Merge pull request 'KAN-65: Prepare macOS 0.1.5 build 5' (#163) from feature/KAN-65-release-0-1-5 into main

Reviewed-on: #163

.agents/skills/inertia-vue-development/SKILL.md

@@ -1,394 +0,0 @@
----
-name: inertia-vue-development
-description: "Develops Inertia.js v2 Vue client-side applications. Activates when creating Vue pages, forms, or navigation; using <Link>, <Form>, useForm, or router; working with deferred props, prefetching, or polling; or when user mentions Vue with Inertia, Vue pages, Vue forms, or Vue navigation."
-license: MIT
-metadata:
-  author: laravel
----
-
-# Inertia Vue Development
-
-## When to Apply
-
-Activate this skill when:
-
-- Creating or modifying Vue page components for Inertia
-- Working with forms in Vue (using `<Form>` or `useForm`)
-- Implementing client-side navigation with `<Link>` or `router`
-- Using v2 features: deferred props, prefetching, WhenVisible, InfiniteScroll, once props, flash data, or polling
-- Building Vue-specific features with the Inertia protocol
-
-## Documentation
-
-Use `search-docs` for detailed Inertia v2 Vue patterns and documentation.
-
-## Basic Usage
-
-### Page Components Location
-
-Vue page components should be placed in the `resources/js/pages` directory.
-
-### Page Component Structure
-
-<!-- Basic Vue Page Component -->
-```vue
-<script setup>
-defineProps({
-    users: Array
-})
-</script>
-
-<template>
-    <div>
-        <h1>Users</h1>
-        <ul>
-            <li v-for="user in users" :key="user.id">
-                {{ user.name }}
-            </li>
-        </ul>
-    </div>
-</template>
-```
-
-## Client-Side Navigation
-
-### Basic Link Component
-
-Use `<Link>` for client-side navigation instead of traditional `<a>` tags:
-
-<!-- Inertia Vue Navigation -->
-```vue
-<script setup>
-import { Link } from '@inertiajs/vue3'
-</script>
-
-<template>
-    <div>
-        <Link href="/">Home</Link>
-        <Link href="/users">Users</Link>
-        <Link :href="`/users/${user.id}`">View User</Link>
-    </div>
-</template>
-```
-
-### Link with Method
-
-<!-- Link with POST Method -->
-```vue
-<script setup>
-import { Link } from '@inertiajs/vue3'
-</script>
-
-<template>
-    <Link href="/logout" method="post" as="button">
-        Logout
-    </Link>
-</template>
-```
-
-### Prefetching
-
-Prefetch pages to improve perceived performance:
-
-<!-- Prefetch on Hover -->
-```vue
-<script setup>
-import { Link } from '@inertiajs/vue3'
-</script>
-
-<template>
-    <Link href="/users" prefetch>
-        Users
-    </Link>
-</template>
-```
-
-### Programmatic Navigation
-
-<!-- Router Visit -->
-```vue
-<script setup>
-import { router } from '@inertiajs/vue3'
-
-function handleClick() {
-    router.visit('/users')
-}
-
-// Or with options
-function createUser() {
-    router.visit('/users', {
-        method: 'post',
-        data: { name: 'John' },
-        onSuccess: () => console.log('Done'),
-    })
-}
-</script>
-
-<template>
-    <Link href="/users">Users</Link>
-    <Link href="/logout" method="post" as="button">Logout</Link>
-</template>
-```
-
-## Form Handling
-
-### Form Component (Recommended)
-
-The recommended way to build forms is with the `<Form>` component:
-
-<!-- Form Component Example -->
-```vue
-<script setup>
-import { Form } from '@inertiajs/vue3'
-</script>
-
-<template>
-    <Form action="/users" method="post" #default="{ errors, processing, wasSuccessful }">
-        <input type="text" name="name" />
-        <div v-if="errors.name">{{ errors.name }}</div>
-
-        <input type="email" name="email" />
-        <div v-if="errors.email">{{ errors.email }}</div>
-
-        <button type="submit" :disabled="processing">
-            {{ processing ? 'Creating...' : 'Create User' }}
-        </button>
-
-        <div v-if="wasSuccessful">User created!</div>
-    </Form>
-</template>
-```
-
-### Form Component With All Props
-
-<!-- Form Component Full Example -->
-```vue
-<script setup>
-import { Form } from '@inertiajs/vue3'
-</script>
-
-<template>
-    <Form
-        action="/users"
-        method="post"
-        #default="{
-            errors,
-            hasErrors,
-            processing,
-            progress,
-            wasSuccessful,
-            recentlySuccessful,
-            setError,
-            clearErrors,
-            resetAndClearErrors,
-            defaults,
-            isDirty,
-            reset,
-            submit
-        }"
-    >
-        <input type="text" name="name" :value="defaults.name" />
-        <div v-if="errors.name">{{ errors.name }}</div>
-
-        <button type="submit" :disabled="processing">
-            {{ processing ? 'Saving...' : 'Save' }}
-        </button>
-
-        <progress v-if="progress" :value="progress.percentage" max="100">
-            {{ progress.percentage }}%
-        </progress>
-
-        <div v-if="wasSuccessful">Saved!</div>
-    </Form>
-</template>
-```
-
-### Form Component Reset Props
-
-The `<Form>` component supports automatic resetting:
-
-- `resetOnError` - Reset form data when the request fails
-- `resetOnSuccess` - Reset form data when the request succeeds
-- `setDefaultsOnSuccess` - Update default values on success
-
-Use the `search-docs` tool with a query of `form component resetting` for detailed guidance.
-
-<!-- Form with Reset Props -->
-```vue
-<script setup>
-import { Form } from '@inertiajs/vue3'
-</script>
-
-<template>
-    <Form
-        action="/users"
-        method="post"
-        reset-on-success
-        set-defaults-on-success
-        #default="{ errors, processing, wasSuccessful }"
-    >
-        <input type="text" name="name" />
-        <div v-if="errors.name">{{ errors.name }}</div>
-
-        <button type="submit" :disabled="processing">
-            Submit
-        </button>
-    </Form>
-</template>
-```
-
-Forms can also be built using the `useForm` composable for more programmatic control. Use the `search-docs` tool with a query of `useForm helper` for guidance.
-
-### `useForm` Composable
-
-For more programmatic control or to follow existing conventions, use the `useForm` composable:
-
-<!-- useForm Composable Example -->
-```vue
-<script setup>
-import { useForm } from '@inertiajs/vue3'
-
-const form = useForm({
-    name: '',
-    email: '',
-    password: '',
-})
-
-function submit() {
-    form.post('/users', {
-        onSuccess: () => form.reset('password'),
-    })
-}
-</script>
-
-<template>
-    <form @submit.prevent="submit">
-        <input type="text" v-model="form.name" />
-        <div v-if="form.errors.name">{{ form.errors.name }}</div>
-
-        <input type="email" v-model="form.email" />
-        <div v-if="form.errors.email">{{ form.errors.email }}</div>
-
-        <input type="password" v-model="form.password" />
-        <div v-if="form.errors.password">{{ form.errors.password }}</div>
-
-        <button type="submit" :disabled="form.processing">
-            Create User
-        </button>
-    </form>
-</template>
-```
-
-## Inertia v2 Features
-
-### Deferred Props
-
-Use deferred props to load data after initial page render:
-
-<!-- Deferred Props with Empty State -->
-```vue
-<script setup>
-defineProps({
-    users: Array
-})
-</script>
-
-<template>
-    <div>
-        <h1>Users</h1>
-        <div v-if="!users" class="animate-pulse">
-            <div class="h-4 bg-gray-200 rounded w-3/4 mb-2"></div>
-            <div class="h-4 bg-gray-200 rounded w-1/2"></div>
-        </div>
-        <ul v-else>
-            <li v-for="user in users" :key="user.id">
-                {{ user.name }}
-            </li>
-        </ul>
-    </div>
-</template>
-```
-
-### Polling
-
-Automatically refresh data at intervals:
-
-<!-- Polling Example -->
-```vue
-<script setup>
-import { router } from '@inertiajs/vue3'
-import { onMounted, onUnmounted } from 'vue'
-
-defineProps({
-    stats: Object
-})
-
-let interval
-
-onMounted(() => {
-    interval = setInterval(() => {
-        router.reload({ only: ['stats'] })
-    }, 5000) // Poll every 5 seconds
-})
-
-onUnmounted(() => {
-    clearInterval(interval)
-})
-</script>
-
-<template>
-    <div>
-        <h1>Dashboard</h1>
-        <div>Active Users: {{ stats.activeUsers }}</div>
-    </div>
-</template>
-```
-
-### WhenVisible
-
-Lazy-load a prop when an element scrolls into view. Useful for deferring expensive data that sits below the fold:
-
-<!-- WhenVisible Example -->
-```vue
-<script setup>
-import { WhenVisible } from '@inertiajs/vue3'
-
-defineProps({
-    stats: Object
-})
-</script>
-
-<template>
-    <div>
-        <h1>Dashboard</h1>
-
-        <!-- stats prop is loaded only when this section scrolls into view -->
-        <WhenVisible data="stats" :buffer="200">
-            <template #fallback>
-                <div class="animate-pulse">Loading stats...</div>
-            </template>
-
-            <template #default="{ fetching }">
-                <div>
-                    <p>Total Users: {{ stats.total_users }}</p>
-                    <p>Revenue: {{ stats.revenue }}</p>
-                    <span v-if="fetching">Refreshing...</span>
-                </div>
-            </template>
-        </WhenVisible>
-    </div>
-</template>
-```
-
-## Server-Side Patterns
-
-Server-side patterns (Inertia::render, props, middleware) are covered in inertia-laravel guidelines.
-
-## Common Pitfalls
-
-- Using traditional `<a>` links instead of Inertia's `<Link>` component (breaks SPA behavior)
-- Forgetting that Vue components must have a single root element
-- Forgetting to add loading states (skeleton screens) when using deferred props
-- Not handling the `undefined` state of deferred props before data loads
-- Using `<form>` without preventing default submission (use `<Form>` component or `@submit.prevent`)
-- Forgetting to check if `<Form>` component is available in your Inertia version

.agents/skills/mcp-development/SKILL.md

@@ -0,0 +1,96 @@
+---
+name: mcp-development
+description: "Use this skill for Laravel MCP development only. Trigger when creating or editing MCP tools, resources, prompts, or servers in Laravel projects. Covers: artisan make:mcp-* generators, mcp:inspector, routes/ai.php, Tool/Resource/Prompt classes, schema validation, shouldRegister(), OAuth setup, URI templates, read-only attributes, and MCP debugging. Do not use for non-Laravel MCP projects or generic AI features without MCP."
+license: MIT
+metadata:
+  author: laravel
+---
+
+# MCP Development
+
+## Documentation
+
+Use `search-docs` for detailed Laravel MCP patterns and documentation.
+
+## Basic Usage
+
+Register MCP servers in `routes/ai.php`:
+
+<!-- Register MCP Server -->
+```php
+use Laravel\Mcp\Facades\Mcp;
+
+Mcp::web();
+```
+
+### Creating MCP Primitives
+
+Create MCP tools, resources, prompts, and servers using artisan commands:
+
+```bash
+php artisan make:mcp-tool ToolName        # Create a tool
+
+php artisan make:mcp-resource ResourceName # Create a resource
+
+php artisan make:mcp-prompt PromptName    # Create a prompt
+
+php artisan make:mcp-server ServerName    # Create a server
+
+```
+
+After creating primitives, register them in your server's `$tools`, `$resources`, or `$prompts` properties.
+
+### Tools
+
+<!-- MCP Tool Example -->
+```php
+use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Request;
+use Laravel\Mcp\Server\Response;
+
+class MyTool extends Tool
+{
+    public function handle(Request $request): Response
+    {
+        return new Response(['result' => 'success']);
+    }
+}
+```
+
+### Registering Primitives in a Server
+
+Each MCP server must explicitly declare the tools, resources, and prompts it exposes.
+
+<!-- Register Primitives in MCP Server -->
+```php
+use Laravel\Mcp\Server;
+
+class AppServer extends Server
+{
+    protected array $tools = [
+        \App\Mcp\Tools\MyTool::class,
+    ];
+
+    protected array $resources = [
+        \App\Mcp\Resources\MyResource::class,
+    ];
+
+    protected array $prompts = [
+        \App\Mcp\Prompts\MyPrompt::class,
+    ];
+}
+```
+
+## Verification
+
+1. Check `routes/ai.php` for proper registration
+2. Test tool via MCP client
+
+## Common Pitfalls
+
+- Running `mcp:start` command (it hangs waiting for input)
+- Using HTTPS locally with Node-based MCP clients
+- Not using `search-docs` for the latest MCP documentation
+- Not registering MCP server routes in `routes/ai.php`
+- Do not register `ai.php` in `bootstrap.php`; it is registered automatically.
+- OAuth registration supports custom URI schemes (e.g., `cursor://`, `vscode://`) for native desktop clients via `mcp.custom_schemes` config

.agents/skills/tailwindcss-development/SKILL.md

@@ -1,119 +0,0 @@
----
-name: tailwindcss-development
-description: "Always invoke when the user's message includes 'tailwind' in any form. Also invoke for: building responsive grid layouts (multi-column card grids, product grids), flex/grid page structures (dashboards with sidebars, fixed topbars, mobile-toggle navs), styling UI components (cards, tables, navbars, pricing sections, forms, inputs, badges), adding dark mode variants, fixing spacing or typography, and Tailwind v3/v4 work. The core use case: writing or fixing Tailwind utility classes in HTML templates (Blade, JSX, Vue). Skip for backend PHP logic, database queries, API routes, JavaScript with no HTML/CSS component, CSS file audits, build tool configuration, and vanilla CSS."
-license: MIT
-metadata:
-  author: laravel
----
-
-# Tailwind CSS Development
-
-## Documentation
-
-Use `search-docs` for detailed Tailwind CSS v4 patterns and documentation.
-
-## Basic Usage
-
-- Use Tailwind CSS classes to style HTML. Check and follow existing Tailwind conventions in the project before introducing new patterns.
-- Offer to extract repeated patterns into components that match the project's conventions (e.g., Blade, JSX, Vue).
-- Consider class placement, order, priority, and defaults. Remove redundant classes, add classes to parent or child elements carefully to reduce repetition, and group elements logically.
-
-## Tailwind CSS v4 Specifics
-
-- Always use Tailwind CSS v4 and avoid deprecated utilities.
-- `corePlugins` is not supported in Tailwind v4.
-
-### CSS-First Configuration
-
-In Tailwind v4, configuration is CSS-first using the `@theme` directive — no separate `tailwind.config.js` file is needed:
-
-<!-- CSS-First Config -->
-```css
-@theme {
-  --color-brand: oklch(0.72 0.11 178);
-}
-```
-
-### Import Syntax
-
-In Tailwind v4, import Tailwind with a regular CSS `@import` statement instead of the `@tailwind` directives used in v3:
-
-<!-- v4 Import Syntax -->
-```diff
-- @tailwind base;
-- @tailwind components;
-- @tailwind utilities;
-+ @import "tailwindcss";
-```
-
-### Replaced Utilities
-
-Tailwind v4 removed deprecated utilities. Use the replacements shown below. Opacity values remain numeric.
-
-| Deprecated | Replacement |
-|------------|-------------|
-| bg-opacity-* | bg-black/* |
-| text-opacity-* | text-black/* |
-| border-opacity-* | border-black/* |
-| divide-opacity-* | divide-black/* |
-| ring-opacity-* | ring-black/* |
-| placeholder-opacity-* | placeholder-black/* |
-| flex-shrink-* | shrink-* |
-| flex-grow-* | grow-* |
-| overflow-ellipsis | text-ellipsis |
-| decoration-slice | box-decoration-slice |
-| decoration-clone | box-decoration-clone |
-
-## Spacing
-
-Use `gap` utilities instead of margins for spacing between siblings:
-
-<!-- Gap Utilities -->
-```html
-<div class="flex gap-8">
-    <div>Item 1</div>
-    <div>Item 2</div>
-</div>
-```
-
-## Dark Mode
-
-If existing pages and components support dark mode, new pages and components must support it the same way, typically using the `dark:` variant:
-
-<!-- Dark Mode -->
-```html
-<div class="bg-white dark:bg-gray-900 text-gray-900 dark:text-white">
-    Content adapts to color scheme
-</div>
-```
-
-## Common Patterns
-
-### Flexbox Layout
-
-<!-- Flexbox Layout -->
-```html
-<div class="flex items-center justify-between gap-4">
-    <div>Left content</div>
-    <div>Right content</div>
-</div>
-```
-
-### Grid Layout
-
-<!-- Grid Layout -->
-```html
-<div class="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-6">
-    <div>Card 1</div>
-    <div>Card 2</div>
-    <div>Card 3</div>
-</div>
-```
-
-## Common Pitfalls
-
-- Using deprecated v3 utilities (bg-opacity-*, flex-shrink-*, etc.)
-- Using `@tailwind` directives instead of `@import "tailwindcss"`
-- Trying to use `tailwind.config.js` instead of CSS `@theme` directive
-- Using margins for spacing between siblings instead of gap utilities
-- Forgetting to add dark mode variants when the project uses dark mode

.agents/skills/wayfinder-development/SKILL.md

@@ -61,10 +61,14 @@ show(1, { query: { page: 1 } }) // "/posts/1?page=1"
 
 ## Wayfinder + Inertia
 
-Use Wayfinder with the `<Form>` component:
-<!-- Wayfinder Form (Vue) -->
-```vue
-<Form v-bind="store.form()"><input name="title" /></Form>
+Use Wayfinder with `useForm`:
+
+<!-- Wayfinder useForm -->
+```typescript
+import { store } from "@/actions/App/Http/Controllers/ExampleController";
+
+const form = useForm({ name: "My Big Post" });
+form.submit(store());
 ```
 
 ## Verification

.dockerignore

@@ -25,7 +25,6 @@
 **/compose.*.y*ml
 !**/composer.json
 !**/composer.lock
-**/Dockerfile*
 **/node_modules
 **/npm-debug.log
 **/obj
@@ -34,16 +33,17 @@
 vendor
 **/.DS_Store
 .editorconfig
-.env.example
-.env.mariadb
-.env.mariadb.example
 .env.production
 LICENSE
 README.md
 
-# Ignore development-related files and directories
-# For development environment, we will use mount bind to mount the source code to the container
-# So we don't need to copy the source code to the container for development
-tests/
-phpunit.xml
-phpunit.xml.dist
+# Runtime-generated data must not become part of an image layer.
+storage/framework/cache/data/*
+storage/framework/sessions/*
+storage/framework/testing/*
+storage/framework/views/*
+storage/logs/*
+
+# Native build artifacts are independent of the Laravel image.
+native/src-tauri/target
+native/src-tauri/gen

.env.example

@@ -10,7 +10,7 @@ APP_LOCALE=en
 APP_FALLBACK_LOCALE=en
 APP_FAKER_LOCALE=en_US
 
-LOG_STACK=daily
+LOG_STACK=stderr
 
 # Optional Discord error logging (append `,discord_errors` to LOG_STACK to enable it)
 LOG_DISCORD_WEBHOOK_URL=
@@ -38,6 +38,22 @@ MAIL_ENCRYPTION=tls
 MAIL_FROM_ADDRESS=no-reply@example.com
 MAIL_FROM_NAME="${APP_NAME}"
 
+CACHE_STORE=database
+QUEUE_CONNECTION=database
+SESSION_DRIVER=database
+
 FILESYSTEM_DISK=public
+AVATAR_FILESYSTEM_DISK=public
+AVATAR_URLS_TEMPORARY=false
+AVATAR_URL_EXPIRATION_MINUTES=15
+
+# Production: set AVATAR_FILESYSTEM_DISK=s3 and inject these as runtime secrets.
+AWS_ACCESS_KEY_ID=
+AWS_SECRET_ACCESS_KEY=
+AWS_DEFAULT_REGION=eu-central-1
+AWS_BUCKET=
+AWS_URL=
+AWS_ENDPOINT=
+AWS_USE_PATH_STYLE_ENDPOINT=false
 
 VITE_APP_NAME="${APP_NAME}"

.env.mariadb.example

@@ -1,4 +0,0 @@
-MARIADB_DATABASE=kanbangit
-MARIADB_USER=kanbangit
-MARIADB_PASSWORD=
-MARIADB_ROOT_PASSWORD=

.github/tests/test_and_check_app/action.yml

@@ -0,0 +1,78 @@
+name: "Lint and Test APP"
+description: "Run Pint and the Pest test suite"
+
+runs:
+  using: composite
+  steps:
+    - name: Setup PHP
+      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #v2.37.2
+      with:
+        php-version: "8.5"
+        extensions: mbstring, pdo_sqlite
+        coverage: none
+        tools: composer:v2
+
+    - name: Verify Composer lockfile
+      run: |
+        if [ ! -f composer.lock ]; then
+          echo "::error::composer.lock not found"
+          exit 1
+        fi
+      shell: bash
+
+    - name: Get Composer cache directory
+      id: composer_cache
+      run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
+      shell: bash
+
+    - name: Cache Composer packages
+      uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+      with:
+        path: ${{ steps.composer_cache.outputs.dir }}
+        key: ${{ runner.os }}-php-8.5-${{ hashFiles('composer.lock') }}
+
+    - name: Setup pnpm
+      uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v11.7.0
+      with:
+        package-json-file: package.json
+
+    - name: Setup Node.js
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      with:
+        node-version: 22
+        cache: "pnpm"
+        cache-dependency-path: "pnpm-lock.yaml"
+
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+      shell: bash
+
+    - name: Prepare environment file
+      run: cp .env.example .env
+      shell: bash
+
+    - name: Install dependencies
+      run: composer install --no-interaction --prefer-dist --no-progress
+      shell: bash
+
+    - name: Generate application key
+      run: php artisan key:generate
+      shell: bash
+
+    - name: Generate Wayfinder routes and actions
+      run: php artisan wayfinder:generate --with-form
+      shell: bash
+
+    - name: Run independent application checks
+      run: |
+        pnpm exec concurrently \
+          --names frontend,backend \
+          --prefix-colors cyan,magenta \
+          --kill-others-on-fail \
+          "composer run ci:frontend" \
+          "composer run ci:backend"
+      shell: bash
+
+    - name: Run Laravel tests
+      run: composer run ci:test
+      shell: bash

.github/workflows/ci_cd.yml

@@ -0,0 +1,147 @@
+name: CI/CD
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - "v*"
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+env:
+  REGISTRY: git.twyco.de
+
+jobs:
+  preconditions:
+    if: >
+      !(contains(github.event.head_commit.message, '[no-ci]') || contains(github.event.head_commit.message, '[skip-ci]'))
+    runs-on: ubuntu-latest
+    steps:
+      - name: Conditions met
+        run: |
+          echo "Conditions for CI/CD are met. Proceeding with the workflow."
+
+  test_and_check_app:
+    runs-on: ubuntu-latest
+    needs:
+      - preconditions
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+
+      - name: Run required application checks
+        uses: ./.github/tests/test_and_check_app
+
+  publish:
+    name: Publish immutable image
+    if: >-
+      github.event_name == 'push' &&
+      (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/'))
+    needs:
+      - preconditions
+      - test_and_check_app
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          fetch-depth: 0
+
+      - name: Validate ref and calculate image name
+        id: image
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+
+          image_path="$(printf '%s' "${GITHUB_REPOSITORY}" | tr '[:upper:]' '[:lower:]')"
+          image="${REGISTRY}/${image_path}"
+
+          case "${GITHUB_REF}" in
+            refs/heads/main)
+              printf -v run_attempt '%03d' "${GITHUB_RUN_ATTEMPT}"
+              tag="main-${GITHUB_RUN_NUMBER}-${run_attempt}-${GITHUB_SHA:0:12}"
+              environment="staging"
+              ;;
+            refs/tags/*)
+              tag="${GITHUB_REF#refs/tags/}"
+
+              if [[ ! "${tag}" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
+                echo "Production tags must match vMAJOR.MINOR.PATCH." >&2
+                exit 1
+              fi
+
+              git fetch --no-tags origin main:refs/remotes/origin/main
+
+              if ! git merge-base --is-ancestor "${GITHUB_SHA}" origin/main; then
+                echo "Production tag must point to a commit contained in main." >&2
+                exit 1
+              fi
+
+              environment="production"
+              ;;
+            *)
+              echo "Unsupported ref: ${GITHUB_REF}" >&2
+              exit 1
+              ;;
+          esac
+
+          {
+            echo "image=${image}"
+            echo "tag=${tag}"
+            echo "environment=${environment}"
+          } >> "${GITHUB_OUTPUT}"
+
+      - name: Log in to private registry
+        shell: bash
+        env:
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -Eeuo pipefail
+
+          if [[ -z "${REGISTRY_USERNAME}" || -z "${REGISTRY_TOKEN}" ]]; then
+            echo "Registry credentials are missing." >&2
+            exit 1
+          fi
+
+          printf '%s' "${REGISTRY_TOKEN}" |
+            docker login \
+              --username "${REGISTRY_USERNAME}" \
+              --password-stdin \
+              "${REGISTRY}"
+
+      - name: Build and publish runtime image
+        shell: bash
+        env:
+          IMAGE: ${{ steps.image.outputs.image }}
+          IMAGE_TAG: ${{ steps.image.outputs.tag }}
+          DEPLOYMENT_ENVIRONMENT: ${{ steps.image.outputs.environment }}
+        run: |
+          set -Eeuo pipefail
+
+          if [[ "${DEPLOYMENT_ENVIRONMENT}" == "production" ]] &&
+            docker buildx imagetools inspect "${IMAGE}:${IMAGE_TAG}" >/dev/null 2>&1; then
+            echo "Production image ${IMAGE}:${IMAGE_TAG} already exists and will not be overwritten." >&2
+            exit 1
+          fi
+
+          docker buildx build \
+            --file Dockerfile \
+            --target runtime \
+            --label "org.opencontainers.image.created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+            --label "org.opencontainers.image.revision=${GITHUB_SHA}" \
+            --label "org.opencontainers.image.source=${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" \
+            --label "de.twyco.environment=${DEPLOYMENT_ENVIRONMENT}" \
+            --tag "${IMAGE}:${IMAGE_TAG}" \
+            --push \
+            .
+
+      - name: Remove registry credentials
+        if: ${{ always() }}
+        shell: bash
+        run: docker logout "${REGISTRY}" >/dev/null 2>&1 || true

.github/workflows/lint.yml

@@ -1,39 +0,0 @@
-name: linter
-
-on:
-  push:
-    branches:
-      - main
-      - staging
-  pull_request:
-
-permissions:
-  contents: write
-
-jobs:
-  quality:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: '8.4'
-
-      - name: Install Dependencies
-        run: |
-          composer install -q --no-ansi --no-interaction --no-scripts --no-progress --prefer-dist
-          npm install
-
-      - name: Run Pint
-        run: composer lint
-
-      - name: Lint Frontend
-        run: npm run lint
-
-      # - name: Commit Changes
-      #   uses: stefanzweifel/git-auto-commit-action@v7
-      #   with:
-      #     commit_message: fix code style
-      #     commit_options: '--no-verify'

.github/workflows/macos-checks.yml

@@ -0,0 +1,58 @@
+name: macOS checks
+
+on:
+  push:
+    branches: [main]
+    paths: ["native/**", ".github/**", "package.json", "pnpm-lock.yaml", "eslint.config.mjs", "resources/css/app.css"]
+  pull_request:
+    paths: ["native/**", ".github/**", "package.json", "pnpm-lock.yaml", "eslint.config.mjs", "resources/css/app.css"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  macos:
+    name: Native Rust tests and unsigned build
+    runs-on: ${{ vars.MACOS_CHECK_RUNNER || vars.MACOS_RUNNER || 'macos-arm64' }}
+    timeout-minutes: 45
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v11.7.0
+        with:
+          package-json-file: package.json
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: 1.98.1
+          components: rustfmt, clippy
+
+      - name: Install locked native dependencies
+        run: pnpm --dir native install --frozen-lockfile
+
+      - name: Run native tests
+        run: pnpm --dir native test
+
+      - name: Check Rust formatting and warnings
+        run: pnpm --dir native check
+
+      - name: Build unsigned macOS app without release credentials
+        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1.0.0
+        with:
+          projectPath: native
+          tauriScript: pnpm exec tauri
+          args: --ci --debug --no-sign --bundles app -- --locked
+          uploadUpdaterJson: false
+          uploadUpdaterSignatures: false
+          uploadWorkflowArtifacts: false

.github/workflows/macos-release.yml

@@ -0,0 +1,228 @@
+name: macOS release to Hetzner
+
+on:
+  push:
+    # Gitea enforces the configured macos-v* protection when tags are pushed.
+    # Reading /tag_protections requires admin rights unavailable to job tokens.
+    tags:
+      - "macos-v*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing protected macos-vMAJOR.MINOR.PATCH tag on main"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  # Partial release files may be replaced until the feed is promoted.
+  # Keep every publisher in this group to prevent overlapping rebuilds.
+  group: macos-release
+  cancel-in-progress: false
+
+env:
+  APPLE_SIGNING_IDENTITY: "Developer ID Application: Nico Schröder (ZZX2KZGTHU)"
+  APPLE_TEAM_ID: ZZX2KZGTHU
+  MACOS_RELEASE_TARGET: ${{ vars.MACOS_RELEASE_TARGET || 'aarch64-apple-darwin' }}
+  S3_BUCKET: ${{ vars.S3_BUCKET }}
+  S3_REGION: ${{ vars.S3_REGION }}
+  S3_PREFIX: ${{ vars.S3_PREFIX || 'releases/macos' }}
+  S3_PUBLIC_BASE_URL: ${{ vars.S3_PUBLIC_BASE_URL }}
+
+jobs:
+  prepare:
+    name: Validate release ref and configuration
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    outputs:
+      commit: ${{ steps.ref.outputs.commit }}
+      tag: ${{ steps.ref.outputs.tag }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: Select an existing version tag contained in main
+        id: ref
+        shell: bash
+        env:
+          REQUESTED_TAG: ${{ inputs.tag }}
+          MACOS_RUNNER: ${{ vars.MACOS_RUNNER }}
+        run: |
+          set -Eeuo pipefail
+          if [[ "$GITHUB_EVENT_NAME" == workflow_dispatch ]]; then
+            [[ "$GITHUB_REF" == refs/heads/main ]] || { echo 'Dispatch this workflow from main.' >&2; exit 1; }
+            tag="$REQUESTED_TAG"
+          else
+            tag="${GITHUB_REF#refs/tags/}"
+          fi
+          [[ "$tag" =~ ^macos-v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]] || { echo 'Invalid macOS release tag.' >&2; exit 1; }
+          [[ "$MACOS_RUNNER" =~ ^[a-zA-Z0-9_-]+$ ]] || { echo 'Set MACOS_RUNNER to a registered macOS runner label.' >&2; exit 1; }
+          git fetch --no-tags origin main:refs/remotes/origin/main
+          commit="$(git rev-parse --verify "refs/tags/$tag^{commit}")"
+          git merge-base --is-ancestor "$commit" origin/main || { echo 'Release tag must belong to main.' >&2; exit 1; }
+          git checkout --detach "$commit"
+          printf 'commit=%s\ntag=%s\n' "$commit" "$tag" >> "$GITHUB_OUTPUT"
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22
+
+      - name: Validate app versions and Hetzner configuration
+        env:
+          RELEASE_TAG: ${{ steps.ref.outputs.tag }}
+        run: |
+          node native/macos-ci.mjs metadata
+          node native/publish-macos.mjs config
+
+  release:
+    name: Sign, notarize, verify and publish macOS
+    needs: prepare
+    # Gitea resolves runner labels before outputs from prepare are available.
+    runs-on: ${{ vars.MACOS_RUNNER }}
+    timeout-minutes: 120
+    env:
+      RELEASE_TAG: ${{ needs.prepare.outputs.tag }}
+    steps:
+      - name: Check out the validated commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.prepare.outputs.commit }}
+          persist-credentials: false
+
+      - name: Validate runner and required secrets
+        shell: bash
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
+          S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}
+        run: |
+          set -Eeuo pipefail
+          [[ "$(uname -s)" == Darwin ]] || { echo 'A macOS runner is required.' >&2; exit 1; }
+          case "$MACOS_RELEASE_TARGET:$(uname -m)" in
+            aarch64-apple-darwin:arm64|x86_64-apple-darwin:x86_64) ;;
+            *) echo 'Runner architecture must match MACOS_RELEASE_TARGET.' >&2; exit 1 ;;
+          esac
+          xcodebuild -version
+          xcrun --find notarytool
+          aws --version | grep '^aws-cli/2\.' || { echo 'Install AWS CLI v2 permanently on this runner.' >&2; exit 1; }
+          for name in APPLE_CERTIFICATE APPLE_CERTIFICATE_PASSWORD APPLE_PASSWORD TAURI_SIGNING_PRIVATE_KEY S3_ACCESS_KEY_ID S3_SECRET_ACCESS_KEY; do
+            [[ -n "${!name}" ]] || { echo "Missing repository secret: $name" >&2; exit 1; }
+          done
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v11.7.0
+        with:
+          package-json-file: package.json
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: 1.98.1
+          targets: ${{ env.MACOS_RELEASE_TARGET }}
+          components: rustfmt, clippy
+
+      - name: Install locked dependencies
+        run: |
+          pnpm install --frozen-lockfile
+          pnpm --dir native install --frozen-lockfile
+
+      - name: Run native checks before importing signing credentials
+        run: |
+          pnpm exec eslint native --max-warnings 0
+          pnpm --dir native test
+          pnpm --dir native check
+
+      - name: Prepare isolated signing keychain
+        id: signing
+        shell: bash
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+        run: |
+          set -Eeuo pipefail
+          umask 077
+          signing_dir="$(mktemp -d "$RUNNER_TEMP/kanbangit-signing.XXXXXX")"
+          printf 'SIGNING_DIRECTORY=%s\n' "$signing_dir" >> "$GITHUB_ENV"
+          security list-keychains -d user > "$signing_dir/original-keychains.txt"
+          printf '%s' "$APPLE_CERTIFICATE" | base64 --decode > "$signing_dir/certificate.p12"
+          password="$(openssl rand -hex 32)"
+          echo "::add-mask::$password"
+          printf 'keychain=kanbangit-%s-%s\npassword=%s\ncertificate=%s/certificate.p12\n' "$GITHUB_RUN_ID" "$GITHUB_RUN_ATTEMPT" "$password" "$signing_dir" >> "$GITHUB_OUTPUT"
+
+      - name: Import Developer ID certificate
+        uses: Apple-Actions/import-codesign-certs@5142e029c445c10ffc7149d172e540235a065466 # v7.0.0; deletes its keychain in the post step
+        with:
+          keychain: ${{ steps.signing.outputs.keychain }}
+          keychain-password: ${{ steps.signing.outputs.password }}
+          p12-filepath: ${{ steps.signing.outputs.certificate }}
+          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+
+      - name: Confirm release signing identity
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+          security find-identity -v -p codesigning | grep -F "\"$APPLE_SIGNING_IDENTITY\""
+
+      - name: Build, sign and notarize with Tauri
+        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1.0.0
+        env:
+          # The DMG bundler reads these variables separately from --ci.
+          CI: "true"
+          TAURI_BUNDLER_DMG_IGNORE_CI: "false"
+          APPLE_ID: dev@petsch-studios.de
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        with:
+          projectPath: native
+          tauriScript: pnpm exec tauri
+          args: >-
+            --ci --target ${{ env.MACOS_RELEASE_TARGET }} --bundles app,dmg
+            --config '{"bundle":{"createUpdaterArtifacts":true,"macOS":{"hardenedRuntime":true}}}'
+            -- --locked
+          uploadUpdaterJson: false
+          uploadUpdaterSignatures: false
+          uploadWorkflowArtifacts: false
+
+      - name: Verify signed app and packaged download
+        id: package
+        run: node native/macos-ci.mjs package
+
+      - name: Upload release files and promote the verified update feed
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}
+          AWS_EC2_METADATA_DISABLED: "true"
+          AWS_REQUEST_CHECKSUM_CALCULATION: when_required
+          AWS_RESPONSE_CHECKSUM_VALIDATION: when_required
+          RELEASE_DIRECTORY: ${{ steps.package.outputs.directory }}
+        run: node native/publish-macos.mjs upload
+
+      - name: Restore keychain search list and remove certificate export
+        if: ${{ always() }}
+        shell: bash
+        run: |
+          python3 - <<'PY'
+          import os, pathlib, shlex, shutil, subprocess
+          value = os.environ.get('SIGNING_DIRECTORY')
+          if value:
+              directory = pathlib.Path(value)
+              original = directory / 'original-keychains.txt'
+              try:
+                  if original.exists():
+                      subprocess.run(['security', 'list-keychains', '-d', 'user', '-s', *shlex.split(original.read_text())], check=True)
+              finally:
+                  shutil.rmtree(directory)
+          PY

.github/workflows/native-checks.yml

@@ -0,0 +1,57 @@
+name: Native JavaScript checks
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "native/**"
+      - ".github/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "eslint.config.mjs"
+      - "resources/css/app.css"
+  pull_request:
+    paths:
+      - "native/**"
+      - ".github/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "eslint.config.mjs"
+      - "resources/css/app.css"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  native_javascript:
+    name: Native launcher and release tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v11.7.0
+        with:
+          package-json-file: package.json
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install locked development dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint native JavaScript
+        run: pnpm exec eslint native --max-warnings 0
+
+      - name: Test native launcher and release safeguards without credentials
+        run: node --test native/tests/*.test.js

.github/workflows/tests.yml

@@ -1,49 +0,0 @@
-name: tests
-
-on:
-  push:
-    branches:
-      - main
-      - staging
-  pull_request:
-
-jobs:
-  ci:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        php-version: ['8.4']
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php-version }}
-          tools: composer:v2
-          coverage: xdebug
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-
-      - name: Install Node Dependencies
-        run: npm i
-
-      - name: Install Dependencies
-        run: composer install --no-interaction --prefer-dist --optimize-autoloader
-
-      - name: Copy Environment File
-        run: cp .env.example .env
-
-      - name: Generate Application Key
-        run: php artisan key:generate
-
-      - name: Build Assets
-        run: npm run build
-
-      - name: Tests
-        run: ./vendor/bin/phpunit

.gitignore

@@ -28,3 +28,16 @@ yarn-error.log
 /.vscode
 /.zed
 .codex/config.toml
+
+/native/node_modules
+/native/src-tauri/target
+/native/src-tauri/gen/*
+!/native/src-tauri/gen/android/
+!/native/src-tauri/gen/apple/
+/native/src-tauri/gen/apple/build/
+/native/src-tauri/gen/apple/Externals/
+/native/src-tauri/gen/apple/assets/
+/native/src-tauri/gen/apple/Pods/
+/native/src-tauri/gen/apple/ExportOptions.plist
+/native/src-tauri/gen/apple/**/*.xcuserstate
+/native/src-tauri/gen/apple/**/xcuserdata/

AGENTS.md

@@ -1,3 +1,9 @@
+# Working Agreements
+
+## Missing programs and SDKs
+
+If implementation or verification requires a missing program, SDK, runtime, toolchain, or platform component, do not download or install a temporary copy in `/tmp` or another temporary directory. Do not use an ad hoc toolchain as a workaround. Tell the user which prerequisites are missing, ask them to install them permanently and confirm when installation is complete, and wait for that confirmation before continuing dependent work. This rule applies to every implementation task in this project.
+
 <laravel-boost-guidelines>
 === foundation rules ===
 
@@ -9,24 +15,18 @@ The Laravel Boost guidelines are specifically curated by Laravel maintainers for
 
 This application is a Laravel application and its main Laravel ecosystems package & versions are below. You are an expert with them all. Ensure you abide by these specific packages & versions.
 
-- php - 8.4
+- php - 8.5
 - inertiajs/inertia-laravel (INERTIA_LARAVEL) - v2
 - laravel/fortify (FORTIFY) - v1
 - laravel/framework (LARAVEL) - v13
+- laravel/mcp (MCP) - v0
 - laravel/prompts (PROMPTS) - v0
 - laravel/wayfinder (WAYFINDER) - v0
 - laravel/boost (BOOST) - v2
-- laravel/mcp (MCP) - v0
 - laravel/pail (PAIL) - v1
 - laravel/pint (PINT) - v1
 - laravel/sail (SAIL) - v1
 - phpunit/phpunit (PHPUNIT) - v12
-- @inertiajs/vue3 (INERTIA_VUE) - v2
-- tailwindcss (TAILWINDCSS) - v4
-- vue (VUE) - v3
-- @laravel/vite-plugin-wayfinder (WAYFINDER_VITE) - v0
-- eslint (ESLINT) - v9
-- prettier (PRETTIER) - v3
 
 ## Skills Activation
 
@@ -34,10 +34,8 @@ This project has domain-specific skills available. You MUST activate the relevan
 
 - `fortify-development` — ACTIVATE when the user works on authentication in Laravel. This includes login, registration, password reset, email verification, two-factor authentication (2FA/TOTP/QR codes/recovery codes), profile updates, password confirmation, or any auth-related routes and controllers. Activate when the user mentions Fortify, auth, authentication, login, register, signup, forgot password, verify email, 2FA, or references app/Actions/Fortify/, CreateNewUser, UpdateUserProfileInformation, FortifyServiceProvider, config/fortify.php, or auth guards. Fortify is the frontend-agnostic authentication backend for Laravel that registers all auth routes and controllers. Also activate when building SPA or headless authentication, customizing login redirects, overriding response contracts like LoginResponse, or configuring login throttling. Do NOT activate for Laravel Passport (OAuth2 API tokens), Socialite (OAuth social login), or non-auth Laravel features.
 - `laravel-best-practices` — Apply this skill whenever writing, reviewing, or refactoring Laravel PHP code. This includes creating or modifying controllers, models, migrations, form requests, policies, jobs, scheduled commands, service classes, and Eloquent queries. Triggers for N+1 and query performance issues, caching strategies, authorization and security patterns, validation, error handling, queue and job configuration, route definitions, and architectural decisions. Also use for Laravel code reviews and refactoring existing Laravel code to follow best practices. Covers any task involving Laravel backend PHP code patterns.
-- `project-route-structure` — Always apply in this project when creating, moving, or refactoring Laravel route definitions in routes/**/*.php; changing route prefixes, names, middleware, scoped bindings, or route files; or adding frontend-facing endpoints that Wayfinder generates. Documents the KanbanGit route-file layout and grouping conventions.
+- `mcp-development` — Use this skill for Laravel MCP development only. Trigger when creating or editing MCP tools, resources, prompts, or servers in Laravel projects. Covers: artisan make:mcp-* generators, mcp:inspector, routes/ai.php, Tool/Resource/Prompt classes, schema validation, shouldRegister(), OAuth setup, URI templates, read-only attributes, and MCP debugging. Do not use for non-Laravel MCP projects or generic AI features without MCP.
 - `wayfinder-development` — Use this skill for Laravel Wayfinder which auto-generates typed functions for Laravel controllers and routes. ALWAYS use this skill when frontend code needs to call backend routes or controller actions. Trigger when: connecting any React/Vue/Svelte/Inertia frontend to Laravel controllers, routes, building end-to-end features with both frontend and backend, wiring up forms or links to backend endpoints, fixing route-related TypeScript errors, importing from @/actions or @/routes, or running wayfinder:generate. Use Wayfinder route functions instead of hardcoded URLs. Covers: wayfinder() vite plugin, .url()/.get()/.post()/.form(), query params, route model binding, tree-shaking. Do not use for backend-only task
-- `inertia-vue-development` — Develops Inertia.js v2 Vue client-side applications. Activates when creating Vue pages, forms, or navigation; using <Link>, <Form>, useForm, or router; working with deferred props, prefetching, or polling; or when user mentions Vue with Inertia, Vue pages, Vue forms, or Vue navigation.
-- `tailwindcss-development` — Always invoke when the user's message includes 'tailwind' in any form. Also invoke for: building responsive grid layouts (multi-column card grids, product grids), flex/grid page structures (dashboards with sidebars, fixed topbars, mobile-toggle navs), styling UI components (cards, tables, navbars, pricing sections, forms, inputs, badges), adding dark mode variants, fixing spacing or typography, and Tailwind v3/v4 work. The core use case: writing or fixing Tailwind utility classes in HTML templates (Blade, JSX, Vue). Skip for backend PHP logic, database queries, API routes, JavaScript with no HTML/CSS component, CSS file audits, build tool configuration, and vanilla CSS.
 
 ## Conventions
 
@@ -56,7 +54,7 @@ This project has domain-specific skills available. You MUST activate the relevan
 
 ## Frontend Bundling
 
-- If the user doesn't see a frontend change reflected in the UI, it could mean they need to run `npm run build`, `npm run dev`, or `composer run dev`. Ask them.
+- If the user doesn't see a frontend change reflected in the UI, it could mean they need to run `pnpm run build`, `pnpm run dev`, or `composer run dev`. Ask them.
 
 ## Documentation Files
 
@@ -130,7 +128,6 @@ This project has domain-specific skills available. You MUST activate the relevan
 - Inertia creates fully client-side rendered SPAs without modern SPA complexity, leveraging existing server-side patterns.
 - Components live in `resources/js/pages` (unless specified in `vite.config.js`). Use `Inertia::render()` for server-side routing instead of Blade views.
 - ALWAYS use `search-docs` tool for version-specific Inertia documentation and updated code examples.
-- IMPORTANT: Activate `inertia-vue-development` when working with Inertia Vue client-side patterns.
 
 # Inertia v2
 
@@ -166,7 +163,7 @@ This project has domain-specific skills available. You MUST activate the relevan
 
 ## Vite Error
 
-- If you receive an "Illuminate\Foundation\ViteException: Unable to locate file in Vite manifest" error, you can run `npm run build` or ask the user to run `npm run dev` or `composer run dev`.
+- If you receive an "Illuminate\Foundation\ViteException: Unable to locate file in Vite manifest" error, you can run `pnpm run build` or ask the user to run `pnpm run dev` or `composer run dev`.
 
 ## Deployment
 
@@ -203,11 +200,4 @@ Use Wayfinder to generate TypeScript functions for Laravel routes. Import from `
 - To run all tests in a file: `php artisan test --compact tests/Feature/ExampleTest.php`.
 - To filter on a particular test name: `php artisan test --compact --filter=testName` (recommended after making a change to a related file).
 
-=== inertia-vue/core rules ===
-
-# Inertia + Vue
-
-Vue components must have a single root element.
-- IMPORTANT: Activate `inertia-vue-development` when working with Inertia Vue client-side patterns.
-
 </laravel-boost-guidelines>

Dockerfile

@@ -0,0 +1,111 @@
+ARG COMPOSER_IMAGE=composer:2.9.5@sha256:698d3801b2a622ace460c4743c781282fcbcb733a4cbf8b31c44731e846585e8
+ARG NODE_IMAGE=node:22-bookworm-slim@sha256:d649c27dae7ba0137b3cef5dd75baa422c08dc3d9e3fc0c23dfb172dc3cc6436
+ARG PHP_IMAGE=php:8.4-fpm-bookworm@sha256:c5fb7a0c02f4efe280691910c8b734995fa83598cdcf3115ef5dcb2e4617681c
+
+FROM ${COMPOSER_IMAGE} AS composer_binary
+FROM ${NODE_IMAGE} AS node_binary
+
+FROM ${PHP_IMAGE} AS php_base
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        gettext-base \
+        git \
+        libfcgi-bin \
+        libfreetype6-dev \
+        libicu-dev \
+        libjpeg62-turbo-dev \
+        libmagickwand-dev \
+        libonig-dev \
+        libpng-dev \
+        libpq-dev \
+        libsqlite3-dev \
+        libssl-dev \
+        libxml2-dev \
+        libzip-dev \
+        nginx \
+        procps \
+        unzip \
+    && docker-php-ext-configure gd --with-freetype --with-jpeg \
+    && docker-php-ext-install -j"$(nproc)" \
+        bcmath \
+        gd \
+        intl \
+        opcache \
+        pcntl \
+        pdo_mysql \
+        pdo_pgsql \
+        pdo_sqlite \
+        pgsql \
+        soap \
+        zip \
+    && pecl install imagick \
+    && docker-php-ext-enable imagick \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+COPY --from=composer_binary /usr/bin/composer /usr/local/bin/composer
+
+WORKDIR /var/www
+
+FROM php_base AS build
+
+COPY --from=node_binary /usr/local/ /usr/local/
+COPY . /var/www
+
+RUN composer install --prefer-dist --no-interaction --no-progress \
+    && corepack enable pnpm \
+    && pnpm install --frozen-lockfile \
+    && pnpm run build
+
+FROM build AS test
+
+RUN cp .env.example .env \
+    && php artisan key:generate\
+    && composer audit --locked --no-interaction \
+    && COMPOSER_ALLOW_SUPERUSER=1 composer ci:check
+
+FROM build AS production_builder
+
+RUN composer install \
+        --classmap-authoritative \
+        --no-dev \
+        --no-interaction \
+        --no-progress \
+        --prefer-dist \
+    && rm -rf node_modules tests phpunit.xml
+
+FROM php_base AS runtime
+
+COPY docker/entrypoint.sh /usr/local/bin/kanbangit-entrypoint
+COPY docker/nginx/nginx.conf.template /etc/nginx/nginx.conf.template
+COPY docker/php-fpm-healthcheck.sh /usr/local/bin/php-fpm-healthcheck
+COPY --from=production_builder --chown=www-data:www-data /var/www /var/www
+
+RUN chmod +x /usr/local/bin/kanbangit-entrypoint /usr/local/bin/php-fpm-healthcheck \
+    && mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini" \
+    && printf '%s\n' \
+        '[global]' \
+        'daemonize = no' \
+        '' \
+        '[www]' \
+        'pm.status_path = /status' \
+        > /usr/local/etc/php-fpm.d/zz-kanbangit.conf \
+    && mkdir -p \
+        /var/www/bootstrap/cache \
+        /var/www/storage/app/public \
+        /var/www/storage/framework/cache \
+        /var/www/storage/framework/sessions \
+        /var/www/storage/framework/testing \
+        /var/www/storage/framework/views \
+        /var/www/storage/logs \
+    && ln -s ../storage/app/public /var/www/public/storage \
+    && chown -R www-data:www-data /var/www/bootstrap/cache /var/www/storage
+
+USER www-data
+
+EXPOSE 8080 9000
+
+ENTRYPOINT ["kanbangit-entrypoint"]
+CMD ["php-fpm"]

app/Actions/Permissions/PermissionService.php

@@ -8,6 +8,7 @@ use App\Models\Project;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection as EloquentCollection;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\DB;
@@ -113,6 +114,41 @@ class PermissionService
         );
     }
 
+    /**
+     * @param  EloquentCollection<int, User>  $users
+     * @return array{directPermissions: array, teamPermissions: array, effectivePermissions: array, globalAdminUserIds: array<int, int>}
+     */
+    public function projectAccessMap(EloquentCollection $users, Project $project): array
+    {
+        $users->loadMissing('teams');
+        $directPermissions = $this->assignmentMap(User::class, $project);
+        $teamPermissions = $this->assignmentMap(Team::class, $project);
+        $globalPermissions = $this->assignmentMap(User::class);
+        $effectivePermissions = [];
+        $globalAdminUserIds = [];
+
+        foreach ($users as $user) {
+            $permissions = $directPermissions[$user->id] ?? [];
+
+            foreach ($user->teams as $team) {
+                $permissions = array_merge($permissions, $teamPermissions[$team->id] ?? []);
+            }
+
+            if (in_array(Permission::GlobalAdmin->value, $globalPermissions[$user->id] ?? [], true)) {
+                $permissions[] = Permission::GlobalAdmin->value;
+                $globalAdminUserIds[] = $user->id;
+            }
+
+            $expanded = $this->expandPermissions(array_map(Permission::from(...), $permissions));
+            $effectivePermissions[$user->id] = Permission::values(array_values(array_filter(
+                Permission::projectAssignable(),
+                fn (Permission $permission): bool => in_array($permission, $expanded, true),
+            )));
+        }
+
+        return compact('directPermissions', 'teamPermissions', 'effectivePermissions', 'globalAdminUserIds');
+    }
+
     /**
      * @return array<string, array<int, string>>
      */

app/Actions/Projects/BuildProjectBacklogPayload.php

@@ -47,6 +47,7 @@ class BuildProjectBacklogPayload
             'tickets' => TicketResource::collection(
                 Ticket::query()
                     ->with([
+                        'assignee',
                         'ticketPriority',
                         'ticketStatus.allowedTargetStatuses.boardColumn',
                         'ticketStatus.boardColumn',

app/Actions/Projects/BuildProjectBoardPayload.php

@@ -29,6 +29,7 @@ class BuildProjectBoardPayload
                         'ticketStatuses',
                         'tickets' => fn ($query) => $query
                             ->with([
+                                'assignee',
                                 'ticketPriority',
                                 'ticketStatus.allowedTargetStatuses.boardColumn',
                                 'ticketStatus.boardColumn',

app/Actions/Projects/BuildProjectTicketMetadataSettingsPayload.php

@@ -34,8 +34,8 @@ class BuildProjectTicketMetadataSettingsPayload
                 DuplicateProjectConfiguration::COPY_TICKET_FIELDS,
                 DuplicateProjectConfiguration::COPY_TICKET_LINK_TYPES,
             ]),
-            'ticketFieldDefinitions' => TicketFieldDefinitionResource::collection($project->ticketFieldDefinitions()->get())->resolve(),
-            'ticketLinkTypes' => TicketLinkTypeResource::collection($project->ticketLinkTypes()->get())->resolve(),
+            'ticketFieldDefinitions' => TicketFieldDefinitionResource::collection($project->ticketFieldDefinitions()->withCount('ticketFieldValues')->get())->resolve(),
+            'ticketLinkTypes' => TicketLinkTypeResource::collection($project->ticketLinkTypes()->withCount('ticketLinks')->get())->resolve(),
             'ticketPriorities' => TicketPriorityResource::collection($project->ticketPriorities()->get())->resolve(),
             'ticketTypes' => TicketTypeResource::collection($project->ticketTypes()->withCount('tickets')->get())->resolve(),
         ];

app/Actions/Projects/BuildProjectTicketOptionsPayload.php

@@ -7,9 +7,9 @@ use App\Http\Resources\TicketPriorityResource;
 use App\Http\Resources\TicketReferenceResource;
 use App\Http\Resources\TicketStatusResource;
 use App\Http\Resources\TicketTypeResource;
-use App\Models\Ticket;
 use App\Http\Resources\UserResource;
 use App\Models\Project;
+use App\Models\Ticket;
 use App\Models\User;
 
 class BuildProjectTicketOptionsPayload

app/Actions/Tickets/CreateProjectTicket.php

@@ -19,6 +19,7 @@ class CreateProjectTicket
     public function __construct(
         private readonly BuildTicketCreatedPayload $buildTicketCreatedPayload,
         private readonly CreateTicketWorklogEntry $createTicketWorklogEntry,
+        private readonly SyncProjectTicketFieldValues $syncProjectTicketFieldValues,
     ) {}
 
     /**
@@ -29,7 +30,15 @@ class CreateProjectTicket
      *         text: string
      *     }>,
      *     assignee_user_id?: int|null,
+     *     author_user_id?: int|null,
+     *     blocked_comment?: string|null,
      *     description: string|null,
+     *     field_values?: array<int, array{
+     *         ticket_field_definition_id: int,
+     *         value_number?: float|int|string|null,
+     *         value_user_id?: int|string|null
+     *     }>,
+     *     is_blocked?: bool,
      *     parent_ticket_id?: int|null,
      *     story_points?: int|null,
      *     ticket_priority_id: int,
@@ -50,11 +59,14 @@ class CreateProjectTicket
             $ticketStatusQuery = TicketStatus::query()->where('project_id', $project->id);
 
             $ticketStatus = $ticketStatusQuery->findOrFail(Arr::get($attributes, 'ticket_status_id'));
+            $isBlocked = (bool) Arr::get($attributes, 'is_blocked', false);
 
             $ticket = Ticket::query()->create([
                 'assignee_user_id' => Arr::get($attributes, 'assignee_user_id'),
-                'author_user_id' => $actor?->id,
+                'author_user_id' => Arr::get($attributes, 'author_user_id', $actor?->id),
+                'blocked_comment' => $isBlocked ? Arr::get($attributes, 'blocked_comment') : null,
                 'description' => Arr::get($attributes, 'description'),
+                'is_blocked' => $isBlocked,
                 'parent_ticket_id' => Arr::get($attributes, 'parent_ticket_id'),
                 'project_id' => $project->id,
                 'sequence_number' => $nextSequenceNumber,
@@ -68,6 +80,17 @@ class CreateProjectTicket
 
             AcceptanceCriteriaChecklistMapper::syncTicket($ticket, $acceptanceCriteria);
 
+            $fieldValues = Arr::get($attributes, 'field_values', []);
+
+            if ($fieldValues !== []) {
+                $this->syncProjectTicketFieldValues->handle(
+                    $ticket,
+                    $project->ticketFieldDefinitions()->get()->keyBy('id'),
+                    collect(),
+                    $fieldValues,
+                );
+            }
+
             $occurredAt = CarbonImmutable::now();
 
             if ($actor !== null) {

app/Actions/Tickets/ListAssignedTicketsByVisibleProject.php

@@ -41,8 +41,8 @@ class ListAssignedTicketsByVisibleProject
             ->where('assignee_user_id', $assignee->id)
             ->whereIn('project_id', $visibleProjectIds)
             ->with([
+                'acceptanceCriteria',
                 'assignee',
-                'project',
                 'ticketPriority',
                 'ticketStatus.boardColumn',
                 'ticketType',

app/Actions/Users/UpdateUserAvatar.php

@@ -30,9 +30,10 @@ class UpdateUserAvatar
         $color = $this->colorFor($user);
         $path = sprintf('avatars/generated/%d-%s.svg', $user->id, (string) Str::uuid());
 
-        $stored = Storage::disk('public')->put(
+        $stored = Storage::disk($this->avatarDisk())->put(
             $path,
             $this->svg($this->initials($user->name), $color),
+            ['ContentType' => 'image/svg+xml'],
         );
 
         if (! $stored) {
@@ -53,7 +54,7 @@ class UpdateUserAvatar
     public function upload(User $user, UploadedFile $avatar): User
     {
         $oldPath = $user->avatar_path;
-        $path = $avatar->store('avatars/uploads', 'public');
+        $path = $avatar->store('avatars/uploads', $this->avatarDisk());
 
         if (! is_string($path)) {
             throw new RuntimeException('Uploaded avatar could not be stored.');
@@ -90,7 +91,14 @@ class UpdateUserAvatar
             return;
         }
 
-        Storage::disk('public')->delete($path);
+        Storage::disk($this->avatarDisk())->delete($path);
+    }
+
+    private function avatarDisk(): string
+    {
+        $disk = config('filesystems.avatar_disk', 'public');
+
+        return is_string($disk) && $disk !== '' ? $disk : 'public';
     }
 
     private function initials(string $name): string

app/Console/Commands/CreateAdminUser.php

@@ -8,6 +8,7 @@ use App\Models\User;
 use Illuminate\Console\Attributes\Description;
 use Illuminate\Console\Attributes\Signature;
 use Illuminate\Console\Command;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
 
 #[Signature('app:create-admin-user {name=Admin} {email=admin@kanbangit.test} {password=test}')]
@@ -25,6 +26,9 @@ class CreateAdminUser extends Command
      */
     public function handle(): int
     {
+        DB::beginTransaction();
+
+        try {
             $user = User::create([
                 'name' => $this->argument('name'),
                 'email' => $this->argument('email'),
@@ -38,7 +42,14 @@ class CreateAdminUser extends Command
             ]);
 
             $this->info(sprintf('Admin User created with emil=\'%s\' and password=\'%s\'', $this->argument('email'), $this->argument('password')));
+            DB::commit();
 
             return self::SUCCESS;
+        } catch (\Exception $exception) {
+            $this->error('Admin User could not be created: ', $exception->getMessage());
+            DB::rollBack();
+
+            return self::FAILURE;
+        }
     }
 }

app/Http/Controllers/DashboardController.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Actions\Tickets\ListAssignedTicketsByVisibleProject;
+use Illuminate\Http\Request;
+use Inertia\Inertia;
+use Inertia\Response;
+
+class DashboardController extends Controller
+{
+    public function __construct(
+        private readonly ListAssignedTicketsByVisibleProject $listAssignedTicketsByVisibleProject,
+    ) {}
+
+    public function __invoke(Request $request): Response
+    {
+        $user = $request->user();
+
+        return Inertia::render('Dashboard', [
+            'assignedTicketsByProject' => $this->listAssignedTicketsByVisibleProject->handle($user, $user),
+        ]);
+    }
+}

app/Http/Controllers/ProjectController.php

@@ -182,25 +182,22 @@ class ProjectController extends Controller
             403,
         );
 
+        $users = User::query()->orderBy('name')->get();
+
         return Inertia::render('projects/Access', [
-            'directPermissions' => $this->permissionService->assignmentMap(User::class, $project),
+            ...$this->permissionService->projectAccessMap($users, $project),
             'permissionOptions' => PermissionOptionResource::collection(
                 $this->permissionService->permissionOptions(User::class, Project::class),
             )->resolve(),
             'project' => ProjectResource::make($project)->resolve(),
             'status' => session('status'),
-            'teamPermissions' => $this->permissionService->assignmentMap(Team::class, $project),
             'teams' => TeamResource::collection(
                 Team::query()
                     ->with('users')
                     ->orderBy('name')
                     ->get(),
             )->resolve(),
-            'users' => UserResource::collection(
-                User::query()
-                    ->orderBy('name')
-                    ->get(),
-            )->resolve(),
+            'users' => UserResource::collection($users)->resolve(),
         ]);
     }
 
@@ -220,7 +217,9 @@ class ProjectController extends Controller
 
         $this->permissionService->sync($user, $project, $permissions);
 
-        return to_route('projects.access', $project)
+        return ($this->permissionService->allows($request->user(), Permission::ProjectAdmin, $project)
+            ? to_route('projects.access', $project)
+            : to_route('projects.index'))
             ->with('status', "{$user->name} permissions were updated.");
     }
 
@@ -239,7 +238,9 @@ class ProjectController extends Controller
 
         $this->permissionService->sync($team, $project, $permissions);
 
-        return to_route('projects.access', $project)
+        return ($this->permissionService->allows($request->user(), Permission::ProjectAdmin, $project)
+            ? to_route('projects.access', $project)
+            : to_route('projects.index'))
             ->with('status', "{$team->name} permissions were updated.");
     }
 

app/Http/Middleware/HandleAppearance.php

@@ -16,7 +16,11 @@ class HandleAppearance
      */
     public function handle(Request $request, Closure $next): Response
     {
-        View::share('appearance', $request->cookie('appearance') ?? 'system');
+        $appearance = $request->cookie('appearance');
+        $appearance = in_array($appearance, ['light', 'dark', 'system'], true) ? $appearance : 'system';
+
+        $request->attributes->set('appearance', $appearance);
+        View::share('appearance', $appearance);
 
         return $next($request);
     }

app/Http/Middleware/HandleInertiaRequests.php

@@ -4,6 +4,7 @@ namespace App\Http\Middleware;
 
 use App\Actions\Permissions\PermissionService;
 use App\Enums\Permission;
+use App\Models\Project;
 use Illuminate\Http\Request;
 use Inertia\Middleware;
 
@@ -46,6 +47,11 @@ class HandleInertiaRequests extends Middleware
         return [
             ...parent::share($request),
             'name' => config('app.name'),
+            'appearance' => $request->attributes->get('appearance', 'system'),
+            'localization' => [
+                'locale' => app()->getLocale(),
+                'timeZone' => config('app.timezone'),
+            ],
             'auth' => [
                 'permissions' => [
                     'canManageTeams' => $user !== null && ($this->permissionService->canManageAnyTeam($user) || $this->permissionService->allows($user, Permission::TeamCreate)),
@@ -55,6 +61,36 @@ class HandleInertiaRequests extends Middleware
                 'user' => $user,
             ],
             'sidebarOpen' => ! $request->hasCookie('sidebar_state') || $request->cookie('sidebar_state') === 'true',
+            'navigation' => fn (): array => [
+                'project' => $this->projectNavigation($request),
+            ],
+        ];
+    }
+
+    /**
+     * @return array{id: int, name: string, key: string, canManage: bool, canCreateTickets: bool}|null
+     */
+    private function projectNavigation(Request $request): ?array
+    {
+        $project = $request->route('project');
+        $user = $request->user();
+
+        if (! $project instanceof Project || $user === null) {
+            return null;
+        }
+
+        $permissions = $this->permissionService->effectivePermissions($user, $project);
+
+        if (! in_array(Permission::ProjectRead, $permissions, true)) {
+            return null;
+        }
+
+        return [
+            'id' => $project->id,
+            'name' => $project->name,
+            'key' => $project->key,
+            'canManage' => in_array(Permission::ProjectAdmin, $permissions, true),
+            'canCreateTickets' => in_array(Permission::ProjectWrite, $permissions, true),
         ];
     }
 }

app/Http/Requests/UpdateProjectTemplateRequest.php

@@ -29,6 +29,7 @@ class UpdateProjectTemplateRequest extends FormRequest
             'copy_areas' => ['required', 'array', 'min:1'],
             'copy_areas.*' => ['string', Rule::in(DuplicateProjectConfiguration::acceptedCopyAreas())],
             'confirm_linked_projects_update' => [
+                Rule::excludeIf(! $requiresImpactConfirmation),
                 Rule::requiredIf($requiresImpactConfirmation),
                 'accepted',
             ],

app/Http/Resources/TicketFieldDefinitionResource.php

@@ -20,6 +20,7 @@ class TicketFieldDefinitionResource extends JsonResource
             'label' => $this->label,
             'position' => $this->position,
             'project_id' => $this->project_id,
+            'ticket_field_values_count' => $this->when(isset($this->ticket_field_values_count), (int) $this->ticket_field_values_count),
             'created_at' => $this->created_at?->toISOString(),
             'updated_at' => $this->updated_at?->toISOString(),
         ];

app/Http/Resources/TicketLinkTypeResource.php

@@ -20,6 +20,7 @@ class TicketLinkTypeResource extends JsonResource
             'counterpart_label' => $this->counterpart_label ?: $this->label,
             'position' => $this->position,
             'project_id' => $this->project_id,
+            'ticket_links_count' => $this->when(isset($this->ticket_links_count), (int) $this->ticket_links_count),
             'created_at' => $this->created_at?->toISOString(),
             'updated_at' => $this->updated_at?->toISOString(),
         ];

app/Mcp/Servers/KanbanGitServer.php

@@ -2,9 +2,11 @@
 
 namespace App\Mcp\Servers;
 
+use App\Mcp\Tools\CreateTicket;
 use App\Mcp\Tools\GetTicket;
 use App\Mcp\Tools\ListMyAssignedTickets;
 use App\Mcp\Tools\ListTicketsByStatus;
+use App\Mcp\Tools\ListTicketTypes;
 use App\Mcp\Tools\MoveTicketStatus;
 use App\Mcp\Tools\UpdateTicketAssignee;
 use App\Mcp\Tools\UpdateTicketDescription;
@@ -15,7 +17,7 @@ use Laravel\Mcp\Server\Attributes\Version;
 
 #[Name('KanbanGit MCP')]
 #[Version('0.1.0')]
-#[Instructions('Use these tools to read and update KanbanGit tickets with the authenticated application key owner permissions. Prefer stable IDs when available, especially ticket_id and ticket_status_id.')]
+#[Instructions('Use these tools to read, create, and update KanbanGit tickets with the authenticated application key owner permissions. Prefer stable IDs when available, especially project_id, ticket_id, ticket_type_id, and ticket_status_id. Use list_ticket_types to discover the available ticket types in a project. Use create_ticket with parent_ticket_id to create a child ticket.')]
 class KanbanGitServer extends Server
 {
     protected array $tools = [
@@ -25,6 +27,8 @@ class KanbanGitServer extends Server
         UpdateTicketDescription::class,
         UpdateTicketAssignee::class,
         MoveTicketStatus::class,
+        CreateTicket::class,
+        ListTicketTypes::class,
     ];
 
     protected array $resources = [

app/Mcp/Support/KanbanGitMcp.php

@@ -120,6 +120,24 @@ class KanbanGitMcp
         return $project;
     }
 
+    /**
+     * @throws AuthorizationException
+     */
+    public function projectForWrite(User $user, int $projectId): Project
+    {
+        $project = Project::query()->find($projectId);
+
+        if ($project === null) {
+            throw ValidationException::withMessages([
+                'project_id' => 'Project was not found.',
+            ]);
+        }
+
+        $this->ensureCanWrite($user, $project);
+
+        return $project;
+    }
+
     /**
      * @param  array<string, mixed>  $validated
      * @return Collection<int, TicketStatus>|Response
@@ -189,10 +207,12 @@ class KanbanGitMcp
     public function ticketPayload(Ticket $ticket): array
     {
         $ticket->load([
+            'acceptanceCriteria',
             'assignee',
             'author',
             'fieldValues.ticketFieldDefinition',
             'fieldValues.userValue',
+            'parentTicket',
             'project',
             'ticketPriority',
             'ticketStatus.boardColumn',

app/Mcp/Tools/CreateTicket.php

@@ -0,0 +1,169 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use App\Actions\Permissions\PermissionService;
+use App\Actions\Tickets\CreateProjectTicket;
+use App\Actions\Tickets\Support\AcceptanceCriteriaChecklistMapper;
+use App\Enums\Permission;
+use App\Mcp\Support\KanbanGitMcp;
+use App\Models\Project;
+use App\Models\Ticket;
+use App\Models\User;
+use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Illuminate\JsonSchema\Types\Type;
+use Illuminate\Support\Arr;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\ValidationException;
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+use Laravel\Mcp\ResponseFactory;
+use Laravel\Mcp\Server\Attributes\Description;
+use Laravel\Mcp\Server\Attributes\Name;
+use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+
+#[Name('create_ticket')]
+#[Description('Create a ticket with all editable ticket fields, including its type, initial status, priority, assignee, author, description, story points, acceptance criteria, blocked state, and custom field values. Set parent_ticket_id to create a child of an existing ticket in the same project whose type allows children. Requires project write permission; overriding the author requires project admin permission. Ticket IDs, keys, sequence numbers, timestamps, and worklog entries are generated automatically.')]
+#[IsDestructive(false)]
+class CreateTicket extends Tool
+{
+    public function __construct(
+        private readonly KanbanGitMcp $kanbanGitMcp,
+        private readonly CreateProjectTicket $createProjectTicket,
+        private readonly PermissionService $permissionService,
+    ) {}
+
+    public function handle(Request $request): Response|ResponseFactory
+    {
+        $projectInput = $request->validate([
+            'project_id' => ['required', 'integer'],
+        ]);
+
+        $user = $this->kanbanGitMcp->user($request);
+        $project = $this->kanbanGitMcp->projectForWrite($user, (int) Arr::get($projectInput, 'project_id'));
+        $validated = $request->validate([
+            'title' => ['required', 'string', 'max:255'],
+            'description' => ['nullable', 'string'],
+            'ticket_type_id' => ['required', 'integer', Rule::exists('ticket_types', 'id')->where('project_id', $project->id)],
+            'ticket_status_id' => ['required', 'integer', Rule::exists('ticket_statuses', 'id')->where('project_id', $project->id)],
+            'ticket_priority_id' => ['required', 'integer', Rule::exists('ticket_priorities', 'id')->where('project_id', $project->id)],
+            'parent_ticket_id' => ['nullable', 'integer', Rule::exists('tickets', 'id')->where('project_id', $project->id)],
+            'assignee_user_id' => ['nullable', 'integer', Rule::exists('users', 'id')],
+            'author_user_id' => ['nullable', 'integer', Rule::exists('users', 'id')],
+            'story_points' => ['nullable', 'integer', 'min:0'],
+            'is_blocked' => ['sometimes', 'boolean'],
+            'blocked_comment' => ['nullable', 'string'],
+            'acceptance_criteria' => ['nullable', 'array', 'list'],
+            'acceptance_criteria.*' => ['array:text,checked,indent'],
+            'acceptance_criteria.*.text' => ['required', 'string'],
+            'acceptance_criteria.*.checked' => ['sometimes', 'boolean'],
+            'acceptance_criteria.*.indent' => ['sometimes', 'integer', 'min:0', 'max:'.AcceptanceCriteriaChecklistMapper::MAX_INDENT_LEVEL],
+            'field_values' => ['sometimes', 'array', 'list'],
+            'field_values.*' => ['array:ticket_field_definition_id,value_number,value_user_id'],
+            'field_values.*.ticket_field_definition_id' => [
+                'required', 'integer', 'distinct',
+                Rule::exists('ticket_field_definitions', 'id')->where('project_id', $project->id),
+            ],
+            'field_values.*.value_number' => ['nullable', 'numeric'],
+            'field_values.*.value_user_id' => ['nullable', 'integer', Rule::exists('users', 'id')],
+        ]);
+
+        $this->validateTicketConstraints($project, $user, $validated);
+
+        $ticket = $this->createProjectTicket->handle($project, $validated, $user);
+
+        return Response::structured([
+            'data' => $this->kanbanGitMcp->ticketPayload($ticket->fresh()),
+            'meta' => [
+                'message' => "{$ticket->ticket_key} was created.",
+            ],
+        ]);
+    }
+
+    /**
+     * @param  array<string, mixed>  $validated
+     */
+    private function validateTicketConstraints(Project $project, User $user, array $validated): void
+    {
+        $errors = [];
+        $parentTicketId = Arr::get($validated, 'parent_ticket_id');
+
+        if ($parentTicketId !== null) {
+            $parentTicket = Ticket::query()
+                ->where('project_id', $project->id)
+                ->with('ticketType')
+                ->find($parentTicketId);
+
+            if (! $parentTicket?->ticketType?->is_parent) {
+                $errors['parent_ticket_id'] = 'Only tickets with a parent-enabled type can be selected as a parent.';
+            }
+        }
+
+        if (Arr::get($validated, 'is_blocked', false) && blank(Arr::get($validated, 'blocked_comment'))) {
+            $errors['blocked_comment'] = 'Blocked tickets require a blocker comment.';
+        }
+
+        if (
+            Arr::exists($validated, 'author_user_id')
+            && (int) Arr::get($validated, 'author_user_id') !== $user->id
+            && ! $this->permissionService->allows($user, Permission::ProjectAdmin, $project)
+        ) {
+            $errors['author_user_id'] = 'Only project admins can change the author.';
+        }
+
+        $fieldValues = Arr::get($validated, 'field_values', []);
+
+        if ($fieldValues !== []) {
+            $fieldDefinitions = $project->ticketFieldDefinitions()->get()->keyBy('id');
+
+            foreach ($fieldValues as $index => $fieldValue) {
+                $fieldDefinition = $fieldDefinitions->get((int) Arr::get($fieldValue, 'ticket_field_definition_id'));
+                $incompatibleValue = $fieldDefinition->field_type === 'user' ? 'value_number' : 'value_user_id';
+
+                if (Arr::get($fieldValue, $incompatibleValue) !== null) {
+                    $errors["field_values.{$index}.{$incompatibleValue}"] = 'The value must match the custom field type.';
+                }
+            }
+        }
+
+        if ($errors !== []) {
+            throw ValidationException::withMessages($errors);
+        }
+    }
+
+    /**
+     * @return array<string, Type>
+     */
+    public function schema(JsonSchema $schema): array
+    {
+        return [
+            'project_id' => $schema->integer()->description('Project ID.')->required(),
+            'title' => $schema->string()->max(255)->description('Ticket title.')->required(),
+            'description' => $schema->string()->nullable()->description('Ticket description.'),
+            'ticket_type_id' => $schema->integer()->description('Ticket type ID belonging to the project. Explicitly selects the type, including types that allow child tickets.')->required(),
+            'ticket_status_id' => $schema->integer()->description('Initial ticket status ID belonging to the project.')->required(),
+            'ticket_priority_id' => $schema->integer()->description('Ticket priority ID belonging to the project.')->required(),
+            'parent_ticket_id' => $schema->integer()->nullable()->description('Existing parent ticket ID in the same project. Its type must allow children. Omit or pass null for a top-level ticket.'),
+            'assignee_user_id' => $schema->integer()->nullable()->description('User ID to assign. Omit or pass null to leave unassigned.'),
+            'author_user_id' => $schema->integer()->nullable()->description('Defaults to the application key owner when omitted. Only project admins may choose another author or pass null for no author.'),
+            'story_points' => $schema->integer()->min(0)->nullable()->description('Non-negative story point estimate.'),
+            'is_blocked' => $schema->boolean()->default(false)->description('Whether the ticket is blocked. Requires a nonblank blocked_comment when true.'),
+            'blocked_comment' => $schema->string()->nullable()->description('Blocker reason. Stored only when is_blocked is true.'),
+            'acceptance_criteria' => $schema->array()->nullable()
+                ->items($schema->object([
+                    'text' => $schema->string()->description('Checklist item text.')->required(),
+                    'checked' => $schema->boolean()->default(false),
+                    'indent' => $schema->integer()->min(0)->max(AcceptanceCriteriaChecklistMapper::MAX_INDENT_LEVEL)->default(0),
+                ])->withoutAdditionalProperties())
+                ->description('Ordered acceptance checklist. Indent 0 is a root item; larger values nest under preceding items.'),
+            'field_values' => $schema->array()
+                ->items($schema->object([
+                    'ticket_field_definition_id' => $schema->integer()->description('Custom field definition ID belonging to the project. Each definition may appear once.')->required(),
+                    'value_number' => $schema->number()->nullable()->description('Value for a numeric field.'),
+                    'value_user_id' => $schema->integer()->nullable()->description('User ID for a user field.'),
+                ])->withoutAdditionalProperties())
+                ->description('Custom field values. Supply the value matching each definition type; omit or pass null for an empty value.'),
+        ];
+    }
+}

app/Mcp/Tools/ListTicketTypes.php

@@ -0,0 +1,56 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use App\Http\Resources\ProjectResource;
+use App\Http\Resources\TicketTypeResource;
+use App\Mcp\Support\KanbanGitMcp;
+use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Illuminate\JsonSchema\Types\Type;
+use Illuminate\Support\Arr;
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+use Laravel\Mcp\ResponseFactory;
+use Laravel\Mcp\Server\Attributes\Description;
+use Laravel\Mcp\Server\Attributes\Name;
+use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[Name('list_ticket_types')]
+#[Description('List all ticket types in a visible project in their configured order, including IDs, names, and is_parent. Use a returned ID as ticket_type_id when creating a ticket. Types with is_parent=true allow tickets of that type to have child tickets; set parent_ticket_id on create_ticket to attach a child to an existing parent ticket.')]
+#[IsReadOnly]
+class ListTicketTypes extends Tool
+{
+    public function __construct(
+        private readonly KanbanGitMcp $kanbanGitMcp,
+    ) {}
+
+    public function handle(Request $request): Response|ResponseFactory
+    {
+        $validated = $request->validate([
+            'project_id' => ['required', 'integer'],
+        ]);
+
+        $user = $this->kanbanGitMcp->user($request);
+        $project = $this->kanbanGitMcp->projectForRead($user, (int) Arr::get($validated, 'project_id'));
+
+        return Response::structured([
+            'data' => [
+                'project' => ProjectResource::make($project)->resolve(),
+                'ticket_types' => TicketTypeResource::collection($project->ticketTypes()->get())->resolve(),
+            ],
+        ]);
+    }
+
+    /**
+     * @return array<string, Type>
+     */
+    public function schema(JsonSchema $schema): array
+    {
+        return [
+            'project_id' => $schema->integer()
+                ->description('Project ID. Requires permission to view this project.')
+                ->required(),
+        ];
+    }
+}

app/Models/BoardColumn.php

@@ -16,6 +16,7 @@ class BoardColumn extends Model
 {
     /** @use HasFactory<BoardColumnFactory> */
     use HasFactory;
+
     use SyncsProjectTemplateOwnership;
 
     protected static function booted(): void

app/Models/NotificationAction.php

@@ -31,6 +31,7 @@ class NotificationAction extends Model
 {
     /** @use HasFactory<NotificationActionFactory> */
     use HasFactory;
+
     use SyncsProjectTemplateOwnership;
 
     /**

app/Models/RepositoryConnection.php

@@ -26,6 +26,7 @@ class RepositoryConnection extends Model
 {
     /** @use HasFactory<RepositoryConnectionFactory> */
     use HasFactory;
+
     use SyncsProjectTemplateOwnership;
 
     /**

app/Models/TicketFieldDefinition.php

@@ -23,6 +23,7 @@ class TicketFieldDefinition extends Model
 
     /** @use HasFactory<TicketFieldDefinitionFactory> */
     use HasFactory;
+
     use SyncsProjectTemplateOwnership;
 
     protected static function booted(): void

app/Models/TicketLinkType.php

@@ -15,6 +15,7 @@ class TicketLinkType extends Model
 {
     /** @use HasFactory<TicketLinkTypeFactory> */
     use HasFactory;
+
     use SyncsProjectTemplateOwnership;
 
     protected static function booted(): void

app/Models/TicketStatus.php

@@ -17,6 +17,7 @@ class TicketStatus extends Model
 {
     /** @use HasFactory<TicketStatusFactory> */
     use HasFactory;
+
     use SyncsProjectTemplateOwnership;
 
     protected static function booted(): void

app/Models/TicketType.php

@@ -15,6 +15,7 @@ class TicketType extends Model
 {
     /** @use HasFactory<TicketTypeFactory> */
     use HasFactory;
+
     use SyncsProjectTemplateOwnership;
 
     protected static function booted(): void

app/Models/User.php

@@ -77,12 +77,28 @@ class User extends Authenticatable
     protected function avatar(): Attribute
     {
         return Attribute::get(
-            fn (): ?string => filled($this->avatar_path)
-                ? Storage::disk('public')->url($this->avatar_path)
-                : null,
+            fn (): ?string => $this->avatarUrl(),
         );
     }
 
+    private function avatarUrl(): ?string
+    {
+        if (blank($this->avatar_path)) {
+            return null;
+        }
+
+        $diskName = config('filesystems.avatar_disk', 'public');
+        $disk = Storage::disk(is_string($diskName) && $diskName !== '' ? $diskName : 'public');
+
+        if ((bool) config('filesystems.avatar_urls_temporary', false)) {
+            $expirationMinutes = max(1, (int) config('filesystems.avatar_url_expiration_minutes', 15));
+
+            return $disk->temporaryUrl($this->avatar_path, now()->addMinutes($expirationMinutes));
+        }
+
+        return $disk->url($this->avatar_path);
+    }
+
     public function permissionAssignments(): MorphMany
     {
         return $this->morphMany(PermissionAssignment::class, 'assignee');

boost.json

@@ -9,8 +9,7 @@
     "skills": [
         "fortify-development",
         "laravel-best-practices",
-        "wayfinder-development",
-        "inertia-vue-development",
-        "tailwindcss-development"
+        "mcp-development",
+        "wayfinder-development"
     ]
 }

bootstrap/app.php

@@ -17,6 +17,8 @@ return Application::configure(basePath: dirname(__DIR__))
         health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware): void {
+        $middleware->trustProxies(at: '*');
+
         $middleware->encryptCookies(except: ['appearance', 'sidebar_state']);
 
         $middleware->web(append: [
@@ -31,5 +33,5 @@ return Application::configure(basePath: dirname(__DIR__))
         ]);
     })
     ->withExceptions(function (Exceptions $exceptions): void {
-        //
+        $exceptions->dontFlash(['api_token']);
     })->create();

composer.json

@@ -12,13 +12,15 @@
         "php": "^8.4",
         "inertiajs/inertia-laravel": "^2.0",
         "laravel/fortify": "^1.34",
-        "laravel/framework": "^13.0",
+        "laravel/framework": "^v13.26.1",
         "laravel/mcp": "^0.6",
         "laravel/tinker": "^3.0",
         "laravel/wayfinder": "^0.1.14",
+        "league/flysystem-aws-s3-v3": "^3.0",
         "scalar/laravel": "^0.2.1"
     },
     "require-dev": {
+        "brianium/paratest": "^7.20",
         "fakerphp/faker": "^1.24",
         "laravel/boost": "^2.0",
         "laravel/pail": "^1.2.5",
@@ -46,15 +48,15 @@
             "@php -r \"file_exists('.env') || copy('.env.example', '.env');\"",
             "@php artisan key:generate",
             "@php artisan migrate --force",
-            "npm install",
-            "npm run build"
+            "pnpm install",
+            "pnpm run build"
         ],
         "dev": [
             "Composer\\Config::disableProcessTimeout",
-            "npx concurrently -c \"#93c5fd,#c4b5fd,#fb7185,#fdba74\" \"php artisan serve\" \"php artisan queue:listen --tries=1 --timeout=0\" \"php artisan pail --timeout=0\" \"npm run dev\" --names=server,queue,logs,vite --kill-others"
+            "@php artisan dev"
         ],
         "dev:ssr": [
-            "npm run build:ssr",
+            "pnpm run build:ssr",
             "Composer\\Config::disableProcessTimeout",
             "npx concurrently -c \"#93c5fd,#c4b5fd,#fb7185,#fdba74\" \"php artisan serve\" \"php artisan queue:listen --tries=1\" \"php artisan pail --timeout=0\" \"php artisan inertia:start-ssr\" --names=server,queue,logs,ssr --kill-others"
         ],
@@ -66,15 +68,27 @@
         ],
         "ci:check": [
             "Composer\\Config::disableProcessTimeout",
-            "npm run lint:check",
-            "npm run format:check",
-            "npm run types:check",
-            "@test"
+            "@ci:frontend",
+            "@ci:backend",
+            "@ci:test"
+        ],
+        "ci:frontend": [
+            "pnpm audit --audit-level=high",
+            "pnpm run lint:check",
+            "pnpm run types:check",
+            "pnpm run build"
+        ],
+        "ci:backend": [
+            "@lint:check"
+        ],
+        "ci:test": [
+            "@php artisan config:clear --ansi",
+            "@php artisan test --parallel --processes=2"
         ],
         "test": [
             "@php artisan config:clear --ansi",
             "@lint:check",
-            "@php artisan test"
+            "@php artisan test --parallel --processes=2"
         ],
         "post-autoload-dump": [
             "Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",

config/filesystems.php

@@ -15,6 +15,12 @@ return [
 
     'default' => env('FILESYSTEM_DISK', 'local'),
 
+    'avatar_disk' => env('AVATAR_FILESYSTEM_DISK', env('FILESYSTEM_DISK', 'public')),
+
+    'avatar_urls_temporary' => env('AVATAR_URLS_TEMPORARY', false),
+
+    'avatar_url_expiration_minutes' => env('AVATAR_URL_EXPIRATION_MINUTES', 15),
+
     /*
     |--------------------------------------------------------------------------
     | Filesystem Disks

docker-compose.yml

@@ -1,33 +1,38 @@
 services:
   web:
     container_name: kanbangit-web
+    image: kanbangit-app:local
     build:
       context: .
-      dockerfile: ./docker/nginx/Dockerfile
+      dockerfile: Dockerfile
+      target: runtime
+    command: nginx
     restart: unless-stopped
     ports:
-      - "8080:80"
-    volumes:
-      - kanbangit-storage:/var/www/storage:ro
-      - kanbangit-public-assets:/var/www/public/build:ro
+      - "8080:8080"
     env_file:
       - .env.production
+    environment:
+      PHP_FPM_UPSTREAM: php-fpm:9000
     networks:
       - kanbangit-web
+    healthcheck:
+      test: ["CMD", "curl", "--fail", "--silent", "http://127.0.0.1:8080/up"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
     depends_on:
       php-fpm:
         condition: service_healthy
 
   php-fpm:
     container_name: kanbangit-php-fpm
+    image: kanbangit-app:local
     build:
       context: .
-      dockerfile: ./docker/php-fpm/Dockerfile
-      target: production
+      dockerfile: Dockerfile
+      target: runtime
     restart: unless-stopped
-    volumes:
-      - kanbangit-storage:/var/www/storage
-      - kanbangit-public-assets:/var/www/public/build
     env_file:
       - .env.production
     networks:
@@ -42,6 +47,23 @@ services:
       mariadb:
         condition: service_healthy
 
+  worker:
+    container_name: kanbangit-worker
+    image: kanbangit-app:local
+    build:
+      context: .
+      dockerfile: Dockerfile
+      target: runtime
+    command: php artisan queue:work --sleep=3 --tries=3 --timeout=60 --max-time=3600
+    restart: unless-stopped
+    env_file:
+      - .env.production
+    networks:
+      - kanbangit-db
+    depends_on:
+      mariadb:
+        condition: service_healthy
+
   mariadb:
     container_name: kanbangit-db
     image: mariadb:11.4
@@ -65,5 +87,3 @@ networks:
 
 volumes:
   mariadb-data-production:
-  kanbangit-storage:
-  kanbangit-public-assets:

docker/entrypoint.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+set -eu
+
+if [ "${1:-}" = "nginx" ]; then
+    : "${PHP_FPM_UPSTREAM:=127.0.0.1:9000}"
+    export PHP_FPM_UPSTREAM
+
+    envsubst '${PHP_FPM_UPSTREAM}' \
+        < /etc/nginx/nginx.conf.template \
+        > /tmp/nginx.conf
+
+    exec nginx -c /tmp/nginx.conf -g 'daemon off;'
+fi
+
+mkdir -p \
+    bootstrap/cache \
+    storage/framework/cache \
+    storage/framework/sessions \
+    storage/framework/testing \
+    storage/framework/views \
+    storage/logs
+
+php artisan config:cache --no-ansi
+php artisan route:cache --no-ansi
+
+exec "$@"

docker/nginx/Dockerfile

@@ -1,20 +0,0 @@
-FROM php:8.4-cli-bookworm AS builder
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl ca-certificates git unzip \
-    && rm -rf /var/lib/apt/lists/*
-RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
-    && apt-get update && apt-get install -y --no-install-recommends nodejs \
-    && rm -rf /var/lib/apt/lists/*
-RUN curl -sS https://getcomposer.org/installer | php -- \
-    --install-dir=/usr/local/bin --filename=composer
-WORKDIR /var/www
-COPY . /var/www
-RUN composer install --no-dev --prefer-dist --no-interaction --no-progress --optimize-autoloader
-RUN npm ci && npm run build
-
-FROM nginx:alpine
-COPY ./docker/nginx/nginx.conf /etc/nginx/nginx.conf
-COPY --from=builder /var/www/public /var/www/public
-WORKDIR /var/www/public
-EXPOSE 80
-CMD ["nginx", "-g", "daemon off;"]

docker/nginx/nginx.conf

@@ -1,33 +0,0 @@
-events {
-    worker_connections  1024;
-}
-http {
-    include       /etc/nginx/mime.types;
-    default_type  application/octet-stream;
-    sendfile        on;
-    keepalive_timeout  65;
-    client_max_body_size 100m;
-
-    server {
-        listen 80;
-        server_name localhost;
-        root /var/www/public;
-        index index.php index.html;
-        location / {
-            try_files $uri $uri/ /index.php?$query_string;
-        }
-         location ^~ /storage/ {
-            alias /var/www/storage/app/public/;
-            try_files $uri =404;
-            access_log off;
-            expires 7d;
-            add_header Cache-Control "public";
-        }
-        location ~ \.php$ {
-            fastcgi_pass php-fpm:9000;
-            fastcgi_index index.php;
-            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-            include fastcgi_params;
-        }
-    }
-}

docker/nginx/nginx.conf.template

@@ -0,0 +1,58 @@
+pid /tmp/nginx.pid;
+error_log /dev/stderr warn;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    access_log /dev/stdout;
+    client_body_temp_path /tmp/client_body;
+    proxy_temp_path /tmp/proxy;
+    fastcgi_temp_path /tmp/fastcgi;
+    uwsgi_temp_path /tmp/uwsgi;
+    scgi_temp_path /tmp/scgi;
+
+    sendfile on;
+    keepalive_timeout 65;
+    client_max_body_size 3m;
+
+    server {
+        listen 8080;
+        server_name _;
+        root /var/www/public;
+        index index.php;
+
+        location = /nginx-health {
+            access_log off;
+            default_type text/plain;
+            return 200 'ok';
+        }
+
+        location / {
+            try_files $uri $uri/ /index.php?$query_string;
+        }
+
+        location = /index.php {
+            include /etc/nginx/fastcgi_params;
+            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+            fastcgi_param HTTP_PROXY '';
+            fastcgi_param HTTP_X_FORWARDED_FOR $http_x_forwarded_for;
+            fastcgi_param HTTP_X_FORWARDED_HOST $http_x_forwarded_host;
+            fastcgi_param HTTP_X_FORWARDED_PORT $http_x_forwarded_port;
+            fastcgi_param HTTP_X_FORWARDED_PROTO $http_x_forwarded_proto;
+            fastcgi_pass ${PHP_FPM_UPSTREAM};
+        }
+
+        location ~ \.php$ {
+            return 404;
+        }
+
+        location ~ /\. {
+            deny all;
+        }
+    }
+}

docker/php-fpm-healthcheck.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+set -eu
+
+SCRIPT_NAME=/status \
+SCRIPT_FILENAME=/status \
+REQUEST_METHOD=GET \
+cgi-fcgi -bind -connect 127.0.0.1:9000 2>/dev/null | grep -q '^pool:'

docker/php-fpm/Dockerfile

@@ -1,66 +0,0 @@
-FROM php:8.4-fpm AS builder
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
-    unzip \
-    libpq-dev \
-    libonig-dev \
-    libssl-dev \
-    libxml2-dev \
-    libcurl4-openssl-dev \
-    libicu-dev \
-    libzip-dev \
-    libmagickwand-dev \
-    libpng-dev \
-    libjpeg-dev \
-    libfreetype6-dev \
-    && docker-php-ext-install -j$(nproc) \
-    pdo_mysql \
-    pdo_pgsql \
-    pgsql \
-    opcache \
-    intl \
-    zip \
-    bcmath \
-    soap \
-    && docker-php-ext-configure gd --with-jpeg --with-freetype \
-    && docker-php-ext-install -j$(nproc) gd \
-    && pecl install imagick \
-    && docker-php-ext-enable imagick \
-    && apt-get autoremove -y && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
-WORKDIR /var/www
-COPY . /var/www
-RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer \
-    && composer install --no-dev --optimize-autoloader --no-interaction --no-progress --prefer-dist
-FROM php:8.4-fpm AS production
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    libpq-dev \
-    libicu-dev \
-    libzip-dev \
-    libfcgi-bin \
-    procps \
-    libmagickwand-dev \
-    && apt-get autoremove -y && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
-RUN curl -o /usr/local/bin/php-fpm-healthcheck \
-    https://raw.githubusercontent.com/renatomefi/php-fpm-healthcheck/master/php-fpm-healthcheck \
-    && chmod +x /usr/local/bin/php-fpm-healthcheck
-COPY ./docker/php-fpm/entrypoint.sh /usr/local/bin/entrypoint.sh
-RUN chmod +x /usr/local/bin/entrypoint.sh
-COPY ./storage /var/www/storage-init
-COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/
-COPY --from=builder /usr/local/etc/php/conf.d/ /usr/local/etc/php/conf.d/
-COPY --from=builder /usr/local/bin/docker-php-ext-* /usr/local/bin/
-RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"
-RUN printf '%s\n' \
-'[global]' \
-'daemonize = no' \
-'' \
-'[www]' \
-'pm.status_path = /status' \
-> /usr/local/etc/php-fpm.d/zz-docker.conf
-COPY --from=builder /var/www /var/www
-WORKDIR /var/www
-RUN chown -R www-data:www-data /var/www
-USER www-data
-ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
-EXPOSE 9000
-CMD ["php-fpm"]

docker/php-fpm/entrypoint.sh

@@ -1,11 +0,0 @@
-#!/bin/sh
-set -e
-if [ ! "$(ls -A /var/www/storage)" ]; then
-  echo "Initializing storage directory..."
-  cp -R /var/www/storage-init/. /var/www/storage
-  chown -R www-data:www-data /var/www/storage
-fi
-rm -rf /var/www/storage-init
-php artisan config:cache
-php artisan route:cache
-exec "$@"

eslint.config.mjs

@@ -25,8 +25,11 @@ const prettierOptions = {
 const eslintConfig = [
     {
         ignores: [
+            'bootstrap/ssr/**',
             '**/dist/**',
-            'node_modules/**',
+            '**/node_modules/**',
+            'native/src-tauri/target/**',
+            'native/src-tauri/gen/**',
             '.github/**',
             '**/*.yml',
             '**/*.yaml',
@@ -37,7 +40,10 @@ const eslintConfig = [
             'bootstrap/cache/**',
             'public/build/**',
             'public/hot',
+            'resources/js/actions/**',
             'resources/js/components/ui/**',
+            'resources/js/routes/**',
+            'resources/js/wayfinder/**',
             'resources/views/mail/**',
         ],
     },

native/macos-ci.mjs

@@ -0,0 +1,267 @@
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import {
+    appendFileSync,
+    copyFileSync,
+    readlinkSync,
+    existsSync,
+    mkdirSync,
+    mkdtempSync,
+    readFileSync,
+    renameSync,
+    rmSync,
+    writeFileSync,
+} from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import process from 'node:process';
+import { updateSource } from './update-manifest.mjs';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import {
+    appleTeamId,
+    bundleIdentifier,
+    verifySignedMacosApp,
+} from './release-macos.mjs';
+
+const nativeDirectory = dirname(fileURLToPath(import.meta.url));
+
+export function releaseMetadata(
+    env = process.env,
+    directory = nativeDirectory,
+) {
+    const config = JSON.parse(
+        readFileSync(join(directory, 'src-tauri/tauri.conf.json'), 'utf8'),
+    );
+    const nativePackage = JSON.parse(
+        readFileSync(join(directory, 'package.json'), 'utf8'),
+    );
+    const packageVersion = nativePackage.version;
+    const cargoVersion = readFileSync(
+        join(directory, 'src-tauri/Cargo.toml'),
+        'utf8',
+    )
+        .match(/\[package\]([\s\S]*?)(?:\n\[|$)/)?.[1]
+        .match(/^version\s*=\s*"([^"]+)"/m)?.[1];
+    if (
+        !/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(config.version) ||
+        config.version !== packageVersion ||
+        config.version !== cargoVersion
+    ) {
+        throw new Error(
+            'Tauri, package.json and Cargo.toml must have the same stable release version.',
+        );
+    }
+    if (env.RELEASE_TAG !== `macos-v${config.version}`) {
+        throw new Error(
+            'Release tag must be macos-vMAJOR.MINOR.PATCH and match the app version.',
+        );
+    }
+    if (
+        config.identifier !== bundleIdentifier ||
+        config.productName !== 'KanbanGit'
+    ) {
+        throw new Error(
+            'The macOS product name and bundle identifier must stay unchanged.',
+        );
+    }
+    if (config.plugins?.updater?.pubkey !== updateSource.publicKey) {
+        throw new Error(
+            'The app updater key must match the permanent release key.',
+        );
+    }
+    if (
+        !/^\d+(?:\.\d+){0,2}$/.test(config.bundle?.macOS?.bundleVersion || '')
+    ) {
+        throw new Error(
+            'Set a numeric macOS bundleVersion for the About build number.',
+        );
+    }
+    if (!nativePackage.releaseNotes?.trim()) {
+        throw new Error(
+            'Add releaseNotes to native/package.json before publishing.',
+        );
+    }
+    const target = env.MACOS_RELEASE_TARGET || 'aarch64-apple-darwin';
+    const arch = {
+        'aarch64-apple-darwin': 'arm64',
+        'x86_64-apple-darwin': 'x86_64',
+    }[target];
+    if (!arch) {
+        throw new Error(
+            'MACOS_RELEASE_TARGET must select Apple Silicon or Intel macOS.',
+        );
+    }
+    const identity = env.APPLE_SIGNING_IDENTITY;
+    if (
+        !identity?.startsWith('Developer ID Application: ') ||
+        !identity.endsWith(` (${appleTeamId})`) ||
+        /[\r\n"]/.test(identity)
+    ) {
+        throw new Error(
+            `A Developer ID Application identity for ${appleTeamId} is required.`,
+        );
+    }
+    return {
+        version: config.version,
+        notes: nativePackage.releaseNotes,
+        target,
+        arch,
+        filename: `KanbanGit-${config.version}-${target}.dmg`,
+        updaterFilename: `KanbanGit-${config.version}-${target}.app.tar.gz`,
+    };
+}
+
+export function execute(command, args) {
+    const result = spawnSync(command, args, {
+        encoding: 'utf8',
+        maxBuffer: 16 * 1024 * 1024,
+    });
+    if (result.error || result.status !== 0) {
+        throw new Error(
+            `${command} failed (exit ${result.status ?? 'unknown'}). ${result.stderr || ''}`,
+        );
+    }
+    return result.stdout?.trim() || result.stderr?.trim() || '';
+}
+
+export function verifyNotarizedApp(app, metadata, run = execute) {
+    verifySignedMacosApp({
+        app,
+        version: metadata.version,
+        step: (_label, command, args) => run(command, args),
+    });
+    const arch = run('lipo', [
+        '-archs',
+        join(app, 'Contents/MacOS/kanbangit-native'),
+    ]).trim();
+    if (arch !== metadata.arch) {
+        throw new Error(
+            'The app architecture does not match its download path.',
+        );
+    }
+    run('xcrun', ['stapler', 'validate', app]);
+    run('spctl', ['--assess', '--type', 'execute', '--verbose=2', app]);
+}
+
+export function packageNotarizedApp({
+    env = process.env,
+    directory = nativeDirectory,
+    run = execute,
+} = {}) {
+    const metadata = releaseMetadata(env, directory);
+    const root = join(directory, 'src-tauri/target');
+    const app = join(
+        root,
+        metadata.target,
+        'release/bundle/macos/KanbanGit.app',
+    );
+    verifyNotarizedApp(app, metadata, run);
+    const releaseRoot = join(root, 'macos-release');
+    const destination = join(
+        releaseRoot,
+        `${metadata.version}-${metadata.target}`,
+    );
+    if (existsSync(destination)) {
+        throw new Error(
+            'Release output already exists; start from a clean checkout.',
+        );
+    }
+    mkdirSync(releaseRoot, { recursive: true });
+    const staging = mkdtempSync(join(releaseRoot, '.pending-'));
+    try {
+        const archive = join(staging, metadata.filename);
+        const bundle = join(root, metadata.target, 'release/bundle');
+        copyFileSync(
+            join(
+                bundle,
+                'dmg',
+                `KanbanGit_${metadata.version}_${metadata.arch === 'arm64' ? 'aarch64' : 'x64'}.dmg`,
+            ),
+            archive,
+        );
+        const mounted = join(staging, 'mounted');
+        mkdirSync(mounted);
+        run('hdiutil', ['verify', archive]);
+        run('hdiutil', [
+            'attach',
+            archive,
+            '-readonly',
+            '-nobrowse',
+            '-mountpoint',
+            mounted,
+        ]);
+        try {
+            if (
+                readlinkSync(join(mounted, 'Applications')) !== '/Applications'
+            ) {
+                throw new Error(
+                    'DMG must contain the Applications installation link.',
+                );
+            }
+            verifyNotarizedApp(join(mounted, 'KanbanGit.app'), metadata, run);
+        } finally {
+            run('hdiutil', ['detach', mounted]);
+        }
+        rmSync(mounted, { recursive: true, force: true });
+        const updateArchive = join(staging, metadata.updaterFilename);
+        copyFileSync(join(bundle, 'macos/KanbanGit.app.tar.gz'), updateArchive);
+        copyFileSync(
+            join(bundle, 'macos/KanbanGit.app.tar.gz.sig'),
+            `${updateArchive}.sig`,
+        );
+        if (!readFileSync(`${updateArchive}.sig`, 'utf8').trim()) {
+            throw new Error('The updater signature is missing.');
+        }
+        const extracted = join(staging, 'extracted');
+        mkdirSync(extracted);
+        run('tar', ['-xzf', updateArchive, '-C', extracted]);
+        verifyNotarizedApp(join(extracted, 'KanbanGit.app'), metadata, run);
+        rmSync(extracted, { recursive: true, force: true });
+        const checksum = createHash('sha256')
+            .update(readFileSync(archive))
+            .digest('hex');
+        for (const name of [metadata.filename, metadata.updaterFilename]) {
+            const hash = createHash('sha256')
+                .update(readFileSync(join(staging, name)))
+                .digest('hex');
+            writeFileSync(
+                join(staging, `${name}.sha256`),
+                `${hash}  ${name}\n`,
+            );
+        }
+        renameSync(staging, destination);
+        return { ...metadata, directory: destination, checksum };
+    } finally {
+        rmSync(staging, { recursive: true, force: true });
+    }
+}
+
+if (
+    process.argv[1] &&
+    import.meta.url === pathToFileURL(resolve(process.argv[1])).href
+) {
+    try {
+        let output;
+        if (process.argv[2] === 'metadata') {
+            output = releaseMetadata();
+        } else if (process.argv[2] === 'package') {
+            output = packageNotarizedApp();
+        } else {
+            throw new Error(
+                'Use metadata or package. Building and notarizing are handled by tauri-action.',
+            );
+        }
+        if (process.env.GITHUB_OUTPUT) {
+            appendFileSync(
+                process.env.GITHUB_OUTPUT,
+                Object.entries(output)
+                    .filter(([key]) => key !== 'notes')
+                    .map(([key, value]) => `${key}=${value}\n`)
+                    .join(''),
+            );
+        }
+        console.log(JSON.stringify(output));
+    } catch (error) {
+        console.error(error.message);
+        process.exitCode = 1;
+    }
+}

native/macos-dmg.mjs

@@ -0,0 +1,25 @@
+import { mkdirSync, rmSync, symlinkSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+
+export function createDiskImage({ app, archive, identity, run }) {
+    const contents = join(dirname(archive), 'dmg-contents');
+    mkdirSync(contents);
+    try {
+        run('ditto', [app, join(contents, 'KanbanGit.app')]);
+        symlinkSync('/Applications', join(contents, 'Applications'));
+        run('hdiutil', [
+            'create',
+            '-volname',
+            'KanbanGit',
+            '-srcfolder',
+            contents,
+            '-format',
+            'UDZO',
+            archive,
+        ]);
+        run('codesign', ['--sign', identity, '--timestamp', archive]);
+        run('hdiutil', ['verify', archive]);
+    } finally {
+        rmSync(contents, { recursive: true, force: true });
+    }
+}

native/package.json

@@ -0,0 +1,28 @@
+{
+    "name": "kanbangit-native",
+    "version": "0.1.5",
+    "private": true,
+    "type": "module",
+    "scripts": {
+        "dev": "tauri dev",
+        "build": "tauri build",
+        "build:macos": "tauri build --debug --bundles app",
+        "release:macos": "node release-macos.mjs",
+        "test": "node --test tests/*.test.js && cargo test --manifest-path src-tauri/Cargo.toml --locked",
+        "check": "cargo fmt --manifest-path src-tauri/Cargo.toml --check && cargo clippy --manifest-path src-tauri/Cargo.toml --locked --all-targets --all-features -- -D warnings",
+        "dev:android": "tauri android dev",
+        "build:android": "tauri android build --debug --apk --target aarch64",
+        "smoke:macos": "cargo test --manifest-path src-tauri/Cargo.toml --locked --features smoke-test,custom-protocol --test macos_smoke",
+        "dev:ios": "tauri ios dev",
+        "build:ios:simulator": "rm -rf src-tauri/gen/apple/build/arm64-sim/KanbanGit.app && tauri ios build --debug --target aarch64-sim --no-sign --ci",
+        "build:ios:device": "tauri ios build --debug --target aarch64 --export-method debugging --archive-only",
+        "open:ios": "tauri ios dev --open --no-dev-server",
+        "prepare:ios": "xcodegen generate --spec src-tauri/gen/apple/project.yml",
+        "test:ios": "xcodebuild -project src-tauri/gen/apple/kanbangit-native.xcodeproj -scheme kanbangit-native_iOS -configuration debug -destination \"platform=iOS Simulator,id=${IOS_SIMULATOR_ID:?Set IOS_SIMULATOR_ID to an installed simulator UUID}\" -parallel-testing-enabled NO CODE_SIGNING_ALLOWED=NO test",
+        "smoke:updater": "cargo test --manifest-path src-tauri/Cargo.toml --locked --features smoke-test,custom-protocol --test updater_smoke"
+    },
+    "devDependencies": {
+        "@tauri-apps/cli": "2.11.4"
+    },
+    "releaseNotes": "Install Update in the KanbanGit menu is now enabled when an update is available. The Update badge has been removed from the Dock icon."
+}

native/pnpm-lock.yaml

@@ -0,0 +1,140 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .:
+    devDependencies:
+      '@tauri-apps/cli':
+        specifier: 2.11.4
+        version: 2.11.4
+
+packages:
+
+  '@tauri-apps/cli-darwin-arm64@2.11.4':
+    resolution: {integrity: sha512-1ryOF3ZhpZ/nemHV5zVwBQBz9jDGKmKPvWPADOhc83ig0P4bMc2iER4NbC6r9sjeIZ6RVQ4g3RZIYvezhcl4TQ==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@tauri-apps/cli-darwin-x64@2.11.4':
+    resolution: {integrity: sha512-uFsGQAAfuyz1k/yGLmkWfkBlgKAqZfxqlHmLWx81QU27RJWfmbNHCIq8T8w1e+VClleIuZUjpHWfoE4E3DLo3A==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@tauri-apps/cli-linux-arm-gnueabihf@2.11.4':
+    resolution: {integrity: sha512-IaHZn5CdBL21oUmjiVOS1ctw6Ip1O0pjp70FwOWmYz1myWe0SY96ZIj2FYf7pT0m8bI2h/hrs5ZbEXXh44/MkQ==}
+    engines: {node: '>= 10'}
+    cpu: [arm]
+    os: [linux]
+
+  '@tauri-apps/cli-linux-arm64-gnu@2.11.4':
+    resolution: {integrity: sha512-N41/ukTRVe6XSuUTESuFdGeOW2i7k62tK+6gHK5Kd5/q5RPvvi19GaWAVPPb9u95HSGmTChSolBfzynUsssFaA==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@tauri-apps/cli-linux-arm64-musl@2.11.4':
+    resolution: {integrity: sha512-v277UnT/fB64xAfSroL5N3Km3tLmvATWqJJw/wRI+g6o+HkeD0slyE7gOhNs1MbjE41R7bQOTxMVoL3aomUJmw==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@tauri-apps/cli-linux-riscv64-gnu@2.11.4':
+    resolution: {integrity: sha512-qqgNkQ2u1yZHxjhxsZaxUtRDW8dIqIYm33rx/mzwQv0SfY9x1B+iraj8vWeFiXjjSVVhEMepXSOts1TqPzvXNQ==}
+    engines: {node: '>= 10'}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@tauri-apps/cli-linux-x64-gnu@2.11.4':
+    resolution: {integrity: sha512-2VRNWl84FOH0m2giiDkO2h0QXlcMJeX+zJDpI5kDIQAx6s+geF3v48F4DXfJez4GS/FdoDGnPnw1C2iYGbQ7bQ==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@tauri-apps/cli-linux-x64-musl@2.11.4':
+    resolution: {integrity: sha512-o9GyhYor/nc7xarmwDE3ka2szuW3uuZzXjHWh64Q8YX5AtSgxdQkFWzrY4O8KiGtVNvFBI14H3Q49Qj5TOIP/A==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@tauri-apps/cli-win32-arm64-msvc@2.11.4':
+    resolution: {integrity: sha512-ld5Ehb598m0VkYyylRPNeCFsBe/km0jxis6KgMpl3IGY6I/i1RwQXO05I1AsXUXO2WC6AvB/Lw4qTf/asiuEiQ==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@tauri-apps/cli-win32-ia32-msvc@2.11.4':
+    resolution: {integrity: sha512-12Hxi0XX/H5VFxO/bGgHkFWhml9VMgEOu9CidjeCeTNQ1l6fpUlbiGgSP7CLI3PFtW9/FfbeHieZ+kyWK5H7CA==}
+    engines: {node: '>= 10'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@tauri-apps/cli-win32-x64-msvc@2.11.4':
+    resolution: {integrity: sha512-+vDiqBIU5dMISg/wNvX3sF+ZHfgJGJ5T0AcO+EHNXV9GGAG+P5fzodlDXD3QdKCRgZxMoCm5PPvj3BqLNjBthw==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [win32]
+
+  '@tauri-apps/cli@2.11.4':
+    resolution: {integrity: sha512-R8xGtMpwyetawSqm9kYOuMmEqkhUbvcUy8n0aNXIxollKBLESUu5f4Fx+64hgASYm1H+jSWq6jCW6zqTnH6hqQ==}
+    engines: {node: '>= 10'}
+    hasBin: true
+
+snapshots:
+
+  '@tauri-apps/cli-darwin-arm64@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli-darwin-x64@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli-linux-arm-gnueabihf@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli-linux-arm64-gnu@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli-linux-arm64-musl@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli-linux-riscv64-gnu@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli-linux-x64-gnu@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli-linux-x64-musl@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli-win32-arm64-msvc@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli-win32-ia32-msvc@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli-win32-x64-msvc@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli@2.11.4':
+    optionalDependencies:
+      '@tauri-apps/cli-darwin-arm64': 2.11.4
+      '@tauri-apps/cli-darwin-x64': 2.11.4
+      '@tauri-apps/cli-linux-arm-gnueabihf': 2.11.4
+      '@tauri-apps/cli-linux-arm64-gnu': 2.11.4
+      '@tauri-apps/cli-linux-arm64-musl': 2.11.4
+      '@tauri-apps/cli-linux-riscv64-gnu': 2.11.4
+      '@tauri-apps/cli-linux-x64-gnu': 2.11.4
+      '@tauri-apps/cli-linux-x64-musl': 2.11.4
+      '@tauri-apps/cli-win32-arm64-msvc': 2.11.4
+      '@tauri-apps/cli-win32-ia32-msvc': 2.11.4
+      '@tauri-apps/cli-win32-x64-msvc': 2.11.4

native/pnpm-workspace.yaml

@@ -0,0 +1 @@
+minimumReleaseAge: 10080

native/publish-macos.mjs

@@ -0,0 +1,462 @@
+import { Buffer } from 'node:buffer';
+import { createHash } from 'node:crypto';
+import {
+    appendFileSync,
+    mkdtempSync,
+    readFileSync,
+    rmSync,
+    writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import process from 'node:process';
+import { setTimeout } from 'node:timers/promises';
+import { pathToFileURL } from 'node:url';
+import { execute, releaseMetadata } from './macos-ci.mjs';
+import {
+    compareVersions,
+    updateManifest,
+    updateSource,
+    verifyUpdateSignature,
+} from './update-manifest.mjs';
+
+export function storageConfiguration(env = process.env) {
+    const region = env.S3_REGION;
+    const bucket = env.S3_BUCKET;
+    const prefix = env.S3_PREFIX || 'releases/macos';
+    if (!['nbg1', 'fsn1', 'hel1'].includes(region)) {
+        throw new Error('S3_REGION must be nbg1, fsn1 or hel1.');
+    }
+    if (!/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/.test(bucket || '')) {
+        throw new Error('Set S3_BUCKET to the Hetzner release bucket name.');
+    }
+    if (!/^[a-zA-Z0-9_-]+(?:\/[a-zA-Z0-9_-]+)*$/.test(prefix)) {
+        throw new Error(
+            'S3_PREFIX must contain plain path segments without leading or trailing slashes.',
+        );
+    }
+    const endpoint = `https://${region}.your-objectstorage.com`;
+    const publicBase =
+        env.S3_PUBLIC_BASE_URL ||
+        `https://${bucket}.${region}.your-objectstorage.com`;
+    const url = new URL(publicBase);
+    if (
+        url.protocol !== 'https:' ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        /[\s]/.test(publicBase)
+    ) {
+        throw new Error(
+            'S3_PUBLIC_BASE_URL must be a public HTTPS URL without credentials or query parameters.',
+        );
+    }
+    return {
+        region,
+        bucket,
+        prefix,
+        endpoint,
+        publicBase: publicBase.replace(/\/$/, ''),
+    };
+}
+
+const sha256 = (data) => createHash('sha256').update(data).digest('hex');
+
+export function conditionalEtag(etag) {
+    const value =
+        typeof etag === 'string' && etag.startsWith('"') && etag.endsWith('"')
+            ? etag.slice(1, -1)
+            : etag;
+    if (
+        typeof value !== 'string' ||
+        !/^[a-f\d]{32}(?:-[1-9]\d*)?$/i.test(value)
+    ) {
+        throw new Error(
+            'Cannot atomically replace an object without a valid S3 ETag.',
+        );
+    }
+    // Hetzner returns quoted ETags on GET but compares bare values on conditional PUT.
+    return value;
+}
+
+function requiresExistingObjectCheck(error) {
+    // AWS CLI can crash while formatting Hetzner's empty error Message.
+    // This only permits a readback; content checks and conditional writes still apply.
+    return /\(PreconditionFailed\)|\(412\)|argument of type 'NoneType' is not (?:a container or )?iterable/.test(
+        error.message,
+    );
+}
+
+export async function publishMacos({
+    env = process.env,
+    directory,
+    metadata,
+    run = execute,
+    fetchPublic = fetch,
+    wait = setTimeout,
+    publicKey = updateSource.publicKey,
+    feedBase = updateSource.baseUrl,
+} = {}) {
+    const storage = storageConfiguration(env);
+    if (`${storage.publicBase}/${storage.prefix}` !== feedBase) {
+        throw new Error(
+            'Release storage does not match the update source bundled in the app.',
+        );
+    }
+    if (!env.AWS_ACCESS_KEY_ID || !env.AWS_SECRET_ACCESS_KEY) {
+        throw new Error(
+            'Set the dedicated S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY release secrets.',
+        );
+    }
+    const archive = readFileSync(join(directory, metadata.filename));
+    const checksum = sha256(archive);
+    const checksumFile = readFileSync(
+        join(directory, `${metadata.filename}.sha256`),
+    );
+    if (checksumFile.toString() !== `${checksum}  ${metadata.filename}\n`) {
+        throw new Error('Release archive does not match its SHA-256 file.');
+    }
+    const updater = readFileSync(join(directory, metadata.updaterFilename));
+    const signature = readFileSync(
+        join(directory, `${metadata.updaterFilename}.sig`),
+        'utf8',
+    );
+    verifyUpdateSignature(updater, signature, publicKey);
+    const updateChecksum = readFileSync(
+        join(directory, `${metadata.updaterFilename}.sha256`),
+    );
+    if (
+        updateChecksum.toString() !==
+        `${sha256(updater)}  ${metadata.updaterFilename}\n`
+    ) {
+        throw new Error('Updater archive does not match its SHA-256 file.');
+    }
+    const common = [
+        '--endpoint-url',
+        storage.endpoint,
+        '--region',
+        storage.region,
+        '--no-cli-pager',
+        's3api',
+    ];
+    function s3(operation, args) {
+        try {
+            return run('aws', [
+                ...common,
+                operation,
+                '--bucket',
+                storage.bucket,
+                ...args,
+            ]);
+        } catch (error) {
+            const keyIndex = args.indexOf('--key');
+            const key = keyIndex >= 0 ? ` ${args[keyIndex + 1]}` : '';
+            throw new Error(`S3 ${operation}${key}: ${error.message}`, {
+                cause: error,
+            });
+        }
+    }
+    const versioningOutput = s3('get-bucket-versioning', [
+        '--output',
+        'json',
+    ]).trim();
+    let versioning;
+    try {
+        // AWS CLI prints nothing for a successful empty VersioningConfiguration.
+        versioning = JSON.parse(versioningOutput || '{}');
+    } catch {
+        throw new Error('Invalid JSON from S3 bucket versioning check.');
+    }
+    if (
+        !versioning ||
+        typeof versioning !== 'object' ||
+        Array.isArray(versioning)
+    ) {
+        throw new Error(
+            'Invalid S3 bucket versioning response: expected an object.',
+        );
+    }
+    if (versioning.Status) {
+        throw new Error(
+            'Use an unversioned release bucket: Hetzner does not support conditional writes on versioned buckets.',
+        );
+    }
+    const staging = mkdtempSync(join(tmpdir(), 'kanbangit-s3-'));
+    const keyPrefix = `${storage.prefix}/${metadata.target}/${metadata.version}`;
+    const publicPrefix = `${storage.publicBase}/${keyPrefix}`;
+    const latestPrefix = `${storage.prefix}/${metadata.target}`;
+    const latestKey = `${latestPrefix}/latest.json`;
+    async function verifyPublic(name, contents, prefix = publicPrefix) {
+        for (let attempt = 1; attempt <= 5; attempt++) {
+            let response;
+            try {
+                response = await fetchPublic(`${prefix}/${name}`, {
+                    redirect: 'error',
+                    cache: 'no-store',
+                    signal: AbortSignal.timeout(60000),
+                });
+            } catch (error) {
+                if (attempt === 5) {
+                    throw new Error(
+                        `Public download request failed for ${name}: ${error.message}`,
+                    );
+                }
+                await wait(2000);
+                continue;
+            }
+            if (response.ok) {
+                if (
+                    sha256(Buffer.from(await response.arrayBuffer())) !==
+                    sha256(contents)
+                ) {
+                    throw new Error(
+                        `Public download verification failed for ${name}: SHA-256 mismatch.`,
+                    );
+                }
+                return;
+            }
+            await response.body?.cancel();
+            const retryable = [403, 404, 408, 429, 500, 502, 503, 504].includes(
+                response.status,
+            );
+            if (!retryable || attempt === 5) {
+                throw new Error(
+                    `Public download verification failed for ${name}: HTTP ${response.status}.`,
+                );
+            }
+            await wait(2000);
+        }
+    }
+    function assertUnpublishedRelease() {
+        const file = join(staging, 'published-latest.json');
+        try {
+            s3('get-object', ['--key', latestKey, file]);
+        } catch (error) {
+            if (/\(NoSuchKey\)/.test(error.message)) {
+                return;
+            }
+            if (requiresExistingObjectCheck(error)) {
+                // A broken CLI error message cannot distinguish missing from denied.
+                // Only an authenticated, explicitly empty listing proves absence.
+                const listing = JSON.parse(
+                    s3('list-objects-v2', [
+                        '--prefix',
+                        latestKey,
+                        '--max-keys',
+                        '1',
+                        '--output',
+                        'json',
+                    ]),
+                );
+                if (
+                    listing?.KeyCount === 0 &&
+                    listing.IsTruncated === false &&
+                    Array.isArray(listing.Contents ?? []) &&
+                    (listing.Contents ?? []).length === 0
+                ) {
+                    return;
+                }
+            }
+            throw error;
+        }
+        const published = JSON.parse(readFileSync(file, 'utf8'));
+        if (compareVersions(metadata.version, published.version) <= 0) {
+            throw new Error(
+                'This version has already been released through the update feed; bump the app version. Published objects were not overwritten.',
+            );
+        }
+    }
+    // The macos-release concurrency group serializes the entire publication.
+    // Never run independent publishers against the same release destination.
+    function putReleaseFile(name, contents, contentType) {
+        const file = join(staging, name);
+        writeFileSync(file, contents);
+        function put(condition) {
+            s3('put-object', [
+                '--key',
+                `${keyPrefix}/${name}`,
+                '--body',
+                file,
+                ...condition,
+                '--content-type',
+                contentType,
+                '--cache-control',
+                'no-cache, max-age=0, must-revalidate',
+                '--content-md5',
+                createHash('md5').update(contents).digest('base64'),
+                '--metadata',
+                `sha256=${sha256(contents)}`,
+            ]);
+        }
+        try {
+            put(['--if-none-match', '*']);
+        } catch (error) {
+            if (!requiresExistingObjectCheck(error)) {
+                throw error;
+            }
+            const existing = join(staging, `existing-${name}`);
+            const response = JSON.parse(
+                s3('get-object', [
+                    '--key',
+                    `${keyPrefix}/${name}`,
+                    '--output',
+                    'json',
+                    existing,
+                ]),
+            );
+            if (sha256(readFileSync(existing)) !== sha256(contents)) {
+                assertUnpublishedRelease();
+                put(['--if-match', conditionalEtag(response.ETag)]);
+            }
+        }
+    }
+    try {
+        const files = [
+            [metadata.filename, archive, 'application/x-apple-diskimage'],
+            [metadata.updaterFilename, updater, 'application/gzip'],
+            [
+                `${metadata.updaterFilename}.sig`,
+                Buffer.from(signature),
+                'text/plain; charset=utf-8',
+            ],
+            [
+                `${metadata.updaterFilename}.sha256`,
+                updateChecksum,
+                'text/plain; charset=utf-8',
+            ],
+            [
+                `${metadata.filename}.sha256`,
+                checksumFile,
+                'text/plain; charset=utf-8',
+            ],
+        ];
+        for (const [name, contents, type] of files) {
+            putReleaseFile(name, contents, type);
+            await verifyPublic(name, contents);
+        }
+        // Completion metadata is written only after every public artifact matches.
+        const manifest = Buffer.from(
+            JSON.stringify(
+                {
+                    version: metadata.version,
+                    target: metadata.target,
+                    url: `${publicPrefix}/${metadata.filename}`,
+                    sha256: checksum,
+                    checksumUrl: `${publicPrefix}/${metadata.filename}.sha256`,
+                },
+                null,
+                2,
+            ) + '\n',
+        );
+        putReleaseFile('release.json', manifest, 'application/json');
+        await verifyPublic('release.json', manifest);
+        const latest = Buffer.from(
+            JSON.stringify(
+                updateManifest(
+                    metadata,
+                    publicPrefix,
+                    signature,
+                    metadata.notes,
+                ),
+                null,
+                2,
+            ) + '\n',
+        );
+        putReleaseFile('update.json', latest, 'application/json');
+        await verifyPublic('update.json', latest);
+        const latestFile = join(staging, 'latest.json');
+        writeFileSync(latestFile, latest);
+        function publishLatest(condition) {
+            s3('put-object', [
+                '--key',
+                latestKey,
+                '--body',
+                latestFile,
+                ...condition,
+                '--content-type',
+                'application/json',
+                '--cache-control',
+                'no-cache, max-age=0, must-revalidate',
+                '--content-md5',
+                createHash('md5').update(latest).digest('base64'),
+            ]);
+        }
+        try {
+            publishLatest(['--if-none-match', '*']);
+        } catch (error) {
+            if (!requiresExistingObjectCheck(error)) {
+                throw error;
+            }
+            const previousFile = join(staging, 'previous-latest.json');
+            const response = JSON.parse(
+                s3('get-object', [
+                    '--key',
+                    latestKey,
+                    '--output',
+                    'json',
+                    previousFile,
+                ]),
+            );
+            const previousBytes = readFileSync(previousFile);
+            const previous = JSON.parse(previousBytes);
+            const comparison = compareVersions(
+                metadata.version,
+                previous.version,
+            );
+            if (comparison < 0) {
+                throw new Error('Refusing to downgrade the update feed.');
+            }
+            if (comparison === 0) {
+                if (!previousBytes.equals(latest)) {
+                    throw new Error(
+                        'Published update metadata differs; bump the app version.',
+                    );
+                }
+            } else {
+                publishLatest(['--if-match', conditionalEtag(response.ETag)]);
+            }
+        }
+        await verifyPublic(
+            'latest.json',
+            latest,
+            `${storage.publicBase}/${latestPrefix}`,
+        );
+        return `${publicPrefix}/${metadata.filename}`;
+    } finally {
+        rmSync(staging, { recursive: true, force: true });
+    }
+}
+
+if (
+    process.argv[1] &&
+    import.meta.url === pathToFileURL(resolve(process.argv[1])).href
+) {
+    try {
+        if (process.argv[2] === 'config') {
+            console.log(JSON.stringify(storageConfiguration()));
+        } else if (
+            process.argv[2] === 'upload' &&
+            process.env.RELEASE_DIRECTORY
+        ) {
+            const url = await publishMacos({
+                directory: process.env.RELEASE_DIRECTORY,
+                metadata: releaseMetadata(),
+            });
+            console.log(`Verified public release: ${url}`);
+            if (process.env.GITHUB_STEP_SUMMARY) {
+                appendFileSync(
+                    process.env.GITHUB_STEP_SUMMARY,
+                    `Download: [KanbanGit](${url})\n`,
+                );
+            }
+        } else {
+            throw new Error(
+                'Use config or upload; upload requires RELEASE_DIRECTORY.',
+            );
+        }
+    } catch (error) {
+        console.error(error.message);
+        process.exitCode = 1;
+    }
+}

native/release-macos.mjs

@@ -0,0 +1,478 @@
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import {
+    existsSync,
+    mkdirSync,
+    mkdtempSync,
+    readFileSync,
+    renameSync,
+    rmSync,
+    writeFileSync,
+} from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import process from 'node:process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { parseArgs } from 'node:util';
+import { createDiskImage } from './macos-dmg.mjs';
+
+export const appleTeamId = 'ZZX2KZGTHU';
+export const bundleIdentifier = 'de.kanbangit.desktop';
+const submissionIdPattern =
+    /^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/i;
+
+function execute(command, args, options) {
+    const result = spawnSync(command, args, {
+        cwd: options.cwd,
+        env: options.env,
+        encoding: 'utf8',
+        maxBuffer: 16 * 1024 * 1024,
+        stdio: options.inherit ? 'inherit' : 'pipe',
+    });
+
+    if (result.error || result.status !== 0) {
+        throw new Error(
+            `${options.step} failed${result.error ? `: ${result.error.message}` : ` (exit ${result.status ?? result.signal})`}.`,
+        );
+    }
+
+    return result.stdout?.trim() || result.stderr?.trim() || '';
+}
+
+export function verifySignedMacosApp({ app, version, step }) {
+    step('Verifying Developer ID signature and team', 'codesign', [
+        '--verify',
+        '--deep',
+        '--strict',
+        '--verbose=2',
+        '-R',
+        `=anchor apple generic and identifier "${bundleIdentifier}" and certificate leaf[subject.OU] = "${appleTeamId}" and certificate leaf[field.1.2.840.113635.100.6.1.13] exists`,
+        app,
+    ]);
+    const signature = step('Checking hardened runtime', 'codesign', [
+        '--display',
+        '--verbose=4',
+        app,
+    ]);
+
+    if (!/^CodeDirectory .*flags=.*\bruntime\b/m.test(signature)) {
+        throw new Error(
+            'The release signature does not enable Hardened Runtime.',
+        );
+    }
+
+    const cdhash = signature.match(/^CDHash=([\da-f]+)$/m)?.[1];
+
+    if (!cdhash) {
+        throw new Error(
+            'The signed app has no CodeDirectory hash to match against Apple notarization.',
+        );
+    }
+
+    const bundledVersion = step('Checking bundled release version', 'plutil', [
+        '-extract',
+        'CFBundleShortVersionString',
+        'raw',
+        '-o',
+        '-',
+        join(app, 'Contents/Info.plist'),
+    ]);
+
+    if (bundledVersion.trim() !== version) {
+        throw new Error(
+            'The built app version does not match the release version.',
+        );
+    }
+
+    return cdhash;
+}
+
+export function releaseMacos({
+    env = process.env,
+    platform = process.platform,
+    arch = process.arch,
+    directory = dirname(fileURLToPath(import.meta.url)),
+    run = execute,
+    log = console.log,
+    resumeSubmissionId = null,
+} = {}) {
+    if (platform !== 'darwin') {
+        throw new Error('macOS releases require a Mac with Xcode installed.');
+    }
+
+    if (
+        resumeSubmissionId !== null &&
+        !submissionIdPattern.test(resumeSubmissionId)
+    ) {
+        throw new Error('--resume requires the Apple submission UUID.');
+    }
+
+    if (!env.TAURI_SIGNING_PRIVATE_KEY?.trim()) {
+        throw new Error(
+            'Set TAURI_SIGNING_PRIVATE_KEY to the permanent updater signing key.',
+        );
+    }
+    const identity = env.APPLE_SIGNING_IDENTITY?.trim();
+    const profile = env.APPLE_NOTARY_KEYCHAIN_PROFILE?.trim();
+
+    if (
+        !identity?.startsWith('Developer ID Application: ') ||
+        !identity.endsWith(` (${appleTeamId})`) ||
+        /[\r\n"]/.test(identity)
+    ) {
+        throw new Error(
+            `Set APPLE_SIGNING_IDENTITY to the full Developer ID Application certificate name for team ${appleTeamId}.`,
+        );
+    }
+
+    if (env.APPLE_TEAM_ID && env.APPLE_TEAM_ID !== appleTeamId) {
+        throw new Error(`APPLE_TEAM_ID must be ${appleTeamId}.`);
+    }
+
+    if (!profile) {
+        throw new Error(
+            'Set APPLE_NOTARY_KEYCHAIN_PROFILE to a notarytool profile created with store-credentials for the new Apple team.',
+        );
+    }
+
+    const target =
+        env.MACOS_RELEASE_TARGET ||
+        { arm64: 'aarch64-apple-darwin', x64: 'x86_64-apple-darwin' }[arch];
+
+    if (!['aarch64-apple-darwin', 'x86_64-apple-darwin'].includes(target)) {
+        throw new Error(
+            'MACOS_RELEASE_TARGET must be aarch64-apple-darwin or x86_64-apple-darwin.',
+        );
+    }
+
+    const config = JSON.parse(
+        readFileSync(join(directory, 'src-tauri/tauri.conf.json'), 'utf8'),
+    );
+
+    if (
+        config.identifier !== bundleIdentifier ||
+        config.productName !== 'KanbanGit'
+    ) {
+        throw new Error(
+            'The macOS release must keep the KanbanGit product name and bundle identifier.',
+        );
+    }
+
+    if (!/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(config.version)) {
+        throw new Error(
+            'The macOS release version must be a stable MAJOR.MINOR.PATCH version.',
+        );
+    }
+
+    const targetDirectory = join(directory, 'src-tauri/target');
+    const releaseDirectory = join(targetDirectory, 'macos-release');
+    const destination = join(releaseDirectory, `${config.version}-${target}`);
+
+    if (existsSync(destination)) {
+        throw new Error(
+            `Release output already exists: ${destination}. Move it aside or use a new version.`,
+        );
+    }
+
+    // Notarization is handled below with the explicit keychain profile, never ambient Apple credentials.
+    const buildEnv = Object.fromEntries(
+        Object.entries(env).filter(
+            ([key]) => !key.startsWith('APPLE_') && key !== 'TAURI_CONFIG',
+        ),
+    );
+    buildEnv.APPLE_SIGNING_IDENTITY = identity;
+    buildEnv.CARGO_TARGET_DIR = targetDirectory;
+
+    function step(label, command, args, inherit = false) {
+        log(label);
+
+        return run(command, args, {
+            cwd: directory,
+            env: buildEnv,
+            step: label,
+            inherit,
+        });
+    }
+
+    const identities = step('Checking signing certificate', 'security', [
+        'find-identity',
+        '-v',
+        '-p',
+        'codesigning',
+    ]);
+
+    if (
+        !identities
+            .split('\n')
+            .some((line) => line.trim().endsWith(`"${identity}"`))
+    ) {
+        throw new Error(
+            `Install the Developer ID Application certificate for ${appleTeamId}, including its private key, in an unlocked keychain.`,
+        );
+    }
+
+    const notaryCredentials = ['--keychain-profile', profile];
+
+    if (env.APPLE_NOTARY_KEYCHAIN?.trim()) {
+        notaryCredentials.push('--keychain', env.APPLE_NOTARY_KEYCHAIN.trim());
+    }
+
+    step(
+        'Checking notarization access (check the keychain profile if this fails)',
+        'xcrun',
+        [
+            'notarytool',
+            'history',
+            ...notaryCredentials,
+            '--output-format',
+            'json',
+        ],
+    );
+
+    const app = join(
+        targetDirectory,
+        target,
+        'release/bundle/macos/KanbanGit.app',
+    );
+    if (!resumeSubmissionId) {
+        step(
+            'Building signed macOS release',
+            'pnpm',
+            [
+                'exec',
+                'tauri',
+                'build',
+                '--ci',
+                '--target',
+                target,
+                '--bundles',
+                'app',
+                '--config',
+                JSON.stringify({
+                    bundle: {
+                        createUpdaterArtifacts: false,
+                        macOS: {
+                            signingIdentity: identity,
+                            hardenedRuntime: true,
+                        },
+                    },
+                }),
+                '--',
+                '--locked',
+            ],
+            true,
+        );
+    }
+
+    if (!existsSync(app)) {
+        throw new Error('The release build did not produce KanbanGit.app.');
+    }
+
+    const cdhash = verifySignedMacosApp({ app, version: config.version, step });
+
+    mkdirSync(releaseDirectory, { recursive: true });
+    const staging = mkdtempSync(join(releaseDirectory, '.pending-'));
+
+    try {
+        const submission = join(staging, 'notarization.zip');
+        let submissionId = resumeSubmissionId;
+
+        if (!submissionId) {
+            step('Preparing notarization archive', 'ditto', [
+                '-c',
+                '-k',
+                '--sequesterRsrc',
+                '--keepParent',
+                app,
+                submission,
+            ]);
+            const submitted = JSON.parse(
+                step('Submitting to Apple', 'xcrun', [
+                    'notarytool',
+                    'submit',
+                    submission,
+                    ...notaryCredentials,
+                    '--no-wait',
+                    '--output-format',
+                    'json',
+                ]),
+            );
+            submissionId = submitted.id;
+
+            if (!submissionIdPattern.test(submissionId ?? '')) {
+                throw new Error(
+                    'Apple did not return a valid submission UUID. Check notarytool history before retrying.',
+                );
+            }
+        }
+
+        const resumeHint = `Resume without rebuilding or uploading: pnpm --dir native release:macos --resume ${submissionId}`;
+        log(`Apple submission: ${submissionId}. ${resumeHint}`);
+        writeFileSync(
+            join(
+                targetDirectory,
+                `notarization-${submissionId}.submission.json`,
+            ),
+            JSON.stringify(
+                {
+                    submissionId,
+                    version: config.version,
+                    target,
+                    cdhash,
+                },
+                null,
+                2,
+            ) + '\n',
+        );
+
+        let result;
+
+        try {
+            result = JSON.parse(
+                step('Waiting for Apple notarization', 'xcrun', [
+                    'notarytool',
+                    'wait',
+                    submissionId,
+                    ...notaryCredentials,
+                    '--timeout',
+                    '30m',
+                    '--output-format',
+                    'json',
+                ]),
+            );
+        } catch (error) {
+            throw new Error(
+                `${error.message} Apple may still be processing this submission. ${resumeHint}`,
+            );
+        }
+
+        if (result.status !== 'Accepted') {
+            throw new Error(
+                `Apple did not accept the release (status: ${result.status ?? 'unknown'}, submission: ${submissionId}). Inspect it with notarytool log. ${resumeHint}`,
+            );
+        }
+
+        const notaryLog = JSON.parse(
+            step('Checking Apple notarization log', 'xcrun', [
+                'notarytool',
+                'log',
+                submissionId,
+                ...notaryCredentials,
+            ]),
+        );
+        writeFileSync(
+            join(targetDirectory, `notarization-${submissionId}.log.json`),
+            JSON.stringify(notaryLog, null, 2) + '\n',
+        );
+        const expectedArch =
+            target === 'aarch64-apple-darwin' ? 'arm64' : 'x86_64';
+
+        if (
+            notaryLog.jobId !== submissionId ||
+            notaryLog.status !== 'Accepted' ||
+            !notaryLog.ticketContents?.some(
+                (ticket) =>
+                    ticket.path.endsWith('/KanbanGit.app') &&
+                    ticket.cdhash === cdhash &&
+                    ticket.arch === expectedArch,
+            )
+        ) {
+            throw new Error(
+                'The accepted Apple submission does not match this signed app and architecture. Restore the submitted app or create a new release.',
+            );
+        }
+
+        if (notaryLog.issues?.length) {
+            throw new Error(
+                `Apple reported notarization issues. Review src-tauri/target/notarization-${submissionId}.log.json before distribution.`,
+            );
+        }
+
+        step('Stapling notarization ticket', 'xcrun', [
+            'stapler',
+            'staple',
+            app,
+        ]);
+        step('Validating notarization ticket', 'xcrun', [
+            'stapler',
+            'validate',
+            app,
+        ]);
+        step('Verifying final app signature', 'codesign', [
+            '--verify',
+            '--deep',
+            '--strict',
+            app,
+        ]);
+        step('Checking Gatekeeper acceptance', 'spctl', [
+            '--assess',
+            '--type',
+            'execute',
+            '--verbose=2',
+            app,
+        ]);
+
+        const name = `KanbanGit-${config.version}-${target}.dmg`;
+        const archive = join(staging, name);
+        createDiskImage({
+            app,
+            archive,
+            identity,
+            run: (command, args) =>
+                step('Packaging notarized download', command, args),
+        });
+        const checksum = createHash('sha256')
+            .update(readFileSync(archive))
+            .digest('hex');
+        writeFileSync(`${archive}.sha256`, `${checksum}  ${name}\n`);
+        const updaterName = `KanbanGit-${config.version}-${target}.app.tar.gz`;
+        const updaterArchive = join(staging, updaterName);
+        step('Packaging updater archive', 'tar', [
+            '-czf',
+            updaterArchive,
+            '-C',
+            dirname(app),
+            'KanbanGit.app',
+        ]);
+        step('Signing updater archive', 'pnpm', [
+            'exec',
+            'tauri',
+            'signer',
+            'sign',
+            updaterArchive,
+        ]);
+        const updaterChecksum = createHash('sha256')
+            .update(readFileSync(updaterArchive))
+            .digest('hex');
+        writeFileSync(
+            `${updaterArchive}.sha256`,
+            `${updaterChecksum}  ${updaterName}\n`,
+        );
+        rmSync(submission, { force: true });
+        renameSync(staging, destination);
+        log(`Verified release: ${join(destination, name)}`);
+
+        return {
+            archive: join(destination, name),
+            checksum,
+            version: config.version,
+            target,
+        };
+    } finally {
+        rmSync(staging, { recursive: true, force: true });
+    }
+}
+
+if (
+    process.argv[1] &&
+    import.meta.url === pathToFileURL(resolve(process.argv[1])).href
+) {
+    try {
+        const { values } = parseArgs({
+            options: { resume: { type: 'string' } },
+        });
+        releaseMacos({ resumeSubmissionId: values.resume ?? null });
+    } catch (error) {
+        console.error(`macOS release failed: ${error.message}`);
+        process.exitCode = 1;
+    }
+}

native/src-tauri/Cargo.toml

@@ -0,0 +1,40 @@
+[package]
+name = "kanbangit-native"
+version = "0.1.5"
+description = "KanbanGit native application"
+edition = "2021"
+publish = false
+
+[lib]
+name = "kanbangit_native"
+crate-type = ["staticlib", "cdylib", "rlib"]
+
+[build-dependencies]
+tauri-build = { version = "2", features = [] }
+
+[dependencies]
+semver = "1"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+tauri = { version = "2", features = [] }
+
+[dev-dependencies]
+tauri = { version = "2", features = ["test"] }
+serde_json = "1"
+
+[features]
+smoke-test = []
+custom-protocol = ["tauri/custom-protocol"]
+
+[[test]]
+name = "macos_smoke"
+harness = false
+required-features = ["smoke-test"]
+
+[target.'cfg(target_os = "macos")'.dependencies]
+tauri-plugin-updater = "=2.12.0"
+
+[[test]]
+name = "updater_smoke"
+harness = false
+required-features = ["smoke-test"]

native/src-tauri/build.rs

@@ -0,0 +1,3 @@
+fn main() {
+    tauri_build::build();
+}

native/src-tauri/gen/android/.editorconfig

@@ -0,0 +1,12 @@
+# EditorConfig is awesome: https://EditorConfig.org
+
+# top-most EditorConfig file
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = false
+insert_final_newline = false

native/src-tauri/gen/android/.gitignore

@@ -0,0 +1,26 @@
+*.iml
+.gradle
+/local.properties
+/.idea/caches
+/.idea/libraries
+/.idea/modules.xml
+/.idea/workspace.xml
+/.idea/navEditor.xml
+/.idea/assetWizardSettings.xml
+.DS_Store
+build
+/captures
+.externalNativeBuild
+.cxx
+local.properties
+key.properties
+keystore.properties
+
+/.tauri
+/tauri.settings.gradle
+/app/tauri.build.gradle.kts
+/app/src/main/jniLibs
+/app/src/main/java/de/kanbangit/desktop/generated
+
+.kotlin
+/app/tauri.properties

native/src-tauri/gen/android/app/.gitignore

@@ -0,0 +1,6 @@
+/src/main/**/generated
+/src/main/jniLibs/**/*.so
+/src/main/assets/tauri.conf.json
+/tauri.build.gradle.kts
+/proguard-tauri.pro
+/tauri.properties

native/src-tauri/gen/android/app/build.gradle.kts

@@ -0,0 +1,76 @@
+import java.util.Properties
+
+plugins {
+    id("com.android.application")
+    id("org.jetbrains.kotlin.android")
+    id("rust")
+}
+
+val tauriProperties = Properties().apply {
+    val propFile = file("tauri.properties")
+    if (propFile.exists()) {
+        propFile.inputStream().use { load(it) }
+    }
+}
+
+android {
+    compileSdk = 36
+    buildToolsVersion = "36.0.0"
+    namespace = "de.kanbangit.desktop"
+    defaultConfig {
+        manifestPlaceholders["usesCleartextTraffic"] = "false"
+        applicationId = "de.kanbangit.desktop"
+        minSdk = 24
+        targetSdk = 36
+        testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
+        // Tauri exits the process when its last activity is destroyed; report results first.
+        testInstrumentationRunnerArguments["waitForActivitiesToComplete"] = "false"
+        versionCode = tauriProperties.getProperty("tauri.android.versionCode", "1").toInt()
+        versionName = tauriProperties.getProperty("tauri.android.versionName", "1.0")
+    }
+    buildTypes {
+        getByName("debug") {
+            manifestPlaceholders["usesCleartextTraffic"] = "false"
+            isDebuggable = true
+            isJniDebuggable = true
+            isMinifyEnabled = false
+            packaging {
+                jniLibs.keepDebugSymbols.add("*/arm64-v8a/*.so")
+                jniLibs.keepDebugSymbols.add("*/armeabi-v7a/*.so")
+                jniLibs.keepDebugSymbols.add("*/x86/*.so")
+                jniLibs.keepDebugSymbols.add("*/x86_64/*.so")
+            }
+        }
+        getByName("release") {
+            isMinifyEnabled = true
+            proguardFiles(
+                *fileTree(".") { include("**/*.pro") }
+                    .plus(getDefaultProguardFile("proguard-android-optimize.txt"))
+                    .toList().toTypedArray()
+            )
+        }
+    }
+    kotlinOptions {
+        jvmTarget = "1.8"
+    }
+    buildFeatures {
+        buildConfig = true
+    }
+}
+
+rust {
+    rootDirRel = "../../../"
+}
+
+dependencies {
+    implementation("androidx.webkit:webkit:1.14.0")
+    implementation("androidx.appcompat:appcompat:1.7.1")
+    implementation("androidx.activity:activity-ktx:1.10.1")
+    implementation("com.google.android.material:material:1.12.0")
+    implementation("androidx.lifecycle:lifecycle-process:2.10.0")
+    testImplementation("junit:junit:4.13.2")
+    androidTestImplementation("androidx.test.ext:junit:1.1.4")
+    androidTestImplementation("androidx.test.espresso:espresso-core:3.5.0")
+}
+
+apply(from = "tauri.build.gradle.kts")

native/src-tauri/gen/android/app/proguard-rules.pro

@@ -0,0 +1,21 @@
+# Add project specific ProGuard rules here.
+# You can control the set of applied configuration files using the
+# proguardFiles setting in build.gradle.
+#
+# For more details, see
+#   http://developer.android.com/guide/developing/tools/proguard.html
+
+# If your project uses WebView with JS, uncomment the following
+# and specify the fully qualified class name to the JavaScript interface
+# class:
+#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
+#   public *;
+#}
+
+# Uncomment this to preserve the line number information for
+# debugging stack traces.
+#-keepattributes SourceFile,LineNumberTable
+
+# If you keep the line number information, uncomment this to
+# hide the original source file name.
+#-renamesourcefileattribute SourceFile

native/src-tauri/gen/android/app/src/androidTest/java/de/kanbangit/desktop/PlatformTest.kt

@@ -0,0 +1,116 @@
+package de.kanbangit.desktop
+
+import android.content.Context
+import android.os.SystemClock
+import android.view.InputDevice
+import android.view.MotionEvent
+import android.view.View
+import android.webkit.CookieManager
+import android.webkit.WebView
+import androidx.lifecycle.Lifecycle
+import androidx.test.core.app.ActivityScenario
+import androidx.test.platform.app.InstrumentationRegistry
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import org.junit.Assert.*
+import org.junit.Test
+import org.junit.runner.RunWith
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.TimeUnit
+import java.util.concurrent.atomic.AtomicReference
+
+@RunWith(AndroidJUnit4::class)
+class PlatformTest {
+    private val instrumentation = InstrumentationRegistry.getInstrumentation()
+
+    private fun evaluate(view: WebView, script: String): String {
+        val result = AtomicReference<String>()
+        val latch = CountDownLatch(1)
+        instrumentation.runOnMainSync { view.evaluateJavascript(script) { result.set(it); latch.countDown() } }
+        assertTrue("JavaScript callback timed out", latch.await(10, TimeUnit.SECONDS))
+        return result.get()
+    }
+
+    private fun waitFor(condition: () -> Boolean) {
+        val end = System.currentTimeMillis() + 25000
+        while (System.currentTimeMillis() < end) {
+            if (condition()) return
+            Thread.sleep(100)
+        }
+        fail("Platform condition timed out")
+    }
+
+    private fun tapCenter(view: View) {
+        val position = IntArray(2)
+        instrumentation.runOnMainSync {
+            view.getLocationOnScreen(position)
+            position[0] += view.width / 2
+            position[1] += view.height / 2
+        }
+        val downTime = SystemClock.uptimeMillis()
+        for (action in listOf(MotionEvent.ACTION_DOWN, MotionEvent.ACTION_UP)) {
+            val event = MotionEvent.obtain(downTime, SystemClock.uptimeMillis(), action, position[0].toFloat(), position[1].toFloat(), 0)
+            event.source = InputDevice.SOURCE_TOUCHSCREEN
+            try {
+                instrumentation.sendPointerSync(event)
+            } finally {
+                event.recycle()
+            }
+        }
+        instrumentation.waitForIdleSync()
+    }
+
+    @Test fun workspacePreservesFormsAndIsolatesServers() {
+        instrumentation.targetContext.getSharedPreferences("workspace", Context.MODE_PRIVATE).edit().clear().commit()
+        val scenario = ActivityScenario.launch(MainActivity::class.java)
+        Thread.sleep(1500)
+        scenario.onActivity { it.openWorkspace("https://kanbangit.de/") }
+        val remote = AtomicReference<WebView>()
+        waitFor {
+            var visible = false
+            scenario.onActivity { remote.set(it.workspace); visible = it.workspace?.visibility == View.VISIBLE }
+            visible && remote.get() != null && evaluate(remote.get(), "document.readyState === 'complete' && document.querySelector('#app')?.innerText.trim().length > 100") == "true"
+        }
+        val view = remote.get()
+        assertEquals("true", evaluate(view, "typeof window.nativeLauncher === 'undefined' && typeof window.__TAURI_INTERNALS__ === 'undefined'"))
+        assertEquals("true", evaluate(view, """
+            (() => {
+                const input = document.createElement('input');
+                input.id = 'kan53-input';
+                input.value = 'retained form';
+                document.body.append(input);
+                const button = document.createElement('button');
+                button.style.cssText = 'position:fixed;inset:0;width:100%;height:100%;z-index:2147483647';
+                button.textContent = 'Navigate';
+                button.onclick = () => {
+                    history.pushState({}, '', '/kan53-history');
+                    button.remove();
+                };
+                document.body.append(button);
+                return true;
+            })()
+        """.trimIndent()))
+        tapCenter(view)
+        waitFor { evaluate(view, "location.pathname === '/kan53-history'") == "true" }
+        waitFor {
+            var canGoBack = false
+            scenario.onActivity { canGoBack = view.canGoBack() }
+            canGoBack
+        }
+        scenario.moveToState(Lifecycle.State.CREATED)
+        scenario.moveToState(Lifecycle.State.RESUMED)
+        assertEquals("\"retained form\"", evaluate(view, "document.querySelector('#kan53-input').value"))
+        scenario.onActivity { it.onBackPressedDispatcher.onBackPressed() }
+        waitFor { evaluate(view, "location.pathname !== '/kan53-history'") == "true" }
+        assertEquals("\"retained form\"", evaluate(view, "document.querySelector('#kan53-input').value"))
+        evaluate(view, "document.cookie = 'kan53_fixture=secret; Path=/; Secure; SameSite=Lax'; localStorage.setItem('kan53_fixture', 'secret')")
+        scenario.onActivity { it.openWorkspace("https://127.0.0.1:9/") }
+        waitFor {
+            val cookie = AtomicReference<String>()
+            instrumentation.runOnMainSync { cookie.set(CookieManager.getInstance().getCookie("https://kanbangit.de/")) }
+            cookie.get()?.contains("kan53_fixture") != true
+        }
+        scenario.onActivity { assertNotSame(view, it.workspace) }
+        // Let instrumentation finish the process after reporting, rather than exiting via Tauri.
+        scenario.moveToState(Lifecycle.State.CREATED)
+    }
+}

native/src-tauri/gen/android/app/src/main/AndroidManifest.xml

@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+    <uses-permission android:name="android.permission.INTERNET" />
+
+    <application
+        android:allowBackup="false"
+        android:dataExtractionRules="@xml/data_extraction_rules"
+        android:icon="@drawable/kanbangit"
+        android:label="@string/app_name"
+        android:theme="@style/Theme.kanbangit_native"
+        android:usesCleartextTraffic="${usesCleartextTraffic}">
+        <activity
+            android:configChanges="orientation|keyboardHidden|keyboard|screenSize|locale|smallestScreenSize|screenLayout|uiMode"
+            android:launchMode="singleTask"
+            android:label="@string/main_activity_title"
+            android:name=".MainActivity"
+            android:windowSoftInputMode="adjustResize"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+
+        <provider
+          android:name="androidx.core.content.FileProvider"
+          android:authorities="${applicationId}.fileprovider"
+          android:exported="false"
+          android:grantUriPermissions="true">
+          <meta-data
+            android:name="android.support.FILE_PROVIDER_PATHS"
+            android:resource="@xml/file_paths" />
+        </provider>
+    </application>
+</manifest>

native/src-tauri/gen/android/app/src/main/java/de/kanbangit/desktop/MainActivity.kt

@@ -0,0 +1,406 @@
+package de.kanbangit.desktop
+
+import android.annotation.SuppressLint
+import android.content.ActivityNotFoundException
+import android.content.Intent
+import android.content.res.Configuration
+import android.graphics.Bitmap
+import android.net.Uri
+import android.net.http.SslError
+import android.os.Bundle
+import android.os.Handler
+import android.os.Looper
+import android.os.Message
+import android.view.View
+import android.view.ViewGroup
+import android.webkit.CookieManager
+import android.webkit.SslErrorHandler
+import android.webkit.ValueCallback
+import android.webkit.WebChromeClient
+import android.webkit.WebResourceError
+import android.webkit.WebResourceRequest
+import android.webkit.WebResourceResponse
+import android.webkit.WebSettings
+import android.webkit.WebStorage
+import android.webkit.WebView
+import android.webkit.WebViewClient
+import android.widget.Button
+import android.widget.FrameLayout
+import android.widget.LinearLayout
+import android.widget.TextView
+import android.widget.Toast
+import androidx.activity.OnBackPressedCallback
+import androidx.activity.enableEdgeToEdge
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.core.view.ViewCompat
+import androidx.core.view.WindowCompat
+import androidx.core.view.WindowInsetsCompat
+import androidx.webkit.WebViewCompat
+import androidx.webkit.WebViewFeature
+import org.json.JSONObject
+
+class MainActivity : TauriActivity() {
+    private val handler = Handler(Looper.getMainLooper())
+    private val preferences by lazy { getSharedPreferences("workspace", MODE_PRIVATE) }
+    private lateinit var launcher: WebView
+    private lateinit var root: LinearLayout
+    private lateinit var content: FrameLayout
+    private lateinit var settings: Button
+    internal var workspace: WebView? = null
+        private set
+    private var server = NavigationPolicy.DEFAULT_SERVER
+    private var phase = "idle"
+    private var ready = false
+    private var revision = 0
+    private var launcherVisible = true
+    private var keyboardVisible = false
+    private var initialized = false
+
+    private var fileCallback: ValueCallback<Array<Uri>>? = null
+    private var fileWorkspace: WebView? = null
+    private var filePage: String? = null
+    private var multipleFiles = false
+    private var filePickerActive = false
+    private val popups = mutableSetOf<WebView>()
+    private val filePicker = registerForActivityResult(ActivityResultContracts.StartActivityForResult()) { result ->
+        filePickerActive = false
+        val callback = fileCallback
+        val owner = fileWorkspace
+        val page = filePage
+        fileCallback = null
+        fileWorkspace = null
+        filePage = null
+        val files = WebChromeClient.FileChooserParams.parseResult(result.resultCode, result.data)
+        val valid = owner != null && owner === workspace && owner.url == page &&
+            NavigationPolicy.allows(server, page.orEmpty()) && files?.isNotEmpty() == true &&
+            (multipleFiles || files.size == 1) && files.all { uri ->
+                NavigationPolicy.selectedFile(uri.toString(), packageName) && runCatching {
+                    contentResolver.openFileDescriptor(uri, "r")?.use { true } == true
+                }.getOrDefault(false)
+            }
+        callback?.onReceiveValue(if (valid) files else null)
+    }
+
+    private fun cancelFileSelection() {
+        fileCallback?.onReceiveValue(null)
+        fileCallback = null
+        fileWorkspace = null
+        filePage = null
+    }
+
+    private fun openExternal(url: String) {
+        if (!NavigationPolicy.external(url)) return
+        try {
+            startActivity(Intent(Intent.ACTION_VIEW, Uri.parse(url)).addCategory(Intent.CATEGORY_BROWSABLE))
+        } catch (_: ActivityNotFoundException) {
+            Toast.makeText(this, R.string.external_link_error, Toast.LENGTH_LONG).show()
+        }
+    }
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        enableEdgeToEdge()
+        super.onCreate(savedInstanceState)
+        onBackPressedDispatcher.addCallback(this, object : OnBackPressedCallback(true) {
+            override fun handleOnBackPressed() {
+                when (NavigationPolicy.backAction(keyboardVisible, launcherVisible, ready, workspace?.canGoBack() == true)) {
+                    "keyboard" -> WindowCompat.getInsetsController(window, window.decorView).hide(WindowInsetsCompat.Type.ime())
+                    "resume" -> showWorkspace()
+                    "history" -> workspace?.goBack()
+                    "settings" -> showLauncher()
+                    else -> moveTaskToBack(true)
+                }
+            }
+        })
+    }
+
+    override fun onWebViewCreate(webView: WebView) {
+        launcher = webView
+        if (WebViewFeature.isFeatureSupported(WebViewFeature.WEB_MESSAGE_LISTENER)) {
+            WebViewCompat.addWebMessageListener(launcher, "nativeLauncher", setOf(NavigationPolicy.LAUNCHER_ORIGIN)) {
+                _, message, origin, mainFrame, _ ->
+                if (mainFrame && origin.toString().trimEnd('/') == NavigationPolicy.LAUNCHER_ORIGIN) {
+                    launcher.post { handleAction(message.data.orEmpty()) }
+                }
+            }
+        }
+        launcher.post { attachShell() }
+    }
+
+    private fun attachShell() {
+        if (::root.isInitialized) return
+        (launcher.parent as? ViewGroup)?.removeView(launcher)
+        root = LinearLayout(this).apply { orientation = LinearLayout.VERTICAL }
+        settings = Button(this).apply {
+            text = getString(R.string.server_settings)
+            isAllCaps = false
+            visibility = View.GONE
+            setOnClickListener { showLauncher() }
+        }
+        root.addView(settings, LinearLayout.LayoutParams(-1, -2))
+        content = FrameLayout(this)
+        content.addView(launcher, FrameLayout.LayoutParams(-1, -1))
+        root.addView(content, LinearLayout.LayoutParams(-1, 0, 1f))
+        setContentView(root)
+        ViewCompat.setOnApplyWindowInsetsListener(root) { view, insets ->
+            val safe = insets.getInsets(WindowInsetsCompat.Type.systemBars() or WindowInsetsCompat.Type.displayCutout())
+            val keyboard = insets.getInsets(WindowInsetsCompat.Type.ime())
+            keyboardVisible = insets.isVisible(WindowInsetsCompat.Type.ime())
+            view.setPadding(safe.left, safe.top, safe.right, maxOf(safe.bottom, keyboard.bottom))
+            WindowInsetsCompat.CONSUMED
+        }
+        ViewCompat.requestApplyInsets(root)
+        if (!WebViewFeature.isFeatureSupported(WebViewFeature.WEB_MESSAGE_LISTENER)) {
+            content.removeAllViews()
+            content.addView(TextView(this).apply { text = getString(R.string.update_webview) })
+        }
+    }
+
+    private fun handleAction(value: String) {
+        attachShell()
+        val url = Uri.parse(value)
+        if (url.scheme != "https" || url.host != "tauri.localhost" || url.port != -1 || url.userInfo != null) return
+        when (url.path) {
+            "/action/ready" -> {
+                if (initialized) return
+                initialized = true
+                val saved = preferences.getString("server", null)
+                server = saved?.let(NavigationPolicy::installation) ?: NavigationPolicy.DEFAULT_SERVER
+                updateLauncher()
+                if (saved != null) openWorkspace(server)
+            }
+            "/action/open" -> openWorkspace(url.getQueryParameter("server").orEmpty())
+            "/action/resume" -> if (ready) showWorkspace()
+        }
+    }
+
+    internal fun openWorkspace(input: String) {
+        val address = NavigationPolicy.installation(input)
+        if (address == null) {
+            phase = "invalidServer"
+            showLauncher()
+            return
+        }
+        if (phase == "connecting") return
+        if (address == server && ready) {
+            if (phase == "connectionError") {
+                phase = "connecting"
+                workspace?.let { startTimeout(it); it.reload() }
+                updateLauncher()
+                return
+            }
+            showWorkspace()
+            return
+        }
+        cancelFileSelection()
+        val changed = address != preferences.getString("server", null)
+        val clearSession = changed || preferences.getBoolean("clearing", false)
+        if (!preferences.edit().putString("server", address).putBoolean("clearing", clearSession).commit()) {
+            phase = "storageError"
+            showLauncher()
+            return
+        }
+        server = address
+        ready = false
+        phase = "connecting"
+        revision++
+        workspace?.let { old ->
+            content.removeView(old)
+            old.stopLoading()
+            if (clearSession) old.clearCache(true)
+            old.destroy()
+        }
+        workspace = null
+        updateLauncher()
+        if (clearSession) {
+            WebStorage.getInstance().deleteAllData()
+            CookieManager.getInstance().removeAllCookies {
+                CookieManager.getInstance().flush()
+                if (!preferences.edit().putBoolean("clearing", false).commit()) {
+                    phase = "storageError"
+                    showLauncher()
+                } else if (!isDestroyed) {
+                    createWorkspace()
+                }
+            }
+        } else {
+            createWorkspace()
+        }
+    }
+
+    @SuppressLint("SetJavaScriptEnabled")
+    private fun createWorkspace() {
+        val remote = WebView(this)
+        workspace = remote
+        remote.settings.apply {
+            javaScriptEnabled = true
+            domStorageEnabled = true
+            allowFileAccess = false
+            allowContentAccess = true
+            mixedContentMode = WebSettings.MIXED_CONTENT_NEVER_ALLOW
+            javaScriptCanOpenWindowsAutomatically = false
+            setSupportMultipleWindows(true)
+        }
+        CookieManager.getInstance().setAcceptThirdPartyCookies(remote, false)
+        remote.webChromeClient = object : WebChromeClient() {
+            override fun onShowFileChooser(view: WebView, callback: ValueCallback<Array<Uri>>, params: FileChooserParams): Boolean {
+                if (view !== workspace || !NavigationPolicy.allows(server, view.url.orEmpty()) ||
+                    params.mode !in listOf(FileChooserParams.MODE_OPEN, FileChooserParams.MODE_OPEN_MULTIPLE)) return false
+                // Keep one outstanding picker; stale results must never reach a different page.
+                if (filePickerActive) return false
+                fileCallback = callback
+                fileWorkspace = view
+                filePage = view.url
+                multipleFiles = params.mode == FileChooserParams.MODE_OPEN_MULTIPLE
+                return try {
+                    filePickerActive = true
+                    filePicker.launch(params.createIntent().addCategory(Intent.CATEGORY_OPENABLE))
+                    true
+                } catch (_: ActivityNotFoundException) {
+                    filePickerActive = false
+                    cancelFileSelection()
+                    Toast.makeText(this@MainActivity, R.string.file_picker_error, Toast.LENGTH_LONG).show()
+                    true
+                }
+            }
+
+            override fun onCreateWindow(view: WebView, isDialog: Boolean, isUserGesture: Boolean, result: Message): Boolean {
+                if (view !== workspace || !isUserGesture || !NavigationPolicy.allows(server, view.url.orEmpty())) return false
+                val popup = WebView(this@MainActivity)
+                popups.add(popup)
+                fun dispose() {
+                    if (popups.remove(popup)) popup.destroy()
+                }
+                popup.webViewClient = object : WebViewClient() {
+                    override fun shouldOverrideUrlLoading(child: WebView, request: WebResourceRequest): Boolean {
+                        if (request.isForMainFrame && workspace === view) {
+                            val url = request.url.toString()
+                            if (NavigationPolicy.allows(server, url)) view.loadUrl(url) else openExternal(url)
+                        }
+                        child.post { dispose() }
+                        return true
+                    }
+                }
+                (result.obj as WebView.WebViewTransport).webView = popup
+                result.sendToTarget()
+                handler.postDelayed({ dispose() }, 10000)
+                return true
+            }
+        }
+        remote.webViewClient = object : WebViewClient() {
+            override fun shouldOverrideUrlLoading(view: WebView, request: WebResourceRequest): Boolean {
+                val url = request.url.toString()
+                if (NavigationPolicy.allows(server, url)) return false
+                if (workspace === view && request.isForMainFrame && request.hasGesture()) openExternal(url)
+                return true
+            }
+
+            override fun onPageStarted(view: WebView, url: String, favicon: Bitmap?) {
+                if (workspace === view) cancelFileSelection()
+                if (!NavigationPolicy.allows(server, url)) {
+                    view.stopLoading()
+                    fail(view)
+                    return
+                }
+                phase = "connecting"
+                startTimeout(view)
+                updateLauncher()
+            }
+
+            override fun onPageFinished(view: WebView, url: String) {
+                if (workspace !== view || phase != "connecting" || !NavigationPolicy.allows(server, url)) return
+                revision++
+                phase = "connected"
+                val firstLoad = !ready
+                ready = true
+                CookieManager.getInstance().flush()
+                updateLauncher()
+                if (firstLoad) showWorkspace()
+            }
+
+            override fun onReceivedError(view: WebView, request: WebResourceRequest, error: WebResourceError) {
+                if (request.isForMainFrame) fail(view)
+            }
+
+            override fun onReceivedHttpError(view: WebView, request: WebResourceRequest, response: WebResourceResponse) {
+                if (request.isForMainFrame && response.statusCode >= 500) fail(view)
+            }
+
+            override fun onReceivedSslError(view: WebView, sslHandler: SslErrorHandler, error: SslError) {
+                sslHandler.cancel()
+                fail(view)
+            }
+        }
+        remote.visibility = View.GONE
+        content.addView(remote, 0, FrameLayout.LayoutParams(-1, -1))
+        startTimeout(remote)
+        remote.loadUrl(server)
+    }
+
+    private fun startTimeout(view: WebView) {
+        val current = ++revision
+        handler.postDelayed({
+            if (current == revision && phase == "connecting" && workspace === view) {
+                view.stopLoading()
+                fail(view)
+            }
+        }, 15000)
+    }
+
+    private fun fail(view: WebView) {
+        if (workspace !== view) return
+        revision++
+        phase = "connectionError"
+        showLauncher()
+    }
+
+    private fun updateLauncher() {
+        val query = Uri.Builder().appendQueryParameter("server", server)
+            .appendQueryParameter("phase", phase).appendQueryParameter("ready", ready.toString())
+            .appendQueryParameter("platform", "android").build().encodedQuery.orEmpty()
+        launcher.evaluateJavascript("window.updateLauncher?.(${JSONObject.quote(query)})", null)
+    }
+
+    private fun showLauncher() {
+        updateLauncher()
+        launcherVisible = true
+        launcher.visibility = View.VISIBLE
+        workspace?.visibility = View.GONE
+        settings.visibility = View.GONE
+        launcher.requestFocus()
+    }
+
+    private fun showWorkspace() {
+        launcherVisible = false
+        launcher.visibility = View.GONE
+        workspace?.visibility = View.VISIBLE
+        settings.visibility = View.VISIBLE
+        workspace?.requestFocus()
+    }
+
+    override fun onPause() {
+        workspace?.onPause()
+        CookieManager.getInstance().flush()
+        super.onPause()
+    }
+
+    override fun onResume() {
+        super.onResume()
+        workspace?.onResume()
+    }
+
+    override fun onConfigurationChanged(newConfig: Configuration) {
+        super.onConfigurationChanged(newConfig)
+        enableEdgeToEdge()
+        if (::root.isInitialized) ViewCompat.requestApplyInsets(root)
+    }
+
+    override fun onDestroy() {
+        handler.removeCallbacksAndMessages(null)
+        cancelFileSelection()
+        popups.forEach { it.destroy() }
+        popups.clear()
+        workspace?.destroy()
+        workspace = null
+        super.onDestroy()
+    }
+}

native/src-tauri/gen/android/app/src/main/java/de/kanbangit/desktop/NavigationPolicy.kt

@@ -0,0 +1,56 @@
+package de.kanbangit.desktop
+
+import java.net.URI
+import java.util.Locale
+
+object NavigationPolicy {
+    const val DEFAULT_SERVER = "https://kanbangit.de/"
+    const val LAUNCHER_ORIGIN = "https://tauri.localhost"
+
+    fun installation(input: String): String? = runCatching {
+        val trimmed = input.trim()
+        require(trimmed.none { it.isISOControl() || it == '\\' })
+        val uri = URI(trimmed)
+        require(uri.scheme.equals("https", ignoreCase = true))
+        require(!uri.host.isNullOrBlank() && uri.rawUserInfo == null)
+        require(uri.rawQuery == null && uri.rawFragment == null)
+        require(uri.port == -1 || uri.port in 1..65535)
+        require(!uri.host.equals("tauri.localhost", ignoreCase = true))
+        val port = if (uri.port == -1 || uri.port == 443) "" else ":${uri.port}"
+        val path = uri.rawPath.orEmpty().let { if (it.endsWith('/')) it else "$it/" }
+        "https://${uri.host.lowercase(Locale.ROOT)}$port$path"
+    }.getOrNull()
+
+    fun allows(server: String, destination: String): Boolean = runCatching {
+        val base = URI(server)
+        val target = URI(destination)
+        target.scheme.equals("https", ignoreCase = true) &&
+            target.host.equals(base.host, ignoreCase = true) &&
+            (if (target.port == -1) 443 else target.port) ==
+            (if (base.port == -1) 443 else base.port) &&
+            target.rawUserInfo == null && !destination.contains('\\')
+    }.getOrDefault(false)
+
+    fun external(destination: String): Boolean = runCatching {
+        val target = URI(destination)
+        target.scheme.lowercase(Locale.ROOT) in setOf("https", "http") &&
+            !target.host.isNullOrBlank() && target.rawUserInfo == null &&
+            (target.port == -1 || target.port in 1..65535) &&
+            destination.none { it.isISOControl() || it == '\\' }
+    }.getOrDefault(false)
+
+    fun selectedFile(destination: String, packageName: String): Boolean = runCatching {
+        val target = URI(destination)
+        target.scheme == "content" && !target.host.isNullOrBlank() &&
+            target.rawUserInfo == null && target.port == -1 &&
+            target.host != packageName && target.host != "$packageName.fileprovider"
+    }.getOrDefault(false)
+
+    fun backAction(keyboard: Boolean, launcher: Boolean, ready: Boolean, history: Boolean): String = when {
+        keyboard -> "keyboard"
+        launcher && ready -> "resume"
+        !launcher && history -> "history"
+        !launcher -> "settings"
+        else -> "background"
+    }
+}

native/src-tauri/gen/android/app/src/main/res/drawable/kanbangit.xml

@@ -0,0 +1,8 @@
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="48dp" android:height="48dp"
+    android:viewportWidth="64" android:viewportHeight="64">
+    <path android:fillColor="#22c55e" android:pathData="M12,0 H52 Q64,0 64,12 V52 Q64,64 52,64 H12 Q0,64 0,52 V12 Q0,0 12,0 Z" />
+    <path android:fillColor="@android:color/transparent" android:strokeColor="#004b1e"
+        android:strokeWidth="3" android:strokeLineCap="round" android:strokeLineJoin="round"
+        android:pathData="M19,16 H45 Q48,16 48,19 V45 Q48,48 45,48 H19 Q16,48 16,45 V19 Q16,16 19,16 Z M27,16 V48 M37,16 V48" />
+</vector>

native/src-tauri/gen/android/app/src/main/res/values-night/themes.xml

@@ -0,0 +1,6 @@
+<resources xmlns:tools="http://schemas.android.com/tools">
+    <!-- Base application theme. -->
+    <style name="Theme.kanbangit_native" parent="Theme.MaterialComponents.DayNight.NoActionBar">
+        <!-- Customize your theme here. -->
+    </style>
+</resources>

native/src-tauri/gen/android/app/src/main/res/values/strings.xml

@@ -0,0 +1,8 @@
+<resources>
+    <string name="app_name">"KanbanGit"</string>
+    <string name="main_activity_title">"KanbanGit"</string>
+    <string name="server_settings">Server settings</string>
+    <string name="update_webview">Update Android System WebView to connect to your workspace.</string>
+    <string name="external_link_error">No browser is available to open this link.</string>
+    <string name="file_picker_error">No file picker is available. Please try again.</string>
+</resources>

native/src-tauri/gen/android/app/src/main/res/values/themes.xml

@@ -0,0 +1,6 @@
+<resources xmlns:tools="http://schemas.android.com/tools">
+    <!-- Base application theme. -->
+    <style name="Theme.kanbangit_native" parent="Theme.MaterialComponents.DayNight.NoActionBar">
+        <!-- Customize your theme here. -->
+    </style>
+</resources>

native/src-tauri/gen/android/app/src/main/res/xml/data_extraction_rules.xml

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<data-extraction-rules>
+    <cloud-backup>
+        <exclude domain="root" path="." />
+        <exclude domain="sharedpref" path="." />
+        <exclude domain="database" path="." />
+        <exclude domain="file" path="." />
+        <exclude domain="external" path="." />
+    </cloud-backup>
+    <device-transfer>
+        <exclude domain="root" path="." />
+        <exclude domain="sharedpref" path="." />
+        <exclude domain="database" path="." />
+        <exclude domain="file" path="." />
+        <exclude domain="external" path="." />
+    </device-transfer>
+</data-extraction-rules>

native/src-tauri/gen/android/app/src/main/res/xml/file_paths.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<paths xmlns:android="http://schemas.android.com/apk/res/android">
+  <external-path name="my_images" path="." />
+  <cache-path name="my_cache_images" path="." />
+</paths>

native/src-tauri/gen/android/app/src/test/java/de/kanbangit/desktop/NavigationPolicyTest.kt

@@ -0,0 +1,51 @@
+package de.kanbangit.desktop
+
+import org.junit.Assert.*
+import org.junit.Test
+
+class NavigationPolicyTest {
+    @Test fun normalizesAddressesAndRejectsCredentialsAndUnsafeSchemes() {
+        assertEquals("https://example.com/kanban/", NavigationPolicy.installation(" HTTPS://Example.com:443/kanban "))
+        assertEquals("https://[::1]:8443/", NavigationPolicy.installation("https://[::1]:8443"))
+        for (value in listOf("http://example.com", "https:example.com", "https://user:pass@example.com", "https://example.com/?token=x", "https://example.com/#x", "https://exa\nmple.com", "https://example.com\\other", "https://example.com:99999", "https://tauri.localhost/", "file:///etc/passwd", "")) {
+            assertNull(value, NavigationPolicy.installation(value))
+        }
+    }
+
+    @Test fun allowsLoginTwoFactorAndHistoryOnlyOnTheSelectedOrigin() {
+        val server = "https://example.com:8443/app/"
+        for (path in listOf("/login", "/two-factor-challenge", "/projects/1?ticket=53#details")) {
+            assertTrue(NavigationPolicy.allows(server, "https://example.com:8443$path"))
+        }
+        for (value in listOf("https://example.com/", "http://example.com:8443/", "https://other.example.com:8443/", "https://user@example.com:8443/", "https://tauri.localhost/action/open", "javascript:alert(1)", "intent://example.com", "file:///etc/passwd")) {
+            assertFalse(value, NavigationPolicy.allows(server, value))
+        }
+        assertTrue(NavigationPolicy.allows("https://example.com/", "https://example.com:443/login"))
+    }
+
+    @Test fun externalLinksNeverBecomeServerNavigation() {
+        val server = "https://example.com/"
+        for (url in listOf("https://git.example.com/org/repo/pulls/1#diff", "http://git.example.com/repo", "https://example.com:8443/other")) {
+            assertTrue(url, NavigationPolicy.external(url))
+            assertFalse(url, NavigationPolicy.allows(server, url))
+        }
+        for (url in listOf("https://user:password@git.example.com/", "https://example.com:99999/", "javascript:alert(1)", "intent://example.com/", "file:///etc/passwd", "content://provider/file", "data:text/html,test", "mailto:user@example.com", "https://example.com\\evil")) {
+            assertFalse(url, NavigationPolicy.external(url))
+        }
+    }
+
+    @Test fun filePickerAcceptsOnlyExternalContentProviders() {
+        assertTrue(NavigationPolicy.selectedFile("content://com.android.providers.media.documents/document/image%3A1", "de.kanbangit.desktop"))
+        for (url in listOf("file:///data/data/de.kanbangit.desktop/session", "https://example.com/avatar.png", "content://de.kanbangit.desktop.fileprovider/private/key", "content://de.kanbangit.desktop/private/key", "content://user@provider/path", "content://provider:123/path", "content:/missing-provider")) {
+            assertFalse(url, NavigationPolicy.selectedFile(url, "de.kanbangit.desktop"))
+        }
+    }
+
+    @Test fun backClosesKeyboardBeforeNavigatingAndPreservesTheWorkspace() {
+        assertEquals("keyboard", NavigationPolicy.backAction(true, false, true, true))
+        assertEquals("resume", NavigationPolicy.backAction(false, true, true, true))
+        assertEquals("history", NavigationPolicy.backAction(false, false, true, true))
+        assertEquals("settings", NavigationPolicy.backAction(false, false, true, false))
+        assertEquals("background", NavigationPolicy.backAction(false, true, false, false))
+    }
+}

native/src-tauri/gen/android/build.gradle.kts

@@ -0,0 +1,21 @@
+buildscript {
+    repositories {
+        google()
+        mavenCentral()
+    }
+    dependencies {
+        classpath("com.android.tools.build:gradle:8.11.0")
+        classpath("org.jetbrains.kotlin:kotlin-gradle-plugin:1.9.25")
+    }
+}
+
+allprojects {
+    repositories {
+        google()
+        mavenCentral()
+    }
+}
+
+tasks.register("clean").configure {
+    delete("build")
+}

native/src-tauri/gen/android/buildSrc/build.gradle.kts

@@ -0,0 +1,22 @@
+plugins {
+    `kotlin-dsl`
+}
+
+gradlePlugin {
+    plugins {
+        create("pluginsForCoolKids") {
+            id = "rust"
+            implementationClass = "RustPlugin"
+        }
+    }
+}
+
+repositories {
+    google()
+    mavenCentral()
+}
+
+dependencies {
+    compileOnly(gradleApi())
+    implementation("com.android.tools.build:gradle:8.11.0")
+}

native/src-tauri/gen/android/buildSrc/src/main/java/de/kanbangit/desktop/kotlin/BuildTask.kt

@@ -0,0 +1,68 @@
+import java.io.File
+import org.apache.tools.ant.taskdefs.condition.Os
+import org.gradle.api.DefaultTask
+import org.gradle.api.GradleException
+import org.gradle.api.logging.LogLevel
+import org.gradle.api.tasks.Input
+import org.gradle.api.tasks.TaskAction
+
+open class BuildTask : DefaultTask() {
+    @Input
+    var rootDirRel: String? = null
+    @Input
+    var target: String? = null
+    @Input
+    var release: Boolean? = null
+
+    @TaskAction
+    fun assemble() {
+        val executable = """pnpm""";
+        try {
+            runTauriCli(executable)
+        } catch (e: Exception) {
+            if (Os.isFamily(Os.FAMILY_WINDOWS)) {
+                // Try different Windows-specific extensions
+                val fallbacks = listOf(
+                    "$executable.exe",
+                    "$executable.cmd",
+                    "$executable.bat",
+                )
+
+                var lastException: Exception = e
+                for (fallback in fallbacks) {
+                    try {
+                        runTauriCli(fallback)
+                        return
+                    } catch (fallbackException: Exception) {
+                        lastException = fallbackException
+                    }
+                }
+                throw lastException
+            } else {
+                throw e;
+            }
+        }
+    }
+
+    fun runTauriCli(executable: String) {
+        val rootDirRel = rootDirRel ?: throw GradleException("rootDirRel cannot be null")
+        val target = target ?: throw GradleException("target cannot be null")
+        val release = release ?: throw GradleException("release cannot be null")
+        val args = listOf("tauri", "android", "android-studio-script");
+
+        project.exec {
+            workingDir(File(project.projectDir, rootDirRel))
+            executable(executable)
+            args(args)
+            if (project.logger.isEnabled(LogLevel.DEBUG)) {
+                args("-vv")
+            } else if (project.logger.isEnabled(LogLevel.INFO)) {
+                args("-v")
+            }
+            if (release) {
+                args("--release")
+            }
+            args(listOf("--target", target))
+        }.assertNormalExitValue()
+    }
+}

native/src-tauri/gen/android/buildSrc/src/main/java/de/kanbangit/desktop/kotlin/RustPlugin.kt

@@ -0,0 +1,85 @@
+import com.android.build.api.dsl.ApplicationExtension
+import org.gradle.api.DefaultTask
+import org.gradle.api.Plugin
+import org.gradle.api.Project
+import org.gradle.kotlin.dsl.configure
+import org.gradle.kotlin.dsl.get
+
+const val TASK_GROUP = "rust"
+
+open class Config {
+    lateinit var rootDirRel: String
+}
+
+open class RustPlugin : Plugin<Project> {
+    private lateinit var config: Config
+
+    override fun apply(project: Project) = with(project) {
+        config = extensions.create("rust", Config::class.java)
+
+        val defaultAbiList = listOf("arm64-v8a", "armeabi-v7a", "x86", "x86_64");
+        val abiList = (findProperty("abiList") as? String)?.split(',') ?: defaultAbiList
+
+        val defaultArchList = listOf("arm64", "arm", "x86", "x86_64");
+        val archList = (findProperty("archList") as? String)?.split(',') ?: defaultArchList
+
+        val targetsList = (findProperty("targetList") as? String)?.split(',') ?: listOf("aarch64", "armv7", "i686", "x86_64")
+
+        extensions.configure<ApplicationExtension> {
+            @Suppress("UnstableApiUsage")
+            flavorDimensions.add("abi")
+            productFlavors {
+                create("universal") {
+                    dimension = "abi"
+                    ndk {
+                        abiFilters += abiList
+                    }
+                }
+                defaultArchList.forEachIndexed { index, arch ->
+                    create(arch) {
+                        dimension = "abi"
+                        ndk {
+                            abiFilters.add(defaultAbiList[index])
+                        }
+                    }
+                }
+            }
+        }
+
+        afterEvaluate {
+            for (profile in listOf("debug", "release")) {
+                val profileCapitalized = profile.replaceFirstChar { it.uppercase() }
+                val buildTask = tasks.maybeCreate(
+                    "rustBuildUniversal$profileCapitalized",
+                    DefaultTask::class.java
+                ).apply {
+                    group = TASK_GROUP
+                    description = "Build dynamic library in $profile mode for all targets"
+                }
+
+                tasks["mergeUniversal${profileCapitalized}JniLibFolders"].dependsOn(buildTask)
+
+                for (targetPair in targetsList.withIndex()) {
+                    val targetName = targetPair.value
+                    val targetArch = archList[targetPair.index]
+                    val targetArchCapitalized = targetArch.replaceFirstChar { it.uppercase() }
+                    val targetBuildTask = project.tasks.maybeCreate(
+                        "rustBuild$targetArchCapitalized$profileCapitalized",
+                        BuildTask::class.java
+                    ).apply {
+                        group = TASK_GROUP
+                        description = "Build dynamic library in $profile mode for $targetArch"
+                        rootDirRel = config.rootDirRel
+                        target = targetName
+                        release = profile == "release"
+                    }
+
+                    buildTask.dependsOn(targetBuildTask)
+                    tasks["merge$targetArchCapitalized${profileCapitalized}JniLibFolders"].dependsOn(
+                        targetBuildTask
+                    )
+                }
+            }
+        }
+    }
+}

native/src-tauri/gen/android/gradle.properties

@@ -0,0 +1,25 @@
+# Project-wide Gradle settings.
+# IDE (e.g. Android Studio) users:
+# Gradle settings configured through the IDE *will override*
+# any settings specified in this file.
+# For more details on how to configure your build environment visit
+# http://www.gradle.org/docs/current/userguide/build_environment.html
+# Specifies the JVM arguments used for the daemon process.
+# The setting is particularly useful for tweaking memory settings.
+org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8
+# When configured, Gradle will run in incubating parallel mode.
+# This option should only be used with decoupled projects. More details, visit
+# http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects
+# org.gradle.parallel=true
+# AndroidX package structure to make it clearer which packages are bundled with the
+# Android operating system, and which are packaged with your app"s APK
+# https://developer.android.com/topic/libraries/support-library/androidx-rn
+android.useAndroidX=true
+# Kotlin code style for this project: "official" or "obsolete":
+kotlin.code.style=official
+# Enables namespacing of each library's R class so that its R class includes only the
+# resources declared in the library itself and none from the library's dependencies,
+# thereby reducing the size of the R class for that library
+android.nonTransitiveRClass=true
+android.nonFinalResIds=false
+android.builder.sdkDownload=false

native/src-tauri/gen/android/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,6 @@
+#Tue May 10 19:22:52 CST 2022
+distributionBase=GRADLE_USER_HOME
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-bin.zip
+distributionPath=wrapper/dists
+zipStorePath=wrapper/dists
+zipStoreBase=GRADLE_USER_HOME

native/src-tauri/gen/android/gradlew

@@ -0,0 +1,185 @@
+#!/usr/bin/env sh
+
+#
+# Copyright 2015 the original author or authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+##############################################################################
+##
+##  Gradle start up script for UN*X
+##
+##############################################################################
+
+# Attempt to set APP_HOME
+# Resolve links: $0 may be a link
+PRG="$0"
+# Need this for relative symlinks.
+while [ -h "$PRG" ] ; do
+    ls=`ls -ld "$PRG"`
+    link=`expr "$ls" : '.*-> \(.*\)$'`
+    if expr "$link" : '/.*' > /dev/null; then
+        PRG="$link"
+    else
+        PRG=`dirname "$PRG"`"/$link"
+    fi
+done
+SAVED="`pwd`"
+cd "`dirname \"$PRG\"`/" >/dev/null
+APP_HOME="`pwd -P`"
+cd "$SAVED" >/dev/null
+
+APP_NAME="Gradle"
+APP_BASE_NAME=`basename "$0"`
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD="maximum"
+
+warn () {
+    echo "$*"
+}
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+}
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "`uname`" in
+  CYGWIN* )
+    cygwin=true
+    ;;
+  Darwin* )
+    darwin=true
+    ;;
+  MINGW* )
+    msys=true
+    ;;
+  NONSTOP* )
+    nonstop=true
+    ;;
+esac
+
+CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD="$JAVA_HOME/jre/sh/java"
+    else
+        JAVACMD="$JAVA_HOME/bin/java"
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD="java"
+    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+fi
+
+# Increase the maximum file descriptors if we can.
+if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then
+    MAX_FD_LIMIT=`ulimit -H -n`
+    if [ $? -eq 0 ] ; then
+        if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
+            MAX_FD="$MAX_FD_LIMIT"
+        fi
+        ulimit -n $MAX_FD
+        if [ $? -ne 0 ] ; then
+            warn "Could not set maximum file descriptor limit: $MAX_FD"
+        fi
+    else
+        warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
+    fi
+fi
+
+# For Darwin, add options to specify how the application appears in the dock
+if $darwin; then
+    GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
+fi
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then
+    APP_HOME=`cygpath --path --mixed "$APP_HOME"`
+    CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
+
+    JAVACMD=`cygpath --unix "$JAVACMD"`
+
+    # We build the pattern for arguments to be converted via cygpath
+    ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
+    SEP=""
+    for dir in $ROOTDIRSRAW ; do
+        ROOTDIRS="$ROOTDIRS$SEP$dir"
+        SEP="|"
+    done
+    OURCYGPATTERN="(^($ROOTDIRS))"
+    # Add a user-defined pattern to the cygpath arguments
+    if [ "$GRADLE_CYGPATTERN" != "" ] ; then
+        OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
+    fi
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    i=0
+    for arg in "$@" ; do
+        CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
+        CHECK2=`echo "$arg"|egrep -c "^-"`                                 ### Determine if an option
+
+        if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then                    ### Added a condition
+            eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
+        else
+            eval `echo args$i`="\"$arg\""
+        fi
+        i=`expr $i + 1`
+    done
+    case $i in
+        0) set -- ;;
+        1) set -- "$args0" ;;
+        2) set -- "$args0" "$args1" ;;
+        3) set -- "$args0" "$args1" "$args2" ;;
+        4) set -- "$args0" "$args1" "$args2" "$args3" ;;
+        5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
+        6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
+        7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
+        8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
+        9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
+    esac
+fi
+
+# Escape application args
+save () {
+    for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done
+    echo " "
+}
+APP_ARGS=`save "$@"`
+
+# Collect all arguments for the java command, following the shell quoting and substitution rules
+eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS"
+
+exec "$JAVACMD" "$@"

native/src-tauri/gen/android/gradlew.bat

@@ -0,0 +1,89 @@
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+
+@if "%DEBUG%" == "" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%" == "" set DIRNAME=.
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if "%ERRORLEVEL%" == "0" goto execute
+
+echo.
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+echo.
+echo Please set the JAVA_HOME variable in your environment to match the
+echo location of your Java installation.
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo.
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
+echo.
+echo Please set the JAVA_HOME variable in your environment to match the
+echo location of your Java installation.
+
+goto fail
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
+
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
+
+:end
+@rem End local scope for the variables with windows NT shell
+if "%ERRORLEVEL%"=="0" goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+if  not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
+exit /b 1
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega

native/src-tauri/gen/android/settings.gradle

@@ -0,0 +1,3 @@
+include ':app'
+
+apply from: 'tauri.settings.gradle'

native/src-tauri/gen/apple/.gitignore

@@ -0,0 +1,3 @@
+xcuserdata/
+build/
+Externals/