Replace monolithic E2E matrices with dependency-aware component CI

Generate small reusable component partitions with explicit provider dependencies, GitHub-hosted concurrency, fail-closed evidence, and exact mobile store gates. Include the literal-i18n fix from #206 so validation covers the exact post-merge tree.

.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "07:00"
+      timezone: Europe/Copenhagen
+    open-pull-requests-limit: 5
+    labels: [dependencies, ci]
+
+  - package-ecosystem: bundler
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "07:15"
+      timezone: Europe/Copenhagen
+    open-pull-requests-limit: 3
+    labels: [dependencies, ios]

.github/workflows/app-store-readiness.yml

@@ -0,0 +1,72 @@
+name: App Store Readiness
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+    paths:
+      - "fastlane/**"
+      - "ios/**"
+      - "scripts/mobile/**"
+      - "Gemfile*"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: app-store-readiness-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          node-version: 22
+
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
+        with:
+          ruby-version: "3.3"
+
+      - name: Resolve the pinned Fastlane dependency graph
+        run: bundle lock
+
+      - name: Check the committed Fastlane dependency lock
+        id: fastlane-lock
+        continue-on-error: true
+        run: test -z "$(git status --porcelain -- Gemfile.lock)"
+
+      - name: Preserve a generated lock for review
+        if: steps.fastlane-lock.outcome == 'failure'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: generated-fastlane-lock
+          path: Gemfile.lock
+          if-no-files-found: error
+          retention-days: 1
+
+      - name: Require a current committed Fastlane dependency lock
+        if: steps.fastlane-lock.outcome == 'failure'
+        run: |
+          echo 'Gemfile.lock is missing or stale. Download generated-fastlane-lock and commit it.' >&2
+          exit 1
+
+      - name: Validate App Store metadata and available assets
+        run: node scripts/mobile/validate-app-store.mjs
+
+      - name: Validate JavaScript syntax
+        run: |
+          node --check scripts/mobile/validate-app-store.mjs
+          node --check scripts/mobile/app-store-connect.mjs
+          node --check scripts/mobile/create-ios-release-manifest.mjs
+          node scripts/mobile/app-store-connect.mjs self-test-jwt

.github/workflows/cpanel-root-restore.yml

@@ -33,7 +33,7 @@ concurrency:
 
 jobs:
   audit-or-restore:
-    runs-on: [self-hosted, Linux, X64, default]
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     environment:
       name: frontend-production

.github/workflows/ios-app-store-candidate.yml

@@ -0,0 +1,188 @@
+name: iOS App Store Candidate
+
+on:
+  push:
+    tags: ["ios-v*"]
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: ios-app-store-candidate
+  cancel-in-progress: false
+
+jobs:
+  resolve:
+    name: Resolve exact tested build
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    outputs:
+      enabled: ${{ steps.resolve.outputs.enabled }}
+      source_sha: ${{ steps.resolve.outputs.source_sha }}
+      version: ${{ steps.resolve.outputs.version }}
+      build_number: ${{ steps.manifest.outputs.build_number }}
+      app_store_build_id: ${{ steps.manifest.outputs.app_store_build_id }}
+    steps:
+      - name: Checkout tagged source
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          node-version: 22
+
+      - name: Validate protected tag and release version
+        id: resolve
+        shell: bash
+        env:
+          AUTOMATION_ENABLED: ${{ vars.APP_STORE_AUTOMATION_ENABLED || 'false' }}
+        run: |
+          set -euo pipefail
+          [[ "$GITHUB_REF_NAME" =~ ^ios-v([0-9]+\.[0-9]+\.[0-9]+)$ ]] || { echo "Tag must be ios-vX.Y.Z." >&2; exit 1; }
+          version="${BASH_REMATCH[1]}"
+          source_sha="$(git rev-parse HEAD)"
+          manifest_version="$(node -p "JSON.parse(require('fs').readFileSync('ios/release.json')).marketingVersion")"
+          [[ "$version" == "$manifest_version" ]] || { echo "Tag version $version does not match ios/release.json $manifest_version." >&2; exit 1; }
+          git show-ref --verify --quiet refs/remotes/origin/master || { echo "origin/master was not included in the full checkout." >&2; exit 1; }
+          git merge-base --is-ancestor "$source_sha" origin/master || { echo "Tagged commit is not reachable from master." >&2; exit 1; }
+          [[ "$(git rev-parse origin/master)" == "$source_sha" ]] || { echo "Tagged commit is not the exact current master SHA." >&2; exit 1; }
+          enabled=false
+          [[ "$AUTOMATION_ENABLED" == true ]] && enabled=true
+          echo "enabled=$enabled" >> "$GITHUB_OUTPUT"
+          echo "source_sha=$source_sha" >> "$GITHUB_OUTPUT"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          if [[ "$enabled" != true ]]; then
+            echo "### Candidate promotion safely disabled" >> "$GITHUB_STEP_SUMMARY"
+            echo 'No App Store environment or credentials were accessed. Enable only after the signed canary.' >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+      - name: Require complete WebKit mobile tests
+        if: steps.resolve.outputs.enabled == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          STORE_SOURCE_SHA: ${{ steps.resolve.outputs.source_sha }}
+          DEFAULT_BRANCH: master
+        run: node scripts/mobile/verify-store-test-gate.mjs --platform apple
+
+      - name: Download exact TestFlight release manifest
+        if: steps.resolve.outputs.enabled == 'true'
+        id: manifest
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SOURCE_SHA: ${{ steps.resolve.outputs.source_sha }}
+          EXPECTED_VERSION: ${{ steps.resolve.outputs.version }}
+        run: |
+          set -euo pipefail
+          artifact_name="ios-release-manifest-$SOURCE_SHA"
+          response="$RUNNER_TEMP/ios-artifacts.json"
+          curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts?name=$artifact_name&per_page=100" > "$response"
+          artifact_id="$(jq -r --arg sha "$SOURCE_SHA" '[.artifacts[] | select(.expired == false) | select(.workflow_run.head_sha == $sha)] | sort_by(.created_at) | last | .id // empty' "$response")"
+          [[ "$artifact_id" =~ ^[0-9]+$ ]] || { echo "No successful TestFlight release manifest exists for $SOURCE_SHA." >&2; exit 1; }
+          mkdir -p output/candidate
+          curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts/$artifact_id/zip" -o "$RUNNER_TEMP/manifest.zip"
+          unzip -q "$RUNNER_TEMP/manifest.zip" -d output/candidate
+          MANIFEST=output/candidate/ios-release-manifest.json node <<'NODE'
+          const fs = require("node:fs");
+          const manifest = JSON.parse(fs.readFileSync(process.env.MANIFEST, "utf8"));
+          const checks = {
+            schema: manifest.schemaVersion === 1,
+            repository: manifest.repository === process.env.GITHUB_REPOSITORY,
+            source: manifest.sourceSha === process.env.SOURCE_SHA,
+            version: manifest.marketingVersion === process.env.EXPECTED_VERSION,
+            bundle: manifest.bundleId === "io.truckwash.app",
+            build: /^[1-9][0-9]*$/.test(manifest.buildNumber),
+            appStoreBuild: typeof manifest.appStoreBuildId === "string" && manifest.appStoreBuildId.length > 0,
+          };
+          const failed = Object.entries(checks).filter(([, ok]) => !ok).map(([name]) => name);
+          if (failed.length) throw new Error(`Invalid iOS release manifest: ${failed.join(", ")}`);
+          fs.appendFileSync(process.env.GITHUB_OUTPUT, `build_number=${manifest.buildNumber}\napp_store_build_id=${manifest.appStoreBuildId}\n`);
+          NODE
+
+  promote:
+    name: Sync storefront and prepare manual review
+    needs: resolve
+    if: needs.resolve.outputs.enabled == 'true'
+    runs-on: macos-15
+    timeout-minutes: 60
+    environment: app-store-candidate
+    env:
+      IOS_SOURCE_SHA: ${{ needs.resolve.outputs.source_sha }}
+      IOS_MARKETING_VERSION: ${{ needs.resolve.outputs.version }}
+      IOS_BUILD_NUMBER: ${{ needs.resolve.outputs.build_number }}
+      EXPECTED_APP_STORE_BUILD_ID: ${{ needs.resolve.outputs.app_store_build_id }}
+      IOS_BUNDLE_ID: ${{ vars.IOS_BUNDLE_ID || 'io.truckwash.app' }}
+      APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
+      APP_STORE_CONNECT_API_KEY_ID: ${{ vars.APP_STORE_CONNECT_API_KEY_ID }}
+      APP_STORE_CONNECT_ISSUER_ID: ${{ vars.APP_STORE_CONNECT_ISSUER_ID || '' }}
+      APP_STORE_CONNECT_APP_ID: ${{ vars.APP_STORE_CONNECT_APP_ID }}
+      APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64 }}
+    steps:
+      - name: Checkout exact candidate source
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          ref: ${{ env.IOS_SOURCE_SHA }}
+          persist-credentials: false
+
+      - name: Setup Ruby and pinned Fastlane
+        uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
+        with:
+          ruby-version: "3.3"
+          bundler-cache: true
+
+      - name: Setup Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          node-version: 22
+
+      - name: Validate complete candidate storefront
+        run: node scripts/mobile/validate-app-store.mjs --strict
+
+      - name: Verify public storefront URLs
+        shell: bash
+        run: |
+          set -euo pipefail
+          for file in support_url privacy_url marketing_url; do
+            url="$(tr -d '\r\n' < "fastlane/metadata/da-DK/$file.txt")"
+            curl --fail --silent --show-error --location --connect-timeout 10 --max-time 30 --output /dev/null "$url"
+          done
+
+      - name: Verify exact processed TestFlight build
+        run: node scripts/mobile/app-store-connect.mjs verify-candidate
+
+      - name: Sync metadata and screenshots without App Review submission
+        run: bundle exec fastlane ios prepare_candidate
+
+      - name: Read back exact App Store candidate
+        id: readback
+        run: node scripts/mobile/app-store-connect.mjs verify-store-version
+
+      - name: Write candidate handoff
+        env:
+          APP_STORE_STATE: ${{ steps.readback.outputs.app_store_state }}
+          APP_STORE_VERSION_ID: ${{ steps.readback.outputs.app_store_version_id }}
+        run: |
+          echo "### iOS $IOS_MARKETING_VERSION candidate prepared" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Source: \`$IOS_SOURCE_SHA\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Exact tested build: \`$IOS_BUILD_NUMBER\` (\`$EXPECTED_APP_STORE_BUILD_ID\`)" >> "$GITHUB_STEP_SUMMARY"
+          echo "- App Store state: \`$APP_STORE_STATE\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- App Store version ID: \`$APP_STORE_VERSION_ID\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- [Open the app in App Store Connect](https://appstoreconnect.apple.com/apps/$APP_STORE_CONNECT_APP_ID/appstore)" >> "$GITHUB_STEP_SUMMARY"
+          echo "- App Review submission and public release remain manual in App Store Connect." >> "$GITHUB_STEP_SUMMARY"
+
+  disabled:
+    name: Promotion disabled
+    needs: resolve
+    if: needs.resolve.outputs.enabled != 'true'
+    runs-on: ubuntu-24.04
+    steps:
+      - run: echo "App Store candidate promotion is disabled; no environment or credentials were accessed."

.github/workflows/ios-credential-health.yml

@@ -0,0 +1,117 @@
+name: iOS Credential Health
+
+on:
+  schedule:
+    - cron: "17 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ios-credential-health
+  cancel-in-progress: true
+
+jobs:
+  gate:
+    runs-on: ubuntu-24.04
+    outputs:
+      enabled: ${{ steps.gate.outputs.enabled }}
+    steps:
+      - id: gate
+        env:
+          ENABLED: ${{ vars.APP_STORE_AUTOMATION_ENABLED || 'false' }}
+        run: |
+          enabled=false
+          [[ "$ENABLED" == true ]] && enabled=true
+          echo "enabled=$enabled" >> "$GITHUB_OUTPUT"
+          if [[ "$enabled" != true ]]; then
+            echo "App Store automation is disabled; credential health did not access its environment." >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+  validate:
+    needs: gate
+    if: needs.gate.outputs.enabled == 'true'
+    runs-on: macos-15
+    timeout-minutes: 15
+    environment: app-store-signing
+    env:
+      IOS_BUNDLE_ID: ${{ vars.IOS_BUNDLE_ID || 'io.truckwash.app' }}
+      APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
+      APP_STORE_CONNECT_API_KEY_ID: ${{ vars.APP_STORE_CONNECT_API_KEY_ID }}
+      APP_STORE_CONNECT_ISSUER_ID: ${{ vars.APP_STORE_CONNECT_ISSUER_ID || '' }}
+      APP_STORE_CONNECT_APP_ID: ${{ vars.APP_STORE_CONNECT_APP_ID }}
+      APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64 }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          node-version: 22
+
+      - name: Validate API key and app access
+        run: node scripts/mobile/app-store-connect.mjs verify-credentials
+
+      - name: Validate certificate and profile identity and expiry
+        shell: bash
+        env:
+          IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64 }}
+          IOS_DISTRIBUTION_CERTIFICATE_PASSWORD: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_PASSWORD }}
+          IOS_APP_STORE_PROFILE_BASE64: ${{ secrets.IOS_APP_STORE_PROFILE_BASE64 }}
+        run: |
+          set -euo pipefail
+          cert_p12="$RUNNER_TEMP/distribution.p12"
+          cert_pem="$RUNNER_TEMP/distribution.pem"
+          cert_der="$RUNNER_TEMP/distribution.der"
+          profile="$RUNNER_TEMP/distribution.mobileprovision"
+          profile_plist="$RUNNER_TEMP/distribution-profile.plist"
+          keychain="$RUNNER_TEMP/credential-health.keychain-db"
+          keychain_password="$(openssl rand -hex 24)"
+          node -e "const fs=require('fs');fs.writeFileSync(process.argv[1],Buffer.from(process.env.IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64.replace(/\\s/g,''),'base64'))" "$cert_p12"
+          node -e "const fs=require('fs');fs.writeFileSync(process.argv[1],Buffer.from(process.env.IOS_APP_STORE_PROFILE_BASE64.replace(/\\s/g,''),'base64'))" "$profile"
+          chmod 600 "$cert_p12" "$profile"
+          security create-keychain -p "$keychain_password" "$keychain"
+          security unlock-keychain -p "$keychain_password" "$keychain"
+          security import "$cert_p12" -P "$IOS_DISTRIBUTION_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain"
+          security list-keychains -d user -s "$keychain"
+          security set-key-partition-list -S apple-tool:,apple: -s -k "$keychain_password" "$keychain" >/dev/null
+          security find-identity -v -p codesigning "$keychain" | grep -q 'Apple Distribution' || {
+            echo "Distribution P12 does not contain a usable private signing identity." >&2
+            exit 1
+          }
+          openssl pkcs12 -in "$cert_p12" -clcerts -nokeys -passin env:IOS_DISTRIBUTION_CERTIFICATE_PASSWORD -out "$cert_pem"
+          openssl x509 -in "$cert_pem" -noout -subject -issuer -dates
+          openssl x509 -in "$cert_pem" -checkend 2592000 -noout || { echo "Distribution certificate expires within 30 days." >&2; exit 1; }
+          openssl x509 -in "$cert_pem" -outform DER -out "$cert_der"
+          security cms -D -i "$profile" > "$profile_plist"
+          CERT_DER="$cert_der" PROFILE_PLIST="$profile_plist" python3 <<'PY'
+          import datetime, hashlib, os, plistlib, sys
+          with open(os.environ["PROFILE_PLIST"], "rb") as handle: profile = plistlib.load(handle)
+          with open(os.environ["CERT_DER"], "rb") as handle: cert_sha = hashlib.sha1(handle.read()).hexdigest().upper()
+          expiration = profile.get("ExpirationDate")
+          if expiration and expiration.tzinfo is None: expiration = expiration.replace(tzinfo=datetime.timezone.utc)
+          warning = datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(days=30)
+          ent = profile.get("Entitlements", {})
+          checks = {
+            "team": os.environ["APPLE_TEAM_ID"] in profile.get("TeamIdentifier", []),
+            "bundle": ent.get("application-identifier") == f'{os.environ["APPLE_TEAM_ID"]}.{os.environ["IOS_BUNDLE_ID"]}',
+            "distribution": ent.get("get-task-allow") is False and not profile.get("ProvisionedDevices"),
+            "profile expiry beyond 30 days": expiration is not None and expiration > warning,
+            "certificate belongs to profile": cert_sha in {hashlib.sha1(value).hexdigest().upper() for value in profile.get("DeveloperCertificates", [])},
+          }
+          failed = [name for name, ok in checks.items() if not ok]
+          if failed:
+            print("Credential health failed:", *[f"- {name}" for name in failed], sep="\n", file=sys.stderr)
+            sys.exit(1)
+          print(f"Provisioning profile is healthy through {expiration.isoformat()}.")
+          PY
+
+      - name: Clean temporary credential files
+        if: always()
+        run: |
+          security delete-keychain "$RUNNER_TEMP/credential-health.keychain-db" 2>/dev/null || true
+          rm -f "$RUNNER_TEMP"/distribution.{p12,pem,der,mobileprovision} "$RUNNER_TEMP/distribution-profile.plist"

.github/workflows/ios-testflight.yml

@@ -0,0 +1,437 @@
+name: iOS Internal TestFlight
+
+on:
+  workflow_run:
+    workflows: [Frontend Release]
+    types: [completed]
+    branches: [master]
+  workflow_dispatch:
+    inputs:
+      source_sha:
+        description: Full master commit SHA with a verified Frontend Release proof
+        required: true
+        type: string
+      confirmation:
+        description: Type UPLOAD IOS INTERNAL BUILD
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: ios-internal-testflight
+  cancel-in-progress: false
+
+jobs:
+  prepare:
+    name: Resolve verified release
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.event == 'workflow_run' &&
+       github.event.workflow_run.head_branch == 'master' &&
+       github.event.workflow_run.head_repository.full_name == github.repository)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    outputs:
+      source_sha: ${{ steps.resolve.outputs.source_sha }}
+      enabled: ${{ steps.resolve.outputs.enabled }}
+      current: ${{ steps.resolve.outputs.current }}
+    steps:
+      - name: Checkout repository history
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Resolve immutable source and rollout gate
+        id: resolve
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          WORKFLOW_SOURCE_SHA: ${{ github.event.workflow_run.head_sha || '' }}
+          INPUT_SOURCE_SHA: ${{ inputs.source_sha || '' }}
+          CONFIRMATION: ${{ inputs.confirmation || '' }}
+          AUTOMATION_ENABLED: ${{ vars.APP_STORE_AUTOMATION_ENABLED || 'false' }}
+        run: |
+          set -euo pipefail
+          source_sha="$WORKFLOW_SOURCE_SHA"
+          if [[ "$EVENT_NAME" == workflow_dispatch ]]; then
+            [[ "$GITHUB_REF" == refs/heads/master ]] || { echo "Dispatch this workflow from master." >&2; exit 1; }
+            [[ "$CONFIRMATION" == "UPLOAD IOS INTERNAL BUILD" ]] || { echo "Invalid confirmation." >&2; exit 1; }
+            source_sha="${INPUT_SOURCE_SHA,,}"
+          fi
+          [[ "$source_sha" =~ ^[0-9a-f]{40}$ ]] || { echo "A full lowercase source SHA is required." >&2; exit 1; }
+          git show-ref --verify --quiet refs/remotes/origin/master || { echo "origin/master was not included in the full checkout." >&2; exit 1; }
+          git cat-file -e "${source_sha}^{commit}"
+          git merge-base --is-ancestor "$source_sha" origin/master || { echo "Source is not reachable from master." >&2; exit 1; }
+          current=false
+          [[ "$(git rev-parse origin/master)" == "$source_sha" ]] && current=true
+          enabled=false
+          [[ "$AUTOMATION_ENABLED" == true ]] && enabled=true
+          echo "source_sha=$source_sha" >> "$GITHUB_OUTPUT"
+          echo "current=$current" >> "$GITHUB_OUTPUT"
+          echo "enabled=$enabled" >> "$GITHUB_OUTPUT"
+          if [[ "$enabled" != true ]]; then
+            echo "### iOS automation is safely disabled" >> "$GITHUB_STEP_SUMMARY"
+            echo 'Set repository variable `APP_STORE_AUTOMATION_ENABLED=true` only after the signing/API credential canary passes.' >> "$GITHUB_STEP_SUMMARY"
+          elif [[ "$current" != true ]]; then
+            echo "### Stale release skipped" >> "$GITHUB_STEP_SUMMARY"
+            echo "The verified SHA is no longer current master." >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+      - name: Setup Node.js
+        if: steps.resolve.outputs.enabled == 'true' && steps.resolve.outputs.current == 'true'
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          node-version: 22
+
+      - name: Require complete WebKit mobile tests
+        if: steps.resolve.outputs.enabled == 'true' && steps.resolve.outputs.current == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          STORE_SOURCE_SHA: ${{ steps.resolve.outputs.source_sha }}
+          DEFAULT_BRANCH: master
+        run: node scripts/mobile/verify-store-test-gate.mjs --platform apple
+
+  deliver:
+    name: Sign, upload, process, and distribute
+    needs: prepare
+    if: needs.prepare.outputs.enabled == 'true' && needs.prepare.outputs.current == 'true'
+    runs-on: macos-15
+    timeout-minutes: 120
+    environment: app-store-signing
+    env:
+      DEVELOPER_DIR: /Applications/Xcode_26.3.app/Contents/Developer
+      IOS_SOURCE_SHA: ${{ needs.prepare.outputs.source_sha }}
+      IOS_PROJECT_PATH: ${{ vars.IOS_PROJECT || 'ios/App/App.xcodeproj' }}
+      IOS_SCHEME: ${{ vars.IOS_SCHEME || 'App' }}
+      IOS_BUNDLE_ID: ${{ vars.IOS_BUNDLE_ID || 'io.truckwash.app' }}
+      APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
+      APP_STORE_CONNECT_API_KEY_ID: ${{ vars.APP_STORE_CONNECT_API_KEY_ID }}
+      APP_STORE_CONNECT_ISSUER_ID: ${{ vars.APP_STORE_CONNECT_ISSUER_ID || '' }}
+      APP_STORE_CONNECT_APP_ID: ${{ vars.APP_STORE_CONNECT_APP_ID }}
+      TESTFLIGHT_INTERNAL_GROUP_ID: ${{ vars.TESTFLIGHT_INTERNAL_GROUP_ID }}
+      APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64 }}
+    steps:
+      - name: Checkout verified source
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          ref: ${{ env.IOS_SOURCE_SHA }}
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Download and verify frontend release proof
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TRIGGERING_RELEASE_RUN_ID: ${{ github.event.workflow_run.id || '' }}
+        run: |
+          set -euo pipefail
+          artifact_name="frontend-release-proof-$IOS_SOURCE_SHA"
+          response="$RUNNER_TEMP/proof-artifacts.json"
+          curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts?name=$artifact_name&per_page=100" > "$response"
+          artifact_id="$(jq -r --arg run "$TRIGGERING_RELEASE_RUN_ID" '
+            [.artifacts[] | select(.expired == false) | select(($run == "") or ((.workflow_run.id|tostring) == $run))] |
+            sort_by(.created_at) | last | .id // empty' "$response")"
+          [[ "$artifact_id" =~ ^[0-9]+$ ]] || { echo "No verified Frontend Release proof found for $IOS_SOURCE_SHA." >&2; exit 1; }
+          mkdir -p output/frontend-release-proof
+          curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts/$artifact_id/zip" -o "$RUNNER_TEMP/proof.zip"
+          unzip -q "$RUNNER_TEMP/proof.zip" -d output/frontend-release-proof
+          PROOF_PATH=output/frontend-release-proof/frontend-release-proof.json node <<'NODE'
+          const fs = require("node:fs");
+          const proof = JSON.parse(fs.readFileSync(process.env.PROOF_PATH, "utf8"));
+          const checks = {
+            schema: proof.schemaVersion === 1,
+            repository: proof.repository === process.env.GITHUB_REPOSITORY,
+            source: proof.sourceSha === process.env.IOS_SOURCE_SHA,
+            publicGate: proof.livePublicGate === "passed",
+            credentialedGate: proof.liveCredentialedGate === "passed",
+            managerGate: proof.releaseManagerGate === "passed",
+            serverVersion: proof.serverVersionUpdated === true,
+          };
+          const failures = Object.entries(checks).filter(([, passed]) => !passed).map(([label]) => label);
+          if (failures.length) throw new Error(`Invalid frontend release proof: ${failures.join(", ")}`);
+          NODE
+
+      - name: Verify Xcode 26 and iOS 26 SDK
+        shell: bash
+        run: |
+          set -euo pipefail
+          [[ -x "$DEVELOPER_DIR/usr/bin/xcodebuild" ]] || { echo "Xcode 26.3 is not installed at $DEVELOPER_DIR." >&2; exit 1; }
+          xcode_version="$(xcodebuild -version | sed -n '1p')"
+          sdk_version="$(xcrun --sdk iphoneos --show-sdk-version)"
+          [[ "$xcode_version" =~ ^Xcode\ 26\. ]] || { echo "Xcode 26.x required; found $xcode_version." >&2; exit 1; }
+          [[ "$sdk_version" =~ ^26\. ]] || { echo "iPhoneOS 26 SDK required; found $sdk_version." >&2; exit 1; }
+          echo "XCODE_VERSION=$xcode_version" >> "$GITHUB_ENV"
+          echo "IOS_SDK_VERSION=$sdk_version" >> "$GITHUB_ENV"
+
+      - name: Setup Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Setup Ruby and pinned Fastlane
+        uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
+        with:
+          ruby-version: "3.3"
+          bundler-cache: true
+
+      - name: Install web dependencies
+        run: npm ci --legacy-peer-deps
+
+      - name: Validate storefront and resolve version
+        id: version
+        shell: bash
+        run: |
+          set -euo pipefail
+          node scripts/mobile/validate-app-store.mjs
+          version="$(node -p "JSON.parse(require('fs').readFileSync('ios/release.json')).marketingVersion")"
+          bundle="$(node -p "JSON.parse(require('fs').readFileSync('ios/release.json')).bundleId")"
+          [[ "$bundle" == "$IOS_BUNDLE_ID" ]]
+          echo "IOS_MARKETING_VERSION=$version" >> "$GITHUB_ENV"
+          echo "MOBILE_VERSION_NAME=$version" >> "$GITHUB_ENV"
+
+      - name: Resolve build number from App Store Connect
+        id: app-store
+        run: node scripts/mobile/app-store-connect.mjs next-build-number
+
+      - name: Export resolved build number
+        env:
+          BUILD_NUMBER: ${{ steps.app-store.outputs.build_number }}
+        run: |
+          [[ "$BUILD_NUMBER" =~ ^[1-9][0-9]*$ ]]
+          echo "IOS_BUILD_NUMBER=$BUILD_NUMBER" >> "$GITHUB_ENV"
+          echo "MOBILE_VERSION_CODE=$BUILD_NUMBER" >> "$GITHUB_ENV"
+
+      - name: Validate complete Apple environment
+        env:
+          IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64 }}
+          IOS_DISTRIBUTION_CERTIFICATE_PASSWORD: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_PASSWORD }}
+          IOS_APP_STORE_PROFILE_BASE64: ${{ secrets.IOS_APP_STORE_PROFILE_BASE64 }}
+          UPLOAD_IOS_TO_APP_STORE: "true"
+        run: node scripts/mobile/check-store-upload-env.mjs --ios
+
+      - name: Build and sync production iOS shell
+        run: |
+          npm run build
+          npx cap sync ios
+          npm run mobile:permissions:check
+          xcodebuild -resolvePackageDependencies -project "$IOS_PROJECT_PATH" -scheme "$IOS_SCHEME"
+
+      - name: Validate native release settings
+        shell: bash
+        run: |
+          set -euo pipefail
+          settings="$RUNNER_TEMP/ios-release-build-settings.txt"
+          xcodebuild -showBuildSettings -project "$IOS_PROJECT_PATH" -scheme "$IOS_SCHEME" -configuration Release CODE_SIGNING_ALLOWED=NO > "$settings"
+          grep -Eq "^[[:space:]]*PRODUCT_BUNDLE_IDENTIFIER = ${IOS_BUNDLE_ID//./\.}$" "$settings"
+          grep -Eq '^[[:space:]]*APP_DISPLAY_NAME = Truck Wash$' "$settings"
+          grep -Eq '^[[:space:]]*IPHONEOS_DEPLOYMENT_TARGET = 15\.0$' "$settings"
+          if grep -q 'isa = PBXShellScriptBuildPhase;' "$IOS_PROJECT_PATH/project.pbxproj"; then
+            echo "Unexpected Xcode shell-script build phase detected." >&2
+            exit 1
+          fi
+
+      - name: Install and validate Apple distribution signing assets
+        shell: bash
+        env:
+          IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64 }}
+          IOS_DISTRIBUTION_CERTIFICATE_PASSWORD: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_PASSWORD }}
+          IOS_APP_STORE_PROFILE_BASE64: ${{ secrets.IOS_APP_STORE_PROFILE_BASE64 }}
+        run: |
+          set -euo pipefail
+          certificate_path="$RUNNER_TEMP/apple-distribution.p12"
+          profile_path="$RUNNER_TEMP/app-store.mobileprovision"
+          profile_plist="$RUNNER_TEMP/app-store-profile.plist"
+          keychain_path="$RUNNER_TEMP/app-store-signing.keychain-db"
+          keychain_password="$(openssl rand -base64 48 | tr -d '\n')"
+          echo "::add-mask::$keychain_password"
+          echo "IOS_KEYCHAIN_PATH=$keychain_path" >> "$GITHUB_ENV"
+          node -e "const fs=require('fs'); fs.writeFileSync(process.argv[1], Buffer.from(process.env.IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64.replace(/\\s/g,''),'base64'))" "$certificate_path"
+          node -e "const fs=require('fs'); fs.writeFileSync(process.argv[1], Buffer.from(process.env.IOS_APP_STORE_PROFILE_BASE64.replace(/\\s/g,''),'base64'))" "$profile_path"
+          chmod 600 "$certificate_path" "$profile_path"
+          security cms -D -i "$profile_path" > "$profile_plist"
+          security create-keychain -p "$keychain_password" "$keychain_path"
+          security set-keychain-settings -lut 21600 "$keychain_path"
+          security unlock-keychain -p "$keychain_password" "$keychain_path"
+          security import "$certificate_path" -P "$IOS_DISTRIBUTION_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain_path"
+          security list-keychains -d user -s "$keychain_path" $(security list-keychains -d user | tr -d '"')
+          security set-key-partition-list -S apple-tool:,apple: -s -k "$keychain_password" "$keychain_path"
+          identity_sha="$(security find-identity -v -p codesigning "$keychain_path" | awk '/Apple Distribution/ {print $2; exit}')"
+          [[ "$identity_sha" =~ ^[0-9A-Fa-f]{40}$ ]] || { echo "P12 lacks an Apple Distribution identity." >&2; exit 1; }
+          IOS_SIGNING_IDENTITY_SHA="$identity_sha" PROFILE_PLIST="$profile_plist" python3 <<'PY'
+          import datetime, hashlib, os, plistlib, re, sys
+          with open(os.environ["PROFILE_PLIST"], "rb") as handle: profile = plistlib.load(handle)
+          entitlements = profile.get("Entitlements", {})
+          expiration = profile.get("ExpirationDate")
+          if expiration and expiration.tzinfo is None: expiration = expiration.replace(tzinfo=datetime.timezone.utc)
+          team = os.environ["APPLE_TEAM_ID"]
+          bundle = os.environ["IOS_BUNDLE_ID"]
+          hashes = {hashlib.sha1(value).hexdigest().upper() for value in profile.get("DeveloperCertificates", [])}
+          checks = {
+            "team": team in profile.get("TeamIdentifier", []),
+            "application identifier": entitlements.get("application-identifier") == f"{team}.{bundle}",
+            "team entitlement": entitlements.get("com.apple.developer.team-identifier") == team,
+            "distribution entitlement": entitlements.get("get-task-allow") is False,
+            "App Store profile has no devices": not profile.get("ProvisionedDevices"),
+            "non-enterprise profile": profile.get("ProvisionsAllDevices") is not True,
+            "expiration": expiration is not None and expiration > datetime.datetime.now(datetime.timezone.utc),
+            "certificate belongs to profile": os.environ["IOS_SIGNING_IDENTITY_SHA"].upper() in hashes,
+            "safe profile name": isinstance(profile.get("Name"), str) and not re.search(r"[\r\n]", profile["Name"]),
+          }
+          failed = [name for name, passed in checks.items() if not passed]
+          if failed:
+            print("Distribution signing validation failed:", *[f"- {name}" for name in failed], sep="\n", file=sys.stderr)
+            sys.exit(1)
+          PY
+          profile_uuid="$(/usr/libexec/PlistBuddy -c 'Print :UUID' "$profile_plist")"
+          profile_name="$(/usr/libexec/PlistBuddy -c 'Print :Name' "$profile_plist")"
+          profile_install="$HOME/Library/MobileDevice/Provisioning Profiles/$profile_uuid.mobileprovision"
+          mkdir -p "$(dirname "$profile_install")"
+          echo "IOS_PROFILE_INSTALL_PATH=$profile_install" >> "$GITHUB_ENV"
+          cp "$profile_path" "$profile_install"
+          echo "IOS_PROFILE_NAME=$profile_name" >> "$GITHUB_ENV"
+          echo "IOS_PROFILE_UUID=$profile_uuid" >> "$GITHUB_ENV"
+
+      - name: Archive and export App Store IPA
+        shell: bash
+        run: |
+          set -euo pipefail
+          archive="$RUNNER_TEMP/TruckWash.xcarchive"
+          export_dir="$RUNNER_TEMP/ios-export"
+          export_options="$RUNNER_TEMP/ExportOptions.plist"
+          xcodebuild -project "$IOS_PROJECT_PATH" -scheme "$IOS_SCHEME" -configuration Release \
+            -destination 'generic/platform=iOS' -archivePath "$archive" archive \
+            DEVELOPMENT_TEAM="$APPLE_TEAM_ID" CODE_SIGN_STYLE=Manual CODE_SIGN_IDENTITY='Apple Distribution' \
+            PROVISIONING_PROFILE_SPECIFIER="$IOS_PROFILE_NAME" MARKETING_VERSION="$IOS_MARKETING_VERSION" \
+            CURRENT_PROJECT_VERSION="$IOS_BUILD_NUMBER" DEBUG_INFORMATION_FORMAT='dwarf-with-dsym'
+          EXPORT_OPTIONS="$export_options" python3 <<'PY'
+          import os, plistlib
+          options = {"method":"app-store-connect","signingStyle":"manual","teamID":os.environ["APPLE_TEAM_ID"],"provisioningProfiles":{os.environ["IOS_BUNDLE_ID"]:os.environ["IOS_PROFILE_NAME"]},"stripSwiftSymbols":True,"manageAppVersionAndBuildNumber":False}
+          with open(os.environ["EXPORT_OPTIONS"], "wb") as handle: plistlib.dump(options, handle)
+          PY
+          xcodebuild -exportArchive -archivePath "$archive" -exportPath "$export_dir" -exportOptionsPlist "$export_options"
+          shopt -s nullglob
+          ipa_files=("$export_dir"/*.ipa)
+          [[ ${#ipa_files[@]} -eq 1 ]] || { echo "Expected one IPA; found ${#ipa_files[@]}." >&2; exit 1; }
+          echo "IOS_ARCHIVE_PATH=$archive" >> "$GITHUB_ENV"
+          echo "IOS_IPA_PATH=${ipa_files[0]}" >> "$GITHUB_ENV"
+
+      - name: Inspect signed IPA
+        shell: bash
+        run: |
+          set -euo pipefail
+          inspect="$RUNNER_TEMP/ios-inspect"
+          unzip -q "$IOS_IPA_PATH" -d "$inspect"
+          shopt -s nullglob
+          apps=("$inspect"/Payload/*.app)
+          [[ ${#apps[@]} -eq 1 ]] || { echo "Expected one Payload app." >&2; exit 1; }
+          app="${apps[0]}"
+          codesign --verify --deep --strict "$app"
+          codesign -d --entitlements :- "$app" > "$RUNNER_TEMP/entitlements.plist"
+          security cms -D -i "$app/embedded.mobileprovision" > "$RUNNER_TEMP/embedded-profile.plist"
+          [[ -f "$app/PrivacyInfo.xcprivacy" ]]
+          [[ -f "$app/da.lproj/InfoPlist.strings" ]]
+          [[ -f "$app/en.lproj/InfoPlist.strings" ]]
+          APP_PATH="$app" python3 <<'PY'
+          import os, plistlib, sys
+          app = os.environ["APP_PATH"]
+          with open(f"{app}/Info.plist", "rb") as handle: info = plistlib.load(handle)
+          with open(os.path.join(os.environ["RUNNER_TEMP"], "entitlements.plist"), "rb") as handle: ent = plistlib.load(handle)
+          with open(os.path.join(os.environ["RUNNER_TEMP"], "embedded-profile.plist"), "rb") as handle: profile = plistlib.load(handle)
+          checks = {
+            "bundle": info.get("CFBundleIdentifier") == os.environ["IOS_BUNDLE_ID"],
+            "version": info.get("CFBundleShortVersionString") == os.environ["IOS_MARKETING_VERSION"],
+            "build": info.get("CFBundleVersion") == os.environ["IOS_BUILD_NUMBER"],
+            "minimum iOS": info.get("MinimumOSVersion") == "15.0",
+            "profile": profile.get("UUID") == os.environ["IOS_PROFILE_UUID"],
+            "non-debug signature": ent.get("get-task-allow") is not True,
+            "signature application id": ent.get("application-identifier") == f'{os.environ["APPLE_TEAM_ID"]}.{os.environ["IOS_BUNDLE_ID"]}',
+          }
+          failed = [name for name, passed in checks.items() if not passed]
+          if failed:
+            print("IPA validation failed:", *[f"- {name}" for name in failed], sep="\n", file=sys.stderr)
+            sys.exit(1)
+          PY
+
+      - name: Recheck live master before upload
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          live_master_sha="$(curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/git/ref/heads/master" | jq -r '.object.sha')"
+          [[ "$live_master_sha" == "$IOS_SOURCE_SHA" ]] || {
+            echo "master advanced while the signed build was queued; refusing upload." >&2
+            exit 1
+          }
+      - name: Upload and wait for App Store processing
+        env:
+          TESTFLIGHT_WHAT_TO_TEST: Automatisk intern build fra verificeret master ${{ env.IOS_SOURCE_SHA }}.
+        run: bundle exec fastlane ios upload_internal
+
+      - name: Assign exact processed build to Internal QA
+        id: distribute
+        env:
+          TESTFLIGHT_WHAT_TO_TEST: Automatisk intern build fra verificeret master ${{ env.IOS_SOURCE_SHA }}.
+        run: node scripts/mobile/app-store-connect.mjs wait-and-distribute
+
+      - name: Assemble signed release evidence
+        shell: bash
+        env:
+          APP_STORE_BUILD_ID: ${{ steps.distribute.outputs.app_store_build_id }}
+        run: |
+          set -euo pipefail
+          artifact="output/ios-release"
+          mkdir -p "$artifact"
+          cp "$IOS_IPA_PATH" "$artifact/TruckWash-$IOS_MARKETING_VERSION-$IOS_BUILD_NUMBER.ipa"
+          shopt -s nullglob
+          dsyms=("$IOS_ARCHIVE_PATH"/dSYMs/*.dSYM)
+          [[ ${#dsyms[@]} -gt 0 ]] || { echo "Release archive contains no dSYM bundles." >&2; exit 1; }
+          ditto -c -k --sequesterRsrc --keepParent "$IOS_ARCHIVE_PATH/dSYMs" "$artifact/TruckWash-$IOS_MARKETING_VERSION-$IOS_BUILD_NUMBER.dSYM.zip"
+          node scripts/mobile/create-ios-release-manifest.mjs
+          (cd "$artifact" && shasum -a 256 -- * > SHA256SUMS)
+
+      - name: Upload signed IPA
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: truck-wash-ios-${{ env.IOS_SOURCE_SHA }}
+          path: output/ios-release/*.ipa
+          if-no-files-found: error
+          retention-days: 30
+
+      - name: Upload release manifest, dSYM, and checksums
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: ios-release-manifest-${{ env.IOS_SOURCE_SHA }}
+          path: |
+            output/ios-release/ios-release-manifest.json
+            output/ios-release/*.dSYM.zip
+            output/ios-release/SHA256SUMS
+          if-no-files-found: error
+          retention-days: 90
+
+      - name: Clean up Apple signing material
+        if: always()
+        shell: bash
+        run: |
+          if [[ -n "${IOS_KEYCHAIN_PATH:-}" ]]; then security delete-keychain "$IOS_KEYCHAIN_PATH" || true; fi
+          if [[ -n "${IOS_PROFILE_INSTALL_PATH:-}" ]]; then rm -f "$IOS_PROFILE_INSTALL_PATH"; fi
+          rm -f "$RUNNER_TEMP/apple-distribution.p12" "$RUNNER_TEMP/app-store.mobileprovision" "$RUNNER_TEMP/app-store-profile.plist"
+
+  disabled:
+    name: Automation disabled
+    needs: prepare
+    if: needs.prepare.outputs.enabled != 'true'
+    runs-on: ubuntu-24.04
+    steps:
+      - run: echo "App Store automation is disabled; no signing environment or secrets were accessed."

.github/workflows/mobile-artifacts.yml

@@ -1,4 +1,4 @@
-name: Mobile Store Artifacts
+name: Android Store Artifacts
 
 on:
   workflow_dispatch:
@@ -16,11 +16,6 @@ on:
         required: false
         type: boolean
         default: true
-      upload_ios_to_app_store:
-        description: Upload the signed iOS IPA to App Store Connect
-        required: false
-        type: boolean
-        default: true
       android_track:
         description: Google Play track for manual dispatches
         required: false
@@ -54,9 +49,10 @@ on:
 
 permissions:
   contents: read
+  actions: read
 
 concurrency:
-  group: mobile-store-artifacts-${{ github.event.workflow_run.head_branch || github.ref_name || github.run_id }}
+  group: android-store-artifacts-${{ github.event.workflow_run.head_branch || github.ref_name || github.run_id }}
   cancel-in-progress: true
 
 jobs:
@@ -79,55 +75,63 @@ jobs:
       UPLOAD_ANDROID_TO_PLAY: ${{ github.event_name != 'workflow_dispatch' || inputs.upload_android_to_play }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           ref: ${{ github.event.workflow_run.head_sha || github.sha }}
+          persist-credentials: false
 
       - name: Guard current master release
         id: release-guard
         shell: bash
         env:
-          EVENT_NAME: ${{ github.event_name }}
           EXPECTED_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
-          RELEASE_BRANCH: ${{ github.event.workflow_run.head_branch || github.ref_name }}
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           current=true
-          if [[ "$EVENT_NAME" == "workflow_run" ]]; then
-            latest_sha="$(git ls-remote origin "refs/heads/$DEFAULT_BRANCH" | awk '{print $1}')"
-            if [[ -z "$latest_sha" ]]; then
-              echo "Could not resolve origin/$DEFAULT_BRANCH." >&2
-              exit 1
-            fi
-            if [[ "$latest_sha" != "$EXPECTED_SHA" ]]; then
-              current=false
-              echo "Skipping stale mobile upload for $EXPECTED_SHA; origin/$DEFAULT_BRANCH is $latest_sha."
-            else
-              echo "Mobile upload commit is current for $DEFAULT_BRANCH."
-            fi
+          latest_sha="$(curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/git/ref/heads/$DEFAULT_BRANCH" | jq -r '.object.sha // empty')"
+          if [[ ! "$latest_sha" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "Could not resolve origin/$DEFAULT_BRANCH." >&2
+            exit 1
+          fi
+          if [[ "$latest_sha" != "$EXPECTED_SHA" ]]; then
+            current=false
+            echo "Skipping stale mobile upload for $EXPECTED_SHA; origin/$DEFAULT_BRANCH is $latest_sha."
           else
-            echo "Mobile release guard passed for $EVENT_NAME on $RELEASE_BRANCH."
+            echo "Mobile upload commit is the exact current $DEFAULT_BRANCH SHA."
           fi
           echo "current=$current" >> "$GITHUB_OUTPUT"
 
       - name: Setup Node.js
         if: steps.release-guard.outputs.current == 'true'
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 22
           cache: npm
 
+      - name: Require complete Chromium mobile tests
+        if: steps.release-guard.outputs.current == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          STORE_SOURCE_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+          TEST_WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id || '' }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: node scripts/mobile/verify-store-test-gate.mjs --platform android
+
       - name: Setup Java
         if: steps.release-guard.outputs.current == 'true'
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           distribution: temurin
           java-version: 21
 
       - name: Setup Android SDK
         if: steps.release-guard.outputs.current == 'true'
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3
 
       - name: Install Android SDK packages
         if: steps.release-guard.outputs.current == 'true'
@@ -205,7 +209,7 @@ jobs:
 
       - name: Upload Android artifact
         if: steps.release-guard.outputs.current == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: truck-wash-android-${{ env.MOBILE_VERSION_NAME }}-${{ github.event.workflow_run.head_sha || github.sha }}
           path: ${{ env.ANDROID_AAB_PATH }}
@@ -217,268 +221,3 @@ jobs:
         env:
           GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64 }}
         run: npm run mobile:android:play-upload
-
-  ios:
-    name: iOS IPA and App Store upload
-    if: >
-      github.event_name != 'workflow_run' ||
-      (github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.event == 'push' &&
-      github.event.workflow_run.head_branch == github.event.repository.default_branch)
-    runs-on: macos-15
-    environment: mobile-store-production
-    timeout-minutes: 90
-    env:
-      IOS_PROJECT_PATH: ios/App/App.xcodeproj
-      IOS_SCHEME: App
-      IOS_BUNDLE_ID: io.truckwash.app
-      UPLOAD_IOS_TO_APP_STORE: ${{ github.event_name != 'workflow_dispatch' || inputs.upload_ios_to_app_store }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
-        with:
-          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
-
-      - name: Guard current master release
-        id: release-guard
-        shell: bash
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          EXPECTED_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
-          RELEASE_BRANCH: ${{ github.event.workflow_run.head_branch || github.ref_name }}
-          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
-        run: |
-          set -euo pipefail
-          current=true
-          if [[ "$EVENT_NAME" == "workflow_run" ]]; then
-            latest_sha="$(git ls-remote origin "refs/heads/$DEFAULT_BRANCH" | awk '{print $1}')"
-            if [[ -z "$latest_sha" ]]; then
-              echo "Could not resolve origin/$DEFAULT_BRANCH." >&2
-              exit 1
-            fi
-            if [[ "$latest_sha" != "$EXPECTED_SHA" ]]; then
-              current=false
-              echo "Skipping stale mobile upload for $EXPECTED_SHA; origin/$DEFAULT_BRANCH is $latest_sha."
-            else
-              echo "Mobile upload commit is current for $DEFAULT_BRANCH."
-            fi
-          else
-            echo "Mobile release guard passed for $EVENT_NAME on $RELEASE_BRANCH."
-          fi
-          echo "current=$current" >> "$GITHUB_OUTPUT"
-
-      - name: Setup Node.js
-        if: steps.release-guard.outputs.current == 'true'
-        uses: actions/setup-node@v5
-        with:
-          node-version: 22
-          cache: npm
-
-      - name: Resolve mobile version
-        if: steps.release-guard.outputs.current == 'true'
-        shell: bash
-        env:
-          INPUT_VERSION_NAME: ${{ inputs.version_name || '' }}
-          INPUT_VERSION_CODE: ${{ inputs.version_code || '' }}
-        run: |
-          set -euo pipefail
-          version_name="$INPUT_VERSION_NAME"
-          if [[ -z "$version_name" && "$GITHUB_REF_NAME" == mobile-v* ]]; then
-            version_name="${GITHUB_REF_NAME#mobile-v}"
-          fi
-          if [[ -z "$version_name" ]]; then
-            version_name="0.0.${GITHUB_RUN_NUMBER}"
-          fi
-          version_code="${INPUT_VERSION_CODE:-$GITHUB_RUN_NUMBER}"
-          echo "MOBILE_VERSION_NAME=$version_name" >> "$GITHUB_ENV"
-          echo "MOBILE_VERSION_CODE=$version_code" >> "$GITHUB_ENV"
-
-      - name: Check iOS store environment
-        if: steps.release-guard.outputs.current == 'true'
-        env:
-          IOS_CERTIFICATE_BASE64: ${{ secrets.IOS_CERTIFICATE_BASE64 }}
-          IOS_CERTIFICATE_PASSWORD: ${{ secrets.IOS_CERTIFICATE_PASSWORD }}
-          IOS_PROVISION_PROFILE_BASE64: ${{ secrets.IOS_PROVISION_PROFILE_BASE64 }}
-          IOS_KEYCHAIN_PASSWORD: ${{ secrets.IOS_KEYCHAIN_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
-          APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
-          APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64 }}
-        run: node scripts/mobile/check-store-upload-env.mjs --ios
-
-      - name: Install dependencies
-        if: steps.release-guard.outputs.current == 'true'
-        run: npm ci --legacy-peer-deps
-
-      - name: Build and sync iOS shell
-        if: steps.release-guard.outputs.current == 'true'
-        run: |
-          npm run build
-          npx cap sync ios
-          npm run mobile:permissions:check
-
-      - name: Install Apple signing assets
-        if: steps.release-guard.outputs.current == 'true'
-        shell: bash
-        env:
-          IOS_CERTIFICATE_BASE64: ${{ secrets.IOS_CERTIFICATE_BASE64 }}
-          IOS_CERTIFICATE_PASSWORD: ${{ secrets.IOS_CERTIFICATE_PASSWORD }}
-          IOS_PROVISION_PROFILE_BASE64: ${{ secrets.IOS_PROVISION_PROFILE_BASE64 }}
-          IOS_KEYCHAIN_PASSWORD: ${{ secrets.IOS_KEYCHAIN_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-        run: |
-          set -euo pipefail
-          certificate_path="$RUNNER_TEMP/apple-distribution.p12"
-          profile_path="$RUNNER_TEMP/app-store.mobileprovision"
-          keychain_path="$RUNNER_TEMP/app-signing.keychain-db"
-          profile_plist="$RUNNER_TEMP/profile.plist"
-
-          node -e "const fs = require('fs'); fs.writeFileSync(process.argv[1], Buffer.from(process.env.IOS_CERTIFICATE_BASE64, 'base64'))" "$certificate_path"
-          node -e "const fs = require('fs'); fs.writeFileSync(process.argv[1], Buffer.from(process.env.IOS_PROVISION_PROFILE_BASE64, 'base64'))" "$profile_path"
-
-          security create-keychain -p "$IOS_KEYCHAIN_PASSWORD" "$keychain_path"
-          security set-keychain-settings -lut 21600 "$keychain_path"
-          security unlock-keychain -p "$IOS_KEYCHAIN_PASSWORD" "$keychain_path"
-          security import "$certificate_path" -P "$IOS_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain_path"
-          security list-keychain -d user -s "$keychain_path" $(security list-keychains -d user | tr -d '"')
-          security set-key-partition-list -S apple-tool:,apple: -s -k "$IOS_KEYCHAIN_PASSWORD" "$keychain_path"
-
-          mkdir -p "$HOME/Library/MobileDevice/Provisioning Profiles"
-          security cms -D -i "$profile_path" > "$profile_plist"
-          profile_uuid="$(/usr/libexec/PlistBuddy -c 'Print UUID' "$profile_plist")"
-          profile_name="$(/usr/libexec/PlistBuddy -c 'Print Name' "$profile_plist")"
-          cp "$profile_path" "$HOME/Library/MobileDevice/Provisioning Profiles/$profile_uuid.mobileprovision"
-
-          echo "APPLE_TEAM_ID=$APPLE_TEAM_ID" >> "$GITHUB_ENV"
-          echo "IOS_KEYCHAIN_PATH=$keychain_path" >> "$GITHUB_ENV"
-          echo "IOS_PROFILE_UUID=$profile_uuid" >> "$GITHUB_ENV"
-          echo "IOS_PROFILE_NAME=$profile_name" >> "$GITHUB_ENV"
-
-      - name: Install App Store Connect API key
-        if: steps.release-guard.outputs.current == 'true' && env.UPLOAD_IOS_TO_APP_STORE == 'true'
-        shell: bash
-        env:
-          APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
-          APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
-          APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64 }}
-        run: |
-          set -euo pipefail
-          private_keys_dir="$RUNNER_TEMP/private_keys"
-          private_key_path="$private_keys_dir/AuthKey_${APP_STORE_CONNECT_API_KEY_ID}.p8"
-          mkdir -p "$private_keys_dir"
-          node -e "const fs = require('fs'); fs.writeFileSync(process.argv[1], Buffer.from(process.env.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64, 'base64'))" "$private_key_path"
-          chmod 600 "$private_key_path"
-          echo "API_PRIVATE_KEYS_DIR=$private_keys_dir" >> "$GITHUB_ENV"
-          echo "APP_STORE_CONNECT_API_KEY_ID=$APP_STORE_CONNECT_API_KEY_ID" >> "$GITHUB_ENV"
-          echo "APP_STORE_CONNECT_ISSUER_ID=$APP_STORE_CONNECT_ISSUER_ID" >> "$GITHUB_ENV"
-          echo "APP_STORE_CONNECT_API_KEY_PATH=$private_key_path" >> "$GITHUB_ENV"
-
-      - name: Resolve Swift packages
-        if: steps.release-guard.outputs.current == 'true'
-        run: xcodebuild -resolvePackageDependencies -project "$IOS_PROJECT_PATH" -scheme "$IOS_SCHEME"
-
-      - name: Archive iOS app
-        if: steps.release-guard.outputs.current == 'true'
-        run: |
-          xcodebuild \
-            -project "$IOS_PROJECT_PATH" \
-            -scheme "$IOS_SCHEME" \
-            -configuration Release \
-            -destination "generic/platform=iOS" \
-            -archivePath "$RUNNER_TEMP/TruckWash.xcarchive" \
-            archive \
-            DEVELOPMENT_TEAM="$APPLE_TEAM_ID" \
-            CODE_SIGN_STYLE=Manual \
-            CODE_SIGN_IDENTITY="Apple Distribution" \
-            PROVISIONING_PROFILE_SPECIFIER="$IOS_PROFILE_NAME" \
-            MARKETING_VERSION="$MOBILE_VERSION_NAME" \
-            CURRENT_PROJECT_VERSION="$MOBILE_VERSION_CODE"
-
-      - name: Export iOS IPA
-        if: steps.release-guard.outputs.current == 'true'
-        shell: bash
-        run: |
-          set -euo pipefail
-          export_method="app-store-connect"
-          if ! xcodebuild -help 2>&1 | grep -q "app-store-connect"; then
-            export_method="app-store"
-          fi
-          export_options="$RUNNER_TEMP/ExportOptions.plist"
-          cat > "$export_options" <<EOF
-          <?xml version="1.0" encoding="UTF-8"?>
-          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-          <plist version="1.0">
-          <dict>
-            <key>method</key>
-            <string>$export_method</string>
-            <key>signingStyle</key>
-            <string>manual</string>
-            <key>teamID</key>
-            <string>$APPLE_TEAM_ID</string>
-            <key>provisioningProfiles</key>
-            <dict>
-              <key>$IOS_BUNDLE_ID</key>
-              <string>$IOS_PROFILE_NAME</string>
-            </dict>
-            <key>stripSwiftSymbols</key>
-            <true/>
-            <key>manageAppVersionAndBuildNumber</key>
-            <false/>
-          </dict>
-          </plist>
-          EOF
-          xcodebuild \
-            -exportArchive \
-            -archivePath "$RUNNER_TEMP/TruckWash.xcarchive" \
-            -exportPath "$RUNNER_TEMP/ios-export" \
-            -exportOptionsPlist "$export_options"
-          ipa_path="$(find "$RUNNER_TEMP/ios-export" -name '*.ipa' -print -quit)"
-          test -n "$ipa_path"
-          echo "IOS_IPA_PATH=$ipa_path" >> "$GITHUB_ENV"
-
-      - name: Upload iOS artifact
-        if: steps.release-guard.outputs.current == 'true'
-        uses: actions/upload-artifact@v4
-        with:
-          name: truck-wash-ios-${{ env.MOBILE_VERSION_NAME }}-${{ github.event.workflow_run.head_sha || github.sha }}
-          path: ${{ runner.temp }}/ios-export/*.ipa
-          if-no-files-found: error
-          retention-days: 14
-
-      - name: Validate iOS IPA with App Store Connect
-        if: steps.release-guard.outputs.current == 'true' && env.UPLOAD_IOS_TO_APP_STORE == 'true'
-        shell: bash
-        run: |
-          set -euo pipefail
-          xcrun altool \
-            --validate-app \
-            --type ios \
-            --file "$IOS_IPA_PATH" \
-            --apiKey "$APP_STORE_CONNECT_API_KEY_ID" \
-            --apiIssuer "$APP_STORE_CONNECT_ISSUER_ID"
-
-      - name: Upload iOS IPA to App Store Connect
-        if: steps.release-guard.outputs.current == 'true' && env.UPLOAD_IOS_TO_APP_STORE == 'true'
-        shell: bash
-        run: |
-          set -euo pipefail
-          xcrun altool \
-            --upload-app \
-            --type ios \
-            --file "$IOS_IPA_PATH" \
-            --apiKey "$APP_STORE_CONNECT_API_KEY_ID" \
-            --apiIssuer "$APP_STORE_CONNECT_ISSUER_ID"
-
-      - name: Clean up Apple signing assets
-        if: always()
-        shell: bash
-        run: |
-          if [[ -n "${IOS_KEYCHAIN_PATH:-}" ]]; then
-            security delete-keychain "$IOS_KEYCHAIN_PATH" || true
-          fi
-          if [[ -n "${IOS_PROFILE_UUID:-}" ]]; then
-            rm -f "$HOME/Library/MobileDevice/Provisioning Profiles/$IOS_PROFILE_UUID.mobileprovision"
-          fi
-          if [[ -n "${APP_STORE_CONNECT_API_KEY_PATH:-}" ]]; then
-            rm -f "$APP_STORE_CONNECT_API_KEY_PATH"
-          fi

.github/workflows/release.yml

@@ -24,7 +24,7 @@ jobs:
       github.event.workflow_run.event == 'push' &&
       github.event.workflow_run.head_branch == 'master' &&
       github.event.workflow_run.head_repository.full_name == github.repository
-    runs-on: [self-hosted, Linux, X64, default]
+    runs-on: ubuntu-24.04
     env:
       RELEASE_COMMIT_SHA: ${{ github.event.workflow_run.head_sha }}
       RELEASE_EXPECTED_COMMIT: ${{ github.event.workflow_run.head_sha }}
@@ -40,7 +40,7 @@ jobs:
     steps:
       - name: Check release commit is current
         id: branch-head
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           github-token: ${{ github.token }}
           script: |
@@ -60,7 +60,7 @@ jobs:
 
       - name: Checkout tested commit
         if: steps.branch-head.outputs.current == 'true'
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -68,7 +68,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.branch-head.outputs.current == 'true'
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 22
           cache: npm
@@ -147,7 +147,7 @@ jobs:
 
       - name: Upload release package
         if: steps.branch-head.outputs.current == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: ${{ steps.package-names.outputs.artifact_name }}
           path: |
@@ -160,7 +160,7 @@ jobs:
   deploy-frontend-production:
     needs: build-release
     if: needs.build-release.outputs.current == 'true'
-    runs-on: [self-hosted, Linux, X64, default]
+    runs-on: ubuntu-24.04
     timeout-minutes: 90
     environment:
       name: frontend-production
@@ -183,14 +183,14 @@ jobs:
       RELEASE_POLL_INTERVAL_SECONDS: 5
     steps:
       - name: Checkout tested commit
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           fetch-depth: 0
           persist-credentials: false
           ref: ${{ env.RELEASE_COMMIT_SHA }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 22
           cache: npm
@@ -217,7 +217,7 @@ jobs:
         run: node scripts/install-playwright-browsers.mjs chromium
 
       - name: Download validated release package
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: ${{ needs.build-release.outputs.artifact_name }}
           path: release-artifacts
@@ -243,7 +243,7 @@ jobs:
 
       - name: Check release commit is still current
         id: branch-head
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           github-token: ${{ github.token }}
           script: |
@@ -272,6 +272,7 @@ jobs:
           PRODUCTION_FTP_USER: ${{ secrets.PRODUCTION_FTP_USER }}
           PRODUCTION_FTP_PASSWORD: ${{ secrets.PRODUCTION_FTP_PASSWORD }}
           PRODUCTION_FTP_PATH: ${{ secrets.PRODUCTION_FTP_PATH }}
+          PRODUCTION_ACTIVATION_KEY: ${{ secrets.PRODUCTION_ACTIVATION_KEY }}
           PRODUCTION_CPANEL_USER: ${{ secrets.PRODUCTION_CPANEL_USER }}
           PRODUCTION_CPANEL_API_TOKEN: ${{ secrets.PRODUCTION_CPANEL_API_TOKEN }}
           PRODUCTION_CPANEL_API_URL: ${{ vars.PRODUCTION_CPANEL_API_URL }}
@@ -312,6 +313,7 @@ jobs:
           PRODUCTION_FTP_USER: ${{ secrets.PRODUCTION_FTP_USER }}
           PRODUCTION_FTP_PASSWORD: ${{ secrets.PRODUCTION_FTP_PASSWORD }}
           PRODUCTION_FTP_PATH: ${{ secrets.PRODUCTION_FTP_PATH }}
+          PRODUCTION_ACTIVATION_KEY: ${{ secrets.PRODUCTION_ACTIVATION_KEY }}
           PRODUCTION_CPANEL_USER: ${{ secrets.PRODUCTION_CPANEL_USER }}
           PRODUCTION_CPANEL_API_TOKEN: ${{ secrets.PRODUCTION_CPANEL_API_TOKEN }}
           PRODUCTION_CPANEL_API_URL: ${{ vars.PRODUCTION_CPANEL_API_URL }}
@@ -341,10 +343,51 @@ jobs:
           SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }}
           RELEASE_VERSION: ${{ github.event.workflow_run.head_sha }}
 
+      - name: Create verified frontend release proof
+        if: steps.branch-head.outputs.current == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          proof_dir="output/frontend-release-proof"
+          mkdir -p "$proof_dir"
+          PROOF_PATH="$proof_dir/frontend-release-proof.json" node <<'NODE'
+          const { writeFileSync } = require("node:fs");
+          const required = (name) => {
+            if (!process.env[name]) throw new Error(`Missing ${name}`);
+            return process.env[name];
+          };
+          const proof = {
+            schemaVersion: 1,
+            repository: required("GITHUB_REPOSITORY"),
+            sourceSha: required("RELEASE_COMMIT_SHA").toLowerCase(),
+            testedWorkflowRunId: required("TESTED_WORKFLOW_RUN_ID"),
+            frontendReleaseRunId: required("GITHUB_RUN_ID"),
+            frontendReleaseRunAttempt: required("GITHUB_RUN_ATTEMPT"),
+            buildId: required("RELEASE_BUILD_ID"),
+            livePublicGate: "passed",
+            liveCredentialedGate: "passed",
+            releaseManagerGate: "passed",
+            serverVersionUpdated: true,
+            completedAt: new Date().toISOString(),
+          };
+          writeFileSync(process.env.PROOF_PATH, `${JSON.stringify(proof, null, 2)}\n`, { mode: 0o600 });
+          NODE
+        env:
+          TESTED_WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }}
+
+      - name: Publish verified frontend release proof
+        if: steps.branch-head.outputs.current == 'true'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: frontend-release-proof-${{ env.RELEASE_COMMIT_SHA }}
+          path: output/frontend-release-proof/frontend-release-proof.json
+          if-no-files-found: error
+          retention-days: 30
+
       - name: Upload Playwright report
         if: failure() && steps.branch-head.outputs.current == 'true'
         continue-on-error: true
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: frontend-release-playwright-${{ env.RELEASE_BUILD_ID }}
           path: output/playwright

.github/workflows/test-graph-node.yml

@@ -0,0 +1,84 @@
+name: Dependency Graph Node
+
+on:
+  workflow_call:
+    inputs:
+      node:
+        description: Stable test-graph node identifier.
+        required: true
+        type: string
+      lane:
+        description: Contract or Playwright project lane.
+        required: true
+        type: string
+      partitions:
+        description: JSON array of one-based partition numbers.
+        required: false
+        default: "[1]"
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: ${{ inputs.node }} / ${{ inputs.lane }} / ${{ matrix.partition }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    container:
+      image: mcr.microsoft.com/playwright:v1.58.2-noble
+    strategy:
+      fail-fast: false
+      max-parallel: 100
+      matrix:
+        partition: ${{ fromJSON(inputs.partitions) }}
+    env:
+      CI: "true"
+      PLAYWRIGHT_ARTIFACT_NAMESPACE: graph-${{ inputs.node }}-${{ inputs.lane }}-${{ matrix.partition }}
+      PLAYWRIGHT_REPORTER_MODE: line-html
+      PLAYWRIGHT_VIDEO_MODE: off
+      PLAYWRIGHT_WORKERS: 3
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci --legacy-peer-deps
+
+      - name: Run dependency graph node
+        run: >-
+          node scripts/test-graph/run-node-tests.mjs
+          --node "${{ inputs.node }}"
+          --lane "${{ inputs.lane }}"
+          --partition "${{ matrix.partition }}"
+          --partitions "${{ strategy.job-total }}"
+
+      - name: Upload dependency graph result
+        if: always()
+        continue-on-error: true
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-graph-result-${{ inputs.node }}-${{ inputs.lane }}-${{ matrix.partition }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: output/test-graph-results
+          if-no-files-found: warn
+          retention-days: 3
+
+      - name: Upload failure diagnostics
+        if: failure() || cancelled()
+        continue-on-error: true
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-graph-${{ inputs.node }}-${{ inputs.lane }}-${{ matrix.partition }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            output/playwright/${{ env.PLAYWRIGHT_ARTIFACT_NAMESPACE }}
+            output/playwright/${{ env.PLAYWRIGHT_ARTIFACT_NAMESPACE }}-*
+          if-no-files-found: ignore
+          retention-days: 3

Gemfile

@@ -0,0 +1,4 @@
+source "https://rubygems.org"
+
+ruby ">= 3.2", "< 3.5"
+gem "fastlane", "2.229.1"

Gemfile.lock

@@ -0,0 +1,235 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    CFPropertyList (3.0.8)
+    abbrev (0.1.2)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
+    artifactory (3.0.17)
+    atomos (0.1.3)
+    aws-eventstream (1.4.0)
+    aws-partitions (1.1271.0)
+    aws-sdk-core (3.254.0)
+      aws-eventstream (~> 1, >= 1.3.0)
+      aws-partitions (~> 1, >= 1.992.0)
+      aws-sigv4 (~> 1.9)
+      base64
+      bigdecimal
+      jmespath (~> 1, >= 1.6.1)
+      logger
+    aws-sdk-kms (1.130.0)
+      aws-sdk-core (~> 3, >= 3.254.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-s3 (1.228.0)
+      aws-sdk-core (~> 3, >= 3.254.0)
+      aws-sdk-kms (~> 1)
+      aws-sigv4 (~> 1.5)
+    aws-sigv4 (1.12.1)
+      aws-eventstream (~> 1, >= 1.0.2)
+    babosa (1.0.4)
+    base64 (0.2.0)
+    bigdecimal (4.1.2)
+    claide (1.1.0)
+    colored (1.2)
+    colored2 (3.1.2)
+    commander (4.6.0)
+      highline (~> 2.0.0)
+    csv (3.3.5)
+    declarative (0.0.20)
+    digest-crc (0.7.0)
+      rake (>= 12.0.0, < 14.0.0)
+    domain_name (0.6.20240107)
+    dotenv (2.8.1)
+    emoji_regex (3.2.3)
+    excon (0.112.0)
+    faraday (1.10.6)
+      faraday-em_http (~> 1.0)
+      faraday-em_synchrony (~> 1.0)
+      faraday-excon (~> 1.1)
+      faraday-httpclient (~> 1.0)
+      faraday-multipart (~> 1.0)
+      faraday-net_http (~> 1.0)
+      faraday-net_http_persistent (~> 1.0)
+      faraday-patron (~> 1.0)
+      faraday-rack (~> 1.0)
+      faraday-retry (~> 1.0)
+      ruby2_keywords (>= 0.0.4)
+    faraday-cookie_jar (0.0.8)
+      faraday (>= 0.8.0)
+      http-cookie (>= 1.0.0)
+    faraday-em_http (1.0.0)
+    faraday-em_synchrony (1.0.1)
+    faraday-excon (1.1.0)
+    faraday-httpclient (1.0.1)
+    faraday-multipart (1.2.0)
+      multipart-post (~> 2.0)
+    faraday-net_http (1.0.2)
+    faraday-net_http_persistent (1.2.0)
+    faraday-patron (1.0.0)
+    faraday-rack (1.0.0)
+    faraday-retry (1.0.4)
+    faraday_middleware (1.2.1)
+      faraday (~> 1.0)
+    fastimage (2.4.1)
+    fastlane (2.229.1)
+      CFPropertyList (>= 2.3, < 4.0.0)
+      abbrev (~> 0.1.2)
+      addressable (>= 2.8, < 3.0.0)
+      artifactory (~> 3.0)
+      aws-sdk-s3 (~> 1.0)
+      babosa (>= 1.0.3, < 2.0.0)
+      base64 (~> 0.2.0)
+      bundler (>= 1.12.0, < 3.0.0)
+      colored (~> 1.2)
+      commander (~> 4.6)
+      csv (~> 3.3)
+      dotenv (>= 2.1.1, < 3.0.0)
+      emoji_regex (>= 0.1, < 4.0)
+      excon (>= 0.71.0, < 1.0.0)
+      faraday (~> 1.0)
+      faraday-cookie_jar (~> 0.0.6)
+      faraday_middleware (~> 1.0)
+      fastimage (>= 2.1.0, < 3.0.0)
+      fastlane-sirp (>= 1.0.0)
+      gh_inspector (>= 1.1.2, < 2.0.0)
+      google-apis-androidpublisher_v3 (~> 0.3)
+      google-apis-playcustomapp_v1 (~> 0.1)
+      google-cloud-env (>= 1.6.0, < 2.0.0)
+      google-cloud-storage (~> 1.31)
+      highline (~> 2.0)
+      http-cookie (~> 1.0.5)
+      json (< 3.0.0)
+      jwt (>= 2.1.0, < 3)
+      mini_magick (>= 4.9.4, < 5.0.0)
+      multipart-post (>= 2.0.0, < 3.0.0)
+      mutex_m (~> 0.3.0)
+      naturally (~> 2.2)
+      nkf (~> 0.2.0)
+      optparse (>= 0.1.1, < 1.0.0)
+      plist (>= 3.1.0, < 4.0.0)
+      rubyzip (>= 2.0.0, < 3.0.0)
+      security (= 0.1.5)
+      simctl (~> 1.6.3)
+      terminal-notifier (>= 2.0.0, < 3.0.0)
+      terminal-table (~> 3)
+      tty-screen (>= 0.6.3, < 1.0.0)
+      tty-spinner (>= 0.8.0, < 1.0.0)
+      word_wrap (~> 1.0.0)
+      xcodeproj (>= 1.13.0, < 2.0.0)
+      xcpretty (~> 0.4.1)
+      xcpretty-travis-formatter (>= 0.0.3, < 2.0.0)
+    fastlane-sirp (1.1.0)
+    gh_inspector (1.1.3)
+    google-apis-androidpublisher_v3 (0.54.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-apis-core (0.11.3)
+      addressable (~> 2.5, >= 2.5.1)
+      googleauth (>= 0.16.2, < 2.a)
+      httpclient (>= 2.8.1, < 3.a)
+      mini_mime (~> 1.0)
+      representable (~> 3.0)
+      retriable (>= 2.0, < 4.a)
+      rexml
+    google-apis-iamcredentials_v1 (0.17.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-apis-playcustomapp_v1 (0.13.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-apis-storage_v1 (0.31.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-cloud-core (1.9.0)
+      google-cloud-env (>= 1.0, < 3.a)
+      google-cloud-errors (~> 1.0)
+    google-cloud-env (1.6.0)
+      faraday (>= 0.17.3, < 3.0)
+    google-cloud-errors (1.7.0)
+    google-cloud-storage (1.47.0)
+      addressable (~> 2.8)
+      digest-crc (~> 0.4)
+      google-apis-iamcredentials_v1 (~> 0.1)
+      google-apis-storage_v1 (~> 0.31.0)
+      google-cloud-core (~> 1.6)
+      googleauth (>= 0.16.2, < 2.a)
+      mini_mime (~> 1.0)
+    googleauth (1.8.1)
+      faraday (>= 0.17.3, < 3.a)
+      jwt (>= 1.4, < 3.0)
+      multi_json (~> 1.11)
+      os (>= 0.9, < 2.0)
+      signet (>= 0.16, < 2.a)
+    highline (2.0.3)
+    http-cookie (1.0.8)
+      domain_name (~> 0.5)
+    httpclient (2.9.0)
+      mutex_m
+    jmespath (1.6.2)
+    json (2.21.1)
+    jwt (2.10.3)
+      base64
+    logger (1.7.0)
+    mini_magick (4.13.2)
+    mini_mime (1.1.5)
+    multi_json (1.21.1)
+    multipart-post (2.4.1)
+    mutex_m (0.3.0)
+    nanaimo (0.4.0)
+    naturally (2.3.0)
+    nkf (0.2.0)
+    optparse (0.8.1)
+    os (1.1.4)
+    plist (3.7.2)
+    public_suffix (7.0.5)
+    rake (13.4.2)
+    representable (3.2.0)
+      declarative (< 0.1.0)
+      trailblazer-option (>= 0.1.1, < 0.2.0)
+      uber (< 0.2.0)
+    retriable (3.8.0)
+    rexml (3.4.4)
+    rouge (3.28.0)
+    ruby2_keywords (0.0.5)
+    rubyzip (2.4.1)
+    security (0.1.5)
+    signet (0.22.0)
+      addressable (~> 2.8)
+      faraday (>= 0.17.5, < 3.a)
+      jwt (>= 1.5, < 4.0)
+    simctl (1.6.10)
+      CFPropertyList
+      naturally
+    terminal-notifier (2.0.0)
+    terminal-table (3.0.2)
+      unicode-display_width (>= 1.1.1, < 3)
+    trailblazer-option (0.1.2)
+    tty-cursor (0.7.1)
+    tty-screen (0.8.2)
+    tty-spinner (0.9.3)
+      tty-cursor (~> 0.7)
+    uber (0.1.0)
+    unicode-display_width (2.6.0)
+    word_wrap (1.0.0)
+    xcodeproj (1.28.1)
+      CFPropertyList (>= 2.3.3, < 4.0)
+      atomos (~> 0.1.3)
+      base64
+      claide (>= 1.0.2, < 2.0)
+      colored2 (~> 3.1)
+      nanaimo (~> 0.4.0)
+      nkf
+      rexml (>= 3.3.6, < 4.0)
+    xcpretty (0.4.1)
+      rouge (~> 3.28.0)
+    xcpretty-travis-formatter (1.0.1)
+      xcpretty (~> 0.2, >= 0.0.7)
+
+PLATFORMS
+  ruby
+  x86_64-linux
+
+DEPENDENCIES
+  fastlane (= 2.229.1)
+
+RUBY VERSION
+   ruby 3.3.12p206
+
+BUNDLED WITH
+   2.5.22

README.md

@@ -170,10 +170,11 @@ The Play Store Android package is built from the Capacitor project in `android/`
 The legacy Bubblewrap/TWA project at the repository root is not used by
 `npm run mobile:android:bundle`.
 
-The source image for the native launcher icon is:
+The native launcher and store icons use the opaque iOS marketing icon as their
+shared master so Android and iOS keep the same white background:
 
 ```text
-public/favicons/web-app-manifest-512x512.png
+ios/App/App/Assets.xcassets/AppIcon.appiconset/AppIcon-1024.png
 ```
 
 Regenerate the checked-in launcher assets after changing that source image:

android/app/src/main/res/values/ic_launcher_background.xml

@@ -1,4 +1,4 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
-    <color name="ic_launcher_background">#0787BB</color>
+    <color name="ic_launcher_background">#FFFFFF</color>
 </resources>

docs/app-store-release.md

@@ -1,102 +1,203 @@
 # Apple App Store Release Runbook
 
-This runbook covers the public iOS App Store release path for the Truck Wash
-Capacitor app.
+This is the operating runbook for the public iOS application and its signed
+GitHub Actions delivery. Public review submission and public release remain
+human actions in App Store Connect.
 
-## Account And App Record
+## Storefront record
 
-- Use the Truck Wash ApS Apple Developer account. The Account Holder must accept
-  the latest Apple agreements before builds can be uploaded.
-- Create or verify the App Store Connect app record:
-  - Platform: iOS
-  - Name: Truck Wash Kundeportal
-  - Bundle ID: `io.truckwash.app`
-  - SKU: `truckwash-ios`
-  - Primary language: Danish
-  - Category: Business
-  - Price: Free
-  - Initial availability: Denmark
-- Keep the GitHub environment `mobile-store-production` configured with the
-  iOS signing, App Store Connect, Android signing, and Google Play upload
-  secrets used by the mobile workflow.
+Create or reconcile one App Store Connect record:
 
-## Build And Upload
+| Setting | Value |
+| --- | --- |
+| Name | Truck Wash Kundeportal |
+| Bundle ID | `io.truckwash.app` |
+| SKU | `truckwash-ios` |
+| Primary language | Danish |
+| Category | Business |
+| Price | Free |
+| Availability | Denmark only |
+| Support URL | `https://truckwash.io/support` |
+| Privacy URL | `https://truckwash.io/privacy-policy` |
+| Marketing URL | `https://truckwash.io/` |
+| Release | Manual after approval |
 
-1. Merge the release commit to `master`.
-2. Confirm `Automated Tests` and `Frontend Release` are green for that commit.
-3. Create a release tag such as `mobile-v1.0.0`.
-4. The `Mobile Store Artifacts` workflow builds Android and iOS artifacts from
-   the tested commit. By default it uploads Android to the Google Play
-   production track and uploads the iOS IPA to App Store Connect.
-5. For a manual upload, dispatch `Mobile Store Artifacts` with `version_name`
-   and `version_code`. Leave `upload_ios_to_app_store` enabled for the iOS
-   upload, or disable it to produce only the signed GitHub artifact.
+Use the standard Apple EULA and do not configure in-app purchases. Payments in
+the product cover physical truck-wash services. Keep iPhone and iPad enabled;
+disable Apple-silicon Mac and Vision Pro compatibility until those targets have
+been tested deliberately.
 
-The same workflow also runs automatically after a successful `Automated Tests`
-run on current `master`. It skips stale workflow-run commits if `master` has
-advanced before the mobile jobs start.
+The Account Holder or Admin must complete these console-only items before the
+first candidate:
 
-The iOS workflow expects these environment secrets:
+- Accept current Apple developer and business agreements.
+- Verify Truck Wash ApS's EU Digital Services Act trader identity and contact
+  information.
+- Complete the current age-rating questionnaire. Do not hard-code an expected
+  rating in automation.
+- Approve the privacy data matrix and enter matching App Privacy answers,
+  including third-party SDK behavior.
+- Decide export compliance after reviewing the final binary. Only add
+  `ITSAppUsesNonExemptEncryption=false` when the exempt determination is
+  approved.
+- Complete accessibility declarations only for behavior verified on devices.
+- Store a durable, sanitized review account in App Store Connect. Never commit
+  its password, OTP seed, or recovery data.
 
-- `IOS_CERTIFICATE_BASE64`
-- `IOS_CERTIFICATE_PASSWORD`
-- `IOS_PROVISION_PROFILE_BASE64`
-- `IOS_KEYCHAIN_PASSWORD`
-- `APPLE_TEAM_ID`
-- `APP_STORE_CONNECT_API_KEY_ID`
-- `APP_STORE_CONNECT_ISSUER_ID`
+Review notes must explain customer and driver login, the review account's 2FA
+path, QR/hardware behavior, camera/location denial fallbacks, and the physical
+service payment model.
+
+## Metadata and assets in Git
+
+`fastlane/metadata/da-DK/` is the Danish storefront source of truth.
+`ios/release.json` is the release-version source of truth. Its version is
+numeric `X.Y.Z`; its bundle ID must remain `io.truckwash.app`.
+
+Run the readiness validation locally:
+
+```sh
+npm run mobile:ios:storefront:check
+```
+
+Readiness mode validates all present assets and reports missing screenshot sets
+as warnings. A candidate tag runs strict mode and requires exactly six reviewed
+images in each set:
+
+- `fastlane/screenshots/da-DK/iphone-6.9-01-*.png` through `06`, 1320×2868.
+- `fastlane/screenshots/da-DK/ipad-13-01-*.png` through `06`, 2064×2752.
+
+Use Xcode 26 simulators and the real Capacitor app. Capture dashboard, booking,
+self-wash/QR, vehicles, orders/history, and invoices. Screenshots must contain
+sanitized fixture data, no alpha channel, no real customer data, and no
+placeholder content. Linux CI cannot honestly synthesize authenticated native
+captures; capture and approve them on a controlled macOS machine before tagging.
+
+The validator also rejects the known default Capacitor icon and splash artwork.
+Native permission strings must exist in Danish and English and are included via
+the `InfoPlist.strings` Xcode variant group.
+
+## Apple identities and GitHub configuration
+
+Create:
+
+1. A dedicated App Store Connect team API key named `GitHub App Store CI` with
+   the App Manager role. Team JWTs use the account issuer ID in the `iss` claim.
+2. A dedicated Apple Distribution certificate for CI.
+3. An App Store distribution provisioning profile for `io.truckwash.app`.
+4. An internal TestFlight group named `Internal QA` with automatic distribution.
+
+Configure two GitHub environments:
+
+- `app-store-signing`, branch policy limited to protected `master`.
+- `app-store-candidate`, tag policy limited to protected `ios-v*` tags.
+
+Private repositories on the Team plan cannot rely on environment required
+reviewers. Protect `ios-v*` creation/update/deletion with a repository ruleset
+limited to release managers. Manual App Review submission is the final human
+approval.
+
+Environment secrets:
+
+- `IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64`
+- `IOS_DISTRIBUTION_CERTIFICATE_PASSWORD`
+- `IOS_APP_STORE_PROFILE_BASE64`
 - `APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64`
 
-The workflow installs the signing certificate and provisioning profile in a
-temporary keychain on the `macos-15` runner, archives the Capacitor Xcode
-project, exports an App Store IPA, validates it with `xcrun altool`, uploads it
-with the App Store Connect API key, and removes temporary signing assets in the
-cleanup step.
+Environment variables:
 
-## Product Page Defaults
+- `APPLE_TEAM_ID=HP3FJ4GVL7`
+- `IOS_BUNDLE_ID=io.truckwash.app`
+- `IOS_SCHEME=App`
+- `IOS_PROJECT=ios/App/App.xcodeproj`
+- `APP_STORE_CONNECT_API_KEY_ID`
+- `APP_STORE_CONNECT_APP_ID` (Apple's numeric app resource ID)
+- `TESTFLIGHT_INTERNAL_GROUP_ID` (Apple's beta-group resource ID)
+- `APP_STORE_CONNECT_ISSUER_ID=074cc671-edc3-403d-b85f-98470f3b16bd`
 
-- Support URL: `https://truckwash.io/support`
-- Privacy URL: `https://truckwash.io/privacy-policy`
-- Subtitle: `Book og start truckvask`
-- Promotional text: `Administrer vask, koeretoejer, ordrer og fakturaer fra mobilen.`
-- Keywords: `truck wash,lastbilvask,vask,booking,kundeportal`
-- Expected age rating: 4+, subject to the App Store Connect questionnaire.
+The repository variable `APP_STORE_AUTOMATION_ENABLED` is the authoritative
+activation switch. Missing or any value other than `true` makes all signing,
+credential-health, and candidate workflows succeed as safe no-ops without
+selecting an App Store environment or reading Apple secrets.
 
-Use real iOS simulator or device screenshots. Provide at least:
+## Enablement and first canary
 
-- iPhone 6.9-inch portrait screenshots
-- iPad 13-inch portrait screenshots
+Keep `APP_STORE_AUTOMATION_ENABLED=false` while configuring Apple/GitHub state.
+Then:
 
-Recommended screenshot scenes: dashboard, booking flow, self-service wash start,
-vehicles/orders, and invoices/payment history. Do not include real customer
-data, private tokens, or placeholder copy.
+1. Merge all product-readiness work and confirm `App Store Readiness` passes.
+   After its first successful default-branch run, add that job to the protected
+   master ruleset's required status checks.
+2. Verify the privacy policy, account-deletion flow, icons, localized permission
+   copy, and privacy manifest on a device.
+3. Set the repository switch to `true` during a controlled release window.
+4. Dispatch `iOS Internal TestFlight` from the `master` workflow definition,
+   supplying the full current master SHA and confirmation
+   `UPLOAD IOS INTERNAL BUILD`.
+5. Confirm the workflow validates Xcode 26.3/iOS 26, certificate/profile
+   identity and expiry, the signed IPA, App Store processing, and exact Internal
+   QA assignment.
+6. Install the result on a clean supported iPhone and iPad. Verify fresh install,
+   upgrade, login, resume, offline/reconnect, permission allow/deny, booking,
+   self-wash/QR, vehicles, orders, invoices, support/privacy, and account
+   deletion.
+7. Leave the switch enabled only after the canary is accepted.
 
-## Privacy And Review Notes
+If the first live credential attempt fails, set the repository switch back to
+`false` before investigating. This avoids red master releases while credentials
+are incomplete.
 
-App Store Connect privacy labels must match the actual app and backend behavior.
-Expected minimum disclosures include account/contact data, identifiers such as
-customer number, vehicle/license plate data, order and invoice history, payment
-state, approximate/precise location when used, and photos or attachments when
-users upload them. Tracking should remain false unless analytics/ad tracking is
-introduced.
+## Continuous TestFlight delivery
 
-Review notes must include:
+`Frontend Release` publishes a signed-by-CI evidence artifact only after the
+production deployment, public live gate, credentialed live gate, Release
+Manager gate, and server-version update all pass for current `master`.
 
-- A demo account and password.
-- OTP/2FA/passkey fallback instructions when enabled for the account.
-- A clear statement that Stripe/card payments are for physical truck-wash
-  services consumed outside the app, so Apple in-app purchase is not used.
-- Any hardware-dependent functionality that reviewers cannot reproduce, with a
-  short demo video if needed.
-- Confirmation that the backend environment is online for the whole review
-  window.
+`iOS Internal TestFlight` consumes that exact proof. It refuses a stale SHA,
+uses `/Applications/Xcode_26.3.app`, requires an iOS 26 SDK, queries App Store
+Connect for the next build number under serialized concurrency, signs and
+inspects the IPA, uploads through pinned Fastlane, waits for processing, and
+idempotently assigns the exact build to Internal QA.
 
-## TestFlight And Release
+Outputs include:
 
-1. Wait for App Store Connect processing to finish.
-2. Distribute the processed build to internal TestFlight testers.
-3. Run clean-device QA on iPhone and iPad.
-4. Fix issues using the same marketing version and an incremented build number.
-5. Submit for App Review with manual release after approval.
-6. After approval, release to Denmark first and monitor crashes, support mail,
-   and App Store Connect feedback before expanding availability.
+- Signed IPA, retained for 30 days.
+- dSYMs, SHA-256 checksums, and `ios-release-manifest.json`, retained for 90
+  days.
+- Source SHA, marketing/build versions, App Store build ID, Xcode/SDK versions,
+  and workflow identity in the manifest.
+
+Every successful future Frontend Release for current `master` triggers this
+delivery automatically. Stale or proofless releases do not sign or upload.
+
+## Select a public candidate
+
+1. Verify the desired TestFlight build on iPhone and iPad.
+2. Confirm its commit's `ios/release.json` contains the public version.
+3. Create a new protected tag such as `ios-v1.0.0` on that exact commit. Never
+   move or reuse an existing release tag.
+4. `iOS App Store Candidate` locates the release manifest for that exact SHA,
+   verifies the exact processed App Store build, enforces complete screenshots,
+   synchronizes Danish metadata, attaches the existing build, and reads it back.
+   It does not rebuild, submit for review, or release publicly.
+5. In App Store Connect, review the rendered product page, review account,
+   privacy/export/age answers, and candidate build. Submit manually.
+6. Release the first Denmark version manually after approval. Use phased release
+   for later updates unless there is a reason not to.
+7. Merge the next `ios/release.json` version bump before further delivery after
+   Apple closes the released version to new builds.
+
+## Rotation and recovery
+
+`iOS Credential Health` runs every Monday and fails when certificate/profile
+identity drifts or either expires within 30 days. Rotate one credential at a
+time, keep automation disabled during rotation, and repeat the canary.
+
+- Bad TestFlight build: expire it, fix master, and produce a new build number.
+- Bad candidate: detach it in App Store Connect and tag a corrected tested SHA
+  with a new version; never move the tag.
+- Bad phased update: pause the phase.
+- Compromised key/certificate: disable automation, revoke it in Apple, rotate
+  GitHub secrets, inspect audit logs, and run a fresh canary.
+- Public emergency: remove from sale only when necessary and prepare an
+  expedited corrective version.

docs/cpanel-frontend-deployment.md

@@ -20,13 +20,15 @@ workflow succeeds for a push to `master` in this repository. It then:
    `master` immediately before deployment.
 8. Uploads the ZIP and checksum over certificate-verified explicit FTPS. The
    uploaded `.part` files are downloaded and hashed before they are renamed.
-9. Uses the cPanel Fileman API to extract into a new inactive release. The
-   extracted tree is downloaded and compared byte-for-byte with the validated
-   inventory, then `master` is checked again through the read-only workflow
-   token.
-10. Replaces the `current` symlink with a single server-side rename. Public
-    manifest, asset-integrity, cache-header, API-ping, and role gates run after
-    activation. A failed public or role gate restores the previous symlink.
+9. Uploads an authenticated, bounded-lifetime request into the jailed
+   deployment directory. A root-owned account-scoped activator validates the
+   request and archive, extracts an inactive release, verifies its manifest
+   identity and required files, and replaces `current` with a local
+   single-filesystem rename.
+10. Downloads the extracted tree and compares it byte-for-byte with the
+    validated inventory. Public manifest, asset-integrity, cache-header,
+    API-ping, and role gates then run against the active release. A failed gate
+    asks the same activator to restore the previous immutable target.
 
 The fixed `frontend-production` concurrency group is not cancellable. A newer
 push therefore cannot interrupt an in-progress switch or rollback.
@@ -43,6 +45,7 @@ Add these environment **secrets**:
 - `PRODUCTION_FTP_USER`
 - `PRODUCTION_FTP_PASSWORD`
 - `PRODUCTION_FTP_PATH`
+- `PRODUCTION_ACTIVATION_KEY`
 - `PRODUCTION_CPANEL_USER`
 - `PRODUCTION_CPANEL_API_TOKEN`
 
@@ -53,9 +56,10 @@ deployment unchanged.
 
 The cPanel token is separate from the FTP password. Create it in cPanel under
 **Security -> Manage API Tokens** for `PRODUCTION_CPANEL_USER`. The deployment
-uses cPanel API2 `Fileman::fileop` because cPanel does not provide a UAPI
-replacement for the required extract, symlink, and rename operations. Revoke
-and rotate the token if it is ever exposed.
+uses the token for fail-closed directory and release-state inspection. It does
+not use legacy Fileman mutation calls to replace symlinks: on this server those
+calls can follow the target instead of renaming the link itself. Revoke and
+rotate the token if it is ever exposed.
 
 Add these environment **variables**:
 
@@ -103,11 +107,10 @@ separately; do not reuse the FTP password as an API token.
    again after leaving the page.
 6. Confirm **Yes, I Saved My Token**, then close any local plaintext copy after
    the GitHub secret has been saved.
-7. Before merging, run the deployment preflight against the configured API
-   origin. It must be able to call cPanel API2 `Fileman::fileop` for extract,
-   symlink, and rename operations inside `PRODUCTION_CPANEL_PATH`. If the provider
-   restricts those operations, request the required account feature access;
-   do not broaden the token or deployment root beyond this cPanel account.
+7. Before merging, run the deployment audit against the configured API origin.
+   It must be able to list `PRODUCTION_CPANEL_PATH`, `current`, and immutable
+   releases. Do not broaden the token or deployment root beyond this cPanel
+   account.
 
 The current production token is named `github-pleno-vue-production` and
 expires on 20 July 2027 at 23:59:59 server time. Rotate the GitHub environment
@@ -121,10 +124,11 @@ environment, and configured protection rules are evaluated before its secrets
 are released.
 
 The existing live-test, Release Manager, and server-version secrets used by
-`release.yml` must remain configured. GitHub-hosted deploy runners install
-`lftp` and Playwright Chromium during the job; the existing self-hosted build
-runner still needs Node 22, npm, `zip`, `unzip`, GNU `find`, `stat`, and
-`sha256sum`.
+`release.yml` must remain configured. The GitHub-hosted deployment job installs
+`lftp` job-locally when needed and installs Playwright Chromium. The workflow
+also uses Node 22, npm, `zip`, `unzip`, GNU `find`, `stat`, and `sha256sum`.
+The cPanel account host needs `/bin/sh`, `flock`, `unzip`, `jq`, and
+`sha256sum` for the account-scoped activator.
 
 ## cPanel layout and one-time bootstrap
 
@@ -169,8 +173,31 @@ Before merging the workflow change, perform a one-time bootstrap in cPanel:
 7. Confirm `/release-manifest.json`, `/release-entry.json`, a deep Vue route,
    and the API health request work at `PRODUCTION_FRONTEND_URL`.
 8. Test the cPanel token against the exact host and port. The workflow performs
-   a disposable symlink-replacement preflight and refuses deployment if the
-   filesystem or hosting policy cannot replace a symlink atomically.
+   read-only state checks and refuses deployment if `current` or the captured
+   rollback release is missing.
+9. Generate a dedicated 32-byte random activation key. Store its 64-character
+   hexadecimal form in the protected `frontend-production` environment as
+   `PRODUCTION_ACTIVATION_KEY`. On the server, install the same value at
+   `/etc/pleno-release-activator/truckwash.key`, owned by `root:truckwash` and
+   mode `0440`. The FTPS jail must not expose this key.
+10. As `root`, install `scripts/release/cpanel-activate.sh` out of band at
+    `/usr/local/sbin/truckwash-release-activate.sh`, owned by `root:root` and
+    mode `0755`. The FTPS principal must not be able to replace or modify this
+    executable. Then install this one `truckwash` account cron entry without
+    replacing any other account cron lines:
+
+```cron
+* * * * * /bin/flock -n /home/truckwash/frontend-deployments/.activation.lock /usr/bin/env CPANEL_ACTIVATION_ROOT=/home/truckwash/frontend-deployments CPANEL_ACTIVATION_KEY_FILE=/etc/pleno-release-activator/truckwash.key /bin/sh /usr/local/sbin/truckwash-release-activate.sh >/dev/null 2>&1
+```
+
+The workflow can upload release data and bounded-lifetime request files, but
+it cannot replace the root-owned executable or read the activation key. The
+script authenticates each bounded-lifetime request with HMAC-SHA-256,
+accepts only strict filename components and hashes, validates the archive
+and manifest, runs a disposable local symlink preflight, journals the prior
+pointer for crash recovery, and writes a request-specific result. It runs as
+`truckwash`; it does not need root or a shell credential in GitHub. The host
+must provide `/bin/sh`, `flock`, `openssl`, `unzip`, `jq`, and `sha256sum`.
 
 The automatic deployer intentionally refuses to create the first `current`
 pointer. This prevents a missing or misconfigured bootstrap from turning the
@@ -190,7 +217,8 @@ HTTP checks remain the source of truth for service health. The audit fails
 closed if any domain record lacks an identity or document root, and restore is
 blocked while an addon or subdomain is rooted below `public_html`.
 
-If the regression followed the one-time webroot exchange, select `restore`
+If the regression followed the one-time webroot exchange and both the active
+webroot and selected recovery are physical directories, select `restore`
 and copy one exact recovery entry from the audit, including the retained
 `public_html.before-atomic-*` entry created by the bootstrap when applicable.
 The workflow requires the
@@ -198,9 +226,10 @@ typed phrase `RESTORE <recovery> TO public_html STATE <state-token>`, using the
 exact token string from that audit. The token is an optimistic-concurrency
 guard over the cPanel metadata visible to the audit; it is not a content hash
 or a substitute for validating the selected recovery. Restore also rejects an
-unreadable physical directory. An unreadable root is eligible only when the
-independent account-home listing identifies it as a symbolic link. It renames
-the current entry to a run-specific `public_html.failed-*` path, restores the retained entry, and
+unreadable physical directory. Restore also rejects symbolic-link roots and
+recoveries because legacy cPanel Fileman may follow their targets rather than
+rename the links. It renames the current physical entry to a run-specific
+`public_html.failed-*` path, restores the retained entry, and
 checks `/`, `/index.html`, `/release-manifest.json`, and a deep Vue route. If
 any mutation response is lost or any check fails, it reconciles the observed
 account-home entries and reinstates the pre-restore cPanel state. It never

docs/dependency-aware-ci.md

@@ -0,0 +1,75 @@
+# Dependency-aware frontend CI
+
+The `Automated Tests` workflow is generated from a repository-owned dependency graph. It replaces the former
+`E2E-PR`, `E2E-targeted`, and `E2E-full` matrices with small component-and-lane jobs that can start concurrently
+as soon as their actual prerequisites pass.
+
+## Source of truth
+
+- `scripts/test-graph/component-node-catalog.mjs` declares stable component, composable, feature, service, store,
+  middleware, router, runtime, and view boundaries. It also records test ownership, supported lanes, and runtime
+  dependencies that cannot be inferred from imports.
+- `scripts/test-graph/import-resolver.mjs` scans JavaScript, TypeScript, and Vue imports. The graph builder combines
+  those inferred edges with the explicit catalog edges and collapses a real strongly connected component into one
+  atomic execution node if a cycle is ever introduced.
+- `scripts/test-graph/test-inventory.mjs` proves that each active unit, component, and E2E spec has exactly one owner
+  and records the exact expected files and role coverage for every runnable lane. The runner lists each browser file
+  to capture its exact test count before execution.
+- `.github/workflows/tests.yml` is generated by `scripts/test-graph/automated-tests-workflow.mjs`. Do not hand-edit
+  its component jobs.
+
+Run these checks after changing the graph or test ownership:
+
+```bash
+npm run test:graph:validate
+npm run test:graph:generate
+npm run test:graph:check
+```
+
+## Selection rules
+
+Pull requests map changed source files to owning nodes. The plan selects each changed owner, every transitive
+consumer that could be affected, and every prerequisite needed to test those consumers. A test-only change selects
+its owner and prerequisites but deliberately does not fan out to consumers. An unknown runtime, dependency,
+configuration, fixture, or graph change fails closed to the full graph.
+
+Manual targeted runs accept stable node IDs through `target_nodes`. The compatibility `target_components` and
+`target_specs` inputs resolve into the same graph. Explicit node and spec targets include both reverse dependents
+and prerequisites. `target_projects` narrows browser lanes, while their required contract jobs remain selected. An
+unmappable grep request runs the full graph rather than claiming unsafe pruning.
+
+Default-branch pushes, schedules, and `targeted-then-full` dispatches select every runnable contract and all nine
+browser/device lanes: Chromium, WebKit, and Firefox on mobile, desktop, and tablet.
+
+## Execution and failure propagation
+
+Each static component/lane caller invokes `.github/workflows/test-graph-node.yml`. Every test spec is an independent
+matrix child. The matrix has `fail-fast: false`, `max-parallel: 100`, and three Playwright workers per runner. Jobs
+list their direct component dependencies through `needs`; browser and component-test lanes also depend on the build.
+A provider failure therefore prevents only its selected consumers from allocating runners. Independent branches
+continue.
+
+All Linux jobs are pinned to the GitHub-hosted `ubuntu-24.04` label; Apple build and signing jobs use GitHub-hosted
+macOS labels. No repository variable can redirect the dependency graph to a self-hosted machine. Repository and
+organization concurrency quotas still determine how many jobs GitHub can start simultaneously. A newer run for the
+same event type and pull request or ref cancels its superseded run so hosted capacity goes to the exact commit that
+can still merge or release. Push, schedule, and manual runs use separate groups so they cannot cancel the exact
+default-branch push proof required by store delivery.
+
+Each partition writes evidence containing its exact listed, green, and intentionally skipped test outcomes, roles, and
+run attempt; unexpected outcomes fail the partition. Artifact names include the node, lane, partition, run ID, and
+attempt so reruns cannot collide.
+Aggregation uses the newest evidence for each partition while retaining successful evidence from earlier attempts.
+`Required CI` fails closed if the plan, quality matrix, build, any selected caller, or any evidence/count check is
+failed, cancelled, blocked, or missing. Its name remains stable for branch protection.
+
+## Mobile store release gates
+
+The aggregate result artifact is versioned, namespaced by run attempt, and tied to the exact source SHA. Android
+release workflows accept only a completed full `master` push whose `Required CI` job succeeded and whose complete
+`chromium-mobile` and `ct-chromium-mobile` inventories passed with exact counts and all roles. Apple release workflows
+apply the same rules to the complete `webkit-mobile` inventory. Missing nodes, duplicate or unexpected results,
+partial profiles, and stale graph versions fail the release gate.
+
+The legacy role-job fallback is temporary migration compatibility and is used only if an older test run has no
+dependency result artifact. A present but invalid graph artifact never falls back.

docs/mobile-artifacts.md

@@ -1,35 +1,24 @@
-# Mobile Store Artifacts
+# Mobile Store Delivery
 
-The `Mobile Store Artifacts` workflow builds signed Android and iOS store artifacts from the Vue/Vite web app through Capacitor, then uploads them to Google Play and App Store Connect by default.
+Android and iOS delivery are intentionally independent. An iOS release or tag
+must never publish an Android production artifact.
 
-Use the Capacitor project under `android/` for the Google Play Store package. The Bubblewrap/TWA files at the repository root are not the path used by `mobile:android:bundle`.
+## Android
 
-## Triggers
+`Android Store Artifacts` remains in
+`.github/workflows/mobile-artifacts.yml`. It builds the Capacitor Android package
+`io.truckwash.twa` and supports:
 
-- Manual: run `Mobile Store Artifacts` from GitHub Actions and optionally provide `version_name`, `version_code`, upload toggles, and Android track/status overrides.
-- Tag: push a tag named `mobile-vX.Y.Z`; the workflow uses `X.Y.Z` as the store version name.
-- Automatic store upload: after the `Automated Tests` workflow completes successfully on current `master`, GitHub Actions builds signed Android and iOS artifacts from that tested commit and uploads them to the stores.
-- Stale workflow-run protection: if a newer commit reaches `master` before the mobile workflow runs, both store-upload jobs skip the stale commit.
+- Automatic delivery after successful current-master `Automated Tests`.
+- Manual dispatch with version, version code, upload toggle, track, and status.
+- Existing `mobile-v*` tags for the Android workflow.
 
-Default upload behavior:
-
-- Android uploads package `io.truckwash.twa` to the Google Play `production` track with release status `completed`.
-- iOS uploads bundle `io.truckwash.app` to App Store Connect for TestFlight/App Review processing. Public App Store release still depends on App Store Connect review and release settings.
-- Manual dispatch can disable either upload path while still producing signed GitHub artifacts.
-
-## Required Secrets
-
-Store secrets are expected in the GitHub environment `mobile-store-production`.
-
-Non-secret environment variables:
-
-- `ANDROID_PACKAGE_NAME=io.truckwash.twa`
-- `ANDROID_AAB_PATH=android/app/build/outputs/bundle/release/app-release.aab`
-- `PLAY_STORE_TRACK=production`
-- `PLAY_STORE_RELEASE_STATUS=completed`
-- `PLAY_STORE_USER_FRACTION` only when using `PLAY_STORE_RELEASE_STATUS=inProgress`
-
-Android:
+The Android job continues using GitHub environment `mobile-store-production`.
+Before any build or upload, it verifies the exact current `master` SHA, the
+overall `Required CI` job, and every manifest-expected `chromium-mobile` and
+`ct-chromium-mobile` dependency-graph result. Failed, incomplete, cancelled,
+missing, or dependency-blocked mobile results prevent Google Play delivery.
+Its required secrets are:
 
 - `ANDROID_KEYSTORE_BASE64`
 - `ANDROID_KEYSTORE_PASSWORD`
@@ -37,75 +26,53 @@ Android:
 - `ANDROID_KEY_PASSWORD`
 - `GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64`
 
-iOS:
+Its variables are `ANDROID_PACKAGE_NAME`, `ANDROID_AAB_PATH`,
+`PLAY_STORE_TRACK`, `PLAY_STORE_RELEASE_STATUS`, and optional
+`PLAY_STORE_USER_FRACTION`. See the Google Play Console runbook for production
+track policy.
 
-- `IOS_CERTIFICATE_BASE64`
-- `IOS_CERTIFICATE_PASSWORD`
-- `IOS_PROVISION_PROFILE_BASE64`
-- `IOS_KEYCHAIN_PASSWORD`
-- `APPLE_TEAM_ID`
-- `APP_STORE_CONNECT_API_KEY_ID`
-- `APP_STORE_CONNECT_ISSUER_ID`
-- `APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64`
+## iOS
 
-The Google Play secret is a base64-encoded service-account JSON file with Android Publisher API access to the Play Console app. The App Store Connect private key secret is the base64-encoded `.p8` API key file.
+iOS uses three separate workflows:
 
-## Local Checks
+- `iOS Internal TestFlight`: exact verified master release to signed internal
+  TestFlight build.
+- `iOS App Store Candidate`: protected `ios-vX.Y.Z` tag to exact-build
+  storefront candidate, without rebuilding or submission.
+- `iOS Credential Health`: weekly identity, access, and expiry preflight.
 
-Run the native permission validation after changing Capacitor, native manifests, or store metadata:
+TestFlight delivery and App Store candidate promotion both require the exact
+current `master` SHA, the overall `Required CI` job, and every
+manifest-expected `webkit-mobile` dependency-graph result. The verifier reads
+schema-version 2 from the latest artifact
+`dependency-ci-results-<source-sha>-<run-attempt>` and file
+`dependency-ci-results.json`. Legacy unnumbered graph artifacts remain readable.
+Legacy full-matrix job names are accepted only when that artifact is absent
+during the dependency-graph migration; an invalid or failing graph artifact
+never falls back to legacy jobs.
+
+The GitHub environments and variables are documented in
+`docs/app-store-release.md`. The repository-level
+`APP_STORE_AUTOMATION_ENABLED` variable gates all access to them and must remain
+`false` until the signed credential canary is approved.
+
+Local source/storefront checks:
 
 ```sh
 npm run mobile:permissions:check
+npm run mobile:ios:storefront:check
 ```
 
-Build a local unsigned Android App Bundle for packaging verification:
+Strict candidate asset check:
 
 ```sh
-npm run mobile:android:bundle:unsigned
+npm run mobile:ios:storefront:check-strict
 ```
 
-Build a signed Play Console upload bundle after exporting the Android upload-key variables:
+Version identity is deliberately different between platforms:
 
-```sh
-export ANDROID_KEYSTORE_FILE=/path/to/upload-key.jks
-export ANDROID_KEYSTORE_PASSWORD=...
-export ANDROID_KEY_ALIAS=...
-export ANDROID_KEY_PASSWORD=...
-npm run mobile:android:bundle
-```
+- Android package: `io.truckwash.twa`
+- iOS App Store bundle: `io.truckwash.app`
 
-The signed Android bundle is written to:
-
-```text
-android/app/build/outputs/bundle/release/app-release.aab
-```
-
-Upload a locally built signed App Bundle to Google Play after exporting the Play service-account secret and release metadata:
-
-```sh
-export GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64=...
-export ANDROID_PACKAGE_NAME=io.truckwash.twa
-export ANDROID_AAB_PATH=android/app/build/outputs/bundle/release/app-release.aab
-export MOBILE_VERSION_NAME=1.4.0
-export MOBILE_VERSION_CODE=10400
-export PLAY_STORE_TRACK=production
-export PLAY_STORE_RELEASE_STATUS=completed
-npm run mobile:android:play-upload
-```
-
-Use `PLAY_STORE_RELEASE_STATUS=inProgress` only with `PLAY_STORE_USER_FRACTION` set to a value greater than `0` and less than `1`.
-
-Android artifacts use package id `io.truckwash.twa`. iOS artifacts use bundle id `io.truckwash.app`.
-
-The Android project currently targets SDK 36. Google Play requires new apps and updates to target Android 15/API 35 or higher starting August 31, 2025: https://developer.android.com/google/play/requirements/target-sdk
-
-Play Store graphics are generated in the workspace-level `playstoregraphics/` folder:
-
-- App icon: `playstoregraphics/universal/app-icon/truck-wash-icon-512.png`
-- Feature graphic: `playstoregraphics/universal/feature-graphic/truck-wash-feature-1024x500.jpg`
-- Phone screenshots: `playstoregraphics/phone/screenshots/`
-- 7-inch tablet screenshots: `playstoregraphics/tablet-7/screenshots/`
-- 10-inch tablet screenshots: `playstoregraphics/tablet-10/screenshots/`
-- Chromebook screenshots: `playstoregraphics/chromebook/screenshots/`
-
-The native manifests declare camera and foreground location access for the store binaries. Keep the App Store Connect and Play Console privacy questionnaires aligned with the app's actual camera and location data handling before submitting a release.
+The iOS release build verifies the final signed IPA rather than relying on the
+Capacitor `appId`, which remains the Android package identifier.

fastlane/Appfile

@@ -0,0 +1,3 @@
+app_identifier(ENV.fetch("IOS_BUNDLE_ID", "io.truckwash.app"))
+team_id(ENV["APPLE_TEAM_ID"])
+itc_team_id(ENV["APP_STORE_CONNECT_TEAM_ID"]) if ENV["APP_STORE_CONNECT_TEAM_ID"]

fastlane/Deliverfile

@@ -0,0 +1,5 @@
+app_identifier(ENV.fetch("IOS_BUNDLE_ID", "io.truckwash.app"))
+metadata_path("fastlane/metadata")
+screenshots_path("fastlane/screenshots")
+primary_category("BUSINESS")
+price_tier(0)

fastlane/Fastfile

@@ -0,0 +1,55 @@
+default_platform(:ios)
+
+def app_store_api_key
+  issuer_id = ENV["APP_STORE_CONNECT_ISSUER_ID"].to_s.strip
+  app_store_connect_api_key(
+    key_id: ENV.fetch("APP_STORE_CONNECT_API_KEY_ID"),
+    issuer_id: issuer_id.empty? ? nil : issuer_id,
+    key_content: ENV.fetch("APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64"),
+    is_key_content_base64: true,
+    duration: 1200,
+    in_house: false
+  )
+end
+
+platform :ios do
+  desc "Validate and upload the signed IPA, then wait for App Store Connect processing"
+  lane :upload_internal do
+    api_key = app_store_api_key
+    upload_to_testflight(
+      api_key: api_key,
+      app_identifier: ENV.fetch("IOS_BUNDLE_ID"),
+      ipa: ENV.fetch("IOS_IPA_PATH"),
+      changelog: ENV.fetch("TESTFLIGHT_WHAT_TO_TEST", "Automatisk intern build fra verificeret master."),
+      distribute_external: false,
+      notify_external_testers: false,
+      skip_submission: true,
+      skip_waiting_for_build_processing: false,
+      wait_processing_interval: 30,
+      reject_build_waiting_for_review: false
+    )
+  end
+
+  desc "Create/update the Denmark App Store candidate without submitting it for review"
+  lane :prepare_candidate do
+    api_key = app_store_api_key
+    deliver(
+      api_key: api_key,
+      app_identifier: ENV.fetch("IOS_BUNDLE_ID"),
+      app_version: ENV.fetch("IOS_MARKETING_VERSION"),
+      build_number: ENV.fetch("IOS_BUILD_NUMBER"),
+      metadata_path: "fastlane/metadata",
+      screenshots_path: "fastlane/screenshots",
+      skip_binary_upload: true,
+      skip_metadata: false,
+      skip_screenshots: false,
+      overwrite_screenshots: true,
+      force: true,
+      submit_for_review: false,
+      automatic_release: false,
+      phased_release: false,
+      run_precheck_before_submit: false,
+      precheck_include_in_app_purchases: false
+    )
+  end
+end

fastlane/metadata/copyright.txt

@@ -0,0 +1 @@
+2026 Truck Wash ApS

fastlane/metadata/da-DK/description.txt

@@ -0,0 +1,12 @@
+Kundeportal til truckvask.
+
+Start selvvask, book tid og hent dokumentation fra mobilen.
+
+Med Truck Wash får du samlet dine truckvaske ét sted:
+
+- Start selvvask direkte fra mobilen.
+- Book vask og vælg tidspunkt.
+- Se dine køretøjer og tidligere vaske.
+- Find vaskecertifikater, ordrer og fakturaer.
+
+Truck Wash gør det nemt for vognmænd, disponenter og chauffører at håndtere den daglige truckvask.

fastlane/metadata/da-DK/keywords.txt

@@ -0,0 +1 @@
+lastbilvask,truckvask,vask,booking,kundeportal,køretøjer

fastlane/metadata/da-DK/marketing_url.txt

@@ -0,0 +1 @@
+https://truckwash.io/

fastlane/metadata/da-DK/name.txt

@@ -0,0 +1 @@
+Truck Wash

fastlane/metadata/da-DK/privacy_url.txt

@@ -0,0 +1 @@
+https://truckwash.io/privacy-policy

fastlane/metadata/da-DK/promotional_text.txt

@@ -0,0 +1 @@
+Start selvvask, book tid og hent dokumentation fra mobilen.

fastlane/metadata/da-DK/release_notes.txt

@@ -0,0 +1 @@
+Første App Store-version af Truck Wash Kundeportal.

fastlane/metadata/da-DK/subtitle.txt

@@ -0,0 +1 @@
+Kundeportal til truckvask

fastlane/metadata/da-DK/support_url.txt

@@ -0,0 +1 @@
+https://truckwash.io/support

fastlane/review_information/README.md

@@ -0,0 +1,7 @@
+# App Review information
+
+Review credentials are deliberately not stored in Git. Configure the durable,
+sanitized review account directly in App Store Connect. The review notes must
+explain the customer/driver login path, any 2FA bypass for that account, camera
+and location denial fallbacks, QR/hardware-dependent behavior, and that any
+payments cover physical truck-wash services rather than digital content.

fastlane/screenshots/da-DK/.gitkeep

@@ -0,0 +1 @@
+

index.html

@@ -19,7 +19,7 @@
     <link rel="shortcut icon" href="%BASE_URL%assets/favicons/favicon.ico" />
     <link rel="apple-touch-icon" sizes="180x180" href="%BASE_URL%assets/favicons/apple-touch-icon.png" />
     <meta name="apple-mobile-web-app-title" content="Truck Wash Kundeportal" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, viewport-fit=cover">
     <meta name="apple-mobile-web-app-capable" content="yes">
     <meta name="mobile-web-app-capable" content="yes">
     <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.7.1/css/all.min.css" integrity="sha512-5Hs3dF2AEPkpNAR7UiOHba+lRSJNeM2ECkwxUIxC1Q/FLycGTbNapWXB4tP889k5T5Ju8fs4b1P5z/iB4nMfSQ==" crossorigin="anonymous" referrerpolicy="no-referrer" />

ios/App/App.xcodeproj/project.pbxproj

@@ -16,6 +16,7 @@
 		504EC3121FED79650016851F /* LaunchScreen.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = 504EC3101FED79650016851F /* LaunchScreen.storyboard */; };
 		50B271D11FEDC1A000F3C39B /* public in Resources */ = {isa = PBXBuildFile; fileRef = 50B271D01FEDC1A000F3C39B /* public */; };
 		A17D5C4A2E8F000100000001 /* PrivacyInfo.xcprivacy in Resources */ = {isa = PBXBuildFile; fileRef = A17D5C4A2E8F000100000002 /* PrivacyInfo.xcprivacy */; };
+		A17D5C4A2E8F000100000003 /* InfoPlist.strings in Resources */ = {isa = PBXBuildFile; fileRef = A17D5C4A2E8F000100000004 /* InfoPlist.strings */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXFileReference section */
@@ -30,6 +31,8 @@
 		50B271D01FEDC1A000F3C39B /* public */ = {isa = PBXFileReference; lastKnownFileType = folder; path = public; sourceTree = "<group>"; };
 		958DCC722DB07C7200EA8C5F /* debug.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; name = debug.xcconfig; path = ../debug.xcconfig; sourceTree = SOURCE_ROOT; };
 		A17D5C4A2E8F000100000002 /* PrivacyInfo.xcprivacy */ = {isa = PBXFileReference; lastKnownFileType = text.xml; path = PrivacyInfo.xcprivacy; sourceTree = "<group>"; };
+		A17D5C4A2E8F000100000005 /* en */ = {isa = PBXFileReference; lastKnownFileType = text.plist.strings; name = en; path = en.lproj/InfoPlist.strings; sourceTree = "<group>"; };
+		A17D5C4A2E8F000100000006 /* da */ = {isa = PBXFileReference; lastKnownFileType = text.plist.strings; name = da; path = da.lproj/InfoPlist.strings; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -70,6 +73,7 @@
 				504EC30E1FED79650016851F /* Assets.xcassets */,
 				504EC3101FED79650016851F /* LaunchScreen.storyboard */,
 				504EC3131FED79650016851F /* Info.plist */,
+				A17D5C4A2E8F000100000004 /* InfoPlist.strings */,
 				A17D5C4A2E8F000100000002 /* PrivacyInfo.xcprivacy */,
 				2FAD9762203C412B000D30F8 /* config.xml */,
 				50B271D01FEDC1A000F3C39B /* public */,
@@ -122,6 +126,7 @@
 			hasScannedForEncodings = 0;
 			knownRegions = (
 				en,
+				da,
 				Base,
 			);
 			mainGroup = 504EC2FB1FED79650016851F;
@@ -146,6 +151,7 @@
 				50B271D11FEDC1A000F3C39B /* public in Resources */,
 				504EC30F1FED79650016851F /* Assets.xcassets in Resources */,
 				A17D5C4A2E8F000100000001 /* PrivacyInfo.xcprivacy in Resources */,
+				A17D5C4A2E8F000100000003 /* InfoPlist.strings in Resources */,
 				50379B232058CBB4000EE86E /* capacitor.config.json in Resources */,
 				504EC30D1FED79650016851F /* Main.storyboard in Resources */,
 				2FAD9763203C412B000D30F8 /* config.xml in Resources */,
@@ -182,6 +188,15 @@
 			name = LaunchScreen.storyboard;
 			sourceTree = "<group>";
 		};
+		A17D5C4A2E8F000100000004 /* InfoPlist.strings */ = {
+			isa = PBXVariantGroup;
+			children = (
+				A17D5C4A2E8F000100000005 /* en */,
+				A17D5C4A2E8F000100000006 /* da */,
+			);
+			name = InfoPlist.strings;
+			sourceTree = "<group>";
+		};
 /* End PBXVariantGroup section */
 
 /* Begin XCBuildConfiguration section */

ios/App/App/Info.plist

@@ -24,6 +24,8 @@
 	<string>$(CURRENT_PROJECT_VERSION)</string>
 	<key>LSRequiresIPhoneOS</key>
 	<true/>
+	<key>ITSAppUsesNonExemptEncryption</key>
+	<false/>
 	<key>NSCameraUsageDescription</key>
 	<string>Truck Wash uses the camera to scan QR codes and vehicle registration plates.</string>
 	<key>NSLocationWhenInUseUsageDescription</key>

ios/App/App/PrivacyInfo.xcprivacy

@@ -5,8 +5,121 @@
 	<key>NSPrivacyAccessedAPITypes</key>
 	<array/>
 	<key>NSPrivacyCollectedDataTypes</key>
-	<array/>
+	<array>
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypeName</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<true/>
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array><string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string></array>
+		</dict>
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypeEmailAddress</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<true/>
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array><string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string></array>
+		</dict>
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypePhoneNumber</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<true/>
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array><string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string></array>
+		</dict>
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypePhysicalAddress</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<true/>
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array><string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string></array>
+		</dict>
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypeUserID</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<true/>
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array><string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string></array>
+		</dict>
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypePurchaseHistory</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<true/>
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array><string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string></array>
+		</dict>
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypePaymentInfo</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<true/>
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array><string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string></array>
+		</dict>
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypePhotosorVideos</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<true/>
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array><string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string></array>
+		</dict>
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypeCustomerSupport</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<true/>
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array><string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string></array>
+		</dict>
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypeOtherUserContent</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<true/>
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array><string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string></array>
+		</dict>
+		<dict>
+			<key>NSPrivacyCollectedDataType</key>
+			<string>NSPrivacyCollectedDataTypeOtherDiagnosticData</string>
+			<key>NSPrivacyCollectedDataTypeLinked</key>
+			<true/>
+			<key>NSPrivacyCollectedDataTypeTracking</key>
+			<false/>
+			<key>NSPrivacyCollectedDataTypePurposes</key>
+			<array><string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string></array>
+		</dict>
+	</array>
 	<key>NSPrivacyTracking</key>
 	<false/>
+	<key>NSPrivacyTrackingDomains</key>
+	<array/>
 </dict>
 </plist>

ios/App/App/da.lproj/InfoPlist.strings

@@ -0,0 +1,3 @@
+"CFBundleDisplayName" = "Truck Wash";
+"NSCameraUsageDescription" = "Truck Wash bruger kameraet til at scanne QR-koder og registreringsnumre, når du vælger en scanningsfunktion.";
+"NSLocationWhenInUseUsageDescription" = "Truck Wash bruger din placering, mens appen er åben, til at finde eller bekræfte den nærmeste Truck Wash-afdeling.";

ios/App/App/en.lproj/InfoPlist.strings

@@ -0,0 +1,3 @@
+"CFBundleDisplayName" = "Truck Wash";
+"NSCameraUsageDescription" = "Truck Wash uses the camera to scan QR codes and vehicle registration plates when you choose a scanning feature.";
+"NSLocationWhenInUseUsageDescription" = "Truck Wash uses your location while the app is open to find or confirm the nearest Truck Wash department.";

ios/release.json

@@ -0,0 +1,5 @@
+{
+  "marketingVersion": "1.0.0",
+  "bundleId": "io.truckwash.app",
+  "minimumIosVersion": "15.0"
+}

package.json

@@ -50,6 +50,12 @@
     "test:e2e:release": "npm run test:e2e:prod && npm run test:e2e:live",
     "test:ct": "playwright test --config=playwright.ct.config.ts",
     "test:ct:pr": "playwright test --config=playwright.ct.config.ts --project=chromium-desktop",
+    "test:graph:validate": "node scripts/test-graph/cli.mjs validate",
+    "test:graph:plan": "node scripts/test-graph/cli.mjs plan",
+    "test:graph:generate": "node scripts/test-graph/automated-tests-workflow.mjs",
+    "test:graph:check": "node scripts/test-graph/automated-tests-workflow.mjs --check",
+    "test:graph:run-node": "node scripts/test-graph/run-node-tests.mjs",
+    "test:graph:aggregate": "node scripts/test-graph/aggregate-results.mjs",
     "release:package": "node scripts/release/package-dist.mjs",
     "release:deploy:cpanel": "node scripts/release/deploy-cpanel.mjs",
     "release:deploy:cpanel:rollback": "node scripts/release/deploy-cpanel.mjs --rollback",
@@ -74,6 +80,9 @@
     "mobile:android:play-upload": "node scripts/mobile/upload-google-play.mjs",
     "mobile:ios:sync": "npm run mobile:sync && npm run mobile:permissions:check",
     "mobile:ios:device": "node scripts/mobile/ios-device.mjs",
+    "mobile:ios:screenshots": "node scripts/playstore/generate-graphics.mjs --app-store-screenshots",
+    "mobile:ios:storefront:check": "node scripts/mobile/validate-app-store.mjs",
+    "mobile:ios:storefront:check-strict": "node scripts/mobile/validate-app-store.mjs --strict",
     "playstore:graphics": "node scripts/playstore/generate-graphics.mjs"
   },
   "dependencies": {

playwright.config.ts

@@ -16,10 +16,12 @@ const reporterMode = (process.env.PLAYWRIGHT_REPORTER_MODE || "").trim();
 const configuredVideoMode = (process.env.PLAYWRIGHT_VIDEO_MODE || "retain-on-failure").trim();
 const allowedVideoModes = new Set(["off", "on", "retain-on-failure", "on-first-retry"]);
 const videoMode = allowedVideoModes.has(configuredVideoMode) ? configuredVideoMode : "retain-on-failure";
-const reporter =
-  reporterMode === "line-html"
-    ? [["line"], ["html", { open: "never", outputFolder: htmlReportOutputFolder }]]
-    : [["list"], ["html", { open: "never", outputFolder: htmlReportOutputFolder }]];
+const jsonOutputFile = (process.env.PLAYWRIGHT_JSON_OUTPUT_FILE || "").trim();
+const reporter = [
+  [reporterMode === "line-html" ? "line" : "list"],
+  ["html", { open: "never", outputFolder: htmlReportOutputFolder }],
+  ...(jsonOutputFile ? [["json", { outputFile: jsonOutputFile }]] : []),
+];
 
 function buildProject(name: string, browserName: "chromium" | "firefox" | "webkit", deviceName: keyof typeof devices) {
   const { defaultBrowserType: _defaultBrowserType, ...device } = devices[deviceName];

playwright.ct.config.ts

@@ -6,10 +6,12 @@ const projectRoot = fileURLToPath(new URL(".", import.meta.url));
 const artifactNamespace = (process.env.PLAYWRIGHT_ARTIFACT_NAMESPACE || "ct").trim();
 const artifactRoot = path.join("output", "playwright", artifactNamespace);
 const reporterMode = (process.env.PLAYWRIGHT_REPORTER_MODE || "").trim();
-const reporter =
-  reporterMode === "line-html"
-    ? [["line"], ["html", { open: "never", outputFolder: path.join(artifactRoot, "report") }]]
-    : [["list"], ["html", { open: "never", outputFolder: path.join(artifactRoot, "report") }]];
+const jsonOutputFile = (process.env.PLAYWRIGHT_JSON_OUTPUT_FILE || "").trim();
+const reporter = [
+  [reporterMode === "line-html" ? "line" : "list"],
+  ["html", { open: "never", outputFolder: path.join(artifactRoot, "report") }],
+  ...(jsonOutputFile ? [["json", { outputFile: jsonOutputFile }]] : []),
+];
 const configuredWorkers = Number(process.env.PLAYWRIGHT_WORKERS || 2);
 const workers = Number.isFinite(configuredWorkers) && configuredWorkers > 0 ? configuredWorkers : 2;
 

scripts/mobile/app-store-connect.mjs

@@ -0,0 +1,285 @@
+import { createPrivateKey, generateKeyPairSync, sign } from "node:crypto";
+import { appendFileSync } from "node:fs";
+import { argv, env, exit } from "node:process";
+
+const command = argv[2];
+const baseUrl = "https://api.appstoreconnect.apple.com/v1";
+const required = (name) => {
+  const value = env[name];
+  if (!value) throw new Error(`Missing ${name}`);
+  return value;
+};
+const base64url = (value) => Buffer.from(value).toString("base64url");
+
+const token = () => {
+  const keyId = required("APP_STORE_CONNECT_API_KEY_ID");
+  const key = Buffer.from(required("APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64"), "base64").toString("utf8");
+  if (!key.includes("PRIVATE KEY"))
+    throw new Error("App Store Connect API key is not a base64-encoded .p8 private key");
+  const now = Math.floor(Date.now() / 1000);
+  const payload = { aud: "appstoreconnect-v1", iat: now, exp: now + 1_200 };
+  if (env.APP_STORE_CONNECT_ISSUER_ID) payload.iss = env.APP_STORE_CONNECT_ISSUER_ID;
+  else payload.sub = "user";
+  const encodedHeader = base64url(JSON.stringify({ alg: "ES256", kid: keyId, typ: "JWT" }));
+  const encodedPayload = base64url(JSON.stringify(payload));
+  const signingInput = `${encodedHeader}.${encodedPayload}`;
+  const signature = sign("sha256", Buffer.from(signingInput), {
+    key: createPrivateKey(key),
+    dsaEncoding: "ieee-p1363",
+  });
+  return `${signingInput}.${base64url(signature)}`;
+};
+
+const sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
+
+const request = async (path, options = {}, attempt = 1) => {
+  const response = await fetch(path.startsWith("http") ? path : `${baseUrl}${path}`, {
+    ...options,
+    headers: {
+      Authorization: `Bearer ${token()}`,
+      "Content-Type": "application/json",
+      ...(options.headers ?? {}),
+    },
+  });
+  const text = await response.text();
+  let body = null;
+  try {
+    body = text ? JSON.parse(text) : null;
+  } catch {
+    body = { raw: text };
+  }
+  if (!response.ok) {
+    if ((response.status === 429 || response.status >= 500) && attempt < 5) {
+      await sleep(Math.min(30_000, 2 ** attempt * 1_000));
+      return request(path, options, attempt + 1);
+    }
+    const detail =
+      body?.errors
+        ?.map((error) => error.detail || error.title)
+        .filter(Boolean)
+        .join("; ") ||
+      body?.raw ||
+      response.statusText;
+    throw new Error(`App Store Connect ${options.method ?? "GET"} ${path} failed (${response.status}): ${detail}`);
+  }
+  return body;
+};
+
+const appId = () => required("APP_STORE_CONNECT_APP_ID");
+const bundleId = () => env.IOS_BUNDLE_ID || "io.truckwash.app";
+const version = () => required("IOS_MARKETING_VERSION");
+const buildNumber = () => required("IOS_BUILD_NUMBER");
+
+const writeOutput = (key, value) => {
+  if (env.GITHUB_OUTPUT) appendFileSync(env.GITHUB_OUTPUT, `${key}=${value}\n`);
+  else console.log(`${key}=${value}`);
+};
+
+const verifyCredentials = async () => {
+  const app = await request(`/apps/${encodeURIComponent(appId())}`);
+  const actualBundleId = app?.data?.attributes?.bundleId;
+  if (actualBundleId !== bundleId()) {
+    throw new Error(
+      `APP_STORE_CONNECT_APP_ID resolves to ${actualBundleId || "an unknown bundle"}, expected ${bundleId()}`
+    );
+  }
+  console.log(`Authenticated to App Store Connect for ${actualBundleId}.`);
+};
+
+const allBuildsForVersion = async () => {
+  const params = new URLSearchParams({
+    "filter[app]": appId(),
+    "filter[preReleaseVersion.version]": version(),
+    limit: "200",
+  });
+  let url = `${baseUrl}/builds?${params}`;
+  const builds = [];
+  while (url) {
+    const page = await request(url);
+    builds.push(...(page?.data ?? []));
+    url = page?.links?.next ?? null;
+  }
+  return builds;
+};
+
+const findExactBuild = async () => {
+  const builds = await allBuildsForVersion();
+  return builds.find((build) => String(build?.attributes?.version) === buildNumber()) ?? null;
+};
+
+const nextBuildNumber = async () => {
+  await verifyCredentials();
+  const storeVersionParams = new URLSearchParams({
+    "filter[app]": appId(),
+    "filter[platform]": "IOS",
+    "filter[versionString]": version(),
+    limit: "10",
+  });
+  const storeVersions = await request(`/appStoreVersions?${storeVersionParams}`);
+  const storeVersion = (storeVersions?.data ?? []).find(
+    (candidate) => candidate?.attributes?.versionString === version()
+  );
+  if (storeVersion?.attributes?.appStoreState === "READY_FOR_SALE") {
+    throw new Error(
+      `App Store version ${version()} is already released; bump ios/release.json before delivering another master build`
+    );
+  }
+  const builds = await allBuildsForVersion();
+  const numbers = builds
+    .map((build) => Number.parseInt(build?.attributes?.version, 10))
+    .filter((number) => Number.isSafeInteger(number) && number > 0);
+  const next = (numbers.length > 0 ? Math.max(...numbers) : 0) + 1;
+  writeOutput("build_number", next);
+  console.log(`Next App Store Connect build for ${version()} is ${next}.`);
+};
+
+const waitForBuild = async () => {
+  const deadline = Date.now() + Number(env.APP_STORE_PROCESSING_TIMEOUT_SECONDS || 3_600) * 1_000;
+  let build = null;
+  while (Date.now() < deadline) {
+    build = await findExactBuild();
+    const state = build?.attributes?.processingState;
+    if (state === "VALID") return build;
+    if (["FAILED", "INVALID"].includes(state)) throw new Error(`App Store Connect processing ended in ${state}`);
+    console.log(
+      build ? `Build ${buildNumber()} is ${state || "processing"}.` : `Waiting for build ${buildNumber()} to appear.`
+    );
+    await sleep(30_000);
+  }
+  throw new Error(`Timed out waiting for ${version()} (${buildNumber()}) to process`);
+};
+
+const waitAndDistribute = async () => {
+  const build = await waitForBuild();
+  const groupId = required("TESTFLIGHT_INTERNAL_GROUP_ID");
+  const localizationParams = new URLSearchParams({ "filter[build]": build.id, "filter[locale]": "da-DK" });
+  const localizations = await request(`/betaBuildLocalizations?${localizationParams}`);
+  const existingLocalization = (localizations?.data ?? [])[0];
+  const whatsNew = env.TESTFLIGHT_WHAT_TO_TEST || `Automatisk intern build ${version()} (${buildNumber()}).`;
+  if (existingLocalization) {
+    await request(`/betaBuildLocalizations/${encodeURIComponent(existingLocalization.id)}`, {
+      method: "PATCH",
+      body: JSON.stringify({
+        data: { type: "betaBuildLocalizations", id: existingLocalization.id, attributes: { whatsNew } },
+      }),
+    });
+  } else {
+    await request("/betaBuildLocalizations", {
+      method: "POST",
+      body: JSON.stringify({
+        data: {
+          type: "betaBuildLocalizations",
+          attributes: { locale: "da-DK", whatsNew },
+          relationships: { build: { data: { type: "builds", id: build.id } } },
+        },
+      }),
+    });
+  }
+  const relationship = await request(`/betaGroups/${encodeURIComponent(groupId)}/relationships/builds?limit=200`);
+  const alreadyAssigned = (relationship?.data ?? []).some((candidate) => candidate.id === build.id);
+  if (!alreadyAssigned) {
+    await request(`/betaGroups/${encodeURIComponent(groupId)}/relationships/builds`, {
+      method: "POST",
+      body: JSON.stringify({ data: [{ type: "builds", id: build.id }] }),
+    });
+  }
+  writeOutput("app_store_build_id", build.id);
+  console.log(
+    `${
+      alreadyAssigned ? "Verified" : "Assigned"
+    } ${version()} (${buildNumber()}) in internal TestFlight group ${groupId}.`
+  );
+};
+
+const verifyCandidate = async () => {
+  await verifyCredentials();
+  const build = await findExactBuild();
+  if (!build) throw new Error(`App Store Connect does not contain ${version()} (${buildNumber()})`);
+  if (build.attributes?.processingState !== "VALID") {
+    throw new Error(`Candidate build is ${build.attributes?.processingState || "not valid"}`);
+  }
+  if (env.EXPECTED_APP_STORE_BUILD_ID && build.id !== env.EXPECTED_APP_STORE_BUILD_ID) {
+    throw new Error(
+      `Candidate App Store build ID ${build.id} does not match release manifest ${env.EXPECTED_APP_STORE_BUILD_ID}`
+    );
+  }
+  writeOutput("app_store_build_id", build.id);
+  console.log(`Verified exact candidate ${version()} (${buildNumber()}) as ${build.id}.`);
+};
+
+const verifyStoreVersion = async () => {
+  const params = new URLSearchParams({
+    "filter[app]": appId(),
+    "filter[platform]": "IOS",
+    "filter[versionString]": version(),
+    include: "build",
+    limit: "10",
+  });
+  const response = await request(`/appStoreVersions?${params}`);
+  const storeVersion = (response?.data ?? []).find((candidate) => candidate?.attributes?.versionString === version());
+  if (!storeVersion) throw new Error(`App Store version ${version()} was not created`);
+  const buildRelationshipId = storeVersion?.relationships?.build?.data?.id;
+  const includedBuild = (response?.included ?? []).find(
+    (candidate) => candidate.type === "builds" && candidate.id === buildRelationshipId
+  );
+  if (!includedBuild || String(includedBuild?.attributes?.version) !== buildNumber()) {
+    throw new Error(`App Store version ${version()} is not attached to build ${buildNumber()}`);
+  }
+  writeOutput("app_store_version_id", storeVersion.id);
+  writeOutput("app_store_state", storeVersion.attributes?.appStoreState || "UNKNOWN");
+  console.log(
+    `Verified App Store version ${version()} with exact build ${buildNumber()} in ${
+      storeVersion.attributes?.appStoreState || "unknown state"
+    }.`
+  );
+};
+
+const selfTestJwt = async () => {
+  const original = {
+    keyId: env.APP_STORE_CONNECT_API_KEY_ID,
+    issuer: env.APP_STORE_CONNECT_ISSUER_ID,
+    key: env.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64,
+  };
+  try {
+    const { privateKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+    env.APP_STORE_CONNECT_API_KEY_ID = "TESTKEY123";
+    env.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64 = Buffer.from(
+      privateKey.export({ type: "pkcs8", format: "pem" })
+    ).toString("base64");
+    delete env.APP_STORE_CONNECT_ISSUER_ID;
+    const individual = JSON.parse(Buffer.from(token().split(".")[1], "base64url").toString("utf8"));
+    if (individual.sub !== "user" || individual.iss !== undefined)
+      throw new Error("Individual API JWT claim test failed");
+    env.APP_STORE_CONNECT_ISSUER_ID = "00000000-0000-0000-0000-000000000000";
+    const team = JSON.parse(Buffer.from(token().split(".")[1], "base64url").toString("utf8"));
+    if (team.iss !== env.APP_STORE_CONNECT_ISSUER_ID || team.sub !== undefined)
+      throw new Error("Team API JWT claim test failed");
+    console.log("App Store Connect individual and team JWT claim tests passed.");
+  } finally {
+    if (original.keyId === undefined) delete env.APP_STORE_CONNECT_API_KEY_ID;
+    else env.APP_STORE_CONNECT_API_KEY_ID = original.keyId;
+    if (original.issuer === undefined) delete env.APP_STORE_CONNECT_ISSUER_ID;
+    else env.APP_STORE_CONNECT_ISSUER_ID = original.issuer;
+    if (original.key === undefined) delete env.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64;
+    else env.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64 = original.key;
+  }
+};
+
+const commands = {
+  "verify-credentials": verifyCredentials,
+  "next-build-number": nextBuildNumber,
+  "wait-and-distribute": waitAndDistribute,
+  "verify-candidate": verifyCandidate,
+  "verify-store-version": verifyStoreVersion,
+  "self-test-jwt": selfTestJwt,
+};
+
+if (!commands[command]) {
+  console.error(`Usage: node scripts/mobile/app-store-connect.mjs ${Object.keys(commands).join("|")}`);
+  exit(2);
+}
+
+commands[command]().catch((error) => {
+  console.error(error instanceof Error ? error.message : error);
+  exit(1);
+});

scripts/mobile/check-store-upload-env.mjs

@@ -21,11 +21,20 @@ const decodeBase64 = (name) => {
     return null;
   }
   try {
-    const decoded = Buffer.from(env[name], "base64");
+    const encoded = env[name].replace(/\s/g, "");
+    if (!encoded || !/^[A-Za-z0-9+/]+={0,2}$/.test(encoded) || encoded.length % 4 !== 0) {
+      failures.push(`${name} is not valid base64`);
+      return null;
+    }
+    const decoded = Buffer.from(encoded, "base64");
     if (decoded.length === 0) {
       failures.push(`${name} is empty after base64 decoding`);
       return null;
     }
+    if (decoded.toString("base64").replace(/=+$/, "") !== encoded.replace(/=+$/, "")) {
+      failures.push(`${name} is not canonical base64`);
+      return null;
+    }
     return decoded;
   } catch {
     failures.push(`${name} is not valid base64`);
@@ -102,21 +111,32 @@ const checkAndroid = () => {
 const checkIos = () => {
   requireVariable("MOBILE_VERSION_NAME");
   requireVariable("MOBILE_VERSION_CODE");
-  requireVariable("IOS_CERTIFICATE_BASE64");
-  requireVariable("IOS_CERTIFICATE_PASSWORD");
-  requireVariable("IOS_PROVISION_PROFILE_BASE64");
-  requireVariable("IOS_KEYCHAIN_PASSWORD");
+  requireVariable("IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64");
+  requireVariable("IOS_DISTRIBUTION_CERTIFICATE_PASSWORD");
+  requireVariable("IOS_APP_STORE_PROFILE_BASE64");
   requireVariable("APPLE_TEAM_ID");
+  requireVariable("IOS_BUNDLE_ID");
 
-  decodeBase64("IOS_CERTIFICATE_BASE64");
-  decodeBase64("IOS_PROVISION_PROFILE_BASE64");
+  if (env.MOBILE_VERSION_NAME && !/^\d+\.\d+\.\d+$/.test(env.MOBILE_VERSION_NAME)) {
+    failures.push("MOBILE_VERSION_NAME must be numeric SemVer (X.Y.Z)");
+  }
+  if (env.MOBILE_VERSION_CODE && !/^[1-9][0-9]*$/.test(env.MOBILE_VERSION_CODE)) {
+    failures.push("MOBILE_VERSION_CODE must be a positive integer");
+  }
+  if (env.APPLE_TEAM_ID && !/^[A-Z0-9]{10}$/.test(env.APPLE_TEAM_ID)) {
+    failures.push("APPLE_TEAM_ID must be a 10-character Apple team identifier");
+  }
+
+  decodeBase64("IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64");
+  decodeBase64("IOS_APP_STORE_PROFILE_BASE64");
 
   if (!isEnabled("UPLOAD_IOS_TO_APP_STORE")) {
     return;
   }
 
   requireVariable("APP_STORE_CONNECT_API_KEY_ID");
-  requireVariable("APP_STORE_CONNECT_ISSUER_ID");
+  requireVariable("APP_STORE_CONNECT_APP_ID");
+  requireVariable("TESTFLIGHT_INTERNAL_GROUP_ID");
   requireVariable("APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64");
 
   const privateKey = decodeBase64("APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64");

scripts/mobile/create-ios-release-manifest.mjs

@@ -0,0 +1,36 @@
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { env, exit } from "node:process";
+
+const required = (name) => {
+  if (!env[name]) throw new Error(`Missing ${name}`);
+  return env[name];
+};
+
+try {
+  const ipaPath = required("IOS_IPA_PATH");
+  const output = env.IOS_RELEASE_MANIFEST_PATH || "output/ios-release/ios-release-manifest.json";
+  const manifest = {
+    schemaVersion: 1,
+    repository: required("GITHUB_REPOSITORY"),
+    sourceSha: required("IOS_SOURCE_SHA").toLowerCase(),
+    marketingVersion: required("IOS_MARKETING_VERSION"),
+    buildNumber: required("IOS_BUILD_NUMBER"),
+    appStoreBuildId: required("APP_STORE_BUILD_ID"),
+    appStoreConnectAppId: required("APP_STORE_CONNECT_APP_ID"),
+    bundleId: required("IOS_BUNDLE_ID"),
+    xcodeVersion: required("XCODE_VERSION"),
+    sdkVersion: required("IOS_SDK_VERSION"),
+    workflowRunId: required("GITHUB_RUN_ID"),
+    workflowRunAttempt: required("GITHUB_RUN_ATTEMPT"),
+    ipaSha256: createHash("sha256").update(readFileSync(ipaPath)).digest("hex"),
+    createdAt: new Date().toISOString(),
+  };
+  mkdirSync(dirname(output), { recursive: true });
+  writeFileSync(output, `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o600 });
+  console.log(`Created ${output}.`);
+} catch (error) {
+  console.error(error instanceof Error ? error.message : error);
+  exit(1);
+}

scripts/mobile/generate-android-icons.mjs

@@ -6,8 +6,10 @@ import Jimp from "jimp";
 
 const projectRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
 const sourcePath = path.join(projectRoot, "public/favicons/web-app-manifest-512x512.png");
+const iosIconDirectory = path.join(projectRoot, "ios/App/App/Assets.xcassets/AppIcon.appiconset");
+const iosContentsPath = path.join(iosIconDirectory, "Contents.json");
 const checkOnly = process.argv.includes("--check");
-const launcherBackground = "#0787BB";
+const launcherBackground = "#FFFFFF";
 
 const densityScale = {
   mdpi: 1,
@@ -18,9 +20,9 @@ const densityScale = {
 };
 
 const targets = [
-  { relativePath: "public/icons/icon-512x512.png", size: 512, copySource: true },
+  { relativePath: "public/icons/icon-512x512.png", size: 512 },
   { relativePath: "public/icons/icon-192x192.png", size: 192 },
-  { relativePath: "store_icon.png", size: 512, copySource: true },
+  { relativePath: "store_icon.png", size: 512 },
 ];
 
 for (const [density, scale] of Object.entries(densityScale)) {
@@ -38,6 +40,7 @@ for (const [density, scale] of Object.entries(densityScale)) {
     {
       relativePath: `android/app/src/main/res/mipmap-${density}/ic_launcher_foreground.png`,
       size: foregroundSize,
+      safeZone: true,
     },
   );
 }
@@ -81,8 +84,19 @@ async function writeIfChanged(relativePath, content) {
   return true;
 }
 
-async function renderPng(sourceImage, size) {
-  const image = sourceImage.clone().resize(size, size, Jimp.RESIZE_BICUBIC);
+async function renderPng(sourceImage, size, safeZone = false) {
+  const image = new Jimp(size, size, launcherBackground);
+  const artworkSize = safeZone ? Math.round(size * 0.72) : size;
+  const artwork = sourceImage.clone();
+  if (artwork.bitmap.width !== artworkSize || artwork.bitmap.height !== artworkSize) {
+    artwork.resize(artworkSize, artworkSize, Jimp.RESIZE_BICUBIC);
+  }
+  const offset = Math.round((size - artworkSize) / 2);
+  image.composite(artwork, offset, offset);
+  image.scan(0, 0, size, size, (_x, _y, index) => {
+    image.bitmap.data[index + 3] = 255;
+  });
+  image.colorType(2);
   return image.getBufferAsync(Jimp.MIME_PNG);
 }
 
@@ -94,10 +108,20 @@ async function main() {
     throw new Error(`Expected ${path.relative(projectRoot, sourcePath)} to be a 512x512 PNG.`);
   }
 
+  const iosContents = JSON.parse(await fs.readFile(iosContentsPath, "utf8"));
+  const iosTargets = iosContents.images.map(({ filename, scale, size }) => ({
+    relativePath: path.relative(projectRoot, path.join(iosIconDirectory, filename)),
+    size: Math.round(Number.parseFloat(size) * Number.parseFloat(scale)),
+  }));
+  iosTargets.push({
+    relativePath: path.relative(projectRoot, path.join(iosIconDirectory, "AppIcon-512@2x.png")),
+    size: 1024,
+  });
+  const imageTargets = [...targets, ...iosTargets];
   const changed = [];
 
-  for (const target of targets) {
-    const buffer = target.copySource ? sourceBuffer : await renderPng(sourceImage, target.size);
+  for (const target of imageTargets) {
+    const buffer = await renderPng(sourceImage, target.size, target.safeZone);
     if (await writeIfChanged(target.relativePath, buffer)) {
       changed.push(target.relativePath);
     }
@@ -110,12 +134,12 @@ async function main() {
   }
 
   if (changed.length === 0) {
-    console.log(`Android icon assets are current (${targets.length + xmlTargets.length} files).`);
+    console.log(`Mobile icon assets are current (${imageTargets.length + xmlTargets.length} files).`);
     return;
   }
 
   if (checkOnly) {
-    console.error("Android icon assets are out of date:");
+    console.error("Mobile icon assets are out of date:");
     for (const relativePath of changed) {
       console.error(`- ${relativePath}`);
     }
@@ -124,7 +148,7 @@ async function main() {
     return;
   }
 
-  console.log(`Updated ${changed.length} Android icon asset${changed.length === 1 ? "" : "s"}.`);
+  console.log(`Updated ${changed.length} mobile icon asset${changed.length === 1 ? "" : "s"}.`);
 }
 
 main().catch((error) => {

scripts/mobile/validate-app-store.mjs

@@ -0,0 +1,165 @@
+import { createHash } from "node:crypto";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { basename, extname, join, relative } from "node:path";
+import { argv, exit } from "node:process";
+
+const strict = argv.includes("--strict");
+const failures = [];
+const warnings = [];
+const root = process.cwd();
+const metadataRoot = join(root, "fastlane/metadata/da-DK");
+const screenshotRoot = join(root, "fastlane/screenshots/da-DK");
+
+const fail = (message) => failures.push(message);
+const warn = (message) => warnings.push(message);
+const readText = (path) => {
+  if (!existsSync(path)) {
+    fail(`Missing ${relative(root, path)}`);
+    return "";
+  }
+  const value = readFileSync(path, "utf8").trim();
+  if (!value) fail(`${relative(root, path)} must not be empty`);
+  return value;
+};
+
+let release;
+try {
+  release = JSON.parse(readFileSync(join(root, "ios/release.json"), "utf8"));
+} catch {
+  fail("ios/release.json must be valid JSON");
+  release = {};
+}
+if (!/^\d+\.\d+\.\d+$/.test(release.marketingVersion ?? "")) {
+  fail("ios/release.json marketingVersion must be numeric SemVer (X.Y.Z)");
+}
+if (release.bundleId !== "io.truckwash.app") fail("ios/release.json bundleId must be io.truckwash.app");
+if (release.minimumIosVersion !== "15.0")
+  fail("ios/release.json minimumIosVersion must remain 15.0 unless compatibility is intentionally changed");
+
+const name = readText(join(metadataRoot, "name.txt"));
+const subtitle = readText(join(metadataRoot, "subtitle.txt"));
+const promotionalText = readText(join(metadataRoot, "promotional_text.txt"));
+const keywords = readText(join(metadataRoot, "keywords.txt"));
+const description = readText(join(metadataRoot, "description.txt"));
+readText(join(metadataRoot, "release_notes.txt"));
+readText(join(root, "fastlane/metadata/copyright.txt"));
+
+if ([...name].length > 30) fail("App Store name exceeds 30 characters");
+if ([...subtitle].length > 30) fail("App Store subtitle exceeds 30 characters");
+if ([...promotionalText].length > 170) fail("Promotional text exceeds 170 characters");
+if (Buffer.byteLength(keywords, "utf8") > 100) fail("Keywords exceed Apple's 100-byte limit");
+if ([...description].length > 4000) fail("Description exceeds 4,000 characters");
+
+for (const file of ["support_url.txt", "privacy_url.txt", "marketing_url.txt"]) {
+  const value = readText(join(metadataRoot, file));
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "https:") fail(`${file} must use HTTPS`);
+  } catch {
+    fail(`${file} must contain a valid URL`);
+  }
+}
+
+const knownCapacitorArtwork = new Set([
+  "29e4777e319de3ee5a52c3a8004ec19d0568414004257e36d7c94a077d71c93b",
+  "1b5002b74a5500e697298ced06ca2811ac33f2771f236f3c720ff23243890530",
+]);
+for (const path of [
+  join(root, "ios/App/App/Assets.xcassets/AppIcon.appiconset/AppIcon-512@2x.png"),
+  join(root, "ios/App/App/Assets.xcassets/Splash.imageset/splash-2732x2732.png"),
+]) {
+  if (!existsSync(path)) {
+    fail(`Missing ${relative(root, path)}`);
+    continue;
+  }
+  const digest = createHash("sha256").update(readFileSync(path)).digest("hex");
+  if (knownCapacitorArtwork.has(digest)) {
+    fail(`${relative(root, path)} is still the default Capacitor artwork`);
+  }
+}
+
+const pngInfo = (buffer) => {
+  if (buffer.length < 33 || buffer.subarray(1, 4).toString("ascii") !== "PNG") return null;
+  const colorType = buffer[25];
+  return {
+    width: buffer.readUInt32BE(16),
+    height: buffer.readUInt32BE(20),
+    hasAlpha: colorType === 4 || colorType === 6,
+  };
+};
+
+const jpegInfo = (buffer) => {
+  if (buffer.length < 4 || buffer[0] !== 0xff || buffer[1] !== 0xd8) return null;
+  let offset = 2;
+  while (offset + 9 < buffer.length) {
+    if (buffer[offset] !== 0xff) {
+      offset += 1;
+      continue;
+    }
+    const marker = buffer[offset + 1];
+    if (marker === 0xd8 || marker === 0xd9) {
+      offset += 2;
+      continue;
+    }
+    const length = buffer.readUInt16BE(offset + 2);
+    if (length < 2 || offset + 2 + length > buffer.length) break;
+    if ([0xc0, 0xc1, 0xc2, 0xc3, 0xc5, 0xc6, 0xc7, 0xc9, 0xca, 0xcb, 0xcd, 0xce, 0xcf].includes(marker)) {
+      return { width: buffer.readUInt16BE(offset + 7), height: buffer.readUInt16BE(offset + 5), hasAlpha: false };
+    }
+    offset += 2 + length;
+  }
+  return null;
+};
+
+const screenshots = existsSync(screenshotRoot)
+  ? readdirSync(screenshotRoot)
+      .filter((file) => [".png", ".jpg", ".jpeg"].includes(extname(file).toLowerCase()))
+      .map((file) => join(screenshotRoot, file))
+  : [];
+const groups = { iphone: [], ipad: [] };
+const hashes = new Map();
+for (const path of screenshots) {
+  const filename = basename(path);
+  const group = filename.startsWith("iphone-6.9-") ? "iphone" : filename.startsWith("ipad-13-") ? "ipad" : null;
+  if (!group) {
+    fail(`${filename} must start with iphone-6.9- or ipad-13-`);
+    continue;
+  }
+  if (statSync(path).size === 0) {
+    fail(`${filename} is empty`);
+    continue;
+  }
+  const buffer = readFileSync(path);
+  const info = pngInfo(buffer) ?? jpegInfo(buffer);
+  if (!info) {
+    fail(`${filename} is not a readable PNG or JPEG`);
+    continue;
+  }
+  const expected = group === "iphone" ? [1320, 2868] : [2064, 2752];
+  if (info.width !== expected[0] || info.height !== expected[1]) {
+    fail(`${filename} is ${info.width}x${info.height}; expected ${expected[0]}x${expected[1]}`);
+  }
+  if (info.hasAlpha) fail(`${filename} has an alpha channel, which App Store screenshots must not use`);
+  const digest = createHash("sha256").update(buffer).digest("hex");
+  if (hashes.has(digest)) fail(`${filename} duplicates ${hashes.get(digest)}`);
+  hashes.set(digest, filename);
+  groups[group].push(filename);
+}
+
+for (const [group, files] of Object.entries(groups)) {
+  if (files.length !== 6) {
+    const message = `Expected 6 ${group === "iphone" ? "iPhone 6.9-inch" : "iPad 13-inch"} screenshots; found ${
+      files.length
+    }`;
+    if (strict) fail(message);
+    else warn(message);
+  }
+}
+
+for (const message of warnings) console.warn(`Storefront readiness warning: ${message}`);
+if (failures.length > 0) {
+  console.error("App Store validation failed:");
+  for (const message of failures) console.error(`- ${message}`);
+  exit(1);
+}
+console.log(`App Store metadata is valid${strict ? " and candidate assets are complete" : ""}.`);

scripts/mobile/verify-store-test-gate.mjs

@@ -0,0 +1,341 @@
+import { execFile } from "node:child_process";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { promisify } from "node:util";
+import { loadRepositoryTestGraph } from "../test-graph/load-graph.mjs";
+import { DEPENDENCY_CI_ARTIFACT_PREFIX, DEPENDENCY_CI_RESULT_FILE } from "../test-graph/result-schema.mjs";
+import { evaluatePlatformResult, normalizeStorePlatform } from "../test-graph/verify-platform-result.mjs";
+
+const execFileAsync = promisify(execFile);
+const requiredRoles = ["superuser", "admin", "customer", "subuser"];
+
+function normalizePlatform(platform) {
+  return normalizeStorePlatform(platform);
+}
+
+function platformBrowserLabel(platform) {
+  return normalizePlatform(platform) === "android" ? "Chromium" : "WebKit";
+}
+
+function required(value, name) {
+  const normalized = String(value || "").trim();
+  if (!normalized) {
+    throw new Error(`${name} is required.`);
+  }
+  return normalized;
+}
+
+function assertFullSha(value) {
+  const normalized = required(value, "source SHA").toLowerCase();
+  if (!/^[0-9a-f]{40}$/u.test(normalized)) {
+    throw new Error("source SHA must be a full lowercase commit SHA.");
+  }
+  return normalized;
+}
+
+function succeeded(job) {
+  return job?.status === "completed" && job?.conclusion === "success";
+}
+
+function requiredCiFailures(jobs) {
+  const matches = (jobs || []).filter((job) => job?.name === "Required CI");
+  if (matches.length !== 1) {
+    return [`Required CI:${matches.length === 0 ? "missing" : "ambiguous"}`];
+  }
+  return succeeded(matches[0])
+    ? []
+    : [`Required CI:${matches[0].status || "unknown"}/${matches[0].conclusion || "none"}`];
+}
+
+export function evaluateDependencyManifest(platform, manifest, jobs = [], graph) {
+  const evaluated = evaluatePlatformResult(platform, manifest, graph);
+  const failures = [...requiredCiFailures(jobs), ...evaluated.failures];
+  return {
+    lane: evaluated.lanes[0],
+    lanes: evaluated.lanes,
+    required: evaluated.required,
+    failures,
+    passed: failures.length === 0,
+    source: "manifest",
+  };
+}
+
+export function expectedLegacyStoreGateJobs(platform) {
+  const browser = platformBrowserLabel(platform);
+  return requiredRoles.map((role) => `E2E-full-${browser}-mobile-${role}`);
+}
+
+export function evaluateLegacyStoreGate(platform, jobs = []) {
+  const browser = platformBrowserLabel(platform);
+  const failures = requiredCiFailures(jobs);
+  const required = [];
+
+  for (const role of requiredRoles) {
+    const prefix = `E2E-full-${browser}-mobile-${role}`;
+    const matches = jobs.filter((job) => job?.name === prefix || job?.name?.startsWith(`${prefix}-`));
+    if (matches.length === 0) {
+      failures.push(`${prefix}:missing`);
+      continue;
+    }
+
+    const exact = matches.filter((job) => job.name === prefix);
+    const shards = matches
+      .map((job) => ({ job, match: job.name.match(new RegExp(`^${prefix}-(\\d+)of(\\d+)$`, "u")) }))
+      .filter(({ match }) => match);
+    if (exact.length === 1 && shards.length === 0) {
+      required.push(prefix);
+      if (!succeeded(exact[0])) {
+        failures.push(`${prefix}:${exact[0].status || "unknown"}/${exact[0].conclusion || "none"}`);
+      }
+      continue;
+    }
+    if (exact.length > 0 || shards.length !== matches.length) {
+      failures.push(`${prefix}:ambiguous legacy jobs`);
+      continue;
+    }
+
+    const shardTotals = new Set(shards.map(({ match }) => Number(match[2])));
+    if (shardTotals.size !== 1) {
+      failures.push(`${prefix}:inconsistent shard totals`);
+      continue;
+    }
+    const total = [...shardTotals][0];
+    const byIndex = new Map(shards.map(({ job, match }) => [Number(match[1]), job]));
+    for (let shard = 1; shard <= total; shard += 1) {
+      const job = byIndex.get(shard);
+      const name = `${prefix}-${shard}of${total}`;
+      required.push(name);
+      if (!job) {
+        failures.push(`${name}:missing`);
+      } else if (!succeeded(job)) {
+        failures.push(`${name}:${job.status || "unknown"}/${job.conclusion || "none"}`);
+      }
+    }
+  }
+
+  return { required, failures, passed: failures.length === 0, source: "legacy" };
+}
+
+function parseArgs(argv) {
+  const args = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const value = argv[index];
+    if (!value.startsWith("--")) {
+      throw new Error(`Unexpected argument: ${value}`);
+    }
+    const [rawName, inlineValue] = value.slice(2).split("=", 2);
+    const nextValue = inlineValue ?? argv[index + 1];
+    if (inlineValue === undefined) {
+      index += 1;
+    }
+    args[rawName] = nextValue;
+  }
+  return args;
+}
+
+function createGitHubClient({ apiUrl, repository, token, fetchImpl = fetch }) {
+  const baseUrl = `${required(apiUrl, "GitHub API URL").replace(/\/$/u, "")}/repos/${required(
+    repository,
+    "GitHub repository"
+  )}`;
+  const headers = {
+    Accept: "application/vnd.github+json",
+    Authorization: `Bearer ${required(token, "GitHub token")}`,
+    "X-GitHub-Api-Version": "2022-11-28",
+  };
+
+  const request = async (requestPath, binary = false) => {
+    const response = await fetchImpl(`${baseUrl}${requestPath}`, { headers });
+    if (!response.ok) {
+      throw new Error(`GitHub API ${response.status} for ${requestPath}: ${await response.text()}`);
+    }
+    return binary ? Buffer.from(await response.arrayBuffer()) : response.json();
+  };
+  return { request };
+}
+
+function validateRun(run, { sourceSha, defaultBranch }) {
+  if (run?.name !== "Automated Tests") {
+    throw new Error(`Run ${run?.id || "<unknown>"} is not the Automated Tests workflow.`);
+  }
+  if (run.head_sha !== sourceSha) {
+    throw new Error(`Run ${run.id} tested ${run.head_sha || "<unknown>"}, not ${sourceSha}.`);
+  }
+  if (run.event !== "push" || run.head_branch !== defaultBranch) {
+    throw new Error(`Run ${run.id} is not a push run for ${defaultBranch}.`);
+  }
+  if (run.status !== "completed") {
+    throw new Error(`Run ${run.id} is not complete.`);
+  }
+  return run;
+}
+
+async function resolveTestRun(client, { runId, sourceSha, defaultBranch }) {
+  if (runId) {
+    return validateRun(await client.request(`/actions/runs/${encodeURIComponent(runId)}`), {
+      sourceSha,
+      defaultBranch,
+    });
+  }
+
+  const query = new URLSearchParams({
+    branch: defaultBranch,
+    event: "push",
+    status: "completed",
+    per_page: "100",
+  });
+  const response = await client.request(`/actions/workflows/tests.yml/runs?${query}`);
+  const run = response.workflow_runs?.find((candidate) => candidate.head_sha === sourceSha);
+  if (!run) {
+    throw new Error(`No completed Automated Tests push run was found for ${sourceSha} on ${defaultBranch}.`);
+  }
+  return validateRun(run, { sourceSha, defaultBranch });
+}
+
+async function readLatestAttemptJobs(client, runId) {
+  const jobs = [];
+  for (let page = 1; ; page += 1) {
+    const query = new URLSearchParams({ filter: "latest", per_page: "100", page: String(page) });
+    const response = await client.request(`/actions/runs/${encodeURIComponent(runId)}/jobs?${query}`);
+    const pageJobs = response.jobs || [];
+    jobs.push(...pageJobs);
+    if (pageJobs.length < 100) {
+      return jobs;
+    }
+  }
+}
+
+async function findManifestArtifact(client, runId, sourceSha) {
+  const artifacts = [];
+  for (let page = 1; ; page += 1) {
+    const query = new URLSearchParams({ per_page: "100", page: String(page) });
+    const response = await client.request(`/actions/runs/${encodeURIComponent(runId)}/artifacts?${query}`);
+    const pageArtifacts = (response.artifacts || []).filter(
+      (artifact) => !artifact.expired && artifact.name?.startsWith(DEPENDENCY_CI_ARTIFACT_PREFIX)
+    );
+    artifacts.push(...pageArtifacts);
+    if ((response.artifacts || []).length < 100) {
+      break;
+    }
+  }
+  if (artifacts.length === 0) {
+    return null;
+  }
+  const exactName = `${DEPENDENCY_CI_ARTIFACT_PREFIX}${sourceSha}`;
+  const candidates = artifacts
+    .map((artifact) => {
+      if (artifact.name === exactName) return { artifact, attempt: 0 };
+      const match = artifact.name.match(new RegExp(`^${exactName}-(\\d+)$`, "u"));
+      return match ? { artifact, attempt: Number(match[1]) } : null;
+    })
+    .filter(Boolean)
+    .sort((left, right) => right.attempt - left.attempt || Number(right.artifact.id) - Number(left.artifact.id));
+  if (
+    candidates.length === 0 ||
+    candidates.filter((candidate) => candidate.attempt === candidates[0].attempt).length > 1
+  ) {
+    throw new Error(`Automated Tests run ${runId} has ambiguous dependency result artifacts.`);
+  }
+  return candidates[0].artifact;
+}
+
+async function downloadManifest(client, artifact, extractManifest) {
+  const zip = await client.request(`/actions/artifacts/${encodeURIComponent(artifact.id)}/zip`, true);
+  if (extractManifest) {
+    return extractManifest(zip, artifact);
+  }
+
+  const directory = await mkdtemp(path.join(tmpdir(), "dependency-ci-results-"));
+  const zipPath = path.join(directory, "results.zip");
+  try {
+    await writeFile(zipPath, zip, { mode: 0o600 });
+    const { stdout } = await execFileAsync("unzip", ["-p", zipPath, DEPENDENCY_CI_RESULT_FILE], {
+      encoding: "utf8",
+      maxBuffer: 16 * 1024 * 1024,
+    });
+    return JSON.parse(stdout);
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+}
+
+export async function verifyStoreTestGate({
+  platform,
+  sourceSha,
+  runId,
+  defaultBranch = "master",
+  apiUrl = "https://api.github.com",
+  repository,
+  token,
+  fetchImpl,
+  extractManifest,
+  manifestPath,
+}) {
+  const normalizedPlatform = normalizePlatform(platform);
+  const normalizedSha = assertFullSha(sourceSha);
+  const client = createGitHubClient({ apiUrl, repository, token, fetchImpl });
+  const run = await resolveTestRun(client, {
+    runId: String(runId || "").trim(),
+    sourceSha: normalizedSha,
+    defaultBranch: required(defaultBranch, "default branch"),
+  });
+  const jobs = await readLatestAttemptJobs(client, run.id);
+  const { graph } = await loadRepositoryTestGraph(process.cwd());
+
+  let manifest = null;
+  let artifact = null;
+  if (manifestPath) {
+    manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+  } else {
+    artifact = await findManifestArtifact(client, run.id, normalizedSha);
+    if (artifact) {
+      manifest = await downloadManifest(client, artifact, extractManifest);
+    }
+  }
+
+  if (manifest && manifest.sourceSha !== normalizedSha) {
+    throw new Error(`Dependency result manifest is for ${manifest.sourceSha || "<unknown>"}, not ${normalizedSha}.`);
+  }
+  const result = manifest
+    ? evaluateDependencyManifest(normalizedPlatform, manifest, jobs, graph)
+    : evaluateLegacyStoreGate(normalizedPlatform, jobs);
+  if (!result.passed) {
+    throw new Error(
+      `${normalizedPlatform} store test gate failed for Automated Tests run ${run.id}: ${result.failures.join(", ")}`
+    );
+  }
+  return {
+    ...result,
+    runId: run.id,
+    sourceSha: normalizedSha,
+    artifactName: artifact?.name || null,
+  };
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const result = await verifyStoreTestGate({
+    platform: args.platform,
+    sourceSha: args["source-sha"] || process.env.STORE_SOURCE_SHA,
+    runId: args["run-id"] || process.env.TEST_WORKFLOW_RUN_ID,
+    defaultBranch: args["default-branch"] || process.env.DEFAULT_BRANCH || "master",
+    apiUrl: process.env.GITHUB_API_URL,
+    repository: process.env.GITHUB_REPOSITORY,
+    token: process.env.GH_TOKEN,
+    manifestPath: args.manifest,
+  });
+  console.log(
+    `${args.platform} store gate passed for Automated Tests run ${result.runId} using ${
+      result.source
+    }: ${result.required.join(", ")}`
+  );
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  await main().catch((error) => {
+    console.error(error instanceof Error ? error.message : error);
+    process.exitCode = 1;
+  });
+}