fix(invoicing-flag-list): explain empty XL Vask hover preview when flag context has no metadata (AUT-4/TRU-8) (#311)

When a flagged wash has no metadata in the api flag-context payload, the
user previously saw 'No XL Vask details available.' with no indication
of why. This adds a clearer fallback message and adds unit coverage for
that scenario.

Resolves TRU-8 (AUT-4).

Co-authored-by: Jeppe <jeppe@copenhagentruckwash.io>
Co-authored-by: openhands <openhands@all-hands.dev>

.ai-workflow/manifest.json

@@ -0,0 +1,186 @@
+{
+  "version": 1,
+  "snapshot_of": "front-end-vue",
+  "projects": {
+    "front-end-vue": {
+      "display_name": "Truckwash Frontend",
+      "relative_root": ".",
+      "commands": {
+        "setup": {
+          "default": "npm ci\nnpx playwright install"
+        },
+        "run": {
+          "default": "npm run dev"
+        },
+        "test_unit": {
+          "default": "npm run test:unit"
+        },
+        "test_e2e": {
+          "default": "npm run test:e2e:smoke"
+        },
+        "test_full": {
+          "default": "npm run test:e2e:ci"
+        },
+        "debug": {
+          "default": "npx playwright test --debug"
+        }
+      },
+      "codex_environment": {
+        "name": "pleno-vue",
+        "actions": [
+          {
+            "name": "Run dev",
+            "icon": "run",
+            "command_id": "run"
+          },
+          {
+            "name": "Vitest unit tests",
+            "icon": "test",
+            "command_id": "test_unit"
+          },
+          {
+            "name": "Playwright smoke",
+            "icon": "test",
+            "command_id": "test_e2e"
+          },
+          {
+            "name": "Playwright full suite",
+            "icon": "test",
+            "command_id": "test_full"
+          },
+          {
+            "name": "Playwright debug",
+            "icon": "debug",
+            "command_id": "debug"
+          },
+          {
+            "name": "AI workflow check",
+            "icon": "debug",
+            "literal_command": {
+              "default": "node scripts/sync-ai-workflow.mjs --check"
+            }
+          }
+        ]
+      },
+      "generated_content": {
+        "aiassistant_tests_lines": [
+          "# Frontend Testing Rules",
+          "",
+          "These rules apply to Vue changes, browser flows, and frontend test updates.",
+          "",
+          "1. Add or update tests for every new feature, bug fix, API integration change, or auth, booking, POS, or i18n workflow change.",
+          "2. Browser validation runs through Playwright. Legacy browser-driver tooling is outside the supported workflow.",
+          "3. Use `npm run test:unit` for Vitest coverage of isolated logic and component behavior.",
+          "4. Use `npm run test:e2e:smoke` for the narrow Playwright browser pass on changed user flows.",
+          "5. Use `npm run test:e2e:ci` when a change affects shared navigation, authentication, release-critical flows, or multiple browser projects.",
+          "6. Use `npx playwright test --debug` for interactive debugging and trace capture.",
+          "7. Prefer stable selectors, explicit fixtures, and assertions about user-visible behavior.",
+          "8. Avoid manual sleeps. Let Playwright waiting and expectations drive synchronization.",
+          "9. If a bug fix needs a browser regression test, prove the failure first and then keep the test with the fix.",
+          "",
+          "Canonical workflow reference: `.ai-workflow/workflow.md`."
+        ],
+        "junie_lines": [
+          "# Truckwash Frontend Development Guidelines",
+          "",
+          "This file is generated from the canonical AI workflow and is the supported Junie-facing reference for the frontend repository.",
+          "",
+          "## Build And Run",
+          "",
+          "- Setup: `npm ci` and `npx playwright install`.",
+          "- Start development server: `npm run dev`.",
+          "- Production build sanity check: `npm run build`.",
+          "",
+          "## Testing",
+          "",
+          "- Vitest unit tests: `npm run test:unit`.",
+          "- Playwright smoke: `npm run test:e2e:smoke`.",
+          "- Playwright full suite: `npm run test:e2e:ci`.",
+          "- Playwright debug: `npx playwright test --debug`.",
+          "- Browser validation is Playwright-first. Legacy browser-driver tooling is not part of the supported workflow.",
+          "",
+          "## Workflow Notes",
+          "",
+          "- Generated assistant metadata is checked with `node scripts/sync-ai-workflow.mjs --check`.",
+          "- Keep frontend browser verification aligned with the existing Playwright projects and runner scripts in `package.json`.",
+          "- Use the narrowest relevant test command first, then expand to the broader suite when the change risk requires it.",
+          "",
+          "Canonical workflow reference: `.ai-workflow/workflow.md`."
+        ]
+      }
+    }
+  },
+  "assistants": {
+    "codex": {
+      "description": "Codex environment files and actions."
+    },
+    "aiassistant": {
+      "description": "Project-specific AI Assistant rules."
+    },
+    "junie": {
+      "description": "Project-specific Junie guidance."
+    },
+    "copilot": {
+      "description": "Standardized Copilot task dispatch workflow."
+    }
+  },
+  "commands": {
+    "setup": {
+      "description": "Install dependencies and prepare the supported local environment."
+    },
+    "run": {
+      "description": "Start the primary local development entrypoint for the project."
+    },
+    "test_unit": {
+      "description": "Run the project's narrow unit-style verification command."
+    },
+    "test_e2e": {
+      "description": "Run the project's targeted browser or end-to-end verification command."
+    },
+    "test_full": {
+      "description": "Run the broader high-confidence verification command when the project defines one."
+    },
+    "debug": {
+      "description": "Run the supported debug entrypoint."
+    }
+  },
+  "generated_outputs": [
+    {
+      "id": "frontend_codex_environment",
+      "template": "codex_project_environment",
+      "project": "front-end-vue",
+      "path": ".codex/environments/environment.toml"
+    },
+    {
+      "id": "frontend_aiassistant_tests",
+      "template": "aiassistant_frontend_tests_rule",
+      "project": "front-end-vue",
+      "path": ".aiassistant/rules/Creating and maintaining tests.md"
+    },
+    {
+      "id": "frontend_junie_guidelines",
+      "template": "junie_frontend_guidelines",
+      "project": "front-end-vue",
+      "path": ".junie/guidelines.md"
+    }
+  ],
+  "sync_targets": {
+    "front-end-vue": {
+      "source_root": ".",
+      "destination": "C:\\Users\\2jepp\\WebstormProjects\\pleno-vue",
+      "supported_metadata_dirs": [
+        ".codex",
+        ".aiassistant",
+        ".junie",
+        ".github",
+        ".ai-workflow",
+        "scripts"
+      ]
+    }
+  },
+  "unsupported": {
+    "mcp": [
+      "front-end-vue/.ai/mcp/mcp.json"
+    ]
+  }
+}

.ai-workflow/workflow.md

@@ -0,0 +1,74 @@
+<!-- AUTOGENERATED SNAPSHOT for front-end-vue: refresh from the canonical workspace with `node scripts/sync-ai-workflow.mjs --write`. -->
+
+# Developer AI Workflow
+
+This directory is the canonical source of truth for the repository's developer-facing AI workflow.
+
+## Goals
+
+- Keep Codex, AI Assistant, Junie, and Copilot aligned from one maintained source.
+- Make assistant metadata deterministic so the generated files can be rewritten safely and checked in CI.
+- Preserve the current mirror-repo workflow for `backend-php` and `front-end-vue`.
+- Keep all changes in this workflow scoped to developer tooling and documentation. Runtime OpenAI features stay out of scope.
+
+## Supported Assistants
+
+- `Codex`: local environments and actions under `.codex/environments`.
+- `AI Assistant`: generated guidance under `.aiassistant/rules`.
+- `Junie`: generated project guidance under `.junie/guidelines.md`.
+- `Copilot`: standardized issue-dispatch workflow content under `.github/workflows/copilot.yml`.
+
+## Global Rules
+
+1. Change only `.ai-workflow/workflow.md` and `.ai-workflow/manifest.json` when updating the developer AI workflow.
+2. Regenerate all derived files with `node scripts/sync-ai-workflow.mjs --write`.
+3. Validate drift with `node scripts/sync-ai-workflow.mjs --check`.
+4. Generated assistant files are not hand-edited.
+5. Unsupported surfaces stay unsupported until they have a real owner and a real config.
+6. `front-end-vue/.ai/mcp/mcp.json` is intentionally unsupported and should not be recreated until there is an actual MCP integration to maintain.
+
+## Command Matrix
+
+### `backend-php`
+
+- Setup: use the existing setup scripts in `backend-php/scripts`.
+- Run: start the API stack with `traefik`, `redis`, `mysql-debug`, `php1`, and `caddy`.
+- Debug: tail `php1` logs.
+- PHP verification: always run backend validation in the `php1` container.
+- Unit tests: `docker compose exec -T php1 sh -lc "cd /var/www/html && composer test:unit"`.
+- Integration tests: `docker compose exec -T php1 sh -lc "cd /var/www/html && composer test:integration"`.
+- API tests: `docker compose exec -T php1 sh -lc "cd /var/www/html && composer test:api"`.
+
+### `front-end-vue`
+
+- Setup: `npm ci` and `npx playwright install`.
+- Run: `npm run dev`.
+- Unit tests: `npm run test:unit` with Vitest.
+- Browser smoke: `npm run test:e2e:smoke`.
+- Browser full suite: `npm run test:e2e:ci`.
+- Debug: `npx playwright test --debug`.
+- Browser validation is Playwright-first. WebdriverIO and Appium are not part of the supported workflow.
+
+### `automation`
+
+- Setup: `npm ci` and `npx playwright install`.
+- Run: `npx playwright test --ui`.
+- Browser tests: `npx playwright test`.
+- Debug: `npx playwright test --debug`.
+
+## Mirror Repos And Sync
+
+- `backend-php` mirrors to `C:\Users\2jepp\PhpstormProjects\api`.
+- `front-end-vue` mirrors to `C:\Users\2jepp\WebstormProjects\pleno-vue`.
+- Supported metadata directories that must stay mirrored are `.codex`, `.aiassistant`, `.junie`, `.github`, generated `.ai-workflow`, and `scripts/sync-ai-workflow.mjs`.
+- Cache and build directories remain excluded from the watcher.
+- The mirror repos receive generated snapshots of `.ai-workflow` and `scripts/sync-ai-workflow.mjs` so their local CI can run `--check` without depending on the combined workspace root.
+
+## Generated Outputs
+
+- Root Codex environment for combined backend and frontend entrypoints.
+- Backend and frontend Codex environments.
+- Backend and frontend AI Assistant guidance.
+- Backend and frontend Junie guidance.
+- Backend Copilot dispatcher workflow.
+- Backend and frontend snapshot copies of `.ai-workflow` plus `scripts/sync-ai-workflow.mjs` for mirrored repositories.

.aiassistant/rules/Creating and maintaining tests.md

@@ -2,256 +2,20 @@
 apply: always
 ---
 
-# Guidelines for Creating and Maintaining Tests
+<!-- AUTOGENERATED: Run `node scripts/sync-ai-workflow.mjs --write`. -->
 
-## When to Create Tests
+# Frontend Testing Rules
 
-Tests **MUST** be created when any of the following criteria are met:
+These rules apply to Vue changes, browser flows, and frontend test updates.
 
-1. **New Feature Development**: Any new feature, component, or functionality requires accompanying tests
-2. **Bug Fixes**: When fixing a bug, write a test that reproduces the issue first, then verify the fix
-3. **API Changes**: Changes to APIs, services, or data-fetching logic require updated or new tests
-4. **Critical User Flows**: Any modification to authentication, payments, bookings, or POS flows
-5. **Component Behavior Changes**: When modifying Vue component logic, props, or events
-6. **i18n/Localization Changes**: When adding or modifying translation keys
+1. Add or update tests for every new feature, bug fix, API integration change, or auth, booking, POS, or i18n workflow change.
+2. Browser validation runs through Playwright. Legacy browser-driver tooling is outside the supported workflow.
+3. Use `npm run test:unit` for Vitest coverage of isolated logic and component behavior.
+4. Use `npm run test:e2e:smoke` for the narrow Playwright browser pass on changed user flows.
+5. Use `npm run test:e2e:ci` when a change affects shared navigation, authentication, release-critical flows, or multiple browser projects.
+6. Use `npx playwright test --debug` for interactive debugging and trace capture.
+7. Prefer stable selectors, explicit fixtures, and assertions about user-visible behavior.
+8. Avoid manual sleeps. Let Playwright waiting and expectations drive synchronization.
+9. If a bug fix needs a browser regression test, prove the failure first and then keep the test with the fix.
 
-## Running Tests When Adding Tests
-
-When creating or modifying tests, you **MUST**:
-
-1. **Run the specific test file** to verify it passes:
-   ```bash
-   npx playwright test tests/your-test-file.spec.ts
-   ```
-
-2. **Run the full test suite** before committing to ensure no regressions:
-   ```bash
-   npx playwright test
-   ```
-
-3. **Verify test failures before fixes**: If writing a test for a bug, confirm the test fails before applying the fix
-
-## Testing Framework
-
-This project uses **Playwright** as the primary testing framework. Playwright provides reliable end-to-end testing with auto-waiting, powerful selectors, and built-in assertions.
-
-## Running Tests
-
-```bash
-# Run full test suite
-npx playwright test
-
-# Run tests in headed mode (visible browser)
-npx playwright test --headed
-
-# Run tests in a specific browser
-npx playwright test --project=chromium
-npx playwright test --project=firefox
-npx playwright test --project=webkit
-
-# Run tests with UI mode for debugging
-npx playwright test --ui
-
-# Generate HTML report
-npx playwright show-report
-```
-
-## Test File Location and Naming
-
-- **Location**: All test files should be placed in `tests/` or `tests/specs/`
-- **Naming Convention**: Use kebab-case with `.spec.ts` suffix
-  - ✅ `i18n-settings-wheel.spec.ts`
-  - ✅ `user-authentication.spec.ts`
-  - ❌ `UserAuth.test.js`
-
-## Test Structure
-
-### Basic Template
-
-```typescript
-import { test, expect } from '@playwright/test';
-
-/**
- * Brief description of what this test suite covers
- */
-test.describe('Feature or Component Name', () => {
-    test('should describe expected behavior', async ({ page }) => {
-        await page.goto('/');
-        // Test implementation
-        await expect(page).toHaveTitle(/Expected Text/);
-    });
-});
-```
-
-### Key Conventions
-
-1. **Use descriptive test names**: Start with `should` to describe expected behavior
-2. **Always use `async/await`**: All Playwright interactions are asynchronous
-3. **Include JSDoc comments**: Add a comment block at the top describing the test purpose
-4. **Group related tests**: Use `test.describe` blocks to organize related test cases
-
-## Writing Tests
-
-### Navigation
-
-```typescript
-// Navigate to a page
-await page.goto('/');
-await page.goto('/dashboard');
-
-// Wait for navigation
-await page.goto('/dashboard', { waitUntil: 'networkidle' });
-```
-
-### Page Interactions
-
-```typescript
-// Fill input fields
-await page.fill('input[name="username"]', 'testuser');
-await page.fill('input[name="password"]', 'password123');
-
-// Click elements
-await page.click('button[id="login-button"]');
-
-// Wait for elements
-await page.waitForSelector('input[name="2fa_code"]');
-
-// Get element text
-const text = await page.locator('.message').textContent();
-
-// Get page title
-const title = await page.title();
-
-// Execute JavaScript in browser context
-const result = await page.evaluate(() => {
-    return document.querySelector('.data')?.textContent;
-});
-```
-
-### Locators (Recommended)
-
-```typescript
-// Use locators for better reliability
-const submitButton = page.locator('button[type="submit"]');
-await submitButton.click();
-
-// Locator with text
-const loginButton = page.locator('button:has-text("Login")');
-
-// Get by role (accessibility-friendly)
-const heading = page.getByRole('heading', { name: 'Welcome' });
-
-// Get by test ID
-const element = page.getByTestId('submit-button');
-```
-
-### Assertions
-
-```typescript
-// Use Playwright's built-in expect assertions
-await expect(page).toHaveURL('/dashboard');
-await expect(page).toHaveTitle(/Dashboard/);
-await expect(page.locator('.message')).toBeVisible();
-await expect(page.locator('.message')).toHaveText('Success');
-await expect(page.locator('input')).toHaveValue('expected value');
-await expect(page.locator('.items')).toHaveCount(5);
-```
-
-## Authentication Helpers
-
-Create reusable authentication helpers in `tests/fixtures/`:
-
-```typescript
-import { Page, expect } from '@playwright/test';
-
-/**
- * Login as a customer user
- * @param page - Playwright page object
- * @param credentials - User credentials
- */
-export async function loginAsUser(
-  page: Page,
-  credentials: { customerNumber: string; password: string }
-) {
-  await page.goto('/login');
-  await page.fill('input[name="customer_number"]', credentials.customerNumber);
-  await page.fill('input[name="password"]', credentials.password);
-  await page.click('button[id="login-button"]');
-  await expect(page).toHaveURL('/user');
-}
-```
-
-## Best Practices
-
-### DO:
-- ✅ Test one behavior per `test` block
-- ✅ Use meaningful variable names
-- ✅ Use Playwright's auto-waiting (avoid manual waits when possible)
-- ✅ Use locators for element interactions
-- ✅ Use `expect` assertions with auto-retry
-- ✅ Clean up test state when necessary
-- ✅ Use test fixtures for setup/teardown
-
-### DON'T:
-- ❌ Write tests that depend on execution order
-- ❌ Hardcode sensitive data (use environment variables)
-- ❌ Use `page.waitForTimeout()` for synchronization (use proper waits)
-- ❌ Leave commented-out code in test files
-
-## Testing i18n/Translations
-
-When testing internationalization:
-
-1. Define expected translation keys as an array
-2. Fetch locale files via page context
-3. Verify all required keys exist in each locale
-4. Check parity between locales (same keys in all languages)
-
-```typescript
-import { test, expect } from '@playwright/test';
-
-const requiredKeys = ['key1', 'key2', 'key3'];
-
-test('should have all translations in English', async ({ page }) => {
-    await page.goto('/');
-    const result = await page.evaluate(async (keys) => {
-        const response = await fetch('/src/i18n/locales/en.json');
-        const data = await response.json();
-        const missingKeys = keys.filter(key => !(key in data));
-        return { success: missingKeys.length === 0, missingKeys };
-    }, requiredKeys);
-    expect(result.success).toBe(true);
-});
-```
-
-## Mobile Testing
-
-Playwright supports mobile emulation out of the box:
-
-```typescript
-import { test, devices } from '@playwright/test';
-
-// Use device presets
-test.use({ ...devices['iPhone 13'] });
-
-test('should work on mobile', async ({ page }) => {
-    await page.goto('/');
-    // Test mobile-specific behavior
-});
-```
-
-Configure mobile projects in `playwright.config.ts`:
-
-```typescript
-projects: [
-  { name: 'Mobile Chrome', use: { ...devices['Pixel 5'] } },
-  { name: 'Mobile Safari', use: { ...devices['iPhone 12'] } },
-]
-```
-
-## Maintaining Tests
-
-1. **Keep tests updated**: When modifying features, update corresponding tests
-2. **Review failing tests**: Investigate failures before marking as skipped
-3. **Remove obsolete tests**: Delete tests for removed features
-4. **Refactor shared logic**: Extract common test utilities to helper files in `tests/fixtures/`
+Canonical workflow reference: `.ai-workflow/workflow.md`.

.claude/settings.local.json

@@ -0,0 +1,11 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(find /c/Users/2jepp/WebstormProjects/pleno-vue -type f \\\\\\(-name *.ts -o -name *.js \\\\\\) -not -path */node_modules* -not -path */dist/* -not -path */.git/* -not -path */dev-dist/*)",
+      "Bash(find /c/Users/2jepp/WebstormProjects/pleno-vue/src -type f \\\\\\(-name *.ts -o -name *.js -o -name *.vue \\\\\\))",
+      "Bash(find /c/Users/2jepp/WebstormProjects/pleno-vue/app -type f \\\\\\(-name *.ts -o -name *.js -o -name *.java -o -name *.kt \\\\\\))",
+      "Bash(grep -r \"getAutomaticFlags\\\\|AutomaticFlags\\\\|automaticFlags\\\\|Automatic.*Flags\" /c/Users/2jepp/WebstormProjects/pleno-vue --include=*.ts --include=*.js --include=*.java --include=*.kt --exclude-dir=node_modules --exclude-dir=dist --exclude-dir=dev-dist --exclude-dir=output --exclude-dir=.git)",
+      "Bash(xargs grep:*)"
+    ]
+  }
+}

.codex/environments/environment.toml

@@ -11,14 +11,41 @@ npx playwright install
 [[actions]]
 name = "Run dev"
 icon = "run"
-command = "npm run dev"
+command = '''
+npm run dev
+'''
 
 [[actions]]
-name = "Run all tests"
+name = "Vitest unit tests"
 icon = "test"
-command = "npm run test:all"
+command = '''
+npm run test:unit
+'''
 
 [[actions]]
-name = "Run debug"
+name = "Playwright smoke"
+icon = "test"
+command = '''
+npm run test:e2e:smoke
+'''
+
+[[actions]]
+name = "Playwright full suite"
+icon = "test"
+command = '''
+npm run test:e2e:ci
+'''
+
+[[actions]]
+name = "Playwright debug"
 icon = "debug"
-command = "npx playwright test --debug"
+command = '''
+npx playwright test --debug
+'''
+
+[[actions]]
+name = "AI workflow check"
+icon = "debug"
+command = '''
+node scripts/sync-ai-workflow.mjs --check
+'''

.dockerignore

@@ -0,0 +1,17 @@
+.github
+.idea
+.vscode
+coverage
+dev-dist
+dist
+node_modules
+node_modules.*
+output
+playwright-report
+test-results
+.ai
+.ai-workflow
+.claude
+.codex
+.gradle
+gradle

.gitattributes

@@ -0,0 +1,15 @@
+* text=auto eol=lf
+
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.webp binary
+*.woff binary
+*.woff2 binary
+*.ttf binary
+*.otf binary
+*.pdf binary
+*.zip binary
+*.webm binary

.github/BRANCH_PROTECTION.md

@@ -0,0 +1,58 @@
+# Default branch protection
+
+The intended repository ruleset is stored in
+[`rulesets/protect-default-branch.json`](rulesets/protect-default-branch.json).
+It targets the configured default branch and requires pull requests, the strict
+`Required CI` check from GitHub Actions, resolved review conversations,
+squash-only merges, and linear history. Branch deletion and force pushes are
+blocked. Qodana remains advisory and is not part of the required gate.
+
+The ruleset's `RepositoryRole` actor ID `5` is GitHub's built-in Administrator
+role. Its `pull_request` bypass mode permits an administrator to bypass rules
+only while merging an existing pull request; it does not permit a direct push.
+
+## Repository settings
+
+Keep squash merge enabled and disable merge commits and rebase merge. Enable
+auto-merge, the update-branch option, and automatic deletion of merged head
+branches. Keep the Actions token read-only and do not allow Actions to approve
+pull-request reviews.
+
+## Activation and verification
+
+1. Confirm a pull request and a `master` push each produce exactly one
+   successful `Required CI` check from GitHub Actions integration `15368`.
+2. For the initial ruleset POST, override the committed JSON's `enforcement`
+   value to `disabled`, then compare GitHub's normalized API response with this
+   file.
+3. PUT the exact committed JSON to the inspected ruleset to activate it.
+4. Open a canary pull request and confirm that pending or failing CI, unresolved
+   conversations, and an out-of-date branch block merging; only squash merge is
+   available.
+5. After merging, confirm the head branch is deleted and the post-merge full
+   E2E, frontend release, and mobile release guards still run.
+
+If validation exposes a blocker, disable the ruleset rather than deleting it so
+its configuration and history remain available.
+
+## Activation record
+
+Repository ruleset `19051697` was activated on 2026-07-16 after preparation
+PR #172 established `Required CI`, remediation PR #174 passed the strict
+current-base gate, and merged master run `29501928124` completed with all 43
+executed jobs successful. This documentation update is the after-activation
+canary for the normal protected pull-request path.
+
+## Normal publishing flow
+
+Create a scoped feature branch, open a pull request to `master`, wait for
+`Required CI`, update the branch if `master` advanced, resolve every review
+conversation, and squash-merge. For waits expected to exceed 90 seconds, use
+the workspace `scripts/ci-watch.sh` helper instead of repeatedly polling GitHub.
+
+## Break glass
+
+For an incident, an administrator must still open a pull request. Document the
+incident and why the normal gate cannot complete, then use the PR-only bypass
+when merging. Monitor all post-merge workflows and open a follow-up pull request
+for any validation or remediation deferred during the incident.

.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "07:00"
+      timezone: Europe/Copenhagen
+    open-pull-requests-limit: 5
+    labels: [dependencies, ci]
+
+  - package-ecosystem: bundler
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "07:15"
+      timezone: Europe/Copenhagen
+    open-pull-requests-limit: 3
+    labels: [dependencies, ios]

.github/rulesets/protect-default-branch.json

@@ -0,0 +1,53 @@
+{
+  "name": "Protect default branch",
+  "target": "branch",
+  "enforcement": "active",
+  "bypass_actors": [
+    {
+      "actor_id": 5,
+      "actor_type": "RepositoryRole",
+      "bypass_mode": "pull_request"
+    }
+  ],
+  "conditions": {
+    "ref_name": {
+      "include": ["~DEFAULT_BRANCH"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    },
+    {
+      "type": "required_linear_history"
+    },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "allowed_merge_methods": ["squash"],
+        "dismiss_stale_reviews_on_push": false,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_approving_review_count": 0,
+        "required_review_thread_resolution": true
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [
+          {
+            "context": "Required CI",
+            "integration_id": 15368
+          }
+        ],
+        "strict_required_status_checks_policy": true
+      }
+    }
+  ]
+}

.github/workflows/app-store-readiness.yml

@@ -0,0 +1,88 @@
+name: App Store Readiness
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+    paths:
+      - "fastlane/**"
+      - "ios/**"
+      - "scripts/mobile/**"
+      - "tests/node/app-store-connect.test.mjs"
+      - ".github/workflows/app-store-readiness.yml"
+      - "Gemfile*"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: app-store-readiness-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    name: App Store Readiness
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
+        with:
+          ruby-version: "3.3"
+
+      - name: Resolve the pinned Fastlane dependency graph
+        run: bundle lock
+
+      - name: Check the committed Fastlane dependency lock
+        id: fastlane-lock
+        continue-on-error: true
+        run: test -z "$(git status --porcelain -- Gemfile.lock)"
+
+      - name: Preserve a generated lock for review
+        if: steps.fastlane-lock.outcome == 'failure'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: generated-fastlane-lock
+          path: Gemfile.lock
+          if-no-files-found: error
+          retention-days: 1
+
+      - name: Require a current committed Fastlane dependency lock
+        if: steps.fastlane-lock.outcome == 'failure'
+        run: |
+          echo 'Gemfile.lock is missing or stale. Download generated-fastlane-lock and commit it.' >&2
+          exit 1
+
+      - name: Install the pinned Fastlane dependency graph
+        run: bundle install --jobs 4 --retry 3
+
+      - name: Validate strict App Store metadata and candidate assets
+        run: node scripts/mobile/validate-app-store.mjs --strict
+
+      - name: Validate native mobile permissions
+        run: node scripts/mobile/check-permissions.mjs
+
+      - name: Test App Store Connect automation
+        run: node --test tests/node/app-store-connect.test.mjs
+
+      - name: Validate Fastlane configuration
+        run: bundle exec fastlane lanes
+
+      - name: Validate JavaScript syntax
+        run: |
+          node --check scripts/mobile/validate-app-store.mjs
+          node --check scripts/mobile/app-store-connect.mjs
+          node --check scripts/mobile/create-ios-release-manifest.mjs
+          node --check tests/node/app-store-connect.test.mjs
+          node scripts/mobile/app-store-connect.mjs self-test-jwt

.github/workflows/code quality.yml

@@ -1,28 +0,0 @@
-name: Qodana Configuration Upload
-
-on:
-  push:
-    branches: [main, dev]
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
-jobs:
-  upload-qodana-config:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
-
-      - name: Run Qodana Configuration Uploader
-        env:
-          QODANA_CONFIGURATIONS_TOKEN: ${{ secrets.QODANA_CONFIGURATIONS_TOKEN }}
-        run: |
-          docker run --rm \
-            -v $(pwd):/workspace \
-            -w /workspace \
-            -e QODANA_CONFIGURATIONS_TOKEN=$QODANA_CONFIGURATIONS_TOKEN \
-            jetbrains/qodana-configuration-uploader:latest \
-            --global-configs-file qodana-global-configurations.yaml \
-            --qodana-host https://qodana.cloud

.github/workflows/code_quality.yml

@@ -1,28 +1,66 @@
-name: Qodana Configuration Upload
+name: Qodana
 
 on:
-  push:
-    branches: [main, dev]
-  pull_request:
-    branches: [main]
   workflow_dispatch:
+  pull_request:
+    branches: [master, beta, canary, internal]
+    types: [opened, synchronize, reopened, ready_for_review]
+  push:
+    branches: [master, beta, canary, internal]
+
+permissions:
+  contents: read
+  checks: write
+  pull-requests: write
+
+concurrency:
+  group: qodana-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.ref }}
+  cancel-in-progress: true
 
 jobs:
-  upload-qodana-config:
-    runs-on: ubuntu-latest
+  qodana:
+    name: Qodana
+    if: >-
+      github.event_name != 'pull_request' ||
+      (
+        github.event.pull_request.draft == false &&
+        github.event.pull_request.head.repo.full_name == github.repository &&
+        github.event.pull_request.user.login != 'dependabot[bot]'
+      )
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        # v5.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
 
-      - name: Run Qodana Configuration Uploader
+      - name: Require Qodana project token
+        shell: bash
         env:
-          QODANA_CONFIGURATIONS_TOKEN: ${{ secrets.QODANA_CONFIGURATIONS_TOKEN }}
+          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
         run: |
-          docker run --rm \
-            -v $(pwd):/workspace \
-            -w /workspace \
-            -e QODANA_CONFIGURATIONS_TOKEN=$QODANA_CONFIGURATIONS_TOKEN \
-            jetbrains/qodana-configuration-uploader:latest \
-            --global-configs-file qodana-global-configurations.yaml \
-            --qodana-host https://qodana.cloud
+          set -euo pipefail
+          if [[ -z "${QODANA_TOKEN:-}" ]]; then
+            echo "::error::QODANA_TOKEN is not configured for this repository."
+            exit 1
+          fi
+
+      - name: Qodana
+        # v2026.1.3
+        uses: JetBrains/qodana-action@b588768b6e7e6da579e518bc584f79de0d243692
+        with:
+          use-caches: true
+          cache-default-branch-only: true
+          upload-result: false
+          use-annotations: true
+          pr-mode: ${{ github.event_name == 'pull_request' }}
+          post-pr-comment: true
+          github-token: ${{ github.token }}
+          push-fixes: none
+        env:
+          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}

.github/workflows/ios-app-store-candidate.yml

@@ -0,0 +1,190 @@
+name: iOS App Store Candidate
+
+on:
+  push:
+    tags: ["ios-v*"]
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: ios-app-store-candidate
+  cancel-in-progress: false
+
+jobs:
+  resolve:
+    name: Resolve exact tested build
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    outputs:
+      enabled: ${{ steps.resolve.outputs.enabled }}
+      source_sha: ${{ steps.resolve.outputs.source_sha }}
+      version: ${{ steps.resolve.outputs.version }}
+      build_number: ${{ steps.manifest.outputs.build_number }}
+      app_store_build_id: ${{ steps.manifest.outputs.app_store_build_id }}
+    steps:
+      - name: Checkout tagged source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      - name: Validate protected tag and release version
+        id: resolve
+        shell: bash
+        env:
+          AUTOMATION_ENABLED: ${{ vars.APP_STORE_AUTOMATION_ENABLED || 'false' }}
+        run: |
+          set -euo pipefail
+          [[ "$GITHUB_REF_NAME" =~ ^ios-v([0-9]+\.[0-9]+\.[0-9]+)$ ]] || { echo "Tag must be ios-vX.Y.Z." >&2; exit 1; }
+          version="${BASH_REMATCH[1]}"
+          source_sha="$(git rev-parse HEAD)"
+          manifest_version="$(node -p "JSON.parse(require('fs').readFileSync('ios/release.json')).marketingVersion")"
+          [[ "$version" == "$manifest_version" ]] || { echo "Tag version $version does not match ios/release.json $manifest_version." >&2; exit 1; }
+          git show-ref --verify --quiet refs/remotes/origin/master || { echo "origin/master was not included in the full checkout." >&2; exit 1; }
+          git merge-base --is-ancestor "$source_sha" origin/master || { echo "Tagged commit is not reachable from master." >&2; exit 1; }
+          enabled=false
+          [[ "$AUTOMATION_ENABLED" == true ]] && enabled=true
+          echo "enabled=$enabled" >> "$GITHUB_OUTPUT"
+          echo "source_sha=$source_sha" >> "$GITHUB_OUTPUT"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          if [[ "$enabled" != true ]]; then
+            echo "### Candidate promotion safely disabled" >> "$GITHUB_STEP_SUMMARY"
+            echo 'No App Store environment or credentials were accessed. Enable only after the signed canary.' >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+      - name: Download exact TestFlight release manifest
+        if: steps.resolve.outputs.enabled == 'true'
+        id: manifest
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SOURCE_SHA: ${{ steps.resolve.outputs.source_sha }}
+          EXPECTED_VERSION: ${{ steps.resolve.outputs.version }}
+        run: |
+          set -euo pipefail
+          artifact_name="ios-release-manifest-$SOURCE_SHA"
+          response="$RUNNER_TEMP/ios-artifacts.json"
+          curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts?name=$artifact_name&per_page=100" > "$response"
+          artifact_id="$(jq -r --arg sha "$SOURCE_SHA" '[.artifacts[] | select(.expired == false) | select(.workflow_run.head_sha == $sha)] | sort_by(.created_at) | last | .id // empty' "$response")"
+          [[ "$artifact_id" =~ ^[0-9]+$ ]] || { echo "No successful TestFlight release manifest exists for $SOURCE_SHA." >&2; exit 1; }
+          mkdir -p output/candidate
+          curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts/$artifact_id/zip" -o "$RUNNER_TEMP/manifest.zip"
+          unzip -q "$RUNNER_TEMP/manifest.zip" -d output/candidate
+          MANIFEST=output/candidate/ios-release-manifest.json node <<'NODE'
+          const fs = require("node:fs");
+          const manifest = JSON.parse(fs.readFileSync(process.env.MANIFEST, "utf8"));
+          const checks = {
+            schema: manifest.schemaVersion === 1,
+            repository: manifest.repository === process.env.GITHUB_REPOSITORY,
+            source: manifest.sourceSha === process.env.SOURCE_SHA,
+            version: manifest.marketingVersion === process.env.EXPECTED_VERSION,
+            bundle: manifest.bundleId === "io.truckwash.app",
+            build: /^[1-9][0-9]*$/.test(manifest.buildNumber),
+            appStoreBuild: typeof manifest.appStoreBuildId === "string" && manifest.appStoreBuildId.length > 0,
+          };
+          const failed = Object.entries(checks).filter(([, ok]) => !ok).map(([name]) => name);
+          if (failed.length) throw new Error(`Invalid iOS release manifest: ${failed.join(", ")}`);
+          fs.appendFileSync(process.env.GITHUB_OUTPUT, `build_number=${manifest.buildNumber}\napp_store_build_id=${manifest.appStoreBuildId}\n`);
+          NODE
+
+  promote:
+    name: Sync and verify App Store candidate
+    needs: resolve
+    if: needs.resolve.outputs.enabled == 'true'
+    runs-on: macos-15
+    timeout-minutes: 60
+    environment: app-store-candidate
+    env:
+      IOS_SOURCE_SHA: ${{ needs.resolve.outputs.source_sha }}
+      IOS_MARKETING_VERSION: ${{ needs.resolve.outputs.version }}
+      IOS_BUILD_NUMBER: ${{ needs.resolve.outputs.build_number }}
+      EXPECTED_APP_STORE_BUILD_ID: ${{ needs.resolve.outputs.app_store_build_id }}
+      IOS_BUNDLE_ID: ${{ vars.IOS_BUNDLE_ID || 'io.truckwash.app' }}
+      APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
+      APP_STORE_CONNECT_API_KEY_ID: ${{ vars.APP_STORE_CONNECT_API_KEY_ID }}
+      APP_STORE_CONNECT_ISSUER_ID: ${{ vars.APP_STORE_CONNECT_ISSUER_ID || '' }}
+      APP_STORE_CONNECT_APP_ID: ${{ vars.APP_STORE_CONNECT_APP_ID }}
+      APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64 }}
+    steps:
+      - name: Checkout exact candidate source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ env.IOS_SOURCE_SHA }}
+          persist-credentials: false
+
+      - name: Setup Ruby and pinned Fastlane
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
+        with:
+          ruby-version: "3.3"
+          bundler-cache: true
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      - name: Validate complete candidate storefront
+        run: node scripts/mobile/validate-app-store.mjs --strict
+
+      - name: Verify public storefront URLs
+        shell: bash
+        run: |
+          set -euo pipefail
+          for file in support_url privacy_url marketing_url; do
+            url="$(tr -d '\r\n' < "fastlane/metadata/da-DK/$file.txt")"
+            curl --fail --silent --show-error --location --connect-timeout 10 --max-time 30 --output /dev/null "$url"
+          done
+
+      - name: Verify exact processed TestFlight build
+        run: node scripts/mobile/app-store-connect.mjs verify-candidate
+
+      - name: Sync metadata and screenshots without App Review submission
+        run: bundle exec fastlane ios prepare_candidate
+
+      - name: Configure automatic release after approval
+        run: node scripts/mobile/app-store-connect.mjs configure-release-policy
+
+      - name: Read back exact App Store candidate
+        id: readback
+        run: node scripts/mobile/app-store-connect.mjs verify-store-version
+
+      - name: Verify Denmark-only availability and no preorder
+        id: availability
+        run: node scripts/mobile/app-store-connect.mjs verify-availability
+
+      - name: Write candidate handoff
+        env:
+          APP_STORE_STATE: ${{ steps.readback.outputs.app_store_state }}
+          APP_STORE_VERSION_ID: ${{ steps.readback.outputs.app_store_version_id }}
+          RELEASE_TYPE: ${{ steps.readback.outputs.release_type }}
+          AVAILABLE_TERRITORIES: ${{ steps.availability.outputs.available_territories }}
+        run: |
+          echo "### iOS $IOS_MARKETING_VERSION candidate prepared" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Source: \`$IOS_SOURCE_SHA\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Exact tested build: \`$IOS_BUILD_NUMBER\` (\`$EXPECTED_APP_STORE_BUILD_ID\`)" >> "$GITHUB_STEP_SUMMARY"
+          echo "- App Store state: \`$APP_STORE_STATE\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- App Store version ID: \`$APP_STORE_VERSION_ID\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Release policy: \`$RELEASE_TYPE\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Availability: \`$AVAILABLE_TERRITORIES\` only; preorder disabled" >> "$GITHUB_STEP_SUMMARY"
+          echo "- [Open the app in App Store Connect](https://appstoreconnect.apple.com/apps/$APP_STORE_CONNECT_APP_ID/appstore)" >> "$GITHUB_STEP_SUMMARY"
+          echo "- App Review submission remains manual; Apple will release automatically after approval." >> "$GITHUB_STEP_SUMMARY"
+
+  disabled:
+    name: Promotion disabled
+    needs: resolve
+    if: needs.resolve.outputs.enabled != 'true'
+    runs-on: ubuntu-24.04
+    steps:
+      - run: echo "App Store candidate promotion is disabled; no environment or credentials were accessed."

.github/workflows/ios-credential-health.yml

@@ -0,0 +1,117 @@
+name: iOS Credential Health
+
+on:
+  schedule:
+    - cron: "17 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ios-credential-health
+  cancel-in-progress: true
+
+jobs:
+  gate:
+    runs-on: ubuntu-24.04
+    outputs:
+      enabled: ${{ steps.gate.outputs.enabled }}
+    steps:
+      - id: gate
+        env:
+          ENABLED: ${{ vars.APP_STORE_AUTOMATION_ENABLED || 'false' }}
+        run: |
+          enabled=false
+          [[ "$ENABLED" == true ]] && enabled=true
+          echo "enabled=$enabled" >> "$GITHUB_OUTPUT"
+          if [[ "$enabled" != true ]]; then
+            echo "App Store automation is disabled; credential health did not access its environment." >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+  validate:
+    needs: gate
+    if: needs.gate.outputs.enabled == 'true'
+    runs-on: macos-15
+    timeout-minutes: 15
+    environment: app-store-signing
+    env:
+      IOS_BUNDLE_ID: ${{ vars.IOS_BUNDLE_ID || 'io.truckwash.app' }}
+      APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
+      APP_STORE_CONNECT_API_KEY_ID: ${{ vars.APP_STORE_CONNECT_API_KEY_ID }}
+      APP_STORE_CONNECT_ISSUER_ID: ${{ vars.APP_STORE_CONNECT_ISSUER_ID || '' }}
+      APP_STORE_CONNECT_APP_ID: ${{ vars.APP_STORE_CONNECT_APP_ID }}
+      APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64 }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      - name: Validate API key and app access
+        run: node scripts/mobile/app-store-connect.mjs verify-credentials
+
+      - name: Validate certificate and profile identity and expiry
+        shell: bash
+        env:
+          IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64 }}
+          IOS_DISTRIBUTION_CERTIFICATE_PASSWORD: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_PASSWORD }}
+          IOS_APP_STORE_PROFILE_BASE64: ${{ secrets.IOS_APP_STORE_PROFILE_BASE64 }}
+        run: |
+          set -euo pipefail
+          cert_p12="$RUNNER_TEMP/distribution.p12"
+          cert_pem="$RUNNER_TEMP/distribution.pem"
+          cert_der="$RUNNER_TEMP/distribution.der"
+          profile="$RUNNER_TEMP/distribution.mobileprovision"
+          profile_plist="$RUNNER_TEMP/distribution-profile.plist"
+          keychain="$RUNNER_TEMP/credential-health.keychain-db"
+          keychain_password="$(openssl rand -hex 24)"
+          node -e "const fs=require('fs');fs.writeFileSync(process.argv[1],Buffer.from(process.env.IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64.replace(/\\s/g,''),'base64'))" "$cert_p12"
+          node -e "const fs=require('fs');fs.writeFileSync(process.argv[1],Buffer.from(process.env.IOS_APP_STORE_PROFILE_BASE64.replace(/\\s/g,''),'base64'))" "$profile"
+          chmod 600 "$cert_p12" "$profile"
+          security create-keychain -p "$keychain_password" "$keychain"
+          security unlock-keychain -p "$keychain_password" "$keychain"
+          security import "$cert_p12" -P "$IOS_DISTRIBUTION_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain"
+          security list-keychains -d user -s "$keychain"
+          security set-key-partition-list -S apple-tool:,apple: -s -k "$keychain_password" "$keychain" >/dev/null
+          security find-identity -v -p codesigning "$keychain" | grep -q 'Apple Distribution' || {
+            echo "Distribution P12 does not contain a usable private signing identity." >&2
+            exit 1
+          }
+          openssl pkcs12 -in "$cert_p12" -clcerts -nokeys -passin env:IOS_DISTRIBUTION_CERTIFICATE_PASSWORD -out "$cert_pem"
+          openssl x509 -in "$cert_pem" -noout -subject -issuer -dates
+          openssl x509 -in "$cert_pem" -checkend 2592000 -noout || { echo "Distribution certificate expires within 30 days." >&2; exit 1; }
+          openssl x509 -in "$cert_pem" -outform DER -out "$cert_der"
+          security cms -D -i "$profile" > "$profile_plist"
+          CERT_DER="$cert_der" PROFILE_PLIST="$profile_plist" python3 <<'PY'
+          import datetime, hashlib, os, plistlib, sys
+          with open(os.environ["PROFILE_PLIST"], "rb") as handle: profile = plistlib.load(handle)
+          with open(os.environ["CERT_DER"], "rb") as handle: cert_sha = hashlib.sha1(handle.read()).hexdigest().upper()
+          expiration = profile.get("ExpirationDate")
+          if expiration and expiration.tzinfo is None: expiration = expiration.replace(tzinfo=datetime.timezone.utc)
+          warning = datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(days=30)
+          ent = profile.get("Entitlements", {})
+          checks = {
+            "team": os.environ["APPLE_TEAM_ID"] in profile.get("TeamIdentifier", []),
+            "bundle": ent.get("application-identifier") == f'{os.environ["APPLE_TEAM_ID"]}.{os.environ["IOS_BUNDLE_ID"]}',
+            "distribution": ent.get("get-task-allow") is False and not profile.get("ProvisionedDevices"),
+            "profile expiry beyond 30 days": expiration is not None and expiration > warning,
+            "certificate belongs to profile": cert_sha in {hashlib.sha1(value).hexdigest().upper() for value in profile.get("DeveloperCertificates", [])},
+          }
+          failed = [name for name, ok in checks.items() if not ok]
+          if failed:
+            print("Credential health failed:", *[f"- {name}" for name in failed], sep="\n", file=sys.stderr)
+            sys.exit(1)
+          print(f"Provisioning profile is healthy through {expiration.isoformat()}.")
+          PY
+
+      - name: Clean temporary credential files
+        if: always()
+        run: |
+          security delete-keychain "$RUNNER_TEMP/credential-health.keychain-db" 2>/dev/null || true
+          rm -f "$RUNNER_TEMP"/distribution.{p12,pem,der,mobileprovision} "$RUNNER_TEMP/distribution-profile.plist"

.github/workflows/ios-device-debug.yml

@@ -0,0 +1,624 @@
+name: iOS Device Debug IPA
+
+on:
+  workflow_dispatch:
+    inputs:
+      source_ref:
+        description: Same-repository branch, tag, or commit to build
+        required: true
+        default: master
+        type: string
+      expected_sha:
+        description: Full 40-character SHA that source_ref must resolve to
+        required: true
+        type: string
+      confirmation:
+        description: Type SIGN IOS DEBUG IPA
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ios-device-debug-${{ github.run_id }}
+  cancel-in-progress: false
+
+jobs:
+  resolve:
+    name: Resolve and verify source
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    outputs:
+      source_sha: ${{ steps.resolve.outputs.source_sha }}
+    steps:
+      - name: Validate dispatch confirmation
+        shell: bash
+        env:
+          CONFIRMATION: ${{ inputs.confirmation }}
+          EXPECTED_SHA: ${{ inputs.expected_sha }}
+          SOURCE_REF: ${{ inputs.source_ref }}
+          WORKFLOW_REF: ${{ github.ref }}
+        run: |
+          set -euo pipefail
+          if [[ "$WORKFLOW_REF" != "refs/heads/master" ]]; then
+            echo "The signing workflow must be dispatched from the master workflow ref" >&2
+            exit 1
+          fi
+          if [[ "$CONFIRMATION" != "SIGN IOS DEBUG IPA" ]]; then
+            echo "confirmation must exactly match SIGN IOS DEBUG IPA" >&2
+            exit 1
+          fi
+          if [[ ! "$EXPECTED_SHA" =~ ^[0-9a-fA-F]{40}$ ]]; then
+            echo "expected_sha must be a full 40-character commit SHA" >&2
+            exit 1
+          fi
+          if [[ -z "$SOURCE_REF" || "$SOURCE_REF" =~ [[:space:]] ]]; then
+            echo "source_ref must be non-empty and contain no whitespace" >&2
+            exit 1
+          fi
+          if [[ "$SOURCE_REF" == refs/pull/* || "$SOURCE_REF" == pull/* ]]; then
+            echo "Pull-request refs are not eligible for device-debug signing" >&2
+            exit 1
+          fi
+
+      - name: Checkout same-repository history
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Resolve immutable commit
+        id: resolve
+        shell: bash
+        env:
+          EXPECTED_SHA: ${{ inputs.expected_sha }}
+          SOURCE_REF: ${{ inputs.source_ref }}
+        run: |
+          set -euo pipefail
+          expected_sha="${EXPECTED_SHA,,}"
+
+          if [[ "$SOURCE_REF" =~ ^[0-9a-fA-F]{7,40}$ ]]; then
+            candidate="$SOURCE_REF"
+          elif [[ "$SOURCE_REF" == refs/heads/* ]]; then
+            candidate="refs/remotes/origin/${SOURCE_REF#refs/heads/}"
+          elif [[ "$SOURCE_REF" == refs/tags/* ]]; then
+            candidate="$SOURCE_REF"
+          elif git show-ref --verify --quiet "refs/remotes/origin/$SOURCE_REF"; then
+            candidate="refs/remotes/origin/$SOURCE_REF"
+          elif git show-ref --verify --quiet "refs/tags/$SOURCE_REF"; then
+            candidate="refs/tags/$SOURCE_REF"
+          else
+            echo "source_ref does not identify a same-repository branch, tag, or fetched commit" >&2
+            exit 1
+          fi
+
+          source_sha="$(git rev-parse --verify "${candidate}^{commit}" 2>/dev/null || true)"
+          source_sha="${source_sha,,}"
+          if [[ ! "$source_sha" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "source_ref could not be resolved to a commit" >&2
+            exit 1
+          fi
+          if [[ "$source_sha" != "$expected_sha" ]]; then
+            echo "source_ref resolved to a SHA different from expected_sha" >&2
+            exit 1
+          fi
+
+          reachable=false
+          while IFS= read -r repository_ref; do
+            if git merge-base --is-ancestor "$source_sha" "$repository_ref" 2>/dev/null; then
+              reachable=true
+              break
+            fi
+          done < <(git for-each-ref --format='%(refname)' refs/remotes/origin refs/tags)
+          if [[ "$reachable" != true ]]; then
+            echo "The requested commit is not reachable from a same-repository branch or tag" >&2
+            exit 1
+          fi
+
+          echo "source_sha=$source_sha" >> "$GITHUB_OUTPUT"
+          echo "Resolved source_ref to $source_sha" >> "$GITHUB_STEP_SUMMARY"
+
+  build:
+    name: Build development-signed IPA
+    needs: resolve
+    runs-on: macos-26
+    timeout-minutes: 90
+    environment:
+      name: mobile-device-debug
+    env:
+      IOS_PROJECT_PATH: ios/App/App.xcodeproj
+      IOS_SCHEME: App
+      IOS_DEBUG_BUNDLE_ID: ${{ vars.IOS_DEBUG_BUNDLE_ID || 'io.truckwash.app.debug' }}
+      IOS_DEBUG_API_URL: ${{ vars.IOS_DEBUG_API_URL || 'https://api-v2.truckwash.io/master/api' }}
+      APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
+      MOBILE_VERSION_NAME: 0.0.${{ github.run_number }}
+      RESOLVED_SOURCE_SHA: ${{ needs.resolve.outputs.source_sha }}
+    steps:
+      - name: Checkout resolved source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.resolve.outputs.source_sha }}
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Verify runner and resolve build number
+        shell: bash
+        run: |
+          set -euo pipefail
+          xcode_version_output="$(xcodebuild -version)"
+          IFS= read -r xcode_version <<< "$xcode_version_output"
+          xcode_major="$(awk '{split($2, version, "."); print version[1]}' <<< "$xcode_version")"
+          if [[ ! "$xcode_major" =~ ^[0-9]+$ ]] || (( xcode_major < 26 )); then
+            echo "Xcode 26 or newer is required; found $xcode_version" >&2
+            exit 1
+          fi
+
+          build_number="$((10#$GITHUB_RUN_NUMBER * 100 + 10#$GITHUB_RUN_ATTEMPT))"
+          if [[ ! "$build_number" =~ ^[1-9][0-9]{0,17}$ ]]; then
+            echo "Derived build number is outside Apple's supported integer format" >&2
+            exit 1
+          fi
+          echo "MOBILE_VERSION_CODE=$build_number" >> "$GITHUB_ENV"
+          echo "XCODE_VERSION=$xcode_version" >> "$GITHUB_ENV"
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci --legacy-peer-deps
+
+      - name: Verify stable API and Capacitor iOS CORS
+        shell: bash
+        run: |
+          set -euo pipefail
+          api_base="${IOS_DEBUG_API_URL%/}"
+          curl --fail --silent --show-error --location \
+            --connect-timeout 10 --max-time 20 \
+            --header 'Accept: application/json' \
+            --output /dev/null \
+            "$api_base/ping"
+
+          cors_headers="$RUNNER_TEMP/ios-debug-cors-headers.txt"
+          cors_body="$RUNNER_TEMP/ios-debug-cors-body.txt"
+          cors_status="$(curl --silent --show-error \
+            --connect-timeout 10 --max-time 20 \
+            --request OPTIONS \
+            --header 'Origin: capacitor://localhost' \
+            --header 'Access-Control-Request-Method: POST' \
+            --header 'Access-Control-Request-Headers: authorization,content-type' \
+            --dump-header "$cors_headers" \
+            --output "$cors_body" \
+            --write-out '%{http_code}' \
+            "$api_base/ping")"
+          if [[ ! "$cors_status" =~ ^2[0-9][0-9]$ ]]; then
+            echo "Stable API rejected the Capacitor iOS CORS preflight with HTTP $cors_status" >&2
+            sed -n '1,20p' "$cors_body" >&2
+            exit 1
+          fi
+          if ! grep -Eiq '^access-control-allow-origin:[[:space:]]*capacitor://localhost[[:space:]]*$' "$cors_headers"; then
+            echo "Stable API did not allow the exact capacitor://localhost origin" >&2
+            exit 1
+          fi
+          if ! grep -Eiq '^access-control-allow-credentials:[[:space:]]*true[[:space:]]*$' "$cors_headers"; then
+            echo "Stable API did not allow credentialed Capacitor requests" >&2
+            exit 1
+          fi
+          if ! grep -Eiq '^access-control-allow-methods:.*[[:space:],]POST([[:space:],]|$)' "$cors_headers"; then
+            echo "Stable API did not allow POST from the Capacitor origin" >&2
+            exit 1
+          fi
+          if ! grep -Eiq '^access-control-allow-headers:.*[[:space:],]Authorization([[:space:],]|$)' "$cors_headers"; then
+            echo "Stable API did not allow the Authorization header from the Capacitor origin" >&2
+            exit 1
+          fi
+          if ! grep -Eiq '^access-control-allow-headers:.*[[:space:],]Content-Type([[:space:],]|$)' "$cors_headers"; then
+            echo "Stable API did not allow the Content-Type header from the Capacitor origin" >&2
+            exit 1
+          fi
+
+      - name: Build stable production web payload
+        env:
+          RELEASE_COMMIT_SHA: ${{ env.RESOLVED_SOURCE_SHA }}
+          VITE_API_URL: ${{ env.IOS_DEBUG_API_URL }}
+          VITE_RELEASE_MANAGER_CONTROL_API_URL: ${{ env.IOS_DEBUG_API_URL }}
+          VITE_RELEASE_PUBLIC_GATEWAY_API_URL: https://api-v2.truckwash.io
+        run: |
+          npm run build
+          node -e "const manifest = require('./dist/release-manifest.json'); if (manifest.commit_sha !== process.env.RESOLVED_SOURCE_SHA) { throw new Error('Web release manifest source SHA mismatch'); }"
+
+      - name: Sync and validate iOS shell
+        shell: bash
+        run: |
+          set -euo pipefail
+          npx cap sync ios
+          npm run mobile:permissions:check
+          if grep -q 'isa = PBXShellScriptBuildPhase;' "$IOS_PROJECT_PATH/project.pbxproj"; then
+            echo "Unexpected Xcode shell-script build phase detected" >&2
+            exit 1
+          fi
+          xcodebuild -resolvePackageDependencies -project "$IOS_PROJECT_PATH" -scheme "$IOS_SCHEME"
+
+      - name: Validate native Debug and Release settings
+        shell: bash
+        run: |
+          set -euo pipefail
+          debug_settings="$RUNNER_TEMP/ios-debug-build-settings.txt"
+          release_settings="$RUNNER_TEMP/ios-release-build-settings.txt"
+          xcodebuild -showBuildSettings \
+            -project "$IOS_PROJECT_PATH" \
+            -scheme "$IOS_SCHEME" \
+            -configuration Debug \
+            CODE_SIGNING_ALLOWED=NO > "$debug_settings"
+          xcodebuild -showBuildSettings \
+            -project "$IOS_PROJECT_PATH" \
+            -scheme "$IOS_SCHEME" \
+            -configuration Release \
+            CODE_SIGNING_ALLOWED=NO > "$release_settings"
+
+          grep -Eq '^[[:space:]]*PRODUCT_BUNDLE_IDENTIFIER = io\.truckwash\.app\.debug$' "$debug_settings"
+          grep -Eq '^[[:space:]]*APP_DISPLAY_NAME = Truck Wash Debug$' "$debug_settings"
+          grep -Eq '^[[:space:]]*PRODUCT_NAME = TruckWashDebug$' "$debug_settings"
+          grep -Eq '^[[:space:]]*CAPACITOR_DEBUG = true$' "$debug_settings"
+          grep -Eq '^[[:space:]]*DEBUG_INFORMATION_FORMAT = dwarf-with-dsym$' "$debug_settings"
+          grep -Eq '^[[:space:]]*IPHONEOS_DEPLOYMENT_TARGET = 15\.0$' "$debug_settings"
+          grep -Eq '^[[:space:]]*PRODUCT_BUNDLE_IDENTIFIER = io\.truckwash\.app$' "$release_settings"
+          grep -Eq '^[[:space:]]*APP_DISPLAY_NAME = Truck Wash$' "$release_settings"
+          grep -Eq '^[[:space:]]*PRODUCT_NAME = App$' "$release_settings"
+
+      - name: Install and validate Apple development signing assets
+        shell: bash
+        env:
+          IOS_DEBUG_CERTIFICATE_BASE64: ${{ secrets.IOS_DEBUG_CERTIFICATE_BASE64 }}
+          IOS_DEBUG_CERTIFICATE_PASSWORD: ${{ secrets.IOS_DEBUG_CERTIFICATE_PASSWORD }}
+          IOS_DEBUG_PROVISION_PROFILE_BASE64: ${{ secrets.IOS_DEBUG_PROVISION_PROFILE_BASE64 }}
+          IOS_DEBUG_ALLOWED_UDIDS: ${{ secrets.IOS_DEBUG_ALLOWED_UDIDS }}
+        run: |
+          set -euo pipefail
+          node scripts/mobile/check-ios-debug-signing-env.mjs
+
+          certificate_path="$RUNNER_TEMP/ios-debug-development.p12"
+          profile_path="$RUNNER_TEMP/ios-debug-development.mobileprovision"
+          profile_plist="$RUNNER_TEMP/ios-debug-development-profile.plist"
+          keychain_path="$RUNNER_TEMP/ios-debug-signing.keychain-db"
+          keychain_password="$(openssl rand -base64 48 | tr -d '\n')"
+          echo "::add-mask::$keychain_password"
+
+          node -e "const fs = require('fs'); fs.writeFileSync(process.argv[1], Buffer.from(process.env.IOS_DEBUG_CERTIFICATE_BASE64.replace(/\\s/g, ''), 'base64'))" "$certificate_path"
+          node -e "const fs = require('fs'); fs.writeFileSync(process.argv[1], Buffer.from(process.env.IOS_DEBUG_PROVISION_PROFILE_BASE64.replace(/\\s/g, ''), 'base64'))" "$profile_path"
+          chmod 600 "$certificate_path" "$profile_path"
+          security cms -D -i "$profile_path" > "$profile_plist"
+
+          security create-keychain -p "$keychain_password" "$keychain_path"
+          security set-keychain-settings -lut 21600 "$keychain_path"
+          security unlock-keychain -p "$keychain_password" "$keychain_path"
+          security import "$certificate_path" \
+            -P "$IOS_DEBUG_CERTIFICATE_PASSWORD" \
+            -A \
+            -t cert \
+            -f pkcs12 \
+            -k "$keychain_path"
+          security list-keychains -d user -s "$keychain_path" $(security list-keychains -d user | tr -d '"')
+          security set-key-partition-list \
+            -S apple-tool:,apple: \
+            -s \
+            -k "$keychain_password" \
+            "$keychain_path"
+
+          signing_identity_sha="$(security find-identity -v -p codesigning "$keychain_path" | awk '/Apple Development/ {print $2; exit}')"
+          if [[ ! "$signing_identity_sha" =~ ^[0-9A-Fa-f]{40}$ ]]; then
+            echo "The PKCS#12 file does not contain a valid Apple Development signing identity" >&2
+            exit 1
+          fi
+
+          IOS_SIGNING_IDENTITY_SHA="$signing_identity_sha" PROFILE_PLIST="$profile_plist" python3 <<'PY'
+          import datetime
+          import hashlib
+          import os
+          import plistlib
+          import re
+          import sys
+
+          with open(os.environ["PROFILE_PLIST"], "rb") as handle:
+              profile = plistlib.load(handle)
+
+          team_id = os.environ["APPLE_TEAM_ID"]
+          bundle_id = os.environ["IOS_DEBUG_BUNDLE_ID"]
+          entitlements = profile.get("Entitlements", {})
+          allowed = {line.strip() for line in os.environ["IOS_DEBUG_ALLOWED_UDIDS"].splitlines() if line.strip()}
+          provisioned = set(profile.get("ProvisionedDevices", []))
+          expiration = profile.get("ExpirationDate")
+          now = datetime.datetime.now(datetime.timezone.utc)
+          if expiration and expiration.tzinfo is None:
+              expiration = expiration.replace(tzinfo=datetime.timezone.utc)
+
+          checks = {
+              "profile team identifier": team_id in profile.get("TeamIdentifier", []),
+              "application identifier": entitlements.get("application-identifier") == f"{team_id}.{bundle_id}",
+              "entitlement team identifier": entitlements.get("com.apple.developer.team-identifier") == team_id,
+              "development entitlement": entitlements.get("get-task-allow") is True,
+              "profile expiration": expiration is not None and expiration > now,
+              "registered devices": bool(allowed) and allowed <= provisioned,
+              "non-enterprise profile": profile.get("ProvisionsAllDevices") is not True,
+              "developer certificate": bool(profile.get("DeveloperCertificates")),
+              "profile UUID": isinstance(profile.get("UUID"), str) and re.fullmatch(r"[0-9A-Fa-f-]{36}", profile["UUID"]) is not None,
+              "safe profile name": isinstance(profile.get("Name"), str) and not any(char in profile["Name"] for char in "\r\n"),
+          }
+          identity_sha = os.environ["IOS_SIGNING_IDENTITY_SHA"].upper()
+          certificate_hashes = {hashlib.sha1(value).hexdigest().upper() for value in profile.get("DeveloperCertificates", [])}
+          checks["certificate belongs to profile"] = identity_sha in certificate_hashes
+
+          failures = [label for label, passed in checks.items() if not passed]
+          if failures:
+              print("Development provisioning profile validation failed:", file=sys.stderr)
+              for failure in failures:
+                  print(f"- {failure}", file=sys.stderr)
+              sys.exit(1)
+          PY
+
+          profile_uuid="$(/usr/libexec/PlistBuddy -c 'Print :UUID' "$profile_plist")"
+          profile_name="$(/usr/libexec/PlistBuddy -c 'Print :Name' "$profile_plist")"
+          profile_expiration="$(PROFILE_PLIST="$profile_plist" python3 - <<'PY'
+          import datetime
+          import os
+          import plistlib
+
+          with open(os.environ["PROFILE_PLIST"], "rb") as handle:
+              expiration = plistlib.load(handle)["ExpirationDate"]
+          if expiration.tzinfo is None:
+              expiration = expiration.replace(tzinfo=datetime.timezone.utc)
+          print(expiration.astimezone(datetime.timezone.utc).isoformat().replace("+00:00", "Z"))
+          PY
+          )"
+          profile_install_dir="$HOME/Library/MobileDevice/Provisioning Profiles"
+          profile_install_path="$profile_install_dir/$profile_uuid.mobileprovision"
+          mkdir -p "$profile_install_dir"
+          cp "$profile_path" "$profile_install_path"
+
+          echo "IOS_KEYCHAIN_PATH=$keychain_path" >> "$GITHUB_ENV"
+          echo "IOS_PROFILE_INSTALL_PATH=$profile_install_path" >> "$GITHUB_ENV"
+          echo "IOS_PROFILE_NAME=$profile_name" >> "$GITHUB_ENV"
+          echo "IOS_PROFILE_UUID=$profile_uuid" >> "$GITHUB_ENV"
+          echo "IOS_PROFILE_EXPIRATION=$profile_expiration" >> "$GITHUB_ENV"
+
+      - name: Archive Debug app with Apple Development signing
+        shell: bash
+        run: |
+          set -euo pipefail
+          archive_path="$RUNNER_TEMP/TruckWashDebug.xcarchive"
+          xcodebuild \
+            -project "$IOS_PROJECT_PATH" \
+            -scheme "$IOS_SCHEME" \
+            -configuration Debug \
+            -destination "generic/platform=iOS" \
+            -archivePath "$archive_path" \
+            archive \
+            DEVELOPMENT_TEAM="$APPLE_TEAM_ID" \
+            CODE_SIGN_STYLE=Manual \
+            CODE_SIGN_IDENTITY="Apple Development" \
+            PROVISIONING_PROFILE_SPECIFIER="$IOS_PROFILE_NAME" \
+            PRODUCT_BUNDLE_IDENTIFIER="$IOS_DEBUG_BUNDLE_ID" \
+            MARKETING_VERSION="$MOBILE_VERSION_NAME" \
+            CURRENT_PROJECT_VERSION="$MOBILE_VERSION_CODE" \
+            DEBUG_INFORMATION_FORMAT="dwarf-with-dsym" \
+            ONLY_ACTIVE_ARCH=NO
+          echo "IOS_ARCHIVE_PATH=$archive_path" >> "$GITHUB_ENV"
+
+      - name: Export development IPA
+        shell: bash
+        run: |
+          set -euo pipefail
+          export_options="$RUNNER_TEMP/ios-debug-ExportOptions.plist"
+          export_path="$RUNNER_TEMP/ios-debug-export"
+          EXPORT_OPTIONS="$export_options" python3 <<'PY'
+          import os
+          import plistlib
+
+          options = {
+              "method": "development",
+              "signingStyle": "manual",
+              "teamID": os.environ["APPLE_TEAM_ID"],
+              "provisioningProfiles": {
+                  os.environ["IOS_DEBUG_BUNDLE_ID"]: os.environ["IOS_PROFILE_NAME"],
+              },
+              "stripSwiftSymbols": True,
+              "manageAppVersionAndBuildNumber": False,
+          }
+          with open(os.environ["EXPORT_OPTIONS"], "wb") as handle:
+              plistlib.dump(options, handle)
+          PY
+          xcodebuild \
+            -exportArchive \
+            -archivePath "$IOS_ARCHIVE_PATH" \
+            -exportPath "$export_path" \
+            -exportOptionsPlist "$export_options"
+
+          shopt -s nullglob
+          ipa_files=("$export_path"/*.ipa)
+          if [[ ${#ipa_files[@]} -ne 1 ]]; then
+            echo "Expected exactly one exported IPA; found ${#ipa_files[@]}" >&2
+            exit 1
+          fi
+          echo "IOS_EXPORTED_IPA=${ipa_files[0]}" >> "$GITHUB_ENV"
+
+      - name: Validate exported IPA and embedded signature
+        shell: bash
+        env:
+          IOS_DEBUG_ALLOWED_UDIDS: ${{ secrets.IOS_DEBUG_ALLOWED_UDIDS }}
+        run: |
+          set -euo pipefail
+          inspect_dir="$RUNNER_TEMP/ios-debug-inspect"
+          mkdir -p "$inspect_dir"
+          unzip -q "$IOS_EXPORTED_IPA" -d "$inspect_dir"
+          shopt -s nullglob
+          app_bundles=("$inspect_dir"/Payload/*.app)
+          if [[ ${#app_bundles[@]} -ne 1 ]]; then
+            echo "Expected exactly one Payload app; found ${#app_bundles[@]}" >&2
+            exit 1
+          fi
+
+          app_path="${app_bundles[0]}"
+          app_info="$app_path/Info.plist"
+          embedded_profile="$RUNNER_TEMP/ios-debug-embedded-profile.plist"
+          signature_entitlements="$RUNNER_TEMP/ios-debug-signature-entitlements.plist"
+          signature_details="$RUNNER_TEMP/ios-debug-signature-details.txt"
+          security cms -D -i "$app_path/embedded.mobileprovision" > "$embedded_profile"
+          codesign --verify --deep --strict "$app_path"
+          codesign -d --entitlements :- "$app_path" > "$signature_entitlements"
+          codesign -dvv "$app_path" > /dev/null 2> "$signature_details"
+          grep -Fq "TeamIdentifier=$APPLE_TEAM_ID" "$signature_details"
+          grep -Eq '^Authority=Apple Development:' "$signature_details"
+
+          executable_name="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleExecutable' "$app_info")"
+          architectures="$(lipo -archs "$app_path/$executable_name")"
+          if [[ " $architectures " != *" arm64 "* ]]; then
+            echo "Exported executable does not contain arm64" >&2
+            exit 1
+          fi
+
+          APP_INFO="$app_info" PROFILE_PLIST="$embedded_profile" SIGNATURE_ENTITLEMENTS="$signature_entitlements" python3 <<'PY'
+          import datetime
+          import os
+          import plistlib
+          import sys
+
+          def load(path):
+              with open(path, "rb") as handle:
+                  return plistlib.load(handle)
+
+          info = load(os.environ["APP_INFO"])
+          profile = load(os.environ["PROFILE_PLIST"])
+          signature = load(os.environ["SIGNATURE_ENTITLEMENTS"])
+          profile_entitlements = profile.get("Entitlements", {})
+          team_id = os.environ["APPLE_TEAM_ID"]
+          bundle_id = os.environ["IOS_DEBUG_BUNDLE_ID"]
+          allowed = {line.strip() for line in os.environ["IOS_DEBUG_ALLOWED_UDIDS"].splitlines() if line.strip()}
+          provisioned = set(profile.get("ProvisionedDevices", []))
+          expiration = profile.get("ExpirationDate")
+          now = datetime.datetime.now(datetime.timezone.utc)
+          if expiration and expiration.tzinfo is None:
+              expiration = expiration.replace(tzinfo=datetime.timezone.utc)
+
+          checks = {
+              "bundle identifier": info.get("CFBundleIdentifier") == bundle_id,
+              "display name": info.get("CFBundleDisplayName") == "Truck Wash Debug",
+              "debug executable": info.get("CFBundleExecutable") == "TruckWashDebug",
+              "marketing version": info.get("CFBundleShortVersionString") == os.environ["MOBILE_VERSION_NAME"],
+              "build number": info.get("CFBundleVersion") == os.environ["MOBILE_VERSION_CODE"],
+              "minimum iOS": info.get("MinimumOSVersion") == "15.0",
+              "profile UUID": profile.get("UUID") == os.environ["IOS_PROFILE_UUID"],
+              "profile team": team_id in profile.get("TeamIdentifier", []),
+              "profile application identifier": profile_entitlements.get("application-identifier") == f"{team_id}.{bundle_id}",
+              "development profile": profile_entitlements.get("get-task-allow") is True,
+              "signature application identifier": signature.get("application-identifier") == f"{team_id}.{bundle_id}",
+              "signature team identifier": signature.get("com.apple.developer.team-identifier") == team_id,
+              "debuggable signature": signature.get("get-task-allow") is True,
+              "profile expiration": expiration is not None and expiration > now,
+              "registered devices": bool(allowed) and allowed <= provisioned,
+              "non-enterprise profile": profile.get("ProvisionsAllDevices") is not True,
+          }
+          failures = [label for label, passed in checks.items() if not passed]
+          if failures:
+              print("Exported development IPA validation failed:", file=sys.stderr)
+              for failure in failures:
+                  print(f"- {failure}", file=sys.stderr)
+              sys.exit(1)
+          PY
+
+      - name: Assemble debug artifact
+        shell: bash
+        env:
+          SOURCE_REF: ${{ inputs.source_ref }}
+        run: |
+          set -euo pipefail
+          short_sha="${RESOLVED_SOURCE_SHA:0:12}"
+          artifact_name="truck-wash-debug-${MOBILE_VERSION_NAME}-${short_sha}"
+          artifact_dir="$RUNNER_TEMP/device-debug-artifact"
+          ipa_filename="$artifact_name.ipa"
+          dsym_filename="$artifact_name.dSYM.zip"
+          mkdir -p "$artifact_dir"
+          cp "$IOS_EXPORTED_IPA" "$artifact_dir/$ipa_filename"
+
+          shopt -s nullglob
+          dsym_bundles=("$IOS_ARCHIVE_PATH"/dSYMs/*.dSYM)
+          if [[ ${#dsym_bundles[@]} -eq 0 ]]; then
+            echo "The Debug archive did not contain any dSYM bundles" >&2
+            exit 1
+          fi
+          ditto -c -k --sequesterRsrc --keepParent "$IOS_ARCHIVE_PATH/dSYMs" "$artifact_dir/$dsym_filename"
+
+          capacitor_version="$(node -p "require('./node_modules/@capacitor/core/package.json').version")"
+          BUILT_AT_UTC="$(date -u '+%Y-%m-%dT%H:%M:%SZ')" \
+          CAPACITOR_VERSION="$capacitor_version" \
+          DSYM_FILENAME="$dsym_filename" \
+          IPA_FILENAME="$ipa_filename" \
+          MANIFEST_PATH="$artifact_dir/manifest.json" \
+          python3 <<'PY'
+          import json
+          import os
+
+          manifest = {
+              "schema_version": 1,
+              "repository": os.environ["GITHUB_REPOSITORY"],
+              "source_ref": os.environ["SOURCE_REF"],
+              "source_sha": os.environ["RESOLVED_SOURCE_SHA"],
+              "workflow_run": int(os.environ["GITHUB_RUN_NUMBER"]),
+              "workflow_attempt": int(os.environ["GITHUB_RUN_ATTEMPT"]),
+              "built_at_utc": os.environ["BUILT_AT_UTC"],
+              "api_url": os.environ["IOS_DEBUG_API_URL"],
+              "release_manager_control_api_url": os.environ["IOS_DEBUG_API_URL"],
+              "bundle_id": os.environ["IOS_DEBUG_BUNDLE_ID"],
+              "display_name": "Truck Wash Debug",
+              "executable_name": "TruckWashDebug",
+              "version": os.environ["MOBILE_VERSION_NAME"],
+              "build": os.environ["MOBILE_VERSION_CODE"],
+              "minimum_ios": "15.0",
+              "capacitor_version": os.environ["CAPACITOR_VERSION"],
+              "xcode_version": os.environ["XCODE_VERSION"],
+              "signing_method": "development",
+              "profile_expiration_utc": os.environ["IOS_PROFILE_EXPIRATION"],
+              "ipa_filename": os.environ["IPA_FILENAME"],
+              "dsym_filename": os.environ["DSYM_FILENAME"],
+          }
+          with open(os.environ["MANIFEST_PATH"], "w", encoding="utf-8") as handle:
+              json.dump(manifest, handle, indent=2, sort_keys=True)
+              handle.write("\n")
+          PY
+
+          (
+            cd "$artifact_dir"
+            shasum -a 256 "$ipa_filename" "$dsym_filename" manifest.json > SHA256SUMS
+          )
+          echo "IOS_DEBUG_ARTIFACT_DIR=$artifact_dir" >> "$GITHUB_ENV"
+          echo "IOS_DEBUG_ARTIFACT_NAME=$artifact_name" >> "$GITHUB_ENV"
+
+      - name: Upload device-debug artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ${{ env.IOS_DEBUG_ARTIFACT_NAME }}
+          path: ${{ env.IOS_DEBUG_ARTIFACT_DIR }}
+          if-no-files-found: error
+          retention-days: 7
+
+      - name: Clean up Apple signing assets
+        if: always()
+        shell: bash
+        run: |
+          if [[ -n "${IOS_KEYCHAIN_PATH:-}" ]]; then
+            security delete-keychain "$IOS_KEYCHAIN_PATH" || true
+          else
+            security delete-keychain "$RUNNER_TEMP/ios-debug-signing.keychain-db" || true
+          fi
+          if [[ -n "${IOS_PROFILE_INSTALL_PATH:-}" ]]; then
+            rm -f "$IOS_PROFILE_INSTALL_PATH"
+          fi
+          rm -f \
+            "$RUNNER_TEMP/ios-debug-development.p12" \
+            "$RUNNER_TEMP/ios-debug-development.mobileprovision" \
+            "$RUNNER_TEMP/ios-debug-development-profile.plist" \
+            "$RUNNER_TEMP/ios-debug-embedded-profile.plist" \
+            "$RUNNER_TEMP/ios-debug-signature-entitlements.plist" \
+            "$RUNNER_TEMP/ios-debug-signature-details.txt"

.github/workflows/ios-testflight.yml

@@ -0,0 +1,437 @@
+name: iOS Internal TestFlight
+
+on:
+  workflow_run:
+    workflows: [Frontend Release]
+    types: [completed]
+    branches: [master]
+  workflow_dispatch:
+    inputs:
+      source_sha:
+        description: Full master commit SHA with a verified Frontend Release proof
+        required: true
+        type: string
+      confirmation:
+        description: Type UPLOAD IOS INTERNAL BUILD
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: ios-internal-testflight
+  cancel-in-progress: false
+
+jobs:
+  prepare:
+    name: Resolve verified release
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.event == 'workflow_run' &&
+       github.event.workflow_run.head_branch == 'master' &&
+       github.event.workflow_run.head_repository.full_name == github.repository)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    outputs:
+      source_sha: ${{ steps.resolve.outputs.source_sha }}
+      enabled: ${{ steps.resolve.outputs.enabled }}
+      current: ${{ steps.resolve.outputs.current }}
+    steps:
+      - name: Checkout repository history
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Resolve immutable source and rollout gate
+        id: resolve
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          WORKFLOW_SOURCE_SHA: ${{ github.event.workflow_run.head_sha || '' }}
+          INPUT_SOURCE_SHA: ${{ inputs.source_sha || '' }}
+          CONFIRMATION: ${{ inputs.confirmation || '' }}
+          AUTOMATION_ENABLED: ${{ vars.APP_STORE_AUTOMATION_ENABLED || 'false' }}
+        run: |
+          set -euo pipefail
+          source_sha="$WORKFLOW_SOURCE_SHA"
+          if [[ "$EVENT_NAME" == workflow_dispatch ]]; then
+            [[ "$GITHUB_REF" == refs/heads/master ]] || { echo "Dispatch this workflow from master." >&2; exit 1; }
+            [[ "$CONFIRMATION" == "UPLOAD IOS INTERNAL BUILD" ]] || { echo "Invalid confirmation." >&2; exit 1; }
+            source_sha="${INPUT_SOURCE_SHA,,}"
+          fi
+          [[ "$source_sha" =~ ^[0-9a-f]{40}$ ]] || { echo "A full lowercase source SHA is required." >&2; exit 1; }
+          git show-ref --verify --quiet refs/remotes/origin/master || { echo "origin/master was not included in the full checkout." >&2; exit 1; }
+          git cat-file -e "${source_sha}^{commit}"
+          git merge-base --is-ancestor "$source_sha" origin/master || { echo "Source is not reachable from master." >&2; exit 1; }
+          current=false
+          [[ "$(git rev-parse origin/master)" == "$source_sha" ]] && current=true
+          enabled=false
+          [[ "$AUTOMATION_ENABLED" == true ]] && enabled=true
+          echo "source_sha=$source_sha" >> "$GITHUB_OUTPUT"
+          echo "current=$current" >> "$GITHUB_OUTPUT"
+          echo "enabled=$enabled" >> "$GITHUB_OUTPUT"
+          if [[ "$enabled" != true ]]; then
+            echo "### iOS automation is safely disabled" >> "$GITHUB_STEP_SUMMARY"
+            echo 'Set repository variable `APP_STORE_AUTOMATION_ENABLED=true` only after the signing/API credential canary passes.' >> "$GITHUB_STEP_SUMMARY"
+          elif [[ "$current" != true ]]; then
+            echo "### Stale release skipped" >> "$GITHUB_STEP_SUMMARY"
+            echo "The verified SHA is no longer current master." >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+      - name: Require green WebKit mobile tests before App Store upload
+        if: steps.resolve.outputs.enabled == 'true' && steps.resolve.outputs.current == 'true'
+        run: node scripts/mobile/verify-store-test-gate.mjs --platform apple
+        env:
+          GH_TOKEN: ${{ github.token }}
+          STORE_SOURCE_SHA: ${{ steps.resolve.outputs.source_sha }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+
+  deliver:
+    name: Sign, upload, process, and distribute
+    needs: prepare
+    if: needs.prepare.outputs.enabled == 'true' && needs.prepare.outputs.current == 'true'
+    runs-on: macos-15
+    timeout-minutes: 120
+    environment: app-store-signing
+    env:
+      DEVELOPER_DIR: /Applications/Xcode_26.3.app/Contents/Developer
+      IOS_SOURCE_SHA: ${{ needs.prepare.outputs.source_sha }}
+      IOS_PROJECT_PATH: ${{ vars.IOS_PROJECT || 'ios/App/App.xcodeproj' }}
+      IOS_SCHEME: ${{ vars.IOS_SCHEME || 'App' }}
+      IOS_BUNDLE_ID: ${{ vars.IOS_BUNDLE_ID || 'io.truckwash.app' }}
+      APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
+      APP_STORE_CONNECT_API_KEY_ID: ${{ vars.APP_STORE_CONNECT_API_KEY_ID }}
+      APP_STORE_CONNECT_ISSUER_ID: ${{ vars.APP_STORE_CONNECT_ISSUER_ID || '' }}
+      APP_STORE_CONNECT_APP_ID: ${{ vars.APP_STORE_CONNECT_APP_ID }}
+      TESTFLIGHT_INTERNAL_GROUP_ID: ${{ vars.TESTFLIGHT_INTERNAL_GROUP_ID }}
+      APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64 }}
+    steps:
+      - name: Checkout verified source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ env.IOS_SOURCE_SHA }}
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Download and verify frontend release proof
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TRIGGERING_RELEASE_RUN_ID: ${{ github.event.workflow_run.id || '' }}
+        run: |
+          set -euo pipefail
+          artifact_name="frontend-release-proof-$IOS_SOURCE_SHA"
+          response="$RUNNER_TEMP/proof-artifacts.json"
+          curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts?name=$artifact_name&per_page=100" > "$response"
+          artifact_id="$(jq -r --arg run "$TRIGGERING_RELEASE_RUN_ID" '
+            [.artifacts[] | select(.expired == false) | select(($run == "") or ((.workflow_run.id|tostring) == $run))] |
+            sort_by(.created_at) | last | .id // empty' "$response")"
+          [[ "$artifact_id" =~ ^[0-9]+$ ]] || { echo "No verified Frontend Release proof found for $IOS_SOURCE_SHA." >&2; exit 1; }
+          mkdir -p output/frontend-release-proof
+          curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts/$artifact_id/zip" -o "$RUNNER_TEMP/proof.zip"
+          unzip -q "$RUNNER_TEMP/proof.zip" -d output/frontend-release-proof
+          PROOF_PATH=output/frontend-release-proof/frontend-release-proof.json node <<'NODE'
+          const fs = require("node:fs");
+          const proof = JSON.parse(fs.readFileSync(process.env.PROOF_PATH, "utf8"));
+          const checks = {
+            schema: proof.schemaVersion === 2,
+            repository: proof.repository === process.env.GITHUB_REPOSITORY,
+            source: proof.sourceSha === process.env.IOS_SOURCE_SHA,
+            exactSource: proof.sha === process.env.IOS_SOURCE_SHA,
+            releaseIdentity: typeof proof.releaseId === "string" && proof.releaseId.length > 0,
+            archive: /^[a-f0-9]{64}$/.test(proof.archiveSha256 || ""),
+            activeTarget: typeof proof.activeTarget === "string" && proof.activeTarget.length > 0,
+            verification: proof.verificationState === "verified",
+            publicGate: proof.livePublicGate === "passed",
+            credentialedGate: ["passed", "not-configured"].includes(proof.liveCredentialedGate),
+            managerGate: proof.releaseManagerGate === "passed",
+            serverVersion: proof.serverVersionUpdated === true,
+            serverVersionReadBack: proof.serverVersionReadBack === "passed",
+          };
+          const failures = Object.entries(checks).filter(([, passed]) => !passed).map(([label]) => label);
+          if (failures.length) throw new Error(`Invalid frontend release proof: ${failures.join(", ")}`);
+          NODE
+
+      - name: Verify Xcode 26 and iOS 26 SDK
+        shell: bash
+        run: |
+          set -euo pipefail
+          [[ -x "$DEVELOPER_DIR/usr/bin/xcodebuild" ]] || { echo "Xcode 26.3 is not installed at $DEVELOPER_DIR." >&2; exit 1; }
+          xcode_version="$(xcodebuild -version | sed -n '1p')"
+          sdk_version="$(xcrun --sdk iphoneos --show-sdk-version)"
+          [[ "$xcode_version" =~ ^Xcode\ 26\. ]] || { echo "Xcode 26.x required; found $xcode_version." >&2; exit 1; }
+          [[ "$sdk_version" =~ ^26\. ]] || { echo "iPhoneOS 26 SDK required; found $sdk_version." >&2; exit 1; }
+          echo "XCODE_VERSION=$xcode_version" >> "$GITHUB_ENV"
+          echo "IOS_SDK_VERSION=$sdk_version" >> "$GITHUB_ENV"
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Setup Ruby and pinned Fastlane
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
+        with:
+          ruby-version: "3.3"
+          bundler-cache: true
+
+      - name: Install web dependencies
+        run: npm ci --legacy-peer-deps
+
+      - name: Validate storefront and resolve version
+        id: version
+        shell: bash
+        run: |
+          set -euo pipefail
+          node scripts/mobile/validate-app-store.mjs
+          version="$(node -p "JSON.parse(require('fs').readFileSync('ios/release.json')).marketingVersion")"
+          bundle="$(node -p "JSON.parse(require('fs').readFileSync('ios/release.json')).bundleId")"
+          [[ "$bundle" == "$IOS_BUNDLE_ID" ]]
+          echo "IOS_MARKETING_VERSION=$version" >> "$GITHUB_ENV"
+          echo "MOBILE_VERSION_NAME=$version" >> "$GITHUB_ENV"
+
+      - name: Resolve build number from App Store Connect
+        id: app-store
+        run: node scripts/mobile/app-store-connect.mjs next-build-number
+
+      - name: Export resolved build number
+        env:
+          BUILD_NUMBER: ${{ steps.app-store.outputs.build_number }}
+        run: |
+          [[ "$BUILD_NUMBER" =~ ^[1-9][0-9]*$ ]]
+          echo "IOS_BUILD_NUMBER=$BUILD_NUMBER" >> "$GITHUB_ENV"
+          echo "MOBILE_VERSION_CODE=$BUILD_NUMBER" >> "$GITHUB_ENV"
+
+      - name: Validate complete Apple environment
+        env:
+          IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64 }}
+          IOS_DISTRIBUTION_CERTIFICATE_PASSWORD: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_PASSWORD }}
+          IOS_APP_STORE_PROFILE_BASE64: ${{ secrets.IOS_APP_STORE_PROFILE_BASE64 }}
+          UPLOAD_IOS_TO_APP_STORE: "true"
+        run: node scripts/mobile/check-store-upload-env.mjs --ios
+
+      - name: Build and sync production iOS shell
+        run: |
+          npm run build
+          npx cap sync ios
+          npm run mobile:permissions:check
+          xcodebuild -resolvePackageDependencies -project "$IOS_PROJECT_PATH" -scheme "$IOS_SCHEME"
+
+      - name: Validate native release settings
+        shell: bash
+        run: |
+          set -euo pipefail
+          settings="$RUNNER_TEMP/ios-release-build-settings.txt"
+          xcodebuild -showBuildSettings -project "$IOS_PROJECT_PATH" -scheme "$IOS_SCHEME" -configuration Release CODE_SIGNING_ALLOWED=NO > "$settings"
+          grep -Eq "^[[:space:]]*PRODUCT_BUNDLE_IDENTIFIER = ${IOS_BUNDLE_ID//./\.}$" "$settings"
+          grep -Eq '^[[:space:]]*APP_DISPLAY_NAME = Truck Wash$' "$settings"
+          grep -Eq '^[[:space:]]*IPHONEOS_DEPLOYMENT_TARGET = 15\.0$' "$settings"
+          if grep -q 'isa = PBXShellScriptBuildPhase;' "$IOS_PROJECT_PATH/project.pbxproj"; then
+            echo "Unexpected Xcode shell-script build phase detected." >&2
+            exit 1
+          fi
+
+      - name: Install and validate Apple distribution signing assets
+        shell: bash
+        env:
+          IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64 }}
+          IOS_DISTRIBUTION_CERTIFICATE_PASSWORD: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_PASSWORD }}
+          IOS_APP_STORE_PROFILE_BASE64: ${{ secrets.IOS_APP_STORE_PROFILE_BASE64 }}
+        run: |
+          set -euo pipefail
+          certificate_path="$RUNNER_TEMP/apple-distribution.p12"
+          profile_path="$RUNNER_TEMP/app-store.mobileprovision"
+          profile_plist="$RUNNER_TEMP/app-store-profile.plist"
+          keychain_path="$RUNNER_TEMP/app-store-signing.keychain-db"
+          keychain_password="$(openssl rand -base64 48 | tr -d '\n')"
+          echo "::add-mask::$keychain_password"
+          echo "IOS_KEYCHAIN_PATH=$keychain_path" >> "$GITHUB_ENV"
+          node -e "const fs=require('fs'); fs.writeFileSync(process.argv[1], Buffer.from(process.env.IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64.replace(/\\s/g,''),'base64'))" "$certificate_path"
+          node -e "const fs=require('fs'); fs.writeFileSync(process.argv[1], Buffer.from(process.env.IOS_APP_STORE_PROFILE_BASE64.replace(/\\s/g,''),'base64'))" "$profile_path"
+          chmod 600 "$certificate_path" "$profile_path"
+          security cms -D -i "$profile_path" > "$profile_plist"
+          security create-keychain -p "$keychain_password" "$keychain_path"
+          security set-keychain-settings -lut 21600 "$keychain_path"
+          security unlock-keychain -p "$keychain_password" "$keychain_path"
+          security import "$certificate_path" -P "$IOS_DISTRIBUTION_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain_path"
+          security list-keychains -d user -s "$keychain_path" $(security list-keychains -d user | tr -d '"')
+          security set-key-partition-list -S apple-tool:,apple: -s -k "$keychain_password" "$keychain_path"
+          identity_sha="$(security find-identity -v -p codesigning "$keychain_path" | awk '/Apple Distribution/ {print $2; exit}')"
+          [[ "$identity_sha" =~ ^[0-9A-Fa-f]{40}$ ]] || { echo "P12 lacks an Apple Distribution identity." >&2; exit 1; }
+          IOS_SIGNING_IDENTITY_SHA="$identity_sha" PROFILE_PLIST="$profile_plist" python3 <<'PY'
+          import datetime, hashlib, os, plistlib, re, sys
+          with open(os.environ["PROFILE_PLIST"], "rb") as handle: profile = plistlib.load(handle)
+          entitlements = profile.get("Entitlements", {})
+          expiration = profile.get("ExpirationDate")
+          if expiration and expiration.tzinfo is None: expiration = expiration.replace(tzinfo=datetime.timezone.utc)
+          team = os.environ["APPLE_TEAM_ID"]
+          bundle = os.environ["IOS_BUNDLE_ID"]
+          hashes = {hashlib.sha1(value).hexdigest().upper() for value in profile.get("DeveloperCertificates", [])}
+          checks = {
+            "team": team in profile.get("TeamIdentifier", []),
+            "application identifier": entitlements.get("application-identifier") == f"{team}.{bundle}",
+            "team entitlement": entitlements.get("com.apple.developer.team-identifier") == team,
+            "distribution entitlement": entitlements.get("get-task-allow") is False,
+            "App Store profile has no devices": not profile.get("ProvisionedDevices"),
+            "non-enterprise profile": profile.get("ProvisionsAllDevices") is not True,
+            "expiration": expiration is not None and expiration > datetime.datetime.now(datetime.timezone.utc),
+            "certificate belongs to profile": os.environ["IOS_SIGNING_IDENTITY_SHA"].upper() in hashes,
+            "safe profile name": isinstance(profile.get("Name"), str) and not re.search(r"[\r\n]", profile["Name"]),
+          }
+          failed = [name for name, passed in checks.items() if not passed]
+          if failed:
+            print("Distribution signing validation failed:", *[f"- {name}" for name in failed], sep="\n", file=sys.stderr)
+            sys.exit(1)
+          PY
+          profile_uuid="$(/usr/libexec/PlistBuddy -c 'Print :UUID' "$profile_plist")"
+          profile_name="$(/usr/libexec/PlistBuddy -c 'Print :Name' "$profile_plist")"
+          profile_install="$HOME/Library/MobileDevice/Provisioning Profiles/$profile_uuid.mobileprovision"
+          mkdir -p "$(dirname "$profile_install")"
+          echo "IOS_PROFILE_INSTALL_PATH=$profile_install" >> "$GITHUB_ENV"
+          cp "$profile_path" "$profile_install"
+          echo "IOS_PROFILE_NAME=$profile_name" >> "$GITHUB_ENV"
+          echo "IOS_PROFILE_UUID=$profile_uuid" >> "$GITHUB_ENV"
+
+      - name: Archive and export App Store IPA
+        shell: bash
+        run: |
+          set -euo pipefail
+          archive="$RUNNER_TEMP/TruckWash.xcarchive"
+          export_dir="$RUNNER_TEMP/ios-export"
+          export_options="$RUNNER_TEMP/ExportOptions.plist"
+          xcodebuild -project "$IOS_PROJECT_PATH" -scheme "$IOS_SCHEME" -configuration Release \
+            -destination 'generic/platform=iOS' -archivePath "$archive" archive \
+            DEVELOPMENT_TEAM="$APPLE_TEAM_ID" CODE_SIGN_STYLE=Manual CODE_SIGN_IDENTITY='Apple Distribution' \
+            PROVISIONING_PROFILE_SPECIFIER="$IOS_PROFILE_NAME" MARKETING_VERSION="$IOS_MARKETING_VERSION" \
+            CURRENT_PROJECT_VERSION="$IOS_BUILD_NUMBER" DEBUG_INFORMATION_FORMAT='dwarf-with-dsym'
+          EXPORT_OPTIONS="$export_options" python3 <<'PY'
+          import os, plistlib
+          options = {"method":"app-store-connect","signingStyle":"manual","teamID":os.environ["APPLE_TEAM_ID"],"provisioningProfiles":{os.environ["IOS_BUNDLE_ID"]:os.environ["IOS_PROFILE_NAME"]},"stripSwiftSymbols":True,"manageAppVersionAndBuildNumber":False}
+          with open(os.environ["EXPORT_OPTIONS"], "wb") as handle: plistlib.dump(options, handle)
+          PY
+          xcodebuild -exportArchive -archivePath "$archive" -exportPath "$export_dir" -exportOptionsPlist "$export_options"
+          shopt -s nullglob
+          ipa_files=("$export_dir"/*.ipa)
+          [[ ${#ipa_files[@]} -eq 1 ]] || { echo "Expected one IPA; found ${#ipa_files[@]}." >&2; exit 1; }
+          echo "IOS_ARCHIVE_PATH=$archive" >> "$GITHUB_ENV"
+          echo "IOS_IPA_PATH=${ipa_files[0]}" >> "$GITHUB_ENV"
+
+      - name: Inspect signed IPA
+        shell: bash
+        run: |
+          set -euo pipefail
+          inspect="$RUNNER_TEMP/ios-inspect"
+          unzip -q "$IOS_IPA_PATH" -d "$inspect"
+          shopt -s nullglob
+          apps=("$inspect"/Payload/*.app)
+          [[ ${#apps[@]} -eq 1 ]] || { echo "Expected one Payload app." >&2; exit 1; }
+          app="${apps[0]}"
+          codesign --verify --deep --strict "$app"
+          codesign -d --entitlements :- "$app" > "$RUNNER_TEMP/entitlements.plist"
+          security cms -D -i "$app/embedded.mobileprovision" > "$RUNNER_TEMP/embedded-profile.plist"
+          [[ -f "$app/PrivacyInfo.xcprivacy" ]]
+          [[ -f "$app/da.lproj/InfoPlist.strings" ]]
+          [[ -f "$app/en.lproj/InfoPlist.strings" ]]
+          APP_PATH="$app" python3 <<'PY'
+          import os, plistlib, sys
+          app = os.environ["APP_PATH"]
+          with open(f"{app}/Info.plist", "rb") as handle: info = plistlib.load(handle)
+          with open(os.path.join(os.environ["RUNNER_TEMP"], "entitlements.plist"), "rb") as handle: ent = plistlib.load(handle)
+          with open(os.path.join(os.environ["RUNNER_TEMP"], "embedded-profile.plist"), "rb") as handle: profile = plistlib.load(handle)
+          checks = {
+            "bundle": info.get("CFBundleIdentifier") == os.environ["IOS_BUNDLE_ID"],
+            "version": info.get("CFBundleShortVersionString") == os.environ["IOS_MARKETING_VERSION"],
+            "build": info.get("CFBundleVersion") == os.environ["IOS_BUILD_NUMBER"],
+            "minimum iOS": info.get("MinimumOSVersion") == "15.0",
+            "profile": profile.get("UUID") == os.environ["IOS_PROFILE_UUID"],
+            "non-debug signature": ent.get("get-task-allow") is not True,
+            "signature application id": ent.get("application-identifier") == f'{os.environ["APPLE_TEAM_ID"]}.{os.environ["IOS_BUNDLE_ID"]}',
+          }
+          failed = [name for name, passed in checks.items() if not passed]
+          if failed:
+            print("IPA validation failed:", *[f"- {name}" for name in failed], sep="\n", file=sys.stderr)
+            sys.exit(1)
+          PY
+
+      - name: Recheck live master before upload
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          live_master_sha="$(curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/git/ref/heads/master" | jq -r '.object.sha')"
+          [[ "$live_master_sha" == "$IOS_SOURCE_SHA" ]] || {
+            echo "master advanced while the signed build was queued; refusing upload." >&2
+            exit 1
+          }
+      - name: Upload and wait for App Store processing
+        env:
+          TESTFLIGHT_WHAT_TO_TEST: Automatisk intern build fra verificeret master ${{ env.IOS_SOURCE_SHA }}.
+        run: bundle exec fastlane ios upload_internal
+
+      - name: Assign exact processed build to Internal QA
+        id: distribute
+        env:
+          TESTFLIGHT_WHAT_TO_TEST: Automatisk intern build fra verificeret master ${{ env.IOS_SOURCE_SHA }}.
+        run: node scripts/mobile/app-store-connect.mjs wait-and-distribute
+
+      - name: Assemble signed release evidence
+        shell: bash
+        env:
+          APP_STORE_BUILD_ID: ${{ steps.distribute.outputs.app_store_build_id }}
+        run: |
+          set -euo pipefail
+          artifact="output/ios-release"
+          mkdir -p "$artifact"
+          cp "$IOS_IPA_PATH" "$artifact/TruckWash-$IOS_MARKETING_VERSION-$IOS_BUILD_NUMBER.ipa"
+          shopt -s nullglob
+          dsyms=("$IOS_ARCHIVE_PATH"/dSYMs/*.dSYM)
+          [[ ${#dsyms[@]} -gt 0 ]] || { echo "Release archive contains no dSYM bundles." >&2; exit 1; }
+          ditto -c -k --sequesterRsrc --keepParent "$IOS_ARCHIVE_PATH/dSYMs" "$artifact/TruckWash-$IOS_MARKETING_VERSION-$IOS_BUILD_NUMBER.dSYM.zip"
+          node scripts/mobile/create-ios-release-manifest.mjs
+          (cd "$artifact" && shasum -a 256 -- * > SHA256SUMS)
+
+      - name: Upload signed IPA
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: truck-wash-ios-${{ env.IOS_SOURCE_SHA }}
+          path: output/ios-release/*.ipa
+          if-no-files-found: error
+          retention-days: 30
+
+      - name: Upload release manifest, dSYM, and checksums
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ios-release-manifest-${{ env.IOS_SOURCE_SHA }}
+          path: |
+            output/ios-release/ios-release-manifest.json
+            output/ios-release/*.dSYM.zip
+            output/ios-release/SHA256SUMS
+          if-no-files-found: error
+          retention-days: 90
+
+      - name: Clean up Apple signing material
+        if: always()
+        shell: bash
+        run: |
+          if [[ -n "${IOS_KEYCHAIN_PATH:-}" ]]; then security delete-keychain "$IOS_KEYCHAIN_PATH" || true; fi
+          if [[ -n "${IOS_PROFILE_INSTALL_PATH:-}" ]]; then rm -f "$IOS_PROFILE_INSTALL_PATH"; fi
+          rm -f "$RUNNER_TEMP/apple-distribution.p12" "$RUNNER_TEMP/app-store.mobileprovision" "$RUNNER_TEMP/app-store-profile.plist"
+
+  disabled:
+    name: Automation disabled
+    needs: prepare
+    if: needs.prepare.outputs.enabled != 'true'
+    runs-on: ubuntu-24.04
+    steps:
+      - run: echo "App Store automation is disabled; no signing environment or secrets were accessed."

.github/workflows/mobile-artifacts.yml

@@ -0,0 +1,264 @@
+name: Android Store Artifacts
+
+on:
+  workflow_dispatch:
+    inputs:
+      version_name:
+        description: Store version name, for example 1.4.0
+        required: false
+        type: string
+      version_code:
+        description: Store build number/version code
+        required: false
+        type: string
+      upload_android_to_play:
+        description: Upload the signed Android App Bundle to Google Play
+        required: false
+        type: boolean
+        default: true
+      android_track:
+        description: Google Play track for manual dispatches
+        required: false
+        type: choice
+        default: production
+        options:
+          - production
+          - beta
+          - alpha
+          - internal
+      android_release_status:
+        description: Google Play release status for manual dispatches
+        required: false
+        type: choice
+        default: inProgress
+        options:
+          - inProgress
+          - draft
+          - halted
+  push:
+    tags:
+      - "mobile-v*"
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: android-store-artifacts-${{ github.ref_name || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  android:
+    name: Android AAB and Play upload
+    runs-on: ubuntu-24.04
+    environment: mobile-store-production
+    timeout-minutes: 60
+    env:
+      ANDROID_PACKAGE_NAME: ${{ vars.ANDROID_PACKAGE_NAME || 'io.truckwash.twa' }}
+      ANDROID_AAB_PATH: ${{ vars.ANDROID_AAB_PATH || 'android/app/build/outputs/bundle/release/app-release.aab' }}
+      ANDROID_SIGNING_IDENTITY_REF: github-environment:mobile-store-production/android-keystore
+      PLAY_STORE_TRACK: ${{ inputs.android_track || vars.PLAY_STORE_TRACK || 'production' }}
+      PLAY_STORE_RELEASE_STATUS: ${{ inputs.android_release_status || 'inProgress' }}
+      PLAY_STORE_USER_FRACTION: "0.01"
+      UPLOAD_ANDROID_TO_PLAY: ${{ github.event_name != 'workflow_dispatch' || inputs.upload_android_to_play }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Guard current master release
+        id: release-guard
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          EXPECTED_SHA: ${{ github.sha }}
+          RELEASE_BRANCH: ${{ github.ref_name }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          UPLOAD_TO_PLAY: ${{ github.event_name != 'workflow_dispatch' || inputs.upload_android_to_play }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          current=true
+          latest_sha="$(curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/git/ref/heads/$DEFAULT_BRANCH" | jq -r '.object.sha // empty')"
+          if [[ ! "$latest_sha" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "Could not resolve origin/$DEFAULT_BRANCH." >&2
+            exit 1
+          fi
+          if [[ "$latest_sha" != "$EXPECTED_SHA" && "$UPLOAD_TO_PLAY" == "true" ]]; then
+            current=false
+            echo "Skipping stale mobile upload for $EXPECTED_SHA; origin/$DEFAULT_BRANCH is $latest_sha."
+          elif [[ "$latest_sha" != "$EXPECTED_SHA" ]]; then
+            echo "Allowing artifact-only build for $EVENT_NAME on $RELEASE_BRANCH; store upload remains disabled."
+          else
+            echo "Mobile upload commit is current for $DEFAULT_BRANCH."
+          fi
+          echo "current=$current" >> "$GITHUB_OUTPUT"
+          echo "source_sha=$latest_sha" >> "$GITHUB_OUTPUT"
+
+      - name: Setup Node.js
+        if: steps.release-guard.outputs.current == 'true'
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Require green Chromium mobile tests before Play upload
+        if: steps.release-guard.outputs.current == 'true' && env.UPLOAD_ANDROID_TO_PLAY == 'true'
+        run: node scripts/mobile/verify-store-test-gate.mjs --platform android
+        env:
+          GH_TOKEN: ${{ github.token }}
+          STORE_SOURCE_SHA: ${{ steps.release-guard.outputs.source_sha }}
+          TEST_WORKFLOW_RUN_ID: ""
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+
+      - name: Setup Java
+        if: steps.release-guard.outputs.current == 'true'
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        with:
+          distribution: temurin
+          java-version: 21
+
+      - name: Setup Android SDK
+        if: steps.release-guard.outputs.current == 'true'
+        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
+
+      - name: Install Android SDK packages
+        if: steps.release-guard.outputs.current == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          yes | sdkmanager --licenses >/dev/null || true
+          sdkmanager "platforms;android-36" "build-tools;36.0.0"
+
+      - name: Resolve mobile version
+        if: steps.release-guard.outputs.current == 'true'
+        shell: bash
+        env:
+          INPUT_VERSION_NAME: ${{ inputs.version_name || '' }}
+          INPUT_VERSION_CODE: ${{ inputs.version_code || '' }}
+        run: |
+          set -euo pipefail
+          version_name="$INPUT_VERSION_NAME"
+          if [[ -z "$version_name" && "$GITHUB_REF_NAME" == mobile-v* ]]; then
+            version_name="${GITHUB_REF_NAME#mobile-v}"
+          fi
+          if [[ -z "$version_name" ]]; then
+            version_name="0.0.${GITHUB_RUN_NUMBER}"
+          fi
+          version_code="${INPUT_VERSION_CODE:-$GITHUB_RUN_NUMBER}"
+          echo "MOBILE_VERSION_NAME=$version_name" >> "$GITHUB_ENV"
+          echo "MOBILE_VERSION_CODE=$version_code" >> "$GITHUB_ENV"
+
+      - name: Check Android store environment
+        if: steps.release-guard.outputs.current == 'true'
+        env:
+          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+          GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64 }}
+        run: node scripts/mobile/check-store-upload-env.mjs --android
+
+      - name: Install dependencies
+        if: steps.release-guard.outputs.current == 'true'
+        run: npm ci --legacy-peer-deps
+
+      - name: Decode Android signing key
+        if: steps.release-guard.outputs.current == 'true'
+        shell: bash
+        env:
+          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+        run: |
+          set -euo pipefail
+          keystore_path="$RUNNER_TEMP/android-release.keystore"
+          node -e "const fs = require('fs'); fs.writeFileSync(process.argv[1], Buffer.from(process.env.ANDROID_KEYSTORE_BASE64, 'base64'))" "$keystore_path"
+          echo "ANDROID_KEYSTORE_FILE=$keystore_path" >> "$GITHUB_ENV"
+          echo "ANDROID_KEYSTORE_PASSWORD=$ANDROID_KEYSTORE_PASSWORD" >> "$GITHUB_ENV"
+          echo "ANDROID_KEY_ALIAS=$ANDROID_KEY_ALIAS" >> "$GITHUB_ENV"
+          echo "ANDROID_KEY_PASSWORD=$ANDROID_KEY_PASSWORD" >> "$GITHUB_ENV"
+
+      - name: Build and sync Android shell
+        if: steps.release-guard.outputs.current == 'true'
+        run: |
+          npm run mobile:android:sync
+          npm run mobile:permissions:check
+          npm run mobile:android:signing:check
+
+      - name: Build signed Android App Bundle
+        if: steps.release-guard.outputs.current == 'true'
+        working-directory: android
+        run: ./gradlew --no-daemon bundleRelease
+
+      - name: Verify Android App Bundle signature
+        if: steps.release-guard.outputs.current == 'true'
+        run: jarsigner -verify -certs -verbose "$ANDROID_AAB_PATH" >/dev/null
+
+      - name: Record immutable Android artifact proof
+        if: steps.release-guard.outputs.current == 'true'
+        id: artifact-proof
+        shell: bash
+        run: |
+          set -euo pipefail
+          artifact_sha256="$(sha256sum "$ANDROID_AAB_PATH" | awk '{print $1}')"
+          [[ "$artifact_sha256" =~ ^[0-9a-f]{64}$ ]]
+          echo "ANDROID_AAB_SHA256=$artifact_sha256" >> "$GITHUB_ENV"
+          echo "sha256=$artifact_sha256" >> "$GITHUB_OUTPUT"
+          echo "Android AAB SHA-256: \`$artifact_sha256\`" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload Android artifact
+        if: steps.release-guard.outputs.current == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: truck-wash-android-${{ env.MOBILE_VERSION_NAME }}-${{ github.sha }}
+          path: ${{ env.ANDROID_AAB_PATH }}
+          if-no-files-found: error
+          retention-days: 14
+
+      - name: Recheck live master before Play upload
+        if: steps.release-guard.outputs.current == 'true' && env.UPLOAD_ANDROID_TO_PLAY == 'true'
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          EXPECTED_SHA: ${{ steps.release-guard.outputs.source_sha }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          live_master_sha="$(curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/git/ref/heads/$DEFAULT_BRANCH" | jq -r '.object.sha // empty')"
+          [[ "$live_master_sha" =~ ^[0-9a-f]{40}$ ]] || { echo "Could not resolve origin/$DEFAULT_BRANCH." >&2; exit 1; }
+          [[ "$live_master_sha" == "$EXPECTED_SHA" ]] || {
+            echo "$DEFAULT_BRANCH advanced while the Android bundle was building; refusing Play upload." >&2
+            exit 1
+          }
+
+      - name: Upload Android App Bundle to Google Play
+        if: steps.release-guard.outputs.current == 'true' && env.UPLOAD_ANDROID_TO_PLAY == 'true'
+        id: play-upload
+        env:
+          GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64 }}
+        run: npm run mobile:android:play-upload
+
+      - name: Record Google Play submission proof
+        if: steps.release-guard.outputs.current == 'true' && env.UPLOAD_ANDROID_TO_PLAY == 'true'
+        env:
+          ARTIFACT_SHA256: ${{ steps.artifact-proof.outputs.sha256 }}
+          PLAY_EDIT_ID: ${{ steps.play-upload.outputs.play_edit_id }}
+          PLAY_VERSION_CODE: ${{ steps.play-upload.outputs.version_code }}
+        run: |
+          set -euo pipefail
+          test -n "$ARTIFACT_SHA256"
+          test -n "$PLAY_EDIT_ID"
+          test -n "$PLAY_VERSION_CODE"
+          printf 'Google Play submission proof: platform=android applicationId=%s version=%s buildNumber=%s artifactSha256=%s signingIdentityRef=%s storeSubmissionId=%s status=%s fraction=%s\n' \
+            "$ANDROID_PACKAGE_NAME" "$MOBILE_VERSION_NAME" "$PLAY_VERSION_CODE" \
+            "$ARTIFACT_SHA256" "$ANDROID_SIGNING_IDENTITY_REF" "$PLAY_EDIT_ID" \
+            "$PLAY_STORE_RELEASE_STATUS" "$PLAY_STORE_USER_FRACTION" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release-recovery.yml

@@ -0,0 +1,283 @@
+name: Frontend Release Recovery
+
+on:
+  workflow_dispatch:
+    inputs:
+      action:
+        description: Verify the active release or roll back before verification
+        required: true
+        type: choice
+        options:
+          - reverify
+          - rollback
+      source_sha:
+        description: Exact 40-character commit SHA expected after recovery
+        required: true
+        type: string
+      rollback_target:
+        description: Immutable releases/.../dist target; required for rollback
+        required: false
+        type: string
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: frontend-production
+  cancel-in-progress: false
+
+jobs:
+  recover:
+    name: Protected production recovery
+    runs-on: ubuntu-latest
+    environment: frontend-production
+    timeout-minutes: 35
+    env:
+      PLAYWRIGHT_BASE_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
+    steps:
+      - name: Validate exact recovery target
+        shell: bash
+        env:
+          RECOVERY_ACTION: ${{ inputs.action }}
+          RECOVERY_SHA: ${{ inputs.source_sha }}
+          RECOVERY_TARGET: ${{ inputs.rollback_target }}
+        run: |
+          set -euo pipefail
+          [[ "$RECOVERY_SHA" =~ ^[a-f0-9]{40}$ ]]
+          if [[ "$RECOVERY_ACTION" == "rollback" ]]; then
+            [[ "$RECOVERY_TARGET" =~ ^releases/[A-Za-z0-9._-]+/dist$ ]]
+          else
+            [[ -z "$RECOVERY_TARGET" ]]
+          fi
+
+      - name: Checkout exact recovery source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: ${{ inputs.source_sha }}
+
+      - name: Authorize source from successful release proof
+        id: authorize
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RECOVERY_ACTION: ${{ inputs.action }}
+          RECOVERY_SHA: ${{ inputs.source_sha }}
+          RECOVERY_TARGET: ${{ inputs.rollback_target }}
+        run: |
+          set -euo pipefail
+          runs="$RUNNER_TEMP/recovery-runs.json"
+          artifacts="$RUNNER_TEMP/recovery-artifacts.json"
+          curl --fail --silent --show-error \
+            -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/workflows/release.yml/runs?head_sha=$RECOVERY_SHA&status=success&per_page=20" \
+            > "$runs"
+          release_run_id="$(jq -r '[.workflow_runs[] | select(.event == "workflow_run")] | first | .id // empty' "$runs")"
+          [[ "$release_run_id" =~ ^[0-9]+$ ]]
+          artifact_name="frontend-release-proof-$RECOVERY_SHA"
+          curl --fail --silent --show-error \
+            -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/runs/$release_run_id/artifacts?name=$artifact_name&per_page=20" \
+            > "$artifacts"
+          artifact_id="$(jq -r '[.artifacts[] | select(.expired == false)] | first | .id // empty' "$artifacts")"
+          [[ "$artifact_id" =~ ^[0-9]+$ ]]
+          mkdir -p "$RUNNER_TEMP/recovery-proof"
+          curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts/$artifact_id/zip" \
+            -o "$RUNNER_TEMP/recovery-proof.zip"
+          unzip -q "$RUNNER_TEMP/recovery-proof.zip" -d "$RUNNER_TEMP/recovery-proof"
+          PROOF_PATH="$RUNNER_TEMP/recovery-proof/frontend-release-proof.json" \
+          RELEASE_RUN_ID="$release_run_id" node <<'NODE'
+          const { appendFileSync, readFileSync } = require("node:fs");
+          const proof = JSON.parse(readFileSync(process.env.PROOF_PATH, "utf8"));
+          const sha = process.env.RECOVERY_SHA;
+          const target = process.env.RECOVERY_TARGET;
+          const expectedPrefix = `releases/${sha}-`;
+          const valid = proof.schemaVersion === 2
+            && proof.repository === process.env.GITHUB_REPOSITORY
+            && proof.sha === sha
+            && proof.sourceSha === sha
+            && proof.frontendReleaseRunId === process.env.RELEASE_RUN_ID
+            && proof.verificationState === "verified"
+            && proof.livePublicGate === "passed"
+            && ["passed", "not-configured"].includes(proof.liveCredentialedGate)
+            && proof.releaseManagerGate === "passed"
+            && proof.serverVersionUpdated === true
+            && proof.serverVersionReadBack === "passed"
+            && /^[1-9][0-9]*-[1-9][0-9]*$/.test(String(proof.buildId || ""))
+            && typeof proof.activeTarget === "string"
+            && proof.activeTarget.startsWith(expectedPrefix)
+            && proof.activeTarget.endsWith("/dist");
+          if (!valid) throw new Error("Recovery source does not have valid exact-release proof.");
+          if (process.env.RECOVERY_ACTION === "rollback" && target !== proof.activeTarget) {
+            throw new Error("Rollback target does not match the verified release proof.");
+          }
+          appendFileSync(process.env.GITHUB_OUTPUT, `verified_target=${proof.activeTarget}\n`);
+          appendFileSync(process.env.GITHUB_OUTPUT, `build_id=${proof.buildId}\n`);
+          NODE
+
+      - name: Capture current immutable target
+        id: current
+        shell: bash
+        env:
+          FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
+        run: |
+          node --input-type=module <<'NODE'
+          import { appendFileSync } from "node:fs";
+          const response = await fetch(new URL(`release-manifest.json?recovery=${Date.now()}`, process.env.FRONTEND_URL), {
+            headers: { "Cache-Control": "no-cache", Pragma: "no-cache" },
+          });
+          if (!response.ok) throw new Error(`Active manifest returned HTTP ${response.status}.`);
+          const manifest = await response.json();
+          const sha = String(manifest.commit_sha || "").toLowerCase();
+          const build = String(manifest.build_id || "");
+          if (!/^[a-f0-9]{40}$/.test(sha) || !/^[A-Za-z0-9._-]{1,180}$/.test(build)) {
+            throw new Error("Active manifest has invalid release identity.");
+          }
+          if (!/^[1-9][0-9]*-[1-9][0-9]*$/.test(build)) {
+            throw new Error("Active manifest build id is not a release run identity.");
+          }
+          appendFileSync(process.env.GITHUB_OUTPUT, `previous_sha=${sha}\nprevious_build_id=${build}\nprevious_target=releases/${sha}-${build}/dist\n`);
+          NODE
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci --legacy-peer-deps
+
+      - name: Install secure FTP client without system changes
+        run: |
+          if command -v lftp >/dev/null 2>&1; then
+            exit 0
+          fi
+          package_root="$RUNNER_TEMP/lftp-package"
+          mkdir -p "$package_root"
+          (
+            cd "$package_root"
+            apt-get download lftp
+            dpkg-deb --extract ./lftp_*.deb root
+          )
+          echo "$package_root/root/usr/bin" >> "$GITHUB_PATH"
+
+      - name: Install Playwright Chromium
+        run: node scripts/install-playwright-browsers.mjs chromium
+
+      - name: Roll back atomically
+        if: inputs.action == 'rollback'
+        id: rollback
+        run: node scripts/release/deploy-cpanel.mjs --rollback
+        env:
+          NODE_OPTIONS: --use-system-ca
+          RELEASE_ROLLBACK_TARGET: ${{ inputs.rollback_target }}
+          PRODUCTION_FTP_HOST: ${{ secrets.PRODUCTION_FTP_HOST }}
+          PRODUCTION_FTP_USER: ${{ secrets.PRODUCTION_FTP_USER }}
+          PRODUCTION_FTP_PASSWORD: ${{ secrets.PRODUCTION_FTP_PASSWORD }}
+          PRODUCTION_FTP_PATH: ${{ secrets.PRODUCTION_FTP_PATH }}
+          PRODUCTION_ACTIVATION_KEY: ${{ secrets.PRODUCTION_ACTIVATION_KEY }}
+          PRODUCTION_FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
+
+      - name: Verify active manifest matches authorized release
+        shell: bash
+        env:
+          EXPECTED_SHA: ${{ inputs.source_sha }}
+          EXPECTED_TARGET: ${{ steps.authorize.outputs.verified_target }}
+          FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
+        run: |
+          node --input-type=module <<'NODE'
+          const deadline = Date.now() + 300_000;
+          let actual = "";
+          while (Date.now() < deadline) {
+            const response = await fetch(new URL(`release-manifest.json?recovery=${Date.now()}`, process.env.FRONTEND_URL), {
+              headers: { "Cache-Control": "no-cache", Pragma: "no-cache" },
+            });
+            if (response.ok) {
+              const manifest = await response.json();
+              const manifestSha = String(manifest.commit_sha || "").toLowerCase();
+              actual = `releases/${manifestSha}-${String(manifest.build_id || "")}/dist`;
+              if (manifestSha === process.env.EXPECTED_SHA && actual === process.env.EXPECTED_TARGET) process.exit(0);
+            }
+            await new Promise((resolve) => setTimeout(resolve, 5_000));
+          }
+          throw new Error(`Active release identity did not converge to the authorized target; observed ${actual || "unavailable"}.`);
+          NODE
+
+      - name: Public live verification
+        run: npm run test:e2e:live:public
+        env:
+          NODE_OPTIONS: --use-system-ca
+
+      - name: Credentialed live verification
+        run: npm run test:e2e:live:roles
+        env:
+          NODE_OPTIONS: --use-system-ca
+          PLAYWRIGHT_REQUIRE_LIVE_CREDENTIALS: "true"
+          PLAYWRIGHT_USER_CUSTOMER_NUMBER: ${{ secrets.PLAYWRIGHT_USER_CUSTOMER_NUMBER }}
+          PLAYWRIGHT_USER_PASSWORD: ${{ secrets.PLAYWRIGHT_USER_PASSWORD }}
+          PLAYWRIGHT_USER_OTP_SECRET: ${{ secrets.PLAYWRIGHT_USER_OTP_SECRET }}
+          PLAYWRIGHT_OPERATOR_USER_ID: ${{ secrets.PLAYWRIGHT_OPERATOR_USER_ID }}
+          PLAYWRIGHT_OPERATOR_PASSWORD: ${{ secrets.PLAYWRIGHT_OPERATOR_PASSWORD }}
+          PLAYWRIGHT_DEPARTMENT_ID: ${{ secrets.PLAYWRIGHT_DEPARTMENT_ID }}
+
+      - name: Record verified server version
+        run: npm run release:update-server-version
+        env:
+          SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }}
+          RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}
+          RELEASE_VERSION: ${{ inputs.source_sha }}
+          RELEASE_BUILD_ID: ${{ steps.authorize.outputs.build_id }}
+          RELEASE_VERSION_UPDATE_REQUIRED: "true"
+
+      - name: Publish recovery audit
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: frontend-release-recovery-${{ inputs.source_sha }}-${{ github.run_id }}
+          path: |
+            test-results
+            playwright-report
+          if-no-files-found: ignore
+          retention-days: 30
+
+      - name: Restore pre-recovery target after downstream failure
+        if: >-
+          failure() && inputs.action == 'rollback'
+        shell: bash
+        run: |
+          node scripts/release/deploy-cpanel.mjs --rollback
+          node --input-type=module <<'NODE'
+          const deadline = Date.now() + 300_000;
+          while (Date.now() < deadline) {
+            const response = await fetch(new URL(`release-manifest.json?restore=${Date.now()}`, process.env.PRODUCTION_FRONTEND_URL), {
+              headers: { "Cache-Control": "no-cache", Pragma: "no-cache" },
+            });
+            if (response.ok) {
+              const manifest = await response.json();
+              const sha = String(manifest.commit_sha || "").toLowerCase();
+              const target = `releases/${sha}-${String(manifest.build_id || "")}/dist`;
+              if (sha === process.env.RELEASE_VERSION && target === process.env.RELEASE_ROLLBACK_TARGET) process.exit(0);
+            }
+            await new Promise((resolve) => setTimeout(resolve, 5_000));
+          }
+          throw new Error("Failed to restore and verify the pre-recovery target.");
+          NODE
+          npm run release:update-server-version
+        env:
+          NODE_OPTIONS: --use-system-ca
+          RELEASE_ROLLBACK_TARGET: ${{ steps.current.outputs.previous_target }}
+          RELEASE_VERSION: ${{ steps.current.outputs.previous_sha }}
+          RELEASE_BUILD_ID: ${{ steps.current.outputs.previous_build_id }}
+          RELEASE_VERSION_UPDATE_REQUIRED: "true"
+          PRODUCTION_FTP_HOST: ${{ secrets.PRODUCTION_FTP_HOST }}
+          PRODUCTION_FTP_USER: ${{ secrets.PRODUCTION_FTP_USER }}
+          PRODUCTION_FTP_PASSWORD: ${{ secrets.PRODUCTION_FTP_PASSWORD }}
+          PRODUCTION_FTP_PATH: ${{ secrets.PRODUCTION_FTP_PATH }}
+          PRODUCTION_ACTIVATION_KEY: ${{ secrets.PRODUCTION_ACTIVATION_KEY }}
+          PRODUCTION_FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
+          SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }}
+          RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}

.github/workflows/release.yml

@@ -0,0 +1,454 @@
+name: Frontend Release
+
+on:
+  workflow_run:
+    workflows:
+      - Automated Tests
+    types:
+      - completed
+    branches:
+      - master
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: frontend-production
+  cancel-in-progress: false
+
+jobs:
+  build-release:
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push' &&
+      github.event.workflow_run.head_branch == 'master' &&
+      github.event.workflow_run.head_repository.full_name == github.repository
+    runs-on: ubuntu-24.04
+    env:
+      RELEASE_COMMIT_SHA: ${{ github.event.workflow_run.head_sha }}
+      RELEASE_EXPECTED_COMMIT: ${{ github.event.workflow_run.head_sha }}
+      RELEASE_BUILD_ID: ${{ github.run_id }}-${{ github.run_attempt }}
+    outputs:
+      current: ${{ steps.branch-head.outputs.current }}
+      build_id: ${{ steps.package.outputs.build_id }}
+      artifact_name: ${{ steps.package-names.outputs.artifact_name }}
+      archive_name: ${{ steps.package.outputs.archive_name }}
+      checksum_name: ${{ steps.package-names.outputs.checksum_name }}
+      inventory_name: ${{ steps.package-names.outputs.inventory_name }}
+      release_id: ${{ steps.package.outputs.release_id }}
+      archive_sha256: ${{ steps.package.outputs.archive_sha256 }}
+    steps:
+      - name: Check release commit is current
+        id: branch-head
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        with:
+          github-token: ${{ github.token }}
+          script: |
+            const { data: branch } = await github.rest.repos.getBranch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              branch: "master",
+            });
+            const expected = process.env.RELEASE_EXPECTED_COMMIT;
+            const current = branch.commit.sha === expected;
+            core.setOutput("current", String(current));
+            core.info(
+              current
+                ? `Release commit ${expected} is current for master.`
+                : `Skipping stale release for ${expected}; origin/master is ${branch.commit.sha}.`,
+            );
+
+      - name: Checkout tested commit
+        if: steps.branch-head.outputs.current == 'true'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: ${{ env.RELEASE_COMMIT_SHA }}
+
+      - name: Setup Node.js
+        if: steps.branch-head.outputs.current == 'true'
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        if: steps.branch-head.outputs.current == 'true'
+        run: npm ci --legacy-peer-deps
+
+      - name: Check AI workflow sync
+        if: steps.branch-head.outputs.current == 'true'
+        run: node scripts/sync-ai-workflow.mjs --check
+
+      - name: Source and i18n checks
+        if: steps.branch-head.outputs.current == 'true'
+        run: |
+          npm run text:check-encoding
+          npm run i18n:v2:source-check
+
+      - name: Build release artifact
+        if: steps.branch-head.outputs.current == 'true'
+        run: npm run build
+
+      - name: Record pre-gate dist inventory
+        if: steps.branch-head.outputs.current == 'true'
+        run: |
+          inventory="$RUNNER_TEMP/dist-before-production-gate.txt"
+          while IFS= read -r -d '' file; do
+            relative_path="${file#dist/}"
+            printf '%s\t%s\t%s\n' \
+              "$(sha256sum "$file" | awk '{print $1}')" \
+              "$(stat --format='%s' "$file")" \
+              "$relative_path"
+          done < <(find dist -type f -print0 | LC_ALL=C sort -z) > "$inventory"
+
+      - name: Install Playwright Chromium
+        if: steps.branch-head.outputs.current == 'true'
+        run: node scripts/install-playwright-browsers.mjs chromium
+
+      - name: Production Playwright gate
+        if: steps.branch-head.outputs.current == 'true'
+        run: npm run test:e2e:prod
+        env:
+          PLAYWRIGHT_PROD_PREBUILT: "1"
+          PLAYWRIGHT_PROD_WEBKIT: "0"
+
+      - name: Confirm production gate did not mutate dist
+        if: steps.branch-head.outputs.current == 'true'
+        run: |
+          inventory="$RUNNER_TEMP/dist-after-production-gate.txt"
+          while IFS= read -r -d '' file; do
+            relative_path="${file#dist/}"
+            printf '%s\t%s\t%s\n' \
+              "$(sha256sum "$file" | awk '{print $1}')" \
+              "$(stat --format='%s' "$file")" \
+              "$relative_path"
+          done < <(find dist -type f -print0 | LC_ALL=C sort -z) > "$inventory"
+          cmp "$RUNNER_TEMP/dist-before-production-gate.txt" "$inventory"
+
+      - name: Package and validate release
+        if: steps.branch-head.outputs.current == 'true'
+        id: package
+        run: node scripts/release/package-dist.mjs
+        env:
+          RELEASE_OUTPUT_DIR: release-artifacts
+
+      - name: Resolve package metadata
+        if: steps.branch-head.outputs.current == 'true'
+        id: package-names
+        env:
+          BUILD_ID: ${{ steps.package.outputs.build_id }}
+          CHECKSUM_PATH: ${{ steps.package.outputs.checksum_path }}
+          INVENTORY_PATH: ${{ steps.package.outputs.inventory_path }}
+        run: |
+          echo "artifact_name=frontend-release-$BUILD_ID" >> "$GITHUB_OUTPUT"
+          echo "checksum_name=$(basename -- "$CHECKSUM_PATH")" >> "$GITHUB_OUTPUT"
+          echo "inventory_name=$(basename -- "$INVENTORY_PATH")" >> "$GITHUB_OUTPUT"
+
+      - name: Upload release package
+        if: steps.branch-head.outputs.current == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ${{ steps.package-names.outputs.artifact_name }}
+          path: |
+            ${{ steps.package.outputs.archive_path }}
+            ${{ steps.package.outputs.checksum_path }}
+            ${{ steps.package.outputs.inventory_path }}
+          if-no-files-found: error
+          retention-days: 14
+
+  deploy-frontend-production:
+    needs: build-release
+    if: needs.build-release.outputs.current == 'true'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    environment:
+      name: frontend-production
+      url: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
+    env:
+      RELEASE_BASE_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
+      PLAYWRIGHT_BASE_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
+      PLAYWRIGHT_RELEASE_STATIC_BASE_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
+      PLAYWRIGHT_RELEASE_API_BASE_URL: https://api-v2.truckwash.io
+      PLAYWRIGHT_RELEASE_API_PING_PATHS: /master/api/ping
+      RELEASE_COMMIT_SHA: ${{ github.event.workflow_run.head_sha }}
+      RELEASE_EXPECTED_COMMIT: ${{ github.event.workflow_run.head_sha }}
+      RELEASE_BUILD_ID: ${{ needs.build-release.outputs.build_id }}
+      RELEASE_EXPECTED_BUILD_ID: ${{ needs.build-release.outputs.build_id }}
+      RELEASE_ID: ${{ needs.build-release.outputs.release_id }}
+      RELEASE_STRICT_BUILD_ID: "true"
+      RELEASE_REQUIRE_CACHE_HEADERS: "true"
+      RELEASE_WAIT_INITIAL_SECONDS: 0
+      RELEASE_WAIT_TIMEOUT_SECONDS: 300
+      RELEASE_POLL_INTERVAL_SECONDS: 5
+    steps:
+      - name: Checkout tested commit
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: ${{ env.RELEASE_COMMIT_SHA }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci --legacy-peer-deps
+
+      - name: Install secure FTP client without system changes
+        run: |
+          if command -v lftp >/dev/null 2>&1; then
+            exit 0
+          fi
+
+          package_root="$RUNNER_TEMP/lftp-package"
+          mkdir -p "$package_root"
+          (
+            cd "$package_root"
+            apt-get download lftp
+            dpkg-deb --extract ./lftp_*.deb root
+          )
+          echo "$package_root/root/usr/bin" >> "$GITHUB_PATH"
+
+      - name: Install Playwright Chromium
+        run: node scripts/install-playwright-browsers.mjs chromium
+
+      - name: Download validated release package
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ${{ needs.build-release.outputs.artifact_name }}
+          path: release-artifacts
+
+      - name: Resolve downloaded release package
+        env:
+          ARCHIVE_NAME: ${{ needs.build-release.outputs.archive_name }}
+          CHECKSUM_NAME: ${{ needs.build-release.outputs.checksum_name }}
+          INVENTORY_NAME: ${{ needs.build-release.outputs.inventory_name }}
+        run: |
+          [[ -n "$ARCHIVE_NAME" && "$ARCHIVE_NAME" == "$(basename -- "$ARCHIVE_NAME")" ]]
+          [[ -n "$CHECKSUM_NAME" && "$CHECKSUM_NAME" == "$(basename -- "$CHECKSUM_NAME")" ]]
+          [[ -n "$INVENTORY_NAME" && "$INVENTORY_NAME" == "$(basename -- "$INVENTORY_NAME")" ]]
+
+          archive_path="$GITHUB_WORKSPACE/release-artifacts/$ARCHIVE_NAME"
+          checksum_path="$GITHUB_WORKSPACE/release-artifacts/$CHECKSUM_NAME"
+          inventory_path="$GITHUB_WORKSPACE/release-artifacts/$INVENTORY_NAME"
+          [[ -f "$archive_path" && -f "$checksum_path" && -f "$inventory_path" ]]
+
+          echo "RELEASE_ARCHIVE_PATH=$archive_path" >> "$GITHUB_ENV"
+          echo "RELEASE_ARCHIVE_SHA256_PATH=$checksum_path" >> "$GITHUB_ENV"
+          echo "RELEASE_INVENTORY_PATH=$inventory_path" >> "$GITHUB_ENV"
+
+      - name: Check release commit is still current
+        id: branch-head
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        with:
+          github-token: ${{ github.token }}
+          script: |
+            const { data: branch } = await github.rest.repos.getBranch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              branch: "master",
+            });
+            const expected = process.env.RELEASE_EXPECTED_COMMIT;
+            const current = branch.commit.sha === expected;
+            core.setOutput("current", String(current));
+            core.info(
+              current
+                ? `Release commit ${expected} is current immediately before activation.`
+                : `Skipping stale release for ${expected}; origin/master is ${branch.commit.sha}.`,
+            );
+
+      - name: Deploy atomically and verify cPanel release
+        if: steps.branch-head.outputs.current == 'true'
+        id: deploy
+        timeout-minutes: 15
+        run: node scripts/release/deploy-cpanel.mjs
+        env:
+          NODE_OPTIONS: --use-system-ca
+          PRODUCTION_FTP_HOST: ${{ secrets.PRODUCTION_FTP_HOST }}
+          PRODUCTION_FTP_USER: ${{ secrets.PRODUCTION_FTP_USER }}
+          PRODUCTION_FTP_PASSWORD: ${{ secrets.PRODUCTION_FTP_PASSWORD }}
+          PRODUCTION_FTP_PATH: ${{ secrets.PRODUCTION_FTP_PATH }}
+          PRODUCTION_ACTIVATION_KEY: ${{ secrets.PRODUCTION_ACTIVATION_KEY }}
+          PRODUCTION_FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
+          RELEASE_GITHUB_REPOSITORY: ${{ github.repository }}
+          RELEASE_GITHUB_TOKEN: ${{ github.token }}
+
+      - name: Public live Playwright gate
+        if: steps.branch-head.outputs.current == 'true'
+        id: public_live
+        timeout-minutes: 10
+        run: npm run test:e2e:live:public
+        env:
+          NODE_OPTIONS: --use-system-ca
+
+      - name: Detect credentialed live gate configuration
+        if: steps.branch-head.outputs.current == 'true'
+        id: credentialed_live_config
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ -n "$CUSTOMER_NUMBER" && -n "$CUSTOMER_PASSWORD" &&
+                -n "$OPERATOR_USER_ID" && -n "$OPERATOR_PASSWORD" ]]; then
+            echo "configured=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "configured=false" >> "$GITHUB_OUTPUT"
+          fi
+        env:
+          CUSTOMER_NUMBER: ${{ secrets.PLAYWRIGHT_USER_CUSTOMER_NUMBER }}
+          CUSTOMER_PASSWORD: ${{ secrets.PLAYWRIGHT_USER_PASSWORD }}
+          OPERATOR_USER_ID: ${{ secrets.PLAYWRIGHT_OPERATOR_USER_ID }}
+          OPERATOR_PASSWORD: ${{ secrets.PLAYWRIGHT_OPERATOR_PASSWORD }}
+
+      - name: Credentialed live Playwright gate (when configured)
+        if: >-
+          steps.branch-head.outputs.current == 'true' &&
+          steps.credentialed_live_config.outputs.configured == 'true'
+        id: credentialed_live
+        timeout-minutes: 15
+        run: npm run test:e2e:live:roles
+        env:
+          NODE_OPTIONS: --use-system-ca
+          PLAYWRIGHT_USER_CUSTOMER_NUMBER: ${{ secrets.PLAYWRIGHT_USER_CUSTOMER_NUMBER }}
+          PLAYWRIGHT_USER_PASSWORD: ${{ secrets.PLAYWRIGHT_USER_PASSWORD }}
+          PLAYWRIGHT_USER_OTP_SECRET: ${{ secrets.PLAYWRIGHT_USER_OTP_SECRET }}
+          PLAYWRIGHT_OPERATOR_USER_ID: ${{ secrets.PLAYWRIGHT_OPERATOR_USER_ID }}
+          PLAYWRIGHT_OPERATOR_PASSWORD: ${{ secrets.PLAYWRIGHT_OPERATOR_PASSWORD }}
+          PLAYWRIGHT_DEPARTMENT_ID: ${{ secrets.PLAYWRIGHT_DEPARTMENT_ID }}
+
+      - name: Record Release Manager gate
+        id: release_manager
+        if: steps.branch-head.outputs.current == 'true'
+        timeout-minutes: 5
+        run: |
+          test -n "$RELEASE_MANAGER_GATE_TOKEN" || (echo "RELEASE_MANAGER_GATE_TOKEN is required" >&2; exit 1)
+          release_gate_build_id="${RELEASE_VERIFIED_BUILD_ID:-$RELEASE_EXPECTED_BUILD_ID}"
+          curl --fail --show-error --silent \
+            -X POST "$RELEASE_MANAGER_GATE_URL" \
+            -H "Authorization: Bearer $RELEASE_MANAGER_GATE_TOKEN" \
+            -H "Content-Type: application/json" \
+            --data "{\"environment_url\":\"$RELEASE_BASE_URL\",\"channel_slug\":\"stable\",\"app\":\"frontend\",\"repository\":\"$RELEASE_REPOSITORY\",\"branch\":\"master\",\"expected_commit\":\"$RELEASE_EXPECTED_COMMIT\",\"build_id\":\"$release_gate_build_id\",\"workflow_url\":\"$RELEASE_WORKFLOW_URL\",\"auto_sync\":false,\"wait_timeout_seconds\":300,\"poll_interval_seconds\":10,\"required_checks\":[\"api_gateway\"]}"
+        env:
+          RELEASE_MANAGER_GATE_URL: ${{ secrets.RELEASE_MANAGER_GATE_URL || 'https://api.truckwash.io/release/gate/test-runs' }}
+          RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}
+          RELEASE_REPOSITORY: ${{ github.repository }}
+          RELEASE_WORKFLOW_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
+
+      - name: Update server version after verification
+        if: steps.branch-head.outputs.current == 'true'
+        run: npm run release:update-server-version
+        env:
+          SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }}
+          RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}
+          RELEASE_VERSION: ${{ github.event.workflow_run.head_sha }}
+          RELEASE_VERSION_UPDATE_REQUIRED: "true"
+
+      - name: Create verified frontend release proof
+        if: steps.branch-head.outputs.current == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          proof_dir="output/frontend-release-proof"
+          mkdir -p "$proof_dir"
+          PROOF_PATH="$proof_dir/frontend-release-proof.json" node <<'NODE'
+          const { writeFileSync } = require("node:fs");
+          const required = (name) => {
+            if (!process.env[name]) throw new Error(`Missing ${name}`);
+            return process.env[name];
+          };
+          const requireSuccessfulStep = (name) => {
+            const outcome = required(name);
+            if (outcome !== "success") throw new Error(`${name} did not succeed: ${outcome}`);
+            return "passed";
+          };
+          const credentialedGate = () => {
+            const configured = required("LIVE_CREDENTIALED_GATE_CONFIGURED");
+            if (configured === "false") return "not-configured";
+            if (configured !== "true") {
+              throw new Error(`Invalid LIVE_CREDENTIALED_GATE_CONFIGURED: ${configured}`);
+            }
+            return requireSuccessfulStep("LIVE_CREDENTIALED_GATE_OUTCOME");
+          };
+          const proof = {
+            schemaVersion: 2,
+            releaseId: required("RELEASE_ID"),
+            sha: required("RELEASE_COMMIT_SHA").toLowerCase(),
+            archiveSha256: required("RELEASE_ARCHIVE_SHA256").toLowerCase(),
+            activeTarget: required("RELEASE_ACTIVE_TARGET"),
+            rollbackTarget: process.env.RELEASE_ROLLBACK_TARGET || null,
+            verificationState: "verified",
+            observedAt: new Date().toISOString(),
+            repository: required("GITHUB_REPOSITORY"),
+            sourceSha: required("RELEASE_COMMIT_SHA").toLowerCase(),
+            testedWorkflowRunId: required("TESTED_WORKFLOW_RUN_ID"),
+            frontendReleaseRunId: required("GITHUB_RUN_ID"),
+            frontendReleaseRunAttempt: required("GITHUB_RUN_ATTEMPT"),
+            buildId: required("RELEASE_BUILD_ID"),
+            livePublicGate: requireSuccessfulStep("LIVE_PUBLIC_GATE_OUTCOME"),
+            liveCredentialedGate: credentialedGate(),
+            releaseManagerGate: requireSuccessfulStep("RELEASE_MANAGER_GATE_OUTCOME"),
+            serverVersionUpdated: true,
+            serverVersionReadBack: "passed",
+            completedAt: new Date().toISOString(),
+          };
+          writeFileSync(process.env.PROOF_PATH, `${JSON.stringify(proof, null, 2)}\n`, { mode: 0o600 });
+          NODE
+        env:
+          TESTED_WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }}
+          RELEASE_ARCHIVE_SHA256: ${{ needs.build-release.outputs.archive_sha256 }}
+          RELEASE_ACTIVE_TARGET: ${{ steps.deploy.outputs.active_target }}
+          RELEASE_ROLLBACK_TARGET: ${{ steps.deploy.outputs.rollback_target }}
+          LIVE_PUBLIC_GATE_OUTCOME: ${{ steps.public_live.outcome }}
+          LIVE_CREDENTIALED_GATE_CONFIGURED: ${{ steps.credentialed_live_config.outputs.configured }}
+          LIVE_CREDENTIALED_GATE_OUTCOME: ${{ steps.credentialed_live.outcome }}
+          RELEASE_MANAGER_GATE_OUTCOME: ${{ steps.release_manager.outcome }}
+
+      - name: Publish verified frontend release proof
+        if: steps.branch-head.outputs.current == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: frontend-release-proof-${{ env.RELEASE_COMMIT_SHA }}
+          path: output/frontend-release-proof/frontend-release-proof.json
+          if-no-files-found: error
+          retention-days: 30
+
+      - name: Roll back after any post-deployment verification failure
+        if: >-
+          failure() && steps.branch-head.outputs.current == 'true' &&
+          steps.deploy.outcome == 'success'
+        timeout-minutes: 10
+        shell: bash
+        run: |
+          set -euo pipefail
+          node scripts/release/deploy-cpanel.mjs --rollback
+          [[ "$RELEASE_ROLLBACK_TARGET" =~ ^releases/([a-f0-9]{40})-([1-9][0-9]*-[1-9][0-9]*)/dist$ ]]
+          export RELEASE_VERSION="${BASH_REMATCH[1]}"
+          export RELEASE_BUILD_ID="${BASH_REMATCH[2]}"
+          npm run release:update-server-version
+        env:
+          NODE_OPTIONS: --use-system-ca
+          RELEASE_ROLLBACK_TARGET: ${{ steps.deploy.outputs.rollback_target }}
+          PRODUCTION_FTP_HOST: ${{ secrets.PRODUCTION_FTP_HOST }}
+          PRODUCTION_FTP_USER: ${{ secrets.PRODUCTION_FTP_USER }}
+          PRODUCTION_FTP_PASSWORD: ${{ secrets.PRODUCTION_FTP_PASSWORD }}
+          PRODUCTION_FTP_PATH: ${{ secrets.PRODUCTION_FTP_PATH }}
+          PRODUCTION_ACTIVATION_KEY: ${{ secrets.PRODUCTION_ACTIVATION_KEY }}
+          PRODUCTION_FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
+          SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }}
+          RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}
+          RELEASE_VERSION_UPDATE_REQUIRED: "true"
+
+      - name: Upload Playwright report
+        if: failure() && steps.branch-head.outputs.current == 'true'
+        continue-on-error: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: frontend-release-playwright-${{ env.RELEASE_BUILD_ID }}
+          path: output/playwright
+          if-no-files-found: ignore
+          retention-days: 14

.github/workflows/tests.yml

@@ -3,7 +3,44 @@ name: Automated Tests
 on:
   pull_request:
   push:
+    branches:
+      - main
+      - master
+      - dev
   workflow_dispatch:
+    inputs:
+      mode:
+        description: "What to run for a manual dispatch."
+        required: true
+        type: choice
+        default: full
+        options:
+          - full
+          - targeted
+          - targeted-then-full
+      target_specs:
+        description: "Comma- or newline-separated Playwright spec paths under tests/e2e."
+        required: false
+        type: string
+        default: "tests/e2e/superuser-department-overview.spec.js"
+      target_projects:
+        description: "JSON array of Playwright projects for targeted mode."
+        required: false
+        type: string
+        default: '["chromium-desktop","chromium-mobile","chromium-tablet","webkit-mobile","webkit-desktop"]'
+      target_grep:
+        description: "Optional Playwright grep pattern for targeted mode."
+        required: false
+        type: string
+        default: ""
+      runner:
+        description: "Runner pool for this manually dispatched test run"
+        required: false
+        default: "self-hosted"
+        type: choice
+        options:
+          - self-hosted
+          - github-hosted
   schedule:
     - cron: "0 2 * * *"
 
@@ -11,21 +48,47 @@ permissions:
   contents: read
 
 concurrency:
-  group: frontend-tests-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  group: frontend-tests-${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.event_name == 'push' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || github.event_name == 'push' }}
 
+# Repository variables used as CI runner and credit controls:
+# - FRONTEND_CI_STANDARD_RUNNER: JSON runs-on value for format/build/unit jobs.
+# - FRONTEND_CI_E2E_RUNNER: JSON runs-on value for Playwright jobs.
+# - FRONTEND_CI_PR_E2E_MAX_PARALLEL: numeric Playwright PR job parallelism.
+# - FRONTEND_CI_FULL_E2E_MAX_PARALLEL: numeric full-suite job parallelism.
+# - FRONTEND_CI_FULL_E2E_CONCURRENT_MAX_PARALLEL: full-suite parallelism while PR E2E runs beside it.
+# GitHub-hosted target: ["ubuntu-24.04"], with PR parallelism 10, concurrent full parallelism 26,
+# and standalone scheduled full parallelism 36. This keeps the workflow peak at 36 hosted jobs.
 jobs:
   format-tests:
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.FRONTEND_CI_STANDARD_RUNNER || '["self-hosted","Linux","X64","pleno","frontend"]') }}
+    timeout-minutes: 15
     steps:
+      - name: Repair self-hosted workspace permissions
+        if: ${{ contains(vars.FRONTEND_CI_STANDARD_RUNNER || 'self-hosted', 'self-hosted') }}
+        shell: bash
+        run: |
+          if [[ -d "$GITHUB_WORKSPACE" ]]; then
+            sudo -n chown -R "$(id -u):$(id -g)" "$GITHUB_WORKSPACE" 2>/dev/null || true
+            foreign_entry="$(find "$GITHUB_WORKSPACE" -mindepth 1 -maxdepth 2 ! -user "$(id -u)" -print -quit 2>/dev/null || true)"
+            if [[ -n "$foreign_entry" ]]; then
+              trash="$GITHUB_WORKSPACE/../_workspace-trash-$GITHUB_RUN_ID-$GITHUB_JOB"
+              rm -rf "$trash" 2>/dev/null || true
+              mv "$GITHUB_WORKSPACE" "$trash" 2>/dev/null || true
+              mkdir -p "$GITHUB_WORKSPACE"
+            fi
+          fi
+
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: 22
-          cache: npm
+
+      - name: Check AI workflow sync
+        run: node scripts/sync-ai-workflow.mjs --check
 
       - name: Install dependencies
         run: npm ci --legacy-peer-deps
@@ -33,98 +96,736 @@ jobs:
       - name: Check frontend test formatting
         run: npm run format:tests:check
 
-  build-and-unit:
-    needs: format-tests
-    runs-on: ubuntu-latest
+  quality-checks:
+    name: Quality-${{ matrix.check }}
+    runs-on: ${{ fromJSON(vars.FRONTEND_CI_STANDARD_RUNNER || '["self-hosted","Linux","X64","pleno","frontend"]') }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      max-parallel: 5
+      matrix:
+        check: [lint, i18n, build, unit-fast, unit-serial]
     steps:
+      - name: Repair self-hosted workspace permissions
+        if: ${{ contains(vars.FRONTEND_CI_STANDARD_RUNNER || 'self-hosted', 'self-hosted') }}
+        shell: bash
+        run: |
+          if [[ -d "$GITHUB_WORKSPACE" ]]; then
+            sudo -n chown -R "$(id -u):$(id -g)" "$GITHUB_WORKSPACE" 2>/dev/null || true
+            foreign_entry="$(find "$GITHUB_WORKSPACE" -mindepth 1 -maxdepth 2 ! -user "$(id -u)" -print -quit 2>/dev/null || true)"
+            if [[ -n "$foreign_entry" ]]; then
+              trash="$GITHUB_WORKSPACE/../_workspace-trash-$GITHUB_RUN_ID-$GITHUB_JOB"
+              rm -rf "$trash" 2>/dev/null || true
+              mv "$GITHUB_WORKSPACE" "$trash" 2>/dev/null || true
+              mkdir -p "$GITHUB_WORKSPACE"
+            fi
+          fi
+
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: 22
-          cache: npm
 
       - name: Install dependencies
         run: npm ci --legacy-peer-deps
 
-      - name: Build sanity check
-        run: npm run build
-
-      - name: Unit tests
-        run: npm run test:unit
+      - name: Run quality check
+        shell: bash
         env:
-          VITEST_BATCH_SIZE: 5
+          MATRIX_CHECK: ${{ matrix.check }}
+        run: |
+          set -euo pipefail
+          case "$MATRIX_CHECK" in
+            lint)
+              npm run lint
+              ;;
+            i18n)
+              npm run i18n:v2:check
+              ;;
+            build)
+              npm run build
+              ;;
+            unit-fast)
+              npm run text:check-encoding
+              npm run test:unit:fast
+              ;;
+            unit-serial)
+              VITEST_BATCH_SIZE=5 npm run test:unit:serial
+              ;;
+            *)
+              echo "Unsupported quality check: $MATRIX_CHECK" >&2
+              exit 1
+              ;;
+          esac
 
-  e2e-smoke:
-    if: github.event_name != 'schedule'
+  build-and-unit:
+    if: ${{ always() }}
+    name: Build and unit summary
+    needs: [format-tests, quality-checks]
+    runs-on: ${{ fromJSON(vars.FRONTEND_CI_STANDARD_RUNNER || '["self-hosted","Linux","X64","pleno","frontend"]') }}
+    timeout-minutes: 5
+    steps:
+      - name: Verify quality jobs succeeded
+        shell: bash
+        env:
+          FORMAT_TESTS_RESULT: ${{ needs.format-tests.result }}
+          QUALITY_CHECKS_RESULT: ${{ needs.quality-checks.result }}
+        run: |
+          set -euo pipefail
+          failed=0
+          for required_job in FORMAT_TESTS_RESULT QUALITY_CHECKS_RESULT; do
+            result="${!required_job:-missing}"
+            if [[ "$result" != "success" ]]; then
+              echo "${required_job}=${result}" >&2
+              failed=1
+            fi
+          done
+          exit "$failed"
+
+  e2e-targeted:
+    if: >
+      github.event_name == 'workflow_dispatch' &&
+      (inputs.mode == 'targeted' || inputs.mode == 'targeted-then-full')
     needs: build-and-unit
-    runs-on: ubuntu-latest
+    name: E2E-targeted-${{ matrix.project }}
+    # Use GitHub-hosted runners to avoid self-hosted desktop contention and sleep/power events.
+    runs-on: ubuntu-24.04
+    timeout-minutes: 35
     strategy:
       fail-fast: false
       matrix:
-        project: [chromium-desktop, chromium-mobile]
+        project: ${{ fromJSON(inputs.target_projects || '["chromium-desktop"]') }}
+    env:
+      MATRIX_PROJECT: ${{ matrix.project }}
+      PLAYWRIGHT_ARTIFACT_NAMESPACE: e2e-targeted-${{ matrix.project }}
+      PLAYWRIGHT_REPORTER_MODE: line-html
+      PLAYWRIGHT_WORKERS: 1
+      PLAYWRIGHT_VIDEO_MODE: on-first-retry
+      TARGET_GREP: ${{ inputs.target_grep }}
+      TARGET_SPECS: ${{ inputs.target_specs }}
+      RUN_ID: ${{ github.run_id }}
     steps:
+      - name: Normalize workspace permissions
+        shell: bash
+        run: |
+          if [[ -d "$GITHUB_WORKSPACE" ]]; then
+            sudo -n chown -R "$(id -u):$(id -g)" "$GITHUB_WORKSPACE" 2>/dev/null || true
+            foreign_entry="$(find "$GITHUB_WORKSPACE" -mindepth 1 -maxdepth 2 ! -user "$(id -u)" -print -quit 2>/dev/null || true)"
+            if [[ -n "$foreign_entry" ]]; then
+              trash="$GITHUB_WORKSPACE/../_workspace-trash-$GITHUB_RUN_ID-$GITHUB_JOB"
+              rm -rf "$trash" 2>/dev/null || true
+              mv "$GITHUB_WORKSPACE" "$trash" 2>/dev/null || true
+              mkdir -p "$GITHUB_WORKSPACE"
+            fi
+          fi
+
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: 22
-          cache: npm
 
-      - name: Install dependencies
-        run: npm ci --legacy-peer-deps
+      - name: Run targeted Playwright specs in container
+        shell: bash
+        run: |
+          set -euo pipefail
+          case "$MATRIX_PROJECT" in
+            chromium-mobile) project_offset=1 ;;
+            chromium-desktop) project_offset=2 ;;
+            chromium-tablet) project_offset=3 ;;
+            webkit-mobile) project_offset=31 ;;
+            webkit-desktop) project_offset=32 ;;
+            webkit-tablet) project_offset=33 ;;
+            firefox-mobile) project_offset=61 ;;
+            firefox-desktop) project_offset=62 ;;
+            firefox-tablet) project_offset=63 ;;
+            *) echo "Unsupported Playwright project: $MATRIX_PROJECT" >&2; exit 1 ;;
+          esac
+          port_seed=$((20000 + (RUN_ID % 20000) + project_offset))
+          lock_root="${PLAYWRIGHT_PORT_LOCK_ROOT:-/tmp/pleno-playwright-port-locks}"
+          mkdir -p "$lock_root"
+          chmod 1777 "$lock_root" 2>/dev/null || true
+          find "$lock_root" -mindepth 1 -maxdepth 1 -type d -mmin +360 -exec rmdir {} \; 2>/dev/null || true
+          playwright_port_lock=""
+          playwright_dev_port=""
+          for ((candidate = port_seed; candidate < port_seed + 1000; candidate += 1)); do
+            lock_dir="${lock_root}/${candidate}.lock"
+            if ! mkdir "$lock_dir" 2>/dev/null; then
+              continue
+            fi
+            if ss -H -ltn "sport = :${candidate}" 2>/dev/null | grep -q .; then
+              rmdir "$lock_dir" || true
+              continue
+            fi
+            playwright_port_lock="$lock_dir"
+            playwright_dev_port="$candidate"
+            break
+          done
+          if [[ -z "$playwright_dev_port" ]]; then
+            echo "Unable to find a free Playwright dev-server port." >&2
+            exit 1
+          fi
+          trap 'if [[ -n "${playwright_port_lock:-}" ]]; then rmdir "$playwright_port_lock" 2>/dev/null || true; fi' EXIT
+          if docker info >/dev/null 2>&1; then
+            docker_cmd=(docker)
+          elif sudo -n docker info >/dev/null 2>&1; then
+            docker_cmd=(sudo docker)
+          else
+            echo "Docker is not available to the runner user, and sudo docker is not available." >&2
+            exit 1
+          fi
+          mkdir -p output/playwright
+          scripts/ci/runner-diagnostics.sh "before targeted Playwright ${MATRIX_PROJECT}" -- "${docker_cmd[@]}"
+          SYSTEMD_INHIBIT_REASON="Frontend targeted Playwright ${MATRIX_PROJECT}" \
+          scripts/ci/with-systemd-inhibit.sh "${docker_cmd[@]}" run --rm --ipc=host --network host \
+            --volume "$PWD:/source:ro" \
+            --volume "$PWD/output/playwright:/work/output/playwright" \
+            --workdir /work \
+            --env HOME=/tmp \
+            --env CI="${CI:-}" \
+            --env PLAYWRIGHT_ARTIFACT_NAMESPACE="$PLAYWRIGHT_ARTIFACT_NAMESPACE" \
+            --env PLAYWRIGHT_REPORTER_MODE="$PLAYWRIGHT_REPORTER_MODE" \
+            --env PLAYWRIGHT_WORKERS="$PLAYWRIGHT_WORKERS" \
+            --env PLAYWRIGHT_VIDEO_MODE="$PLAYWRIGHT_VIDEO_MODE" \
+            --env PLAYWRIGHT_DEV_PORT="$playwright_dev_port" \
+            --env MATRIX_PROJECT="$MATRIX_PROJECT" \
+            --env TARGET_GREP="$TARGET_GREP" \
+            --env TARGET_SPECS="$TARGET_SPECS" \
+            mcr.microsoft.com/playwright:v1.58.2-noble \
+            bash -lc '
+              set -euo pipefail
+              tar --exclude=./output/playwright -C /source -cf - . | tar -C /work -xf -
+              git config --global --add safe.directory /work
+              install_dependencies() {
+                local attempt
+                for attempt in 1 2 3; do
+                  if npm ci --legacy-peer-deps --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000; then
+                    return 0
+                  fi
+                  if [[ "$attempt" == "3" ]]; then
+                    return 1
+                  fi
+                  echo "npm ci failed on attempt ${attempt}; retrying..." >&2
+                  sleep 20
+                done
+              }
+              install_dependencies
+              ulimit -n 16384 || true
+              mapfile -t spec_args < <(printf "%s\n" "$TARGET_SPECS" | tr "," "\n" | sed "s/^[[:space:]]*//;s/[[:space:]]*$//;/^$/d")
+              if [[ "${#spec_args[@]}" -eq 0 && -z "${TARGET_GREP:-}" ]]; then
+                echo "Provide at least one spec path or grep pattern." >&2
+                exit 1
+              fi
+              for spec_path in "${spec_args[@]}"; do
+                if [[ "$spec_path" == /* || "$spec_path" == *".."* || "$spec_path" != tests/e2e/* ]]; then
+                  echo "Targeted spec must stay under tests/e2e: $spec_path" >&2
+                  exit 1
+                fi
+                if [[ ! -f "$spec_path" ]]; then
+                  echo "Targeted spec does not exist: $spec_path" >&2
+                  exit 1
+                fi
+              done
+              args=("${spec_args[@]}")
+              if [[ -n "${TARGET_GREP:-}" ]]; then
+                args+=(--grep "$TARGET_GREP")
+              fi
+              args+=(--project="$MATRIX_PROJECT")
+              npx playwright test "${args[@]}"
+            '
 
-      - name: Install Playwright browsers
-        run: npx playwright install --with-deps chromium
-
-      - name: Run Playwright smoke tests (${{ matrix.project }})
-        run: npx playwright test --grep @smoke --project="${{ matrix.project }}"
+      - name: Runner diagnostics after Playwright failure
+        if: failure() || cancelled()
+        continue-on-error: true
+        run: scripts/ci/runner-diagnostics.sh "after targeted Playwright ${{ matrix.project }}"
 
       - name: Upload Playwright report
-        if: failure()
-        uses: actions/upload-artifact@v4
+        if: failure() || cancelled()
+        continue-on-error: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: playwright-report-smoke-${{ matrix.project }}
+          name: playwright-report-targeted-${{ matrix.project }}
           path: |
-            output/playwright/report
-            output/playwright/test-results
+            output/playwright/${{ env.PLAYWRIGHT_ARTIFACT_NAMESPACE }}-*
+            output/playwright/${{ env.PLAYWRIGHT_ARTIFACT_NAMESPACE }}
           if-no-files-found: ignore
-          retention-days: 7
+          retention-days: 1
+
+  e2e-pr:
+    if: >
+      always() &&
+      github.event_name != 'schedule' &&
+      needs.build-and-unit.result == 'success' &&
+      !(github.event_name == 'workflow_dispatch' && inputs.mode == 'targeted') &&
+      (
+        github.event_name != 'workflow_dispatch' ||
+        inputs.mode == 'full' ||
+        needs.e2e-targeted.result == 'success'
+      )
+    needs: [build-and-unit, e2e-targeted]
+    name: E2E-pr-${{ matrix.suite }}-${{ matrix.project }}
+    runs-on: ${{ fromJSON(vars.FRONTEND_CI_E2E_RUNNER || '["self-hosted","Linux","X64","pleno","frontend","docker"]') }}
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      max-parallel: ${{ fromJSON(vars.FRONTEND_CI_PR_E2E_MAX_PARALLEL || '2') }}
+      matrix:
+        suite: [changed-1-of-2, changed-2-of-2, smoke, pr, ct]
+        project: [chromium-desktop, chromium-mobile]
+    env:
+      PLAYWRIGHT_ARTIFACT_NAMESPACE: e2e-pr-${{ matrix.suite }}-${{ matrix.project }}
+      PLAYWRIGHT_REPORTER_MODE: line-html
+      PLAYWRIGHT_WORKERS: 1
+      PLAYWRIGHT_VIDEO_MODE: on-first-retry
+    steps:
+      - name: Repair self-hosted workspace permissions
+        if: ${{ contains(vars.FRONTEND_CI_E2E_RUNNER || 'self-hosted', 'self-hosted') }}
+        shell: bash
+        run: |
+          if [[ -d "$GITHUB_WORKSPACE" ]]; then
+            sudo -n chown -R "$(id -u):$(id -g)" "$GITHUB_WORKSPACE" 2>/dev/null || true
+            foreign_entry="$(find "$GITHUB_WORKSPACE" -mindepth 1 -maxdepth 2 ! -user "$(id -u)" -print -quit 2>/dev/null || true)"
+            if [[ -n "$foreign_entry" ]]; then
+              trash="$GITHUB_WORKSPACE/../_workspace-trash-$GITHUB_RUN_ID-$GITHUB_JOB"
+              rm -rf "$trash" 2>/dev/null || true
+              mv "$GITHUB_WORKSPACE" "$trash" 2>/dev/null || true
+              mkdir -p "$GITHUB_WORKSPACE"
+            fi
+          fi
+
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Resolve Playwright diff refs
+        id: playwright-diff
+        shell: bash
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          EVENT_NAME: ${{ github.event_name }}
+          HEAD_SHA: ${{ github.sha }}
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PUSH_BEFORE_SHA: ${{ github.event.before }}
+        run: |
+          set -euo pipefail
+          zero_sha="0000000000000000000000000000000000000000"
+          if [[ "$EVENT_NAME" == "pull_request" && -n "$PR_BASE_SHA" ]]; then
+            base_ref="$PR_BASE_SHA"
+            head_ref="$PR_HEAD_SHA"
+          elif [[ -z "$PUSH_BEFORE_SHA" || "$PUSH_BEFORE_SHA" == "$zero_sha" ]]; then
+            git fetch --no-tags --prune origin "$DEFAULT_BRANCH"
+            base_ref="origin/$DEFAULT_BRANCH"
+            head_ref="$HEAD_SHA"
+          else
+            base_ref="$PUSH_BEFORE_SHA"
+            head_ref="$HEAD_SHA"
+          fi
+          if [[ "$EVENT_NAME" == "pull_request" && -n "$PR_HEAD_SHA" ]]; then
+            head_ref="$PR_HEAD_SHA"
+          else
+            head_ref="$HEAD_SHA"
+          fi
+          echo "base=$base_ref" >> "$GITHUB_OUTPUT"
+          echo "head=$head_ref" >> "$GITHUB_OUTPUT"
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: 22
+
+      - name: Run Playwright PR suite in container
+        shell: bash
+        env:
+          DIFF_BASE_REF: ${{ steps.playwright-diff.outputs.base }}
+          DIFF_HEAD_REF: ${{ steps.playwright-diff.outputs.head }}
+          MATRIX_SUITE: ${{ matrix.suite }}
+          MATRIX_PROJECT: ${{ matrix.project }}
+          RUN_ID: ${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          case "$MATRIX_SUITE" in
+            changed-1-of-2) suite_offset=0 ;;
+            changed-2-of-2) suite_offset=10 ;;
+            smoke) suite_offset=20 ;;
+            pr) suite_offset=30 ;;
+            ct) suite_offset=40 ;;
+            *) echo "Unsupported Playwright PR suite: $MATRIX_SUITE" >&2; exit 1 ;;
+          esac
+          case "$MATRIX_PROJECT" in
+            chromium-desktop) project_offset=1 ;;
+            chromium-mobile) project_offset=2 ;;
+            *) echo "Unsupported Playwright PR project: $MATRIX_PROJECT" >&2; exit 1 ;;
+          esac
+          port_seed=$((21000 + (RUN_ID % 20000) + suite_offset + project_offset))
+          lock_root="${PLAYWRIGHT_PORT_LOCK_ROOT:-/tmp/pleno-playwright-port-locks}"
+          mkdir -p "$lock_root"
+          chmod 1777 "$lock_root" 2>/dev/null || true
+          find "$lock_root" -mindepth 1 -maxdepth 1 -type d -mmin +360 -exec rmdir {} \; 2>/dev/null || true
+          playwright_port_lock=""
+          playwright_dev_port=""
+          for ((candidate = port_seed; candidate < port_seed + 1000; candidate += 1)); do
+            lock_dir="${lock_root}/${candidate}.lock"
+            if ! mkdir "$lock_dir" 2>/dev/null; then
+              continue
+            fi
+            if ss -H -ltn "sport = :${candidate}" 2>/dev/null | grep -q .; then
+              rmdir "$lock_dir" || true
+              continue
+            fi
+            playwright_port_lock="$lock_dir"
+            playwright_dev_port="$candidate"
+            break
+          done
+          if [[ -z "$playwright_dev_port" ]]; then
+            echo "Unable to find a free Playwright dev-server port." >&2
+            exit 1
+          fi
+          trap 'if [[ -n "${playwright_port_lock:-}" ]]; then rmdir "$playwright_port_lock" 2>/dev/null || true; fi' EXIT
+          if docker info >/dev/null 2>&1; then
+            docker_cmd=(docker)
+          elif sudo -n docker info >/dev/null 2>&1; then
+            docker_cmd=(sudo docker)
+          else
+            echo "Docker is not available to the runner user, and sudo docker is not available." >&2
+            exit 1
+          fi
+          mkdir -p output/playwright
+          scripts/ci/runner-diagnostics.sh "before Playwright PR ${MATRIX_SUITE}/${MATRIX_PROJECT}" -- "${docker_cmd[@]}"
+          SYSTEMD_INHIBIT_REASON="Frontend Playwright PR ${MATRIX_SUITE}/${MATRIX_PROJECT}" \
+          scripts/ci/with-systemd-inhibit.sh "${docker_cmd[@]}" run --rm --ipc=host --network host \
+            --volume "$PWD:/source:ro" \
+            --volume "$PWD/output/playwright:/work/output/playwright" \
+            --workdir /work \
+            --env HOME=/tmp \
+            --env CI="${CI:-}" \
+            --env PLAYWRIGHT_ARTIFACT_NAMESPACE="$PLAYWRIGHT_ARTIFACT_NAMESPACE" \
+            --env PLAYWRIGHT_REPORTER_MODE="$PLAYWRIGHT_REPORTER_MODE" \
+            --env PLAYWRIGHT_WORKERS="$PLAYWRIGHT_WORKERS" \
+            --env PLAYWRIGHT_VIDEO_MODE="$PLAYWRIGHT_VIDEO_MODE" \
+            --env PLAYWRIGHT_DEV_PORT="$playwright_dev_port" \
+            --env MATRIX_SUITE="$MATRIX_SUITE" \
+            --env MATRIX_PROJECT="$MATRIX_PROJECT" \
+            --env DIFF_BASE_REF="$DIFF_BASE_REF" \
+            --env DIFF_HEAD_REF="$DIFF_HEAD_REF" \
+            mcr.microsoft.com/playwright:v1.58.2-noble \
+            bash -lc '
+              set -euo pipefail
+              tar --exclude=./output/playwright -C /source -cf - . | tar -C /work -xf -
+              git config --global --add safe.directory /work
+              install_dependencies() {
+                local attempt
+                for attempt in 1 2 3; do
+                  if npm ci --legacy-peer-deps --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000; then
+                    return 0
+                  fi
+                  if [[ "$attempt" == "3" ]]; then
+                    return 1
+                  fi
+                  echo "npm ci failed on attempt ${attempt}; retrying..." >&2
+                  sleep 20
+                done
+              }
+              install_dependencies
+              ulimit -n 16384 || true
+              case "$MATRIX_SUITE" in
+                ct)
+                  npm run test:ct -- --project="$MATRIX_PROJECT"
+                  ;;
+                smoke)
+                  npx playwright test --grep @smoke --project="$MATRIX_PROJECT"
+                  ;;
+                pr)
+                  npm run test:e2e:pr -- --core-only --project="$MATRIX_PROJECT"
+                  ;;
+                changed-1-of-2)
+                  npm run test:e2e:pr -- --changed-only --project="$MATRIX_PROJECT" --base="$DIFF_BASE_REF" --head="$DIFF_HEAD_REF" -- --shard=1/2 --pass-with-no-tests
+                  ;;
+                changed-2-of-2)
+                  npm run test:e2e:pr -- --changed-only --project="$MATRIX_PROJECT" --base="$DIFF_BASE_REF" --head="$DIFF_HEAD_REF" -- --shard=2/2 --pass-with-no-tests
+                  ;;
+                *)
+                  echo "Unsupported Playwright PR suite: $MATRIX_SUITE" >&2
+                  exit 1
+                  ;;
+              esac
+            '
+
+      - name: Runner diagnostics after Playwright failure
+        if: failure() || cancelled()
+        continue-on-error: true
+        run: scripts/ci/runner-diagnostics.sh "after Playwright PR ${{ matrix.suite }}/${{ matrix.project }}"
+
+      - name: Upload Playwright report
+        if: failure() || cancelled()
+        continue-on-error: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: playwright-report-pr-${{ matrix.suite }}-${{ matrix.project }}
+          path: |
+            output/playwright/${{ env.PLAYWRIGHT_ARTIFACT_NAMESPACE }}-*
+            output/playwright/${{ env.PLAYWRIGHT_ARTIFACT_NAMESPACE }}
+          if-no-files-found: ignore
+          retention-days: 1
+
+  required-ci:
+    if: ${{ always() && (github.event_name == 'pull_request' || github.event_name == 'push') }}
+    name: Required CI
+    needs: [format-tests, build-and-unit, e2e-pr]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Verify required jobs succeeded
+        shell: bash
+        env:
+          FORMAT_TESTS_RESULT: ${{ needs.format-tests.result }}
+          BUILD_AND_UNIT_RESULT: ${{ needs.build-and-unit.result }}
+          E2E_PR_RESULT: ${{ needs.e2e-pr.result }}
+        run: |
+          set -euo pipefail
+          failed=0
+          for required_job in FORMAT_TESTS_RESULT BUILD_AND_UNIT_RESULT E2E_PR_RESULT; do
+            result="${!required_job:-missing}"
+            if [[ "$result" != "success" ]]; then
+              echo "${required_job}=${result}" >&2
+              failed=1
+            fi
+          done
+          exit "$failed"
 
   e2e-full:
-    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.ref_name == github.event.repository.default_branch
-    needs: build-and-unit
-    runs-on: ubuntu-latest
+    if: >
+      always() &&
+      (
+        github.event_name == 'schedule' ||
+        github.event_name == 'workflow_dispatch' ||
+        (
+          github.ref_name == github.event.repository.default_branch &&
+          !(github.event_name == 'push' && github.event.before == 'd393c8c17508c46c61e97bd834a2e407367c69eb')
+        )
+      ) &&
+      !(github.event_name == 'workflow_dispatch' && inputs.mode == 'targeted') &&
+      needs.build-and-unit.result == 'success' &&
+      (
+        github.event_name != 'workflow_dispatch' ||
+        inputs.mode == 'full' ||
+        needs.e2e-targeted.result == 'success'
+      )
+    needs: [build-and-unit, e2e-targeted]
+    name: E2E-full-${{ matrix.browser_label }}-${{ matrix.device }}-${{ matrix.role }}-shard-${{ matrix.shard_index }}-of-${{ (matrix.role == 'superuser' || matrix.role == 'admin') && 2 || 1 }}
+    runs-on: ${{ fromJSON(vars.FRONTEND_CI_E2E_RUNNER || '["self-hosted","Linux","X64","pleno","frontend","docker"]') }}
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      max-parallel: ${{ fromJSON(vars.FRONTEND_CI_FULL_E2E_MAX_PARALLEL || '36') > 0 && github.event_name == 'schedule' && fromJSON(vars.FRONTEND_CI_FULL_E2E_MAX_PARALLEL || '36') || fromJSON(vars.FRONTEND_CI_FULL_E2E_CONCURRENT_MAX_PARALLEL || '26') }}
+      matrix:
+        device: [mobile, desktop, tablet]
+        role: [superuser, admin, customer, subuser]
+        shard_index: [1, 2]
+        browser: [chromium, webkit, firefox]
+        exclude:
+          - role: customer
+            shard_index: 2
+          - role: subuser
+            shard_index: 2
+        include:
+          - browser: chromium
+            browser_label: Chromium
+            browser_install: chromium
+          - browser: webkit
+            browser_label: WebKit
+            browser_install: webkit
+          - browser: firefox
+            browser_label: Firefox
+            browser_install: firefox
+    env:
+      PLAYWRIGHT_ARTIFACT_NAMESPACE: e2e-full-${{ matrix.browser }}-${{ matrix.device }}-${{ matrix.role }}-shard-${{ matrix.shard_index }}-of-${{ (matrix.role == 'superuser' || matrix.role == 'admin') && 2 || 1 }}
+      PLAYWRIGHT_REPORTER_MODE: line-html
+      PLAYWRIGHT_WORKERS: 1
+      PLAYWRIGHT_VIDEO_MODE: off
     steps:
+      - name: Repair self-hosted workspace permissions
+        if: ${{ contains(vars.FRONTEND_CI_E2E_RUNNER || 'self-hosted', 'self-hosted') }}
+        shell: bash
+        run: |
+          if [[ -d "$GITHUB_WORKSPACE" ]]; then
+            sudo -n chown -R "$(id -u):$(id -g)" "$GITHUB_WORKSPACE" 2>/dev/null || true
+            foreign_entry="$(find "$GITHUB_WORKSPACE" -mindepth 1 -maxdepth 2 ! -user "$(id -u)" -print -quit 2>/dev/null || true)"
+            if [[ -n "$foreign_entry" ]]; then
+              trash="$GITHUB_WORKSPACE/../_workspace-trash-$GITHUB_RUN_ID-$GITHUB_JOB"
+              rm -rf "$trash" 2>/dev/null || true
+              mv "$GITHUB_WORKSPACE" "$trash" 2>/dev/null || true
+              mkdir -p "$GITHUB_WORKSPACE"
+            fi
+          fi
+
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: 22
-          cache: npm
 
-      - name: Install dependencies
-        run: npm ci --legacy-peer-deps
+      - name: Run full Playwright slice in container
+        shell: bash
+        env:
+          MATRIX_ROLE: ${{ matrix.role }}
+          MATRIX_BROWSER: ${{ matrix.browser }}
+          MATRIX_DEVICE: ${{ matrix.device }}
+          MATRIX_SHARD_INDEX: ${{ matrix.shard_index }}
+          MATRIX_SHARD_TOTAL: ${{ (matrix.role == 'superuser' || matrix.role == 'admin') && 2 || 1 }}
+          RUN_ID: ${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          case "$MATRIX_ROLE" in
+            superuser) role_offset=0 ;;
+            admin) role_offset=100 ;;
+            customer) role_offset=200 ;;
+            subuser) role_offset=300 ;;
+            *) echo "Unsupported Playwright role: $MATRIX_ROLE" >&2; exit 1 ;;
+          esac
+          case "$MATRIX_BROWSER" in
+            chromium) browser_offset=0 ;;
+            webkit) browser_offset=30 ;;
+            firefox) browser_offset=60 ;;
+            *) echo "Unsupported Playwright browser: $MATRIX_BROWSER" >&2; exit 1 ;;
+          esac
+          case "$MATRIX_DEVICE" in
+            mobile) device_offset=1 ;;
+            desktop) device_offset=2 ;;
+            tablet) device_offset=3 ;;
+            *) echo "Unsupported Playwright device: $MATRIX_DEVICE" >&2; exit 1 ;;
+          esac
+          case "$MATRIX_SHARD_INDEX" in
+            1) shard_offset=0 ;;
+            2) shard_offset=400 ;;
+            *) echo "Unsupported Playwright shard index: $MATRIX_SHARD_INDEX" >&2; exit 1 ;;
+          esac
+          port_seed=$((22000 + (RUN_ID % 20000) + role_offset + browser_offset + device_offset + shard_offset))
+          lock_root="${PLAYWRIGHT_PORT_LOCK_ROOT:-/tmp/pleno-playwright-port-locks}"
+          mkdir -p "$lock_root"
+          chmod 1777 "$lock_root" 2>/dev/null || true
+          find "$lock_root" -mindepth 1 -maxdepth 1 -type d -mmin +360 -exec rmdir {} \; 2>/dev/null || true
+          playwright_port_lock=""
+          playwright_dev_port=""
+          for ((candidate = port_seed; candidate < port_seed + 1000; candidate += 1)); do
+            lock_dir="${lock_root}/${candidate}.lock"
+            if ! mkdir "$lock_dir" 2>/dev/null; then
+              continue
+            fi
+            if ss -H -ltn "sport = :${candidate}" 2>/dev/null | grep -q .; then
+              rmdir "$lock_dir" || true
+              continue
+            fi
+            playwright_port_lock="$lock_dir"
+            playwright_dev_port="$candidate"
+            break
+          done
+          if [[ -z "$playwright_dev_port" ]]; then
+            echo "Unable to find a free Playwright dev-server port." >&2
+            exit 1
+          fi
+          trap 'if [[ -n "${playwright_port_lock:-}" ]]; then rmdir "$playwright_port_lock" 2>/dev/null || true; fi' EXIT
+          if docker info >/dev/null 2>&1; then
+            docker_cmd=(docker)
+          elif sudo -n docker info >/dev/null 2>&1; then
+            docker_cmd=(sudo docker)
+          else
+            echo "Docker is not available to the runner user, and sudo docker is not available." >&2
+            exit 1
+          fi
+          mkdir -p output/playwright
+          scripts/ci/runner-diagnostics.sh "before Playwright full ${MATRIX_BROWSER}/${MATRIX_DEVICE}/${MATRIX_ROLE}/shard-${MATRIX_SHARD_INDEX}-of-${MATRIX_SHARD_TOTAL}" -- "${docker_cmd[@]}"
+          SYSTEMD_INHIBIT_REASON="Frontend Playwright full ${MATRIX_BROWSER}/${MATRIX_DEVICE}/${MATRIX_ROLE}/shard-${MATRIX_SHARD_INDEX}-of-${MATRIX_SHARD_TOTAL}" \
+          scripts/ci/with-systemd-inhibit.sh "${docker_cmd[@]}" run --rm --ipc=host --network host \
+            --volume "$PWD:/source:ro" \
+            --volume "$PWD/output/playwright:/work/output/playwright" \
+            --workdir /work \
+            --env HOME=/tmp \
+            --env CI="${CI:-}" \
+            --env PLAYWRIGHT_ARTIFACT_NAMESPACE="$PLAYWRIGHT_ARTIFACT_NAMESPACE" \
+            --env PLAYWRIGHT_REPORTER_MODE="$PLAYWRIGHT_REPORTER_MODE" \
+            --env PLAYWRIGHT_WORKERS="$PLAYWRIGHT_WORKERS" \
+            --env PLAYWRIGHT_VIDEO_MODE="$PLAYWRIGHT_VIDEO_MODE" \
+            --env PLAYWRIGHT_DEV_PORT="$playwright_dev_port" \
+            --env MATRIX_ROLE="$MATRIX_ROLE" \
+            --env MATRIX_BROWSER="$MATRIX_BROWSER" \
+            --env MATRIX_DEVICE="$MATRIX_DEVICE" \
+            --env MATRIX_SHARD_INDEX="$MATRIX_SHARD_INDEX" \
+            --env MATRIX_SHARD_TOTAL="$MATRIX_SHARD_TOTAL" \
+            mcr.microsoft.com/playwright:v1.58.2-noble \
+            bash -lc '
+              set -euo pipefail
+              tar --exclude=./output/playwright -C /source -cf - . | tar -C /work -xf -
+              git config --global --add safe.directory /work
+              install_dependencies() {
+                local attempt
+                for attempt in 1 2 3; do
+                  if npm ci --legacy-peer-deps --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000; then
+                    return 0
+                  fi
+                  if [[ "$attempt" == "3" ]]; then
+                    return 1
+                  fi
+                  echo "npm ci failed on attempt ${attempt}; retrying..." >&2
+                  sleep 20
+                done
+              }
+              install_dependencies
+              ulimit -n 16384 || true
+              npm run test:e2e:full:slice -- --role="$MATRIX_ROLE" --project="$MATRIX_BROWSER-$MATRIX_DEVICE" --shard="$MATRIX_SHARD_INDEX/$MATRIX_SHARD_TOTAL"
+            '
 
-      - name: Install Playwright browsers
-        run: npx playwright install --with-deps
-
-      - name: Run full Playwright suite
-        run: npm run test:e2e:ci
+      - name: Runner diagnostics after Playwright failure
+        if: failure() || cancelled()
+        continue-on-error: true
+        run: scripts/ci/runner-diagnostics.sh "after Playwright full ${{ matrix.browser }}/${{ matrix.device }}/${{ matrix.role }}/shard-${{ matrix.shard_index }}-of-${{ (matrix.role == 'superuser' || matrix.role == 'admin') && 2 || 1 }}"
 
       - name: Upload Playwright report
-        if: failure()
-        uses: actions/upload-artifact@v4
+        if: failure() || cancelled()
+        continue-on-error: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: playwright-report-full
+          name: playwright-report-full-${{ matrix.browser }}-${{ matrix.device }}-${{ matrix.role }}-shard-${{ matrix.shard_index }}-of-${{ (matrix.role == 'superuser' || matrix.role == 'admin') && 2 || 1 }}
           path: |
-            output/playwright/report
-            output/playwright/test-results
+            output/playwright/${{ env.PLAYWRIGHT_ARTIFACT_NAMESPACE }}/report
+            output/playwright/${{ env.PLAYWRIGHT_ARTIFACT_NAMESPACE }}/test-results
+            output/playwright/test-lists/${{ matrix.browser }}-${{ matrix.device }}-${{ matrix.role }}.txt
+            output/playwright/test-lists/${{ matrix.browser }}-${{ matrix.device }}-${{ matrix.role }}-shard-${{ matrix.shard_index }}-of-${{ (matrix.role == 'superuser' || matrix.role == 'admin') && 2 || 1 }}.txt
           if-no-files-found: ignore
-          retention-days: 14
+          retention-days: 1
+
+  full-e2e-summary:
+    if: >
+      always() &&
+      (
+        github.event_name == 'schedule' ||
+        github.event_name == 'workflow_dispatch' ||
+        (
+          github.ref_name == github.event.repository.default_branch &&
+          !(github.event_name == 'push' && github.event.before == 'd393c8c17508c46c61e97bd834a2e407367c69eb')
+        )
+      ) &&
+      !(github.event_name == 'workflow_dispatch' && inputs.mode == 'targeted')
+    name: Full E2E summary
+    needs: [e2e-full]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Verify full E2E succeeded
+        shell: bash
+        env:
+          FULL_E2E_RESULT: ${{ needs.e2e-full.result }}
+        run: |
+          set -euo pipefail
+          if [[ "$FULL_E2E_RESULT" != "success" ]]; then
+            echo "E2E_FULL_RESULT=${FULL_E2E_RESULT:-missing}" >&2
+            exit 1
+          fi

.junie/guidelines.md

@@ -1,77 +1,27 @@
-# Project Guidelines
+<!-- AUTOGENERATED: Run `node scripts/sync-ai-workflow.mjs --write`. -->
 
-## Project Overview
+# Truckwash Frontend Development Guidelines
 
-This repository contains a Vue 3 single-page application built with Vite. It powers dashboard-style pages and modules such as bookings and POS flows. The UI is primarily styled with Bulma. The app leverages libraries like FullCalendar and Chart.js for scheduling and analytics.
+This file is generated from the canonical AI workflow and is the supported Junie-facing reference for the frontend repository.
 
-- Tech stack: Vue 3, Vite 5, Vue Router, Vuex, Bulma, FullCalendar, Chart.js
-- Notable integrations: toast notifications, QR/Barcode utilities, and PWA/devtools plugins
-- Target: modern browsers and mobile WebView contexts
+## Build And Run
 
-Local development
-- Requirements: Node.js 18+ (recommended to match Vite 5), npm 9+
-- Install dependencies: `npm install`
-- Start dev server: `npm run dev` (default at http://localhost:5173)
+- Setup: `npm ci` and `npx playwright install`.
+- Start development server: `npm run dev`.
+- Production build sanity check: `npm run build`.
 
-Build and preview
-- Production build: `npm run build` (output in `dist/`)
-- Preview build locally: `npm run preview`
+## Testing
 
-Testing
-- Framework: WebdriverIO (wdio) with Vite service; Appium available for mobile testing
-- Common commands:
-  - `npm run wdio` — run test suite per `wdio.conf.js`
-  - `npm run test:mobile` — run tests excluding Safari
-  - `npm run test:android` — run Android-targeted specs
-- Prerequisites for mobile tests may include Android SDK/emulator or iOS tooling and Appium drivers
+- Vitest unit tests: `npm run test:unit`.
+- Playwright smoke: `npm run test:e2e:smoke`.
+- Playwright full suite: `npm run test:e2e:ci`.
+- Playwright debug: `npx playwright test --debug`.
+- Browser validation is Playwright-first. Legacy browser-driver tooling is not part of the supported workflow.
 
-Environment configuration
-- Place environment variables in `.env.*` files (Vite loads `VITE_`-prefixed vars into the client)
+## Workflow Notes
 
-See the sections below for code style and detailed project structure.
+- Generated assistant metadata is checked with `node scripts/sync-ai-workflow.mjs --check`.
+- Keep frontend browser verification aligned with the existing Playwright projects and runner scripts in `package.json`.
+- Use the narrowest relevant test command first, then expand to the broader suite when the change risk requires it.
 
-## Code Style and Conventions
-
-### Vue Components
-
-- Use PascalCase for component names (e.g., `UserProfile.vue`)
-- Implement Single File Components (SFC) pattern
-- Keep components focused and single-responsibility
-- Use composition API for new components
-- Document component props and events
-
-### JavaScript/TypeScript
-
-- Use ES6+ features
-- Maintain consistent naming conventions (camelCase for variables/methods)
-- Document complex logic with clear comments
-- Use TypeScript for type safety when possible
-
-## Project Structure
-
-### Root Directory Structure
-
-- `/src` - Source code files
-    - `/assets` - Static assets (images, fonts, etc.)
-    - `/components` - Reusable Vue components
-    - `/views` - Page components
-    - `/router` - Vue Router configuration
-    - `/store` - Vuex store modules
-    - `/services` - API and external service integrations
-    - `/utils` - Utility functions and helpers
-    - `/styles` - Global styles and variables
-
-### Configuration Files
-
-- `vite.config.js` - Vite configuration
-- `.env.*` - Environment variables
-- `package.json` - Project dependencies and scripts
-- `jsconfig.json` - JavaScript/TypeScript tooling and path aliases
-
-### File Naming Conventions
-
-- Components: PascalCase (e.g., `UserProfile.vue`)
-- Utilities: camelCase (e.g., `formatDate.js`)
-- Store modules: camelCase (e.g., `userStore.js`)
-- Style files: kebab-case (e.g., `main-styles.scss`)
-- Test files: `*.spec.js` or `*.test.js`
+Canonical workflow reference: `.ai-workflow/workflow.md`.

.junie/memory/memory.version

@@ -0,0 +1 @@
+3.0

.npmrc

@@ -0,0 +1 @@
+legacy-peer-deps=true

.openclaw/workspace-state.json

@@ -0,0 +1,4 @@
+{
+  "version": 1,
+  "setupCompletedAt": "2026-06-07T11:37:04.444Z"
+}

Dockerfile.coolify-frontend

@@ -0,0 +1,26 @@
+FROM node:24-alpine AS build
+
+WORKDIR /app
+
+RUN apk add --no-cache git
+
+COPY package*.json ./
+RUN npm ci --ignore-scripts
+
+COPY . .
+ARG SOURCE_COMMIT
+ARG RELEASE_COMMIT_SHA
+ARG COMMIT_SHA
+ARG GITHUB_SHA
+ENV SOURCE_COMMIT=$SOURCE_COMMIT
+ENV RELEASE_COMMIT_SHA=$RELEASE_COMMIT_SHA
+ENV COMMIT_SHA=$COMMIT_SHA
+ENV GITHUB_SHA=$GITHUB_SHA
+RUN npm run build
+
+FROM nginx:1.27-alpine
+
+COPY nginx.coolify-frontend.conf /etc/nginx/conf.d/default.conf
+COPY --from=build /app/dist /usr/share/nginx/html
+
+EXPOSE 80

Gemfile

@@ -0,0 +1,4 @@
+source "https://rubygems.org"
+
+ruby ">= 3.2", "< 3.5"
+gem "fastlane", "2.237.0"

Gemfile.lock

@@ -0,0 +1,248 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    CFPropertyList (3.0.8)
+    abbrev (0.1.2)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
+    artifactory (3.0.17)
+    atomos (0.1.3)
+    aws-eventstream (1.4.0)
+    aws-partitions (1.1271.0)
+    aws-sdk-core (3.254.0)
+      aws-eventstream (~> 1, >= 1.3.0)
+      aws-partitions (~> 1, >= 1.992.0)
+      aws-sigv4 (~> 1.9)
+      base64
+      bigdecimal
+      jmespath (~> 1, >= 1.6.1)
+      logger
+    aws-sdk-kms (1.130.0)
+      aws-sdk-core (~> 3, >= 3.254.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-s3 (1.228.0)
+      aws-sdk-core (~> 3, >= 3.254.0)
+      aws-sdk-kms (~> 1)
+      aws-sigv4 (~> 1.5)
+    aws-sigv4 (1.12.1)
+      aws-eventstream (~> 1, >= 1.0.2)
+    babosa (1.0.4)
+    base64 (0.3.0)
+    benchmark (0.5.0)
+    bigdecimal (4.1.2)
+    claide (1.1.0)
+    colored (1.2)
+    colored2 (3.1.2)
+    commander (4.6.0)
+      highline (~> 2.0.0)
+    csv (3.3.5)
+    declarative (0.0.20)
+    digest-crc (0.7.0)
+      rake (>= 12.0.0, < 14.0.0)
+    domain_name (0.6.20240107)
+    dotenv (2.8.1)
+    emoji_regex (3.2.3)
+    excon (1.6.0)
+      logger
+    faraday (1.10.6)
+      faraday-em_http (~> 1.0)
+      faraday-em_synchrony (~> 1.0)
+      faraday-excon (~> 1.1)
+      faraday-httpclient (~> 1.0)
+      faraday-multipart (~> 1.0)
+      faraday-net_http (~> 1.0)
+      faraday-net_http_persistent (~> 1.0)
+      faraday-patron (~> 1.0)
+      faraday-rack (~> 1.0)
+      faraday-retry (~> 1.0)
+      ruby2_keywords (>= 0.0.4)
+    faraday-cookie_jar (0.0.8)
+      faraday (>= 0.8.0)
+      http-cookie (>= 1.0.0)
+    faraday-em_http (1.0.0)
+    faraday-em_synchrony (1.0.1)
+    faraday-excon (1.1.0)
+    faraday-httpclient (1.0.1)
+    faraday-multipart (1.2.0)
+      multipart-post (~> 2.0)
+    faraday-net_http (1.0.2)
+    faraday-net_http_persistent (1.2.0)
+    faraday-patron (1.0.0)
+    faraday-rack (1.0.0)
+    faraday-retry (1.0.4)
+    faraday_middleware (1.2.1)
+      faraday (~> 1.0)
+    fastimage (2.4.1)
+    fastlane (2.237.0)
+      CFPropertyList (>= 2.3, < 5.0.0)
+      abbrev (~> 0.1)
+      addressable (>= 2.9.0, < 3.0.0)
+      artifactory (~> 3.0)
+      aws-sdk-s3 (~> 1.197)
+      babosa (>= 1.0.3, < 2.0.0)
+      base64 (~> 0.2)
+      benchmark (>= 0.1.0)
+      bundler (>= 2.4.0, < 5.0.0)
+      colored (~> 1.2)
+      commander (~> 4.6)
+      csv (~> 3.3)
+      dotenv (>= 2.1.1, < 3.0.0)
+      emoji_regex (>= 0.1, < 4.0)
+      excon (>= 0.71.0, < 2.0.0)
+      faraday (~> 1.0)
+      faraday-cookie_jar (~> 0.0.6)
+      faraday_middleware (~> 1.0)
+      fastimage (>= 2.1.0, < 3.0.0)
+      fastlane-sirp (>= 1.1.0)
+      gh_inspector (>= 1.1.2, < 2.0.0)
+      google-apis-androidpublisher_v3 (~> 0.3)
+      google-apis-playcustomapp_v1 (~> 0.1)
+      google-cloud-env (>= 1.6.0, < 2.3.0)
+      google-cloud-storage (~> 1.31)
+      highline (~> 2.0)
+      http-cookie (~> 1.0.5)
+      json (< 3.0.0)
+      jwt (>= 2.10.3, < 4)
+      logger (>= 1.6, < 2.0)
+      mini_magick (>= 4.9.4, < 5.0.0)
+      multi_json (~> 1.12)
+      multipart-post (>= 2.0.0, < 3.0.0)
+      mutex_m (~> 0.3)
+      naturally (~> 2.2)
+      nkf (~> 0.2)
+      optparse (>= 0.1.1, < 1.0.0)
+      ostruct (>= 0.1.0)
+      plist (>= 3.1.0, < 4.0.0)
+      rubyzip (>= 2.0.0, < 3.0.0)
+      security (= 0.1.5)
+      simctl (~> 1.6.3)
+      terminal-notifier (>= 2.0.0, < 3.0.0)
+      terminal-table (~> 3)
+      tty-screen (>= 0.6.3, < 1.0.0)
+      tty-spinner (>= 0.8.0, < 1.0.0)
+      word_wrap (~> 1.0.0)
+      xcodeproj (>= 1.13.0, < 2.0.0)
+      xcpretty (~> 0.4.1)
+      xcpretty-travis-formatter (>= 0.0.3, < 2.0.0)
+    fastlane-sirp (1.1.0)
+    gh_inspector (1.1.3)
+    google-apis-androidpublisher_v3 (0.105.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-apis-core (0.18.0)
+      addressable (~> 2.5, >= 2.5.1)
+      googleauth (~> 1.9)
+      httpclient (>= 2.8.3, < 3.a)
+      mini_mime (~> 1.0)
+      mutex_m
+      representable (~> 3.0)
+      retriable (>= 2.0, < 4.a)
+    google-apis-iamcredentials_v1 (0.28.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-apis-playcustomapp_v1 (0.18.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-apis-storage_v1 (0.65.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-cloud-core (1.9.0)
+      google-cloud-env (>= 1.0, < 3.a)
+      google-cloud-errors (~> 1.0)
+    google-cloud-env (2.2.2)
+      base64 (~> 0.2)
+      faraday (>= 1.0, < 3.a)
+    google-cloud-errors (1.7.0)
+    google-cloud-storage (1.62.0)
+      addressable (~> 2.8)
+      digest-crc (~> 0.4)
+      google-apis-core (>= 0.18, < 2)
+      google-apis-iamcredentials_v1 (~> 0.18)
+      google-apis-storage_v1 (>= 0.42)
+      google-cloud-core (~> 1.6)
+      googleauth (~> 1.9)
+      mini_mime (~> 1.0)
+    google-logging-utils (0.2.0)
+    googleauth (1.17.1)
+      faraday (>= 1.0, < 3.a)
+      google-cloud-env (~> 2.2)
+      google-logging-utils (~> 0.1)
+      jwt (>= 1.4, < 4.0)
+      os (>= 0.9, < 2.0)
+      pstore (~> 0.1)
+      signet (>= 0.16, < 2.a)
+    highline (2.0.3)
+    http-cookie (1.0.8)
+      domain_name (~> 0.5)
+    httpclient (2.9.0)
+      mutex_m
+    jmespath (1.6.2)
+    json (2.21.1)
+    jwt (3.2.0)
+      base64
+    logger (1.7.0)
+    mini_magick (4.13.2)
+    mini_mime (1.1.5)
+    multi_json (1.21.1)
+    multipart-post (2.4.1)
+    mutex_m (0.3.0)
+    nanaimo (0.4.0)
+    naturally (2.3.0)
+    nkf (0.3.0)
+    optparse (0.8.1)
+    os (1.1.4)
+    ostruct (0.6.3)
+    plist (3.7.2)
+    pstore (0.2.1)
+    public_suffix (7.0.5)
+    rake (13.4.2)
+    representable (3.2.0)
+      declarative (< 0.1.0)
+      trailblazer-option (>= 0.1.1, < 0.2.0)
+      uber (< 0.2.0)
+    retriable (3.8.0)
+    rexml (3.4.4)
+    rouge (3.28.0)
+    ruby2_keywords (0.0.5)
+    rubyzip (2.4.1)
+    security (0.1.5)
+    signet (0.22.0)
+      addressable (~> 2.8)
+      faraday (>= 0.17.5, < 3.a)
+      jwt (>= 1.5, < 4.0)
+    simctl (1.6.10)
+      CFPropertyList
+      naturally
+    terminal-notifier (2.0.0)
+    terminal-table (3.0.2)
+      unicode-display_width (>= 1.1.1, < 3)
+    trailblazer-option (0.1.2)
+    tty-cursor (0.7.1)
+    tty-screen (0.8.2)
+    tty-spinner (0.9.3)
+      tty-cursor (~> 0.7)
+    uber (0.1.0)
+    unicode-display_width (2.6.0)
+    word_wrap (1.0.0)
+    xcodeproj (1.28.1)
+      CFPropertyList (>= 2.3.3, < 4.0)
+      atomos (~> 0.1.3)
+      base64
+      claide (>= 1.0.2, < 2.0)
+      colored2 (~> 3.1)
+      nanaimo (~> 0.4.0)
+      nkf
+      rexml (>= 3.3.6, < 4.0)
+    xcpretty (0.4.1)
+      rouge (~> 3.28.0)
+    xcpretty-travis-formatter (1.0.1)
+      xcpretty (~> 0.2, >= 0.0.7)
+
+PLATFORMS
+  ruby
+  x86_64-linux
+
+DEPENDENCIES
+  fastlane (= 2.237.0)
+
+RUBY VERSION
+   ruby 3.3.12p206
+
+BUNDLED WITH
+   2.5.22

README.md

@@ -16,12 +16,52 @@ See [Vite Configuration Reference](https://vite.dev/config/).
 npm install
 ```
 
+## Contributing Changes
+
+Create a scoped feature branch, push it, and open a pull request targeting
+`master`. Do not push directly to `master`. Merge only after the `Required CI`
+check succeeds, all review conversations are resolved, and the branch is up to
+date. Use squash merge so `master` retains linear history.
+
+See [`.github/BRANCH_PROTECTION.md`](.github/BRANCH_PROTECTION.md) for the
+repository policy, rollout checks, and emergency bypass procedure.
+
 ### Compile and Hot-Reload for Development
 
 ```sh
 npm run dev
 ```
 
+By default, the Vite dev server proxies `/api/*` to the remote stable API at
+`https://api-v2.truckwash.io/master/api`. This lets the Vue app run locally
+without a local PHP API container.
+
+To develop against a local PHP API instead:
+
+```powershell
+$env:VITE_API_PROXY_TARGET="http://localhost"; npm run dev
+```
+
+To use another remote API route:
+
+```powershell
+$env:VITE_API_PROXY_BASE_PATH="/canary/api"; npm run dev
+```
+
+TLS certificate validation is enabled for proxied HTTPS APIs by default. If you
+are using a trusted local HTTPS API with a self-signed certificate, you can opt
+out explicitly:
+
+```powershell
+$env:VITE_API_PROXY_TARGET="https://local-api.test"; $env:VITE_API_PROXY_SECURE="false"; npm run dev
+```
+
+For compatible local gateways that expect the `/api` prefix to be preserved:
+
+```powershell
+$env:VITE_API_PROXY_TARGET="http://localhost"; $env:VITE_API_PROXY_STRIP_PREFIX="false"; npm run dev
+```
+
 ### Compile and Minify for Production
 
 ```sh
@@ -57,12 +97,116 @@ npm run test:e2e:batched:chromium -- --grep @smoke
 ```
 
 Artifacts and summaries:
+
 - `output/playwright/batched-chromium/last-run.json`
 - `output/playwright/batched-chromium/failed-shards.json`
 - `output/playwright/batched-chromium/report-index.html`
 - `output/playwright/batched-chromium-shard-<i>-of-<n>/report/index.html`
 - `output/playwright/batched-chromium-rerun-shard-<i>-of-<n>/report/index.html`
 
+## Playwright Full E2E
+
+Run the permanent grouped full-suite entrypoint with a hard max of 5 total workers across the browser-engine groups:
+
+- Chromium
+- WebKit
+- Firefox
+
+```sh
+npm run test:e2e:ci
+```
+
+The full CI matrix is ordered by browser engine, then device class, then user role:
+
+- browsers: `chromium`, `webkit`, `firefox`
+- devices: `mobile`, `desktop`, `tablet`
+- roles: `superuser`, `admin`, `customer`, `subuser`
+
+Run a single full-suite slice for one role and one Playwright project:
+
+```sh
+npm run test:e2e:full:slice -- --role=admin --project=webkit-tablet
+```
+
+Default worker allocation:
+
+```sh
+PLAYWRIGHT_PARALLEL_WORKERS_CHROMIUM=2
+PLAYWRIGHT_PARALLEL_WORKERS_FIREFOX=1
+PLAYWRIGHT_PARALLEL_WORKERS_WEBKIT=1
+```
+
+Optional overrides:
+
+```sh
+PLAYWRIGHT_PARALLEL_BASE_PORT=5191
+PLAYWRIGHT_PARALLEL_WORKERS_CHROMIUM=2
+PLAYWRIGHT_PARALLEL_WORKERS_FIREFOX=1
+PLAYWRIGHT_PARALLEL_WORKERS_WEBKIT=1
+```
+
+The runner fails fast if the combined worker count exceeds 5.
+
+GitHub Actions keeps the full browser/device/role matrix stable by capping full-suite
+matrix parallelism at 2 jobs, running each full slice with `PLAYWRIGHT_WORKERS=1`,
+wrapping Docker Playwright runs with `systemd-inhibit` when available, and setting
+`PLAYWRIGHT_VIDEO_MODE=off` for the full matrix. The E2E network harness serves
+Font Awesome from local fixtures so WebKit page loads and visual snapshots do not
+depend on CDN/TLS availability. Traces and screenshots are still retained on
+failure.
+
+Artifacts and summaries:
+
+- `output/playwright/ci-parallel-report/index.html`
+- `output/playwright/ci-parallel-chromium/report/index.html`
+- `output/playwright/ci-parallel-firefox/report/index.html`
+- `output/playwright/ci-parallel-webkit/report/index.html`
+- `output/playwright/test-lists/<project>-<role>.txt`
+- `output/playwright/test-lists/<role>-<project>.txt` (legacy compatibility copy)
+
+## Android App Icon
+
+The Play Store Android package is built from the Capacitor project in `android/`.
+The legacy Bubblewrap/TWA project at the repository root is not used by
+`npm run mobile:android:bundle`.
+
+The native launcher and store icons use the opaque iOS marketing icon as their
+shared master so Android and iOS keep the same white background:
+
+```text
+ios/App/App/Assets.xcassets/AppIcon.appiconset/AppIcon-1024.png
+```
+
+Regenerate the checked-in launcher assets after changing that source image:
+
+```sh
+npm run mobile:android:icons
+```
+
+Check that the generated Android launcher assets are current:
+
+```sh
+npm run mobile:android:icons:check
+```
+
+`npm run mobile:android:sync` runs the icon generator before building and syncing
+the Capacitor Android project. The generator updates `android/app/src/main/res`
+launcher assets, `public/icons/icon-192x192.png`, `public/icons/icon-512x512.png`,
+and `store_icon.png`.
+
+## Mobile Store Releases
+
+Signed Android and iOS store artifacts are built through the GitHub Actions
+`Mobile Store Artifacts` workflow. By default, current `master` after green
+`Automated Tests` uploads Android to Google Play production and uploads iOS to
+App Store Connect.
+
+See `docs/mobile-artifacts.md` for workflow triggers, required secrets, and
+local mobile checks. See `docs/app-store-release.md` for App Store Connect
+release preparation and review notes. For a separate development-signed IPA
+that can be installed on an approved iPhone from Ubuntu over USB, see
+`docs/ios-device-debug.md`.
+
 ## Bubblewrap (TWA) Build and Install
 
 To build and install the Trusted Web Activity (TWA) using Bubblewrap, use the following commands:

android/.gitignore

@@ -0,0 +1,101 @@
+# Using Android gitignore template: https://github.com/github/gitignore/blob/HEAD/Android.gitignore
+
+# Built application files
+*.apk
+*.aar
+*.ap_
+*.aab
+
+# Files for the ART/Dalvik VM
+*.dex
+
+# Java class files
+*.class
+
+# Generated files
+bin/
+gen/
+out/
+#  Uncomment the following line in case you need and you don't have the release build type files in your app
+# release/
+
+# Gradle files
+.gradle/
+build/
+
+# Local configuration file (sdk path, etc)
+local.properties
+
+# Proguard folder generated by Eclipse
+proguard/
+
+# Log Files
+*.log
+
+# Android Studio Navigation editor temp files
+.navigation/
+
+# Android Studio captures folder
+captures/
+
+# IntelliJ
+*.iml
+.idea/workspace.xml
+.idea/tasks.xml
+.idea/gradle.xml
+.idea/assetWizardSettings.xml
+.idea/dictionaries
+.idea/libraries
+# Android Studio 3 in .gitignore file.
+.idea/caches
+.idea/modules.xml
+# Comment next line if keeping position of elements in Navigation Editor is relevant for you
+.idea/navEditor.xml
+
+# Keystore files
+# Uncomment the following lines if you do not want to check your keystore files in.
+#*.jks
+#*.keystore
+
+# External native build folder generated in Android Studio 2.2 and later
+.externalNativeBuild
+.cxx/
+
+# Google Services (e.g. APIs or Firebase)
+# google-services.json
+
+# Freeline
+freeline.py
+freeline/
+freeline_project_description.json
+
+# fastlane
+fastlane/report.xml
+fastlane/Preview.html
+fastlane/screenshots
+fastlane/test_output
+fastlane/readme.md
+
+# Version control
+vcs.xml
+
+# lint
+lint/intermediates/
+lint/generated/
+lint/outputs/
+lint/tmp/
+# lint/reports/
+
+# Android Profiling
+*.hprof
+
+# Cordova plugins for Capacitor
+capacitor-cordova-android-plugins
+
+# Copied web assets
+app/src/main/assets/public
+
+# Generated Config files
+app/src/main/assets/capacitor.config.json
+app/src/main/assets/capacitor.plugins.json
+app/src/main/res/xml/config.xml

android/app/.gitignore

@@ -0,0 +1,2 @@
+/build/*
+!/build/.npmkeep

android/app/build.gradle

@@ -0,0 +1,77 @@
+apply plugin: 'com.android.application'
+
+def mobileEnv = { String name, String defaultValue = null ->
+    return System.getenv(name) ?: (project.hasProperty(name) ? project.property(name).toString() : defaultValue)
+}
+
+def releaseStoreFile = mobileEnv('ANDROID_KEYSTORE_FILE')
+def hasReleaseSigning = releaseStoreFile &&
+    mobileEnv('ANDROID_KEYSTORE_PASSWORD') &&
+    mobileEnv('ANDROID_KEY_ALIAS') &&
+    mobileEnv('ANDROID_KEY_PASSWORD')
+
+android {
+    namespace = "io.truckwash.twa"
+    compileSdk = rootProject.ext.compileSdkVersion
+    defaultConfig {
+        applicationId "io.truckwash.twa"
+        minSdkVersion rootProject.ext.minSdkVersion
+        targetSdkVersion rootProject.ext.targetSdkVersion
+        versionCode Integer.parseInt(mobileEnv('MOBILE_VERSION_CODE', '1'))
+        versionName mobileEnv('MOBILE_VERSION_NAME', '1.0')
+        testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
+        aaptOptions {
+             // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.
+             // Default: https://android.googlesource.com/platform/frameworks/base/+/282e181b58cf72b6ca770dc7ca5f91f135444502/tools/aapt/AaptAssets.cpp#61
+             ignoreAssetsPattern = '!.svn:!.git:!.ds_store:!*.scc:.*:!CVS:!thumbs.db:!picasa.ini:!*~'
+        }
+    }
+    signingConfigs {
+        release {
+            if (hasReleaseSigning) {
+                storeFile file(releaseStoreFile)
+                storePassword mobileEnv('ANDROID_KEYSTORE_PASSWORD')
+                keyAlias mobileEnv('ANDROID_KEY_ALIAS')
+                keyPassword mobileEnv('ANDROID_KEY_PASSWORD')
+            }
+        }
+    }
+    buildTypes {
+        release {
+            minifyEnabled false
+            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
+            if (hasReleaseSigning) {
+                signingConfig signingConfigs.release
+            }
+        }
+    }
+}
+
+repositories {
+    flatDir{
+        dirs '../capacitor-cordova-android-plugins/src/main/libs', 'libs'
+    }
+}
+
+dependencies {
+    implementation fileTree(include: ['*.jar'], dir: 'libs')
+    implementation "androidx.appcompat:appcompat:$androidxAppCompatVersion"
+    implementation "androidx.coordinatorlayout:coordinatorlayout:$androidxCoordinatorLayoutVersion"
+    implementation "androidx.core:core-splashscreen:$coreSplashScreenVersion"
+    implementation project(':capacitor-android')
+    testImplementation "junit:junit:$junitVersion"
+    androidTestImplementation "androidx.test.ext:junit:$androidxJunitVersion"
+    androidTestImplementation "androidx.test.espresso:espresso-core:$androidxEspressoCoreVersion"
+    implementation project(':capacitor-cordova-android-plugins')
+}
+
+apply from: 'capacitor.build.gradle'
+
+try {
+    def servicesJSON = file('google-services.json')
+    if (servicesJSON.text) {
+        apply plugin: 'com.google.gms.google-services'
+    }
+} catch(Exception e) {
+    logger.info("google-services.json not found, google-services plugin not applied. Push Notifications won't work")
+}

android/app/capacitor.build.gradle

@@ -0,0 +1,19 @@
+// DO NOT EDIT THIS FILE! IT IS GENERATED EACH TIME "capacitor update" IS RUN
+
+android {
+  compileOptions {
+      sourceCompatibility JavaVersion.VERSION_21
+      targetCompatibility JavaVersion.VERSION_21
+  }
+}
+
+apply from: "../capacitor-cordova-android-plugins/cordova.variables.gradle"
+dependencies {
+    implementation project(':capacitor-geolocation')
+
+}
+
+
+if (hasProperty('postBuildExtras')) {
+  postBuildExtras()
+}

android/app/proguard-rules.pro

@@ -0,0 +1,21 @@
+# Add project specific ProGuard rules here.
+# You can control the set of applied configuration files using the
+# proguardFiles setting in build.gradle.
+#
+# For more details, see
+#   http://developer.android.com/guide/developing/tools/proguard.html
+
+# If your project uses WebView with JS, uncomment the following
+# and specify the fully qualified class name to the JavaScript interface
+# class:
+#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
+#   public *;
+#}
+
+# Uncomment this to preserve the line number information for
+# debugging stack traces.
+#-keepattributes SourceFile,LineNumberTable
+
+# If you keep the line number information, uncomment this to
+# hide the original source file name.
+#-renamesourcefileattribute SourceFile

android/app/src/androidTest/java/com/getcapacitor/myapp/ExampleInstrumentedTest.java

@@ -0,0 +1,26 @@
+package io.truckwash.twa;
+
+import static org.junit.Assert.*;
+
+import android.content.Context;
+import androidx.test.ext.junit.runners.AndroidJUnit4;
+import androidx.test.platform.app.InstrumentationRegistry;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+/**
+ * Instrumented test, which will execute on an Android device.
+ *
+ * @see <a href="http://d.android.com/tools/testing">Testing documentation</a>
+ */
+@RunWith(AndroidJUnit4.class)
+public class ExampleInstrumentedTest {
+
+    @Test
+    public void useAppContext() throws Exception {
+        // Context of the app under test.
+        Context appContext = InstrumentationRegistry.getInstrumentation().getTargetContext();
+
+        assertEquals("io.truckwash.twa", appContext.getPackageName());
+    }
+}

android/app/src/main/AndroidManifest.xml

@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <application
+        android:allowBackup="true"
+        android:icon="@mipmap/ic_launcher"
+        android:label="@string/app_name"
+        android:roundIcon="@mipmap/ic_launcher_round"
+        android:supportsRtl="true"
+        android:theme="@style/AppTheme">
+
+        <activity
+            android:configChanges="orientation|keyboardHidden|keyboard|screenSize|locale|smallestScreenSize|screenLayout|uiMode|navigation|density"
+            android:name=".MainActivity"
+            android:label="@string/title_activity_main"
+            android:theme="@style/AppTheme.NoActionBarLaunch"
+            android:launchMode="singleTask"
+            android:exported="true">
+
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+
+        </activity>
+
+        <provider
+            android:name="androidx.core.content.FileProvider"
+            android:authorities="${applicationId}.fileprovider"
+            android:exported="false"
+            android:grantUriPermissions="true">
+            <meta-data
+                android:name="android.support.FILE_PROVIDER_PATHS"
+                android:resource="@xml/file_paths"></meta-data>
+        </provider>
+    </application>
+
+    <uses-feature
+        android:name="android.hardware.camera"
+        android:required="false" />
+    <uses-feature
+        android:name="android.hardware.camera.autofocus"
+        android:required="false" />
+    <uses-feature
+        android:name="android.hardware.location.gps"
+        android:required="false" />
+
+    <!-- Permissions -->
+    <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.CAMERA" />
+    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
+    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
+</manifest>

android/app/src/main/java/io/truckwash/twa/MainActivity.java

@@ -0,0 +1,5 @@
+package io.truckwash.twa;
+
+import com.getcapacitor.BridgeActivity;
+
+public class MainActivity extends BridgeActivity {}

android/app/src/main/res/drawable-v24/ic_launcher_foreground.xml

@@ -0,0 +1,34 @@
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:aapt="http://schemas.android.com/aapt"
+    android:width="108dp"
+    android:height="108dp"
+    android:viewportHeight="108"
+    android:viewportWidth="108">
+    <path
+        android:fillType="evenOdd"
+        android:pathData="M32,64C32,64 38.39,52.99 44.13,50.95C51.37,48.37 70.14,49.57 70.14,49.57L108.26,87.69L108,109.01L75.97,107.97L32,64Z"
+        android:strokeColor="#00000000"
+        android:strokeWidth="1">
+        <aapt:attr name="android:fillColor">
+            <gradient
+                android:endX="78.5885"
+                android:endY="90.9159"
+                android:startX="48.7653"
+                android:startY="61.0927"
+                android:type="linear">
+                <item
+                    android:color="#44000000"
+                    android:offset="0.0" />
+                <item
+                    android:color="#00000000"
+                    android:offset="1.0" />
+            </gradient>
+        </aapt:attr>
+    </path>
+    <path
+        android:fillColor="#FFFFFF"
+        android:fillType="nonZero"
+        android:pathData="M66.94,46.02L66.94,46.02C72.44,50.07 76,56.61 76,64L32,64C32,56.61 35.56,50.11 40.98,46.06L36.18,41.19C35.45,40.45 35.45,39.3 36.18,38.56C36.91,37.81 38.05,37.81 38.78,38.56L44.25,44.05C47.18,42.57 50.48,41.71 54,41.71C57.48,41.71 60.78,42.57 63.68,44.05L69.11,38.56C69.84,37.81 70.98,37.81 71.71,38.56C72.44,39.3 72.44,40.45 71.71,41.19L66.94,46.02ZM62.94,56.92C64.08,56.92 65,56.01 65,54.88C65,53.76 64.08,52.85 62.94,52.85C61.8,52.85 60.88,53.76 60.88,54.88C60.88,56.01 61.8,56.92 62.94,56.92ZM45.06,56.92C46.2,56.92 47.13,56.01 47.13,54.88C47.13,53.76 46.2,52.85 45.06,52.85C43.92,52.85 43,53.76 43,54.88C43,56.01 43.92,56.92 45.06,56.92Z"
+        android:strokeColor="#00000000"
+        android:strokeWidth="1" />
+</vector>

android/app/src/main/res/drawable/ic_launcher_background.xml

@@ -0,0 +1,170 @@
+<?xml version="1.0" encoding="utf-8"?>
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="108dp"
+    android:height="108dp"
+    android:viewportHeight="108"
+    android:viewportWidth="108">
+    <path
+        android:fillColor="#26A69A"
+        android:pathData="M0,0h108v108h-108z" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M9,0L9,108"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M19,0L19,108"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M29,0L29,108"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M39,0L39,108"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M49,0L49,108"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M59,0L59,108"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M69,0L69,108"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M79,0L79,108"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M89,0L89,108"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M99,0L99,108"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,9L108,9"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,19L108,19"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,29L108,29"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,39L108,39"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,49L108,49"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,59L108,59"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,69L108,69"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,79L108,79"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,89L108,89"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M0,99L108,99"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M19,29L89,29"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M19,39L89,39"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M19,49L89,49"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M19,59L89,59"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M19,69L89,69"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M19,79L89,79"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M29,19L29,89"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M39,19L39,89"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M49,19L49,89"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M59,19L59,89"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M69,19L69,89"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+    <path
+        android:fillColor="#00000000"
+        android:pathData="M79,19L79,89"
+        android:strokeColor="#33FFFFFF"
+        android:strokeWidth="0.8" />
+</vector>

android/app/src/main/res/layout/activity_main.xml

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+<androidx.coordinatorlayout.widget.CoordinatorLayout xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:app="http://schemas.android.com/apk/res-auto"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent"
+    tools:context=".MainActivity">
+
+    <WebView
+        android:layout_width="match_parent"
+        android:layout_height="match_parent" />
+</androidx.coordinatorlayout.widget.CoordinatorLayout>

android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+    <background android:drawable="@color/ic_launcher_background"/>
+    <foreground android:drawable="@mipmap/ic_launcher_foreground"/>
+</adaptive-icon>

android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+    <background android:drawable="@color/ic_launcher_background"/>
+    <foreground android:drawable="@mipmap/ic_launcher_foreground"/>
+</adaptive-icon>

android/app/src/main/res/values/ic_launcher_background.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <color name="ic_launcher_background">#FFFFFF</color>
+</resources>

android/app/src/main/res/values/strings.xml

@@ -0,0 +1,7 @@
+<?xml version='1.0' encoding='utf-8'?>
+<resources>
+    <string name="app_name">Truck Wash</string>
+    <string name="title_activity_main">Truck Wash</string>
+    <string name="package_name">io.truckwash.twa</string>
+    <string name="custom_url_scheme">io.truckwash.twa</string>
+</resources>

android/app/src/main/res/values/styles.xml

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+
+    <!-- Base application theme. -->
+    <style name="AppTheme" parent="Theme.AppCompat.Light.DarkActionBar">
+        <!-- Customize your theme here. -->
+        <item name="colorPrimary">@color/colorPrimary</item>
+        <item name="colorPrimaryDark">@color/colorPrimaryDark</item>
+        <item name="colorAccent">@color/colorAccent</item>
+    </style>
+
+    <style name="AppTheme.NoActionBar" parent="Theme.AppCompat.DayNight.NoActionBar">
+        <item name="windowActionBar">false</item>
+        <item name="windowNoTitle">true</item>
+        <item name="android:background">@null</item>
+    </style>
+
+
+    <style name="AppTheme.NoActionBarLaunch" parent="Theme.SplashScreen">
+        <item name="android:background">@drawable/splash</item>
+    </style>
+</resources>

android/app/src/main/res/xml/file_paths.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<paths xmlns:android="http://schemas.android.com/apk/res/android">
+    <external-path name="my_images" path="." />
+    <cache-path name="my_cache_images" path="." />
+</paths>

android/app/src/test/java/com/getcapacitor/myapp/ExampleUnitTest.java

@@ -0,0 +1,18 @@
+package io.truckwash.twa;
+
+import static org.junit.Assert.*;
+
+import org.junit.Test;
+
+/**
+ * Example local unit test, which will execute on the development machine (host).
+ *
+ * @see <a href="http://d.android.com/tools/testing">Testing documentation</a>
+ */
+public class ExampleUnitTest {
+
+    @Test
+    public void addition_isCorrect() throws Exception {
+        assertEquals(4, 2 + 2);
+    }
+}

android/build.gradle

@@ -0,0 +1,29 @@
+// Top-level build file where you can add configuration options common to all sub-projects/modules.
+
+buildscript {
+
+    repositories {
+        google()
+        mavenCentral()
+    }
+    dependencies {
+        classpath 'com.android.tools.build:gradle:8.13.0'
+        classpath 'com.google.gms:google-services:4.4.4'
+
+        // NOTE: Do not place your application dependencies here; they belong
+        // in the individual module build.gradle files
+    }
+}
+
+apply from: "variables.gradle"
+
+allprojects {
+    repositories {
+        google()
+        mavenCentral()
+    }
+}
+
+task clean(type: Delete) {
+    delete rootProject.buildDir
+}

android/capacitor.settings.gradle

@@ -0,0 +1,6 @@
+// DO NOT EDIT THIS FILE! IT IS GENERATED EACH TIME "capacitor update" IS RUN
+include ':capacitor-android'
+project(':capacitor-android').projectDir = new File('../node_modules/@capacitor/android/capacitor')
+
+include ':capacitor-geolocation'
+project(':capacitor-geolocation').projectDir = new File('../node_modules/@capacitor/geolocation/android')

android/gradle.properties

@@ -0,0 +1,22 @@
+# Project-wide Gradle settings.
+
+# IDE (e.g. Android Studio) users:
+# Gradle settings configured through the IDE *will override*
+# any settings specified in this file.
+
+# For more details on how to configure your build environment visit
+# http://www.gradle.org/docs/current/userguide/build_environment.html
+
+# Specifies the JVM arguments used for the daemon process.
+# The setting is particularly useful for tweaking memory settings.
+org.gradle.jvmargs=-Xmx1536m
+
+# When configured, Gradle will run in incubating parallel mode.
+# This option should only be used with decoupled projects. More details, visit
+# http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects
+# org.gradle.parallel=true
+
+# AndroidX package structure to make it clearer which packages are bundled with the
+# Android operating system, and which are packaged with your app's APK
+# https://developer.android.com/topic/libraries/support-library/androidx-rn
+android.useAndroidX=true

android/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,7 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-all.zip
+networkTimeout=10000
+validateDistributionUrl=true
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists

android/gradlew

@@ -0,0 +1,251 @@
+#!/bin/sh
+
+#
+# Copyright © 2015-2021 the original authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+##############################################################################
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
+##############################################################################
+
+# Attempt to set APP_HOME
+
+# Resolve links: $0 may be a link
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
+done
+
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD=maximum
+
+warn () {
+    echo "$*"
+} >&2
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+} >&2
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
+esac
+
+CLASSPATH="\\\"\\\""
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD=$JAVA_HOME/jre/sh/java
+    else
+        JAVACMD=$JAVA_HOME/bin/java
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD=java
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+fi
+
+# Increase the maximum file descriptors if we can.
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
+    esac
+fi
+
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
+        fi
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
+    done
+fi
+
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
+
+exec "$JAVACMD" "$@"

android/gradlew.bat

@@ -0,0 +1,94 @@
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
+
+@if "%DEBUG%"=="" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if %ERRORLEVEL% equ 0 goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=
+
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
+
+:end
+@rem End local scope for the variables with windows NT shell
+if %ERRORLEVEL% equ 0 goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega

android/settings.gradle

@@ -0,0 +1,5 @@
+include ':app'
+include ':capacitor-cordova-android-plugins'
+project(':capacitor-cordova-android-plugins').projectDir = new File('./capacitor-cordova-android-plugins/')
+
+apply from: 'capacitor.settings.gradle'

android/variables.gradle

@@ -0,0 +1,16 @@
+ext {
+    minSdkVersion = 24
+    compileSdkVersion = 36
+    targetSdkVersion = 36
+    androidxActivityVersion = '1.11.0'
+    androidxAppCompatVersion = '1.7.1'
+    androidxCoordinatorLayoutVersion = '1.3.0'
+    androidxCoreVersion = '1.17.0'
+    androidxFragmentVersion = '1.8.9'
+    coreSplashScreenVersion = '1.2.0'
+    androidxWebkitVersion = '1.14.0'
+    junitVersion = '4.13.2'
+    androidxJunitVersion = '1.3.0'
+    androidxEspressoCoreVersion = '3.7.0'
+    cordovaAndroidVersion = '14.0.1'
+}

app/build.gradle

@@ -56,9 +56,9 @@ android {
     defaultConfig {
         applicationId "io.truckwash.twa"
         minSdkVersion 21
-        targetSdkVersion 35
-        versionCode 6
-        versionName "6"
+        targetSdkVersion 36
+        versionCode 7
+        versionName "7"
 
         // The name for the application
         resValue "string", "appName", twaManifest.name

app/build/generated/res/resValues/release/values/gradleResValues.xml

@@ -1,49 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<resources>
-
-    <!-- Automatically generated file. DO NOT MODIFY -->
-
-    <!-- Value from default config. -->
-    <bool name="enableNotification">true</bool>
-    <!-- Value from default config. -->
-    <bool name="enableSiteSettingsShortcut">true</bool>
-    <!-- Value from default config. -->
-    <color name="backgroundColor">#0787BB</color>
-    <!-- Value from default config. -->
-    <color name="colorPrimary">#063651</color>
-    <!-- Value from default config. -->
-    <color name="colorPrimaryDark">#000000</color>
-    <!-- Value from default config. -->
-    <color name="navigationColor">#000000</color>
-    <!-- Value from default config. -->
-    <color name="navigationColorDark">#000000</color>
-    <!-- Value from default config. -->
-    <color name="navigationDividerColor">#000000</color>
-    <!-- Value from default config. -->
-    <color name="navigationDividerColorDark">#000000</color>
-    <!-- Value from default config. -->
-    <integer name="splashScreenFadeOutDuration">300</integer>
-    <!-- Value from default config. -->
-    <string name="appName" translatable="false">Truck Wash</string>
-    <!-- Value from default config. -->
-    <string name="fallbackType" translatable="false">customtabs</string>
-    <!-- Value from default config. -->
-    <string name="fullScopeUrl" translatable="false">https://truckwash.io/</string>
-    <!-- Value from default config. -->
-    <string name="generatorApp" translatable="false">bubblewrap-cli</string>
-    <!-- Value from default config. -->
-    <string name="hostName" translatable="false">truckwash.io</string>
-    <!-- Value from default config. -->
-    <string name="launchHandlerClientMode" translatable="false">navigate-existing</string>
-    <!-- Value from default config. -->
-    <string name="launchUrl" translatable="false">https://truckwash.io/</string>
-    <!-- Value from default config. -->
-    <string name="launcherName" translatable="false">Truck Wash</string>
-    <!-- Value from default config. -->
-    <string name="orientation" translatable="false">portrait</string>
-    <!-- Value from default config. -->
-    <string name="providerAuthority" translatable="false">io.truckwash.twa.fileprovider</string>
-    <!-- Value from default config. -->
-    <string name="webManifestUrl" translatable="false">https://truckwash.io/manifest.webmanifest</string>
-
-</resources>

app/build/intermediates/aapt_proguard_file/release/processReleaseResources/aapt_rules.txt

@@ -1,55 +0,0 @@
--keep class androidx.core.app.CoreComponentFactory { <init>(); }
--keep class androidx.core.content.FileProvider { <init>(); }
--keep class androidx.profileinstaller.ProfileInstallReceiver { <init>(); }
--keep class androidx.startup.InitializationProvider { <init>(); }
--keep class com.google.android.gms.common.api.GoogleApiActivity { <init>(); }
--keep class com.google.androidbrowserhelper.locationdelegation.PermissionRequestActivity { <init>(); }
--keep class com.google.androidbrowserhelper.trusted.FocusActivity { <init>(); }
--keep class com.google.androidbrowserhelper.trusted.ManageDataLauncherActivity { <init>(); }
--keep class com.google.androidbrowserhelper.trusted.NotificationPermissionRequestActivity { <init>(); }
--keep class com.google.androidbrowserhelper.trusted.WebViewFallbackActivity { <init>(); }
--keep class io.truckwash.twa.Application { <init>(); }
--keep class io.truckwash.twa.DelegationService { <init>(); }
--keep class io.truckwash.twa.LauncherActivity { <init>(); }
--keep class android.widget.Space { <init>(android.content.Context, android.util.AttributeSet); }
-
--keep class androidx.appcompat.app.AlertController$RecycleListView { <init>(android.content.Context, android.util.AttributeSet); }
-
--keep class androidx.appcompat.view.menu.ActionMenuItemView { <init>(android.content.Context, android.util.AttributeSet); }
-
--keep class androidx.appcompat.view.menu.ExpandedMenuView { <init>(android.content.Context, android.util.AttributeSet); }
-
--keep class androidx.appcompat.view.menu.ListMenuItemView { <init>(android.content.Context, android.util.AttributeSet); }
-
--keep class androidx.appcompat.widget.ActionBarContainer { <init>(android.content.Context, android.util.AttributeSet); }
-
--keep class androidx.appcompat.widget.ActionBarContextView { <init>(android.content.Context, android.util.AttributeSet); }
-
--keep class androidx.appcompat.widget.ActionBarOverlayLayout { <init>(android.content.Context, android.util.AttributeSet); }
-
--keep class androidx.appcompat.widget.ActionMenuView { <init>(android.content.Context, android.util.AttributeSet); }
-
--keep class androidx.appcompat.widget.ActivityChooserView$InnerLayout { <init>(android.content.Context, android.util.AttributeSet); }
-
--keep class androidx.appcompat.widget.AlertDialogLayout { <init>(android.content.Context, android.util.AttributeSet); }
-
--keep class androidx.appcompat.widget.ButtonBarLayout { <init>(android.content.Context, android.util.AttributeSet); }
-
--keep class androidx.appcompat.widget.ContentFrameLayout { <init>(android.content.Context, android.util.AttributeSet); }
-
--keep class androidx.appcompat.widget.DialogTitle { <init>(android.content.Context, android.util.AttributeSet); }
-
--keep class androidx.appcompat.widget.FitWindowsFrameLayout { <init>(android.content.Context, android.util.AttributeSet); }
-
--keep class androidx.appcompat.widget.FitWindowsLinearLayout { <init>(android.content.Context, android.util.AttributeSet); }
-
--keep class androidx.appcompat.widget.SearchView$SearchAutoComplete { <init>(android.content.Context, android.util.AttributeSet); }
-
--keep class androidx.appcompat.widget.Toolbar { <init>(android.content.Context, android.util.AttributeSet); }
-
--keep class androidx.appcompat.widget.ViewStubCompat { <init>(android.content.Context, android.util.AttributeSet); }
-
--keep class androidx.browser.browseractions.BrowserActionsFallbackMenuView { <init>(android.content.Context, android.util.AttributeSet); }
-
--keep class androidx.core.widget.NestedScrollView { <init>(android.content.Context, android.util.AttributeSet); }
-

app/build/intermediates/annotation_processor_list/release/javaPreCompileRelease/annotationProcessors.json

@@ -1 +0,0 @@
-{}

app/build/intermediates/apk_ide_redirect_file/release/createReleaseApkListingFileRedirect/redirect.txt

@@ -1,2 +0,0 @@
-#- File Locator -
-listingFile=../../../../outputs/apk/release/output-metadata.json

app/build/intermediates/app_metadata/release/writeReleaseAppMetadata/app-metadata.properties

@@ -1,2 +0,0 @@
-appMetadataVersion=1.1
-androidGradlePluginVersion=8.9.1