed files with 135964 additions and 2051124 deletions
@@ -1,7 +1,6 @@
 node_modules
 client/node_modules
 server/node_modules
-shared/node_modules
 client/dist
 shared/dist
 data
@@ -16,8 +15,6 @@ uploads
 chart/
 docs/
 docker-compose.yml
-docker-compose.minio-test.yml
-minio-licence.key
 unraid-template.xml
 *.sqlite
 *.sqlite-shm
@@ -35,5 +32,6 @@ server/tests/
 server/vitest.config.ts
 **/*.test.ts
 **/*.spec.ts
+wiki/
 scripts/
 charts/
@@ -1,6 +0,0 @@
-# Commits that only reformat code. git blame skips them with
-#   git config blame.ignoreRevsFile .git-blame-ignore-revs
-# (GitHub reads this file on its own).
-
-# style: format server and shared with prettier
-724c88c201b2c16d31317eaea5f59f43d314b833
@@ -15,7 +15,6 @@
 *.sh   text eol=lf
 # Binary files — no line ending conversion
 *.png  binary
-*.webp binary
 *.jpg  binary
 *.jpeg binary
 *.gif  binary
@@ -26,8 +25,3 @@
 *.eot  binary
 *.pdf  binary
 *.zip  binary
-# Ski area graphs (SGR1) as the Places host writes them, byte for byte
-*.sgr  binary
-*.gz   binary
-# A GPX fixture whose byte-order mark and CRLF line endings are what it tests
-server/tests/fixtures/gpx/bom-crlf.gpx -text
@@ -8,11 +8,11 @@ body:
    attributes:
      label: Pre-flight checklist
      options:
-        - label: I have searched [existing issues](https://github.com/liketrek/TREK/issues) and this bug has not been reported yet
+        - label: I have searched [existing issues](https://github.com/mauriceboe/TREK/issues) and this bug has not been reported yet
          required: true
        - label: I am running the latest available version of TREK
          required: true
-        - label: I have read the [Troubleshooting guide](https://github.com/liketrek/TREK/wiki/Troubleshooting) and my issue is not covered there
+        - label: I have read the [Troubleshooting guide](https://github.com/mauriceboe/TREK/wiki/Troubleshooting) and my issue is not covered there
          required: true

  - type: input
@@ -1,11 +1,11 @@
 blank_issues_enabled: false
 contact_links:
  - name: Documentation
-    url: https://github.com/liketrek/TREK/wiki
+    url: https://github.com/mauriceboe/TREK/wiki
    about: Check the docs before opening an issue
  - name: Feature Request
-    url: https://github.com/liketrek/TREK/discussions/new?category=feature-requests
+    url: https://github.com/mauriceboe/TREK/discussions/new?category=feature-requests
    about: Suggest a new feature or improvement in Discussions
  - name: Questions & Help
-    url: https://github.com/liketrek/TREK/discussions
+    url: https://github.com/mauriceboe/TREK/discussions
    about: For questions and general help, use Discussions instead
@@ -13,8 +13,8 @@
 - [ ] Documentation update

 ## Checklist
- [ ] I have read the [Contributing Guidelines](https://github.com/liketrek/TREK/wiki/Contributing)
- [ ] My branch is [up to date with `dev`](https://github.com/liketrek/TREK/wiki/Development-environment#3-keep-your-fork-up-to-date)
+- [ ] I have read the [Contributing Guidelines](https://github.com/mauriceboe/TREK/wiki/Contributing)
+- [ ] My branch is [up to date with `dev`](https://github.com/mauriceboe/TREK/wiki/Development-environment#3-keep-your-fork-up-to-date)
 - [ ] This PR targets the `dev` branch, not `main` *(wiki-only PRs are exempt)*
 - [ ] I have tested my changes locally
 - [ ] I have added/updated tests that prove my fix is effective or that my feature works
@@ -1,71 +0,0 @@
-# Version updates, weekly, into dev. Minor and patch bumps of one ecosystem
-# arrive as a single grouped PR; a major bump gets a PR of its own so its
-# breaking notes are read on their own.
-#
-# Security updates are a repository setting, not part of this file, and
-# GitHub opens them against the default branch whatever target-branch says.
-# enforce-target-branch.yml moves those onto dev.
-#
-# Every PR runs test.yml like any other, so ci-ok decides whether it can
-# merge. Dependabot runs get no Actions secrets, so s3-contract and the Sonar
-# scan skip themselves on these PRs and ci-ok counts the skip as passed.
-version: 2
-updates:
-  # The root lockfile covers the client, server and shared workspaces.
-  - package-ecosystem: npm
-    directory: /
-    target-branch: dev
-    schedule:
-      interval: weekly
-      day: monday
-    open-pull-requests-limit: 5
-    commit-message:
-      prefix: chore(deps)
-      prefix-development: chore(deps-dev)
-    groups:
-      npm-minor-and-patch:
-        update-types: [minor, patch]
-
-  # plugin-sdk is standalone with a lockfile of its own and ships to npm.
-  - package-ecosystem: npm
-    directory: /plugin-sdk
-    target-branch: dev
-    schedule:
-      interval: weekly
-      day: monday
-    open-pull-requests-limit: 3
-    commit-message:
-      prefix: chore(plugin-sdk)
-      prefix-development: chore(plugin-sdk)
-    groups:
-      plugin-sdk-minor-and-patch:
-        update-types: [minor, patch]
-
-  # Keeps the SHA pins of third-party actions current, comment included.
-  - package-ecosystem: github-actions
-    directory: /
-    target-branch: dev
-    schedule:
-      interval: weekly
-      day: monday
-    open-pull-requests-limit: 3
-    commit-message:
-      prefix: ci
-    groups:
-      actions-minor-and-patch:
-        update-types: [minor, patch]
-
-  # The Dockerfile's base images. The Node major follows .nvmrc and the
-  # engines ranges, so it moves by hand, together with them.
-  - package-ecosystem: docker
-    directory: /
-    target-branch: dev
-    schedule:
-      interval: weekly
-      day: monday
-    open-pull-requests-limit: 3
-    commit-message:
-      prefix: chore(docker)
-    ignore:
-      - dependency-name: node
-        update-types: [version-update:semver-major]
@@ -9,12 +9,10 @@ permissions:

 jobs:
  close-stale:
-    if: github.repository == 'liketrek/TREK'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 45
+    runs-on: ubuntu-latest
    steps:
      - name: Close stale invalid-title issues
-        uses: actions/github-script@v9
+        uses: actions/github-script@v7
        with:
          script: |
            const badTitles = [
@@ -10,12 +10,10 @@ permissions:

 jobs:
  close-stale:
-    if: github.repository == 'liketrek/TREK'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 45
+    runs-on: ubuntu-latest
    steps:
      - name: Close stale wrong-base-branch PRs
-        uses: actions/github-script@v9
+        uses: actions/github-script@v7
        with:
          script: |
            const { data: pulls } = await github.rest.pulls.list({
@@ -9,12 +9,10 @@ permissions:

 jobs:
  check-title:
-    if: github.repository == 'liketrek/TREK'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 45
+    runs-on: ubuntu-latest
    steps:
      - name: Flag or redirect issue
-        uses: actions/github-script@v9
+        uses: actions/github-script@v7
        with:
          script: |
            const title = context.payload.issue.title.trim();
@@ -78,7 +76,7 @@ jobs:
                body: [
                  '## Wrong place for feature requests',
                  '',
-                  'Feature requests should be submitted in [Discussions](https://github.com/liketrek/TREK/discussions/new?category=feature-requests), not as issues.',
+                  'Feature requests should be submitted in [Discussions](https://github.com/mauriceboe/TREK/discussions/new?category=feature-requests), not as issues.',
                  '',
                  'This issue has been closed. Feel free to re-submit your idea in the right place!',
                ].join('\n'),
@@ -1,18 +1,5 @@
 name: Build & Push Docker Image (Prerelease)

-# The canary. Dispatched by hand, usually on dev, it builds the dispatched
-# commit as <next minor or major>-pre.N, publishes :VERSION, :MAJOR-pre and
-# :latest-pre, and tags the commit. Nothing moves :latest. Like the stable
-# release it refuses a commit whose ci-ok is not green. docker.yml with
-# bump=auto later finalizes the line once main carries it.
-#
-# A prerelease asks the TREK services issuer for a registration dialect of its
-# own -pre.N version (registration-dialect.yml, as the stable release does)
-# and builds it into the image; nothing of it is committed, dev keeps the
-# module of the last stable release, which it gets when main is merged back
-# into dev. Without one the image carries dev's module, with a warning when
-# that is the original one or old.
-
 on:
  workflow_dispatch:
    inputs:
@@ -24,7 +11,6 @@ on:

 permissions:
  contents: write
-  checks: read

 concurrency:
  group: prerelease-build
@@ -32,42 +18,23 @@ concurrency:

 jobs:
  version-bump:
-    if: github.repository == 'liketrek/TREK'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 120
+    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.bump.outputs.VERSION }}
      sha: ${{ steps.bump.outputs.SHA }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

-      # The dev push, the main push and any manual run each leave a ci-ok on
-      # this commit. scripts/ci/ci-ok-verdict.mjs counts the newest attempt of
-      # each, refuses while one is still going, and requires the one that
-      # finished last to be green, so a later green run supersedes a flaky or
-      # cancelled one. It prints the link of every run it counted.
-      - name: Require a green ci-ok on the commit being built
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          sha="$(git rev-parse HEAD)"
-          runs="$RUNNER_TEMP/ci-ok-runs.json"
-          gh api "repos/$GITHUB_REPOSITORY/commits/$sha/check-runs?check_name=ci-ok&filter=all&per_page=100" > "$runs"
-          node scripts/ci/ci-ok-verdict.mjs "$runs" "$sha"
-
      - name: Determine prerelease version
        id: bump
-        env:
-          BUMP_INPUT: ${{ inputs.bump || 'auto' }}
        run: |
          git fetch --tags

          # Capture the exact commit we're building so build/merge jobs are pinned to it
-          echo "SHA=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+          echo "SHA=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT

          # Get latest stable tag (exclude prerelease tags)
          STABLE_TAG=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' | grep -v '\-pre\.' | sort -V | tail -1)
@@ -75,12 +42,14 @@ jobs:
          STABLE="${STABLE:-0.0.0}"
          echo "Latest stable: $STABLE"

-          IFS='.' read -r MAJOR MINOR _ <<< "$STABLE"
+          IFS='.' read -r MAJOR MINOR PATCH <<< "$STABLE"

          # Detect any in-flight major prerelease (v(MAJOR+1).0.0-pre.*). Stay on that line if found.
          NEXT_MAJOR="$((MAJOR + 1)).0.0"
          MAJOR_PRE_EXISTS=$(git tag -l "v${NEXT_MAJOR}-pre.*" | head -1)

+          BUMP_INPUT="${{ github.event.inputs.bump || 'auto' }}"
+
          if [ "$BUMP_INPUT" = "major" ] || { [ "$BUMP_INPUT" = "auto" ] && [ -n "$MAJOR_PRE_EXISTS" ]; }; then
            TARGET="$NEXT_MAJOR"
          else
@@ -93,102 +62,38 @@ jobs:
          N=$(( ${LAST_N:-0} + 1 ))

          NEW_VERSION="${TARGET}-pre.${N}"
-          echo "VERSION=$NEW_VERSION" >> "$GITHUB_OUTPUT"
-          echo "$STABLE to $NEW_VERSION"
-
-  # The registration dialect of this prerelease, fetched and checked in a job
-  # without write access. It never fails the build.
-  dialect:
-    needs: version-bump
-    uses: ./.github/workflows/registration-dialect.yml
-    with:
-      version: ${{ needs.version-bump.outputs.version }}
-      ref: ${{ needs.version-bump.outputs.sha }}
-    secrets:
-      TREK_DIALECT_TOKEN: ${{ secrets.TREK_DIALECT_TOKEN }}
+          echo "VERSION=$NEW_VERSION" >> $GITHUB_OUTPUT
+          echo "$STABLE → $NEW_VERSION"

  build:
    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 120
-    needs: [version-bump, dialect]
-    # Whatever became of the dialect job: without its artifact the image carries dev's module.
-    if: ${{ !cancelled() && needs.version-bump.result == 'success' }}
+    needs: version-bump
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
-            runner: ubuntu-24.04
+            runner: ubuntu-latest
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
    steps:
      - name: Prepare platform tag-safe name
-        env:
-          PLATFORM: ${{ matrix.platform }}
-        run: echo "PLATFORM_PAIR=${PLATFORM//\//-}" >> "$GITHUB_ENV"
+        run: echo "PLATFORM_PAIR=$(echo ${{ matrix.platform }} | sed 's|/|-|g')" >> $GITHUB_ENV

-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.version-bump.outputs.sha }}

-      - name: Take over the prerelease's dialect
-        id: take
-        uses: actions/download-artifact@v7
-        continue-on-error: true
-        with:
-          name: registration-dialect
-          path: ${{ runner.temp }}/dialect
+      - uses: docker/setup-buildx-action@v3

-      # Into the build context only; the commit stays as it is. Without a
-      # dialect of its own the image speaks dev's module, which the issuer
-      # takes for new installations for 180 days after it was made (longer
-      # while it is the newest stable release's). That is warned about, never
-      # stopped on, and a date that cannot be read only warns as well.
-      - name: Place the dialect
-        env:
-          VERSION: ${{ needs.version-bump.outputs.version }}
-          TAKEN: ${{ steps.take.outcome }}
-          REPORT: ${{ matrix.platform == 'linux/amd64' }}
-        run: |
-          set -u
-          target=server/src/nest/service-identity/registration-dialect.ts
-          fetched="$RUNNER_TEMP/dialect/registration-dialect.ts"
-          if [ "$TAKEN" = success ] && [ -f "$fetched" ]; then
-            cp "$fetched" "$target"
-            echo "$VERSION registers in dialect $(sed -n "s/^const DIALECT = '\(.*\)';$/\1/p" "$target") of its own."
-            exit 0
-          fi
-          [ "$REPORT" = true ] || exit 0
-          id="$(sed -n "s/^const DIALECT = '\(.*\)';$/\1/p" "$target")"
-          created="$(sed -n "s/^  createdAt: '\(.*\)',$/\1/p" "$target")"
-          if [ "$id" = 0 ]; then
-            message="$VERSION got no dialect of its own and registers in the original one, which the issuer accepts only for a transition period."
-          elif made="$(date -u -d "$created" +%s 2>/dev/null)"; then
-            age=$(( ($(date -u +%s) - made) / 86400 ))
-            message="$VERSION got no dialect of its own and registers in dev's dialect $id from $created, $age days old."
-            [ "$age" -gt 150 ] || { echo "$message"; exit 0; }
-          else
-            message="$VERSION got no dialect of its own, and the date of dev's dialect cannot be read from $target."
-          fi
-          echo "::warning::$message"
-          printf '### Registration dialect\n%s\n' "$message" >> "$GITHUB_STEP_SUMMARY"
-
-      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
-
-      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+      - uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

-      - name: Image metadata
-        id: meta
-        run: |
-          echo "revision=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
-
      - name: Build and push by digest
        id: build
-        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: ${{ matrix.platform }}
@@ -196,9 +101,6 @@ jobs:
          no-cache: true
          build-args: |
            APP_VERSION=${{ needs.version-bump.outputs.version }}
-          labels: |
-            org.opencontainers.image.revision=${{ steps.meta.outputs.revision }}
-            org.opencontainers.image.created=${{ steps.meta.outputs.created }}

      - name: Export digest
        run: |
@@ -207,7 +109,7 @@ jobs:
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
        with:
          name: digests-${{ env.PLATFORM_PAIR }}
          path: /tmp/digests/*
@@ -215,28 +117,25 @@ jobs:
          retention-days: 1

  merge:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 120
+    runs-on: ubuntu-latest
    needs: [version-bump, build]
-    if: ${{ !cancelled() && needs.build.result == 'success' }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.version-bump.outputs.sha }}
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Download build digests
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: digests-*
-          # Deliberately NOT merged: the per-platform folder names are what lets
-          # the manifest below be assembled in a fixed order.
+          merge-multiple: true

-      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/setup-buildx-action@v3

-      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+      - uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -244,30 +143,10 @@ jobs:
      - name: Create and push multi-arch manifest
        working-directory: /tmp/digests
        run: |
-          set -euo pipefail
          VERSION="${{ needs.version-bump.outputs.version }}"
+          mapfile -t digests < <(printf 'mauriceboe/trek@sha256:%s\n' *)
          MAJOR_TAG="$(echo "$VERSION" | cut -d. -f1)-pre"
-          # amd64 first, always. This used to be a glob over hash-named files, so
-          # the order changed from one release to the next: 3.4.1 listed amd64
-          # first and 4.0.0 listed arm64 first. Clients that read the first entry
-          # of the index rather than matching their own platform then compare the
-          # wrong digest and report "no update" — which is what Unraid users hit
-          # on :latest after 4.0.0 shipped. The image was fine; the order was not.
-          digests=()
-          for platform in linux-amd64 linux-arm64; do
-            dir="digests-$platform"
-            [ -d "$dir" ] || { echo "::error::missing digest artifact for $platform"; exit 1; }
-            for f in "$dir"/*; do
-              [ -e "$f" ] || { echo "::error::no digest file in $dir"; exit 1; }
-              digests+=("mauriceboe/trek@sha256:$(basename "$f")")
-            done
-          done
-          # The labels live on each platform image; the index gets the ones a
-          # client reads before it picks a platform (#1498).
          docker buildx imagetools create \
-            --annotation "index:org.opencontainers.image.source=https://github.com/liketrek/TREK" \
-            --annotation "index:org.opencontainers.image.version=$VERSION" \
-            --annotation "index:org.opencontainers.image.licenses=AGPL-3.0-only" \
            -t "mauriceboe/trek:latest-pre" \
            -t "mauriceboe/trek:$MAJOR_TAG" \
            -t "mauriceboe/trek:$VERSION" \
@@ -290,7 +169,7 @@ jobs:
        run: |
          KEEP=20
          VERSION="${{ needs.version-bump.outputs.version }}"
-          BASE_VERSION="${VERSION%%-pre.*}"
+          BASE_VERSION="$(echo "$VERSION" | sed 's/-pre\..*//')"
          git fetch --tags
          # Sort by numeric prerelease N (field after -pre.) to get correct ascending order
          mapfile -t ALL_TAGS < <(git tag -l "v${BASE_VERSION}-pre.*" | awk -F'-pre\\.' '{print $2" "$0}' | sort -n | awk '{print $2}')
@@ -1,36 +1,20 @@
 name: Build & Push Docker Image

-# The stable release. Dispatched by hand on main, it:
-#   1. refuses to run unless ci-ok passed on the main commit it releases,
-#   2. works out the version from the tags and the bump input,
-#   3. asks the TREK services issuer for the registration dialect of that
-#      version and checks it, in a job without write access
-#      (registration-dialect.yml); without one the release ships the dialect
-#      already on main, but only while that one still has 90 days to run,
-#   4. commits the bump to package.json, the lockfile, Chart.yaml and the
-#      dialect, tags it and pushes,
-#   5. builds both platforms from exactly that bump commit (never from
-#      whatever main points to by then) and publishes :VERSION,
-#      :MAJOR.MINOR, :MAJOR and :latest,
-#   6. publishes the Helm chart from the same commit.
-#
-# Big or risky changes go out as a prerelease first (docker-dev.yml, tagged
-# :latest-pre and :<next>-pre.N); bump=auto here then finalizes that line.
-# Without a prerelease in flight there is no default: the run stops until
-# someone picks patch, minor or major.
-#
-# Each stable release registers new installations in a dialect of its own,
-# which the issuer accepts for 180 days, and for as long as it is the newest
-# release's; renewing a key needs none. dev gets the module when main is merged
-# back into dev after the release; a prerelease asks the issuer for one of its
-# own (docker-dev.yml). The issuer's side, and what to set up before the first
-# release with a dialect, is in the operations guide of the TREK services.
-
 on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - 'docs/**'
+      - '**/*.md'
+      - 'wiki/**'
+      - '.github/workflows/**'
+      - '.github/ISSUE_TEMPLATE/**'
+      - '.github/FUNDING.yml'
+      - '.github/PULL_REQUEST_TEMPLATE.md'
  workflow_dispatch:
    inputs:
      bump:
-        description: 'auto finalizes the prerelease in flight; otherwise pick patch, minor or major'
+        description: 'Force bump line (auto = patch/finalize as today)'
        type: choice
        options: [auto, patch, minor, major]
        default: auto
@@ -38,118 +22,43 @@ on:
        description: "Type MAJOR (all caps) to confirm a major release"
        type: string
        default: ''
-      ci_from:
-        description: 'Take ci-ok from this earlier commit instead of the one on main, when main differs from it only under .github/ (a fix to a release workflow needs no second test run)'
-        type: string
-        default: ''
-      allow_stale_dialect:
-        description: 'Ship without a dialect of its own even if the one on main is the original one or has under 90 days left'
-        type: boolean
-        default: false

 permissions:
  contents: write
-  checks: read

 concurrency:
  group: stable-build
  cancel-in-progress: false

 jobs:
-  version:
-    if: github.repository == 'liketrek/TREK'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    permissions:
-      contents: read
-      checks: read
+  version-bump:
+    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.bump.outputs.VERSION }}
-      base: ${{ steps.base.outputs.SHA }}
    steps:
-      - name: Release from main only
-        if: github.ref != 'refs/heads/main'
-        run: |
-          echo "::error::Dispatch this workflow on main, not on $GITHUB_REF."
-          exit 1
-
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          fetch-tags: true
-          persist-credentials: false
+          token: ${{ secrets.GITHUB_TOKEN }}

-      # The bump job checks out exactly this commit, so what ci-ok was checked
-      # on is what gets released, however long the dialect takes.
-      - name: Note the commit being released
-        id: base
-        run: echo "SHA=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-
-      # The dev push, the main push and any manual run each leave a ci-ok on
-      # this commit. scripts/ci/ci-ok-verdict.mjs counts the newest attempt of
-      # each, refuses while one is still going, and requires the one that
-      # finished last to be green, so a later green run supersedes a flaky or
-      # cancelled one. It prints the link of every run it counted.
-      - name: Require a green ci-ok on the commit being released
-        if: inputs.ci_from == ''
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          sha="$(git rev-parse HEAD)"
-          runs="$RUNNER_TEMP/ci-ok-runs.json"
-          gh api "repos/$GITHUB_REPOSITORY/commits/$sha/check-runs?check_name=ci-ok&filter=all&per_page=100" > "$runs"
-          node scripts/ci/ci-ok-verdict.mjs "$runs" "$sha"
-
-      # ci_from: main carries only workflow changes on top of a commit that
-      # already passed. That commit must be an ancestor of main, everything
-      # outside .github/ must be identical, and one of its ci-ok runs must be
-      # green (its dev push, typically).
-      - name: Require a green ci-ok on the commit main's code comes from
-        if: inputs.ci_from != ''
-        env:
-          GH_TOKEN: ${{ github.token }}
-          CI_FROM: ${{ inputs.ci_from }}
-        run: |
-          set -euo pipefail
-          from="$(git rev-parse --verify "$CI_FROM^{commit}")"
-          if ! git merge-base --is-ancestor "$from" HEAD; then
-            echo "::error::$from is not an ancestor of main."
-            exit 1
-          fi
-          outside="$(git diff --name-only "$from" HEAD -- . ':(exclude).github/**')"
-          if [ -n "$outside" ]; then
-            echo "::error::main differs from $from outside .github/:"
-            echo "$outside"
-            exit 1
-          fi
-          green="$(gh api "repos/$GITHUB_REPOSITORY/commits/$from/check-runs?check_name=ci-ok&filter=all&per_page=100" \
-            --jq '[.check_runs[] | select(.status == "completed" and .conclusion == "success")] | length')"
-          if [ "$green" -lt 1 ]; then
-            echo "::error::$from has no green ci-ok."
-            exit 1
-          fi
-          echo "main differs from $from only under .github/, and $from has $green green ci-ok run(s)."
-
-      - name: Determine bump type and version
+      - name: Determine bump type and update version
        id: bump
-        env:
-          BUMP_INPUT: ${{ inputs.bump || 'auto' }}
-          CONFIRM_MAJOR: ${{ inputs.confirm_major }}
        run: |
-          set -eu
+          git fetch --tags

-          # Derive version from git tags, no package.json dependency
+          # Derive version from git tags — no package.json dependency
          STABLE_TAG=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' | grep -v '\-pre\.' | sort -V | tail -1)
          STABLE="${STABLE_TAG#v}"
          STABLE="${STABLE:-0.0.0}"

          PRE_TAG=$(git tag -l 'v*-pre.*' | sort -V | tail -1)

+          BUMP_INPUT="${{ github.event.inputs.bump || 'auto' }}"
          IFS='.' read -r MAJOR MINOR PATCH <<< "$STABLE"

          if [ "$BUMP_INPUT" = "major" ]; then
-            if [ "$CONFIRM_MAJOR" != "MAJOR" ]; then
+            if [ "${{ github.event.inputs.confirm_major }}" != "MAJOR" ]; then
              echo "::error::confirm_major must equal 'MAJOR' to cut a major release"
              exit 1
            fi
@@ -162,210 +71,86 @@ jobs:
            NEW_VERSION="${MAJOR}.${MINOR}.$((PATCH + 1))"
            BUMP="patch"
          else
-            # auto finalizes the in-flight prerelease and nothing else. It used
-            # to fall back to a patch, which would have shipped any change,
-            # however big, as a patch nobody chose.
-            PRE_BASE=""
+            # auto: finalize in-flight prerelease if one exists, else patch
            if [ -n "$PRE_TAG" ]; then
              PRE_BASE="${PRE_TAG#v}"
              PRE_BASE="${PRE_BASE%-pre.*}"
+              PRE_MAJOR="$(echo "$PRE_BASE" | cut -d. -f1)"
+              # Refuse to auto-finalize a major bump — it bypasses confirm_major
+              if [ "$PRE_MAJOR" -gt "$MAJOR" ]; then
+                echo "::error::In-flight prerelease $PRE_TAG is a major bump ($STABLE → $PRE_BASE). Use bump=major with confirm_major=MAJOR to finalize."
+                exit 1
+              fi
+              # If prerelease base is strictly greater than stable, finalize it
+              HIGHEST=$(printf '%s\n' "$PRE_BASE" "$STABLE" | sort -V | tail -1)
+              if [ "$HIGHEST" = "$PRE_BASE" ] && [ "$PRE_BASE" != "$STABLE" ]; then
+                NEW_VERSION="$PRE_BASE"
+                BUMP="finalize"
+              else
+                PATCH=$((PATCH + 1))
+                NEW_VERSION="${MAJOR}.${MINOR}.${PATCH}"
+                BUMP="patch"
+              fi
+            else
+              PATCH=$((PATCH + 1))
+              NEW_VERSION="${MAJOR}.${MINOR}.${PATCH}"
+              BUMP="patch"
            fi
-            HIGHEST=$(printf '%s\n' "$PRE_BASE" "$STABLE" | sort -V | tail -1)
-            if [ -z "$PRE_BASE" ] || [ "$HIGHEST" != "$PRE_BASE" ] || [ "$PRE_BASE" = "$STABLE" ]; then
-              echo "::error::No prerelease above $STABLE is in flight, so bump=auto has nothing to finalize. Dispatch again with bump=patch, minor or major."
-              exit 1
-            fi
-            PRE_MAJOR="$(echo "$PRE_BASE" | cut -d. -f1)"
-            # Refuse to auto-finalize a major bump, it would bypass confirm_major
-            if [ "$PRE_MAJOR" -gt "$MAJOR" ]; then
-              echo "::error::In-flight prerelease $PRE_TAG is a major bump ($STABLE to $PRE_BASE). Use bump=major with confirm_major=MAJOR to finalize."
-              exit 1
-            fi
-            NEW_VERSION="$PRE_BASE"
-            BUMP="finalize"
-          fi
-
-          # Patch releases have carried migrations before, so this only warns:
-          # whoever pinned :MAJOR.MINOR gets this schema change too.
-          if [ "$BUMP" = "patch" ] && [ -n "$STABLE_TAG" ] \
-            && [ -n "$(git diff --name-only --diff-filter=A "$STABLE_TAG" HEAD -- server/src/db/migrations/)" ]; then
-            echo "::warning::$NEW_VERSION is a patch release that adds database migrations."
          fi

          echo "Bump type: $BUMP"
-          echo "VERSION=$NEW_VERSION" >> "$GITHUB_OUTPUT"
-          echo "$STABLE to $NEW_VERSION ($BUMP)"
-
-  # The registration dialect of this version, fetched and checked in a job
-  # without write access. It never fails; without an artifact from it the
-  # bump decides below whether the dialect on main may ship.
-  dialect:
-    needs: version
-    uses: ./.github/workflows/registration-dialect.yml
-    with:
-      version: ${{ needs.version.outputs.version }}
-      ref: ${{ needs.version.outputs.base }}
-    secrets:
-      TREK_DIALECT_TOKEN: ${{ secrets.TREK_DIALECT_TOKEN }}
-
-  # Runs whatever became of the dialect job, a timeout or a lost runner
-  # included: no artifact means the dialect on main, if it may still ship.
-  version-bump:
-    needs: [version, dialect]
-    if: ${{ !cancelled() && needs.version.result == 'success' }}
-    runs-on: ubuntu-24.04
-    timeout-minutes: 120
-    outputs:
-      sha: ${{ steps.commit.outputs.SHA }}
-    steps:
-      - uses: actions/create-github-app-token@v3
-        id: app-token
-        with:
-          app-id: ${{ secrets.RELEASE_APP_ID }}
-          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
-
-      - uses: actions/checkout@v6
-        with:
-          ref: ${{ needs.version.outputs.base }}
-          fetch-depth: 0
-          fetch-tags: true
-          token: ${{ steps.app-token.outputs.token }}
-
-      - name: Take over the checked dialect
-        id: take
-        uses: actions/download-artifact@v7
-        continue-on-error: true
-        with:
-          name: registration-dialect
-          path: ${{ runner.temp }}/dialect
-
-      # Without a dialect of its own the release ships the one on main, but
-      # only while the issuer takes new registrations in it for 90 more days:
-      # dialect 0 closes on the issuer's transition date, and a dialect with
-      # little left would shut out new installations of this release soon after
-      # it is out. Then this stops before anything is committed, unless
-      # allow_stale_dialect says to ship anyway. The issuer keeps the newest
-      # release's dialect open past its date, so the date here is the least it
-      # has, not the most.
-      - name: Place the dialect
-        env:
-          VERSION: ${{ needs.version.outputs.version }}
-          TAKEN: ${{ steps.take.outcome }}
-          ALLOW_STALE: ${{ inputs.allow_stale_dialect }}
-        run: |
-          set -u
-          target=server/src/nest/service-identity/registration-dialect.ts
-          fetched="$RUNNER_TEMP/dialect/registration-dialect.ts"
-          dialect_id() { sed -n "s/^const DIALECT = '\(.*\)';$/\1/p" "$1"; }
-          report() {
-            echo "$2$1"
-            printf '### Registration dialect\n%s\n' "$1" >> "$GITHUB_STEP_SUMMARY"
-          }
-          if [ "$TAKEN" = success ] && [ -f "$fetched" ]; then
-            cp "$fetched" "$target"
-            report "$VERSION registers in dialect $(dialect_id "$target"), written by the issuer for it." ""
-            exit 0
-          fi
-          id="$(dialect_id "$target")"
-          created="$(sed -n "s/^  createdAt: '\(.*\)',$/\1/p" "$target")"
-          left=""
-          if [ -n "$id" ] && [ "$id" != 0 ] && made="$(date -u -d "$created" +%s 2>/dev/null)"; then
-            left=$(( (made + 180 * 86400 - $(date -u +%s)) / 86400 ))
-          fi
-          if [ -n "$left" ] && [ "$left" -ge 90 ]; then
-            report "$VERSION ships without a dialect of its own and registers in dialect $id from $created, which the issuer takes for new installations for $left more days at least. Its operator can write one by hand for the next patch." "::warning::"
-            exit 0
-          fi
-          if [ "$id" = 0 ]; then
-            what="the original registration, which the issuer accepts only until the end of its transition period"
-          elif [ -n "$left" ]; then
-            what="dialect $id from $created, which has $left days left"
-          else
-            what="a dialect whose id or date cannot be read from $target"
-          fi
-          if [ "$ALLOW_STALE" = true ]; then
-            report "$VERSION ships without a dialect of its own and registers in $what, as allow_stale_dialect asked." "::warning::"
-            exit 0
-          fi
-          report "$VERSION got no dialect of its own and would register in $what. Nothing was committed or pushed. Make sure the issuer runs with its dialect seed and release token and that TREK_DIALECT_TOKEN is set, then run the release again, or tick allow_stale_dialect to ship anyway." "::error::"
-          exit 1
-
-      - name: Update the version, commit, tag and push
-        id: commit
-        env:
-          NEW_VERSION: ${{ needs.version.outputs.version }}
-        run: |
-          set -eu
+          echo "VERSION=$NEW_VERSION" >> $GITHUB_OUTPUT
+          echo "$STABLE → $NEW_VERSION ($BUMP)"

          # Update all workspace + root package.json files and the root lockfile in one shot
          npm version "$NEW_VERSION" --workspaces --include-workspace-root --no-git-tag-version
          sed -i "s/^version: .*/version: $NEW_VERSION/" charts/trek/Chart.yaml
          sed -i "s/^appVersion: .*/appVersion: \"$NEW_VERSION\"/" charts/trek/Chart.yaml

-          # Commit and tag. The push fast-forwards main from the commit ci-ok
-          # was checked on, so it fails rather than release past anything that
-          # landed on main in the meantime.
+          # Commit and tag
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add package.json package-lock.json server/package.json client/package.json shared/package.json \
-            charts/trek/Chart.yaml server/src/nest/service-identity/registration-dialect.ts
+          git add package.json package-lock.json server/package.json client/package.json shared/package.json charts/trek/Chart.yaml
          git commit -m "chore: bump version to $NEW_VERSION [skip ci]"
-          git tag -a "v$NEW_VERSION" -m "v$NEW_VERSION"
-          git push origin HEAD:main --follow-tags
-
-          # build, merge and release-helm check out exactly this commit.
-          echo "SHA=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+          git tag "v$NEW_VERSION"
+          git push origin main --follow-tags

  build:
    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 120
-    needs: [version, version-bump]
-    # version-bump may run after a failed dialect job; that alone must not skip what follows it.
-    if: ${{ !cancelled() && needs.version-bump.result == 'success' }}
+    needs: version-bump
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
-            runner: ubuntu-24.04
+            runner: ubuntu-latest
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
    steps:
      - name: Prepare platform tag-safe name
-        env:
-          PLATFORM: ${{ matrix.platform }}
-        run: echo "PLATFORM_PAIR=${PLATFORM//\//-}" >> "$GITHUB_ENV"
+        run: echo "PLATFORM_PAIR=$(echo ${{ matrix.platform }} | sed 's|/|-|g')" >> $GITHUB_ENV

-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
        with:
-          ref: ${{ needs.version-bump.outputs.sha }}
+          ref: main

-      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/setup-buildx-action@v3

-      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+      - uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

-      - name: Image metadata
-        id: meta
-        run: |
-          echo "revision=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
-
      - name: Build and push by digest
        id: build
-        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: ${{ matrix.platform }}
          outputs: type=image,name=mauriceboe/trek,push-by-digest=true,name-canonical=true,push=true
          no-cache: true
          build-args: |
-            APP_VERSION=${{ needs.version.outputs.version }}
-          labels: |
-            org.opencontainers.image.revision=${{ steps.meta.outputs.revision }}
-            org.opencontainers.image.created=${{ steps.meta.outputs.created }}
+            APP_VERSION=${{ needs.version-bump.outputs.version }}

      - name: Export digest
        run: |
@@ -374,7 +159,7 @@ jobs:
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
        with:
          name: digests-${{ env.PLATFORM_PAIR }}
          path: /tmp/digests/*
@@ -382,26 +167,23 @@ jobs:
          retention-days: 1

  merge:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 120
-    needs: [version, version-bump, build]
-    if: ${{ !cancelled() && needs.build.result == 'success' }}
+    runs-on: ubuntu-latest
+    needs: [version-bump, build]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
        with:
-          ref: ${{ needs.version-bump.outputs.sha }}
+          ref: main

      - name: Download build digests
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: digests-*
-          # Deliberately NOT merged: the per-platform folder names are what lets
-          # the manifest below be assembled in a fixed order.
+          merge-multiple: true

-      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/setup-buildx-action@v3

-      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+      - uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -409,37 +191,12 @@ jobs:
      - name: Create and push multi-arch manifest
        working-directory: /tmp/digests
        run: |
-          set -euo pipefail
-          VERSION="${{ needs.version.outputs.version }}"
+          VERSION="${{ needs.version-bump.outputs.version }}"
+          mapfile -t digests < <(printf 'mauriceboe/trek@sha256:%s\n' *)
          MAJOR_TAG="$(echo "$VERSION" | cut -d. -f1)"
-          # :MAJOR.MINOR takes the patches of one minor line and nothing else,
-          # the conservative pin for an install that wants to wait out a
-          # release that migrates.
-          MINOR_TAG="$(echo "$VERSION" | cut -d. -f1-2)"
-          # amd64 first, always. This used to be a glob over hash-named files, so
-          # the order changed from one release to the next: 3.4.1 listed amd64
-          # first and 4.0.0 listed arm64 first. Clients that read the first entry
-          # of the index rather than matching their own platform then compare the
-          # wrong digest and report "no update" — which is what Unraid users hit
-          # on :latest after 4.0.0 shipped. The image was fine; the order was not.
-          digests=()
-          for platform in linux-amd64 linux-arm64; do
-            dir="digests-$platform"
-            [ -d "$dir" ] || { echo "::error::missing digest artifact for $platform"; exit 1; }
-            for f in "$dir"/*; do
-              [ -e "$f" ] || { echo "::error::no digest file in $dir"; exit 1; }
-              digests+=("mauriceboe/trek@sha256:$(basename "$f")")
-            done
-          done
-          # The labels live on each platform image; the index gets the ones a
-          # client reads before it picks a platform (#1498).
          docker buildx imagetools create \
-            --annotation "index:org.opencontainers.image.source=https://github.com/liketrek/TREK" \
-            --annotation "index:org.opencontainers.image.version=$VERSION" \
-            --annotation "index:org.opencontainers.image.licenses=AGPL-3.0-only" \
            -t "mauriceboe/trek:latest" \
            -t "mauriceboe/trek:$MAJOR_TAG" \
-            -t "mauriceboe/trek:$MINOR_TAG" \
            -t "mauriceboe/trek:$VERSION" \
            "${digests[@]}"

@@ -447,19 +204,16 @@ jobs:
        run: docker buildx imagetools inspect mauriceboe/trek:latest

  release-helm:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 120
+    runs-on: ubuntu-latest
    needs: version-bump
-    if: ${{ !cancelled() && needs.version-bump.result == 'success' }}
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
        with:
-          ref: ${{ needs.version-bump.outputs.sha }}
+          ref: main

      - name: Publish Helm chart
-        uses: stefanprodan/helm-gh-pages@0ad2bb377311d61ac04ad9eb6f252fb68e207260 # v1.7.0
+        uses: stefanprodan/helm-gh-pages@v1.7.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          charts_dir: charts
-          charts_url: https://chart.liketrek.com
@@ -6,9 +6,7 @@ on:

 jobs:
  check-target:
-    if: github.repository == 'liketrek/TREK'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 45
+    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      issues: write
@@ -16,7 +14,7 @@ jobs:

    steps:
      - name: Flag or clear wrong base branch
-        uses: actions/github-script@v9
+        uses: actions/github-script@v7
        with:
          script: |
            const base = context.payload.pull_request.base.ref;
@@ -69,38 +67,6 @@ jobs:
              return;
            }

-            // Dependabot's security updates cannot be pointed at dev. `target-branch`
-            // in .github/dependabot.yml applies to version updates only; security
-            // updates always open against the default branch. Labelling them meant
-            // close-stale-wrong-branch shut them 24 hours later, which is how 13 of
-            // them died. Retarget instead: a bot cannot click "Edit" the way the
-            // comment below asks a human to.
-            if (context.payload.pull_request.user.login === 'dependabot[bot]') {
-              try {
-                await github.rest.pulls.update({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  pull_number: prNumber,
-                  base: 'dev',
-                });
-                if (labels.includes('wrong-base-branch')) {
-                  await github.rest.issues.removeLabel({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    issue_number: prNumber,
-                    name: 'wrong-base-branch',
-                  });
-                }
-                console.log('Retargeted the Dependabot PR onto dev.');
-                return;
-              } catch (err) {
-                // Retargeting can fail when the branch was cut from main and dev has
-                // moved on. Fall through to the normal path so a human sees it rather
-                // than the check passing on a PR that is still aimed at main.
-                console.log(`Could not retarget the Dependabot PR: ${err.message}`);
-              }
-            }
-
            // Base is main — check if this user is a maintainer
            let permission = 'none';
            try {
@@ -2,41 +2,31 @@ name: Lint & Prettier
 on:
  pull_request:
    branches: [main, dev]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
  lint:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 45
+    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
        with:
-          node-version-file: .nvmrc
+          node-version: '24'

      - name: Install dependencies
        run: npm install

      - name: Run lint & format check
-        # Both are check-only: lint used to run eslint --fix, which rewrote the
-        # files before format:check looked at them, so neither could fail on
-        # formatting. lint:format holds every file outside
-        # scripts/format-baseline.json to Prettier; the list only shrinks.
        id: checks
        continue-on-error: true
        run: |
          cd shared
          npm run lint
-          npm run lint:format
+          npm run format:check

      - name: Comment on PR if checks failed
        if: steps.checks.outcome == 'failure'
-        uses: actions/github-script@v9
+        uses: actions/github-script@v7
        with:
          script: |
            await github.rest.issues.createComment({
@@ -50,9 +40,8 @@ jobs:
                '',
                '```bash',
                'cd shared',
-                'npm run lint:fix',
-                'npx prettier --write <file>   # each file lint:format names',
-                'npm run lint:format -- --update   # when a listed file is formatted now',
+                'npm run lint',
+                'npm run format',
                '```',
                '',
                'Then commit and push the changes.',
@@ -1,191 +0,0 @@
-name: Native apps release
-
-# Builds the signed store builds of the iOS and Android apps and uploads them:
-# the Android App Bundle to a Google Play testing track, the iOS archive to
-# App Store Connect (TestFlight). Promotion to production stays a manual step
-# in both consoles.
-#
-# Runs only in liketrek/TREK, only by hand or on a version tag, and only after a
-# required reviewer approves the `store` environment, which holds every secret
-# (see wiki/Native-Apps.md for the list). Pull requests never reach it.
-#
-# Both stores get the same numbers: the version from client/package.json
-# without a prerelease suffix, and a build number that only grows. A prerelease
-# reuses its X.Y.Z with a higher build number and belongs on the internal track
-# and in TestFlight only.
-
-on:
-  workflow_dispatch:
-    inputs:
-      track:
-        description: Google Play track
-        type: choice
-        options: [internal, alpha, beta]
-        default: internal
-  push:
-    tags: ['v*']
-
-permissions:
-  contents: read
-
-concurrency:
-  group: native-release
-  cancel-in-progress: false
-
-jobs:
-  android:
-    if: github.repository == 'liketrek/TREK'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 40
-    environment: store
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-
-      - uses: actions/setup-java@v5
-        with:
-          distribution: temurin
-          java-version: 21
-          cache: gradle
-
-      - name: Version and build number
-        id: version
-        run: |
-          echo "version=$(node -p "require('./client/package.json').version.split('-')[0]")" >> "$GITHUB_OUTPUT"
-          echo "build=$((GITHUB_RUN_NUMBER + 1000))" >> "$GITHUB_OUTPUT"
-
-      - name: Install
-        run: npm ci --workspace=shared --workspace=client
-
-      - name: Build shared
-        run: npm run build --workspace=shared
-
-      - name: Build the address screen and sync it into the shell
-        working-directory: client
-        run: npm run cap:sync -- android
-
-      - name: Upload key
-        env:
-          KEYSTORE_B64: ${{ secrets.ANDROID_UPLOAD_KEYSTORE_B64 }}
-        run: printf '%s' "$KEYSTORE_B64" | base64 -d > "$RUNNER_TEMP/upload.jks"
-
-      - name: Build the signed App Bundle
-        working-directory: client/android
-        env:
-          ORG_GRADLE_PROJECT_trekKeystorePassword: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
-          ORG_GRADLE_PROJECT_trekKeyAlias: ${{ secrets.ANDROID_KEY_ALIAS }}
-          ORG_GRADLE_PROJECT_trekKeyPassword: ${{ secrets.ANDROID_KEY_PASSWORD }}
-        run: >-
-          ./gradlew bundleRelease --no-daemon
-          -PtrekVersionName=${{ steps.version.outputs.version }}
-          -PtrekVersionCode=${{ steps.version.outputs.build }}
-          -PtrekKeystore="$RUNNER_TEMP/upload.jks"
-
-      - uses: actions/upload-artifact@v6
-        with:
-          name: trek-android-${{ steps.version.outputs.version }}-${{ steps.version.outputs.build }}
-          path: client/android/app/build/outputs/bundle/release/app-release.aab
-          retention-days: 30
-
-      # Play only accepts API uploads once one bundle was uploaded by hand
-      # (wiki/Native-Apps.md). `draft` until the app has left draft in the console.
-      - name: Upload to Google Play
-        uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
-        with:
-          serviceAccountJsonPlainText: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
-          packageName: com.liketrek.trek
-          releaseFiles: client/android/app/build/outputs/bundle/release/app-release.aab
-          track: ${{ inputs.track || 'internal' }}
-          status: draft
-
-      - name: Remove the upload key
-        if: always()
-        run: rm -f "$RUNNER_TEMP/upload.jks"
-
-  ios:
-    if: github.repository == 'liketrek/TREK'
-    runs-on: macos-15
-    timeout-minutes: 60
-    environment: store
-    steps:
-      - uses: actions/checkout@v6
-
-      # App Store uploads must be built with Xcode 26; the image's default is older.
-      - name: Select Xcode 26
-        run: |
-          XCODE=$(ls -d /Applications/Xcode_26*.app | sort -V | tail -1)
-          test -n "$XCODE"
-          sudo xcode-select -s "$XCODE"
-          xcodebuild -version
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-
-      - name: Version and build number
-        id: version
-        run: |
-          echo "version=$(node -p "require('./client/package.json').version.split('-')[0]")" >> "$GITHUB_OUTPUT"
-          echo "build=$((GITHUB_RUN_NUMBER + 1000))" >> "$GITHUB_OUTPUT"
-
-      - name: Install
-        run: npm ci --workspace=shared --workspace=client
-
-      - name: Build shared
-        run: npm run build --workspace=shared
-
-      - name: Build the address screen and sync it into the shell
-        working-directory: client
-        run: npm run cap:sync -- ios
-
-      - name: App Store Connect API key
-        env:
-          ASC_KEY_P8_B64: ${{ secrets.ASC_KEY_P8_B64 }}
-        run: printf '%s' "$ASC_KEY_P8_B64" | base64 -d > "$RUNNER_TEMP/AuthKey.p8"
-
-      - name: Archive
-        working-directory: client/ios/App
-        env:
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
-          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
-        run: >-
-          xcodebuild archive
-          -project App.xcodeproj
-          -scheme App
-          -configuration Release
-          -destination 'generic/platform=iOS'
-          -archivePath "$RUNNER_TEMP/TREK.xcarchive"
-          MARKETING_VERSION=${{ steps.version.outputs.version }}
-          CURRENT_PROJECT_VERSION=${{ steps.version.outputs.build }}
-          DEVELOPMENT_TEAM="$APPLE_TEAM_ID"
-          -allowProvisioningUpdates
-          -authenticationKeyPath "$RUNNER_TEMP/AuthKey.p8"
-          -authenticationKeyID "$ASC_KEY_ID"
-          -authenticationKeyIssuerID "$ASC_ISSUER_ID"
-
-      # ExportOptions.plist says destination=upload, so this step sends the build
-      # to App Store Connect, where it shows up in TestFlight after processing.
-      - name: Export and upload to App Store Connect
-        working-directory: client/ios/App
-        env:
-          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
-          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
-        run: >-
-          xcodebuild -exportArchive
-          -archivePath "$RUNNER_TEMP/TREK.xcarchive"
-          -exportOptionsPlist ../ExportOptions.plist
-          -exportPath "$RUNNER_TEMP/export"
-          -allowProvisioningUpdates
-          -authenticationKeyPath "$RUNNER_TEMP/AuthKey.p8"
-          -authenticationKeyID "$ASC_KEY_ID"
-          -authenticationKeyIssuerID "$ASC_ISSUER_ID"
-
-      - name: Remove the API key
-        if: always()
-        run: rm -f "$RUNNER_TEMP/AuthKey.p8"
@@ -1,132 +0,0 @@
-name: Native apps
-
-permissions:
-  contents: read
-
-# Builds the iOS and Android shells whenever they, their address screen or the
-# Capacitor plugins change. Nobody on the team has to own a Mac for the Swift
-# side to be compiled on every change, and every run leaves a debug APK to
-# install on a phone.
-#
-# Unsigned on purpose: signing and store uploads need secrets that fork PRs do
-# not get, and belong in a release workflow of their own.
-on:
-  pull_request:
-    paths:
-      - 'client/android/**'
-      - 'client/ios/**'
-      - 'client/native-shell/**'
-      - 'client/src/native/trekShell.ts'
-      - 'client/src/native/serverAddress.ts'
-      - 'client/capacitor.config.ts'
-      - 'client/vite.native.config.js'
-      - 'client/scripts/check-store-metadata.mjs'
-      - 'client/fastlane/**'
-      - 'client/package.json'
-      - 'package-lock.json'
-      - 'shared/src/i18n/*/native.ts'
-      - '.github/workflows/native.yml'
-  workflow_dispatch:
-
-concurrency:
-  group: native-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  # The store texts fit their limits and every listing image has its size and
-  # no alpha channel (client/fastlane/README.md). Plain Node, no install.
-  metadata:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-
-      - name: Check the store listings
-        run: node client/scripts/check-store-metadata.mjs
-
-  android:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-
-      - uses: actions/setup-java@v5
-        with:
-          distribution: temurin
-          java-version: 21
-          cache: gradle
-
-      - name: Install
-        run: npm ci --workspace=shared --workspace=client
-
-      - name: Build shared
-        run: npm run build --workspace=shared
-
-      - name: Build the address screen and sync it into the shells
-        working-directory: client
-        run: npm run cap:sync -- android
-
-      # The release build runs R8 with the keep rules in proguard-rules.pro, so a
-      # rule that goes missing fails here rather than in the store build. It is
-      # unsigned: the upload key only exists in native-release.yml.
-      - name: Assemble debug and release APKs
-        working-directory: client/android
-        run: ./gradlew assembleDebug assembleRelease lintDebug --no-daemon
-
-      - uses: actions/upload-artifact@v6
-        with:
-          name: trek-android-debug
-          path: client/android/app/build/outputs/apk/debug/app-debug.apk
-          retention-days: 14
-
-  ios:
-    runs-on: macos-15
-    timeout-minutes: 40
-    steps:
-      - uses: actions/checkout@v6
-
-      # App Store uploads must be built with Xcode 26; the image's default is older.
-      - name: Select Xcode 26
-        run: |
-          XCODE=$(ls -d /Applications/Xcode_26*.app | sort -V | tail -1)
-          test -n "$XCODE"
-          sudo xcode-select -s "$XCODE"
-          xcodebuild -version
-
-      - name: Check the property lists
-        run: plutil -lint client/ios/App/App/Info.plist client/ios/ExportOptions.plist
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-
-      - name: Install
-        run: npm ci --workspace=shared --workspace=client
-
-      - name: Build shared
-        run: npm run build --workspace=shared
-
-      - name: Build the address screen and sync it into the shells
-        working-directory: client
-        run: npm run cap:sync -- ios
-
-      - name: Build for the simulator
-        working-directory: client/ios/App
-        run: |
-          xcodebuild build \
-            -project App.xcodeproj \
-            -scheme App \
-            -configuration Debug \
-            -sdk iphonesimulator \
-            -destination 'generic/platform=iOS Simulator' \
-            CODE_SIGNING_ALLOWED=NO
@@ -14,19 +14,17 @@ permissions:

 jobs:
  publish:
-    if: github.repository == 'liketrek/TREK'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 45
+    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: plugin-sdk
    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
        with:
-          # The Node the TREK image runs the plugins on. It has the node:sqlite
-          # the dev-server tests exercise.
-          node-version-file: .nvmrc
+          # 22 matches the TREK server runtime and has node:sqlite, which the
+          # dev-server tests exercise.
+          node-version: 22
          registry-url: 'https://registry.npmjs.org'
      - run: npm ci
      - run: npm publish
@@ -1,144 +0,0 @@
-name: Registration dialect
-
-# Asks the TREK services issuer for the registration dialect of one version and
-# checks it, for docker.yml (a stable release commits it with the version bump)
-# and docker-dev.yml (a prerelease only builds it into its image).
-#
-# The issuer's answer runs here, in a job that holds no write token and keeps
-# no git credentials; the token for the issuer is in the environment of the
-# one step that fetches. The answer is held to what a dialect is
-# (scripts/ci/check-registration-dialect.mjs), then type-checked and linted
-# the way TREK's CI would see it once it is on main and dev. Only a module that
-# passes all of it goes on, as the artifact `registration-dialect`; without
-# one the caller decides what ships. This workflow never fails its caller.
-
-on:
-  workflow_call:
-    inputs:
-      version:
-        description: 'The version the dialect is for, X.Y.Z or X.Y.Z-pre.N'
-        type: string
-        required: true
-      ref:
-        description: 'The commit whose checker, types and lint config the dialect is checked with'
-        type: string
-        required: true
-    secrets:
-      TREK_DIALECT_TOKEN:
-        required: false
-
-permissions:
-  contents: read
-
-jobs:
-  dialect:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 20
-    # A failed or timed-out run leaves no artifact, which the caller already
-    # handles; it must not fail the release around it.
-    continue-on-error: true
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          ref: ${{ inputs.ref }}
-          persist-credentials: false
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-          cache-dependency-path: package-lock.json
-
-      # The only step that sees the token. The URL is fixed; the answer is
-      # bounded in time and size and goes to a file nothing runs yet.
-      - name: Fetch the dialect from the issuer
-        id: fetch
-        timeout-minutes: 3
-        env:
-          TREK_DIALECT_TOKEN: ${{ secrets.TREK_DIALECT_TOKEN }}
-          VERSION: ${{ inputs.version }}
-        run: |
-          set -uo pipefail
-          out="$RUNNER_TEMP/registration-dialect.ts"
-          if [ -z "${TREK_DIALECT_TOKEN:-}" ]; then
-            echo "::warning::TREK_DIALECT_TOKEN is not set; the issuer was not asked for a dialect for $VERSION."
-            exit 0
-          fi
-          status=$(curl --silent --show-error --proto '=https' --tlsv1.2 --max-time 30 --retry 2 --retry-delay 5 \
-            --max-filesize 262144 -H "Authorization: Bearer $TREK_DIALECT_TOKEN" -H 'Content-Type: application/json' \
-            --data "{\"version\":\"$VERSION\"}" -o "$out" -w '%{http_code}' https://places.liketrek.com/v1/dialects) \
-            || status=000
-          if [ "$status" != 200 ] && [ "$status" != 201 ]; then
-            echo "::warning::The issuer handed out no registration dialect for $VERSION (HTTP $status)."
-            rm -f "$out"
-            exit 0
-          fi
-          if [ "$(wc -c < "$out")" -gt 262144 ]; then
-            echo "::warning::The issuer's registration dialect for $VERSION is larger than a dialect."
-            rm -f "$out"
-            exit 0
-          fi
-          echo "file=$out" >> "$GITHUB_OUTPUT"
-
-      # A module that computes for long is refused by the clock as well.
-      - name: Check the dialect
-        id: check
-        if: steps.fetch.outputs.file != ''
-        timeout-minutes: 2
-        env:
-          FILE: ${{ steps.fetch.outputs.file }}
-          VERSION: ${{ inputs.version }}
-        run: |
-          set -uo pipefail
-          if ! node scripts/ci/check-registration-dialect.mjs "$FILE" "$VERSION"; then
-            echo "::warning::The issuer's registration dialect for $VERSION failed its check."
-            exit 0
-          fi
-          echo "What changes against the dialect in the tree:"
-          git diff --no-index -- server/src/nest/service-identity/registration-dialect.ts "$FILE" || true
-          echo "ok=true" >> "$GITHUB_OUTPUT"
-
-      - name: Install the toolchain
-        if: steps.check.outputs.ok == 'true'
-        timeout-minutes: 8
-        run: |
-          npm ci --ignore-scripts --no-audit --no-fund
-          npm run build --workspace=shared
-
-      # The bump commit skips CI, so this is where the module meets the strict
-      # config (lint:strict lets a new file have no strict errors) and ESLint
-      # with --max-warnings 0 (lint:warnings starts a new file at none) before
-      # it lands on main.
-      - name: Type-check and lint the dialect
-        id: types
-        if: steps.check.outputs.ok == 'true'
-        timeout-minutes: 5
-        working-directory: server
-        env:
-          FILE: ${{ steps.fetch.outputs.file }}
-          VERSION: ${{ inputs.version }}
-        run: |
-          set -uo pipefail
-          cp "$FILE" src/nest/service-identity/registration-dialect.ts
-          # TypeScript 6 includes no @types by default and the dialect imports nothing
-          # from node, so checked on its own it would not know Buffer: name node here.
-          printf '%s\n' '{"extends": "./tsconfig.strict.json", "compilerOptions": {"types": ["node"]}, "include": [],' \
-            '"files": ["src/nest/service-identity/registration-dialect.ts"]}' > tsconfig.dialect-check.json
-          if ! npx tsc -p tsconfig.dialect-check.json --noEmit --pretty false; then
-            echo "::warning::The issuer's registration dialect for $VERSION does not type-check under the strict config."
-            exit 0
-          fi
-          if ! npx eslint --max-warnings 0 src/nest/service-identity/registration-dialect.ts; then
-            echo "::warning::The issuer's registration dialect for $VERSION does not pass ESLint."
-            exit 0
-          fi
-          echo "ok=true" >> "$GITHUB_OUTPUT"
-
-      - name: Hand the dialect on
-        if: steps.types.outputs.ok == 'true'
-        uses: actions/upload-artifact@v6
-        with:
-          name: registration-dialect
-          path: ${{ steps.fetch.outputs.file }}
-          if-no-files-found: error
-          retention-days: 1
@@ -1,85 +1,35 @@
 name: Security Scan

-# Neither job is a required check. What they report depends on the advisory
-# databases as much as on the change: a CVE published overnight would turn
-# every open PR red at once, including the ones that cannot fix it. The
-# security floors that hold the fixes live in the root package.json's
-# overrides, which a regenerated lockfile keeps.
-#
-#   - npm-audit reads the lockfile only, so it runs in seconds on every PR
-#     and push into dev and main. It audits what the image installs (the
-#     server and shared workspaces without dev dependencies) and the
-#     standalone plugin-sdk.
-#   - scout scans the built image, base image packages included. It needs
-#     the Docker Hub login, so it runs on PRs and pushes into main only and
-#     skips fork PRs. Whether the image builds at all is test.yml's
-#     docker-image job, which a red scan cannot hide.
 on:
  pull_request:
-    branches: [main, dev]
+    branches: [main]
  push:
-    branches: [main, dev]
+    branches: [main]

 permissions:
-  contents: read
  pull-requests: write

-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
-  npm-audit:
-    name: npm audit
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-
-      # The client's dependencies end up in a browser bundle, not in the
-      # image, and are audited by hand until maplibre-gl's fix (a major) lands.
-      - name: Audit the image's runtime dependencies
-        run: npm audit --package-lock-only --omit=dev --audit-level=high --workspace=server --workspace=shared
-
-      - name: Audit trek-plugin-sdk
-        working-directory: plugin-sdk
-        run: npm audit --package-lock-only --omit=dev --audit-level=high
-
  scout:
-    # Docker Hub secrets are not exposed to pull requests from forks, so the
-    # Scout login can never succeed there.
-    if: >-
-      github.repository == 'liketrek/TREK'
-      && github.event.pull_request.head.repo.fork != true
-      && (github.base_ref == 'main' || github.ref == 'refs/heads/main')
-    runs-on: ubuntu-24.04
-    timeout-minutes: 45
+    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v4

-      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/setup-buildx-action@v3

-      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+      - uses: docker/build-push-action@v5
        with:
          context: .
          push: false
          load: true
          tags: trek:scan

-      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+      - uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

-      - uses: docker/scout-action@e7e2a72bf1485d10a58f30696b6c513b261ce4fa # v1.29.0
+      - uses: docker/scout-action@v1
        with:
          command: cves
          image: trek:scan
@@ -17,12 +17,10 @@ concurrency:

 jobs:
  deploy:
-    if: github.repository == 'liketrek/TREK'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 45
+    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - name: Publish to GitHub wiki
-        uses: Andrew-Chen-Wang/github-wiki-action@1bbb4280446f9630e8e21a18012cbacf3b0f992e # v5.0.6
+        uses: Andrew-Chen-Wang/github-wiki-action@v5
        with:
          strategy: clone
@@ -4,7 +4,6 @@ node_modules/
 # Build output
 client/dist/
 server/dist/
-server/VERSION
 shared/dist/
 server/public/*
 !server/public/.gitkeep
@@ -52,11 +51,8 @@ yarn-error.log*

 # Coverage
 coverage
-coverage-*/
 *.lcov
 .nyc_output
-# Blob reports of a sharded vitest run (test.yml)
-.vitest-reports

 # Cache
 .npm
@@ -68,8 +64,7 @@ coverage-*/
 .scannerwork
 test-data

-# Live-MinIO/AIStor manual test license key — never commit, operators obtain their own free key
-minio-licence.key
-
 .run
 .full-review
+# Wiki offline snapshot is baked in at build, not committed (duplicates wiki/)
+server/assets/wiki/
@@ -1 +0,0 @@
-24
@@ -1,165 +0,0 @@
-# CLAUDE.md
-
-Guidance for Claude Code in this repository. This file holds the commands, the invariants, the gates and the philosophy. Inventories (file lists, counts, history) deliberately live in the code and its READMEs, not here — when this file disagrees with the code, the code wins; fix the doc.
-
-## What TREK is
-
-A self-hosted, real-time collaborative travel planner. npm-workspaces monorepo:
-
- **`shared/`** (`@trek/shared`) — Zod schemas, the **single source of truth** for API contracts, plus all i18n locales. Must be built before server/client typecheck or run.
- **`server/`** (`@trek/server`) — NestJS API (Express adapter), SQLite via `better-sqlite3`, WebSocket sync, built-in MCP server, sandboxed plugin runtime.
- **`client/`** (`@trek/client`) — React 19 + Vite + Zustand + Tailwind PWA, offline-first via Dexie/IndexedDB.
- **`plugin-sdk/`** (`trek-plugin-sdk`) — **not a root workspace**: own lockfile, published to npm independently, must ship standalone. Run its commands from `plugin-sdk/`.
-
-Each package has its own `CLAUDE.md`; this file covers the monorepo picture.
-
-## Commands
-
-Run from the repo root unless noted. **Use `npm run ... --workspace=<pkg>`, not `npm -w <pkg>`**.
-
-```bash
-npm run dev                       # build shared, then watch shared + server + client concurrently
-npm run build                     # build shared → server → client (order matters)
-npm run lint                      # lint all three workspaces, check-only (npm run lint:fix applies the fixes in shared and server)
-npm run format                    # prettier --write all three
-npm run lint:knip                 # knip over client/server/shared (knip.jsonc): unused files, exports, types, deps may only shrink against scripts/ci/knip-baseline.json (CI gate; --update lowers it)
-```
-
-Tests:
-
-```bash
-npm run test                                       # all workspaces
-npm run test --workspace=server                    # vitest run (server); also test:unit / test:integration / test:ws
-npm run test:e2e                                   # server e2e (boots Nest against a temp SQLite)
-npm run test:cov                                   # coverage (lcov) for all four packages incl. plugin-sdk
-cd client && npm run test                          # client vitest run
-cd client && npm run e2e                           # Playwright (CI runs the public and app projects; the screenshot and help-media ones are local)
-cd client && npm run lint:pages                    # enforce the Page pattern (CI gate)
-cd client && npm run lint:rtl                      # physical left/right sides may only shrink per file (CI gate)
-cd client && npm run lint:dup                      # lines in copied code may only shrink per file, at SonarCloud's thresholds (CI gate)
-cd client && npm run lint:pairs                    # desktop and phone views of a feature import its shared hook; every phone screen is listed (CI gate)
-cd client && npm run lint:size                     # no source file past 1000 lines, longer ones only shrink (CI gate; server has the same)
-cd client && npm run lint:strict                   # strictNullChecks + noImplicitAny errors may only shrink per file; new files start at zero (CI gate)
-cd client && npm run lint:warnings                 # eslint (typed) errors fail, warnings per rule may only shrink, new rules start frozen (CI gate)
-cd server && npm run lint:warnings                 # the same for the server, against server/scripts/eslint-baseline.json (CI gate)
-cd server && npm run lint:format                   # Prettier outside the baseline list (CI gate; shared has the same in lint-prettier.yml)
-cd server && npm run lint:strict                   # strict type errors per file may only shrink, a new file has none (CI gate)
-cd client && npm run lint:format                   # Prettier outside the baseline list (CI gate)
-cd client && npm run lint:layers                   # components never import pages/ or mobile/ (CI gate)
-cd client && npm run lint:offline                  # views may not import src/api/ beyond the baseline (CI gate)
-cd client && npm run lint:skips                    # no .only; skipped tests may only shrink (CI gate)
-cd client && npm run lint:i18n-keys                # every key the client names exists in en; unused en keys may only shrink (CI gate)
-cd server && npm run lint:boundaries               # no new import cycles or cross-domain reach-ins (CI gate)
-cd server && npm run lint:dialect                  # SQLite-only SQL spellings may only shrink (CI gate; rules in server/CLAUDE.md)
-cd server && npm run probe:pg                      # dialect helpers + the repository statements it reaches against Postgres (CI job; needs TREK_PG_PROBE_URL)
-cd server && npm run lint:tx                       # no new method writing twice outside one transaction (CI gate)
-cd server && npm run lint:test-sql                 # raw SQL fixtures in tests/ may only shrink; seed through tests/helpers/factories (CI gate)
-cd server && npm run lint:test-mocks               # vi.mock of config, realtime and db modules in tests/ may only shrink (CI gate)
-cd server && npm run lint:test-new-service         # hand-built services and repositories in tests/ may only shrink (CI gate)
-cd server && npm run lint:query-api                # MikroORM QueryBuilder calls in the repositories may only shrink (CI gate)
-cd server && npm run lint:mcp-zod                  # inline zod in the MCP tool files may only shrink; fields derive from @trek/shared (CI gate)
-cd server && npm run lint:service-http             # { error, status } results and their caller-side branches may only shrink; services throw DomainError (CI gate)
-cd server && npm run lint:response-contracts        # route handlers without @ResponseContract may only shrink (CI gate)
-cd client && npm run theme:lint                    # styling that bypasses appearance tokens may only shrink per file (CI gate)
-npm run typecheck --workspace=server               # tsc --noEmit (also client/shared; server also has typecheck:tests)
-```
-
-Run a single test file or test:
-
-```bash
-npx vitest run tests/unit/nest/weather.controller.test.ts   # (from server/ or client/)
-npx vitest run -t "name of the test"                        # by test-name pattern
-```
-
-i18n parity (CI gate — every non-`en` locale must have the identical file set and top-level keys):
-
-```bash
-npm run i18n:parity --workspace=shared            # audit (exit 0)
-npm run i18n:parity:strict --workspace=shared     # CI gate (exit 1 on drift)
-```
-
-Dev ports: the server listens on **3001**; the Vite dev server proxies the API, websocket, uploads, MCP and OAuth paths to it (see `client/vite.config.js`). `.nvmrc` pins the Node major the Docker image runs and every CI job reads; `engines` in each package.json states the range that installs (npm only warns outside it). `server/.env.example` is the env-var reference.
-
-## Server invariants
-
-Nest owns everything: every domain is a DI module under `server/src/nest/<domain>/` (`controller` + `service` + `module`, registered in `app.module.ts`), and ESLint refuses imports of the deleted legacy `services/` layer. `server/src/nest/README.md` is the module blueprint; **`weather/` is the reference implementation** — copy its shape. The domain's Zod contract lives in `shared/src/<domain>/`.
-
- **`bootstrap.ts` — `buildApp()`** is the single builder for production and the test harness. **Composition order is load-bearing**: everything registered on the raw Express instance must come **before `app.init()`**, because Nest's router throws `NotFoundException` on unmatched routes and nothing registered after init is reachable. Don't add routes to that pre-init shell — it bypasses every global guard, interceptor and filter.
- **`/mcp` bodies are raw by design** — the parser wrappers exempt `/mcp` so the MCP SDK reads the untouched stream; never `@Body()` a `/mcp` route.
- **Auth is default-deny**: global guards run as `APP_GUARD`s; public routes opt out with `@Public()`, and a boot-time ratchet (`validate-route-guards.ts`) refuses any public route not on its allow-list.
- **Trip-scoped routes** verify trip access (404) and the permission (403) — `@UseGuards(JwtAuthGuard, TripAccessGuard)` + `@RequirePermission('<action>')` per handler — and forward `X-Socket-Id` to the broadcast so the originating client doesn't echo its own change. **Never gate a multipart upload with a guard** (the client sees ECONNRESET instead of 403 — check in the handler).
- **DB** (`server/src/db/`): `better-sqlite3`, WAL, FK on. MikroORM's migrations (`db/migrations/`) are the only schema source, **including for tests** — the hand-kept `schema.ts`/`migrations.ts`/`seeds.ts` test builders are gone. Seeding is MikroORM's too (`db/seeders/`), applied at boot from `buildApp()`; the ORM shares the one better-sqlite3 connection (bound in `server/src/db/orm-driver.ts`) rather than opening its own. Queries go through repositories (`server/src/db/repositories/`) and `UnitOfWork` (`server/src/nest/database/unit-of-work.ts`) for transactions — there is no `DatabaseService`. `better-sqlite3` itself is ESLint-restricted to `src/db/` plus a short, named allow-list (`server/eslint.config.mjs`), so a domain reaching for the driver directly fails lint. `NODE_ENV=test` gives each vitest worker an isolated `:memory:` DB.
- **Realtime**: `/ws` is a Nest gateway in `server/src/nest/realtime/` — inject `RealtimeService`. Tests observe broadcasts through a `FakeRealtimeService` (`server/tests/helpers/fake-realtime.ts`), never by mocking the transport module.
- **MCP**: tools are declared in `<domain>.mcp.ts` files beside each module, on the `server/src/nest-mcp/` decorator layer. A validation or permission change on a REST route must land in the parallel MCP tool in the same change. See `MCP.md`.
- **Addons** are admin-toggleable feature modules keyed by `ADDON_IDS` in `server/src/addons.ts`.
- **Plugins** (`server/src/nest/plugins/`): one forked child process per plugin, permission-gated RPC (a handler is registered only if the plugin holds the unlocking permission), install-time manifest/signature/egress/version-range gates. The protocol tables are **generated** into `plugin-sdk/` and `shared/` by `gen:plugin-facts`; `check:plugin-facts` is the CI gate. Author tooling is `plugin-sdk/`; the `trek-plugin-dev` skill covers authoring.
- **Storage**: uploads go through the driver abstraction in `server/src/nest/storage/` (local / S3 / mirror). Never touch the filesystem or the S3 SDK from a domain service.
- **Crons** go through `server/src/nest/scheduling/` only — never a `@Cron` decorator (it bypasses the test-time gate).
-
-## Client invariants
-
-Offline-first, with a layered data flow. A Page never owns state directly:
-
- **Page pattern** (enforced by `lint:pages`, spec in `client/src/pages/PATTERN.md`): a `*Page.tsx` is a **wiring container** composing a co-located `use<Page>()` hook; it must not call React state/effect/memo hooks itself.
- **Data flow**: `store (Zustand, client/src/store/) → repo (client/src/repo/) → api (client/src/api/) | Dexie (client/src/db/offlineDb.ts)`. Writes go through `client/src/sync/mutationQueue.ts`: optimistic Dexie write, then a replay with an `X-Idempotency-Key` header on reconnect. `client/src/store/slices/remoteEventHandler.ts` applies incoming WebSocket events. Components never call the API directly.
- **Styling**: semantic Tailwind tokens (`bg-surface*`, `text-content*`, `border-edge*`, `bg-accent*`) or the underlying `var(--token)` variables — never color literals, arbitrary-value color classes or numeric inline `fontSize`, so user-chosen scheme/transparency/text-size keep working. `theme:lint` holds the bypasses per file to a baseline that only shrinks (CI gate); mark intentional exceptions (map/PDF/brand) with a `theme-lint-disable` line comment, which is counted too.
- **Reading direction**: Arabic runs the app right to left, so spacing, insets and alignment that follow the text use the logical forms (`ms-`/`me-`/`ps-`/`pe-`/`start-`/`end-`/`text-start`/`border-s`/`rounded-s`, `marginInlineStart`, `insetInlineEnd`, `textAlign: 'start'`). `lint:rtl` counts the physical ones per file against `client/scripts/rtl-baseline.json`, which may only shrink; geometry that is physical on purpose in new code (maps, measured positions, time axes) carries an `rtl-lint-disable` comment.
- **PWA**: `vite-plugin-pwa` + Workbox cache tiles, API and uploads; `prebuild` generates icons.
-
-## Shared contracts & i18n
-
- A route is "done" only once its contract lives in `shared/` and both sides import the inferred types. Edit the Zod schema, rebuild shared, then server (validation + DTO types) and client (typed requests) pick it up.
- Locale files live in `shared/src/i18n/<locale>/`, one file per domain; `en/` is canonical. When you add or change a key, **add a real translation to every locale** — parity fails CI on missing keys, and an English placeholder is not acceptable in a non-`en` locale.
- Count-bearing strings are plural groups: the key holds the general form and `key.one`, `.few` … the forms the language's `Intl.PluralRules` selects. Pass `{ count }` as a number and never choose between two keys with `count === 1`; details in `shared/CLAUDE.md`.
-
-## Project direction
-
-These principles come out of a full-repo audit and shape all new code:
-
- **Protect the crown jewels.** The client's offline-first data core (repos + mutation queue + Dexie), the out-of-process plugin sandbox, the Zod contract layer, and the auth primitives are production-grade. Extend them; never route around them or rewrite them in anger.
- **No "modern shell over legacy core."** The debt pattern is a modern frame delegating to the old approach underneath (on the client: feature components calling the raw API past the offline core). New code goes all-in on the target architecture; when touching a legacy seam, migrate it rather than adding another wrapper.
- **Single source of truth over manual synchronization.** Never add a hand-mirrored copy of state, schema, or contract (server↔Dexie↔Zustand, schema↔SQL, the plugin contract). Derive from one source, or guard the copy with a parity test that cannot silently skip — the server entities are the precedent: `npm run gen:entities`/`check:entities --workspace=server` (`server/scripts/generate-entities.ts`) regenerate them from the live migrated schema instead of hand-editing, and a parity test (PARITY-009) pins entity-vs-DB drift (delete rules, index names) at zero skips. The Kysely table types the repositories query through are generated the same way (`gen:db-types`/`check:db-types`, `server/scripts/generate-db-types.ts`).
- **DI over global mutable module state.** New server code injects its dependencies; new client code avoids `window`-global buses and mutable module state.
- **Use the runtime's native idioms.** Prefer React 19 features (`useOptimistic`, Actions, `use()`/Suspense) and Nest subsystems (providers, pipes, guards, `@nestjs/schedule`) over hand-rolled equivalents.
- **Fail closed, gates stay on.** Security switches default to safe; misconfiguration must refuse, not degrade. Never lower a quality gate to land a change — no new `any`, no new `eslint-disable`, no downgrading rules to `warn`, no lowered coverage thresholds.
-
-## Conventions (from CONTRIBUTING.md)
-
- **Target the `dev` branch** for PRs, not `main` (exception: `wiki/`-only changes).
- **Discuss first**: outside contributions are pitched in the `#github-pr` Discord channel before any code is written.
- **PRs follow `.github/PULL_REQUEST_TEMPLATE.md`** and need a linked issue (`Closes #N`) for fixes or an approved feature discussion for features.
- **Conventional commits** (`fix(maps): ...`, `feat(budget): ...`). **No Co-Authored-By or other tool-attribution trailers.**
- One focused change per PR; no breaking changes; no unrelated reformatting. Tests ship in the same change — the project holds 80%+ coverage.
- **Parity is law** when touching a route: same URL, method, query/body, HTTP status, `Set-Cookie` and JSON body, including bespoke error strings. Nest defaults POST to 201 — add `@HttpCode(200)` where the contract returns 200. Declare static sub-routes (`/reorder`) **before** `:id` param routes.
-
-## Quality gates in CI
-
-`.github/workflows/test.yml` runs, per package: typecheck (server also `typecheck:tests`, client also the strict-mode ratchet `lint:strict`), lint (client and server through `lint:warnings`, which also holds the warning count per rule), `lint:pages`, `lint:rtl`, `lint:size` (client and server), the server's `lint:strict`, `lint:boundaries`, `lint:tx`, `lint:dialect`, `lint:test-sql`, `lint:test-mocks`, `lint:test-new-service`, `lint:query-api`, `lint:mcp-zod`, `lint:service-http` and `lint:response-contracts`, the client's and server's `lint:format`, `lint:layers`, `lint:offline`, `lint:dup`, `lint:pairs`, `lint:skips`, `lint:i18n-keys` and `theme:lint`, shared's `contracts:open`, the repo-wide `lint:knip` (in server-lint-checks), `check:plugin-facts`, `i18n:parity:strict` (with the untranslated-strings ratchet), the S3 contract suite, the Postgres probe (`postgres-probe`: every dialect helper on SQLite and Postgres, and the statements every repository method reaches with sample arguments against a Postgres service; the SQL errors per method and the list of methods it cannot measure are held to a baseline that only shrinks and fails while it is still unmeasured; see `server/CLAUDE.md`), the browser end-to-end flows (Chromium and WebKit), a client build with `check:gl-split`, coverage for all four packages, then a SonarCloud scan. It also builds the Docker image and boots it until `/api/health/ready` answers (`docker-image`), and lints and renders the Helm chart against the Kubernetes schemas and runs `docker compose config` on every compose file (`deploy-manifests`). `lint-prettier.yml` additionally runs `lint` + `lint:format` on `shared/`, both check-only. `plugin-sdk` has no lint script and is outside the eslint gates. **Not in CI**: the screenshot and help-media Playwright projects; run them locally. There are no git hooks; nothing runs before a commit except you. Other workflows build Docker images, scan them, and publish `trek-plugin-sdk` on `plugin-sdk-v*` tags.
-
- **Job names read "package: what"** (`Server: Types`, `Client: Tests 3/7`), and the list at the top of `test.yml` says what each job holds. A new job follows the scheme and joins that list, and the job-count note there says when a long job needs a slot freed first.
- **Tests run beside the gates, in shards.** The client and server suites run in slices on parallel runners (`client-tests`, `server-tests`, through each package's `vitest.shard.config.ts`), and `client-coverage`/`server-coverage` merge their blob reports and check the thresholds against the whole. A red slice is usually a failing test, a red merge job usually a threshold.
- **`ci-ok` is the required check.** The branch ruleset requires `ci-ok` (plus `lint` and `check-target` from their own workflows), and `ci-ok` needs every job above except the scan. It fails if any of them failed or was cancelled and passes if they passed or were skipped. A new gate job counts only once it is listed in `ci-ok`'s `needs:`.
- **Guides name paths that exist**: the `changes` job runs `scripts/ci/doc-paths.mjs`, which resolves every backtick path in the CLAUDE.md files, `README.md`, `server/src/nest/README.md` and the wiki against the tracked files; the missing ones are listed in `scripts/ci/doc-paths-baseline.json`, which only shrinks (`--update` after a fix).
- **What runs is decided by `changes`, not by `on.paths`**: `scripts/ci/changed-areas.mjs` maps the changed files to the `code`, `image` and `deploy` areas (tests: `npm run test:ci-scripts`). A path filter on the workflow would leave `ci-ok` unreported on a docs-only PR and block it. Add a new top-level file the build reads to the right area there.
- **Runners and Node**: jobs run on `ubuntu-24.04`, not `ubuntu-latest`, and every `setup-node` reads `.nvmrc`. Third-party actions (anything outside `actions/*`) are pinned by commit SHA with the tag in a comment; Dependabot keeps both current.
- **Security scans are advisory.** `security.yml` runs `npm audit` (what the image installs, plus `plugin-sdk`) on every PR and push into dev and main, and Docker Scout on the built image for main. Neither is required: a newly published advisory would turn every open PR red at once. Fixes are held as floors in the root `package.json` `overrides`; npm ignores an `overrides` block in a workspace `package.json`, so never put one there.
- **Releases** are dispatched by hand and refuse a commit whose `ci-ok` is not green. `docker-dev.yml` (any branch, usually dev) is the canary: it builds the dispatched commit as the next minor or major `-pre.N` and moves only `:latest-pre` and `:<major>-pre`. `docker.yml` (main only) bumps the version, commits and tags it, builds both platforms from exactly that commit and moves `:latest`, `:<major>`, `:<major>.<minor>` and `:<version>`. Its `bump=auto` only finalizes a prerelease in flight; without one it stops and asks for patch, minor or major. Ship a release that migrates or changes a lot as a prerelease first, and as a minor, so installs pinned to `:<major>.<minor>` can wait it out.
-
-**SonarCloud** (project `liketrek_TREK`, the built-in Sonar way gate; the run takes 20–25 min, so get it right before pushing) measures **new code only** on a PR; any failing condition blocks it:
-
-| Condition (new code) | Must be |
-|---|---|
-| Coverage | ≥ 80% |
-| Duplicated lines | ≤ 3% |
-| Security / reliability / maintainability rating | A |
-| Security hotspots reviewed | 100% |
-
- **Duplication is the one that bites.** Desktop and phone shells (`client/src/components/<X>` ↔ `client/src/mobile/screens/.../M<X>`) are deliberate mirrors of each other's markup; their logic lives in one shared hook per feature. Every line added identically to both counts against the 3% budget, so a feature touching both shells fails on its own. Put the logic in ONE hook/module (precedents: `useInstanceSettings`, `useRangeBypass` under `client/src/components/Admin/`) and leave only markup in each shell. `lint:dup` finds the same copies in `client/src` before the push and holds every file to `client/scripts/dup-baseline.json`; `lint:pairs` holds each pair in `client/scripts/feature-pairs.json` to its shared hook and makes every new phone screen either join a pair or say why it has no twin. Locale files are excluded from duplication, so i18n additions are free.
- **Coverage is per new line across all four packages.** A new file without tests drags the PR under 80%. Files in `sonar.coverage.exclusions` don't count either way.
- **Ratings are about new issues.** One new bug drops reliability; one new vulnerability drops security. Don't introduce hotspot patterns (`Math.random` in anything security-adjacent, `child_process` through PATH, backtracking regexes, secret-looking strings). Path-wide suppressions live only in `sonar-project.properties` with a written justification; one-off findings are resolved on SonarCloud, never with an inline `// NOSONAR`.
- **Check it yourself.** The `sonarqube` MCP is connected: `list_pull_requests` → `get_project_quality_gate_status` shows each condition's value; `search_duplicated_files` + `get_duplications` show what tripped duplication; `search_sonar_issues_in_projects` lists new issues. Test files are excluded from analysis — when duplication fires, the source is the problem.
-
-## Reference docs
-
- `MCP.md` (MCP server, tools, scopes) · `README.md` (deployment, env vars, reverse proxy) · `server/src/nest/README.md` (module blueprint, test layout) · `server/src/app-config/README.md` (env parsing quirks) · `plugin-sdk/README.md` (plugin author guide).
- `wiki/` — end-user documentation. `Dockerfile` / `docker-compose*.yml` — the deployment path and the local S3 test stack.
@@ -1,136 +0,0 @@
-# Contributor Covenant 3.0 Code of Conduct
-
-## Our Pledge
-
-We pledge to make our community welcoming, safe, and equitable for all.
-
-We are committed to fostering an environment that respects and promotes the dignity, rights, and contributions of all
-individuals, regardless of characteristics including race, ethnicity, caste, color, age, physical characteristics,
-neurodiversity, disability, sex or gender, gender identity or expression, sexual orientation, language, philosophy or
-religion, national or social origin, socio-economic position, level of education, or other status. The same privileges
-of participation are extended to everyone who participates in good faith and in accordance with this Covenant.
-
-## Encouraged Behaviors
-
-While acknowledging differences in social norms, we all strive to meet our community's expectations for positive
-behavior. We also understand that our words and actions may be interpreted differently than we intend based on culture,
-background, or native language.
-
-With these considerations in mind, we agree to behave mindfully toward each other and act in ways that center our shared
-values, including:
-
-1. Respecting the **purpose of our community**, our activities, and our ways of gathering.
-2. Engaging **kindly and honestly** with others.
-3. Respecting **different viewpoints** and experiences.
-4. **Taking responsibility** for our actions and contributions.
-5. Gracefully giving and accepting **constructive feedback**.
-6. Committing to **repairing harm** when it occurs.
-7. Behaving in other ways that promote and sustain the **well-being of our community**.
-
-## Restricted Behaviors
-
-We agree to restrict the following behaviors in our community. Instances, threats, and promotion of these behaviors are
-violations of this Code of Conduct.
-
-1. **Harassment.** Violating explicitly expressed boundaries or engaging in unnecessary personal attention after any
-   clear request to stop.
-2. **Character attacks.** Making insulting, demeaning, or pejorative comments directed at a community member or group of
-   people.
-3. **Stereotyping or discrimination.** Characterizing anyone’s personality or behavior on the basis of immutable
-   identities or traits.
-4. **Sexualization.** Behaving in a way that would generally be considered inappropriately intimate in the context or
-   purpose of the community.
-5. **Violating confidentiality**. Sharing or acting on someone's personal or private information without their
-   permission.
-6. **Endangerment.** Causing, encouraging, or threatening violence or other harm toward any person or group.
-7. Behaving in other ways that **threaten the well-being** of our community.
-
-### Other Restrictions
-
-1. **Misleading identity.** Impersonating someone else for any reason, or pretending to be someone else to evade
-   enforcement actions.
-2. **Failing to credit sources.** Not properly crediting the sources of content you contribute.
-3. **Promotional materials**. Sharing marketing or other commercial content in a way that is outside the norms of the
-   community.
-4. **Irresponsible communication.** Failing to responsibly present content which includes, links or describes any other
-   restricted behaviors.
-
-## Reporting an Issue
-
-Tensions can occur between community members even when they are trying their best to collaborate. Not every conflict
-represents a code of conduct violation, and this Code of Conduct reinforces encouraged behaviors and norms that can help
-avoid conflicts and minimize harm.
-
-When an incident does occur, it is important to report it promptly. To report a possible violation, **send an email to
-report@liketrek.com**.
-
-Community Moderators take reports of violations seriously and will make every effort to respond in a timely manner. They
-will investigate all reports of code of conduct violations, reviewing messages, logs, and recordings, or interviewing
-witnesses and other participants. Community Moderators will keep investigation and enforcement actions as transparent as
-possible while prioritizing safety and confidentiality. In order to honor these values, enforcement actions are carried
-out in private with the involved parties, but communicating to the whole community may be part of a mutually agreed upon
-resolution.
-
-## Addressing and Repairing Harm
-
-****
-
-If an investigation by the Community Moderators finds that this Code of Conduct has been violated, the following
-enforcement ladder may be used to determine how best to repair harm, based on the incident's impact on the individuals
-involved and the community as a whole. Depending on the severity of a violation, lower rungs on the ladder may be
-skipped.
-
-1) Warning
-    1) Event: A violation involving a single incident or series of incidents.
-    2) Consequence: A private, written warning from the Community Moderators.
-    3) Repair: Examples of repair include a private written apology, acknowledgement of responsibility, and seeking
-       clarification on expectations.
-2) Temporarily Limited Activities
-    1) Event: A repeated incidence of a violation that previously resulted in a warning, or the first incidence of a
-       more serious violation.
-    2) Consequence: A private, written warning with a time-limited cooldown period designed to underscore the
-       seriousness of the situation and give the community members involved time to process the incident. The cooldown
-       period may be limited to particular communication channels or interactions with particular community members.
-    3) Repair: Examples of repair may include making an apology, using the cooldown period to reflect on actions and
-       impact, and being thoughtful about re-entering community spaces after the period is over.
-3) Temporary Suspension
-    1) Event: A pattern of repeated violation which the Community Moderators have tried to address with warnings, or a
-       single serious violation.
-    2) Consequence: A private written warning with conditions for return from suspension. In general, temporary
-       suspensions give the person being suspended time to reflect upon their behavior and possible corrective actions.
-    3) Repair: Examples of repair include respecting the spirit of the suspension, meeting the specified conditions for
-       return, and being thoughtful about how to reintegrate with the community when the suspension is lifted.
-4) Permanent Ban
-    1) Event: A pattern of repeated code of conduct violations that other steps on the ladder have failed to resolve, or
-       a violation so serious that the Community Moderators determine there is no way to keep the community safe with
-       this person as a member.
-    2) Consequence: Access to all community spaces, tools, and communication channels is removed. In general, permanent
-       bans should be rarely used, should have strong reasoning behind them, and should only be resorted to if working
-       through other remedies has failed to change the behavior.
-    3) Repair: There is no possible repair in cases of this severity.
-
-This enforcement ladder is intended as a guideline. It does not limit the ability of Community Managers to use their
-discretion and judgment, in keeping with the best interests of our community.
-
-## Scope
-
-This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing
-the community in public or other spaces. Examples of representing our community include using an official email address,
-posting via an official social media account, or acting as an appointed representative at an online or offline event.
-
-## Attribution
-
-This Code of Conduct is adapted from the Contributor Covenant, version 3.0, permanently available
-at [https://www.contributor-covenant.org/version/3/0/](https://www.contributor-covenant.org/version/3/0/).
-
-Contributor Covenant is stewarded by the Organization for Ethical Source and licensed under CC BY-SA 4.0. To view a copy
-of this license,
-visit [https://creativecommons.org/licenses/by-sa/4.0/](https://creativecommons.org/licenses/by-sa/4.0/)
-
-For answers to common questions about Contributor Covenant, see the FAQ
-at [https://www.contributor-covenant.org/faq](https://www.contributor-covenant.org/faq). Translations are provided
-at [https://www.contributor-covenant.org/translations](https://www.contributor-covenant.org/translations). Additional
-enforcement and community guideline resources can be found
-at [https://www.contributor-covenant.org/resources](https://www.contributor-covenant.org/resources). The enforcement
-ladder was inspired by the work of [Mozilla’s code of conduct team](https://github.com/mozilla/inclusion).
-
@@ -10,7 +10,7 @@ Thanks for your interest in contributing! Please read these guidelines before op
 4. **Target the `dev` branch** — All PRs must be opened against `dev`, not `main`. Exception: PRs that only modify files under `wiki/` may target any branch
 5. **Match the existing style** — No reformatting, no linter config changes, no "while I'm here" cleanups
 6. **Tests** — Your changes must include tests. The project maintains 80%+ coverage; PRs that drop it will be closed
-7. **Branch up to date** — Your branch must be [up to date with `dev`](https://github.com/liketrek/TREK/wiki/Development-environment#3-keep-your-fork-up-to-date) before submitting a PR
+7. **Branch up to date** — Your branch must be [up to date with `dev`](https://github.com/mauriceboe/TREK/wiki/Development-environment#3-keep-your-fork-up-to-date) before submitting a PR

 ## Pull Requests

@@ -39,8 +39,8 @@ feat(budget): add CSV export for expenses

 ## Development Environment

-See the [Developer Environment page](https://github.com/liketrek/TREK/wiki/Development-environment) for more information on setting up your development environment.
+See the [Developer Environment page](https://github.com/mauriceboe/TREK/wiki/Development-environment) for more information on setting up your development environment.

 ## More Details

-See the [Contributing wiki page](https://github.com/liketrek/TREK/wiki/Contributing) for the full tech stack, architecture overview, and detailed guidelines.
+See the [Contributing wiki page](https://github.com/mauriceboe/TREK/wiki/Contributing) for the full tech stack, architecture overview, and detailed guidelines.
@@ -2,10 +2,8 @@
 # Rebuild gosu with a current Go toolchain so the runtime image ships no stale
 # Go stdlib (Debian's apt gosu is built with an old Go that trips CVE scanners).
 # The binary and its runtime behaviour are identical to the apt package.
-FROM golang:1.26-alpine AS gosu-build
-# Pinned to the commit of gosu's 1.19 tag: @latest made every build pick up whatever
-# was pushed last, and the tag itself is not a semver version go install accepts.
-RUN CGO_ENABLED=0 GOBIN=/out go install github.com/tianon/gosu@6456aaa0f3c854d199d0f037f068eb97515b7513
+FROM golang:1.25-alpine AS gosu-build
+RUN CGO_ENABLED=0 GOBIN=/out go install github.com/tianon/gosu@latest

 # ── Stage 1: shared ──────────────────────────────────────────────────────────
 FROM node:24-alpine AS shared-builder
@@ -25,14 +23,10 @@ COPY client/package.json ./client/
 RUN npm ci --workspace=client
 COPY --from=shared-builder /app/shared/dist ./shared/dist
 COPY client/ ./client/
-# A prerelease build does not bump client/package.json, so the bundle takes its
-# version from the same build argument the server's VERSION file comes from.
-ARG APP_VERSION=dev
 RUN npm run build --workspace=client

 # ── Stage 3: server ──────────────────────────────────────────────────────────
-# --ignore-scripts: nothing here needs a postinstall, tsc only reads types. The one
-# native module, better-sqlite3, ships its binaries inside the npm tarball since 13.x.
+# --ignore-scripts skips native builds (better-sqlite3); they happen in the production stage.
 FROM node:24-alpine AS server-builder
 WORKDIR /app
 COPY package.json package-lock.json ./
@@ -41,9 +35,7 @@ COPY server/package.json ./server/
 RUN npm ci --workspace=server --ignore-scripts
 COPY --from=shared-builder /app/shared/dist ./shared/dist
 COPY server/ ./server/
-# tsc needs more than the 2 GB heap Node picks on a host with about 12 GB of RAM;
-# on a bigger build machine the default is larger, so only small hosts failed.
-RUN NODE_OPTIONS=--max-old-space-size=4096 npm run build --workspace=server
+RUN npm run build --workspace=server

 # ── Stage 4: production runtime ──────────────────────────────────────────────
 FROM node:24-trixie-slim
@@ -54,32 +46,16 @@ COPY package.json package-lock.json ./
 COPY shared/package.json ./shared/
 COPY server/package.json ./server/

-# The trailing chown runs in this layer on purpose: it covers the manifests and
-# the freshly installed node_modules while they are already part of this layer's
-# changeset, so it costs nothing. Everything copied after this point carries
-# --chown=node:node for the same reason — a recursive chown in a later layer
-# would copy up every inode it touches and duplicate the whole tree in the image.
-#
-# No compiler in this stage. better-sqlite3 13.x carries prebuilt binaries for
-# amd64 and arm64 inside its tarball, so there is nothing left to build: the old
-# python3 + build-essential fallback compiled it against whatever Node headers
-# the base image had that day, and 24.19+ headers give an addon that aborts with
-# "Assertion failed: (env) != nullptr" the first time a statement is collected
-# (#2421). --ignore-scripts because a lockfile-driven npm ci still synthesises
-# `node-gyp rebuild` for the binding.gyp it finds, blind to the package's
-# gypfile:false (npm/cli#9837). The only other install scripts among the runtime
-# deps are esbuild's binary check, redundant next to its optional platform
-# package, and a telemetry ping.
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends tzdata dumb-init wget ca-certificates \
-    libkitinerary-bin libsqlite3-0 && \
-    npm ci --workspace=server --omit=dev --ignore-scripts && \
-    { ln -sf "$(find /usr/lib -name kitinerary-extractor -type f | head -1)" /usr/local/bin/kitinerary-extractor || true; } && \
-    rm -rf /var/lib/apt/lists/* /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx && \
-    chown -R node:node /app
+    apt-get install -y --no-install-recommends tzdata dumb-init wget ca-certificates python3 build-essential \
+    libkitinerary-bin && \
+    npm ci --workspace=server --omit=dev && \
+    ln -sf "$(find /usr/lib -name kitinerary-extractor -type f | head -1)" /usr/local/bin/kitinerary-extractor; \
+    apt-get purge -y python3 build-essential && \
+    apt-get autoremove -y && \
+    rm -rf /var/lib/apt/lists/* /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx

-# gosu rebuilt with a current Go toolchain (stage 0) — the entrypoint script uses
-# it to drop to node.
+# gosu rebuilt with a current Go toolchain (stage 0) — used by CMD to drop to node.
 COPY --from=gosu-build /out/gosu /usr/local/bin/gosu

 ENV XDG_CACHE_HOME=/tmp/kf6-cache
@@ -89,76 +65,42 @@ ENV QT_QPA_PLATFORM=offscreen
 # Override with KITINERARY_EXTRACTOR_PATH if you install it elsewhere.
 ENV KITINERARY_EXTRACTOR_PATH=/usr/local/bin/kitinerary-extractor

-COPY --chown=node:node --from=server-builder /app/server/dist ./server/dist
+COPY --from=server-builder /app/server/dist ./server/dist
 # Runtime data assets read from server/assets at runtime: airports.json (flight
-# transport search) and atlas/*.geojson.gz + atlas/admin1/*.geojson.gz (Atlas
-# country/region map). The build
+# transport search) and atlas/*.geojson.gz (Atlas country/region map). The build
 # only emits dist, so these must be copied explicitly or the features silently
 # degrade to empty in the image.
-COPY --chown=node:node --from=server-builder /app/server/assets ./server/assets
-# The in-app help pages (/help) read this straight from disk at runtime, so the
-# docs always match the version running. Without it, wikiService falls back to
-# fetching the GitHub wiki, which tracks main and needs network access.
-COPY --chown=node:node wiki ./wiki
+COPY --from=server-builder /app/server/assets ./server/assets
 # tsconfig-paths/register reads this at runtime to resolve MCP SDK paths.
-COPY --chown=node:node server/tsconfig.json ./server/
+COPY server/tsconfig.json ./server/
 # Encryption-key rotation is run on demand via tsx (a prod dep) straight from the
 # raw .ts source — it never enters dist, so it must be copied in explicitly or
 # `node --import tsx scripts/migrate-encryption.ts` fails with module-not-found.
-COPY --chown=node:node server/scripts/migrate-encryption.ts ./server/scripts/migrate-encryption.ts
+COPY server/scripts/migrate-encryption.ts ./server/scripts/migrate-encryption.ts
 # Admin recovery script (node server/reset-admin.js) for locked-out installs.
-COPY --chown=node:node server/reset-admin.js ./server/reset-admin.js
-COPY --chown=node:node --from=shared-builder /app/shared/dist ./shared/dist
-COPY --chown=node:node --from=client-builder /app/client/dist ./server/public
-COPY --chown=node:node --from=client-builder /app/client/public/fonts ./server/public/fonts
+COPY server/reset-admin.js ./server/reset-admin.js
+COPY --from=shared-builder /app/shared/dist ./shared/dist
+COPY --from=client-builder /app/client/dist ./server/public
+COPY --from=client-builder /app/client/public/fonts ./server/public/fonts

-# journey/ and places/ must be listed here and in server/src/index.ts (#1762) —
-# a dir created lazily on first upload needs write permission on the uploads
-# mount point itself, which fails with EACCES when the bind-mounted host dir
-# isn't writable by node. Only paths this layer creates are chowned; anything
-# already in the image arrived node-owned via --chown above.
-RUN mkdir -p /app/data/logs /app/uploads/files /app/uploads/covers /app/uploads/avatars \
-      /app/uploads/photos /app/uploads/journey /app/uploads/places && \
+RUN mkdir -p /app/data/logs /app/uploads/files /app/uploads/covers /app/uploads/avatars /app/uploads/photos && \
    ln -s /app/uploads /app/server/uploads && \
    ln -s /app/data /app/server/data && \
-    chown -R node:node /app/data /app/uploads && \
-    chown -h node:node /app/server/uploads /app/server/data
+    chown -R node:node /app

 ENV NODE_ENV=production
-ENV NODE_USE_ENV_PROXY=1
 ENV PORT=3000
-# The version goes into a file, not into ENV. A container keeps its environment
-# when it is recreated on a newer image (Portainer's recreate, a copied run
-# config), so an APP_VERSION env var would keep announcing the old release and
-# the clients would never pick up the new bundle. The server reads this file
-# first (server/src/app-config/image-version.ts).
 ARG APP_VERSION=dev
-RUN if [ "$APP_VERSION" != "dev" ]; then printf '%s\n' "$APP_VERSION" > /app/server/VERSION; fi
-
-# OCI metadata: Renovate, Watchtower and the registries read the source label to
-# link an image update to its release notes (#1498). The release workflows add
-# the commit and the build time; a local build carries everything else.
-LABEL org.opencontainers.image.title="TREK" \
-      org.opencontainers.image.description="Self-hosted collaborative travel planner" \
-      org.opencontainers.image.url="https://github.com/liketrek/TREK" \
-      org.opencontainers.image.source="https://github.com/liketrek/TREK" \
-      org.opencontainers.image.documentation="https://github.com/liketrek/TREK/wiki" \
-      org.opencontainers.image.licenses="AGPL-3.0-only" \
-      org.opencontainers.image.version="${APP_VERSION}"
+ENV APP_VERSION=${APP_VERSION}

 EXPOSE 3000

 HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
-  CMD wget -qO- "http://localhost:${PORT:-3000}/api/health" || exit 1
-
-# Start-up lives in a script, not an inline `sh -c` string: container management
-# UIs re-tokenise Config.Cmd when you edit a container in place, and a command
-# carrying quotes does not survive that round-trip (the container then dies with
-# a shell syntax error before Node starts). A CMD of one bare token does.
-COPY server/scripts/entrypoint.sh /usr/local/bin/trek-entrypoint
-# Root-owned on purpose — this is what calls gosu, so it runs before the drop to
-# node. chmod is explicit because a checkout on Windows carries no exec bit.
-RUN chmod 0755 /usr/local/bin/trek-entrypoint
+  CMD wget -qO- http://localhost:3000/api/health || exit 1

 ENTRYPOINT ["dumb-init", "--"]
-CMD ["/usr/local/bin/trek-entrypoint"]
+# Preflight: if the app code is missing, a volume was almost certainly mounted
+# over /app (it hides the image's node_modules + dist). Fail with actionable
+# guidance instead of a cryptic "Cannot find module 'tsconfig-paths/register'".
+# cd into server/ so tsconfig-paths/register finds tsconfig.json and ../node_modules resolves correctly.
+CMD ["sh", "-c", "if [ ! -f /app/server/dist/index.js ] || [ ! -d /app/node_modules/tsconfig-paths ]; then echo 'FATAL: TREK application files are missing from the image.'; echo 'A volume is likely mounted over /app, which hides the app code.'; echo 'Mount ONLY your data and uploads dirs: -v ./data:/app/data -v ./uploads:/app/uploads'; echo 'Do NOT mount a volume at /app. See the Troubleshooting section of the README.'; exit 1; fi; chown -R node:node /app/data /app/uploads 2>/dev/null || true; cd /app/server && exec gosu node node --require tsconfig-paths/register dist/index.js"]
@@ -1,3 +1,577 @@
 # MCP Integration

-Please refer to the [MCP wiki](https://github.com/liketrek/TREK/wiki/MCP-Overview) for more information.
+TREK includes a built-in [Model Context Protocol](https://modelcontextprotocol.io/) (MCP) server that lets AI
+assistants — such as Claude Desktop, Cursor, or any MCP-compatible client — read and modify your trip data through a
+structured API.
+
+> **Note:** MCP is an addon that must be enabled by your TREK administrator before it becomes available.
+
+## Table of Contents
+
+- [Setup](#setup)
+  - [Option A: OAuth 2.1 (recommended)](#option-a-oauth-21-recommended)
+  - [Option B: Static API Token (deprecated)](#option-b-static-api-token-deprecated)
+- [Authentication](#authentication)
+- [OAuth Scopes](#oauth-scopes)
+- [Limitations & Important Notes](#limitations--important-notes)
+- [Resources (read-only)](#resources-read-only)
+- [Tools (read-write)](#tools-read-write)
+  - [Compound Tools](#compound-tools)
+- [Prompts](#prompts)
+- [Example](#example)
+
+---
+
+## Setup
+
+### 1. Enable the MCP addon (admin)
+
+An administrator must first enable the MCP addon from the **Admin Panel > Addons** page. Until enabled, the `/mcp`
+endpoint returns `404` and the MCP section does not appear in user settings.
+
+### 2. Connect your MCP client
+
+#### Option A: OAuth 2.1 (recommended)
+
+MCP clients that support OAuth 2.1 (such as Claude Desktop via `mcp-remote`) authenticate automatically. No token
+management required — just provide the server URL:
+
+```json
+{
+  "mcpServers": {
+    "trek": {
+      "command": "npx",
+      "args": [
+        "mcp-remote",
+        "https://your-trek-instance.com/mcp"
+      ]
+    }
+  }
+}
+```
+
+> The path to `npx` may need to be adjusted for your system (e.g. `C:\PROGRA~1\nodejs\npx.cmd` on Windows).
+
+**What happens automatically:**
+1. The client fetches `/.well-known/oauth-protected-resource` (RFC 9728) to discover the authorization server and bind the `/mcp` endpoint.
+2. The client fetches `/.well-known/oauth-authorization-server` for the full AS metadata.
+3. The client registers itself via [Dynamic Client Registration (RFC 7591)](https://www.rfc-editor.org/rfc/rfc7591).
+4. Your browser opens TREK's consent screen, where you choose which scopes (permissions) to grant.
+5. The client receives a short-lived access token audience-bound to `/mcp` (RFC 8707) and a rotating refresh token — no re-authorization needed.
+
+> **Requirement:** The `APP_URL` environment variable must be set to your TREK instance's public URL for OAuth
+> discovery to work correctly.
+
+**For more control over scopes or to use confidential client mode**, pre-create an OAuth client in
+**Settings > Integrations > MCP > OAuth Clients** before connecting. Clients created there have a client secret
+(`trekcs_` prefix) and fixed scopes that you define up front.
+
+#### Option B: Static API Token (deprecated)
+
+> **Deprecated:** Static API tokens will stop working in a future version. Migrate to OAuth 2.1 above.
+
+1. Go to **Settings > Integrations > MCP** and create an API token.
+2. Click **Create New Token**, give it a name, and **copy the token immediately** — it is shown only once.
+3. Add it to your `claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "trek": {
+      "command": "npx",
+      "args": [
+        "mcp-remote",
+        "https://your-trek-instance.com/mcp",
+        "--header",
+        "Authorization: Bearer trek_your_token_here"
+      ]
+    }
+  }
+}
+```
+
+Static tokens grant full access to all tools and resources (no scope restrictions). Sessions authenticated with a
+static token will receive deprecation warnings in the AI client via server instructions and tool results.
+
+Each user can create up to **10 static tokens**.
+
+---
+
+## Authentication
+
+TREK's MCP server supports three authentication methods. OAuth 2.1 is the recommended path for all external clients.
+
+| Method | Token prefix | Access level | TTL | Notes |
+|--------|-------------|-------------|-----|-------|
+| **OAuth 2.1** | `trekoa_` | Scoped (per-consent) | 1 hour | Recommended. Automatically refreshed via 30-day rolling refresh tokens (`trekrf_` prefix). Replay-detected rotation — replayed tokens cascade-revoke the entire chain. |
+| **Static API token** | `trek_` | Full access | No expiry | **Deprecated.** Triggers deprecation warnings in AI clients. Will be removed in a future release. |
+| **Web session JWT** | — | Full access | Session-based | Used internally by the TREK web UI. Not intended for external clients. |
+
+All methods require the `Authorization: Bearer <token>` header (strict scheme enforcement — `Bearer` required).
+
+---
+
+## OAuth Scopes
+
+When connecting via OAuth 2.1, you grant specific scopes during the consent step. TREK registers only the MCP tools
+that match your granted scopes for that session.
+
+| Scope | Permission | Group |
+|-------|-----------|-------|
+| `trips:read` | View trips & itineraries | Trips |
+| `trips:write` | Edit trips & itineraries | Trips |
+| `trips:delete` | Delete trips (irreversible) | Trips |
+| `trips:share` | Manage share links | Trips |
+| `places:read` | View places & map data | Places |
+| `places:write` | Manage places | Places |
+| `atlas:read` | View Atlas | Atlas |
+| `atlas:write` | Manage Atlas | Atlas |
+| `packing:read` | View packing lists | Packing |
+| `packing:write` | Manage packing lists | Packing |
+| `todos:read` | View to-do lists | To-dos |
+| `todos:write` | Manage to-do lists | To-dos |
+| `budget:read` | View budget | Budget |
+| `budget:write` | Manage budget | Budget |
+| `reservations:read` | View reservations | Reservations |
+| `reservations:write` | Manage reservations | Reservations |
+| `collab:read` | View collaboration | Collaboration |
+| `collab:write` | Manage collaboration | Collaboration |
+| `notifications:read` | View notifications | Notifications |
+| `notifications:write` | Manage notifications | Notifications |
+| `vacay:read` | View vacation plans | Vacation |
+| `vacay:write` | Manage vacation plans | Vacation |
+| `geo:read` | Maps & geocoding | Geo |
+| `weather:read` | Weather forecasts | Weather |
+| `journey:read` | View journeys | Journey |
+| `journey:write` | Manage journeys | Journey |
+| `journey:share` | Manage journey share links | Journey |
+
+**Scope rules:**
+- A `:write` scope implies `:read` access for the same group (e.g. `budget:write` also grants budget read access).
+- Any `trips:*` scope (`trips:read`, `trips:write`, `trips:delete`, or `trips:share`) grants trip read access.
+- Any `journey:*` scope (`journey:read`, `journey:write`, or `journey:share`) grants journey read access.
+- `list_trips` and `get_trip_summary` are **always available** regardless of scopes — they are navigation tools.
+- Static tokens and web session JWTs have full access to all tools (equivalent to all scopes).
+- Addon-gated tools (Atlas, Collab, Vacay, Journey) require both the relevant scope **and** the addon to be enabled.
+
+---
+
+## Limitations & Important Notes
+
+| Limitation                              | Details                                                                                                                                          |
+|-----------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
+| **Admin activation required**           | The MCP addon must be enabled by an admin before any user can access it.                                                                         |
+| **Per-user scoping**                    | Each MCP session is scoped to the authenticated user. You can only access trips you own or are a member of.                                      |
+| **No image uploads**                    | Cover images cannot be set through MCP. Use the web UI to upload trip covers.                                                                    |
+| **Reservations are created as pending** | When the AI creates a reservation, it starts with `pending` status. You must confirm it manually or ask the AI to set the status to `confirmed`. |
+| **Demo mode restrictions**              | If TREK is running in demo mode, all write operations through MCP are blocked.                                                                   |
+| **Rate limiting**                       | 300 requests per minute per user (configurable via `MCP_RATE_LIMIT`). Exceeding this returns a `429` error.                                     |
+| **Per-client rate limiting**            | Rate limits are tracked per user-client pair, so each OAuth client has its own independent rate limit window.                                    |
+| **Session limits**                      | Maximum 20 concurrent MCP sessions per user (configurable via `MCP_MAX_SESSION_PER_USER`). Sessions expire after 1 hour of inactivity.          |
+| **Token limits**                        | Maximum 10 static API tokens per user. Maximum 10 OAuth clients per user.                                                                        |
+| **Token revocation**                    | Deleting a static token or revoking an OAuth session immediately terminates all active MCP sessions for that token/client.                       |
+| **OAuth scope enforcement**             | Only tools matching your granted OAuth scopes are registered in the session. Calling an out-of-scope tool returns an error.                      |
+| **Addon toggle invalidation**           | When an admin enables or disables an addon, all active MCP sessions are invalidated and must be re-established.                                  |
+| **Real-time sync**                      | Changes made through MCP are broadcast to all connected clients in real-time via WebSocket, just like changes made through the web UI.           |
+| **Addon-gated features**                | Some resources and tools are only available when the corresponding addon (Atlas, Collab, Vacay, Journey) is enabled by an admin.                 |
+
+---
+
+## Resources (read-only)
+
+Resources provide read-only access to your TREK data. MCP clients can read these to understand the current state before
+making changes.
+
+### Core Resources
+
+| Resource              | URI                                             | Description                                                                           |
+|-----------------------|-------------------------------------------------|---------------------------------------------------------------------------------------|
+| Trips                 | `trek://trips`                                  | All trips you own or are a member of                                                  |
+| Trip Detail           | `trek://trips/{tripId}`                         | Single trip with metadata and member count                                            |
+| Days                  | `trek://trips/{tripId}/days`                    | Days of a trip with their assigned places                                             |
+| Places                | `trek://trips/{tripId}/places`                  | All places/POIs saved in a trip. Supports `?assignment=all\|unassigned\|assigned`     |
+| Budget                | `trek://trips/{tripId}/budget`                  | Budget and expense items                                                              |
+| Budget Per-Person     | `trek://trips/{tripId}/budget/per-person`       | Per-person totals and split breakdown                                                 |
+| Budget Settlement     | `trek://trips/{tripId}/budget/settlement`       | Suggested transactions to settle who owes whom                                        |
+| Packing               | `trek://trips/{tripId}/packing`                 | Packing checklist                                                                     |
+| Packing Bags          | `trek://trips/{tripId}/packing/bags`            | Packing bags with their assigned members                                              |
+| Reservations          | `trek://trips/{tripId}/reservations`            | Flights, hotels, restaurants, etc.                                                    |
+| Day Notes             | `trek://trips/{tripId}/days/{dayId}/notes`      | Notes for a specific day                                                              |
+| Accommodations        | `trek://trips/{tripId}/accommodations`          | Hotels/rentals with check-in/out details                                              |
+| Members               | `trek://trips/{tripId}/members`                 | Owner and collaborators                                                               |
+| Collab Notes          | `trek://trips/{tripId}/collab-notes`            | Shared collaborative notes                                                            |
+| To-Dos                | `trek://trips/{tripId}/todos`                   | To-do items ordered by position                                                       |
+| Categories            | `trek://categories`                             | Available place categories (for use when creating places)                             |
+| Bucket List           | `trek://bucket-list`                            | Your personal travel bucket list                                                      |
+| Visited Countries     | `trek://visited-countries`                      | Countries marked as visited in Atlas                                                  |
+| Notifications         | `trek://notifications/in-app`                   | Your in-app notifications (most recent 50, unread first)                              |
+
+### Addon-Gated Resources
+
+These resources are only available when the corresponding addon is enabled by an admin.
+
+| Resource              | URI                                             | Addon    | Description                                                         |
+|-----------------------|-------------------------------------------------|----------|---------------------------------------------------------------------|
+| Atlas Stats           | `trek://atlas/stats`                            | Atlas    | Visited country counts and continent breakdown                      |
+| Atlas Regions         | `trek://atlas/regions`                          | Atlas    | Manually visited sub-country regions                                |
+| Collab Polls          | `trek://trips/{tripId}/collab/polls`            | Collab   | All polls for a trip with vote counts per option                    |
+| Collab Messages       | `trek://trips/{tripId}/collab/messages`         | Collab   | Most recent 100 chat messages for a trip                            |
+| Vacay Plan            | `trek://vacay/plan`                             | Vacay    | Full snapshot of your active vacation plan (members, years, config) |
+| Vacay Entries         | `trek://vacay/entries/{year}`                   | Vacay    | All vacation day entries for the active plan and a specific year    |
+| Vacay Holidays        | `trek://vacay/holidays/{year}`                  | Vacay    | Public holidays for the plan's configured region and year           |
+| Journeys              | `trek://journeys`                               | Journey  | All journeys owned or contributed to by the current user            |
+| Journey Detail        | `trek://journeys/{journeyId}`                   | Journey  | Single journey with entries, contributors, and linked trips         |
+| Journey Entries       | `trek://journeys/{journeyId}/entries`           | Journey  | All entries in a journey (date, text, mood, linked trip)            |
+| Journey Contributors  | `trek://journeys/{journeyId}/contributors`      | Journey  | Contributors (owner and collaborators) of a journey                 |
+
+---
+
+## Tools (read-write)
+
+TREK exposes tools organized by feature area. Use `get_trip_summary` as a starting point — it returns everything about a
+trip in a single call.
+
+### Trip Summary
+
+| Tool               | Description                                                                                                                                                                                                           |
+|--------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `get_trip_summary` | Full denormalized snapshot of a trip: metadata, members, days with assignments and notes, accommodations, budget, packing, reservations, collab notes, to-dos, and poll/message counts. Use this as your context loader. |
+
+### Compound Tools
+
+Compound tools collapse common multi-step workflows into a single atomic call. Each one wraps two sequential operations in a database transaction — if the second step fails, the first is rolled back automatically.
+
+> **When to use:** Only use compound tools when the place or item does not yet exist. If it already exists, call the individual tools (`assign_place_to_day`, `create_accommodation`, `set_budget_item_members`) directly.
+
+| Tool | Wraps | Description |
+|---|---|---|
+| `create_and_assign_place` | `create_place` + `assign_place_to_day` | Create a new place and immediately assign it to a specific day. Accepts all `create_place` fields (`place_notes` instead of `notes`) plus `dayId` and optional `assignment_notes`. Returns `{ place, assignment }`. |
+| `create_place_accommodation` | `create_place` + `create_accommodation` | Create a new place and immediately book it as an accommodation for a date range. Accepts all `create_place` fields (`place_notes` instead of `notes`) plus `start_day_id`, `end_day_id`, `check_in`, `check_out`, `confirmation`, and `accommodation_notes`. Also auto-creates a linked hotel reservation. Returns `{ place, accommodation }`. |
+| `create_budget_item_with_members` | `create_budget_item` + `set_budget_item_members` | Create a budget item and optionally set which members are splitting it. Accepts all `create_budget_item` fields plus an optional `userIds` array. If `userIds` is omitted or empty, behaves identically to `create_budget_item`. Returns `{ item }` with members populated. |
+
+**Scope requirements** match the underlying tools: `places:write` for `create_and_assign_place`, `trips:write` for `create_place_accommodation`, `budget:write` for `create_budget_item_with_members` (Budget addon required).
+
+---
+
+### Trips
+
+| Tool                 | Description                                                                                 |
+|----------------------|---------------------------------------------------------------------------------------------|
+| `list_trips`         | List all trips you own or are a member of. Supports `include_archived` flag.                |
+| `create_trip`        | Create a new trip with title, dates, currency. Days are auto-generated from the date range. |
+| `update_trip`        | Update a trip's title, description, dates, or currency.                                     |
+| `delete_trip`        | Delete a trip. **Owner only.**                                                              |
+| `list_trip_members`  | List the owner and all collaborators of a trip.                                             |
+| `add_trip_member`    | Add a user to a trip by username or email. **Owner only.**                                  |
+| `remove_trip_member` | Remove a collaborator from a trip. **Owner only.**                                          |
+| `copy_trip`          | Duplicate a trip (days, places, itinerary, packing, budget, reservations). Packing items are reset to unchecked. |
+| `export_trip_ics`    | Export the trip itinerary and reservations as iCalendar (`.ics`) text for calendar apps.   |
+| `get_share_link`     | Get the current public share link for a trip and its permission flags.                      |
+| `create_share_link`  | Create or update the public share link with configurable visibility flags (map, bookings, packing, budget, collab). |
+| `delete_share_link`  | Revoke the public share link for a trip.                                                    |
+
+### Places
+
+> To create a place and assign it to a day in one call, use [`create_and_assign_place`](#compound-tools).
+
+| Tool             | Description                                                                                      |
+|------------------|--------------------------------------------------------------------------------------------------|
+| `list_places`              | List places/POIs in a trip, optionally filtered by assignment status, category, tag, or search.  |
+| `create_place`             | Add a place/POI with name, coordinates, address, category, notes, website, phone, and optional `google_place_id` / `osm_id` for opening hours. |
+| `update_place`             | Update any field of an existing place including transport mode, timing, and price.               |
+| `delete_place`             | Remove a place from a trip.                                                                      |
+| `bulk_delete_places`       | Delete multiple places at once by ID. Removes all day assignments as well. **Cannot be undone.** |
+| `import_places_from_url`   | Import all places from a publicly shared Google Maps or Naver Maps list URL.                     |
+| `list_categories`          | List all available place categories with id, name, icon and color.                              |
+| `search_place`             | Search for a real-world place by name or address. Returns `osm_id` and `google_place_id` for use in `create_place`. |
+
+### Day Planning
+
+| Tool                        | Description                                                                          |
+|-----------------------------|--------------------------------------------------------------------------------------|
+| `update_day`                | Set or clear a day's title (e.g. "Arrival in Paris", "Free day").                   |
+| `create_day`                | Add a new day to a trip with optional date and notes.                                |
+| `delete_day`                | Delete a day from a trip.                                                            |
+| `assign_place_to_day`       | Pin a place to a specific day in the itinerary.                                      |
+| `unassign_place`            | Remove a place assignment from a day.                                                |
+| `reorder_day_assignments`   | Reorder places within a day by providing assignment IDs in the desired order.        |
+| `update_assignment_time`    | Set start/end times for a place assignment (e.g. "09:00" – "11:30"). Pass `null` to clear. |
+| `move_assignment`           | Move a place assignment to a different day.                                          |
+| `get_assignment_participants`| Get the list of users participating in a specific place assignment.                 |
+| `set_assignment_participants`| Set participants for a place assignment (replaces current list).                   |
+
+### Accommodations
+
+> To create a place and book it as an accommodation in one call, use [`create_place_accommodation`](#compound-tools).
+
+| Tool                   | Description                                                                              |
+|------------------------|------------------------------------------------------------------------------------------|
+| `create_accommodation` | Add an accommodation (hotel, Airbnb, etc.) linked to a place and a check-in/out date range. |
+| `update_accommodation` | Update fields on an existing accommodation (dates, times, confirmation, notes).          |
+| `delete_accommodation` | Delete an accommodation record from a trip.                                              |
+
+### Transport
+
+Transport bookings (flights, trains, cars, cruises) support multi-stop `endpoints[]` — each endpoint has a `role` (`from`/`to`/`stop`), name, optional IATA `code` (for flights), coordinates, timezone, and local time. Use `search_airports` to resolve airport names to IATA codes before creating a flight.
+
+| Tool                   | Description                                                                                                                                           |
+|------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `create_transport`     | Create a transport booking (`flight`, `train`, `car`, `cruise`) with optional endpoints, departure/arrival times, and confirmation details. Created as pending. |
+| `update_transport`     | Update an existing transport booking. Pass `endpoints[]` to replace the full stop list. Use `status: "confirmed"` to confirm.                        |
+| `delete_transport`     | Delete a transport booking from a trip.                                                                                                               |
+
+### Reservations
+
+For flights, trains, cars, and cruises, use the **Transport** tools above. Reservations cover all other booking types.
+
+| Tool                       | Description                                                                                                                              |
+|----------------------------|------------------------------------------------------------------------------------------------------------------------------------------|
+| `create_reservation`       | Create a pending reservation. Supports hotels, restaurants, events, tours, activities, and other types. Hotels can be linked to places and check-in/out days. |
+| `update_reservation`       | Update any field including status (`pending` / `confirmed` / `cancelled`).                                                               |
+| `delete_reservation`       | Delete a reservation and its linked accommodation record if applicable.                                                                  |
+| `reorder_reservations`     | Update the display order of reservations (and transports) within a day.                                                                  |
+| `link_hotel_accommodation` | Set or update a hotel reservation's check-in/out day links and associated place.                                                         |
+
+### Budget
+
+> To create a budget item and set its members in one call, use [`create_budget_item_with_members`](#compound-tools).
+
+| Tool                       | Description                                                                           |
+|----------------------------|---------------------------------------------------------------------------------------|
+| `create_budget_item`       | Add an expense with name, category, and price.                                        |
+| `update_budget_item`       | Update an expense's details, split (persons/days), or notes.                          |
+| `delete_budget_item`       | Remove a budget item.                                                                 |
+| `set_budget_item_members`  | Set which trip members are splitting a budget item (replaces current member list).    |
+| `toggle_budget_member_paid`| Mark or unmark a member as having paid their share of a budget item.                  |
+
+### Packing
+
+| Tool                          | Description                                                                       |
+|-------------------------------|-----------------------------------------------------------------------------------|
+| `create_packing_item`         | Add an item to the packing checklist with optional category.                      |
+| `update_packing_item`         | Rename an item or change its category.                                            |
+| `toggle_packing_item`         | Check or uncheck a packing item.                                                  |
+| `delete_packing_item`         | Remove a packing item.                                                            |
+| `reorder_packing_items`       | Set the display order of packing items within a trip.                             |
+| `bulk_import_packing`         | Import multiple packing items at once from a list (with optional quantity).       |
+| `apply_packing_template`      | Apply a saved packing template to a trip (adds items from the template).          |
+| `save_packing_template`       | Save the current packing list as a reusable template.                             |
+| `list_packing_bags`           | List all packing bags for a trip.                                                 |
+| `create_packing_bag`          | Create a new packing bag (e.g. "Carry-on", "Checked bag").                        |
+| `update_packing_bag`          | Rename or recolor a packing bag.                                                  |
+| `delete_packing_bag`          | Delete a packing bag (items are unassigned, not deleted).                         |
+| `set_bag_members`             | Assign trip members to a packing bag.                                             |
+| `get_packing_category_assignees` | Get which trip members are assigned to each packing category.                 |
+| `set_packing_category_assignees` | Assign trip members to a packing category.                                    |
+
+### Day Notes
+
+| Tool              | Description                                                            |
+|-------------------|------------------------------------------------------------------------|
+| `create_day_note` | Add a note to a specific day with optional time label and emoji icon.  |
+| `update_day_note` | Edit a day note's text, time, or icon.                                 |
+| `delete_day_note` | Remove a note from a day.                                              |
+
+### To-Dos
+
+| Tool                          | Description                                                                                       |
+|-------------------------------|---------------------------------------------------------------------------------------------------|
+| `list_todos`                  | List all to-do items for a trip, ordered by position.                                             |
+| `create_todo`                 | Create a to-do item with name, category, due date, description, assignee, and priority.           |
+| `update_todo`                 | Update an existing to-do item. Pass `null` to clear nullable fields.                              |
+| `toggle_todo`                 | Mark a to-do item as done or undone.                                                              |
+| `delete_todo`                 | Delete a to-do item.                                                                              |
+| `reorder_todos`               | Reorder to-do items within a trip by providing a new ordered list of IDs.                         |
+| `get_todo_category_assignees` | Get the default assignees configured per to-do category for a trip.                               |
+| `set_todo_category_assignees` | Set default assignees for a to-do category. Pass an empty array to clear.                         |
+
+### Tags
+
+| Tool         | Description                                                              |
+|--------------|--------------------------------------------------------------------------|
+| `list_tags`  | List all tags belonging to the current user.                             |
+| `create_tag` | Create a new tag (user-scoped label for places) with optional hex color. |
+| `update_tag` | Update the name or color of an existing tag.                             |
+| `delete_tag` | Delete a tag (removes it from all places it was attached to).            |
+
+### Notifications
+
+| Tool                            | Description                                          |
+|---------------------------------|------------------------------------------------------|
+| `list_notifications`            | List in-app notifications with pagination and unread filter. |
+| `get_unread_notification_count` | Get the count of unread in-app notifications.        |
+| `mark_notification_read`        | Mark a single notification as read.                  |
+| `mark_notification_unread`      | Mark a single notification as unread.                |
+| `mark_all_notifications_read`   | Mark all notifications as read.                      |
+
+### Maps & Weather
+
+| Tool                  | Description                                                                                         |
+|-----------------------|-----------------------------------------------------------------------------------------------------|
+| `search_place`        | Search for a real-world place by name/address and get coordinates, `osm_id`, and `google_place_id`. |
+| `get_place_details`   | Fetch detailed information (hours, photos, ratings) about a place by its Google Place ID.           |
+| `reverse_geocode`     | Get a human-readable address for given coordinates.                                                 |
+| `resolve_maps_url`    | Resolve a Google Maps share URL to coordinates and place name.                                      |
+| `get_weather`         | Get weather forecast for a location and date.                                                       |
+| `get_detailed_weather`| Get hourly/detailed weather forecast for a location and date.                                       |
+
+### Airports
+
+| Tool              | Description                                                                                                       |
+|-------------------|-------------------------------------------------------------------------------------------------------------------|
+| `search_airports` | Search for airports by name, city, or IATA code. Returns IATA code, name, city, country, coordinates, timezone.  |
+| `get_airport`     | Look up a single airport by IATA code (e.g. `"ZRH"`, `"AMS"`, `"CDG"`).                                         |
+
+### Collab Notes _(Collab addon required)_
+
+| Tool                 | Description                                                                                     |
+|----------------------|-------------------------------------------------------------------------------------------------|
+| `create_collab_note` | Create a shared note visible to all trip members. Supports title, content, category, and color. |
+| `update_collab_note` | Edit a collab note's content, category, color, or pin status.                                   |
+| `delete_collab_note` | Delete a collab note.                                                                           |
+
+### Collab Polls & Chat _(Collab addon required)_
+
+| Tool                  | Description                                                                              |
+|-----------------------|------------------------------------------------------------------------------------------|
+| `list_collab_polls`   | List all polls for a trip.                                                               |
+| `create_collab_poll`  | Create a new poll with a question, options, optional multiple choice, and deadline.      |
+| `vote_collab_poll`    | Vote on a poll option (or remove vote if already voted).                                 |
+| `close_collab_poll`   | Close a poll so no more votes can be cast.                                               |
+| `delete_collab_poll`  | Delete a poll and all its votes.                                                         |
+| `list_collab_messages`| List chat messages for a trip (most recent 100, supports pagination via `before`).       |
+| `send_collab_message` | Send a chat message to a trip's collab channel, with optional reply threading.           |
+| `delete_collab_message`| Delete a chat message (own messages only).                                              |
+| `react_collab_message`| Toggle a reaction emoji on a chat message.                                               |
+
+### Bucket List _(Atlas addon required)_
+
+| Tool                      | Description                                                                                |
+|---------------------------|--------------------------------------------------------------------------------------------|
+| `create_bucket_list_item` | Add a destination to your personal bucket list with optional coordinates and country code. |
+| `delete_bucket_list_item` | Remove an item from your bucket list.                                                      |
+
+### Atlas _(Atlas addon required)_
+
+| Tool                     | Description                                                                     |
+|--------------------------|---------------------------------------------------------------------------------|
+| `mark_country_visited`   | Mark a country as visited using its ISO 3166-1 alpha-2 code (e.g. "FR", "JP"). |
+| `unmark_country_visited` | Remove a country from your visited list.                                        |
+
+### Atlas Extended _(Atlas addon required)_
+
+| Tool                       | Description                                                                  |
+|----------------------------|------------------------------------------------------------------------------|
+| `get_atlas_stats`          | Get atlas statistics — visited country counts, region counts, continent breakdown. |
+| `list_visited_regions`     | List all manually visited sub-country regions for the current user.          |
+| `mark_region_visited`      | Mark a sub-country region as visited (e.g. ISO code "US-CA").                |
+| `unmark_region_visited`    | Remove a region from the visited list.                                       |
+| `get_country_atlas_places` | Get places saved in the user's atlas for a specific country.                 |
+| `update_bucket_list_item`  | Update a bucket list item (name, notes, coordinates, target date).           |
+
+### Vacay _(Vacay addon required)_
+
+| Tool                       | Description                                                                           |
+|----------------------------|---------------------------------------------------------------------------------------|
+| `get_vacay_plan`           | Get the current user's active vacation plan (own or joined).                          |
+| `update_vacay_plan`        | Update vacation plan settings (weekend blocking, holidays, carry-over).               |
+| `set_vacay_color`          | Set the current user's color in the vacation plan calendar.                           |
+| `get_available_vacay_users`| List users who can be invited to the current vacation plan.                           |
+| `send_vacay_invite`        | Invite a user to join the vacation plan by their user ID.                             |
+| `accept_vacay_invite`      | Accept a pending invitation to join another user's vacation plan.                     |
+| `decline_vacay_invite`     | Decline a pending vacation plan invitation.                                           |
+| `cancel_vacay_invite`      | Cancel an outgoing invitation (owner cancels an invite they sent).                    |
+| `dissolve_vacay_plan`      | Dissolve the shared plan — all members return to their own individual plan.           |
+| `list_vacay_years`         | List calendar years tracked in the current vacation plan.                             |
+| `add_vacay_year`           | Add a calendar year to the vacation plan.                                             |
+| `delete_vacay_year`        | Remove a calendar year from the vacation plan.                                        |
+| `get_vacay_entries`        | Get all vacation day entries for the active plan and a specific year.                 |
+| `toggle_vacay_entry`       | Toggle a day on or off as a vacation day for the current user.                        |
+| `toggle_company_holiday`   | Toggle a date as a company holiday for the whole plan.                                |
+| `get_vacay_stats`          | Get vacation statistics for a specific year (days used, remaining, carried over).     |
+| `update_vacay_stats`       | Update the vacation day allowance for a specific user and year.                       |
+| `add_holiday_calendar`     | Add a public holiday calendar (by region code) to the vacation plan.                  |
+| `update_holiday_calendar`  | Update label or color for a holiday calendar.                                         |
+| `delete_holiday_calendar`  | Remove a holiday calendar from the vacation plan.                                     |
+| `list_holiday_countries`   | List countries available for public holiday calendars.                                |
+| `list_holidays`            | List public holidays for a country and year.                                          |
+
+### Journey _(Journey addon required)_
+
+| Tool                              | Description                                                                                                |
+|-----------------------------------|------------------------------------------------------------------------------------------------------------|
+| `list_journeys`                   | List all journeys owned or contributed to by the current user.                                             |
+| `get_journey`                     | Get a full snapshot of a journey: metadata, entries, contributors, and linked trips.                       |
+| `create_journey`                  | Create a new journey with title, optional subtitle, and an initial list of trip IDs.                       |
+| `update_journey`                  | Update a journey's title, subtitle, or status.                                                             |
+| `delete_journey`                  | Delete a journey.                                                                                          |
+| `add_journey_trip`                | Link an existing trip to a journey.                                                                        |
+| `remove_journey_trip`             | Remove a trip from a journey.                                                                              |
+| `list_journey_entries`            | List all entries in a journey (date, text, mood, linked trip).                                             |
+| `create_journey_entry`            | Add an entry to a journey with optional title, body text, date, linked trip, and sort order.               |
+| `update_journey_entry`            | Edit a journey entry's title, body, date, or mood.                                                         |
+| `delete_journey_entry`            | Remove an entry from a journey.                                                                            |
+| `reorder_journey_entries`         | Reorder entries in a journey by providing the new ordered list of entry IDs.                               |
+| `list_journey_contributors`       | List the contributors of a journey (owner and invited editors/viewers).                                    |
+| `add_journey_contributor`         | Invite a user to a journey with `editor` or `viewer` role.                                                 |
+| `update_journey_contributor_role` | Change a contributor's role between `editor` and `viewer`.                                                 |
+| `remove_journey_contributor`      | Remove a contributor from a journey.                                                                       |
+| `update_journey_preferences`      | Update display preferences for a journey (e.g. hide skeleton entries).                                     |
+| `get_journey_suggestions`         | Get suggested trips to add to journeys (based on recent trip history).                                     |
+| `list_journey_available_trips`    | List all trips available to the current user for linking to a journey.                                     |
+| `get_journey_share_link`          | Get the current public share link for a journey.                                                           |
+| `create_journey_share_link`       | Create or update the public share link for a journey.                                                      |
+| `delete_journey_share_link`       | Revoke the public share link for a journey.                                                                |
+
+---
+
+## Prompts
+
+MCP prompts are pre-built context loaders your AI client can invoke to get a structured starting point for common tasks.
+
+| Prompt               | Description                                                                     |
+|----------------------|---------------------------------------------------------------------------------|
+| `trip-summary`       | Load a formatted summary of a trip (dates, members, days, budget, packing, reservations) before planning or modifying it. |
+| `packing-list`       | Get a formatted packing checklist for a trip, grouped by category.              |
+| `budget-overview`    | Get a formatted budget summary with totals by category and per-person cost.     |
+| `token_auth_notice`  | Static token deprecation notice and migration guide. Only available in sessions authenticated with a legacy `trek_` token. |
+
+---
+
+## Example
+
+Conversation with Claude: https://claude.ai/share/51572203-6a4d-40f8-a6bd-eba09d4b009d
+
+Initial prompt (1st message):
+
+```
+I'd like to plan a week-long trip to Kyoto, Japan, arriving April 5 2027
+and leaving April 11 2027. It's cherry blossom season so please keep that
+in mind when picking spots.
+
+Before writing anything to TREK, do some research: look up what's worth
+visiting, figure out a logical day-by-day flow (group nearby spots together
+to avoid unnecessary travel), find a well-reviewed hotel in a central
+neighbourhood, and think about what kind of food and restaurant experiences
+are worth including.
+
+Once you have a solid plan, write the whole thing to TREK:
+- Create the trip
+- Add all the places you've researched with their real coordinates
+- Build out the daily itinerary with sensible visiting times
+- Book the hotel as a reservation and link it properly to the accommodation days
+- Add any notable restaurant reservations
+- Put together a realistic budget in EUR
+- Build a packing list suited to April in Kyoto
+- Leave a pinned collab note with practical tips (transport, etiquette, money, etc.)
+- Add a day note for each day with any important heads-up (early start, crowd
+  tips, booking requirements, etc.)
+- Mark Japan as visited in my Atlas
+
+Currency: CHF. Use get_trip_summary at the end and give me a quick recap
+of everything that was added.
+```
+
+PDF of the generated trip: [./docs/TREK-Generated-by-MCP.pdf](./docs/TREK-Generated-by-MCP.pdf)
+
+![trip](./docs/screenshot-trip-mcp.png)
@@ -5,9 +5,8 @@ TREK bundles and uses third-party data that requires attribution.
 ## geoBoundaries — country & sub-national boundaries

 The Atlas map's administrative boundaries (admin-0 countries and admin-1
-provinces/counties), shipped at `server/assets/atlas/admin0.geojson.gz`,
-`server/assets/atlas/admin1.geojson.gz` and `server/assets/atlas/admin1/<ISO_A2>.geojson.gz`
-(the same regions, one file per country) and generated by
+provinces/counties), shipped at `server/assets/atlas/admin0.geojson.gz` and
+`server/assets/atlas/admin1.geojson.gz` and generated by
 `server/scripts/build-atlas-geo.mjs`, are derived from **geoBoundaries**.

 > Runfola, D. et al. (2020) geoBoundaries: A global database of political
@@ -22,86 +21,13 @@ property names TREK consumes. Country borders (`admin0`) derive from the geoBoun
 CGAZ composite; sub-national regions (`admin1`) derive from the per-country open
 (gbOpen) release.

-## OpenStreetMap — geocoding, place details & descriptions
+## OpenStreetMap — geocoding

-Atlas reverse-geocodes places via the **Nominatim** service, and place search,
-details and descriptions come from Nominatim and **Overpass**. Data is
+Atlas reverse-geocodes places via the **Nominatim** service. Geocoding data is
 © OpenStreetMap contributors, licensed under the Open Database License (ODbL).
 https://www.openstreetmap.org/copyright

-## Wikimedia Commons & Wikipedia — place pictures & descriptions
-
-Pictures offered for a place come from **Wikimedia Commons** (geosearch by
-coordinate) and are cached locally rather than hotlinked. Descriptions can come
-from **Wikipedia**, resolved from the place's OpenStreetMap `wikipedia` tag.
-
-Commons files carry their own licence, most often **CC BY** or **CC BY-SA**. TREK
-shows the author, the licence and a link to the file description page next to
-every picture while it is being chosen, and keeps the author and licence with the
-cached file so the credit stays visible afterwards. Wikipedia article text is
-**CC BY-SA 4.0**. https://commons.wikimedia.org/wiki/Commons:Licensing
-
-## Google Places — optional place data
-
-When an administrator configures a Google Maps API key, place search, details,
-pictures and editorial summaries can also come from the **Google Places API**,
-subject to Google's terms. Photos carry the author attribution Google supplies
-and no reusable licence; TREK displays that attribution and claims nothing
-further. This path is off unless a key is configured, and each part of it has its
-own switch in the admin panel. https://cloud.google.com/maps-platform/terms
-
 ## OurAirports — airport reference data

 `server/assets/airports.json` is built from **OurAirports**
 (https://ourairports.com/data/), released into the public domain.
-
-## Typefaces: Studio books and the app
-
-Every typeface a book can be set in, and the app's own (Poppins, MuseoModerno,
-Geist), is self-hosted from the **@fontsource** npm packages, which redistribute
-the families published on Google Fonts split into subsets by script. The catalogue of book faces is
-`shared/src/book/book-fonts.data.ts`. Each package carries its licence and the
-copyright notice of the family's authors in its `LICENSE` file.
-
-Both licences allow a font to be bundled with software and embedded in a
-document made with it, so a printed or exported book may carry the faces it is
-set in. No family is renamed, redrawn or sold on its own. SIL OFL 1.1: https://openfontlicense.org. Apache 2.0:
-https://www.apache.org/licenses/LICENSE-2.0
-
-| Family | Package | Licence |
-|---|---|---|
-| Abril Fatface | `@fontsource/abril-fatface` | SIL Open Font License 1.1 |
-| Alfa Slab One | `@fontsource/alfa-slab-one` | SIL Open Font License 1.1 |
-| Allura | `@fontsource/allura` | SIL Open Font License 1.1 |
-| Anton | `@fontsource/anton` | SIL Open Font License 1.1 |
-| Archivo Black | `@fontsource/archivo-black` | SIL Open Font License 1.1 |
-| Bebas Neue | `@fontsource/bebas-neue` | SIL Open Font License 1.1 |
-| Big Shoulders Display | `@fontsource/big-shoulders-display` | SIL Open Font License 1.1 |
-| Bodoni Moda | `@fontsource/bodoni-moda` | SIL Open Font License 1.1 |
-| Bricolage Grotesque | `@fontsource/bricolage-grotesque` | SIL Open Font License 1.1 |
-| Caveat | `@fontsource/caveat` | SIL Open Font License 1.1 |
-| Cormorant Garamond | `@fontsource/cormorant-garamond` | SIL Open Font License 1.1 |
-| Dancing Script | `@fontsource/dancing-script` | SIL Open Font License 1.1 |
-| DM Mono | `@fontsource/dm-mono` | SIL Open Font License 1.1 |
-| DM Serif Display | `@fontsource/dm-serif-display` | SIL Open Font License 1.1 |
-| EB Garamond | `@fontsource/eb-garamond` | SIL Open Font License 1.1 |
-| Fraunces | `@fontsource/fraunces` | SIL Open Font License 1.1 |
-| Great Vibes | `@fontsource/great-vibes` | SIL Open Font License 1.1 |
-| Homemade Apple | `@fontsource/homemade-apple` | Apache License 2.0 |
-| Inter | `@fontsource/inter` | SIL Open Font License 1.1 |
-| Kaushan Script | `@fontsource/kaushan-script` | SIL Open Font License 1.1 |
-| League Gothic | `@fontsource/league-gothic` | SIL Open Font License 1.1 |
-| Lora | `@fontsource/lora` | SIL Open Font License 1.1 |
-| Montserrat | `@fontsource/montserrat` | SIL Open Font License 1.1 |
-| MuseoModerno | `@fontsource/museomoderno` | SIL Open Font License 1.1 |
-| Oswald | `@fontsource/oswald` | SIL Open Font License 1.1 |
-| Pacifico | `@fontsource/pacifico` | SIL Open Font License 1.1 |
-| Parisienne | `@fontsource/parisienne` | SIL Open Font License 1.1 |
-| Permanent Marker | `@fontsource/permanent-marker` | Apache License 2.0 |
-| Playfair Display | `@fontsource/playfair-display` | SIL Open Font License 1.1 |
-| Poppins | `@fontsource/poppins` | SIL Open Font License 1.1 |
-| Sacramento | `@fontsource/sacramento` | SIL Open Font License 1.1 |
-| Satisfy | `@fontsource/satisfy` | Apache License 2.0 |
-| Shrikhand | `@fontsource/shrikhand` | SIL Open Font License 1.1 |
-| Yellowtail | `@fontsource/yellowtail` | Apache License 2.0 |
-| Geist Sans | `@fontsource/geist-sans` | SIL Open Font License 1.1 |
@@ -1,14 +1,20 @@
 <div align="center">

 <picture>
-  <source media="(prefers-color-scheme: dark)" srcset="docs/logo-trek-light.svg" />
-  <source media="(prefers-color-scheme: light)" srcset="docs/logo-trek-dark.svg" />
-  <img src="docs/logo-trek-dark.svg" alt="TREK" height="96" />
+  <source media="(prefers-color-scheme: dark)" srcset="docs/logo-trek-light.gif" />
+  <source media="(prefers-color-scheme: light)" srcset="docs/logo-trek-dark.gif" />
+  <img src="docs/logo-trek-dark.gif" alt="TREK" height="96" />
 </picture>

-### Every part of your trip. One app you own.
+<br />

-TREK has grown from a travel planner into a whole ecosystem for trips: plan together in real time on a live map, build hikes, tours and road trips, keep bookings and shared costs in order, pack, write the journal, lay out the photo book and hand the busy work to the built-in AI. Self-hosted, on the web, on your phone and offline.
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/subtitle-light.png" />
+  <source media="(prefers-color-scheme: light)" srcset="docs/subtitle-dark.png" />
+  <img src="docs/subtitle-dark.png" alt="Your trips. Your plan. Your server." height="28" />
+</picture>
+
+A self-hosted, real-time collaborative travel planner — with maps, budgets, packing lists, a journal, and AI built in.

 <br />

@@ -16,192 +22,146 @@ TREK has grown from a travel planner into a whole ecosystem for trips: plan toge
 &nbsp;
 <a href="https://hub.docker.com/r/mauriceboe/trek"><img alt="Docker" src="https://img.shields.io/badge/Docker-ready-2496ED?style=for-the-badge" /></a>
 &nbsp;
-<a href="https://sonarcloud.io/project/overview?id=liketrek_TREK"><img alt="Sonar Quality Gate" src="https://img.shields.io/sonar/quality_gate/liketrek_TREK?server=https%3A%2F%2Fsonarcloud.io&style=for-the-badge" /></a>
-&nbsp;
-<img alt="GitHub Actions Workflow Status" src="https://img.shields.io/github/actions/workflow/status/liketrek/TREK/test.yml?branch=main&style=for-the-badge">
-&nbsp;
 <a href="https://discord.gg/NhZBDSd4qW"><img alt="Discord" src="https://img.shields.io/badge/Discord-join-5865F2?style=for-the-badge" /></a>
 &nbsp;
 <a href="https://kanban.pakulat.org/shared/I4wxF6inOOMB0C6hH6kQm3efyNxFjwyI"><img alt="Roadmap" src="https://img.shields.io/badge/Roadmap-view-0EA5E9?style=for-the-badge" /></a>
-&nbsp;
+<br />
 <a href="https://ko-fi.com/mauriceboe"><img alt="Ko-fi" src="https://img.shields.io/badge/Ko--fi-support-FF5E5B?style=for-the-badge" /></a>
 &nbsp;
 <a href="https://www.buymeacoffee.com/mauriceboe"><img alt="BMAC" src="https://img.shields.io/badge/BMAC-support-FFDD00?style=for-the-badge" /></a>
-&nbsp;
-<a href="LICENSE"><img alt="License" src="https://img.shields.io/badge/License-AGPL_v3-6B7280?style=for-the-badge" /></a>
-&nbsp;
-<a href="https://github.com/liketrek/TREK/releases"><img alt="Latest Release" src="https://img.shields.io/github/v/release/liketrek/trek?include_prereleases&style=for-the-badge&label=Release&color=6B7280" /></a>
-&nbsp;
-<a href="https://hub.docker.com/r/mauriceboe/trek"><img alt="Docker Pulls" src="https://img.shields.io/docker/pulls/mauriceboe/trek?style=for-the-badge&label=Docker%20pulls&color=6B7280" /></a>
-&nbsp;
-<a href="https://github.com/liketrek/TREK"><img alt="Stars" src="https://img.shields.io/github/stars/liketrek/trek?style=for-the-badge&label=Stars&color=6B7280" /></a>
+<br />
+<a href="LICENSE"><img alt="License" src="https://img.shields.io/badge/license-AGPL_v3-6B7280?style=flat-square" /></a>
+<a href="https://github.com/mauriceboe/TREK/releases"><img alt="Latest Release" src="https://img.shields.io/github/v/release/mauriceboe/TREK?include_prereleases&style=flat-square&color=6B7280" /></a>
+<a href="https://hub.docker.com/r/mauriceboe/trek"><img alt="Docker Pulls" src="https://img.shields.io/docker/pulls/mauriceboe/trek?style=flat-square&color=6B7280" /></a>
+<a href="https://github.com/mauriceboe/TREK"><img alt="Stars" src="https://img.shields.io/github/stars/mauriceboe/TREK?style=flat-square&color=6B7280" /></a>

-<sub>PUBLIC SERVICES PROUDLY SPONSORED BY</sub><br /><a href="https://cloud.dataforest.net/en?mtm_campaign=trek"><picture><source media="(prefers-color-scheme: dark)" srcset="docs/sponsors/dataforest-light.svg" /><source media="(prefers-color-scheme: light)" srcset="docs/sponsors/dataforest-dark.svg" /><img src="docs/sponsors/dataforest-dark.svg" alt="dataforest cloud" height="30" /></picture></a>
 </div>

 ---

 <div align="center">

-<img src="https://github.com/mauriceboe/trek-media/releases/download/readme-assets/TREK2.webp" alt="TREK, a tour of the app" width="100%" />
+<img src="https://github.com/mauriceboe/trek-media/releases/download/readme-assets/TREK1.gif" alt="TREK — 60-second tour" width="100%" />

 </div>

 <br />

+<div align="center">
+  <a href="docs/screenshots/dashboard.png"><img src="docs/screenshots/dashboard.png" alt="Dashboard" width="49%" /></a>
+  <a href="docs/screenshots/trip-planner.png"><img src="docs/screenshots/trip-planner.png" alt="Trip planner · day plan & route" width="49%" /></a>
+  <a href="docs/screenshots/journey.png"><img src="docs/screenshots/journey.png" alt="Journey journal" width="49%" /></a>
+  <a href="docs/screenshots/budget.png"><img src="docs/screenshots/budget.png" alt="Costs · expense splitting" width="49%" /></a>
+  <a href="docs/screenshots/atlas.png"><img src="docs/screenshots/atlas.png" alt="Atlas · visited countries" width="49%" /></a>
+  <a href="docs/screenshots/vacay.png"><img src="docs/screenshots/vacay.png" alt="Vacay planner" width="49%" /></a>
+  <a href="docs/screenshots/collections.png"><img src="docs/screenshots/collections.png" alt="Collections · saved place lists" width="49%" /></a>
+  <a href="docs/screenshots/admin.png"><img src="docs/screenshots/admin.png" alt="Admin panel" width="49%" /></a>
+</div>
+
+---
+
 ## What you get

 <picture>
  <source media="(max-width: 700px)" srcset="docs/tiles/grid-mobile.svg" />
-  <source media="(prefers-color-scheme: dark)" srcset="docs/tiles/grid-desktop-dark.svg" />
-  <img src="docs/tiles/grid-desktop.svg" alt="Plan, track, share" width="100%" />
+  <img src="docs/tiles/grid-desktop.svg" alt="TREK feature tiles" width="100%" />
 </picture>

 <details>
 <summary><b>See all features</b></summary>

-<br />
-
-Most of what follows is an addon an admin switches on or off. Lists, Costs, Documents, Collab, Tours, Vacay and Atlas ship on; Journey, Collections, MCP, the AI assistant, AI Parsing, Road trip, Dawarich and AirTrail ship off and are marked below.
-
 <table>
 <tr>
 <td width="50%" valign="top">

-#### 🧭 Planning
+#### 🧭 Trip planning

- **Day plans**: drag places, notes and bookings between days with undo, or drop a map marker straight onto a day
- **Maps**: Leaflet, Mapbox GL or MapLibre GL (OpenFreeMap, no token) with clustering, photo markers, route lines and a whole-trip route overview
- **Places**: search the TREK Places index and OpenStreetMap with no key, or Google Places and Amap with one. Descriptions, hours and photos from Wikipedia, Wikidata and Wikimedia Commons, plus a rating and a custom image per place
- **Explore**: nearby places by category for the map view, from the TREK Places index with Overpass as fallback
- **Routes**: auto-sort a day (nearest neighbour then 2-opt, locked stops and hotels stay put), a travel mode per leg over OSRM or Valhalla, then open the day in Google Maps or CoMaps and a place in seven navigation apps
- **Public transport**: door-to-door itineraries over Transitous, or Google where Transitous has no data
- **Import and export**: Google Maps and Naver Maps lists, Google Maps directions links, GPX, KML and KMZ in; GPX and an ICS feed per trip or across all trips out
- **Weather**: 16-day forecast from Open-Meteo, no key, and the archive for dates beyond it
- **Trip dates**: move a trip and its days re-date themselves, with the bookings along or re-anchored. Trips also copy and archive
- **Road trip** (off by default): drives with stops, day windows and arrival times that recompute, route alternatives, hazards and EV charging with range
+- **Drag & drop planner** — organise places into day plans with reordering and cross-day moves
+- **Interactive map** — Leaflet or Mapbox GL with 3D buildings, terrain, photo markers, clustering, route visualization
+- **Place search** — Google Places (photos, ratings, hours) or OpenStreetMap (free, no API key)
+- **Place import** — shared Google Maps / Naver Maps lists, plus GPX and KML/KMZ/GeoJSON map files
+- **Day notes** — timestamped, icon-tagged notes with drag-and-drop reordering
+- **Route optimisation** — auto-sort places and export to Google Maps
+- **Weather forecasts** — 16-day via Open-Meteo (no key) + historical climate fallback
+- **Category filter** — show only matching pins on the map

 </td>
 <td width="50%" valign="top">

-#### 🥾 Tours
+#### 🧳 Travel management

- **Seven tour types**: hike, city walk, run, bike (touring, road, gravel, MTB), paddle (kayak, canoe, SUP), horse ride, and ski and winter (alpine, cross-country, touring, snowshoe, winter hike)
- **Routing**: legs routed over Valhalla with shaping points, hand-drawn legs, route variants, round hikes of a wished length and trip places as stops, all with undo
- **Hikes**: routed within a maximum SAC grade (T1 to T6), the trail grades along the way, and via ferratas on the map
- **Terrain**: elevation profile, ascent and descent, and a 3D terrain map with grade colouring and a flyover, no token needed. Topo, hiking, cycling and satellite bases with sea marks and ski pistes as overlays
- **Multi-day tours**: one route cut into stages and spread across the trip's days
- **Along the way**: viewpoints, huts, water, food and more within a corridor of the route, inserted as a stop with the detour it adds
- **Ski, paddle and city walks**: a piste router by difficulty and lift type; a water router with portages, locks and a wind forecast; city walks with stays, opening hours and transit between stops
- **Plan against reality**: link a recorded GPX to a planned day and compare distance, ascent and time. Import trails from a wanderer instance, save tours to a collection and take them into another trip
+- **Reservations** — flights, accommodations, restaurants with status, confirmation numbers, files; import from booking confirmation emails and PDFs ([KDE Itinerary](https://invent.kde.org/pim/kitinerary))
+- **Costs** — track and split trip expenses (Splitwise-style): per-person / per-day breakdowns, settle-up, multi-currency
+- **Packing lists** — categories, templates, user assignment, progress tracking
+- **Bag tracking** — optional weight tracking with iOS-style distribution
+- **Document manager** — attach docs, tickets, PDFs to trips / places / reservations (≤ 50 MB each)
+- **PDF export** — full trip plan as PDF with cover page, images, notes

 </td>
 </tr>
 <tr>
 <td width="50%" valign="top">

-#### 🧳 Bookings and money
-
- **Reservations**: 18 booking types with status, confirmation code, travellers and attached files
- **Flights and trains**: several legs with stopovers and endpoint timezones, against 4,045 bundled airports so local times resolve without a key
- **Accommodation**: a stay spans a range of nights with a check-in window
- **Booking import**: EML, PDF, PKPass, HTML, TXT and photos of confirmations, through [KItinerary](https://invent.kde.org/pim/kitinerary) or an AI model, with a review step before anything is saved. Prices become linked costs
- **AirTrail** (off by default): import flights from a self-hosted AirTrail instance and keep them in sync
- **Costs**: split in integer cents with equal or custom shares, several payers, settle-up suggestions, a per-person summary, a settlement log and CSV export. A receipt photo can fill in an expense
- **Currencies**: one per expense with the rate frozen at entry, from Frankfurter with no key
- **Packing lists and to-dos**: categories, templates, assignees and visibility tiers; bags with weights as an admin switch; to-dos with due dates, priorities and reminders
- **Files**: attach to a trip, place, day or booking, 50 MB each and 500 MB for video, with trash and restore
- **PDF export**: cover, place photos, day notes, bookings and costs, with an optional page break per day
-
-</td>
-<td width="50%" valign="top">
-
 #### 👥 Collaboration

- **Real-time sync** (WebSocket): edits land live for everyone who has the trip open
- **Members**: add by email or username, hand over ownership, or add guests who have no login at all
- **Permissions**: an admin maps each of 17 trip actions to admin, trip owner, trip member or everybody
- **Invites**: one reusable link per trip with an optional expiry, and admin signup invites that drop a new account straight into a trip
- **Public share**: a read-only trip page without an account, with switches for map, bookings, packing, costs and chat
- **Collab**: group chat with replies, reactions and link previews, shared notes, links, polls and a What's Next list, each one its own switch
- **Notifications**: an inbox grouped by day with answers right from the notification, and a per-user matrix of events against in-app, email, webhook, ntfy, Web Push and plugin channels
+- **Real-time sync** — WebSocket. Changes appear instantly across all connected users
+- **Multi-user trips** — invite members with role-based access
+- **Invite links** — one-time or reusable links with expiry
+- **SSO (OIDC)** — Google, Apple, Authentik, Keycloak, or any OIDC provider
+- **2FA** — TOTP + backup codes
+- **Passkeys** — passwordless WebAuthn login (fingerprint / face / PIN / security key), admin-toggleable
+- **Collab suite** — group chat, shared notes, polls, day check-ins
+
+</td>
+<td width="50%" valign="top">
+
+#### 📱 Mobile & PWA
+
+- **Installable** — iOS and Android, straight from the browser, no App Store needed
+- **Offline support** — Service Worker caches tiles, API, uploads via Workbox
+- **Native feel** — fullscreen standalone, themed status bar, splash screen
+- **Touch optimised** — mobile-specific layouts with safe-area handling

 </td>
 </tr>
 <tr>
 <td width="50%" valign="top">

-#### 📔 Journey and TREK Studio
+#### 🧩 Addons (admin-toggleable)

- **Journey** (off by default): dated entries with story, mood, weather and tags, photos and video from uploads, [Immich](https://immich.app) or Synology Photos, map views, co-authors, drafts and a public share link
- **Linked journal**: a trip can show one journal as its own, with the members picked on the trip as viewers or editors
- **Recorded days** (with Dawarich): keep a day's recorded route and turn its stays into entries
- **TREK Studio**: turn a journal into a printable photo book. 34 print-licensed typefaces, 17 themes, 108 designed pages in twelve styles, 160 recolourable stickers, text effects, layers and a Travel tab with route maps, country stamps and trip figures
- **Auto layout**: lays the whole book on the designed pages in the style of its theme, every photo in a frame, or rebuilds one spread
- **Print and share**: PDF export as pages or spreads with crop marks, several people editing at once, and design files to move a spread into another book
+- **Lists** — packing lists + to-dos with templates, member assignments, optional bag tracking
+- **Costs** — expense tracker with splits and settle-up (who owes whom), multi-currency
+- **Documents** — file attachments on trips, places, and reservations
+- **Collab** — chat, notes, polls, day-by-day attendance
+- **Vacay** — personal vacation planner with calendar, 100+ country holidays, carry-over tracking
+- **Atlas** — world map of visited countries, bucket list, travel stats, streak tracking, liquid-glass UI
+- **Journey** — magazine-style travel journal with entries, photos (Immich/Synology), maps, moods
+- **AirTrail** — connect a self-hosted AirTrail instance to import and sync flights into reservations
+- **MCP** — expose TREK to AI assistants via OAuth 2.1

 </td>
 <td width="50%" valign="top">

-#### 🗺️ Atlas, Vacay and Collections
+#### 🤖 AI / MCP

- **Atlas**: countries and regions visited on [geoBoundaries](https://www.geoboundaries.org/) outlines, a bucket list, travel stats, and a tour activities tab with planned against recorded totals
- **Vacay**: leave calendar with half days, public holidays from date.nager.at, school holidays for 16 European countries, company holidays, carry-over between years, and joint or read-only sharing
- **Collections** (off by default): a place library outside any trip with lists, labels, ratings, a status per place, cover images, GPX and file export, copy into a trip, and sharing by invite
- **Dawarich** (off by default): link a Dawarich instance for recorded tracks, suggested stays and countries for the Atlas
+- **Built-in MCP server** — OAuth 2.1 authenticated. 150+ tools, 30 resources
+- **Granular scopes** — 27 OAuth scopes across 13 permission groups
+- **Full automation** — AI can create trips, plan days, build packing lists, manage budgets, mark countries visited
+- **Pre-built prompts** — `trip-summary`, `packing-list`, `budget-overview`
+- **Addon-aware** — exposes Atlas, Collab, Vacay when those addons are on

 </td>
 </tr>
 <tr>
-<td width="50%" valign="top">
+<td colspan="2" valign="top">

-#### 🤖 AI assistant and MCP
+#### ⚙️ Admin & customisation

- **AI assistant** (off by default): a chat that plans with you in a trip, across all your trips, in a journal and in Studio, and works with tours, costs, bookings, packing, Vacay and the Atlas
- **Your own model**: an API key for Anthropic, OpenAI, Gemini or OpenRouter, a ChatGPT plan, or any OpenAI-compatible endpoint, set for the instance or per user
- **You stay in charge**: reads run at once, every change waits as a card to apply or discard and can be undone for 15 minutes. Nothing leaves before you agree to the provider, and a file's text only with your consent
- **Attachments**: drop a booking confirmation, a GPX file or a photo into the chat, and the assistant offers what to do with it
- **MCP server** (off by default): OAuth 2.1 with mandatory PKCE and dynamic client registration, 410 tools, 30 resources and 4 prompts, 35 scopes in 17 groups ticked on the consent screen, and every call in the audit log
- **Addon-aware**: twelve addon gates decide which tools a session sees, and flipping one re-registers live sessions
-
-</td>
-<td width="50%" valign="top">
-
-#### 🧩 Plugins
-
- **Third-party plugins**: install from the TREK registry or sideload a zip, with their own pages under `/plugins/<id>`
- **Sandboxed**: one child process per plugin, 66 grantable permissions, an admin-edited outbound host allowlist, memory and call caps
- **Trust**: registry downloads are pinned by sha256 and checked against the author's minisign key, a sideloaded zip is marked unverified, and `TREK_PLUGINS_ENABLED=false` turns the whole system off
- **Extension points**: map layers, place details, day schedules, PDF sections, Atlas layers, journal rows, trip warnings, search and photo providers, route profiles, notification channels and MCP tools
- **SDK**: [`trek-plugin-sdk`](https://www.npmjs.com/package/trek-plugin-sdk) with a CLI to create, validate, run against real data, sign and publish
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-#### 📱 Mobile and offline
-
- **Apps**: TREK Travel Planner for iPhone, iPad and Android connects to any TREK server, and the browser installs TREK as a standalone app with a themed status bar too
- **Phone layouts**: their own screens for every part of the app, with a bottom bar and dashboard widgets the user orders
- **Offline reads**: the app shell is precached and trips, places, tours, files and nearby places live in a per-user IndexedDB store, so a trip opens with no network
- **Offline writes**: changes queue and replay with an `X-Idempotency-Key`, and a stale edit waits for a keep-mine or keep-theirs choice
- **Offline maps**: raster and vector tiles of a trip downloaded ahead, and a switch that takes the whole app offline on purpose
-
-</td>
-<td width="50%" valign="top">
-
-#### ⚙️ Admin, accounts and security
-
- **Sign-in**: password, OIDC and passkeys each switch on and off on their own, `OIDC_ONLY` leaves SSO as the only way in, and an OIDC claim can grant admin
- **SSO and 2FA**: one OIDC provider by discovery with PKCE (Authentik, Keycloak, Google and the like), TOTP with backup codes that an admin can require, and passkeys that count as the second factor
- **Sessions**: every sign-in is a session you can see and end, one by one or all others at once
- **Hardening**: rate limits on sign-in, reset and 2FA, a password policy, secrets encrypted at rest and masked on read, and an SSRF guard on every URL you configure
- **Admin panel**: users and the permission matrix, defaults for new users, categories and templates, addons, plugins, storage, notifications, MCP tokens, backups, audit log and releases
- **Backups and storage**: scheduled backups with retention that restore their own secrets, and local or S3-compatible storage per content category with replicas
- **Appearance**: light, dark or follow the OS, seven colour schemes plus a custom accent, transparency, density, reduced motion and text size
- **28 languages**: en, de, es, fr, it, nl, hu, ru, zh, zh-TW, pl, cs, ar (right to left), he (right to left), br, id, tr, ja, ko, uk, gr, sv, vi, ca, az, et, sk, th
- **Help center**: a ? in the top bar with 381 step-by-step guides with screenshots, searched together with the wiki that ships in the image
+- **Dashboard views** — card grid or compact list · **Dark mode** — full theme with matching status bar
+- **20 languages** — EN, DE, ES, FR, IT, NL, HU, RU, ZH, ZH-TW, PL, CS, AR (RTL), BR, ID, TR, JA, KO, UK, GR
+- **Admin panel** — users, invites, packing templates, categories, addons, API keys, backups, GitHub history
+- **Notifications** — per-user preferences across email (SMTP), webhook, ntfy, and an in-app notification center
+- **Auto-backups** — scheduled with configurable retention · **Units** — °C/°F, 12h/24h, map tile sources, default coordinates

 </td>
 </tr>
@@ -211,77 +171,19 @@ Most of what follows is an addon an admin switches on or off. Lists, Costs, Docu

 <br />

-<div align="center">
-  <a href="docs/screenshots/showcase-desktop-1.webp"><img src="docs/screenshots/showcase-desktop-1.webp" alt="Atlas · dashboard · trip planner" width="100%" /></a>
-  <a href="docs/screenshots/showcase-mobile.webp"><img src="docs/screenshots/showcase-mobile.webp" alt="Mobile PWA · dashboard, day plan, map, costs" width="100%" /></a>
-</div>
-
-<br />
-
-## Powered by [dataforest cloud](https://cloud.dataforest.net/en?mtm_campaign=trek)
-
-<div align="center">
-
-<br />
-
-<a href="https://cloud.dataforest.net/en?mtm_campaign=trek">
-  <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="docs/sponsors/dataforest-light.svg" />
-    <source media="(prefers-color-scheme: light)" srcset="docs/sponsors/dataforest-dark.svg" />
-    <img src="docs/sponsors/dataforest-dark.svg" alt="dataforest cloud" height="60" />
-  </picture>
-</a>
-
-<br />
-<br />
-
-**Every TREK installation in the world searches through servers that [dataforest cloud](https://cloud.dataforest.net/en?mtm_campaign=trek) sponsors.**
-
-The place index with over 88 million places, the address search in every TREK language and the planet-wide routing all run on [dataforest cloud](https://cloud.dataforest.net/en?mtm_campaign=trek) in Frankfurt, Germany, free of charge for everyone who self-hosts TREK. Without this sponsorship, these services would not exist in this form.
-
-Thank you, [dataforest](https://cloud.dataforest.net/en?mtm_campaign=trek), for backing open source this generously. 💚
-
-<br />
-
-<a href="https://cloud.dataforest.net/en?mtm_campaign=trek"><img alt="Visit dataforest cloud" src="https://img.shields.io/badge/Visit-dataforest_cloud-02C382?style=for-the-badge" /></a>
-
-Looking for a server for your own TREK? [dataforest cloud](https://cloud.dataforest.net/en?mtm_campaign=trek) is where TREK's own services live.
-
-</div>
-
-<br />
-
-## AI usage
-
-We use LLM-assisted coding tools across parts of this codebase. Nothing ships that a
-maintainer has not read and understood: every change goes through a pull request, is
-reviewed and tested, and has a human who can answer for it. "The AI wrote that" is not
-an answer any of us would accept from ourselves.
-
-See [**How we use AI in TREK**](https://github.com/liketrek/TREK/discussions/1851) for
-the details.
-
-<br />
-
 ## Get started in 30 seconds

 ```bash
-ENCRYPTION_KEY=$(openssl rand -hex 32) docker run -d --name trek -p 3000:3000 \
+ENCRYPTION_KEY=$(openssl rand -hex 32) docker run -d -p 3000:3000 \
  -e ENCRYPTION_KEY=$ENCRYPTION_KEY \
-  -e COOKIE_SECURE=false \
  -v ./data:/app/data -v ./uploads:/app/uploads mauriceboe/trek
 ```

-Open `http://localhost:3000`, or `http://<server-ip>:3000` from another machine. On first boot TREK seeds an admin account — if you set `ADMIN_EMAIL`/`ADMIN_PASSWORD` those are used, otherwise the credentials are printed to the container log (`docker logs trek`).
-
-`COOKIE_SECURE=false` is only for trying TREK over plain HTTP: without it the browser drops the session cookie and the login does not stick. Once TREK sits behind HTTPS (see [Reverse Proxy](#reverse-proxy)), remove it.
-
-> [!TIP]
-> **No server yet?** TREK's own public services run on [**dataforest cloud**](https://cloud.dataforest.net/en?mtm_campaign=trek), our infrastructure sponsor. A small seed is plenty for a TREK instance and is ready within a minute.
+Open `http://localhost:3000`. On first boot TREK seeds an admin account — if you set `ADMIN_EMAIL`/`ADMIN_PASSWORD` those are used, otherwise the credentials are printed to the container log (`docker logs trek`).

 <div align="center">

-<a href="#docker-compose-production">Docker Compose</a>&nbsp;&nbsp;·&nbsp;&nbsp;<a href="#helm-kubernetes">Helm / Kubernetes</a>&nbsp;&nbsp;·&nbsp;&nbsp;<a href="#install-as-app-pwa">Install as PWA</a>&nbsp;&nbsp;·&nbsp;&nbsp;<a href="#reverse-proxy">Reverse Proxy</a>
+&nbsp;&nbsp;·&nbsp;&nbsp;<a href="#docker-compose-production">Docker Compose</a>&nbsp;&nbsp;·&nbsp;&nbsp;<a href="#helm-kubernetes">Helm / Kubernetes</a>&nbsp;&nbsp;·&nbsp;&nbsp;<a href="#install-as-app-pwa">Install as PWA</a>&nbsp;&nbsp;·&nbsp;&nbsp;<a href="#reverse-proxy">Reverse Proxy</a>&nbsp;&nbsp;·&nbsp;&nbsp;

 </div>

@@ -291,7 +193,7 @@ Open `http://localhost:3000`, or `http://<server-ip>:3000` from another machine.

 <div align="center">

-![Node.js](https://img.shields.io/badge/Node.js_24-339933?style=flat-square&logo=node.js&logoColor=white)
+![Node.js](https://img.shields.io/badge/Node.js_22-339933?style=flat-square&logo=node.js&logoColor=white)
 ![NestJS](https://img.shields.io/badge/NestJS_11-E0234E?style=flat-square&logo=nestjs&logoColor=white)
 ![SQLite](https://img.shields.io/badge/SQLite-003B57?style=flat-square&logo=sqlite&logoColor=white)
 ![React](https://img.shields.io/badge/React_19-61DAFB?style=flat-square&logo=react&logoColor=black)
@@ -309,33 +211,80 @@ Real-time sync via WebSocket (`ws`). Backend on NestJS 11. State with Zustand. A

 <h2 id="docker-compose-production">Docker Compose (production)</h2>

-The repository ships a ready-to-use [`docker-compose.yml`](docker-compose.yml)
-with secure defaults and every option documented inline. Download it, then:
+<details>
+<summary>Full compose example with secure defaults</summary>
+
+```yaml
+services:
+  app:
+    image: mauriceboe/trek:latest
+    container_name: trek
+    read_only: true
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    cap_add:
+      - CHOWN
+      - SETUID
+      - SETGID
+    tmpfs:
+      - /tmp:noexec,nosuid,size=64m
+    ports:
+      - "3000:3000"
+    environment:
+      - NODE_ENV=production
+      - PORT=3000
+      - ENCRYPTION_KEY=${ENCRYPTION_KEY:-}   # generate with: openssl rand -hex 32
+      - TZ=${TZ:-UTC}
+      - LOG_LEVEL=${LOG_LEVEL:-info}
+      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-}
+      - APP_URL=${APP_URL:-}                 # required for OIDC + email links
+      # - FORCE_HTTPS=true                   # behind a TLS-terminating proxy
+      # - TRUST_PROXY=1
+      # - OIDC_ISSUER=https://auth.example.com
+      # - OIDC_CLIENT_ID=trek
+      # - OIDC_CLIENT_SECRET=supersecret
+      # - OIDC_DISPLAY_NAME=SSO
+      # - OIDC_ADMIN_CLAIM=groups
+      # - OIDC_ADMIN_VALUE=app-trek-admins
+    volumes:
+      - ./data:/app/data
+      - ./uploads:/app/uploads
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
+```
+
+Then:

 ```bash
 docker compose up -d
 ```

-See [Install with Docker Compose](https://github.com/liketrek/TREK/wiki/Install-Docker-Compose)
-for the full walkthrough.
+**HTTPS notes:** `FORCE_HTTPS=true` is optional — it adds a 301 redirect, HSTS, CSP upgrade-insecure-requests, and forces the `secure` cookie flag. Only use it behind a TLS-terminating reverse proxy. `TRUST_PROXY=1` tells the server how many proxies sit in front so real client IPs and `X-Forwarded-Proto` work.
+
+</details>

 <br />

 <h2 id="helm-kubernetes">Helm (Kubernetes)</h2>

 ```bash
-helm repo add trek https://chart.liketrek.com
+helm repo add trek https://mauriceboe.github.io/TREK
 helm repo update
 helm install trek trek/trek
 ```

-See [`charts/README.md`](https://github.com/liketrek/TREK/blob/main/charts/README.md) for values.
-
-<br />
+See [`charts/README.md`](https://github.com/mauriceboe/TREK/blob/main/charts/README.md) for values.

 <h2 id="install-as-app-pwa">Install as App (PWA)</h2>

-TREK works as a Progressive Web App, and the TREK Travel Planner app for iPhone, iPad and Android connects to the same server ([Native Apps](https://github.com/liketrek/TREK/wiki/Native-Apps)). To install the web app instead:
+TREK works as a Progressive Web App — no App Store needed.

 1. Open TREK in the browser (HTTPS required)
 2. **iOS**: Share ▸ *Add to Home Screen*
@@ -347,17 +296,41 @@ TREK then launches fullscreen with its own icon, just like a native app.

 ## Updating

-See [Updating](https://github.com/liketrek/TREK/wiki/Updating) — Docker Compose,
-Docker run, Helm, Portainer, Unraid and Proxmox, plus the encryption-key note.
+**Docker Compose:**

-<br />
+```bash
+docker compose pull && docker compose up -d
+```
+
+**Docker run** — reuse the original volume paths:
+
+```bash
+docker pull mauriceboe/trek
+docker rm -f trek
+docker run -d --name trek -p 3000:3000 -v ./data:/app/data -v ./uploads:/app/uploads --restart unless-stopped mauriceboe/trek
+```
+
+> Not sure which paths you used? `docker inspect trek --format '{{json .Mounts}}'` before removing the container.
+
+Your data stays in the mounted `data` and `uploads` volumes — updates never touch it.
+
+> [!IMPORTANT]
+> Mount **only** the data and uploads directories — `-v ./data:/app/data -v ./uploads:/app/uploads`. **Never mount a volume at `/app`.** Doing so hides the application code shipped in the image and the container fails to start with `Cannot find module 'tsconfig-paths/register'`. If you previously mounted `/app`, switch to the two mounts above; your data in `data/` and `uploads/` is preserved.
+
+<h3>Rotating the Encryption Key</h3>
+
+If you need to rotate `ENCRYPTION_KEY` (e.g. upgrading from a version that derived encryption from `JWT_SECRET`):
+
+```bash
+docker exec -it trek node --import tsx scripts/migrate-encryption.ts
+```
+
+The script creates a timestamped DB backup before making changes and prompts for old + new keys (input is not echoed).

 <h2 id="reverse-proxy">Reverse Proxy</h2>

 For production, put TREK behind a TLS-terminating reverse proxy. TREK uses WebSockets for real-time sync, so the proxy **must** support WebSocket upgrades on `/ws`.

-If you use the MCP addon, the proxy must also pass the `Mcp-Session-Id` header through in both directions on `/mcp` — Nginx and Caddy do this by default, but a proxy that strips it makes every tool call open a new session instead of reusing one. See the [Reverse Proxy wiki page](https://github.com/liketrek/TREK/wiki/Reverse-Proxy) for details.
-
 <details>
 <summary>Nginx</summary>

@@ -395,19 +368,6 @@ server {
        proxy_set_header Host $host;
        proxy_read_timeout 86400;
    }
-
-    # Only needed if you use the MCP addon. Responses are Server-Sent Events,
-    # so buffering must be off or tool results arrive late.
-    location /mcp {
-        proxy_pass http://localhost:3000;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_buffering off;
-        proxy_read_timeout 3600s;
-    }
 }
 ```

@@ -430,8 +390,60 @@ Caddy handles TLS and WebSockets automatically.

 ## Environment variables

-Every variable, its default and what it does: see
-[Environment Variables](https://github.com/liketrek/TREK/wiki/Environment-Variables).
+<details>
+<summary><b>Full reference</b></summary>
+
+<br />
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| **Core** | | |
+| `PORT` | Server port | `3000` |
+| `NODE_ENV` | Environment (`production` / `development`) | `production` |
+| `ENCRYPTION_KEY` | At-rest encryption key for stored secrets (API keys, MFA, SMTP, OIDC). Recommended: generate with `openssl rand -hex 32`. If unset, falls back to `data/.jwt_secret` (existing installs) or auto-generates a key (fresh installs). | Auto |
+| `TZ` | Timezone for logs, reminders and cron jobs (e.g. `Europe/Berlin`) | `UTC` |
+| `LOG_LEVEL` | `info` = concise user actions, `debug` = verbose details | `info` |
+| `DEFAULT_LANGUAGE` | Default language on the login page for users with no saved preference. Browser/OS language is auto-detected first; this is the fallback. Supported: `de`, `en`, `es`, `fr`, `hu`, `nl`, `br`, `cs`, `pl`, `ru`, `zh`, `zh-TW`, `it`, `ar`, `id`, `tr`, `ja`, `ko`, `uk`, `gr` | `en` |
+| `ALLOWED_ORIGINS` | Comma-separated origins for CORS and email links | same-origin |
+| `FORCE_HTTPS` | Optional. When `true`: 301-redirects HTTP to HTTPS, sends HSTS, adds CSP `upgrade-insecure-requests`, forces the session cookie `secure` flag. Useful behind a TLS-terminating reverse proxy. Requires `TRUST_PROXY`. | `false` |
+| `HSTS_INCLUDE_SUBDOMAINS` | When `true`: adds the `includeSubDomains` directive to the HSTS header, extending HTTPS enforcement to all subdomains. Only effective when HSTS is active (`FORCE_HTTPS=true` or `NODE_ENV=production`). Leave `false` if you run other services on sibling subdomains over plain HTTP. | `false` |
+| `COOKIE_SECURE` | Controls the `secure` flag on the `trek_session` cookie. Auto-derived: on when `NODE_ENV=production` or `FORCE_HTTPS=true`. Escape hatch: set `false` to allow session cookies over plain HTTP. Not recommended in production. | auto |
+| `SESSION_DURATION` | How long a login session stays valid when **"Remember me" is unchecked** (the default): sets the `trek_session` JWT `exp` and issues a browser-session cookie (cleared when the browser closes). Accepts `ms`-style strings: `1h`, `12h`, `7d`, `30d`, `90d`. Invalid values warn at startup and fall back to the default. | `24h` |
+| `SESSION_DURATION_REMEMBER` | Session length when **"Remember me" is ticked** at login: a longer-lived JWT plus a persistent `trek_session` cookie that survives browser restarts. Same format and startup-fallback behaviour as `SESSION_DURATION`. | `30d` |
+| `TRUST_PROXY` | Number of trusted reverse proxies. Tells the server to read client IP from `X-Forwarded-For` and protocol from `X-Forwarded-Proto`. Defaults to `1` in production; off in dev unless set. | `1` |
+| `ALLOW_INTERNAL_NETWORK` | Allow outbound requests to private/RFC-1918 IPs (e.g. Immich on your LAN). Loopback and link-local addresses remain blocked. | `false` |
+| `APP_URL` | Public base URL of this instance (e.g. `https://trek.example.com`). Required when OIDC is enabled; used as base for email notification links. | — |
+| **OIDC / SSO** | | |
+| `OIDC_ISSUER` | OpenID Connect provider URL | — |
+| `OIDC_CLIENT_ID` | OIDC client ID | — |
+| `OIDC_CLIENT_SECRET` | OIDC client secret | — |
+| `OIDC_DISPLAY_NAME` | Label shown on the SSO login button | `SSO` |
+| `OIDC_ONLY` | Force SSO-only mode: disables password login + registration, regardless of Admin > Settings. The first SSO login becomes admin. | `false` |
+| `OIDC_ADMIN_CLAIM` | OIDC claim used to identify admin users | — |
+| `OIDC_ADMIN_VALUE` | Value of the OIDC claim that grants admin role | — |
+| `OIDC_SCOPE` | Space-separated OIDC scopes. **Fully replaces** the default — always include `openid email profile`. | `openid email profile` |
+| `OIDC_DISCOVERY_URL` | Override the auto-constructed OIDC discovery endpoint (e.g. Authentik: `.../application/o/trek/.well-known/openid-configuration`) | — |
+| **Initial setup** | | |
+| `ADMIN_EMAIL` | Email for the first admin on initial boot. Must be set together with `ADMIN_PASSWORD`. If either is omitted a random password is printed to the server log. No effect once a user exists. | `admin@trek.local` |
+| `ADMIN_PASSWORD` | Password for the first admin on initial boot. Pairs with `ADMIN_EMAIL`. | random |
+| **Other** | | |
+| `DEMO_MODE` | Enable demo mode (hourly data resets) | `false` |
+| `MCP_RATE_LIMIT` | Max MCP API requests per user per minute | `300` |
+| `MCP_MAX_SESSION_PER_USER` | Max concurrent MCP sessions per user | `20` |
+
+</details>
+
+<br />
+
+## Data & Backups
+
+- **Database** — SQLite, stored in `./data/travel.db`
+- **Uploads** — stored in `./uploads/`
+- **Logs** — `./data/logs/trek.log` (auto-rotated)
+- **Backups** — create and restore via Admin Panel
+- **Auto-Backups** — configurable schedule and retention in Admin Panel
+
+<br />

 ## Data sources

@@ -440,8 +452,7 @@ The Atlas map's country and sub-national (province/county) boundaries come from
 [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/). See [NOTICE.md](NOTICE.md)
 for full third-party attributions.

-<br />
-
 ## License

 TREK is [AGPL v3](LICENSE). Self-host freely for personal or internal company use. If you modify and offer TREK as a network service to third parties, your modifications must be open-sourced under the same licence.
+
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")" && pwd)"
+CLIENT_DIR="$REPO_ROOT/client"
+SERVER_DIR="$REPO_ROOT/server"
+PUBLIC_DIR="$REPO_ROOT/server/public"
+
+echo "==> Installing client dependencies"
+cd "$CLIENT_DIR"
+npm ci
+
+echo "==> Building client"
+npm run build
+
+echo "==> Installing server dependencies"
+cd "$SERVER_DIR"
+npm ci
+
+echo "==> Populating server/public"
+find "$PUBLIC_DIR" -mindepth 1 ! -name '.gitkeep' -delete
+cp -r "$CLIENT_DIR/dist/." "$PUBLIC_DIR/"
+cp -r "$CLIENT_DIR/public/fonts" "$PUBLIC_DIR/fonts"
+
+echo "==> Done — server/public is ready"
@@ -1,9 +1,9 @@
 <?xml version="1.0"?>
 <CommunityApplications>
  <Profile>TREK is a self-hosted, real-time collaborative travel planner. Plan trips together with interactive maps, budgets, bookings, packing lists, day-by-day itineraries and file management — every change syncs instantly across everyone in your group. Includes OIDC/SSO, TOTP MFA, dark mode, PWA support, multi-language UI and a modular addon system (Vacay, Atlas, Collab, Budget, Packing, Journey). Maintained by mauriceboe — support and bug reports via GitHub Issues.</Profile>
-  <Icon>https://raw.githubusercontent.com/liketrek/TREK/main/docs/trek-icon.png</Icon>
-  <WebPage>https://github.com/liketrek/TREK</WebPage>
-  <Forum>https://github.com/liketrek/TREK/issues</Forum>
+  <Icon>https://raw.githubusercontent.com/mauriceboe/TREK/main/docs/trek-icon.png</Icon>
+  <WebPage>https://github.com/mauriceboe/TREK</WebPage>
+  <Forum>https://github.com/mauriceboe/TREK/issues</Forum>
  <DonateLink>https://ko-fi.com/mauriceboe</DonateLink>
  <DonateText>Support TREK development</DonateText>
 </CommunityApplications>
@@ -5,30 +5,27 @@ This is a minimal Helm chart for deploying the TREK app.
 ## Features
 - Deploys the TREK container
 - Exposes port 3000 via Service
- Optional persistent storage for `/app/data` and `/app/uploads`, plus extra volumes and mounts
+- Optional persistent storage for `/app/data` and `/app/uploads`
 - Configurable environment variables and secrets
 - Optional generic Ingress support
- Optional Gateway API HTTPRoute support
- Configurable health checks (liveness/readiness probes) on `/api/health`
+- Health checks on `/api/health`

 ## Helm Repository

 A hosted Helm repository is available:

 ```sh
-helm repo add trek https://chart.liketrek.com
+helm repo add trek https://mauriceboe.github.io/TREK
 helm repo update
 helm install trek trek/trek
 ```

-> **Note:** `chart.liketrek.com` is a custom domain (CNAME) for the GitHub Pages site at `https://liketrek.github.io/TREK` — both URLs serve the same repository. The github.io URL keeps working (it redirects to `chart.liketrek.com`), but the custom domain is the canonical one to use.
-
 ## Usage

 Or install directly from the local chart:

 ```sh
-helm install trek ./charts/trek \
+helm install trek ./chart \
  --set ingress.enabled=true \
  --set ingress.hosts[0].host=yourdomain.com
 ```
@@ -47,14 +44,9 @@ See `values.yaml` for more options.
 - With `persistence.enabled: false`, the data and uploads volumes use an `emptyDir` — storage is ephemeral and lost on pod restart. Intended for testing only.
 - `JWT_SECRET` is managed entirely by the server — auto-generated into the data PVC on first start and rotatable via the admin panel (Settings → Danger Zone). No Helm configuration needed.
 - `ENCRYPTION_KEY` encrypts stored secrets (API keys, MFA, SMTP, OIDC) at rest. Recommended: set via `secretEnv.ENCRYPTION_KEY` or `existingSecret`. If left empty, the server falls back automatically: existing installs use `data/.jwt_secret` (no action needed on upgrade); fresh installs auto-generate a key persisted to the data PVC.
- Liveness and readiness probes are configurable under `probes`. Overrides are merged over the defaults, so `--set probes.liveness.initialDelaySeconds=60` keeps the `httpGet` handler. When switching to `exec` or `tcpSocket`, clear `httpGet` in the same override. Set `probes.liveness: null` to remove a probe.
- If exposing TREK through an Ingress or HTTPRoute, set `env.ALLOWED_ORIGINS` and `env.APP_URL` to the public URL. The chart does not sync these automatically.
+- If using ingress, you must manually keep `env.ALLOWED_ORIGINS` and `ingress.hosts` in sync to ensure CORS works correctly. The chart does not sync these automatically.
 - Set `env.ALLOW_INTERNAL_NETWORK: "true"` if Immich or other integrated services are hosted on a private/RFC-1918 address (e.g. a pod on the same cluster or a NAS on your LAN). Loopback (`127.x`) and link-local/metadata addresses (`169.254.x`) remain blocked regardless.
- Set `env.ALLOW_LINK_LOCAL_IPS` to a single link-local address (e.g. `"169.254.1.2"`) only when a service TREK needs sits behind one, such as a host gateway. Cloud metadata addresses (`169.254.169.x`, `169.254.170.x`) cannot be listed.
 - `FORCE_HTTPS` is optional. Set `env.FORCE_HTTPS: "true"` only when ingress (or another proxy) terminates TLS. It enables HTTPS redirects, HSTS, CSP `upgrade-insecure-requests`, and forces the session cookie `secure` flag. Requires `TRUST_PROXY` to be set.
 - Set `env.TRUST_PROXY: "1"` (or the number of proxy hops) when running behind ingress or a load balancer. Required for `FORCE_HTTPS` to detect the forwarded protocol correctly. In production it defaults to `1` automatically.
 - `COOKIE_SECURE` is auto-derived (on when `NODE_ENV=production` or `FORCE_HTTPS=true`). Set `env.COOKIE_SECURE: "false"` only during local testing without TLS. **Not recommended for production.**
- Web Push needs no chart settings: TREK generates its key pair on first start and keeps it in the database on the data PVC. To bring your own pair, set `env.VAPID_PUBLIC_KEY` and `secretEnv.VAPID_PRIVATE_KEY` together (and optionally `env.VAPID_SUBJECT`); changing the pair later means every device has to turn push on again.
 - Set `env.OIDC_DISCOVERY_URL` to override the auto-constructed OIDC discovery endpoint. Required for providers (e.g. Authentik) that expose it at a non-standard path.
- `podSecurityContext` defaults to `fsGroup: 1000` with `fsGroupChangePolicy: OnRootMismatch`, and `securityContext` (the container's) is empty. The container then starts as root, hands `/app/data` and `/app/uploads` to `node` (uid 1000) if the directory or anything directly inside it is not owned by `node` yet, and drops to `node`. Deeper files are not checked. Only the owning user is changed (plus a `root` group), so a different `fsGroup` stays in place. A volume that refuses `chown` (NFS with `root_squash`) logs a warning instead; set `runAsUser: 1000` then. To run as `node` from the start, for example under the `restricted` Pod Security Standard, set `podSecurityContext.runAsUser: 1000` and `runAsGroup: 1000`; the image then skips that step and the privilege drop. See the example in `values.yaml`.
- Use `extraVolumes` and `extraVolumeMounts` to add your own volumes to the pod. To give the booking import more KItinerary extractors, mount a ConfigMap at `/usr/local/share/kitinerary/extractors`, with one `.json` and one `.js` key for each extractor; see the example in `values.yaml`.
@@ -1,5 +1,5 @@
 apiVersion: v2
 name: trek
-version: 5.1.0
+version: 3.1.3
 description: Minimal Helm chart for TREK app
-appVersion: "5.1.0"
+appVersion: "3.1.3"
@@ -2,12 +2,8 @@
   - ENCRYPTION_KEY encrypts stored secrets (API keys, MFA, SMTP, OIDC) at rest.
   - By default, the chart creates a Kubernetes Secret from `secretEnv.ENCRYPTION_KEY` in values.yaml.
   - To generate a random key at install (preserved across upgrades), set `generateEncryptionKey: true`.
-   - To use an existing Kubernetes secret, set `existingSecret` to the secret name. The chart then
-     renders no Secret of its own and reads every secret env var from that secret: `ENCRYPTION_KEY`
-     (renamable via `existingSecretKey`), plus `ADMIN_EMAIL`, `ADMIN_PASSWORD`, `OIDC_CLIENT_SECRET`,
-     `UNSPLASH_ACCESS_KEY`, `PLACES_API_KEY`, `AMAP_API_KEY`, `AMAP_API_SECRET`,
-     `VAPID_PRIVATE_KEY`, `SMTP_PASS`, `MAPBOX_ACCESS_TOKEN`, `CARTO_API_KEY` and
-     `DEMO_ADMIN_PASS`. Missing keys are simply left unset, so only provide the ones you use.
+   - To use an existing Kubernetes secret, set `existingSecret` to the secret name. The secret must
+     contain a key matching `existingSecretKey` (defaults to `ENCRYPTION_KEY`).
   - If left empty, the server resolves the key automatically: existing installs fall back to
     data/.jwt_secret (encrypted data stays readable with no manual action); fresh installs
     auto-generate a key persisted to the data PVC.
@@ -31,12 +27,3 @@
     The other values for that volume (size, storageClassName, annotations) are then ignored.
   - With `persistence.enabled=false` the volumes use an emptyDir — storage is ephemeral and is lost
     when the pod restarts. Use only for testing.
-{{- if .Values.httpRoute.enabled }}
-
-6. HTTPRoute:
-   - The chart creates an HTTPRoute v1 to the existing TREK Service. The Gateway, GatewayClass,
-     listeners, TLS certificates and allowedRoutes are managed by your cluster operator.
-   - Ingress and HTTPRoute may be enabled together.
-   - Timeout fields are Standard Channel in Gateway API v1.2, but controller support varies. Omit
-     them to use controller defaults; `0s` disables the corresponding timeout where supported.
-{{- end }}
@@ -13,15 +13,6 @@ data:
  {{- if .Values.env.LOG_LEVEL }}
  LOG_LEVEL: {{ .Values.env.LOG_LEVEL | quote }}
  {{- end }}
-  {{- if .Values.env.TREK_WIKI_DIR }}
-  TREK_WIKI_DIR: {{ .Values.env.TREK_WIKI_DIR | quote }}
-  {{- end }}
-  {{- if .Values.env.DEFAULT_LANGUAGE }}
-  DEFAULT_LANGUAGE: {{ .Values.env.DEFAULT_LANGUAGE | quote }}
-  {{- end }}
-  {{- if .Values.env.MCP_MAX_SESSION_PER_USER }}
-  MCP_MAX_SESSION_PER_USER: {{ .Values.env.MCP_MAX_SESSION_PER_USER | quote }}
-  {{- end }}
  {{- if .Values.env.ALLOWED_ORIGINS }}
  ALLOWED_ORIGINS: {{ .Values.env.ALLOWED_ORIGINS | quote }}
  {{- end }}
@@ -49,9 +40,6 @@ data:
  {{- if .Values.env.ALLOW_INTERNAL_NETWORK }}
  ALLOW_INTERNAL_NETWORK: {{ .Values.env.ALLOW_INTERNAL_NETWORK | quote }}
  {{- end }}
-  {{- if .Values.env.ALLOW_LINK_LOCAL_IPS }}
-  ALLOW_LINK_LOCAL_IPS: {{ .Values.env.ALLOW_LINK_LOCAL_IPS | quote }}
-  {{- end }}
  {{- if .Values.env.OIDC_ISSUER }}
  OIDC_ISSUER: {{ .Values.env.OIDC_ISSUER | quote }}
  {{- end }}
@@ -70,21 +58,9 @@ data:
  {{- if .Values.env.OIDC_ADMIN_VALUE }}
  OIDC_ADMIN_VALUE: {{ .Values.env.OIDC_ADMIN_VALUE | quote }}
  {{- end }}
-  {{- if .Values.env.OIDC_USERNAME_CLAIM }}
-  OIDC_USERNAME_CLAIM: {{ .Values.env.OIDC_USERNAME_CLAIM | quote }}
-  {{- end }}
  {{- if .Values.env.OIDC_SCOPE }}
  OIDC_SCOPE: {{ .Values.env.OIDC_SCOPE | quote }}
  {{- end }}
-  {{- if .Values.env.HTTP_PROXY }}
-  HTTP_PROXY: {{ .Values.env.HTTP_PROXY | quote }}
-  {{- end }}
-  {{- if .Values.env.HTTPS_PROXY }}
-  HTTPS_PROXY: {{ .Values.env.HTTPS_PROXY | quote }}
-  {{- end }}
-  {{- if .Values.env.NO_PROXY }}
-  NO_PROXY: {{ .Values.env.NO_PROXY | quote }}
-  {{- end }}
  {{- if .Values.env.OIDC_DISCOVERY_URL }}
  OIDC_DISCOVERY_URL: {{ .Values.env.OIDC_DISCOVERY_URL | quote }}
  {{- end }}
@@ -94,48 +70,9 @@ data:
  {{- if .Values.env.MCP_RATE_LIMIT }}
  MCP_RATE_LIMIT: {{ .Values.env.MCP_RATE_LIMIT | quote }}
  {{- end }}
-  {{- if .Values.env.NOMINATIM_URL }}
-  NOMINATIM_URL: {{ .Values.env.NOMINATIM_URL | quote }}
-  {{- end }}
  {{- if .Values.env.OVERPASS_URL }}
  OVERPASS_URL: {{ .Values.env.OVERPASS_URL | quote }}
  {{- end }}
  {{- if .Values.env.OVERPASS_TIMEOUT_MS }}
  OVERPASS_TIMEOUT_MS: {{ .Values.env.OVERPASS_TIMEOUT_MS | quote }}
  {{- end }}
-  {{- /* Tested for presence rather than truth: the one value this switch gets set to is
-         false, and an unquoted false (or --set env.TREK_PLACES_ENABLED=false) would
-         otherwise drop the key and leave the index on. */}}
-  {{- if not (kindIs "invalid" .Values.env.TREK_PLACES_ENABLED) }}
-  TREK_PLACES_ENABLED: {{ .Values.env.TREK_PLACES_ENABLED | quote }}
-  {{- end }}
-  {{- if .Values.env.TREK_PLACES_URL }}
-  TREK_PLACES_URL: {{ .Values.env.TREK_PLACES_URL | quote }}
-  {{- end }}
-  {{- if .Values.env.TREK_PLACES_CONTRIBUTE }}
-  TREK_PLACES_CONTRIBUTE: {{ .Values.env.TREK_PLACES_CONTRIBUTE | quote }}
-  {{- end }}
-  {{- if .Values.env.TREK_SERVICES }}
-  TREK_SERVICES: {{ .Values.env.TREK_SERVICES | quote }}
-  {{- end }}
-  {{- if .Values.env.TREK_SERVICES_HOSTS }}
-  TREK_SERVICES_HOSTS: {{ .Values.env.TREK_SERVICES_HOSTS | quote }}
-  {{- end }}
-  {{- if .Values.env.TREK_PHOTON_URL }}
-  TREK_PHOTON_URL: {{ .Values.env.TREK_PHOTON_URL | quote }}
-  {{- end }}
-  {{- if .Values.env.TREK_VALHALLA_URL }}
-  TREK_VALHALLA_URL: {{ .Values.env.TREK_VALHALLA_URL | quote }}
-  {{- end }}
-  {{- if .Values.env.GOOGLE_LIST_DATA_BASE }}
-  GOOGLE_LIST_DATA_BASE: {{ .Values.env.GOOGLE_LIST_DATA_BASE | quote }}
-  {{- end }}
-  {{- if .Values.env.AMAP_API_BASE }}
-  AMAP_API_BASE: {{ .Values.env.AMAP_API_BASE | quote }}
-  {{- end }}
-  {{- if .Values.env.VAPID_PUBLIC_KEY }}
-  VAPID_PUBLIC_KEY: {{ .Values.env.VAPID_PUBLIC_KEY | quote }}
-  {{- end }}
-  {{- if .Values.env.VAPID_SUBJECT }}
-  VAPID_SUBJECT: {{ .Values.env.VAPID_SUBJECT | quote }}
-  {{- end }}
@@ -6,12 +6,6 @@ metadata:
    app: {{ include "trek.name" . }}
 spec:
  replicas: 1
-  # TREK is a single-writer SQLite app on a ReadWriteOnce PVC, so the default
-  # RollingUpdate would start a second pod holding the same volume before the old one
-  # exits — a Multi-Attach deadlock, or two processes on one travel.db. Recreate tears
-  # the old pod down first. Keep it, see updateStrategy in values.yaml.
-  strategy:
-    type: {{ .Values.updateStrategy | default "Recreate" }}
  selector:
    matchLabels:
      app: {{ include "trek.name" . }}
@@ -29,31 +23,21 @@ spec:
        - name: {{ .name }}
        {{- end }}
      {{- end }}
-      {{- with .Values.podSecurityContext }}
      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
+        fsGroup: 1000
      containers:
        - name: trek
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          {{- with .Values.securityContext }}
-          securityContext:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
          {{- with .Values.resources }}
          resources:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          ports:
-            - name: http
-              containerPort: {{ .Values.env.PORT | default 3000 }}
+            - containerPort: 3000
          envFrom:
            - configMapRef:
                name: {{ include "trek.fullname" . }}-config
-            {{- with .Values.extraEnvFrom }}
-            {{- toYaml . | nindent 12 }}
-            {{- end }}
          env:
            - name: ENCRYPTION_KEY
              valueFrom:
@@ -79,89 +63,23 @@ spec:
                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
                  key: OIDC_CLIENT_SECRET
                  optional: true
-            - name: UNSPLASH_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
-                  key: UNSPLASH_ACCESS_KEY
-                  optional: true
-            - name: PLACES_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
-                  key: PLACES_API_KEY
-                  optional: true
-            - name: TREK_SERVICES_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
-                  key: TREK_SERVICES_KEY
-                  optional: true
-            - name: AMAP_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
-                  key: AMAP_API_KEY
-                  optional: true
-            - name: AMAP_API_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
-                  key: AMAP_API_SECRET
-                  optional: true
-            - name: VAPID_PRIVATE_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
-                  key: VAPID_PRIVATE_KEY
-                  optional: true
-            - name: SMTP_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
-                  key: SMTP_PASS
-                  optional: true
-            - name: MAPBOX_ACCESS_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
-                  key: MAPBOX_ACCESS_TOKEN
-                  optional: true
-            - name: CARTO_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
-                  key: CARTO_API_KEY
-                  optional: true
-            - name: DEMO_ADMIN_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
-                  key: DEMO_ADMIN_PASS
-                  optional: true
-          {{- with .Values.extraEnv }}
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
          volumeMounts:
            - name: data
              mountPath: /app/data
            - name: uploads
              mountPath: /app/uploads
-            {{- with .Values.extraVolumeMounts }}
-            {{- toYaml . | nindent 12 }}
-            {{- end }}
-          {{- with (default dict .Values.probes).startup }}
-          startupProbe:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with (default dict .Values.probes).liveness }}
          livenessProbe:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with (default dict .Values.probes).readiness }}
+            httpGet:
+              path: /api/health
+              port: 3000
+            initialDelaySeconds: 15
+            periodSeconds: 30
          readinessProbe:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
+            httpGet:
+              path: /api/health
+              port: 3000
+            initialDelaySeconds: 5
+            periodSeconds: 10
      volumes:
        - name: data
          {{- if .Values.persistence.enabled }}
@@ -177,6 +95,3 @@ spec:
          {{- else }}
          emptyDir: {}
          {{- end }}
-        {{- with .Values.extraVolumes }}
-        {{- toYaml . | nindent 8 }}
-        {{- end }}
@@ -1,39 +0,0 @@
-{{- if .Values.httpRoute.enabled -}}
-{{- if not .Values.httpRoute.parentRefs }}
-{{- fail "httpRoute.parentRefs must include at least one parent" }}
-{{- end }}
-{{- if not .Values.httpRoute.paths }}
-{{- fail "httpRoute.paths must include at least one path" }}
-{{- end }}
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: {{ include "trek.fullname" . }}
-  labels:
-    app: {{ include "trek.name" . }}
-  {{- with .Values.httpRoute.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  parentRefs:
-    {{- toYaml .Values.httpRoute.parentRefs | nindent 4 }}
-  {{- with .Values.httpRoute.hostnames }}
-  hostnames:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  rules:
-    {{- range $path := .Values.httpRoute.paths }}
-    - matches:
-        - path:
-            type: PathPrefix
-            value: {{ $path | quote }}
-      backendRefs:
-        - name: {{ include "trek.fullname" $ }}
-          port: {{ $.Values.service.port }}
-      {{- with $.Values.httpRoute.timeouts }}
-      timeouts:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-    {{- end }}
-{{- end }}
@@ -17,36 +17,6 @@ data:
  {{- if .Values.secretEnv.OIDC_CLIENT_SECRET }}
  OIDC_CLIENT_SECRET: {{ .Values.secretEnv.OIDC_CLIENT_SECRET | b64enc | quote }}
  {{- end }}
-  {{- if .Values.secretEnv.UNSPLASH_ACCESS_KEY }}
-  UNSPLASH_ACCESS_KEY: {{ .Values.secretEnv.UNSPLASH_ACCESS_KEY | b64enc | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.PLACES_API_KEY }}
-  PLACES_API_KEY: {{ .Values.secretEnv.PLACES_API_KEY | b64enc | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.TREK_SERVICES_KEY }}
-  TREK_SERVICES_KEY: {{ .Values.secretEnv.TREK_SERVICES_KEY | b64enc | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.AMAP_API_KEY }}
-  AMAP_API_KEY: {{ .Values.secretEnv.AMAP_API_KEY | b64enc | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.AMAP_API_SECRET }}
-  AMAP_API_SECRET: {{ .Values.secretEnv.AMAP_API_SECRET | b64enc | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.VAPID_PRIVATE_KEY }}
-  VAPID_PRIVATE_KEY: {{ .Values.secretEnv.VAPID_PRIVATE_KEY | b64enc | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.SMTP_PASS }}
-  SMTP_PASS: {{ .Values.secretEnv.SMTP_PASS | b64enc | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.MAPBOX_ACCESS_TOKEN }}
-  MAPBOX_ACCESS_TOKEN: {{ .Values.secretEnv.MAPBOX_ACCESS_TOKEN | b64enc | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.CARTO_API_KEY }}
-  CARTO_API_KEY: {{ .Values.secretEnv.CARTO_API_KEY | b64enc | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.DEMO_ADMIN_PASS }}
-  DEMO_ADMIN_PASS: {{ .Values.secretEnv.DEMO_ADMIN_PASS | b64enc | quote }}
-  {{- end }}
 {{- end }}

 {{- if and (not .Values.existingSecret) (.Values.generateEncryptionKey) }}
@@ -61,47 +31,17 @@ metadata:
 type: Opaque
 stringData:
  {{- if and $existingSecret $existingSecret.data }}
-  {{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}: {{ index $existingSecret.data (.Values.existingSecretKey | default "ENCRYPTION_KEY") | b64dec | quote }}
+  {{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}: {{ index $existingSecret.data (.Values.existingSecretKey | default "ENCRYPTION_KEY") | b64dec }}
  {{- else }}
-  {{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}: {{ randAlphaNum 32 | quote }}
+  {{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}: {{ randAlphaNum 32 }}
  {{- end }}
  {{- if .Values.secretEnv.ADMIN_EMAIL }}
-  ADMIN_EMAIL: {{ .Values.secretEnv.ADMIN_EMAIL | quote }}
+  ADMIN_EMAIL: {{ .Values.secretEnv.ADMIN_EMAIL }}
  {{- end }}
  {{- if .Values.secretEnv.ADMIN_PASSWORD }}
-  ADMIN_PASSWORD: {{ .Values.secretEnv.ADMIN_PASSWORD | quote }}
+  ADMIN_PASSWORD: {{ .Values.secretEnv.ADMIN_PASSWORD }}
  {{- end }}
  {{- if .Values.secretEnv.OIDC_CLIENT_SECRET }}
-  OIDC_CLIENT_SECRET: {{ .Values.secretEnv.OIDC_CLIENT_SECRET | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.UNSPLASH_ACCESS_KEY }}
-  UNSPLASH_ACCESS_KEY: {{ .Values.secretEnv.UNSPLASH_ACCESS_KEY | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.PLACES_API_KEY }}
-  PLACES_API_KEY: {{ .Values.secretEnv.PLACES_API_KEY | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.TREK_SERVICES_KEY }}
-  TREK_SERVICES_KEY: {{ .Values.secretEnv.TREK_SERVICES_KEY | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.AMAP_API_KEY }}
-  AMAP_API_KEY: {{ .Values.secretEnv.AMAP_API_KEY | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.AMAP_API_SECRET }}
-  AMAP_API_SECRET: {{ .Values.secretEnv.AMAP_API_SECRET | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.VAPID_PRIVATE_KEY }}
-  VAPID_PRIVATE_KEY: {{ .Values.secretEnv.VAPID_PRIVATE_KEY | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.SMTP_PASS }}
-  SMTP_PASS: {{ .Values.secretEnv.SMTP_PASS | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.MAPBOX_ACCESS_TOKEN }}
-  MAPBOX_ACCESS_TOKEN: {{ .Values.secretEnv.MAPBOX_ACCESS_TOKEN | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.CARTO_API_KEY }}
-  CARTO_API_KEY: {{ .Values.secretEnv.CARTO_API_KEY | quote }}
-  {{- end }}
-  {{- if .Values.secretEnv.DEMO_ADMIN_PASS }}
-  DEMO_ADMIN_PASS: {{ .Values.secretEnv.DEMO_ADMIN_PASS | quote }}
+  OIDC_CLIENT_SECRET: {{ .Values.secretEnv.OIDC_CLIENT_SECRET }}
  {{- end }}
 {{- end }}
@@ -8,7 +8,7 @@ spec:
  type: {{ .Values.service.type }}
  ports:
    - port: {{ .Values.service.port }}
-      targetPort: http
+      targetPort: 3000
      protocol: TCP
      name: http
  selector:
@@ -4,40 +4,6 @@ image:
  # tag: latest
  pullPolicy: IfNotPresent

-# Deployment update strategy. Keep Recreate: TREK is a single-writer SQLite app, and
-# during a RollingUpdate the new pod migrates the database while the old one still
-# writes to it. A ReadWriteMany volume does not make that safe; SQLite's WAL needs both
-# processes on one host, which network filesystems do not provide.
-updateStrategy: Recreate
-
-# Pod-level security context. fsGroup gives the node user (uid/gid 1000) group access
-# to the data and uploads volumes; OnRootMismatch lets the kubelet skip its recursive
-# permission walk once the volume root already matches, so a big PVC does not hold up
-# every start.
-#
-# By default the container starts as root, hands any files that are not node's yet to
-# node, and then drops to node itself. To start it as node straight away (needed under
-# the "restricted" Pod Security Standard), add the user here and lock the container
-# down below; the image then skips the ownership step and the privilege drop:
-#   podSecurityContext:
-#     fsGroup: 1000
-#     fsGroupChangePolicy: OnRootMismatch
-#     runAsUser: 1000
-#     runAsGroup: 1000
-#     runAsNonRoot: true
-#     seccompProfile:
-#       type: RuntimeDefault
-#   securityContext:
-#     allowPrivilegeEscalation: false
-#     capabilities:
-#       drop: [ALL]
-podSecurityContext:
-  fsGroup: 1000
-  fsGroupChangePolicy: OnRootMismatch
-
-# Security context of the trek container itself. Empty by default.
-securityContext: {}
-
 # Optional image pull secrets for private registries
 imagePullSecrets: []
  # - name: my-registry-secret
@@ -53,18 +19,12 @@ env:
  # Timezone for logs, reminders, and cron jobs (e.g. Europe/Berlin).
  # LOG_LEVEL: "info"
  # "info" = concise user actions, "debug" = verbose details.
-  # TREK_WIKI_DIR: "/app/wiki"
-  # Where the in-app Help pages (/help) read their content from. Leave unset: the
-  # image ships the wiki at /app/wiki and finds it automatically, so Help matches
-  # the version you are running. Only set this to serve your own docs from a mounted
-  # volume. If the path does not exist, Help falls back to fetching the public GitHub
-  # wiki, which needs egress and tracks the latest release rather than your version.
  # DEFAULT_LANGUAGE: "en"
  # Default language on the login page for users with no saved preference.
  # Browser/OS language is auto-detected first; this is the fallback when no match is found.
-  # Supported: ar, az, br, ca, cs, de, en, es, et, fr, gr, hu, id, it, ja, ko, nl, pl, ru, sk, sv, th, tr, uk, vi, zh, zh-TW
+  # Supported: de, en, es, fr, hu, nl, br, cs, pl, ru, zh, zh-TW, it, ar
  # ALLOWED_ORIGINS: ""
-  # NOTE: If using ingress or HTTPRoute, ensure env.ALLOWED_ORIGINS matches the public domains for proper CORS configuration.
+  # NOTE: If using ingress, ensure env.ALLOWED_ORIGINS matches the domains in ingress.hosts for proper CORS configuration.
  # APP_URL: "https://trek.example.com"
  # Public base URL of this instance. Required when OIDC is enabled — must match the redirect URI registered with your IdP.
  # Also used as the base URL for links in email notifications and other external links.
@@ -83,9 +43,6 @@ env:
  # ALLOW_INTERNAL_NETWORK: "false"
  # Set to "true" if Immich or other integrated services are hosted on a private/RFC-1918 network address.
  # Loopback (127.x) and link-local/metadata addresses (169.254.x) are always blocked.
-  # ALLOW_LINK_LOCAL_IPS: ""
-  # Comma-separated single link-local addresses TREK may reach after all, e.g. "169.254.1.2" for a host gateway.
-  # 169.254.169.x and 169.254.170.x (cloud metadata) cannot be listed; an invalid entry aborts startup.
  # OIDC_ISSUER: ""
  # OpenID Connect provider URL.
  # OIDC_CLIENT_ID: ""
@@ -100,78 +57,22 @@ env:
  # OIDC claim used to identify admin users.
  # OIDC_ADMIN_VALUE: ""
  # Value of the OIDC claim that grants admin role.
-  # OIDC_USERNAME_CLAIM: ""
-  # Claim a new account's username comes from, e.g. "preferred_username". Unset: name, then preferred_username.
  # OIDC_SCOPE: "openid email profile groups"
  # Space-separated OIDC scopes to request. Must include scopes for any claim used by OIDC_ADMIN_CLAIM.
  # OIDC_DISCOVERY_URL: ""
  # Override the OIDC discovery endpoint for providers with non-standard paths (e.g. Authentik).
-  # HTTP_PROXY: ""
-  # HTTPS_PROXY: ""
-  # NO_PROXY: "localhost,127.0.0.1"
-  # Outbound proxy for TREK's requests to the internet; NO_PROXY lists hosts that bypass it.
  # DEMO_MODE: "false"
  # Enable demo mode (hourly data resets).
  # MCP_RATE_LIMIT: "300"
  # Max MCP API requests per user per minute. Defaults to 300.
  # MCP_MAX_SESSION_PER_USER: "20"
  # Max concurrent MCP sessions per user. Defaults to 20.
-  # NOMINATIM_URL: ""
-  # Custom Nominatim base URL for every geocoding call the server makes (place search, reverse lookup, Atlas region
-  # fill). When set it REPLACES the public OpenStreetMap service, with no fallback, so the instance behind it needs
-  # the coverage you expect and has to speak the Nominatim API. TREK keeps its ~1 request per second spacing either
-  # way, and search and reverse lookups no longer go to the TREK services' Photon. Defaults to
-  # https://nominatim.openstreetmap.org.
  # OVERPASS_URL: ""
  # Custom Overpass endpoint(s) for the map POI "explore" search, comma-separated. When set, REPLACES the bundled
  # public mirrors — point it at an internal/self-hosted Overpass instance when the public mirrors are unreachable
  # from the cluster (e.g. locked-down egress). Non-http(s) entries are ignored.
-  # OVERPASS_TIMEOUT_MS: "25000"
-  # Per-endpoint timeout (ms) for Overpass POI requests. The query itself gives Overpass 20 seconds of work, so a
-  # lower value hangs up on answers that were still coming. Raise it for a slow self-hosted Overpass instance.
-  # Defaults to 25000.
-  # TREK_PLACES_ENABLED: "false"
-  # Place search (suggestions, full search, category buttons, Road trip search, import geocoding, offline downloads,
-  # and the OpenStreetMap ways and horse routes Tours reads) asks the TREK Places API at https://places.liketrek.com by default, so the pod makes outbound requests to that
-  # host. Set "false" to search the way it did before 4.3.0 (OpenStreetMap, or your Google/Amap key) and send
-  # nothing there. There is no switch in the admin panel on purpose: whether searches leave the instance is decided
-  # here. Defaults to on.
-  # TREK_PLACES_URL: ""
-  # GOOGLE_LIST_DATA_BASE: ""
-  # Base URL of a copy of the Places API you run yourself; it has to answer the same /v1 API. Read from
-  # configuration rather than typed by a user, so an in-cluster address works without ALLOW_INTERNAL_NETWORK.
-  # Defaults to https://places.liketrek.com.
-  # TREK_PLACES_CONTRIBUTE: "off"
-  # Whether an admin may let this installation send the place details its users typed in (website, phone, e-mail,
-  # opening hours, description, picture) to the TREK Places API. "admin" leaves the choice to the admin panel, where
-  # it stays off until an admin agrees; "off" takes it away. Defaults to admin.
-  # TREK_SERVICES: "off"
-  # Places search identifies this installation with a key it registers by itself on first use and keeps in the
-  # database. "off" sends no key; searches then use the shared pool. A key issued to you goes under
-  # secretEnv.TREK_SERVICES_KEY. Defaults to auto.
-  # TREK_SERVICES_HOSTS: ""
-  # Comma-separated hosts that receive the installation key over https. Defaults to
-  # places.liketrek.com,photon.liketrek.com,valhalla.liketrek.com.
-  # TREK_PHOTON_URL: ""
-  # The address search (Photon) of the TREK services. With a key, search and reverse lookups ask it before
-  # Nominatim and fall back to Nominatim when it does not answer. Never asked when NOMINATIM_URL is set.
-  # Defaults to https://photon.liketrek.com.
-  # TREK_VALHALLA_URL: ""
-  # The Valhalla of the TREK services, which this server relays routing to unless the admin picks another
-  # routing service. The browser never talks to it. Defaults to https://valhalla.liketrek.com.
-  # AMAP_API_BASE: ""
-  # Send the Amap (高德地图) calls through an egress proxy, a cache or a gateway that speaks the same API instead of
-  # restapi.amap.com directly. The key itself is a credential and goes under secretEnv.AMAP_API_KEY, or into
-  # Admin > Settings > API Keys. Defaults to https://restapi.amap.com.
-  # VAPID_PUBLIC_KEY: ""
-  # Web Push key pair, public half (base64url, 65 bytes). Leave both halves empty and TREK generates a pair on
-  # first start and keeps it in the database, so it travels with backups. To use your own pair, set this and
-  # secretEnv.VAPID_PRIVATE_KEY together, e.g. from `npx web-push generate-vapid-keys`. Changing the pair later
-  # means every device has to turn push on again.
-  # VAPID_SUBJECT: ""
-  # The contact push services see with every Web Push message: a mailto: address or an https:// URL. Defaults to
-  # APP_URL when it is an https:// address other than localhost, else https://github.com/liketrek/TREK. No email
-  # address is sent unless you set one here.
+  # OVERPASS_TIMEOUT_MS: "12000"
+  # Per-endpoint timeout (ms) for Overpass POI requests. Raise it for a slow self-hosted Overpass instance. Defaults to 12000.


 # Secret environment variables stored in a Kubernetes Secret.
@@ -191,48 +92,11 @@ secretEnv:
  ADMIN_PASSWORD: ""
  # OIDC client secret — set together with env.OIDC_ISSUER and env.OIDC_CLIENT_ID.
  OIDC_CLIENT_SECRET: ""
-  # Optional Unsplash Access Key for trip-cover and place-image search.
-  # Without one, TREK uses Unsplash's unauthenticated endpoint, which some
-  # datacenter/VPS IPs (including many Kubernetes clusters) are blocked from.
-  # Get a free key at https://unsplash.com/developers. Can also be set per-admin
-  # in Admin > Settings; this value overrides that. Leave empty to disable.
-  UNSPLASH_ACCESS_KEY: ""
-  # Optional Google Maps API key (Places API (New) enabled) for place search, photos,
-  # details and Google transit. Overrides the key set in Admin > Settings > API Keys,
-  # whose field then shows this variable read-only. Leave empty to use the key from the
-  # admin panel, or none.
-  PLACES_API_KEY: ""
-  # Optional Amap (高德地图) Web 服务 key for place search and geocoding inside mainland
-  # China. Overrides the key set in Admin > Settings > API Keys. A Web 端 (JS API) key is
-  # a different credential and is rejected with INVALID_USER_KEY. Leave empty to use the
-  # key from the admin panel, or none.
-  AMAP_API_KEY: ""
-  # The private secret (数字签名) of that key. Required exactly when the key was created
-  # with signing enabled, because such a key rejects every unsigned request. Leave empty
-  # otherwise. The endpoint itself is not a secret and is set under env.AMAP_API_BASE.
-  AMAP_API_SECRET: ""
-  # Optional key issued for this installation by the TREK services. Wins over the key TREK
-  # registers by itself and turns that registration off. Leave empty to let TREK register.
-  TREK_SERVICES_KEY: ""
-  # Optional Web Push key pair, private half (base64url, 32 bytes). Only used together with
-  # env.VAPID_PUBLIC_KEY; a pair whose halves do not belong together, or only one half, turns
-  # push off with an error in the log until it is fixed, and every device stays registered.
-  # Leave both empty to let TREK keep a generated pair in its database.
-  VAPID_PRIVATE_KEY: ""

-# If true, a random ENCRYPTION_KEY is generated at install and preserved across upgrades.
-# Only with helm install/upgrade against the cluster: under `helm template`, ArgoCD or Flux
-# the chart cannot read the existing secret and renders a new key every time. TREK then
-# refuses to start rather than lose its secrets; use existingSecret in those setups.
+# If true, a random ENCRYPTION_KEY is generated at install and preserved across upgrades
 generateEncryptionKey: false

-# If set, the chart renders no Secret of its own and instead reads every secret env
-# var from this existing Kubernetes secret. Expected keys: ENCRYPTION_KEY (rename via
-# existingSecretKey), ADMIN_EMAIL, ADMIN_PASSWORD, OIDC_CLIENT_SECRET,
-# UNSPLASH_ACCESS_KEY, PLACES_API_KEY, AMAP_API_KEY, AMAP_API_SECRET, TREK_SERVICES_KEY,
-# VAPID_PRIVATE_KEY, SMTP_PASS, MAPBOX_ACCESS_TOKEN, CARTO_API_KEY, DEMO_ADMIN_PASS.
-# Missing keys are simply left unset (they are optional), so only provide the ones your
-# setup needs.
+# If set, use an existing Kubernetes secret that contains ENCRYPTION_KEY
 existingSecret: ""
 existingSecretKey: ENCRYPTION_KEY

@@ -253,59 +117,6 @@ persistence:
    existingClaim: ""
    annotations: {}

-# Readiness and liveness probes. Overrides are merged over these defaults, so a key you
-# do not set stays as shipped: --set probes.liveness.initialDelaySeconds=60 keeps the
-# httpGet handler. Switching handler means clearing the old one in the same override
-# (httpGet: null together with tcpSocket), otherwise the API rejects the pod with
-# "may not specify more than 1 handler type". Set probes.liveness to null to drop a probe.
-#
-# The startup probe gives a first boot, a long migration or a restore at boot up to ten
-# minutes before liveness takes over; liveness alone killed such a boot after about
-# 105 s, and the next start began it again. Readiness asks the database, so a pod whose
-# database does not answer stops getting traffic without being restarted.
-probes:
-  startup:
-    httpGet:
-      path: /api/health
-      port: http
-    periodSeconds: 10
-    failureThreshold: 60
-  liveness:
-    httpGet:
-      path: /api/health
-      port: http
-    periodSeconds: 30
-  readiness:
-    httpGet:
-      path: /api/health/ready
-      port: http
-    periodSeconds: 10
-
-# Further environment variables, for any setting the env block above does not list.
-#   extraEnv:
-#     - name: SESSION_DURATION
-#       value: 7d
-extraEnv: []
-# Whole ConfigMaps or Secrets:
-#   extraEnvFrom:
-#     - secretRef:
-#         name: trek-smtp
-extraEnvFrom: []
-
-# Further volumes for the pod. The chart does not create the objects they name.
-#   extraVolumes:
-#     - name: kitinerary-extractors
-#       configMap:
-#         name: trek-kitinerary-extractors
-extraVolumes: []
-# Where the trek container mounts them. For example, KItinerary
-# loads extractors for the booking import from this path:
-#   extraVolumeMounts:
-#     - name: kitinerary-extractors
-#       mountPath: /usr/local/share/kitinerary/extractors
-#       readOnly: true
-extraVolumeMounts: []
-
 resources:
  requests:
    cpu: 100m
@@ -326,20 +137,3 @@ ingress:
  #  - secretName: chart-example-tls
  #    hosts:
  #      - chart-example.local
-
-httpRoute:
-  enabled: false
-  annotations: {}
-  parentRefs: []
-  #   - name: gateway
-  #     namespace: gateway-system
-  #     sectionName: https
-  hostnames: []
-  #   - trek.example.com
-  paths:
-    - /
-  # Timeout fields are Standard Channel in Gateway API v1.2; controller support varies.
-  # Leave empty for controller defaults. Use "0s" to disable the corresponding timeout.
-  timeouts: {}
-  #   request: "0s"
-  #   backendRequest: "0s"
@@ -3,11 +3,3 @@ e2e/.tmp/
 test-results/
 playwright-report/
 playwright/.cache/
-
-# vite-plugin-pwa dev output (devOptions.enabled)
-dev-dist/
-e2e/help/media.env
-
-# The native apps' address screen (npm run build:native), copied into
-# android/ and ios/ by `cap sync`
-native-dist/
@@ -1,89 +0,0 @@
-# CLAUDE.md
-
-Scope: the **`@trek/client`** workspace (React 19 + Vite + Zustand + Tailwind PWA). See the repo-root `CLAUDE.md` for the monorepo picture and the philosophy, `server/CLAUDE.md` for the API. This file holds the client's commands, invariants and pitfalls; `ls` the directories for the inventory.
-
-## Commands (run from `client/`)
-
-```bash
-npm run dev               # Vite dev server; proxies the API/ws/uploads/MCP/OAuth paths → http://localhost:3001
-npm run build             # prebuild generates PWA icons, then vite build
-npm run typecheck         # tsc --noEmit (CI)
-npm run lint:strict       # tsc over tsconfig.strict.json (strictNullChecks + noImplicitAny): errors per file may only shrink against scripts/strict-baseline.json, a new file starts at zero (CI gate; --list shows them, --update lowers it)
-npm run lint              # eslint .   (CI runs lint:warnings instead, which fails on the same errors)
-npm run lint:warnings     # eslint (typed), failing on any error and on any warning count per rule above scripts/eslint-baseline.json and on any entry above its count (app code, tests and eslint-disable'd messages counted apart; a `/* eslint <rule>: ... */` config comment fails outright; --update lowers it). Frozen as warnings: floating/misused promises, `.catch(() => {})` (trek/no-swallowed-catch), react-hooks v7 recommended, complexity/max-depth/max-params/max-lines-per-function (120 per .ts function, 300 per .tsx), `use*Store()` without a selector, `window.__*` and window.dispatchEvent buses (trek/no-window-globals), no-console, no-non-null-assertion; the local rules live in scripts/lib/eslint-rules.mjs
-npm run lint:pages        # enforce the Page pattern (CI gate)
-npm run lint:rtl          # physical left/right sides and rtl-lint-disable comments may only shrink per file (CI gate; --list shows them, --update lowers both baselines)
-npm run lint:size         # no source file or stylesheet past 1000 lines, no test (Playwright specs and fixtures under e2e/ included) past 2000, counted wrapped at 120 columns; longer ones may only shrink (CI gate; --update lowers the baseline)
-npm run lint:format       # Prettier: every .ts/.tsx/.mjs/.css file under src/, tests/, e2e/ and scripts/ outside scripts/format-baseline.json must be formatted, the list only shrinks (CI gate; npx prettier --write <file>, then --update)
-npm run lint:layers       # imports go downwards: components never import pages/ or mobile/, nothing under the views imports a view; per-file counts may only shrink (CI gate; --list, --update)
-npm run lint:offline      # no view file (components/mobile/pages/hooks) imports src/api/ beyond scripts/offline-baseline.json, which only shrinks (CI gate; --list, --update)
-npm run lint:pairs        # each desktop/phone pair in scripts/feature-pairs.json imports its shared hooks, and every file under src/mobile/screens is listed there, in a pair or under mobileOnly with a reason (CI gate; --list prints the pairs)
-npm run lint:dup          # copied code: the lines of a file inside a block that repeats elsewhere (100 tokens over 10 lines, SonarCloud's thresholds; .ts and .tsx read as one language) may only shrink against scripts/dup-baseline.json (CI gate; --list shows each block with its other side, --update lowers it)
-npm run lint:skips        # no .only anywhere; skipped/todo/fixme tests per file may only shrink against scripts/skip-baseline.json (CI gate; skipIf/runIf and Playwright's test.skip(condition, 'why') are fine, but skipIf(true) and runIf(false) count as skips)
-npm run lint:i18n-keys    # every translation key src/ names exists in shared en, and en keys nothing in src/, server/src or plugin-sdk/src reaches may only shrink per en file against scripts/i18n-unused-baseline.json (CI gate; --unused lists them, --update lowers the baseline)
-npm run test              # vitest run (tests/** + co-located src/**/*.test.{ts,tsx}); also test:unit / test:integration / test:coverage
-npm run e2e               # Playwright (CI runs --project=public --project=app; e2e:report opens the last report)
-npm run shots             # Playwright screenshot project (shots:promote to accept)
-npm run theme:lint        # colour literals, palette classes, raw text sizes, z-index literals above z-50 and dark_mode reads may only shrink per file, theme-lint-disable markers too (CI gate; --list shows them, --update lowers both baselines)
-npm run check:gl-split    # after build: fails if one chunk bundles both mapbox-gl and maplibre-gl (CI gate)
-```
-
-Every baseline ratchet above also fails on an entry that allows more than the tree holds: a count above what its file or rule has now, or a file that is gone. Run the check with `--update` in the change that made it smaller, so a fixed file cannot grow back to its old entry and a new file at a deleted path does not inherit one.
-
-Single test: `npx vitest run src/store/slices/budgetSlice.test.ts`, or `npx vitest run -t "optimistically adds the place"`.
-
-The dev server needs the API on **:3001** — run `npm run dev` at the repo root to start both.
-
-## Page pattern (enforced — `lint:pages` fails otherwise)
-
-Every `src/pages/*Page.tsx` is a thin **wiring container**; all state/effects/handlers live in a co-located **`use<Page>()` hook** under `src/pages/<page>/`. The page body must **not** call React state/effect/memo/ref hooks — only context hooks like `useTranslation()`. An optional `<page>Model.ts` holds pure, React-free types and helpers. Full spec in `src/pages/PATTERN.md`. When extracting, keep the rendered JSX byte-identical — it is a refactor of where logic lives.
-
-## Data flow — offline-first
-
-The layering is **component → feature hook → store/slice → `repo/` → `api/` | Dexie**, and writes go through a mutation queue:
-
- **`src/store/`** — Zustand. `tripStore.ts` is composed from slices in `store/slices/`; `slices/remoteEventHandler.ts` applies inbound WebSocket events to local state.
- **`src/repo/`** — per-entity repositories mediating between the network and the offline cache: online, call REST and upsert into Dexie; offline, read Dexie. Always go through a repo for trip data.
- **`src/api/client.ts`** — the single Axios instance, typed from `@trek/shared`. New API surface goes in a per-domain `api/<domain>.ts`, not the god module.
- **`src/db/offlineDb.ts`** — the Dexie schema. Database and table names are the on-device contract — renaming one orphans every user's cache. Versions are append-only: a new `this.version(N)` adds its stores to `HISTORY` and a case to `UPGRADE_CASES` in `tests/unit/db/offlineDb.upgrade.test.ts`, which opens the previous version with seeded rows in fake-indexeddb and upgrades it to the current one; a guard there fails on a declared version without both. Never edit a shipped version's stores or `upgrade()`.
- **`src/sync/`**: in `mutationQueue.ts`, offline writes do an optimistic Dexie write (temporary **negative id** for creates), then `flush()` replays REST on reconnect with the mutation's UUID as the **`X-Idempotency-Key`** header (matching the server interceptor) and reconciles the row. Writes to one entity keep their order: a write parked as `failed` or `conflict` holds back the later writes to the same `resource` + entity id until the user retries, resolves or discards it, and only that action deletes a parked row (trip eviction never does). Every row `enqueue()` writes carries `schemaVersion` (`MUTATION_SCHEMA_VERSION` in `offlineDb.ts`) and `buildVersion`; bump the constant when a row's fields or the way the replay reads them change incompatibly. A flush replays its own format and older ones (an unstamped row is format 1) and skips a row from a newer format without sending, marking or dropping it, holding back the later writes to its entity, so a tab still on an older bundle never replays a shape it does not know. The guard exists only from the release that introduced `schemaVersion` on; a bundle older than that replays every row, so the first bump of `MUTATION_SCHEMA_VERSION` must not ship while a rollback target older than the guard is still in play. A skipped row stays `pending` with no retry or discard path, so on a rolled-back install it holds its entity until the user clears the cache. Repos whose writes carry no version token (visits, day clears, tours, driving settings) ask `mutationQueue.mustQueue()` before an online write and queue it while an older write to the entity is still queued, so a retried write cannot land over a newer one made here online; places and packing items send `X-Base-Updated-At`, so the server refuses the stale replay with a 409 instead. `flush()` takes the Web Lock `trek-mutation-flush:<db name>` so only one tab replays at a time; a tab that finds it taken waits for it, and a `flush()` called while this tab's flush runs or waits for the lock gets that same flush back (with one more pass asked for), so `flush()` never resolves while a tab is still replaying and a re-seed chained onto it cannot lay older server rows over those writes (the in-tab flush alone where the API is missing). The rest of the directory drives reconnection sync, the auth gate that stops background loops before logout swaps the DB, offline preferences, and map pre-download (raster and vector prefetchers).
-
-## Rules for new code
-
-The offline core is flagship work surrounded by a periphery that ignores it. New code extends the core's discipline, not the periphery's shortcuts:
-
- **One data path, no layer skips.** Never import `api/client` (or raw fetch/axios) from a component or modal, and especially never *write* from one. `lint:offline` enforces it: a file under `components/`, `mobile/`, `pages/` or `hooks/` may not import anything from `src/api/` except types. The long tail that already does is listed in `scripts/offline-baseline.json`; the list only shrinks (a file that stops leaves it via `--update`) and is debt, not precedent. A domain that is online-only on purpose (admin, auth) still puts its calls in a store or repo, not in the view.
- **Offline-first is the product promise.** New domains get a repo with read-through and offline writes (temp id → optimistic Dexie write → idempotent queue entry). If a domain is deliberately online-only, say so explicitly.
- **Imports go downwards** (`lint:layers`, rules in `scripts/lib/layers.mjs`). A component never imports `pages/` or `mobile/`, a shared hook no view, and stores, repos, sync, api, db and the helpers no view at all; a file directly in `src/` is the layer of its name, so `src/types.ts` follows the `types/` rules. A model or helper both sides need moves down (`utils/`, `hooks/`, `types/`); the counts in `scripts/layers-baseline.json` are debt, not precedent.
- **No god components or god hooks.** The page pattern is a floor, not a ceiling. Decompose hooks by concern, split renders into memoizable sections, and don't pass huge prop bags with inline-arrow callbacks.
- **Prefer React 19 idioms**: `useOptimistic`, `useActionState`/`useFormStatus`, `use()` + Suspense, `useSyncExternalStore` for external subscriptions (`hooks/useNetworkMode` is the reference).
- **Optimistic writes must reconcile** — rollback + user-visible toast on failure. No `.catch(() => {})`, no bare `catch {}`.
- **WS remote-event handling must match local slice reducers field-for-field.** Divergence is silent, cross-user data loss.
- **Subscribe with selectors** (`useShallow` for multi-field reads); never whole-store subscriptions; `getState()` for imperative access in effects.
- **Connectivity**: `isEffectivelyOffline()` is the single source of truth — never read `navigator.onLine` in feature code.
- **Rendering security**: never interpolate user content into HTML strings (map popups included — build via DOM + `textContent`, or `escapeHtml` from `@trek/shared`); untrusted markdown gets `rehype-sanitize`; never `rehype-raw` near it.
- **No `window` event buses or global mutable `window` state.** No `any` at boundaries: WS payloads and map renderer props get real types.
- **Hygiene**: error boundaries around new shells/routes (`components/shared/ErrorBoundary.tsx`); every async `.then(setState)` needs a cancelled flag or `AbortController`; no routine `eslint-disable exhaustive-deps` (a missing dep has already shipped wrong money on screen); no sequential-await N+1 fetch loops; search for an existing utility before writing a duplicate.
- **Theming**: use the semantic Tailwind tokens defined in `tailwind.config.js` (`bg-surface*`, `text-content*`, `border-edge*`, `bg-accent*`, status colors) — no palette classes, hex literals, arbitrary-value color classes, or invented CSS vars. Only `applyAppearance()` in `src/theme/` mutates `<html>` styling (see `src/theme/README.md`). `theme:lint` counts literals, `bg-[#...]`-style and palette classes, raw `text-sm`- and `text-[13px]`-style sizes, z-index literals and `dark_mode` reads per file against `scripts/theme-baseline.json`.
-
-## Big-picture pieces
-
- **Maps** (`src/components/Map/`): two interchangeable renderers — Leaflet and Mapbox/MapLibre GL — chosen at runtime by `MapViewAuto.tsx`. Keep both in sync when changing map features, and keep `mapbox-gl` and `maplibre-gl` in separate chunks (`check:gl-split`). The raster prefetcher fetches tiles `no-cors` so custom tile providers without CORS headers keep working; the vector prefetcher deliberately uses `cors` because it has to read the responses — don't "align" one with the other.
- **i18n** (`src/i18n/TranslationContext.tsx`): `en` is bundled; every other locale is a dynamic `import('@trek/shared/i18n/<locale>')` so Vite emits one chunk per locale. Strings live in `shared/`, never here. `t()` returns an unknown key unchanged, so `lint:i18n-keys` (`scripts/i18n-keys.mjs`) resolves every literal key in `t()`, `tHtml()`, `tr()`, `<TransHtml html>`, `translateApiError` and `*Key` props against `shared/src/i18n/en`; a template whose interpolations only choose between string literals is expanded and each branch checked as a key; any other template key is read with each interpolation as one key segment and passes by itself only when it reaches between 1 and `MAX_IMPLICIT_MATCHES` (30) en keys; a wider one, or one with no fixed dotted prefix, needs a `DYNAMIC_ALLOWED` entry keyed by file and template that says what bounds the value, and an entry the check no longer needs fails. Pass counts as numbers, and let a plural group pick the wording instead of switching keys on the count.
- **Mobile shell** (`src/mobile/`): below the phone breakpoint (`useIsPhone`) `App.tsx` wraps routes in `MobileShell` and the `M*` screens under `mobile/screens/` take over. A UI change to a domain with an `M*` twin usually needs both, and the logic change goes into the shared hook (see "Desktop and phone views" below).
- **Plugins UI** (`src/components/Plugins/`): third-party surfaces render only inside the sandboxed `PluginFrame` iframe (postMessage bridge, live theme-token sync). Host-rendered contribution points (widgets, schedule rows, map layers, planner columns/actions) render server-normalized primitives only — plugin markup never runs inline. Authoring is covered by the `trek-plugin-dev` skill.
- **Managed installs** (`src/managed/index.tsx`): the attachment point for screens that only exist on a centrally administered install. Empty here by design — an operator replaces it at build time. Don't put features there.
-
-## Desktop and phone views
-
-Most features have a desktop view (`components/`, `pages/`) and a phone view (`mobile/screens/`). They share one hook or model per feature that holds the logic (state, effects, loading, handlers, validation, derived values, store and repo calls); each view keeps only its own markup, layout and dialogs or sheets. `useInstanceSettings` and `useRangeBypass` under `components/Admin/` show the shape. `scripts/feature-pairs.json` lists every pair with its hooks.
-
- **Changing a feature:** change the shared hook, not one view. A behaviour that really differs between the two views is a parameter of the hook, so both stay visible in one place and its test covers both.
- **A new feature with both views:** write the hook first under `components/<Feature>/` (or `hooks/`/`utils/` when it is not bound to one feature; a page's own logic stays in its `use<Page>` hook and models in `pages/<page>/`, which the phone shell imports too), give it its own test, build both views on it and add the pair to `scripts/feature-pairs.json`.
- **A new phone screen:** list it in `scripts/feature-pairs.json`, as a view of the pair whose hook it runs on or under `mobileOnly` with the reason it has no twin. A file under `mobile/screens/` that is in neither fails `lint:pairs`.
-
-Two CI gates hold this: `lint:pairs` fails when a listed view stops importing its pair's hook or a phone screen is not listed, and `lint:dup` holds the lines inside copied blocks to `scripts/dup-baseline.json`, so a copy that looks alike fails too. SonarCloud allows **≤ 3% duplicated lines on the PR's new code**, so the same lines added to both views fail a PR by themselves. Full gate rules in the root `CLAUDE.md`.
-
-## Tests
-
-vitest with `@vitejs/plugin-react`, a custom jsdom environment (`tests/environment/`), `forks` pool. Tests live in `tests/{unit,integration}/` and co-located as `src/**/*.test.{ts,tsx}`. `msw` mocks HTTP, `fake-indexeddb` backs Dexie. Page tests render JSX against a mocked hook; hook/slice logic is tested in isolation (see `store/slices/budgetSlice.test.ts`).
@@ -1,108 +0,0 @@
-# Using Android gitignore template: https://github.com/github/gitignore/blob/HEAD/Android.gitignore
-
-# Built application files
-*.apk
-*.aar
-*.ap_
-*.aab
-
-# Files for the ART/Dalvik VM
-*.dex
-
-# Java class files
-*.class
-
-# Generated files
-bin/
-gen/
-out/
-#  Uncomment the following line in case you need and you don't have the release build type files in your app
-# release/
-
-# Gradle files
-.gradle/
-build/
-
-# Local configuration file (sdk path, etc)
-local.properties
-
-# Proguard folder generated by Eclipse
-proguard/
-
-# Log Files
-*.log
-
-# Android Studio Navigation editor temp files
-.navigation/
-
-# Android Studio captures folder
-captures/
-
-# IntelliJ
-*.iml
-.idea/workspace.xml
-.idea/tasks.xml
-.idea/gradle.xml
-.idea/assetWizardSettings.xml
-.idea/dictionaries
-.idea/libraries
-# Android Studio 3 in .gitignore file.
-.idea/caches
-.idea/modules.xml
-# Comment next line if keeping position of elements in Navigation Editor is relevant for you
-.idea/navEditor.xml
-
-# Keystore files and store credentials. The upload key and the Play service
-# account live only in the release workflow's secrets and in the owner's
-# offline backup, never in the repository.
-*.jks
-*.keystore
-keystore.properties
-*service-account*.json
-
-# External native build folder generated in Android Studio 2.2 and later
-.externalNativeBuild
-.cxx/
-
-# Google Services (e.g. APIs or Firebase)
-# Push is not wired up and the build does not apply the google-services plugin,
-# so no CI secret is needed. Kept ignored so a stray Firebase config never lands
-# in the repository.
-google-services.json
-app/google-services.json
-
-# Freeline
-freeline.py
-freeline/
-freeline_project_description.json
-
-# fastlane
-fastlane/report.xml
-fastlane/Preview.html
-fastlane/screenshots
-fastlane/test_output
-fastlane/readme.md
-
-# Version control
-vcs.xml
-
-# lint
-lint/intermediates/
-lint/generated/
-lint/outputs/
-lint/tmp/
-# lint/reports/
-
-# Android Profiling
-*.hprof
-
-# Cordova plugins for Capacitor
-capacitor-cordova-android-plugins
-
-# Copied web assets
-app/src/main/assets/public
-
-# Generated Config files
-app/src/main/assets/capacitor.config.json
-app/src/main/assets/capacitor.plugins.json
-app/src/main/res/xml/config.xml
@@ -1,2 +0,0 @@
-/build/*
-!/build/.npmkeep
@@ -1,66 +0,0 @@
-apply plugin: 'com.android.application'
-
-android {
-    namespace = "com.liketrek.trek"
-    compileSdk = rootProject.ext.compileSdkVersion
-    defaultConfig {
-        applicationId "com.liketrek.trek"
-        minSdkVersion rootProject.ext.minSdkVersion
-        targetSdkVersion rootProject.ext.targetSdkVersion
-        // The release workflow (.github/workflows/native-release.yml) passes both:
-        // the version from client/package.json and a build number that only grows.
-        // Local and PR builds fall back to these placeholders.
-        versionCode((project.findProperty('trekVersionCode') ?: '1') as Integer)
-        versionName(project.findProperty('trekVersionName') ?: '0.0.0-dev')
-        testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
-        aaptOptions {
-             // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.
-             // Default: https://android.googlesource.com/platform/frameworks/base/+/282e181b58cf72b6ca770dc7ca5f91f135444502/tools/aapt/AaptAssets.cpp#61
-            ignoreAssetsPattern = '!.svn:!.git:!.ds_store:!*.scc:.*:!CVS:!thumbs.db:!picasa.ini:!*~'
-        }
-    }
-    // The upload key only exists in the release workflow, which decodes it from a
-    // secret and passes its path and passwords as Gradle properties. Every other
-    // build (local, fork, PR) stays unsigned and needs no secret.
-    signingConfigs {
-        release {
-            if (project.hasProperty('trekKeystore')) {
-                storeFile file(project.property('trekKeystore'))
-                storePassword project.property('trekKeystorePassword')
-                keyAlias project.property('trekKeyAlias')
-                keyPassword project.property('trekKeyPassword')
-            }
-        }
-    }
-    buildTypes {
-        release {
-            if (project.hasProperty('trekKeystore')) {
-                signingConfig signingConfigs.release
-            }
-            minifyEnabled true
-            shrinkResources true
-            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
-        }
-    }
-}
-
-repositories {
-    flatDir{
-        dirs '../capacitor-cordova-android-plugins/src/main/libs', 'libs'
-    }
-}
-
-dependencies {
-    implementation fileTree(include: ['*.jar'], dir: 'libs')
-    implementation "androidx.appcompat:appcompat:$androidxAppCompatVersion"
-    implementation "androidx.coordinatorlayout:coordinatorlayout:$androidxCoordinatorLayoutVersion"
-    implementation "androidx.core:core-splashscreen:$coreSplashScreenVersion"
-    implementation "androidx.browser:browser:$androidxBrowserVersion"
-    implementation project(':capacitor-android')
-    testImplementation "junit:junit:$junitVersion"
-    androidTestImplementation "androidx.test.ext:junit:$androidxJunitVersion"
-    androidTestImplementation "androidx.test.espresso:espresso-core:$androidxEspressoCoreVersion"
-    implementation project(':capacitor-cordova-android-plugins')
-}
-
-apply from: 'capacitor.build.gradle'
@@ -1,25 +0,0 @@
-// DO NOT EDIT THIS FILE! IT IS GENERATED EACH TIME "capacitor update" IS RUN
-
-android {
-  compileOptions {
-      sourceCompatibility JavaVersion.VERSION_21
-      targetCompatibility JavaVersion.VERSION_21
-  }
-}
-
-apply from: "../capacitor-cordova-android-plugins/cordova.variables.gradle"
-dependencies {
-    implementation project(':capacitor-app')
-    implementation project(':capacitor-filesystem')
-    implementation project(':capacitor-haptics')
-    implementation project(':capacitor-keyboard')
-    implementation project(':capacitor-share')
-    implementation project(':capacitor-splash-screen')
-    implementation project(':capacitor-status-bar')
-
-}
-
-
-if (hasProperty('postBuildExtras')) {
-  postBuildExtras()
-}
@@ -1,38 +0,0 @@
-# Add project specific ProGuard rules here.
-# You can control the set of applied configuration files using the
-# proguardFiles setting in build.gradle.
-#
-# For more details, see
-#   http://developer.android.com/guide/developing/tools/proguard.html
-
-# If your project uses WebView with JS, uncomment the following
-# and specify the fully qualified class name to the JavaScript interface
-# class:
-#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
-#   public *;
-#}
-
-# Uncomment this to preserve the line number information for
-# debugging stack traces.
-#-keepattributes SourceFile,LineNumberTable
-
-# If you keep the line number information, uncomment this to
-# hide the original source file name.
-#-renamesourcefileattribute SourceFile
-
-# TREK's own classes: TrekShellPlugin is reached from JavaScript by name and its
-# methods through reflection, so R8 must neither rename nor drop them.
-keep class com.liketrek.trek.** { *; }
-
-# Every Capacitor plugin: the bridge finds plugins by their annotation and calls
-# the annotated methods reflectively.
-keep @com.getcapacitor.annotation.CapacitorPlugin public class * {
-    @com.getcapacitor.PluginMethod public <methods>;
-}
-
-# The WebView bridge: Capacitor's message handler is called from JavaScript
-# through @JavascriptInterface, and every plugin class is instantiated by name.
-keepclassmembers class * {
-    @android.webkit.JavascriptInterface <methods>;
-}
-keep public class * extends com.getcapacitor.Plugin
@@ -1,80 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools">
-
-    <application
-        android:allowBackup="false"
-        android:icon="@mipmap/ic_launcher"
-        android:label="@string/app_name"
-        android:networkSecurityConfig="@xml/network_security_config"
-        android:roundIcon="@mipmap/ic_launcher_round"
-        android:supportsRtl="true"
-        android:theme="@style/AppTheme">
-
-        <activity
-            android:configChanges="orientation|keyboardHidden|keyboard|screenSize|locale|smallestScreenSize|screenLayout|uiMode|navigation|density"
-            android:name=".MainActivity"
-            android:label="@string/title_activity_main"
-            android:theme="@style/AppTheme.NoActionBarLaunch"
-            android:launchMode="singleTask"
-            android:exported="true">
-
-            <intent-filter>
-                <action android:name="android.intent.action.MAIN" />
-                <category android:name="android.intent.category.LAUNCHER" />
-            </intent-filter>
-
-            <!-- Deep links.
-
-                 The scheme is @string/custom_url_scheme (com.liketrek.trek).
-                 launchMode is singleTask above, so a link delivers into the
-                 running task via onNewIntent rather than starting a second copy
-                 of the app on top of the first.
-
-                 This is the return path for SSO and passkey sign-in: TrekShell
-                 opens the server's login page in a Custom Tab, and after the
-                 hand-off it redirects to com.liketrek.trek://auth?code=…, which
-                 lands here and in TrekShellPlugin.handleOnNewIntent.
-
-                 Not an App Link (autoVerify + https). App Links are verified
-                 against a specific domain via assetlinks.json, and TREK is
-                 self-hosted — there is no single domain to verify against. A
-                 custom scheme is the only form that works for every user's
-                 server. -->
-            <intent-filter>
-                <action android:name="android.intent.action.VIEW" />
-                <category android:name="android.intent.category.DEFAULT" />
-                <category android:name="android.intent.category.BROWSABLE" />
-                <data android:scheme="@string/custom_url_scheme" />
-            </intent-filter>
-
-        </activity>
-
-        <provider
-            android:name="androidx.core.content.FileProvider"
-            android:authorities="${applicationId}.fileprovider"
-            android:exported="false"
-            android:grantUriPermissions="true">
-            <meta-data
-                android:name="android.support.FILE_PROVIDER_PATHS"
-                android:resource="@xml/file_paths"></meta-data>
-        </provider>
-
-    </application>
-
-    <!-- Permissions. Only what the WebView itself needs: the file picker's
-         camera option and navigator.geolocation for "locate me" on the map,
-         both granted at runtime through Capacitor's WebChromeClient. -->
-
-    <uses-permission android:name="android.permission.INTERNET" />
-    <!-- COARSE is listed first because it is the weaker grant and is enough
-         for "what city am I in". -->
-    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
-    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
-    <!-- required="false" on purpose: TREK is a planner, and everything except
-         "locate me" works without GPS hardware. Marking it required would have
-         Play hide the app from tablets and other GPS-less devices. -->
-    <uses-feature android:name="android.hardware.location.gps" android:required="false" />
-    <uses-permission android:name="android.permission.CAMERA" />
-    <uses-feature android:name="android.hardware.camera" android:required="false" />
-</manifest>
@@ -1,50 +0,0 @@
-package com.liketrek.trek;
-
-import android.content.Intent;
-import android.os.Bundle;
-import android.view.View;
-import com.getcapacitor.BridgeActivity;
-
-public class MainActivity extends BridgeActivity {
-
-    @Override
-    protected void onCreate(Bundle savedInstanceState) {
-        registerPlugin(TrekShellPlugin.class);
-        // With a server picked, the WebView loads that server instead of the
-        // bundled address screen, so the UI arrives in the version the server
-        // runs and on its own origin. BridgeActivity reads `config` while it
-        // builds the bridge inside super.onCreate().
-        boolean restarting = TrekServerStore.consumeRestart(this);
-        String server = TrekServerStore.getUrl(this);
-        boolean onServer = server != null && !TrekServerStore.consumeShellOnce(this);
-        config = TrekServerStore.configFor(this, onServer ? server : null, restarting);
-        super.onCreate(savedInstanceState);
-        if (bridge == null) return;
-        // The UI asks for no overscroll effect (overscroll-behavior: none on html)
-        // and Chrome honours that, but the WebView draws the stretch on its root
-        // scroller natively. It scales the whole view, top bar and bottom dock included.
-        bridge.getWebView().setOverScrollMode(View.OVER_SCROLL_NEVER);
-        // Set before any WebView callback can run: they are posted to this thread.
-        if (onServer) bridge.setWebViewClient(new TrekWebViewClient(bridge, this::showAddressScreen));
-    }
-
-    private boolean leavingServer;
-
-    /**
-     * The server did not load: back to the address screen, which offers retry
-     * and change. A fresh task rather than recreate(), because this usually
-     * happens during launch, while the system splash is still up, and a
-     * recreated activity leaves that splash lying over the new page.
-     */
-    private void showAddressScreen() {
-        // A failed page can report more than one error; restart only once.
-        if (leavingServer) return;
-        leavingServer = true;
-        TrekServerStore.showShellOnce(this);
-        TrekServerStore.markRestart(this);
-        runOnUiThread(() -> {
-            startActivity(new Intent(this, MainActivity.class).addFlags(Intent.FLAG_ACTIVITY_NEW_TASK | Intent.FLAG_ACTIVITY_CLEAR_TASK));
-            overridePendingTransition(0, 0);
-        });
-    }
-}
@@ -1,123 +0,0 @@
-package com.liketrek.trek;
-
-import android.content.Context;
-import android.content.SharedPreferences;
-import com.getcapacitor.CapConfig;
-import com.getcapacitor.Logger;
-import java.io.ByteArrayOutputStream;
-import java.io.File;
-import java.io.FileOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.charset.StandardCharsets;
-import org.json.JSONException;
-import org.json.JSONObject;
-
-/** The server the user picked, and the Capacitor configuration that loads it. */
-final class TrekServerStore {
-
-    private static final String PREFS = "trek_shell";
-    private static final String KEY_URL = "server_url";
-    private static final String KEY_SHELL_ONCE = "shell_once";
-    private static final String KEY_RESTART = "restart";
-    private static final String CONFIG_DIR = "trek-server-config";
-
-    private TrekServerStore() {}
-
-    static String getUrl(Context context) {
-        return prefs(context).getString(KEY_URL, null);
-    }
-
-    static void setUrl(Context context, String url) {
-        SharedPreferences.Editor editor = prefs(context).edit();
-        if (url == null) {
-            editor.remove(KEY_URL);
-        } else {
-            editor.putString(KEY_URL, url);
-        }
-        editor.commit();
-    }
-
-    /** Start the next launch on the bundled address screen, even with a server remembered. */
-    static void showShellOnce(Context context) {
-        prefs(context).edit().putBoolean(KEY_SHELL_ONCE, true).commit();
-    }
-
-    static boolean consumeShellOnce(Context context) {
-        return consume(context, KEY_SHELL_ONCE);
-    }
-
-    /** The next onCreate is the app restarting itself, not a launch. */
-    static void markRestart(Context context) {
-        prefs(context).edit().putBoolean(KEY_RESTART, true).commit();
-    }
-
-    static boolean consumeRestart(Context context) {
-        return consume(context, KEY_RESTART);
-    }
-
-    private static boolean consume(Context context, String key) {
-        boolean set = prefs(context).getBoolean(key, false);
-        if (set) prefs(context).edit().remove(key).commit();
-        return set;
-    }
-
-    /**
-     * The bundled capacitor.config.json, adjusted for this start. Capacitor only
-     * takes these settings from a config file, so this writes a copy into the
-     * app's private storage and loads that; null means the bundled one as it is.
-     *
-     * With a server: server.url set, and server.errorPath dropped, because that
-     * page would have no bridge on the server's origin (TrekWebViewClient
-     * handles a failed load instead).
-     *
-     * On a restart: no launch splash. The splash plugin shows it again after
-     * recreate() but cannot take it down when the page hides it early, which
-     * left it covering a fully rendered page. A restart has no launch to cover.
-     */
-    static CapConfig configFor(Context context, String url, boolean restarting) {
-        if (url == null && !restarting) return null;
-        try {
-            JSONObject json = new JSONObject(readAsset(context, "capacitor.config.json"));
-            if (url != null) {
-                JSONObject server = child(json, "server");
-                server.put("url", url);
-                server.remove("errorPath");
-            }
-            if (restarting) {
-                child(child(json, "plugins"), "SplashScreen").put("launchShowDuration", 0);
-            }
-
-            File dir = new File(context.getFilesDir(), CONFIG_DIR);
-            if (!dir.isDirectory() && !dir.mkdirs()) throw new IOException("Cannot create " + dir);
-            try (FileOutputStream out = new FileOutputStream(new File(dir, "capacitor.config.json"))) {
-                out.write(json.toString().getBytes(StandardCharsets.UTF_8));
-            }
-            return CapConfig.loadFromFile(context, dir.getAbsolutePath());
-        } catch (IOException | JSONException ex) {
-            Logger.error("TrekShell", "Could not adjust the app config for " + url, ex);
-            return null;
-        }
-    }
-
-    private static JSONObject child(JSONObject parent, String key) throws JSONException {
-        JSONObject existing = parent.optJSONObject(key);
-        if (existing != null) return existing;
-        JSONObject created = new JSONObject();
-        parent.put(key, created);
-        return created;
-    }
-
-    private static String readAsset(Context context, String name) throws IOException {
-        try (InputStream in = context.getAssets().open(name); ByteArrayOutputStream out = new ByteArrayOutputStream()) {
-            byte[] buffer = new byte[8192];
-            int read;
-            while ((read = in.read(buffer)) != -1) out.write(buffer, 0, read);
-            return out.toString("UTF-8");
-        }
-    }
-
-    private static SharedPreferences prefs(Context context) {
-        return context.getSharedPreferences(PREFS, Context.MODE_PRIVATE);
-    }
-}
@@ -1,149 +0,0 @@
-package com.liketrek.trek;
-
-import android.content.Intent;
-import android.net.Uri;
-import android.os.Handler;
-import android.os.Looper;
-import androidx.browser.customtabs.CustomTabsIntent;
-import com.getcapacitor.JSObject;
-import com.getcapacitor.Plugin;
-import com.getcapacitor.PluginCall;
-import com.getcapacitor.PluginMethod;
-import com.getcapacitor.annotation.CapacitorPlugin;
-import org.json.JSONObject;
-
-/** The native half of client/src/native/trekShell.ts. */
-@CapacitorPlugin(name = "TrekShell")
-public class TrekShellPlugin extends Plugin {
-
-    /** How long to wait after returning from the browser for the redirect to land. */
-    private static final long CANCEL_GRACE_MS = 600;
-
-    private String authCallId;
-    private String authScheme;
-    private boolean authBrowserOpen;
-    private final Handler handler = new Handler(Looper.getMainLooper());
-
-    @PluginMethod
-    public void getServer(PluginCall call) {
-        String url = TrekServerStore.getUrl(getContext());
-        JSObject result = new JSObject();
-        result.put("url", url == null ? JSONObject.NULL : url);
-        call.resolve(result);
-    }
-
-    @PluginMethod
-    public void setServer(PluginCall call) {
-        String url = call.getString("url");
-        Uri parsed = url == null ? null : Uri.parse(url);
-        if (parsed == null || parsed.getHost() == null || !("https".equals(parsed.getScheme()) || "http".equals(parsed.getScheme()))) {
-            call.reject("A http(s) URL is required");
-            return;
-        }
-        TrekServerStore.setUrl(getContext(), url);
-        call.resolve();
-        restart();
-    }
-
-    @PluginMethod
-    public void resetServer(PluginCall call) {
-        TrekServerStore.setUrl(getContext(), null);
-        call.resolve();
-        restart();
-    }
-
-    @PluginMethod
-    public void reload(PluginCall call) {
-        call.resolve();
-        restart();
-    }
-
-    /** The server URL is part of the bridge's configuration, so it takes a new activity. */
-    private void restart() {
-        TrekServerStore.markRestart(getContext());
-        getActivity().runOnUiThread(() -> getActivity().recreate());
-    }
-
-    @PluginMethod
-    public void authenticate(PluginCall call) {
-        String url = call.getString("url");
-        String scheme = call.getString("callbackScheme");
-        if (url == null || scheme == null) {
-            call.reject("url and callbackScheme are required");
-            return;
-        }
-        rejectPendingAuth("Superseded by a new sign-in");
-        call.setKeepAlive(true);
-        getBridge().saveCall(call);
-        authCallId = call.getCallbackId();
-        authScheme = scheme;
-        authBrowserOpen = true;
-        // A Custom Tab shares the browser's cookies, so a running SSO session at
-        // the identity provider carries over. The redirect back to the app's
-        // scheme arrives through the intent-filter in AndroidManifest.xml.
-        new CustomTabsIntent.Builder().build().launchUrl(getActivity(), Uri.parse(url));
-    }
-
-    @Override
-    protected void handleOnNewIntent(Intent intent) {
-        super.handleOnNewIntent(intent);
-        Uri data = intent.getData();
-        PluginCall call = pendingAuthCall();
-        if (call == null || data == null || !authScheme.equals(data.getScheme())) return;
-        JSObject result = new JSObject();
-        result.put("url", data.toString());
-        call.resolve(result);
-        finishAuth(call);
-    }
-
-    /**
-     * Back in the app without a redirect means the user closed the browser.
-     * onNewIntent runs before onResume when the redirect did arrive, so the
-     * grace period only covers devices that deliver the two out of order.
-     */
-    @Override
-    protected void handleOnResume() {
-        super.handleOnResume();
-        if (!authBrowserOpen) return;
-        authBrowserOpen = false;
-        handler.postDelayed(() -> {
-            PluginCall call = pendingAuthCall();
-            if (call == null) return;
-            call.reject("Sign-in cancelled", "CANCELLED");
-            finishAuth(call);
-        }, CANCEL_GRACE_MS);
-    }
-
-    private PluginCall pendingAuthCall() {
-        return authCallId == null ? null : getBridge().getSavedCall(authCallId);
-    }
-
-    private void rejectPendingAuth(String message) {
-        PluginCall call = pendingAuthCall();
-        if (call == null) return;
-        call.reject(message, "CANCELLED");
-        finishAuth(call);
-    }
-
-    private void finishAuth(PluginCall call) {
-        getBridge().releaseCall(call);
-        authCallId = null;
-        authScheme = null;
-        authBrowserOpen = false;
-    }
-
-    /** iOS only: Android keeps the service worker, which already starts TREK offline. */
-    @PluginMethod
-    public void refreshOfflineCopy(PluginCall call) {
-        JSObject result = new JSObject();
-        result.put("saved", false);
-        call.resolve(result);
-    }
-
-    @PluginMethod
-    public void openOfflineCopy(PluginCall call) {
-        JSObject result = new JSObject();
-        result.put("opened", false);
-        call.resolve(result);
-    }
-}
@@ -1,49 +0,0 @@
-package com.liketrek.trek;
-
-import android.webkit.WebResourceError;
-import android.webkit.WebResourceRequest;
-import android.webkit.WebResourceResponse;
-import android.webkit.WebView;
-import com.getcapacitor.Bridge;
-import com.getcapacitor.BridgeWebViewClient;
-
-/**
- * Used while the WebView shows the user's server. When that server cannot be
- * loaded, Capacitor would show server.errorPath, but on Android it injects
- * its bridge only into the server's origin, so that local page could neither
- * retry nor change the server and stayed blank. Instead the app restarts on
- * the bundled address screen, where the bridge is present and the screen
- * offers exactly those two things.
- */
-class TrekWebViewClient extends BridgeWebViewClient {
-
-    private final Runnable onUnreachable;
-
-    TrekWebViewClient(Bridge bridge, Runnable onUnreachable) {
-        super(bridge);
-        this.onUnreachable = onUnreachable;
-    }
-
-    @Override
-    public void onReceivedError(WebView view, WebResourceRequest request, WebResourceError error) {
-        if (request.isForMainFrame()) {
-            onUnreachable.run();
-            return;
-        }
-        super.onReceivedError(view, request, error);
-    }
-
-    /**
-     * Only a 5xx on the page itself means the server is down (a proxy's 502 or
-     * 503 while TREK restarts). A 4xx page is left alone: the server answered,
-     * and TREK serves its UI for every other path.
-     */
-    @Override
-    public void onReceivedHttpError(WebView view, WebResourceRequest request, WebResourceResponse errorResponse) {
-        if (!request.isForMainFrame()) {
-            super.onReceivedHttpError(view, request, errorResponse);
-        } else if (errorResponse.getStatusCode() >= 500) {
-            onUnreachable.run();
-        }
-    }
-}
@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<androidx.coordinatorlayout.widget.CoordinatorLayout xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:app="http://schemas.android.com/apk/res-auto"
-    xmlns:tools="http://schemas.android.com/tools"
-    android:layout_width="match_parent"
-    android:layout_height="match_parent"
-    tools:context=".MainActivity">
-
-    <WebView
-        android:layout_width="match_parent"
-        android:layout_height="match_parent" />
-</androidx.coordinatorlayout.widget.CoordinatorLayout>
@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background>
-        <inset android:drawable="@mipmap/ic_launcher_background" android:inset="16.7%" />
-    </background>
-    <foreground>
-        <inset android:drawable="@mipmap/ic_launcher_foreground" android:inset="16.7%" />
-    </foreground>
-    <monochrome>
-        <inset android:drawable="@mipmap/ic_launcher_foreground" android:inset="16.7%" />
-    </monochrome>
-</adaptive-icon>
@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background>
-        <inset android:drawable="@mipmap/ic_launcher_background" android:inset="16.7%" />
-    </background>
-    <foreground>
-        <inset android:drawable="@mipmap/ic_launcher_foreground" android:inset="16.7%" />
-    </foreground>
-    <monochrome>
-        <inset android:drawable="@mipmap/ic_launcher_foreground" android:inset="16.7%" />
-    </monochrome>
-</adaptive-icon>
--- a/Show More
+++ b/Show More