feat(KAN-54): add local iOS and iPadOS Xcode builds

.agents/skills/inertia-vue-development/SKILL.md

@@ -0,0 +1,394 @@
+---
+name: inertia-vue-development
+description: "Develops Inertia.js v2 Vue client-side applications. Activates when creating Vue pages, forms, or navigation; using <Link>, <Form>, useForm, or router; working with deferred props, prefetching, or polling; or when user mentions Vue with Inertia, Vue pages, Vue forms, or Vue navigation."
+license: MIT
+metadata:
+  author: laravel
+---
+
+# Inertia Vue Development
+
+## When to Apply
+
+Activate this skill when:
+
+- Creating or modifying Vue page components for Inertia
+- Working with forms in Vue (using `<Form>` or `useForm`)
+- Implementing client-side navigation with `<Link>` or `router`
+- Using v2 features: deferred props, prefetching, WhenVisible, InfiniteScroll, once props, flash data, or polling
+- Building Vue-specific features with the Inertia protocol
+
+## Documentation
+
+Use `search-docs` for detailed Inertia v2 Vue patterns and documentation.
+
+## Basic Usage
+
+### Page Components Location
+
+Vue page components should be placed in the `resources/js/pages` directory.
+
+### Page Component Structure
+
+<!-- Basic Vue Page Component -->
+```vue
+<script setup>
+defineProps({
+    users: Array
+})
+</script>
+
+<template>
+    <div>
+        <h1>Users</h1>
+        <ul>
+            <li v-for="user in users" :key="user.id">
+                {{ user.name }}
+            </li>
+        </ul>
+    </div>
+</template>
+```
+
+## Client-Side Navigation
+
+### Basic Link Component
+
+Use `<Link>` for client-side navigation instead of traditional `<a>` tags:
+
+<!-- Inertia Vue Navigation -->
+```vue
+<script setup>
+import { Link } from '@inertiajs/vue3'
+</script>
+
+<template>
+    <div>
+        <Link href="/">Home</Link>
+        <Link href="/users">Users</Link>
+        <Link :href="`/users/${user.id}`">View User</Link>
+    </div>
+</template>
+```
+
+### Link with Method
+
+<!-- Link with POST Method -->
+```vue
+<script setup>
+import { Link } from '@inertiajs/vue3'
+</script>
+
+<template>
+    <Link href="/logout" method="post" as="button">
+        Logout
+    </Link>
+</template>
+```
+
+### Prefetching
+
+Prefetch pages to improve perceived performance:
+
+<!-- Prefetch on Hover -->
+```vue
+<script setup>
+import { Link } from '@inertiajs/vue3'
+</script>
+
+<template>
+    <Link href="/users" prefetch>
+        Users
+    </Link>
+</template>
+```
+
+### Programmatic Navigation
+
+<!-- Router Visit -->
+```vue
+<script setup>
+import { router } from '@inertiajs/vue3'
+
+function handleClick() {
+    router.visit('/users')
+}
+
+// Or with options
+function createUser() {
+    router.visit('/users', {
+        method: 'post',
+        data: { name: 'John' },
+        onSuccess: () => console.log('Done'),
+    })
+}
+</script>
+
+<template>
+    <Link href="/users">Users</Link>
+    <Link href="/logout" method="post" as="button">Logout</Link>
+</template>
+```
+
+## Form Handling
+
+### Form Component (Recommended)
+
+The recommended way to build forms is with the `<Form>` component:
+
+<!-- Form Component Example -->
+```vue
+<script setup>
+import { Form } from '@inertiajs/vue3'
+</script>
+
+<template>
+    <Form action="/users" method="post" #default="{ errors, processing, wasSuccessful }">
+        <input type="text" name="name" />
+        <div v-if="errors.name">{{ errors.name }}</div>
+
+        <input type="email" name="email" />
+        <div v-if="errors.email">{{ errors.email }}</div>
+
+        <button type="submit" :disabled="processing">
+            {{ processing ? 'Creating...' : 'Create User' }}
+        </button>
+
+        <div v-if="wasSuccessful">User created!</div>
+    </Form>
+</template>
+```
+
+### Form Component With All Props
+
+<!-- Form Component Full Example -->
+```vue
+<script setup>
+import { Form } from '@inertiajs/vue3'
+</script>
+
+<template>
+    <Form
+        action="/users"
+        method="post"
+        #default="{
+            errors,
+            hasErrors,
+            processing,
+            progress,
+            wasSuccessful,
+            recentlySuccessful,
+            setError,
+            clearErrors,
+            resetAndClearErrors,
+            defaults,
+            isDirty,
+            reset,
+            submit
+        }"
+    >
+        <input type="text" name="name" :value="defaults.name" />
+        <div v-if="errors.name">{{ errors.name }}</div>
+
+        <button type="submit" :disabled="processing">
+            {{ processing ? 'Saving...' : 'Save' }}
+        </button>
+
+        <progress v-if="progress" :value="progress.percentage" max="100">
+            {{ progress.percentage }}%
+        </progress>
+
+        <div v-if="wasSuccessful">Saved!</div>
+    </Form>
+</template>
+```
+
+### Form Component Reset Props
+
+The `<Form>` component supports automatic resetting:
+
+- `resetOnError` - Reset form data when the request fails
+- `resetOnSuccess` - Reset form data when the request succeeds
+- `setDefaultsOnSuccess` - Update default values on success
+
+Use the `search-docs` tool with a query of `form component resetting` for detailed guidance.
+
+<!-- Form with Reset Props -->
+```vue
+<script setup>
+import { Form } from '@inertiajs/vue3'
+</script>
+
+<template>
+    <Form
+        action="/users"
+        method="post"
+        reset-on-success
+        set-defaults-on-success
+        #default="{ errors, processing, wasSuccessful }"
+    >
+        <input type="text" name="name" />
+        <div v-if="errors.name">{{ errors.name }}</div>
+
+        <button type="submit" :disabled="processing">
+            Submit
+        </button>
+    </Form>
+</template>
+```
+
+Forms can also be built using the `useForm` composable for more programmatic control. Use the `search-docs` tool with a query of `useForm helper` for guidance.
+
+### `useForm` Composable
+
+For more programmatic control or to follow existing conventions, use the `useForm` composable:
+
+<!-- useForm Composable Example -->
+```vue
+<script setup>
+import { useForm } from '@inertiajs/vue3'
+
+const form = useForm({
+    name: '',
+    email: '',
+    password: '',
+})
+
+function submit() {
+    form.post('/users', {
+        onSuccess: () => form.reset('password'),
+    })
+}
+</script>
+
+<template>
+    <form @submit.prevent="submit">
+        <input type="text" v-model="form.name" />
+        <div v-if="form.errors.name">{{ form.errors.name }}</div>
+
+        <input type="email" v-model="form.email" />
+        <div v-if="form.errors.email">{{ form.errors.email }}</div>
+
+        <input type="password" v-model="form.password" />
+        <div v-if="form.errors.password">{{ form.errors.password }}</div>
+
+        <button type="submit" :disabled="form.processing">
+            Create User
+        </button>
+    </form>
+</template>
+```
+
+## Inertia v2 Features
+
+### Deferred Props
+
+Use deferred props to load data after initial page render:
+
+<!-- Deferred Props with Empty State -->
+```vue
+<script setup>
+defineProps({
+    users: Array
+})
+</script>
+
+<template>
+    <div>
+        <h1>Users</h1>
+        <div v-if="!users" class="animate-pulse">
+            <div class="h-4 bg-gray-200 rounded w-3/4 mb-2"></div>
+            <div class="h-4 bg-gray-200 rounded w-1/2"></div>
+        </div>
+        <ul v-else>
+            <li v-for="user in users" :key="user.id">
+                {{ user.name }}
+            </li>
+        </ul>
+    </div>
+</template>
+```
+
+### Polling
+
+Automatically refresh data at intervals:
+
+<!-- Polling Example -->
+```vue
+<script setup>
+import { router } from '@inertiajs/vue3'
+import { onMounted, onUnmounted } from 'vue'
+
+defineProps({
+    stats: Object
+})
+
+let interval
+
+onMounted(() => {
+    interval = setInterval(() => {
+        router.reload({ only: ['stats'] })
+    }, 5000) // Poll every 5 seconds
+})
+
+onUnmounted(() => {
+    clearInterval(interval)
+})
+</script>
+
+<template>
+    <div>
+        <h1>Dashboard</h1>
+        <div>Active Users: {{ stats.activeUsers }}</div>
+    </div>
+</template>
+```
+
+### WhenVisible
+
+Lazy-load a prop when an element scrolls into view. Useful for deferring expensive data that sits below the fold:
+
+<!-- WhenVisible Example -->
+```vue
+<script setup>
+import { WhenVisible } from '@inertiajs/vue3'
+
+defineProps({
+    stats: Object
+})
+</script>
+
+<template>
+    <div>
+        <h1>Dashboard</h1>
+
+        <!-- stats prop is loaded only when this section scrolls into view -->
+        <WhenVisible data="stats" :buffer="200">
+            <template #fallback>
+                <div class="animate-pulse">Loading stats...</div>
+            </template>
+
+            <template #default="{ fetching }">
+                <div>
+                    <p>Total Users: {{ stats.total_users }}</p>
+                    <p>Revenue: {{ stats.revenue }}</p>
+                    <span v-if="fetching">Refreshing...</span>
+                </div>
+            </template>
+        </WhenVisible>
+    </div>
+</template>
+```
+
+## Server-Side Patterns
+
+Server-side patterns (Inertia::render, props, middleware) are covered in inertia-laravel guidelines.
+
+## Common Pitfalls
+
+- Using traditional `<a>` links instead of Inertia's `<Link>` component (breaks SPA behavior)
+- Forgetting that Vue components must have a single root element
+- Forgetting to add loading states (skeleton screens) when using deferred props
+- Not handling the `undefined` state of deferred props before data loads
+- Using `<form>` without preventing default submission (use `<Form>` component or `@submit.prevent`)
+- Forgetting to check if `<Form>` component is available in your Inertia version

.agents/skills/tailwindcss-development/SKILL.md

@@ -0,0 +1,119 @@
+---
+name: tailwindcss-development
+description: "Always invoke when the user's message includes 'tailwind' in any form. Also invoke for: building responsive grid layouts (multi-column card grids, product grids), flex/grid page structures (dashboards with sidebars, fixed topbars, mobile-toggle navs), styling UI components (cards, tables, navbars, pricing sections, forms, inputs, badges), adding dark mode variants, fixing spacing or typography, and Tailwind v3/v4 work. The core use case: writing or fixing Tailwind utility classes in HTML templates (Blade, JSX, Vue). Skip for backend PHP logic, database queries, API routes, JavaScript with no HTML/CSS component, CSS file audits, build tool configuration, and vanilla CSS."
+license: MIT
+metadata:
+  author: laravel
+---
+
+# Tailwind CSS Development
+
+## Documentation
+
+Use `search-docs` for detailed Tailwind CSS v4 patterns and documentation.
+
+## Basic Usage
+
+- Use Tailwind CSS classes to style HTML. Check and follow existing Tailwind conventions in the project before introducing new patterns.
+- Offer to extract repeated patterns into components that match the project's conventions (e.g., Blade, JSX, Vue).
+- Consider class placement, order, priority, and defaults. Remove redundant classes, add classes to parent or child elements carefully to reduce repetition, and group elements logically.
+
+## Tailwind CSS v4 Specifics
+
+- Always use Tailwind CSS v4 and avoid deprecated utilities.
+- `corePlugins` is not supported in Tailwind v4.
+
+### CSS-First Configuration
+
+In Tailwind v4, configuration is CSS-first using the `@theme` directive — no separate `tailwind.config.js` file is needed:
+
+<!-- CSS-First Config -->
+```css
+@theme {
+  --color-brand: oklch(0.72 0.11 178);
+}
+```
+
+### Import Syntax
+
+In Tailwind v4, import Tailwind with a regular CSS `@import` statement instead of the `@tailwind` directives used in v3:
+
+<!-- v4 Import Syntax -->
+```diff
+- @tailwind base;
+- @tailwind components;
+- @tailwind utilities;
++ @import "tailwindcss";
+```
+
+### Replaced Utilities
+
+Tailwind v4 removed deprecated utilities. Use the replacements shown below. Opacity values remain numeric.
+
+| Deprecated | Replacement |
+|------------|-------------|
+| bg-opacity-* | bg-black/* |
+| text-opacity-* | text-black/* |
+| border-opacity-* | border-black/* |
+| divide-opacity-* | divide-black/* |
+| ring-opacity-* | ring-black/* |
+| placeholder-opacity-* | placeholder-black/* |
+| flex-shrink-* | shrink-* |
+| flex-grow-* | grow-* |
+| overflow-ellipsis | text-ellipsis |
+| decoration-slice | box-decoration-slice |
+| decoration-clone | box-decoration-clone |
+
+## Spacing
+
+Use `gap` utilities instead of margins for spacing between siblings:
+
+<!-- Gap Utilities -->
+```html
+<div class="flex gap-8">
+    <div>Item 1</div>
+    <div>Item 2</div>
+</div>
+```
+
+## Dark Mode
+
+If existing pages and components support dark mode, new pages and components must support it the same way, typically using the `dark:` variant:
+
+<!-- Dark Mode -->
+```html
+<div class="bg-white dark:bg-gray-900 text-gray-900 dark:text-white">
+    Content adapts to color scheme
+</div>
+```
+
+## Common Patterns
+
+### Flexbox Layout
+
+<!-- Flexbox Layout -->
+```html
+<div class="flex items-center justify-between gap-4">
+    <div>Left content</div>
+    <div>Right content</div>
+</div>
+```
+
+### Grid Layout
+
+<!-- Grid Layout -->
+```html
+<div class="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-6">
+    <div>Card 1</div>
+    <div>Card 2</div>
+    <div>Card 3</div>
+</div>
+```
+
+## Common Pitfalls
+
+- Using deprecated v3 utilities (bg-opacity-*, flex-shrink-*, etc.)
+- Using `@tailwind` directives instead of `@import "tailwindcss"`
+- Trying to use `tailwind.config.js` instead of CSS `@theme` directive
+- Using margins for spacing between siblings instead of gap utilities
+- Forgetting to add dark mode variants when the project uses dark mode

.agents/skills/wayfinder-development/SKILL.md

@@ -61,14 +61,10 @@ show(1, { query: { page: 1 } }) // "/posts/1?page=1"
 
 ## Wayfinder + Inertia
 
-Use Wayfinder with `useForm`:
-
-<!-- Wayfinder useForm -->
-```typescript
-import { store } from "@/actions/App/Http/Controllers/ExampleController";
-
-const form = useForm({ name: "My Big Post" });
-form.submit(store());
+Use Wayfinder with the `<Form>` component:
+<!-- Wayfinder Form (Vue) -->
+```vue
+<Form v-bind="store.form()"><input name="title" /></Form>
 ```
 
 ## Verification

.github/tests/test_and_check_app/action.yml

@@ -1,78 +1,18 @@
-name: "Lint and Test APP"
-description: "Run Pint and the Pest test suite"
+name: test_and_check_app
+description: Build the test image and run all application checks
 
 runs:
   using: composite
   steps:
-    - name: Setup PHP
-      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #v2.37.2
-      with:
-        php-version: "8.5"
-        extensions: mbstring, pdo_sqlite
-        coverage: none
-        tools: composer:v2
-
-    - name: Verify Composer lockfile
+    - name: Test and check app
+      shell: bash
       run: |
-        if [ ! -f composer.lock ]; then
-          echo "::error::composer.lock not found"
-          exit 1
-        fi
-      shell: bash
+        set -Eeuo pipefail
 
-    - name: Get Composer cache directory
-      id: composer_cache
-      run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
-      shell: bash
-
-    - name: Cache Composer packages
-      uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
-      with:
-        path: ${{ steps.composer_cache.outputs.dir }}
-        key: ${{ runner.os }}-php-8.5-${{ hashFiles('composer.lock') }}
-
-    - name: Setup pnpm
-      uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v11.7.0
-      with:
-        package-json-file: package.json
-
-    - name: Setup Node.js
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-      with:
-        node-version: 22
-        cache: "pnpm"
-        cache-dependency-path: "pnpm-lock.yaml"
-
-    - name: Install dependencies
-      run: pnpm install --frozen-lockfile
-      shell: bash
-
-    - name: Prepare environment file
-      run: cp .env.example .env
-      shell: bash
-
-    - name: Install dependencies
-      run: composer install --no-interaction --prefer-dist --no-progress
-      shell: bash
-
-    - name: Generate application key
-      run: php artisan key:generate
-      shell: bash
-
-    - name: Generate Wayfinder routes and actions
-      run: php artisan wayfinder:generate --with-form
-      shell: bash
-
-    - name: Run independent application checks
-      run: |
-        pnpm exec concurrently \
-          --names frontend,backend \
-          --prefix-colors cyan,magenta \
-          --kill-others-on-fail \
-          "composer run ci:frontend" \
-          "composer run ci:backend"
-      shell: bash
-
-    - name: Run Laravel tests
-      run: composer run ci:test
-      shell: bash
+        docker buildx build \
+          --file Dockerfile \
+          --target test \
+          --tag "local/kanbangit-test:${GITHUB_SHA}" \
+          --progress plain \
+          --load \
+          .

.github/workflows/macos-checks.yml

@@ -1,58 +0,0 @@
-name: macOS checks
-
-on:
-  push:
-    branches: [main]
-    paths: ["native/**", ".github/**", "package.json", "pnpm-lock.yaml", "eslint.config.mjs", "resources/css/app.css"]
-  pull_request:
-    paths: ["native/**", ".github/**", "package.json", "pnpm-lock.yaml", "eslint.config.mjs", "resources/css/app.css"]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  macos:
-    name: Native Rust tests and unsigned build
-    runs-on: ${{ vars.MACOS_CHECK_RUNNER || vars.MACOS_RUNNER || 'macos-arm64' }}
-    timeout-minutes: 45
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v11.7.0
-        with:
-          package-json-file: package.json
-
-      - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 22
-
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
-        with:
-          toolchain: 1.98.1
-          components: rustfmt, clippy
-
-      - name: Install locked native dependencies
-        run: pnpm --dir native install --frozen-lockfile
-
-      - name: Run native tests
-        run: pnpm --dir native test
-
-      - name: Check Rust formatting and warnings
-        run: pnpm --dir native check
-
-      - name: Build unsigned macOS app without release credentials
-        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1.0.0
-        with:
-          projectPath: native
-          tauriScript: pnpm exec tauri
-          args: --ci --debug --no-sign --bundles app -- --locked
-          uploadUpdaterJson: false
-          uploadUpdaterSignatures: false
-          uploadWorkflowArtifacts: false

.github/workflows/macos-release.yml

@@ -1,220 +0,0 @@
-name: macOS release to Hetzner
-
-on:
-  push:
-    # Gitea enforces the configured macos-v* protection when tags are pushed.
-    # Reading /tag_protections requires admin rights unavailable to job tokens.
-    tags:
-      - "macos-v*"
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "Existing protected macos-vMAJOR.MINOR.PATCH tag on main"
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-concurrency:
-  group: macos-release
-  cancel-in-progress: false
-
-env:
-  APPLE_SIGNING_IDENTITY: "Developer ID Application: Nico Schröder (ZZX2KZGTHU)"
-  APPLE_TEAM_ID: ZZX2KZGTHU
-  MACOS_RELEASE_TARGET: ${{ vars.MACOS_RELEASE_TARGET || 'aarch64-apple-darwin' }}
-  S3_BUCKET: ${{ vars.S3_BUCKET }}
-  S3_REGION: ${{ vars.S3_REGION }}
-  S3_PREFIX: ${{ vars.S3_PREFIX || 'releases/macos' }}
-  S3_PUBLIC_BASE_URL: ${{ vars.S3_PUBLIC_BASE_URL }}
-
-jobs:
-  prepare:
-    name: Validate release ref and configuration
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    outputs:
-      commit: ${{ steps.ref.outputs.commit }}
-      tag: ${{ steps.ref.outputs.tag }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-
-      - name: Select an existing version tag contained in main
-        id: ref
-        shell: bash
-        env:
-          REQUESTED_TAG: ${{ inputs.tag }}
-          MACOS_RUNNER: ${{ vars.MACOS_RUNNER }}
-        run: |
-          set -Eeuo pipefail
-          if [[ "$GITHUB_EVENT_NAME" == workflow_dispatch ]]; then
-            [[ "$GITHUB_REF" == refs/heads/main ]] || { echo 'Dispatch this workflow from main.' >&2; exit 1; }
-            tag="$REQUESTED_TAG"
-          else
-            tag="${GITHUB_REF#refs/tags/}"
-          fi
-          [[ "$tag" =~ ^macos-v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]] || { echo 'Invalid macOS release tag.' >&2; exit 1; }
-          [[ "$MACOS_RUNNER" =~ ^[a-zA-Z0-9_-]+$ ]] || { echo 'Set MACOS_RUNNER to a registered macOS runner label.' >&2; exit 1; }
-          git fetch --no-tags origin main:refs/remotes/origin/main
-          commit="$(git rev-parse --verify "refs/tags/$tag^{commit}")"
-          git merge-base --is-ancestor "$commit" origin/main || { echo 'Release tag must belong to main.' >&2; exit 1; }
-          git checkout --detach "$commit"
-          printf 'commit=%s\ntag=%s\n' "$commit" "$tag" >> "$GITHUB_OUTPUT"
-
-      - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 22
-
-      - name: Validate app versions and Hetzner configuration
-        env:
-          RELEASE_TAG: ${{ steps.ref.outputs.tag }}
-        run: |
-          node native/macos-ci.mjs metadata
-          node native/publish-macos.mjs config
-
-  release:
-    name: Sign, notarize, verify and publish macOS
-    needs: prepare
-    # Gitea resolves runner labels before outputs from prepare are available.
-    runs-on: ${{ vars.MACOS_RUNNER }}
-    timeout-minutes: 120
-    env:
-      RELEASE_TAG: ${{ needs.prepare.outputs.tag }}
-    steps:
-      - name: Check out the validated commit
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ needs.prepare.outputs.commit }}
-          persist-credentials: false
-
-      - name: Validate runner and required secrets
-        shell: bash
-        env:
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
-          S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
-          S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}
-        run: |
-          set -Eeuo pipefail
-          [[ "$(uname -s)" == Darwin ]] || { echo 'A macOS runner is required.' >&2; exit 1; }
-          case "$MACOS_RELEASE_TARGET:$(uname -m)" in
-            aarch64-apple-darwin:arm64|x86_64-apple-darwin:x86_64) ;;
-            *) echo 'Runner architecture must match MACOS_RELEASE_TARGET.' >&2; exit 1 ;;
-          esac
-          xcodebuild -version
-          xcrun --find notarytool
-          aws --version | grep '^aws-cli/2\.' || { echo 'Install AWS CLI v2 permanently on this runner.' >&2; exit 1; }
-          for name in APPLE_CERTIFICATE APPLE_CERTIFICATE_PASSWORD APPLE_PASSWORD S3_ACCESS_KEY_ID S3_SECRET_ACCESS_KEY; do
-            [[ -n "${!name}" ]] || { echo "Missing repository secret: $name" >&2; exit 1; }
-          done
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v11.7.0
-        with:
-          package-json-file: package.json
-
-      - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 22
-
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
-        with:
-          toolchain: 1.98.1
-          targets: ${{ env.MACOS_RELEASE_TARGET }}
-          components: rustfmt, clippy
-
-      - name: Install locked dependencies
-        run: |
-          pnpm install --frozen-lockfile
-          pnpm --dir native install --frozen-lockfile
-
-      - name: Run native checks before importing signing credentials
-        run: |
-          pnpm exec eslint native --max-warnings 0
-          pnpm --dir native test
-          pnpm --dir native check
-
-      - name: Prepare isolated signing keychain
-        id: signing
-        shell: bash
-        env:
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-        run: |
-          set -Eeuo pipefail
-          umask 077
-          signing_dir="$(mktemp -d "$RUNNER_TEMP/kanbangit-signing.XXXXXX")"
-          printf 'SIGNING_DIRECTORY=%s\n' "$signing_dir" >> "$GITHUB_ENV"
-          security list-keychains -d user > "$signing_dir/original-keychains.txt"
-          printf '%s' "$APPLE_CERTIFICATE" | base64 --decode > "$signing_dir/certificate.p12"
-          password="$(openssl rand -hex 32)"
-          echo "::add-mask::$password"
-          printf 'keychain=kanbangit-%s-%s\npassword=%s\ncertificate=%s/certificate.p12\n' "$GITHUB_RUN_ID" "$GITHUB_RUN_ATTEMPT" "$password" "$signing_dir" >> "$GITHUB_OUTPUT"
-
-      - name: Import Developer ID certificate
-        uses: Apple-Actions/import-codesign-certs@5142e029c445c10ffc7149d172e540235a065466 # v7.0.0; deletes its keychain in the post step
-        with:
-          keychain: ${{ steps.signing.outputs.keychain }}
-          keychain-password: ${{ steps.signing.outputs.password }}
-          p12-filepath: ${{ steps.signing.outputs.certificate }}
-          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-
-      - name: Confirm release signing identity
-        shell: bash
-        run: |
-          set -Eeuo pipefail
-          security find-identity -v -p codesigning | grep -F "\"$APPLE_SIGNING_IDENTITY\""
-
-      - name: Build, sign and notarize with Tauri
-        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1.0.0
-        env:
-          APPLE_ID: dev@petsch-studios.de
-          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
-        with:
-          projectPath: native
-          tauriScript: pnpm exec tauri
-          args: >-
-            --ci --target ${{ env.MACOS_RELEASE_TARGET }} --bundles app
-            --config '{"bundle":{"createUpdaterArtifacts":false,"macOS":{"hardenedRuntime":true}}}'
-            -- --locked
-          uploadUpdaterJson: false
-          uploadUpdaterSignatures: false
-          uploadWorkflowArtifacts: false
-
-      - name: Verify signed app and packaged download
-        id: package
-        run: node native/macos-ci.mjs package
-
-      - name: Publish immutable files and verify public Hetzner downloads
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}
-          AWS_EC2_METADATA_DISABLED: "true"
-          AWS_REQUEST_CHECKSUM_CALCULATION: when_required
-          AWS_RESPONSE_CHECKSUM_VALIDATION: when_required
-          RELEASE_DIRECTORY: ${{ steps.package.outputs.directory }}
-        run: node native/publish-macos.mjs upload
-
-      - name: Restore keychain search list and remove certificate export
-        if: ${{ always() }}
-        shell: bash
-        run: |
-          python3 - <<'PY'
-          import os, pathlib, shlex, shutil, subprocess
-          value = os.environ.get('SIGNING_DIRECTORY')
-          if value:
-              directory = pathlib.Path(value)
-              original = directory / 'original-keychains.txt'
-              try:
-                  if original.exists():
-                      subprocess.run(['security', 'list-keychains', '-d', 'user', '-s', *shlex.split(original.read_text())], check=True)
-              finally:
-                  shutil.rmtree(directory)
-          PY

.github/workflows/native-checks.yml

@@ -1,57 +0,0 @@
-name: Native JavaScript checks
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - "native/**"
-      - ".github/**"
-      - "package.json"
-      - "pnpm-lock.yaml"
-      - "eslint.config.mjs"
-      - "resources/css/app.css"
-  pull_request:
-    paths:
-      - "native/**"
-      - ".github/**"
-      - "package.json"
-      - "pnpm-lock.yaml"
-      - "eslint.config.mjs"
-      - "resources/css/app.css"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  native_javascript:
-    name: Native launcher and release tests
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v11.7.0
-        with:
-          package-json-file: package.json
-
-      - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 22
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
-
-      - name: Install locked development dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Lint native JavaScript
-        run: pnpm exec eslint native --max-warnings 0
-
-      - name: Test native launcher and release safeguards without credentials
-        run: node --test native/tests/*.test.js

.gitignore

@@ -32,7 +32,6 @@ yarn-error.log
 /native/node_modules
 /native/src-tauri/target
 /native/src-tauri/gen/*
-!/native/src-tauri/gen/android/
 !/native/src-tauri/gen/apple/
 /native/src-tauri/gen/apple/build/
 /native/src-tauri/gen/apple/Externals/

AGENTS.md

@@ -1,9 +1,3 @@
-# Working Agreements
-
-## Missing programs and SDKs
-
-If implementation or verification requires a missing program, SDK, runtime, toolchain, or platform component, do not download or install a temporary copy in `/tmp` or another temporary directory. Do not use an ad hoc toolchain as a workaround. Tell the user which prerequisites are missing, ask them to install them permanently and confirm when installation is complete, and wait for that confirmation before continuing dependent work. This rule applies to every implementation task in this project.
-
 <laravel-boost-guidelines>
 === foundation rules ===
 
@@ -15,7 +9,7 @@ The Laravel Boost guidelines are specifically curated by Laravel maintainers for
 
 This application is a Laravel application and its main Laravel ecosystems package & versions are below. You are an expert with them all. Ensure you abide by these specific packages & versions.
 
-- php - 8.5
+- php - 8.4
 - inertiajs/inertia-laravel (INERTIA_LARAVEL) - v2
 - laravel/fortify (FORTIFY) - v1
 - laravel/framework (LARAVEL) - v13
@@ -27,6 +21,12 @@ This application is a Laravel application and its main Laravel ecosystems packag
 - laravel/pint (PINT) - v1
 - laravel/sail (SAIL) - v1
 - phpunit/phpunit (PHPUNIT) - v12
+- @inertiajs/vue3 (INERTIA_VUE) - v2
+- tailwindcss (TAILWINDCSS) - v4
+- vue (VUE) - v3
+- @laravel/vite-plugin-wayfinder (WAYFINDER_VITE) - v0
+- eslint (ESLINT) - v9
+- prettier (PRETTIER) - v3
 
 ## Skills Activation
 
@@ -36,6 +36,8 @@ This project has domain-specific skills available. You MUST activate the relevan
 - `laravel-best-practices` — Apply this skill whenever writing, reviewing, or refactoring Laravel PHP code. This includes creating or modifying controllers, models, migrations, form requests, policies, jobs, scheduled commands, service classes, and Eloquent queries. Triggers for N+1 and query performance issues, caching strategies, authorization and security patterns, validation, error handling, queue and job configuration, route definitions, and architectural decisions. Also use for Laravel code reviews and refactoring existing Laravel code to follow best practices. Covers any task involving Laravel backend PHP code patterns.
 - `mcp-development` — Use this skill for Laravel MCP development only. Trigger when creating or editing MCP tools, resources, prompts, or servers in Laravel projects. Covers: artisan make:mcp-* generators, mcp:inspector, routes/ai.php, Tool/Resource/Prompt classes, schema validation, shouldRegister(), OAuth setup, URI templates, read-only attributes, and MCP debugging. Do not use for non-Laravel MCP projects or generic AI features without MCP.
 - `wayfinder-development` — Use this skill for Laravel Wayfinder which auto-generates typed functions for Laravel controllers and routes. ALWAYS use this skill when frontend code needs to call backend routes or controller actions. Trigger when: connecting any React/Vue/Svelte/Inertia frontend to Laravel controllers, routes, building end-to-end features with both frontend and backend, wiring up forms or links to backend endpoints, fixing route-related TypeScript errors, importing from @/actions or @/routes, or running wayfinder:generate. Use Wayfinder route functions instead of hardcoded URLs. Covers: wayfinder() vite plugin, .url()/.get()/.post()/.form(), query params, route model binding, tree-shaking. Do not use for backend-only task
+- `inertia-vue-development` — Develops Inertia.js v2 Vue client-side applications. Activates when creating Vue pages, forms, or navigation; using <Link>, <Form>, useForm, or router; working with deferred props, prefetching, or polling; or when user mentions Vue with Inertia, Vue pages, Vue forms, or Vue navigation.
+- `tailwindcss-development` — Always invoke when the user's message includes 'tailwind' in any form. Also invoke for: building responsive grid layouts (multi-column card grids, product grids), flex/grid page structures (dashboards with sidebars, fixed topbars, mobile-toggle navs), styling UI components (cards, tables, navbars, pricing sections, forms, inputs, badges), adding dark mode variants, fixing spacing or typography, and Tailwind v3/v4 work. The core use case: writing or fixing Tailwind utility classes in HTML templates (Blade, JSX, Vue). Skip for backend PHP logic, database queries, API routes, JavaScript with no HTML/CSS component, CSS file audits, build tool configuration, and vanilla CSS.
 
 ## Conventions
 
@@ -54,7 +56,7 @@ This project has domain-specific skills available. You MUST activate the relevan
 
 ## Frontend Bundling
 
-- If the user doesn't see a frontend change reflected in the UI, it could mean they need to run `pnpm run build`, `pnpm run dev`, or `composer run dev`. Ask them.
+- If the user doesn't see a frontend change reflected in the UI, it could mean they need to run `npm run build`, `npm run dev`, or `composer run dev`. Ask them.
 
 ## Documentation Files
 
@@ -128,6 +130,7 @@ This project has domain-specific skills available. You MUST activate the relevan
 - Inertia creates fully client-side rendered SPAs without modern SPA complexity, leveraging existing server-side patterns.
 - Components live in `resources/js/pages` (unless specified in `vite.config.js`). Use `Inertia::render()` for server-side routing instead of Blade views.
 - ALWAYS use `search-docs` tool for version-specific Inertia documentation and updated code examples.
+- IMPORTANT: Activate `inertia-vue-development` when working with Inertia Vue client-side patterns.
 
 # Inertia v2
 
@@ -163,7 +166,7 @@ This project has domain-specific skills available. You MUST activate the relevan
 
 ## Vite Error
 
-- If you receive an "Illuminate\Foundation\ViteException: Unable to locate file in Vite manifest" error, you can run `pnpm run build` or ask the user to run `pnpm run dev` or `composer run dev`.
+- If you receive an "Illuminate\Foundation\ViteException: Unable to locate file in Vite manifest" error, you can run `npm run build` or ask the user to run `npm run dev` or `composer run dev`.
 
 ## Deployment
 
@@ -200,4 +203,11 @@ Use Wayfinder to generate TypeScript functions for Laravel routes. Import from `
 - To run all tests in a file: `php artisan test --compact tests/Feature/ExampleTest.php`.
 - To filter on a particular test name: `php artisan test --compact --filter=testName` (recommended after making a change to a related file).
 
+=== inertia-vue/core rules ===
+
+# Inertia + Vue
+
+Vue components must have a single root element.
+- IMPORTANT: Activate `inertia-vue-development` when working with Inertia Vue client-side patterns.
+
 </laravel-boost-guidelines>

app/Actions/Permissions/PermissionService.php

@@ -8,7 +8,6 @@ use App\Models\Project;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Database\Eloquent\Builder;
-use Illuminate\Database\Eloquent\Collection as EloquentCollection;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\DB;
@@ -114,41 +113,6 @@ class PermissionService
         );
     }
 
-    /**
-     * @param  EloquentCollection<int, User>  $users
-     * @return array{directPermissions: array, teamPermissions: array, effectivePermissions: array, globalAdminUserIds: array<int, int>}
-     */
-    public function projectAccessMap(EloquentCollection $users, Project $project): array
-    {
-        $users->loadMissing('teams');
-        $directPermissions = $this->assignmentMap(User::class, $project);
-        $teamPermissions = $this->assignmentMap(Team::class, $project);
-        $globalPermissions = $this->assignmentMap(User::class);
-        $effectivePermissions = [];
-        $globalAdminUserIds = [];
-
-        foreach ($users as $user) {
-            $permissions = $directPermissions[$user->id] ?? [];
-
-            foreach ($user->teams as $team) {
-                $permissions = array_merge($permissions, $teamPermissions[$team->id] ?? []);
-            }
-
-            if (in_array(Permission::GlobalAdmin->value, $globalPermissions[$user->id] ?? [], true)) {
-                $permissions[] = Permission::GlobalAdmin->value;
-                $globalAdminUserIds[] = $user->id;
-            }
-
-            $expanded = $this->expandPermissions(array_map(Permission::from(...), $permissions));
-            $effectivePermissions[$user->id] = Permission::values(array_values(array_filter(
-                Permission::projectAssignable(),
-                fn (Permission $permission): bool => in_array($permission, $expanded, true),
-            )));
-        }
-
-        return compact('directPermissions', 'teamPermissions', 'effectivePermissions', 'globalAdminUserIds');
-    }
-
     /**
      * @return array<string, array<int, string>>
      */

app/Http/Controllers/ProjectController.php

@@ -182,22 +182,25 @@ class ProjectController extends Controller
             403,
         );
 
-        $users = User::query()->orderBy('name')->get();
-
         return Inertia::render('projects/Access', [
-            ...$this->permissionService->projectAccessMap($users, $project),
+            'directPermissions' => $this->permissionService->assignmentMap(User::class, $project),
             'permissionOptions' => PermissionOptionResource::collection(
                 $this->permissionService->permissionOptions(User::class, Project::class),
             )->resolve(),
             'project' => ProjectResource::make($project)->resolve(),
             'status' => session('status'),
+            'teamPermissions' => $this->permissionService->assignmentMap(Team::class, $project),
             'teams' => TeamResource::collection(
                 Team::query()
                     ->with('users')
                     ->orderBy('name')
                     ->get(),
             )->resolve(),
-            'users' => UserResource::collection($users)->resolve(),
+            'users' => UserResource::collection(
+                User::query()
+                    ->orderBy('name')
+                    ->get(),
+            )->resolve(),
         ]);
     }
 
@@ -217,9 +220,7 @@ class ProjectController extends Controller
 
         $this->permissionService->sync($user, $project, $permissions);
 
-        return ($this->permissionService->allows($request->user(), Permission::ProjectAdmin, $project)
-            ? to_route('projects.access', $project)
-            : to_route('projects.index'))
+        return to_route('projects.access', $project)
             ->with('status', "{$user->name} permissions were updated.");
     }
 
@@ -238,9 +239,7 @@ class ProjectController extends Controller
 
         $this->permissionService->sync($team, $project, $permissions);
 
-        return ($this->permissionService->allows($request->user(), Permission::ProjectAdmin, $project)
-            ? to_route('projects.access', $project)
-            : to_route('projects.index'))
+        return to_route('projects.access', $project)
             ->with('status', "{$team->name} permissions were updated.");
     }
 

boost.json

@@ -10,6 +10,8 @@
         "fortify-development",
         "laravel-best-practices",
         "mcp-development",
-        "wayfinder-development"
+        "wayfinder-development",
+        "inertia-vue-development",
+        "tailwindcss-development"
     ]
 }

composer.json

@@ -20,7 +20,6 @@
         "scalar/laravel": "^0.2.1"
     },
     "require-dev": {
-        "brianium/paratest": "^7.20",
         "fakerphp/faker": "^1.24",
         "laravel/boost": "^2.0",
         "laravel/pail": "^1.2.5",
@@ -68,27 +67,15 @@
         ],
         "ci:check": [
             "Composer\\Config::disableProcessTimeout",
-            "@ci:frontend",
-            "@ci:backend",
-            "@ci:test"
-        ],
-        "ci:frontend": [
             "pnpm audit --audit-level=high",
             "pnpm run lint:check",
             "pnpm run types:check",
-            "pnpm run build"
-        ],
-        "ci:backend": [
-            "@lint:check"
-        ],
-        "ci:test": [
-            "@php artisan config:clear --ansi",
-            "@php artisan test --parallel --processes=2"
+            "@test"
         ],
         "test": [
             "@php artisan config:clear --ansi",
             "@lint:check",
-            "@php artisan test --parallel --processes=2"
+            "@php artisan test"
         ],
         "post-autoload-dump": [
             "Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "4d18577105a240f2d8cce1c098398730",
+    "content-hash": "7d965721310f81816807d6b78c5f9654",
     "packages": [
         {
             "name": "aws/aws-crt-php",
@@ -7020,99 +7020,6 @@
         }
     ],
     "packages-dev": [
-        {
-            "name": "brianium/paratest",
-            "version": "v7.20.0",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/paratestphp/paratest.git",
-                "reference": "81c80677c9ec0ed4ef16b246167f11dec81a6e3d"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/paratestphp/paratest/zipball/81c80677c9ec0ed4ef16b246167f11dec81a6e3d",
-                "reference": "81c80677c9ec0ed4ef16b246167f11dec81a6e3d",
-                "shasum": ""
-            },
-            "require": {
-                "ext-dom": "*",
-                "ext-pcre": "*",
-                "ext-reflection": "*",
-                "ext-simplexml": "*",
-                "fidry/cpu-core-counter": "^1.3.0",
-                "jean85/pretty-package-versions": "^2.1.1",
-                "php": "~8.3.0 || ~8.4.0 || ~8.5.0",
-                "phpunit/php-code-coverage": "^12.5.3 || ^13.0.1",
-                "phpunit/php-file-iterator": "^6.0.1 || ^7",
-                "phpunit/php-timer": "^8 || ^9",
-                "phpunit/phpunit": "^12.5.14 || ^13.0.5",
-                "sebastian/environment": "^8.0.3 || ^9",
-                "symfony/console": "^7.4.7 || ^8.0.7",
-                "symfony/process": "^7.4.5 || ^8.0.5"
-            },
-            "require-dev": {
-                "doctrine/coding-standard": "^14.0.0",
-                "ext-pcntl": "*",
-                "ext-pcov": "*",
-                "ext-posix": "*",
-                "phpstan/phpstan": "^2.1.44",
-                "phpstan/phpstan-deprecation-rules": "^2.0.4",
-                "phpstan/phpstan-phpunit": "^2.0.16",
-                "phpstan/phpstan-strict-rules": "^2.0.10",
-                "symfony/filesystem": "^7.4.6 || ^8.0.6"
-            },
-            "bin": [
-                "bin/paratest",
-                "bin/paratest_for_phpstorm"
-            ],
-            "type": "library",
-            "autoload": {
-                "psr-4": {
-                    "ParaTest\\": [
-                        "src/"
-                    ]
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Brian Scaturro",
-                    "email": "scaturrob@gmail.com",
-                    "role": "Developer"
-                },
-                {
-                    "name": "Filippo Tessarotto",
-                    "email": "zoeslam@gmail.com",
-                    "role": "Developer"
-                }
-            ],
-            "description": "Parallel testing for PHP",
-            "homepage": "https://github.com/paratestphp/paratest",
-            "keywords": [
-                "concurrent",
-                "parallel",
-                "phpunit",
-                "testing"
-            ],
-            "support": {
-                "issues": "https://github.com/paratestphp/paratest/issues",
-                "source": "https://github.com/paratestphp/paratest/tree/v7.20.0"
-            },
-            "funding": [
-                {
-                    "url": "https://github.com/sponsors/Slamdunk",
-                    "type": "github"
-                },
-                {
-                    "url": "https://paypal.me/filippotessarotto",
-                    "type": "paypal"
-                }
-            ],
-            "time": "2026-03-29T15:46:14+00:00"
-        },
         {
             "name": "fakerphp/faker",
             "version": "v1.24.1",
@@ -7176,67 +7083,6 @@
             },
             "time": "2024-11-21T13:46:39+00:00"
         },
-        {
-            "name": "fidry/cpu-core-counter",
-            "version": "1.3.0",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/theofidry/cpu-core-counter.git",
-                "reference": "db9508f7b1474469d9d3c53b86f817e344732678"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/theofidry/cpu-core-counter/zipball/db9508f7b1474469d9d3c53b86f817e344732678",
-                "reference": "db9508f7b1474469d9d3c53b86f817e344732678",
-                "shasum": ""
-            },
-            "require": {
-                "php": "^7.2 || ^8.0"
-            },
-            "require-dev": {
-                "fidry/makefile": "^0.2.0",
-                "fidry/php-cs-fixer-config": "^1.1.2",
-                "phpstan/extension-installer": "^1.2.0",
-                "phpstan/phpstan": "^2.0",
-                "phpstan/phpstan-deprecation-rules": "^2.0.0",
-                "phpstan/phpstan-phpunit": "^2.0",
-                "phpstan/phpstan-strict-rules": "^2.0",
-                "phpunit/phpunit": "^8.5.31 || ^9.5.26",
-                "webmozarts/strict-phpunit": "^7.5"
-            },
-            "type": "library",
-            "autoload": {
-                "psr-4": {
-                    "Fidry\\CpuCoreCounter\\": "src/"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Théo FIDRY",
-                    "email": "theo.fidry@gmail.com"
-                }
-            ],
-            "description": "Tiny utility to get the number of CPU cores.",
-            "keywords": [
-                "CPU",
-                "core"
-            ],
-            "support": {
-                "issues": "https://github.com/theofidry/cpu-core-counter/issues",
-                "source": "https://github.com/theofidry/cpu-core-counter/tree/1.3.0"
-            },
-            "funding": [
-                {
-                    "url": "https://github.com/theofidry",
-                    "type": "github"
-                }
-            ],
-            "time": "2025-08-14T07:29:31+00:00"
-        },
         {
             "name": "filp/whoops",
             "version": "2.18.4",
@@ -7359,66 +7205,6 @@
             },
             "time": "2025-04-30T06:54:44+00:00"
         },
-        {
-            "name": "jean85/pretty-package-versions",
-            "version": "2.1.1",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/Jean85/pretty-package-versions.git",
-                "reference": "4d7aa5dab42e2a76d99559706022885de0e18e1a"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/Jean85/pretty-package-versions/zipball/4d7aa5dab42e2a76d99559706022885de0e18e1a",
-                "reference": "4d7aa5dab42e2a76d99559706022885de0e18e1a",
-                "shasum": ""
-            },
-            "require": {
-                "composer-runtime-api": "^2.1.0",
-                "php": "^7.4|^8.0"
-            },
-            "require-dev": {
-                "friendsofphp/php-cs-fixer": "^3.2",
-                "jean85/composer-provided-replaced-stub-package": "^1.0",
-                "phpstan/phpstan": "^2.0",
-                "phpunit/phpunit": "^7.5|^8.5|^9.6",
-                "rector/rector": "^2.0",
-                "vimeo/psalm": "^4.3 || ^5.0"
-            },
-            "type": "library",
-            "extra": {
-                "branch-alias": {
-                    "dev-master": "1.x-dev"
-                }
-            },
-            "autoload": {
-                "psr-4": {
-                    "Jean85\\": "src/"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Alessandro Lai",
-                    "email": "alessandro.lai85@gmail.com"
-                }
-            ],
-            "description": "A library to get pretty versions strings of installed dependencies",
-            "keywords": [
-                "composer",
-                "package",
-                "release",
-                "versions"
-            ],
-            "support": {
-                "issues": "https://github.com/Jean85/pretty-package-versions/issues",
-                "source": "https://github.com/Jean85/pretty-package-versions/tree/2.1.1"
-            },
-            "time": "2025-03-19T14:43:43+00:00"
-        },
         {
             "name": "laravel/boost",
             "version": "v2.4.3",

native/macos-ci.mjs

@@ -1,203 +0,0 @@
-import { spawnSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import {
-    appendFileSync,
-    existsSync,
-    mkdirSync,
-    mkdtempSync,
-    readFileSync,
-    renameSync,
-    rmSync,
-    writeFileSync,
-} from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-import process from 'node:process';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import {
-    appleTeamId,
-    bundleIdentifier,
-    verifySignedMacosApp,
-} from './release-macos.mjs';
-
-const nativeDirectory = dirname(fileURLToPath(import.meta.url));
-
-export function releaseMetadata(
-    env = process.env,
-    directory = nativeDirectory,
-) {
-    const config = JSON.parse(
-        readFileSync(join(directory, 'src-tauri/tauri.conf.json'), 'utf8'),
-    );
-    const packageVersion = JSON.parse(
-        readFileSync(join(directory, 'package.json'), 'utf8'),
-    ).version;
-    const cargoVersion = readFileSync(
-        join(directory, 'src-tauri/Cargo.toml'),
-        'utf8',
-    )
-        .match(/\[package\]([\s\S]*?)(?:\n\[|$)/)?.[1]
-        .match(/^version\s*=\s*"([^"]+)"/m)?.[1];
-    if (
-        !/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(config.version) ||
-        config.version !== packageVersion ||
-        config.version !== cargoVersion
-    ) {
-        throw new Error(
-            'Tauri, package.json and Cargo.toml must have the same stable release version.',
-        );
-    }
-    if (env.RELEASE_TAG !== `macos-v${config.version}`) {
-        throw new Error(
-            'Release tag must be macos-vMAJOR.MINOR.PATCH and match the app version.',
-        );
-    }
-    if (
-        config.identifier !== bundleIdentifier ||
-        config.productName !== 'KanbanGit'
-    ) {
-        throw new Error(
-            'The macOS product name and bundle identifier must stay unchanged.',
-        );
-    }
-    const target = env.MACOS_RELEASE_TARGET || 'aarch64-apple-darwin';
-    const arch = {
-        'aarch64-apple-darwin': 'arm64',
-        'x86_64-apple-darwin': 'x86_64',
-    }[target];
-    if (!arch) {
-        throw new Error(
-            'MACOS_RELEASE_TARGET must select Apple Silicon or Intel macOS.',
-        );
-    }
-    const identity = env.APPLE_SIGNING_IDENTITY;
-    if (
-        !identity?.startsWith('Developer ID Application: ') ||
-        !identity.endsWith(` (${appleTeamId})`) ||
-        /[\r\n"]/.test(identity)
-    ) {
-        throw new Error(
-            `A Developer ID Application identity for ${appleTeamId} is required.`,
-        );
-    }
-    return {
-        version: config.version,
-        target,
-        arch,
-        filename: `KanbanGit-${config.version}-${target}.zip`,
-    };
-}
-
-export function execute(command, args) {
-    const result = spawnSync(command, args, {
-        encoding: 'utf8',
-        maxBuffer: 16 * 1024 * 1024,
-    });
-    if (result.error || result.status !== 0) {
-        throw new Error(
-            `${command} failed (exit ${result.status ?? 'unknown'}). ${result.stderr || ''}`,
-        );
-    }
-    return result.stdout?.trim() || result.stderr?.trim() || '';
-}
-
-export function verifyNotarizedApp(app, metadata, run = execute) {
-    verifySignedMacosApp({
-        app,
-        version: metadata.version,
-        step: (_label, command, args) => run(command, args),
-    });
-    const arch = run('lipo', [
-        '-archs',
-        join(app, 'Contents/MacOS/kanbangit-native'),
-    ]).trim();
-    if (arch !== metadata.arch) {
-        throw new Error(
-            'The app architecture does not match its download path.',
-        );
-    }
-    run('xcrun', ['stapler', 'validate', app]);
-    run('spctl', ['--assess', '--type', 'execute', '--verbose=2', app]);
-}
-
-export function packageNotarizedApp({
-    env = process.env,
-    directory = nativeDirectory,
-    run = execute,
-} = {}) {
-    const metadata = releaseMetadata(env, directory);
-    const root = join(directory, 'src-tauri/target');
-    const app = join(
-        root,
-        metadata.target,
-        'release/bundle/macos/KanbanGit.app',
-    );
-    verifyNotarizedApp(app, metadata, run);
-    const releaseRoot = join(root, 'macos-release');
-    const destination = join(
-        releaseRoot,
-        `${metadata.version}-${metadata.target}`,
-    );
-    if (existsSync(destination)) {
-        throw new Error(
-            'Release output already exists; start from a clean checkout.',
-        );
-    }
-    mkdirSync(releaseRoot, { recursive: true });
-    const staging = mkdtempSync(join(releaseRoot, '.pending-'));
-    try {
-        const archive = join(staging, metadata.filename);
-        run('ditto', [
-            '-c',
-            '-k',
-            '--sequesterRsrc',
-            '--keepParent',
-            app,
-            archive,
-        ]);
-        const checksum = createHash('sha256')
-            .update(readFileSync(archive))
-            .digest('hex');
-        writeFileSync(
-            `${archive}.sha256`,
-            `${checksum}  ${metadata.filename}\n`,
-        );
-        const extracted = join(staging, 'extracted');
-        run('ditto', ['-x', '-k', archive, extracted]);
-        verifyNotarizedApp(join(extracted, 'KanbanGit.app'), metadata, run);
-        rmSync(extracted, { recursive: true, force: true });
-        renameSync(staging, destination);
-        return { ...metadata, directory: destination, checksum };
-    } finally {
-        rmSync(staging, { recursive: true, force: true });
-    }
-}
-
-if (
-    process.argv[1] &&
-    import.meta.url === pathToFileURL(resolve(process.argv[1])).href
-) {
-    try {
-        let output;
-        if (process.argv[2] === 'metadata') {
-            output = releaseMetadata();
-        } else if (process.argv[2] === 'package') {
-            output = packageNotarizedApp();
-        } else {
-            throw new Error(
-                'Use metadata or package. Building and notarizing are handled by tauri-action.',
-            );
-        }
-        if (process.env.GITHUB_OUTPUT) {
-            appendFileSync(
-                process.env.GITHUB_OUTPUT,
-                Object.entries(output)
-                    .map(([key, value]) => `${key}=${value}\n`)
-                    .join(''),
-            );
-        }
-        console.log(JSON.stringify(output));
-    } catch (error) {
-        console.error(error.message);
-        process.exitCode = 1;
-    }
-}

native/package.json

@@ -1,17 +1,14 @@
 {
     "name": "kanbangit-native",
-    "version": "0.1.1",
+    "version": "0.1.0",
     "private": true,
     "type": "module",
     "scripts": {
         "dev": "tauri dev",
         "build": "tauri build",
         "build:macos": "tauri build --debug --bundles app",
-        "release:macos": "node release-macos.mjs",
         "test": "node --test tests/*.test.js && cargo test --manifest-path src-tauri/Cargo.toml --locked",
         "check": "cargo fmt --manifest-path src-tauri/Cargo.toml --check && cargo clippy --manifest-path src-tauri/Cargo.toml --locked --all-targets --all-features -- -D warnings",
-        "dev:android": "tauri android dev",
-        "build:android": "tauri android build --debug --apk --target aarch64",
         "smoke:macos": "cargo test --manifest-path src-tauri/Cargo.toml --locked --features smoke-test,custom-protocol --test macos_smoke",
         "dev:ios": "tauri ios dev",
         "build:ios:simulator": "rm -rf src-tauri/gen/apple/build/arm64-sim/KanbanGit.app && tauri ios build --debug --target aarch64-sim --no-sign --ci",

native/publish-macos.mjs

@@ -1,266 +0,0 @@
-import { Buffer } from 'node:buffer';
-import { createHash } from 'node:crypto';
-import {
-    appendFileSync,
-    mkdtempSync,
-    readFileSync,
-    rmSync,
-    writeFileSync,
-} from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join, resolve } from 'node:path';
-import process from 'node:process';
-import { setTimeout } from 'node:timers/promises';
-import { pathToFileURL } from 'node:url';
-import { execute, releaseMetadata } from './macos-ci.mjs';
-
-export function storageConfiguration(env = process.env) {
-    const region = env.S3_REGION;
-    const bucket = env.S3_BUCKET;
-    const prefix = env.S3_PREFIX || 'releases/macos';
-    if (!['nbg1', 'fsn1', 'hel1'].includes(region)) {
-        throw new Error('S3_REGION must be nbg1, fsn1 or hel1.');
-    }
-    if (!/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/.test(bucket || '')) {
-        throw new Error('Set S3_BUCKET to the Hetzner release bucket name.');
-    }
-    if (!/^[a-zA-Z0-9_-]+(?:\/[a-zA-Z0-9_-]+)*$/.test(prefix)) {
-        throw new Error(
-            'S3_PREFIX must contain plain path segments without leading or trailing slashes.',
-        );
-    }
-    const endpoint = `https://${region}.your-objectstorage.com`;
-    const publicBase =
-        env.S3_PUBLIC_BASE_URL ||
-        `https://${bucket}.${region}.your-objectstorage.com`;
-    const url = new URL(publicBase);
-    if (
-        url.protocol !== 'https:' ||
-        url.username ||
-        url.password ||
-        url.search ||
-        url.hash ||
-        /[\s]/.test(publicBase)
-    ) {
-        throw new Error(
-            'S3_PUBLIC_BASE_URL must be a public HTTPS URL without credentials or query parameters.',
-        );
-    }
-    return {
-        region,
-        bucket,
-        prefix,
-        endpoint,
-        publicBase: publicBase.replace(/\/$/, ''),
-    };
-}
-
-const sha256 = (data) => createHash('sha256').update(data).digest('hex');
-
-export async function publishMacos({
-    env = process.env,
-    directory,
-    metadata,
-    run = execute,
-    fetchPublic = fetch,
-    wait = setTimeout,
-} = {}) {
-    const storage = storageConfiguration(env);
-    if (!env.AWS_ACCESS_KEY_ID || !env.AWS_SECRET_ACCESS_KEY) {
-        throw new Error(
-            'Set the dedicated S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY release secrets.',
-        );
-    }
-    const archive = readFileSync(join(directory, metadata.filename));
-    const checksum = sha256(archive);
-    const checksumFile = readFileSync(
-        join(directory, `${metadata.filename}.sha256`),
-    );
-    if (checksumFile.toString() !== `${checksum}  ${metadata.filename}\n`) {
-        throw new Error('Release archive does not match its SHA-256 file.');
-    }
-    const common = [
-        '--endpoint-url',
-        storage.endpoint,
-        '--region',
-        storage.region,
-        '--no-cli-pager',
-        's3api',
-    ];
-    function s3(operation, args) {
-        return run('aws', [
-            ...common,
-            operation,
-            '--bucket',
-            storage.bucket,
-            ...args,
-        ]);
-    }
-    const versioningOutput = s3('get-bucket-versioning', [
-        '--output',
-        'json',
-    ]).trim();
-    let versioning;
-    try {
-        // AWS CLI prints nothing for a successful empty VersioningConfiguration.
-        versioning = JSON.parse(versioningOutput || '{}');
-    } catch {
-        throw new Error('Invalid JSON from S3 bucket versioning check.');
-    }
-    if (
-        !versioning ||
-        typeof versioning !== 'object' ||
-        Array.isArray(versioning)
-    ) {
-        throw new Error(
-            'Invalid S3 bucket versioning response: expected an object.',
-        );
-    }
-    if (versioning.Status) {
-        throw new Error(
-            'Use an unversioned release bucket: Hetzner does not support conditional writes on versioned buckets.',
-        );
-    }
-    const staging = mkdtempSync(join(tmpdir(), 'kanbangit-s3-'));
-    const keyPrefix = `${storage.prefix}/${metadata.target}/${metadata.version}`;
-    const publicPrefix = `${storage.publicBase}/${keyPrefix}`;
-    async function verifyPublic(name, contents) {
-        for (let attempt = 1; attempt <= 5; attempt++) {
-            let response;
-            try {
-                response = await fetchPublic(`${publicPrefix}/${name}`, {
-                    redirect: 'error',
-                    signal: AbortSignal.timeout(60000),
-                });
-            } catch (error) {
-                if (attempt === 5) {
-                    throw new Error(
-                        `Public download request failed for ${name}: ${error.message}`,
-                    );
-                }
-                await wait(2000);
-                continue;
-            }
-            if (response.ok) {
-                if (
-                    sha256(Buffer.from(await response.arrayBuffer())) !==
-                    sha256(contents)
-                ) {
-                    throw new Error(
-                        `Public download verification failed for ${name}: SHA-256 mismatch.`,
-                    );
-                }
-                return;
-            }
-            await response.body?.cancel();
-            const retryable = [403, 404, 408, 429, 500, 502, 503, 504].includes(
-                response.status,
-            );
-            if (!retryable || attempt === 5) {
-                throw new Error(
-                    `Public download verification failed for ${name}: HTTP ${response.status}.`,
-                );
-            }
-            await wait(2000);
-        }
-    }
-    function putImmutable(name, contents, contentType) {
-        const file = join(staging, name);
-        writeFileSync(file, contents);
-        try {
-            s3('put-object', [
-                '--key',
-                `${keyPrefix}/${name}`,
-                '--body',
-                file,
-                '--if-none-match',
-                '*',
-                '--content-type',
-                contentType,
-                '--cache-control',
-                'public, max-age=31536000, immutable',
-                '--content-md5',
-                createHash('md5').update(contents).digest('base64'),
-                '--metadata',
-                `sha256=${sha256(contents)}`,
-            ]);
-        } catch (error) {
-            if (!/\(PreconditionFailed\)|\(412\)/.test(error.message)) {
-                throw error;
-            }
-            const existing = join(staging, `existing-${name}`);
-            s3('get-object', ['--key', `${keyPrefix}/${name}`, existing]);
-            if (sha256(readFileSync(existing)) !== sha256(contents)) {
-                throw new Error(
-                    `Published ${name} differs; bump the app version. Existing objects were not overwritten.`,
-                );
-            }
-        }
-    }
-    try {
-        const files = [
-            [metadata.filename, archive, 'application/zip'],
-            [
-                `${metadata.filename}.sha256`,
-                checksumFile,
-                'text/plain; charset=utf-8',
-            ],
-        ];
-        for (const [name, contents, type] of files) {
-            putImmutable(name, contents, type);
-            await verifyPublic(name, contents);
-        }
-        // This completion record is written only after both public downloads match.
-        const manifest = Buffer.from(
-            JSON.stringify(
-                {
-                    version: metadata.version,
-                    target: metadata.target,
-                    url: `${publicPrefix}/${metadata.filename}`,
-                    sha256: checksum,
-                    checksumUrl: `${publicPrefix}/${metadata.filename}.sha256`,
-                },
-                null,
-                2,
-            ) + '\n',
-        );
-        putImmutable('release.json', manifest, 'application/json');
-        await verifyPublic('release.json', manifest);
-        return `${publicPrefix}/${metadata.filename}`;
-    } finally {
-        rmSync(staging, { recursive: true, force: true });
-    }
-}
-
-if (
-    process.argv[1] &&
-    import.meta.url === pathToFileURL(resolve(process.argv[1])).href
-) {
-    try {
-        if (process.argv[2] === 'config') {
-            console.log(JSON.stringify(storageConfiguration()));
-        } else if (
-            process.argv[2] === 'upload' &&
-            process.env.RELEASE_DIRECTORY
-        ) {
-            const url = await publishMacos({
-                directory: process.env.RELEASE_DIRECTORY,
-                metadata: releaseMetadata(),
-            });
-            console.log(`Verified public release: ${url}`);
-            if (process.env.GITHUB_STEP_SUMMARY) {
-                appendFileSync(
-                    process.env.GITHUB_STEP_SUMMARY,
-                    `Download: [KanbanGit](${url})\n`,
-                );
-            }
-        } else {
-            throw new Error(
-                'Use config or upload; upload requires RELEASE_DIRECTORY.',
-            );
-        }
-    } catch (error) {
-        console.error(error.message);
-        process.exitCode = 1;
-    }
-}

native/release-macos.mjs

@@ -1,450 +0,0 @@
-import { spawnSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import {
-    existsSync,
-    mkdirSync,
-    mkdtempSync,
-    readFileSync,
-    renameSync,
-    rmSync,
-    writeFileSync,
-} from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-import process from 'node:process';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { parseArgs } from 'node:util';
-
-export const appleTeamId = 'ZZX2KZGTHU';
-export const bundleIdentifier = 'de.kanbangit.desktop';
-const submissionIdPattern =
-    /^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/i;
-
-function execute(command, args, options) {
-    const result = spawnSync(command, args, {
-        cwd: options.cwd,
-        env: options.env,
-        encoding: 'utf8',
-        maxBuffer: 16 * 1024 * 1024,
-        stdio: options.inherit ? 'inherit' : 'pipe',
-    });
-
-    if (result.error || result.status !== 0) {
-        throw new Error(
-            `${options.step} failed${result.error ? `: ${result.error.message}` : ` (exit ${result.status ?? result.signal})`}.`,
-        );
-    }
-
-    return result.stdout?.trim() || result.stderr?.trim() || '';
-}
-
-export function verifySignedMacosApp({ app, version, step }) {
-    step('Verifying Developer ID signature and team', 'codesign', [
-        '--verify',
-        '--deep',
-        '--strict',
-        '--verbose=2',
-        '-R',
-        `=anchor apple generic and identifier "${bundleIdentifier}" and certificate leaf[subject.OU] = "${appleTeamId}" and certificate leaf[field.1.2.840.113635.100.6.1.13] exists`,
-        app,
-    ]);
-    const signature = step('Checking hardened runtime', 'codesign', [
-        '--display',
-        '--verbose=4',
-        app,
-    ]);
-
-    if (!/^CodeDirectory .*flags=.*\bruntime\b/m.test(signature)) {
-        throw new Error(
-            'The release signature does not enable Hardened Runtime.',
-        );
-    }
-
-    const cdhash = signature.match(/^CDHash=([\da-f]+)$/m)?.[1];
-
-    if (!cdhash) {
-        throw new Error(
-            'The signed app has no CodeDirectory hash to match against Apple notarization.',
-        );
-    }
-
-    const bundledVersion = step('Checking bundled release version', 'plutil', [
-        '-extract',
-        'CFBundleShortVersionString',
-        'raw',
-        '-o',
-        '-',
-        join(app, 'Contents/Info.plist'),
-    ]);
-
-    if (bundledVersion.trim() !== version) {
-        throw new Error(
-            'The built app version does not match the release version.',
-        );
-    }
-
-    return cdhash;
-}
-
-export function releaseMacos({
-    env = process.env,
-    platform = process.platform,
-    arch = process.arch,
-    directory = dirname(fileURLToPath(import.meta.url)),
-    run = execute,
-    log = console.log,
-    resumeSubmissionId = null,
-} = {}) {
-    if (platform !== 'darwin') {
-        throw new Error('macOS releases require a Mac with Xcode installed.');
-    }
-
-    if (
-        resumeSubmissionId !== null &&
-        !submissionIdPattern.test(resumeSubmissionId)
-    ) {
-        throw new Error('--resume requires the Apple submission UUID.');
-    }
-
-    const identity = env.APPLE_SIGNING_IDENTITY?.trim();
-    const profile = env.APPLE_NOTARY_KEYCHAIN_PROFILE?.trim();
-
-    if (
-        !identity?.startsWith('Developer ID Application: ') ||
-        !identity.endsWith(` (${appleTeamId})`) ||
-        /[\r\n"]/.test(identity)
-    ) {
-        throw new Error(
-            `Set APPLE_SIGNING_IDENTITY to the full Developer ID Application certificate name for team ${appleTeamId}.`,
-        );
-    }
-
-    if (env.APPLE_TEAM_ID && env.APPLE_TEAM_ID !== appleTeamId) {
-        throw new Error(`APPLE_TEAM_ID must be ${appleTeamId}.`);
-    }
-
-    if (!profile) {
-        throw new Error(
-            'Set APPLE_NOTARY_KEYCHAIN_PROFILE to a notarytool profile created with store-credentials for the new Apple team.',
-        );
-    }
-
-    const target =
-        env.MACOS_RELEASE_TARGET ||
-        { arm64: 'aarch64-apple-darwin', x64: 'x86_64-apple-darwin' }[arch];
-
-    if (!['aarch64-apple-darwin', 'x86_64-apple-darwin'].includes(target)) {
-        throw new Error(
-            'MACOS_RELEASE_TARGET must be aarch64-apple-darwin or x86_64-apple-darwin.',
-        );
-    }
-
-    const config = JSON.parse(
-        readFileSync(join(directory, 'src-tauri/tauri.conf.json'), 'utf8'),
-    );
-
-    if (
-        config.identifier !== bundleIdentifier ||
-        config.productName !== 'KanbanGit'
-    ) {
-        throw new Error(
-            'The macOS release must keep the KanbanGit product name and bundle identifier.',
-        );
-    }
-
-    if (!/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(config.version)) {
-        throw new Error(
-            'The macOS release version must be a stable MAJOR.MINOR.PATCH version.',
-        );
-    }
-
-    const targetDirectory = join(directory, 'src-tauri/target');
-    const releaseDirectory = join(targetDirectory, 'macos-release');
-    const destination = join(releaseDirectory, `${config.version}-${target}`);
-
-    if (existsSync(destination)) {
-        throw new Error(
-            `Release output already exists: ${destination}. Move it aside or use a new version.`,
-        );
-    }
-
-    // Notarization is handled below with the explicit keychain profile, never ambient Apple credentials.
-    const buildEnv = Object.fromEntries(
-        Object.entries(env).filter(
-            ([key]) => !key.startsWith('APPLE_') && key !== 'TAURI_CONFIG',
-        ),
-    );
-    buildEnv.APPLE_SIGNING_IDENTITY = identity;
-    buildEnv.CARGO_TARGET_DIR = targetDirectory;
-
-    function step(label, command, args, inherit = false) {
-        log(label);
-
-        return run(command, args, {
-            cwd: directory,
-            env: buildEnv,
-            step: label,
-            inherit,
-        });
-    }
-
-    const identities = step('Checking signing certificate', 'security', [
-        'find-identity',
-        '-v',
-        '-p',
-        'codesigning',
-    ]);
-
-    if (
-        !identities
-            .split('\n')
-            .some((line) => line.trim().endsWith(`"${identity}"`))
-    ) {
-        throw new Error(
-            `Install the Developer ID Application certificate for ${appleTeamId}, including its private key, in an unlocked keychain.`,
-        );
-    }
-
-    const notaryCredentials = ['--keychain-profile', profile];
-
-    if (env.APPLE_NOTARY_KEYCHAIN?.trim()) {
-        notaryCredentials.push('--keychain', env.APPLE_NOTARY_KEYCHAIN.trim());
-    }
-
-    step(
-        'Checking notarization access (check the keychain profile if this fails)',
-        'xcrun',
-        [
-            'notarytool',
-            'history',
-            ...notaryCredentials,
-            '--output-format',
-            'json',
-        ],
-    );
-
-    const app = join(
-        targetDirectory,
-        target,
-        'release/bundle/macos/KanbanGit.app',
-    );
-    if (!resumeSubmissionId) {
-        step(
-            'Building signed macOS release',
-            'pnpm',
-            [
-                'exec',
-                'tauri',
-                'build',
-                '--ci',
-                '--target',
-                target,
-                '--bundles',
-                'app',
-                '--config',
-                JSON.stringify({
-                    bundle: {
-                        createUpdaterArtifacts: false,
-                        macOS: {
-                            signingIdentity: identity,
-                            hardenedRuntime: true,
-                        },
-                    },
-                }),
-                '--',
-                '--locked',
-            ],
-            true,
-        );
-    }
-
-    if (!existsSync(app)) {
-        throw new Error('The release build did not produce KanbanGit.app.');
-    }
-
-    const cdhash = verifySignedMacosApp({ app, version: config.version, step });
-
-    mkdirSync(releaseDirectory, { recursive: true });
-    const staging = mkdtempSync(join(releaseDirectory, '.pending-'));
-
-    try {
-        const submission = join(staging, 'notarization.zip');
-        let submissionId = resumeSubmissionId;
-
-        if (!submissionId) {
-            step('Preparing notarization archive', 'ditto', [
-                '-c',
-                '-k',
-                '--sequesterRsrc',
-                '--keepParent',
-                app,
-                submission,
-            ]);
-            const submitted = JSON.parse(
-                step('Submitting to Apple', 'xcrun', [
-                    'notarytool',
-                    'submit',
-                    submission,
-                    ...notaryCredentials,
-                    '--no-wait',
-                    '--output-format',
-                    'json',
-                ]),
-            );
-            submissionId = submitted.id;
-
-            if (!submissionIdPattern.test(submissionId ?? '')) {
-                throw new Error(
-                    'Apple did not return a valid submission UUID. Check notarytool history before retrying.',
-                );
-            }
-        }
-
-        const resumeHint = `Resume without rebuilding or uploading: pnpm --dir native release:macos --resume ${submissionId}`;
-        log(`Apple submission: ${submissionId}. ${resumeHint}`);
-        writeFileSync(
-            join(
-                targetDirectory,
-                `notarization-${submissionId}.submission.json`,
-            ),
-            JSON.stringify(
-                {
-                    submissionId,
-                    version: config.version,
-                    target,
-                    cdhash,
-                },
-                null,
-                2,
-            ) + '\n',
-        );
-
-        let result;
-
-        try {
-            result = JSON.parse(
-                step('Waiting for Apple notarization', 'xcrun', [
-                    'notarytool',
-                    'wait',
-                    submissionId,
-                    ...notaryCredentials,
-                    '--timeout',
-                    '30m',
-                    '--output-format',
-                    'json',
-                ]),
-            );
-        } catch (error) {
-            throw new Error(
-                `${error.message} Apple may still be processing this submission. ${resumeHint}`,
-            );
-        }
-
-        if (result.status !== 'Accepted') {
-            throw new Error(
-                `Apple did not accept the release (status: ${result.status ?? 'unknown'}, submission: ${submissionId}). Inspect it with notarytool log. ${resumeHint}`,
-            );
-        }
-
-        const notaryLog = JSON.parse(
-            step('Checking Apple notarization log', 'xcrun', [
-                'notarytool',
-                'log',
-                submissionId,
-                ...notaryCredentials,
-            ]),
-        );
-        writeFileSync(
-            join(targetDirectory, `notarization-${submissionId}.log.json`),
-            JSON.stringify(notaryLog, null, 2) + '\n',
-        );
-        const expectedArch =
-            target === 'aarch64-apple-darwin' ? 'arm64' : 'x86_64';
-
-        if (
-            notaryLog.jobId !== submissionId ||
-            notaryLog.status !== 'Accepted' ||
-            !notaryLog.ticketContents?.some(
-                (ticket) =>
-                    ticket.path.endsWith('/KanbanGit.app') &&
-                    ticket.cdhash === cdhash &&
-                    ticket.arch === expectedArch,
-            )
-        ) {
-            throw new Error(
-                'The accepted Apple submission does not match this signed app and architecture. Restore the submitted app or create a new release.',
-            );
-        }
-
-        if (notaryLog.issues?.length) {
-            throw new Error(
-                `Apple reported notarization issues. Review src-tauri/target/notarization-${submissionId}.log.json before distribution.`,
-            );
-        }
-
-        step('Stapling notarization ticket', 'xcrun', [
-            'stapler',
-            'staple',
-            app,
-        ]);
-        step('Validating notarization ticket', 'xcrun', [
-            'stapler',
-            'validate',
-            app,
-        ]);
-        step('Verifying final app signature', 'codesign', [
-            '--verify',
-            '--deep',
-            '--strict',
-            app,
-        ]);
-        step('Checking Gatekeeper acceptance', 'spctl', [
-            '--assess',
-            '--type',
-            'execute',
-            '--verbose=2',
-            app,
-        ]);
-
-        const name = `KanbanGit-${config.version}-${target}.zip`;
-        const archive = join(staging, name);
-        step('Packaging notarized download', 'ditto', [
-            '-c',
-            '-k',
-            '--sequesterRsrc',
-            '--keepParent',
-            app,
-            archive,
-        ]);
-        const checksum = createHash('sha256')
-            .update(readFileSync(archive))
-            .digest('hex');
-        writeFileSync(`${archive}.sha256`, `${checksum}  ${name}\n`);
-        rmSync(submission, { force: true });
-        renameSync(staging, destination);
-        log(`Verified release: ${join(destination, name)}`);
-
-        return {
-            archive: join(destination, name),
-            checksum,
-            version: config.version,
-            target,
-        };
-    } finally {
-        rmSync(staging, { recursive: true, force: true });
-    }
-}
-
-if (
-    process.argv[1] &&
-    import.meta.url === pathToFileURL(resolve(process.argv[1])).href
-) {
-    try {
-        const { values } = parseArgs({
-            options: { resume: { type: 'string' } },
-        });
-        releaseMacos({ resumeSubmissionId: values.resume ?? null });
-    } catch (error) {
-        console.error(`macOS release failed: ${error.message}`);
-        process.exitCode = 1;
-    }
-}

native/src-tauri/Cargo.lock

@@ -1673,7 +1673,7 @@ dependencies = [
 
 [[package]]
 name = "kanbangit-native"
-version = "0.1.1"
+version = "0.1.0"
 dependencies = [
  "serde_json",
  "tauri",

native/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "kanbangit-native"
-version = "0.1.1"
+version = "0.1.0"
 description = "KanbanGit native application"
 edition = "2021"
 publish = false

native/src-tauri/gen/android/.editorconfig

@@ -1,12 +0,0 @@
-# EditorConfig is awesome: https://EditorConfig.org
-
-# top-most EditorConfig file
-root = true
-
-[*]
-indent_style = space
-indent_size = 2
-end_of_line = lf
-charset = utf-8
-trim_trailing_whitespace = false
-insert_final_newline = false

native/src-tauri/gen/android/.gitignore

@@ -1,26 +0,0 @@
-*.iml
-.gradle
-/local.properties
-/.idea/caches
-/.idea/libraries
-/.idea/modules.xml
-/.idea/workspace.xml
-/.idea/navEditor.xml
-/.idea/assetWizardSettings.xml
-.DS_Store
-build
-/captures
-.externalNativeBuild
-.cxx
-local.properties
-key.properties
-keystore.properties
-
-/.tauri
-/tauri.settings.gradle
-/app/tauri.build.gradle.kts
-/app/src/main/jniLibs
-/app/src/main/java/de/kanbangit/desktop/generated
-
-.kotlin
-/app/tauri.properties

native/src-tauri/gen/android/app/.gitignore

@@ -1,6 +0,0 @@
-/src/main/**/generated
-/src/main/jniLibs/**/*.so
-/src/main/assets/tauri.conf.json
-/tauri.build.gradle.kts
-/proguard-tauri.pro
-/tauri.properties

native/src-tauri/gen/android/app/build.gradle.kts

@@ -1,76 +0,0 @@
-import java.util.Properties
-
-plugins {
-    id("com.android.application")
-    id("org.jetbrains.kotlin.android")
-    id("rust")
-}
-
-val tauriProperties = Properties().apply {
-    val propFile = file("tauri.properties")
-    if (propFile.exists()) {
-        propFile.inputStream().use { load(it) }
-    }
-}
-
-android {
-    compileSdk = 36
-    buildToolsVersion = "36.0.0"
-    namespace = "de.kanbangit.desktop"
-    defaultConfig {
-        manifestPlaceholders["usesCleartextTraffic"] = "false"
-        applicationId = "de.kanbangit.desktop"
-        minSdk = 24
-        targetSdk = 36
-        testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
-        // Tauri exits the process when its last activity is destroyed; report results first.
-        testInstrumentationRunnerArguments["waitForActivitiesToComplete"] = "false"
-        versionCode = tauriProperties.getProperty("tauri.android.versionCode", "1").toInt()
-        versionName = tauriProperties.getProperty("tauri.android.versionName", "1.0")
-    }
-    buildTypes {
-        getByName("debug") {
-            manifestPlaceholders["usesCleartextTraffic"] = "false"
-            isDebuggable = true
-            isJniDebuggable = true
-            isMinifyEnabled = false
-            packaging {
-                jniLibs.keepDebugSymbols.add("*/arm64-v8a/*.so")
-                jniLibs.keepDebugSymbols.add("*/armeabi-v7a/*.so")
-                jniLibs.keepDebugSymbols.add("*/x86/*.so")
-                jniLibs.keepDebugSymbols.add("*/x86_64/*.so")
-            }
-        }
-        getByName("release") {
-            isMinifyEnabled = true
-            proguardFiles(
-                *fileTree(".") { include("**/*.pro") }
-                    .plus(getDefaultProguardFile("proguard-android-optimize.txt"))
-                    .toList().toTypedArray()
-            )
-        }
-    }
-    kotlinOptions {
-        jvmTarget = "1.8"
-    }
-    buildFeatures {
-        buildConfig = true
-    }
-}
-
-rust {
-    rootDirRel = "../../../"
-}
-
-dependencies {
-    implementation("androidx.webkit:webkit:1.14.0")
-    implementation("androidx.appcompat:appcompat:1.7.1")
-    implementation("androidx.activity:activity-ktx:1.10.1")
-    implementation("com.google.android.material:material:1.12.0")
-    implementation("androidx.lifecycle:lifecycle-process:2.10.0")
-    testImplementation("junit:junit:4.13.2")
-    androidTestImplementation("androidx.test.ext:junit:1.1.4")
-    androidTestImplementation("androidx.test.espresso:espresso-core:3.5.0")
-}
-
-apply(from = "tauri.build.gradle.kts")

native/src-tauri/gen/android/app/proguard-rules.pro

@@ -1,21 +0,0 @@
-# Add project specific ProGuard rules here.
-# You can control the set of applied configuration files using the
-# proguardFiles setting in build.gradle.
-#
-# For more details, see
-#   http://developer.android.com/guide/developing/tools/proguard.html
-
-# If your project uses WebView with JS, uncomment the following
-# and specify the fully qualified class name to the JavaScript interface
-# class:
-#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
-#   public *;
-#}
-
-# Uncomment this to preserve the line number information for
-# debugging stack traces.
-#-keepattributes SourceFile,LineNumberTable
-
-# If you keep the line number information, uncomment this to
-# hide the original source file name.
-#-renamesourcefileattribute SourceFile

native/src-tauri/gen/android/app/src/androidTest/java/de/kanbangit/desktop/PlatformTest.kt

@@ -1,116 +0,0 @@
-package de.kanbangit.desktop
-
-import android.content.Context
-import android.os.SystemClock
-import android.view.InputDevice
-import android.view.MotionEvent
-import android.view.View
-import android.webkit.CookieManager
-import android.webkit.WebView
-import androidx.lifecycle.Lifecycle
-import androidx.test.core.app.ActivityScenario
-import androidx.test.platform.app.InstrumentationRegistry
-import androidx.test.ext.junit.runners.AndroidJUnit4
-import org.junit.Assert.*
-import org.junit.Test
-import org.junit.runner.RunWith
-import java.util.concurrent.CountDownLatch
-import java.util.concurrent.TimeUnit
-import java.util.concurrent.atomic.AtomicReference
-
-@RunWith(AndroidJUnit4::class)
-class PlatformTest {
-    private val instrumentation = InstrumentationRegistry.getInstrumentation()
-
-    private fun evaluate(view: WebView, script: String): String {
-        val result = AtomicReference<String>()
-        val latch = CountDownLatch(1)
-        instrumentation.runOnMainSync { view.evaluateJavascript(script) { result.set(it); latch.countDown() } }
-        assertTrue("JavaScript callback timed out", latch.await(10, TimeUnit.SECONDS))
-        return result.get()
-    }
-
-    private fun waitFor(condition: () -> Boolean) {
-        val end = System.currentTimeMillis() + 25000
-        while (System.currentTimeMillis() < end) {
-            if (condition()) return
-            Thread.sleep(100)
-        }
-        fail("Platform condition timed out")
-    }
-
-    private fun tapCenter(view: View) {
-        val position = IntArray(2)
-        instrumentation.runOnMainSync {
-            view.getLocationOnScreen(position)
-            position[0] += view.width / 2
-            position[1] += view.height / 2
-        }
-        val downTime = SystemClock.uptimeMillis()
-        for (action in listOf(MotionEvent.ACTION_DOWN, MotionEvent.ACTION_UP)) {
-            val event = MotionEvent.obtain(downTime, SystemClock.uptimeMillis(), action, position[0].toFloat(), position[1].toFloat(), 0)
-            event.source = InputDevice.SOURCE_TOUCHSCREEN
-            try {
-                instrumentation.sendPointerSync(event)
-            } finally {
-                event.recycle()
-            }
-        }
-        instrumentation.waitForIdleSync()
-    }
-
-    @Test fun workspacePreservesFormsAndIsolatesServers() {
-        instrumentation.targetContext.getSharedPreferences("workspace", Context.MODE_PRIVATE).edit().clear().commit()
-        val scenario = ActivityScenario.launch(MainActivity::class.java)
-        Thread.sleep(1500)
-        scenario.onActivity { it.openWorkspace("https://kanbangit.de/") }
-        val remote = AtomicReference<WebView>()
-        waitFor {
-            var visible = false
-            scenario.onActivity { remote.set(it.workspace); visible = it.workspace?.visibility == View.VISIBLE }
-            visible && remote.get() != null && evaluate(remote.get(), "document.readyState === 'complete' && document.querySelector('#app')?.innerText.trim().length > 100") == "true"
-        }
-        val view = remote.get()
-        assertEquals("true", evaluate(view, "typeof window.nativeLauncher === 'undefined' && typeof window.__TAURI_INTERNALS__ === 'undefined'"))
-        assertEquals("true", evaluate(view, """
-            (() => {
-                const input = document.createElement('input');
-                input.id = 'kan53-input';
-                input.value = 'retained form';
-                document.body.append(input);
-                const button = document.createElement('button');
-                button.style.cssText = 'position:fixed;inset:0;width:100%;height:100%;z-index:2147483647';
-                button.textContent = 'Navigate';
-                button.onclick = () => {
-                    history.pushState({}, '', '/kan53-history');
-                    button.remove();
-                };
-                document.body.append(button);
-                return true;
-            })()
-        """.trimIndent()))
-        tapCenter(view)
-        waitFor { evaluate(view, "location.pathname === '/kan53-history'") == "true" }
-        waitFor {
-            var canGoBack = false
-            scenario.onActivity { canGoBack = view.canGoBack() }
-            canGoBack
-        }
-        scenario.moveToState(Lifecycle.State.CREATED)
-        scenario.moveToState(Lifecycle.State.RESUMED)
-        assertEquals("\"retained form\"", evaluate(view, "document.querySelector('#kan53-input').value"))
-        scenario.onActivity { it.onBackPressedDispatcher.onBackPressed() }
-        waitFor { evaluate(view, "location.pathname !== '/kan53-history'") == "true" }
-        assertEquals("\"retained form\"", evaluate(view, "document.querySelector('#kan53-input').value"))
-        evaluate(view, "document.cookie = 'kan53_fixture=secret; Path=/; Secure; SameSite=Lax'; localStorage.setItem('kan53_fixture', 'secret')")
-        scenario.onActivity { it.openWorkspace("https://127.0.0.1:9/") }
-        waitFor {
-            val cookie = AtomicReference<String>()
-            instrumentation.runOnMainSync { cookie.set(CookieManager.getInstance().getCookie("https://kanbangit.de/")) }
-            cookie.get()?.contains("kan53_fixture") != true
-        }
-        scenario.onActivity { assertNotSame(view, it.workspace) }
-        // Let instrumentation finish the process after reporting, rather than exiting via Tauri.
-        scenario.moveToState(Lifecycle.State.CREATED)
-    }
-}

native/src-tauri/gen/android/app/src/main/AndroidManifest.xml

@@ -1,35 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<manifest xmlns:android="http://schemas.android.com/apk/res/android">
-    <uses-permission android:name="android.permission.INTERNET" />
-
-    <application
-        android:allowBackup="false"
-        android:dataExtractionRules="@xml/data_extraction_rules"
-        android:icon="@drawable/kanbangit"
-        android:label="@string/app_name"
-        android:theme="@style/Theme.kanbangit_native"
-        android:usesCleartextTraffic="${usesCleartextTraffic}">
-        <activity
-            android:configChanges="orientation|keyboardHidden|keyboard|screenSize|locale|smallestScreenSize|screenLayout|uiMode"
-            android:launchMode="singleTask"
-            android:label="@string/main_activity_title"
-            android:name=".MainActivity"
-            android:windowSoftInputMode="adjustResize"
-            android:exported="true">
-            <intent-filter>
-                <action android:name="android.intent.action.MAIN" />
-                <category android:name="android.intent.category.LAUNCHER" />
-            </intent-filter>
-        </activity>
-
-        <provider
-          android:name="androidx.core.content.FileProvider"
-          android:authorities="${applicationId}.fileprovider"
-          android:exported="false"
-          android:grantUriPermissions="true">
-          <meta-data
-            android:name="android.support.FILE_PROVIDER_PATHS"
-            android:resource="@xml/file_paths" />
-        </provider>
-    </application>
-</manifest>

native/src-tauri/gen/android/app/src/main/java/de/kanbangit/desktop/MainActivity.kt

@@ -1,406 +0,0 @@
-package de.kanbangit.desktop
-
-import android.annotation.SuppressLint
-import android.content.ActivityNotFoundException
-import android.content.Intent
-import android.content.res.Configuration
-import android.graphics.Bitmap
-import android.net.Uri
-import android.net.http.SslError
-import android.os.Bundle
-import android.os.Handler
-import android.os.Looper
-import android.os.Message
-import android.view.View
-import android.view.ViewGroup
-import android.webkit.CookieManager
-import android.webkit.SslErrorHandler
-import android.webkit.ValueCallback
-import android.webkit.WebChromeClient
-import android.webkit.WebResourceError
-import android.webkit.WebResourceRequest
-import android.webkit.WebResourceResponse
-import android.webkit.WebSettings
-import android.webkit.WebStorage
-import android.webkit.WebView
-import android.webkit.WebViewClient
-import android.widget.Button
-import android.widget.FrameLayout
-import android.widget.LinearLayout
-import android.widget.TextView
-import android.widget.Toast
-import androidx.activity.OnBackPressedCallback
-import androidx.activity.enableEdgeToEdge
-import androidx.activity.result.contract.ActivityResultContracts
-import androidx.core.view.ViewCompat
-import androidx.core.view.WindowCompat
-import androidx.core.view.WindowInsetsCompat
-import androidx.webkit.WebViewCompat
-import androidx.webkit.WebViewFeature
-import org.json.JSONObject
-
-class MainActivity : TauriActivity() {
-    private val handler = Handler(Looper.getMainLooper())
-    private val preferences by lazy { getSharedPreferences("workspace", MODE_PRIVATE) }
-    private lateinit var launcher: WebView
-    private lateinit var root: LinearLayout
-    private lateinit var content: FrameLayout
-    private lateinit var settings: Button
-    internal var workspace: WebView? = null
-        private set
-    private var server = NavigationPolicy.DEFAULT_SERVER
-    private var phase = "idle"
-    private var ready = false
-    private var revision = 0
-    private var launcherVisible = true
-    private var keyboardVisible = false
-    private var initialized = false
-
-    private var fileCallback: ValueCallback<Array<Uri>>? = null
-    private var fileWorkspace: WebView? = null
-    private var filePage: String? = null
-    private var multipleFiles = false
-    private var filePickerActive = false
-    private val popups = mutableSetOf<WebView>()
-    private val filePicker = registerForActivityResult(ActivityResultContracts.StartActivityForResult()) { result ->
-        filePickerActive = false
-        val callback = fileCallback
-        val owner = fileWorkspace
-        val page = filePage
-        fileCallback = null
-        fileWorkspace = null
-        filePage = null
-        val files = WebChromeClient.FileChooserParams.parseResult(result.resultCode, result.data)
-        val valid = owner != null && owner === workspace && owner.url == page &&
-            NavigationPolicy.allows(server, page.orEmpty()) && files?.isNotEmpty() == true &&
-            (multipleFiles || files.size == 1) && files.all { uri ->
-                NavigationPolicy.selectedFile(uri.toString(), packageName) && runCatching {
-                    contentResolver.openFileDescriptor(uri, "r")?.use { true } == true
-                }.getOrDefault(false)
-            }
-        callback?.onReceiveValue(if (valid) files else null)
-    }
-
-    private fun cancelFileSelection() {
-        fileCallback?.onReceiveValue(null)
-        fileCallback = null
-        fileWorkspace = null
-        filePage = null
-    }
-
-    private fun openExternal(url: String) {
-        if (!NavigationPolicy.external(url)) return
-        try {
-            startActivity(Intent(Intent.ACTION_VIEW, Uri.parse(url)).addCategory(Intent.CATEGORY_BROWSABLE))
-        } catch (_: ActivityNotFoundException) {
-            Toast.makeText(this, R.string.external_link_error, Toast.LENGTH_LONG).show()
-        }
-    }
-
-    override fun onCreate(savedInstanceState: Bundle?) {
-        enableEdgeToEdge()
-        super.onCreate(savedInstanceState)
-        onBackPressedDispatcher.addCallback(this, object : OnBackPressedCallback(true) {
-            override fun handleOnBackPressed() {
-                when (NavigationPolicy.backAction(keyboardVisible, launcherVisible, ready, workspace?.canGoBack() == true)) {
-                    "keyboard" -> WindowCompat.getInsetsController(window, window.decorView).hide(WindowInsetsCompat.Type.ime())
-                    "resume" -> showWorkspace()
-                    "history" -> workspace?.goBack()
-                    "settings" -> showLauncher()
-                    else -> moveTaskToBack(true)
-                }
-            }
-        })
-    }
-
-    override fun onWebViewCreate(webView: WebView) {
-        launcher = webView
-        if (WebViewFeature.isFeatureSupported(WebViewFeature.WEB_MESSAGE_LISTENER)) {
-            WebViewCompat.addWebMessageListener(launcher, "nativeLauncher", setOf(NavigationPolicy.LAUNCHER_ORIGIN)) {
-                _, message, origin, mainFrame, _ ->
-                if (mainFrame && origin.toString().trimEnd('/') == NavigationPolicy.LAUNCHER_ORIGIN) {
-                    launcher.post { handleAction(message.data.orEmpty()) }
-                }
-            }
-        }
-        launcher.post { attachShell() }
-    }
-
-    private fun attachShell() {
-        if (::root.isInitialized) return
-        (launcher.parent as? ViewGroup)?.removeView(launcher)
-        root = LinearLayout(this).apply { orientation = LinearLayout.VERTICAL }
-        settings = Button(this).apply {
-            text = getString(R.string.server_settings)
-            isAllCaps = false
-            visibility = View.GONE
-            setOnClickListener { showLauncher() }
-        }
-        root.addView(settings, LinearLayout.LayoutParams(-1, -2))
-        content = FrameLayout(this)
-        content.addView(launcher, FrameLayout.LayoutParams(-1, -1))
-        root.addView(content, LinearLayout.LayoutParams(-1, 0, 1f))
-        setContentView(root)
-        ViewCompat.setOnApplyWindowInsetsListener(root) { view, insets ->
-            val safe = insets.getInsets(WindowInsetsCompat.Type.systemBars() or WindowInsetsCompat.Type.displayCutout())
-            val keyboard = insets.getInsets(WindowInsetsCompat.Type.ime())
-            keyboardVisible = insets.isVisible(WindowInsetsCompat.Type.ime())
-            view.setPadding(safe.left, safe.top, safe.right, maxOf(safe.bottom, keyboard.bottom))
-            WindowInsetsCompat.CONSUMED
-        }
-        ViewCompat.requestApplyInsets(root)
-        if (!WebViewFeature.isFeatureSupported(WebViewFeature.WEB_MESSAGE_LISTENER)) {
-            content.removeAllViews()
-            content.addView(TextView(this).apply { text = getString(R.string.update_webview) })
-        }
-    }
-
-    private fun handleAction(value: String) {
-        attachShell()
-        val url = Uri.parse(value)
-        if (url.scheme != "https" || url.host != "tauri.localhost" || url.port != -1 || url.userInfo != null) return
-        when (url.path) {
-            "/action/ready" -> {
-                if (initialized) return
-                initialized = true
-                val saved = preferences.getString("server", null)
-                server = saved?.let(NavigationPolicy::installation) ?: NavigationPolicy.DEFAULT_SERVER
-                updateLauncher()
-                if (saved != null) openWorkspace(server)
-            }
-            "/action/open" -> openWorkspace(url.getQueryParameter("server").orEmpty())
-            "/action/resume" -> if (ready) showWorkspace()
-        }
-    }
-
-    internal fun openWorkspace(input: String) {
-        val address = NavigationPolicy.installation(input)
-        if (address == null) {
-            phase = "invalidServer"
-            showLauncher()
-            return
-        }
-        if (phase == "connecting") return
-        if (address == server && ready) {
-            if (phase == "connectionError") {
-                phase = "connecting"
-                workspace?.let { startTimeout(it); it.reload() }
-                updateLauncher()
-                return
-            }
-            showWorkspace()
-            return
-        }
-        cancelFileSelection()
-        val changed = address != preferences.getString("server", null)
-        val clearSession = changed || preferences.getBoolean("clearing", false)
-        if (!preferences.edit().putString("server", address).putBoolean("clearing", clearSession).commit()) {
-            phase = "storageError"
-            showLauncher()
-            return
-        }
-        server = address
-        ready = false
-        phase = "connecting"
-        revision++
-        workspace?.let { old ->
-            content.removeView(old)
-            old.stopLoading()
-            if (clearSession) old.clearCache(true)
-            old.destroy()
-        }
-        workspace = null
-        updateLauncher()
-        if (clearSession) {
-            WebStorage.getInstance().deleteAllData()
-            CookieManager.getInstance().removeAllCookies {
-                CookieManager.getInstance().flush()
-                if (!preferences.edit().putBoolean("clearing", false).commit()) {
-                    phase = "storageError"
-                    showLauncher()
-                } else if (!isDestroyed) {
-                    createWorkspace()
-                }
-            }
-        } else {
-            createWorkspace()
-        }
-    }
-
-    @SuppressLint("SetJavaScriptEnabled")
-    private fun createWorkspace() {
-        val remote = WebView(this)
-        workspace = remote
-        remote.settings.apply {
-            javaScriptEnabled = true
-            domStorageEnabled = true
-            allowFileAccess = false
-            allowContentAccess = true
-            mixedContentMode = WebSettings.MIXED_CONTENT_NEVER_ALLOW
-            javaScriptCanOpenWindowsAutomatically = false
-            setSupportMultipleWindows(true)
-        }
-        CookieManager.getInstance().setAcceptThirdPartyCookies(remote, false)
-        remote.webChromeClient = object : WebChromeClient() {
-            override fun onShowFileChooser(view: WebView, callback: ValueCallback<Array<Uri>>, params: FileChooserParams): Boolean {
-                if (view !== workspace || !NavigationPolicy.allows(server, view.url.orEmpty()) ||
-                    params.mode !in listOf(FileChooserParams.MODE_OPEN, FileChooserParams.MODE_OPEN_MULTIPLE)) return false
-                // Keep one outstanding picker; stale results must never reach a different page.
-                if (filePickerActive) return false
-                fileCallback = callback
-                fileWorkspace = view
-                filePage = view.url
-                multipleFiles = params.mode == FileChooserParams.MODE_OPEN_MULTIPLE
-                return try {
-                    filePickerActive = true
-                    filePicker.launch(params.createIntent().addCategory(Intent.CATEGORY_OPENABLE))
-                    true
-                } catch (_: ActivityNotFoundException) {
-                    filePickerActive = false
-                    cancelFileSelection()
-                    Toast.makeText(this@MainActivity, R.string.file_picker_error, Toast.LENGTH_LONG).show()
-                    true
-                }
-            }
-
-            override fun onCreateWindow(view: WebView, isDialog: Boolean, isUserGesture: Boolean, result: Message): Boolean {
-                if (view !== workspace || !isUserGesture || !NavigationPolicy.allows(server, view.url.orEmpty())) return false
-                val popup = WebView(this@MainActivity)
-                popups.add(popup)
-                fun dispose() {
-                    if (popups.remove(popup)) popup.destroy()
-                }
-                popup.webViewClient = object : WebViewClient() {
-                    override fun shouldOverrideUrlLoading(child: WebView, request: WebResourceRequest): Boolean {
-                        if (request.isForMainFrame && workspace === view) {
-                            val url = request.url.toString()
-                            if (NavigationPolicy.allows(server, url)) view.loadUrl(url) else openExternal(url)
-                        }
-                        child.post { dispose() }
-                        return true
-                    }
-                }
-                (result.obj as WebView.WebViewTransport).webView = popup
-                result.sendToTarget()
-                handler.postDelayed({ dispose() }, 10000)
-                return true
-            }
-        }
-        remote.webViewClient = object : WebViewClient() {
-            override fun shouldOverrideUrlLoading(view: WebView, request: WebResourceRequest): Boolean {
-                val url = request.url.toString()
-                if (NavigationPolicy.allows(server, url)) return false
-                if (workspace === view && request.isForMainFrame && request.hasGesture()) openExternal(url)
-                return true
-            }
-
-            override fun onPageStarted(view: WebView, url: String, favicon: Bitmap?) {
-                if (workspace === view) cancelFileSelection()
-                if (!NavigationPolicy.allows(server, url)) {
-                    view.stopLoading()
-                    fail(view)
-                    return
-                }
-                phase = "connecting"
-                startTimeout(view)
-                updateLauncher()
-            }
-
-            override fun onPageFinished(view: WebView, url: String) {
-                if (workspace !== view || phase != "connecting" || !NavigationPolicy.allows(server, url)) return
-                revision++
-                phase = "connected"
-                val firstLoad = !ready
-                ready = true
-                CookieManager.getInstance().flush()
-                updateLauncher()
-                if (firstLoad) showWorkspace()
-            }
-
-            override fun onReceivedError(view: WebView, request: WebResourceRequest, error: WebResourceError) {
-                if (request.isForMainFrame) fail(view)
-            }
-
-            override fun onReceivedHttpError(view: WebView, request: WebResourceRequest, response: WebResourceResponse) {
-                if (request.isForMainFrame && response.statusCode >= 500) fail(view)
-            }
-
-            override fun onReceivedSslError(view: WebView, sslHandler: SslErrorHandler, error: SslError) {
-                sslHandler.cancel()
-                fail(view)
-            }
-        }
-        remote.visibility = View.GONE
-        content.addView(remote, 0, FrameLayout.LayoutParams(-1, -1))
-        startTimeout(remote)
-        remote.loadUrl(server)
-    }
-
-    private fun startTimeout(view: WebView) {
-        val current = ++revision
-        handler.postDelayed({
-            if (current == revision && phase == "connecting" && workspace === view) {
-                view.stopLoading()
-                fail(view)
-            }
-        }, 15000)
-    }
-
-    private fun fail(view: WebView) {
-        if (workspace !== view) return
-        revision++
-        phase = "connectionError"
-        showLauncher()
-    }
-
-    private fun updateLauncher() {
-        val query = Uri.Builder().appendQueryParameter("server", server)
-            .appendQueryParameter("phase", phase).appendQueryParameter("ready", ready.toString())
-            .appendQueryParameter("platform", "android").build().encodedQuery.orEmpty()
-        launcher.evaluateJavascript("window.updateLauncher?.(${JSONObject.quote(query)})", null)
-    }
-
-    private fun showLauncher() {
-        updateLauncher()
-        launcherVisible = true
-        launcher.visibility = View.VISIBLE
-        workspace?.visibility = View.GONE
-        settings.visibility = View.GONE
-        launcher.requestFocus()
-    }
-
-    private fun showWorkspace() {
-        launcherVisible = false
-        launcher.visibility = View.GONE
-        workspace?.visibility = View.VISIBLE
-        settings.visibility = View.VISIBLE
-        workspace?.requestFocus()
-    }
-
-    override fun onPause() {
-        workspace?.onPause()
-        CookieManager.getInstance().flush()
-        super.onPause()
-    }
-
-    override fun onResume() {
-        super.onResume()
-        workspace?.onResume()
-    }
-
-    override fun onConfigurationChanged(newConfig: Configuration) {
-        super.onConfigurationChanged(newConfig)
-        enableEdgeToEdge()
-        if (::root.isInitialized) ViewCompat.requestApplyInsets(root)
-    }
-
-    override fun onDestroy() {
-        handler.removeCallbacksAndMessages(null)
-        cancelFileSelection()
-        popups.forEach { it.destroy() }
-        popups.clear()
-        workspace?.destroy()
-        workspace = null
-        super.onDestroy()
-    }
-}

native/src-tauri/gen/android/app/src/main/java/de/kanbangit/desktop/NavigationPolicy.kt

@@ -1,56 +0,0 @@
-package de.kanbangit.desktop
-
-import java.net.URI
-import java.util.Locale
-
-object NavigationPolicy {
-    const val DEFAULT_SERVER = "https://kanbangit.de/"
-    const val LAUNCHER_ORIGIN = "https://tauri.localhost"
-
-    fun installation(input: String): String? = runCatching {
-        val trimmed = input.trim()
-        require(trimmed.none { it.isISOControl() || it == '\\' })
-        val uri = URI(trimmed)
-        require(uri.scheme.equals("https", ignoreCase = true))
-        require(!uri.host.isNullOrBlank() && uri.rawUserInfo == null)
-        require(uri.rawQuery == null && uri.rawFragment == null)
-        require(uri.port == -1 || uri.port in 1..65535)
-        require(!uri.host.equals("tauri.localhost", ignoreCase = true))
-        val port = if (uri.port == -1 || uri.port == 443) "" else ":${uri.port}"
-        val path = uri.rawPath.orEmpty().let { if (it.endsWith('/')) it else "$it/" }
-        "https://${uri.host.lowercase(Locale.ROOT)}$port$path"
-    }.getOrNull()
-
-    fun allows(server: String, destination: String): Boolean = runCatching {
-        val base = URI(server)
-        val target = URI(destination)
-        target.scheme.equals("https", ignoreCase = true) &&
-            target.host.equals(base.host, ignoreCase = true) &&
-            (if (target.port == -1) 443 else target.port) ==
-            (if (base.port == -1) 443 else base.port) &&
-            target.rawUserInfo == null && !destination.contains('\\')
-    }.getOrDefault(false)
-
-    fun external(destination: String): Boolean = runCatching {
-        val target = URI(destination)
-        target.scheme.lowercase(Locale.ROOT) in setOf("https", "http") &&
-            !target.host.isNullOrBlank() && target.rawUserInfo == null &&
-            (target.port == -1 || target.port in 1..65535) &&
-            destination.none { it.isISOControl() || it == '\\' }
-    }.getOrDefault(false)
-
-    fun selectedFile(destination: String, packageName: String): Boolean = runCatching {
-        val target = URI(destination)
-        target.scheme == "content" && !target.host.isNullOrBlank() &&
-            target.rawUserInfo == null && target.port == -1 &&
-            target.host != packageName && target.host != "$packageName.fileprovider"
-    }.getOrDefault(false)
-
-    fun backAction(keyboard: Boolean, launcher: Boolean, ready: Boolean, history: Boolean): String = when {
-        keyboard -> "keyboard"
-        launcher && ready -> "resume"
-        !launcher && history -> "history"
-        !launcher -> "settings"
-        else -> "background"
-    }
-}

native/src-tauri/gen/android/app/src/main/res/drawable/kanbangit.xml

@@ -1,8 +0,0 @@
-<vector xmlns:android="http://schemas.android.com/apk/res/android"
-    android:width="48dp" android:height="48dp"
-    android:viewportWidth="64" android:viewportHeight="64">
-    <path android:fillColor="#22c55e" android:pathData="M12,0 H52 Q64,0 64,12 V52 Q64,64 52,64 H12 Q0,64 0,52 V12 Q0,0 12,0 Z" />
-    <path android:fillColor="@android:color/transparent" android:strokeColor="#004b1e"
-        android:strokeWidth="3" android:strokeLineCap="round" android:strokeLineJoin="round"
-        android:pathData="M19,16 H45 Q48,16 48,19 V45 Q48,48 45,48 H19 Q16,48 16,45 V19 Q16,16 19,16 Z M27,16 V48 M37,16 V48" />
-</vector>

native/src-tauri/gen/android/app/src/main/res/values-night/themes.xml

@@ -1,6 +0,0 @@
-<resources xmlns:tools="http://schemas.android.com/tools">
-    <!-- Base application theme. -->
-    <style name="Theme.kanbangit_native" parent="Theme.MaterialComponents.DayNight.NoActionBar">
-        <!-- Customize your theme here. -->
-    </style>
-</resources>

native/src-tauri/gen/android/app/src/main/res/values/strings.xml

@@ -1,8 +0,0 @@
-<resources>
-    <string name="app_name">"KanbanGit"</string>
-    <string name="main_activity_title">"KanbanGit"</string>
-    <string name="server_settings">Server settings</string>
-    <string name="update_webview">Update Android System WebView to connect to your workspace.</string>
-    <string name="external_link_error">No browser is available to open this link.</string>
-    <string name="file_picker_error">No file picker is available. Please try again.</string>
-</resources>

native/src-tauri/gen/android/app/src/main/res/values/themes.xml

@@ -1,6 +0,0 @@
-<resources xmlns:tools="http://schemas.android.com/tools">
-    <!-- Base application theme. -->
-    <style name="Theme.kanbangit_native" parent="Theme.MaterialComponents.DayNight.NoActionBar">
-        <!-- Customize your theme here. -->
-    </style>
-</resources>

native/src-tauri/gen/android/app/src/main/res/xml/data_extraction_rules.xml

@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<data-extraction-rules>
-    <cloud-backup>
-        <exclude domain="root" path="." />
-        <exclude domain="sharedpref" path="." />
-        <exclude domain="database" path="." />
-        <exclude domain="file" path="." />
-        <exclude domain="external" path="." />
-    </cloud-backup>
-    <device-transfer>
-        <exclude domain="root" path="." />
-        <exclude domain="sharedpref" path="." />
-        <exclude domain="database" path="." />
-        <exclude domain="file" path="." />
-        <exclude domain="external" path="." />
-    </device-transfer>
-</data-extraction-rules>

native/src-tauri/gen/android/app/src/main/res/xml/file_paths.xml

@@ -1,5 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<paths xmlns:android="http://schemas.android.com/apk/res/android">
-  <external-path name="my_images" path="." />
-  <cache-path name="my_cache_images" path="." />
-</paths>

native/src-tauri/gen/android/app/src/test/java/de/kanbangit/desktop/NavigationPolicyTest.kt

@@ -1,51 +0,0 @@
-package de.kanbangit.desktop
-
-import org.junit.Assert.*
-import org.junit.Test
-
-class NavigationPolicyTest {
-    @Test fun normalizesAddressesAndRejectsCredentialsAndUnsafeSchemes() {
-        assertEquals("https://example.com/kanban/", NavigationPolicy.installation(" HTTPS://Example.com:443/kanban "))
-        assertEquals("https://[::1]:8443/", NavigationPolicy.installation("https://[::1]:8443"))
-        for (value in listOf("http://example.com", "https:example.com", "https://user:pass@example.com", "https://example.com/?token=x", "https://example.com/#x", "https://exa\nmple.com", "https://example.com\\other", "https://example.com:99999", "https://tauri.localhost/", "file:///etc/passwd", "")) {
-            assertNull(value, NavigationPolicy.installation(value))
-        }
-    }
-
-    @Test fun allowsLoginTwoFactorAndHistoryOnlyOnTheSelectedOrigin() {
-        val server = "https://example.com:8443/app/"
-        for (path in listOf("/login", "/two-factor-challenge", "/projects/1?ticket=53#details")) {
-            assertTrue(NavigationPolicy.allows(server, "https://example.com:8443$path"))
-        }
-        for (value in listOf("https://example.com/", "http://example.com:8443/", "https://other.example.com:8443/", "https://user@example.com:8443/", "https://tauri.localhost/action/open", "javascript:alert(1)", "intent://example.com", "file:///etc/passwd")) {
-            assertFalse(value, NavigationPolicy.allows(server, value))
-        }
-        assertTrue(NavigationPolicy.allows("https://example.com/", "https://example.com:443/login"))
-    }
-
-    @Test fun externalLinksNeverBecomeServerNavigation() {
-        val server = "https://example.com/"
-        for (url in listOf("https://git.example.com/org/repo/pulls/1#diff", "http://git.example.com/repo", "https://example.com:8443/other")) {
-            assertTrue(url, NavigationPolicy.external(url))
-            assertFalse(url, NavigationPolicy.allows(server, url))
-        }
-        for (url in listOf("https://user:password@git.example.com/", "https://example.com:99999/", "javascript:alert(1)", "intent://example.com/", "file:///etc/passwd", "content://provider/file", "data:text/html,test", "mailto:user@example.com", "https://example.com\\evil")) {
-            assertFalse(url, NavigationPolicy.external(url))
-        }
-    }
-
-    @Test fun filePickerAcceptsOnlyExternalContentProviders() {
-        assertTrue(NavigationPolicy.selectedFile("content://com.android.providers.media.documents/document/image%3A1", "de.kanbangit.desktop"))
-        for (url in listOf("file:///data/data/de.kanbangit.desktop/session", "https://example.com/avatar.png", "content://de.kanbangit.desktop.fileprovider/private/key", "content://de.kanbangit.desktop/private/key", "content://user@provider/path", "content://provider:123/path", "content:/missing-provider")) {
-            assertFalse(url, NavigationPolicy.selectedFile(url, "de.kanbangit.desktop"))
-        }
-    }
-
-    @Test fun backClosesKeyboardBeforeNavigatingAndPreservesTheWorkspace() {
-        assertEquals("keyboard", NavigationPolicy.backAction(true, false, true, true))
-        assertEquals("resume", NavigationPolicy.backAction(false, true, true, true))
-        assertEquals("history", NavigationPolicy.backAction(false, false, true, true))
-        assertEquals("settings", NavigationPolicy.backAction(false, false, true, false))
-        assertEquals("background", NavigationPolicy.backAction(false, true, false, false))
-    }
-}

native/src-tauri/gen/android/build.gradle.kts

@@ -1,21 +0,0 @@
-buildscript {
-    repositories {
-        google()
-        mavenCentral()
-    }
-    dependencies {
-        classpath("com.android.tools.build:gradle:8.11.0")
-        classpath("org.jetbrains.kotlin:kotlin-gradle-plugin:1.9.25")
-    }
-}
-
-allprojects {
-    repositories {
-        google()
-        mavenCentral()
-    }
-}
-
-tasks.register("clean").configure {
-    delete("build")
-}

native/src-tauri/gen/android/buildSrc/build.gradle.kts

@@ -1,22 +0,0 @@
-plugins {
-    `kotlin-dsl`
-}
-
-gradlePlugin {
-    plugins {
-        create("pluginsForCoolKids") {
-            id = "rust"
-            implementationClass = "RustPlugin"
-        }
-    }
-}
-
-repositories {
-    google()
-    mavenCentral()
-}
-
-dependencies {
-    compileOnly(gradleApi())
-    implementation("com.android.tools.build:gradle:8.11.0")
-}

native/src-tauri/gen/android/buildSrc/src/main/java/de/kanbangit/desktop/kotlin/BuildTask.kt

@@ -1,68 +0,0 @@
-import java.io.File
-import org.apache.tools.ant.taskdefs.condition.Os
-import org.gradle.api.DefaultTask
-import org.gradle.api.GradleException
-import org.gradle.api.logging.LogLevel
-import org.gradle.api.tasks.Input
-import org.gradle.api.tasks.TaskAction
-
-open class BuildTask : DefaultTask() {
-    @Input
-    var rootDirRel: String? = null
-    @Input
-    var target: String? = null
-    @Input
-    var release: Boolean? = null
-
-    @TaskAction
-    fun assemble() {
-        val executable = """pnpm""";
-        try {
-            runTauriCli(executable)
-        } catch (e: Exception) {
-            if (Os.isFamily(Os.FAMILY_WINDOWS)) {
-                // Try different Windows-specific extensions
-                val fallbacks = listOf(
-                    "$executable.exe",
-                    "$executable.cmd",
-                    "$executable.bat",
-                )
-
-                var lastException: Exception = e
-                for (fallback in fallbacks) {
-                    try {
-                        runTauriCli(fallback)
-                        return
-                    } catch (fallbackException: Exception) {
-                        lastException = fallbackException
-                    }
-                }
-                throw lastException
-            } else {
-                throw e;
-            }
-        }
-    }
-
-    fun runTauriCli(executable: String) {
-        val rootDirRel = rootDirRel ?: throw GradleException("rootDirRel cannot be null")
-        val target = target ?: throw GradleException("target cannot be null")
-        val release = release ?: throw GradleException("release cannot be null")
-        val args = listOf("tauri", "android", "android-studio-script");
-
-        project.exec {
-            workingDir(File(project.projectDir, rootDirRel))
-            executable(executable)
-            args(args)
-            if (project.logger.isEnabled(LogLevel.DEBUG)) {
-                args("-vv")
-            } else if (project.logger.isEnabled(LogLevel.INFO)) {
-                args("-v")
-            }
-            if (release) {
-                args("--release")
-            }
-            args(listOf("--target", target))
-        }.assertNormalExitValue()
-    }
-}

native/src-tauri/gen/android/buildSrc/src/main/java/de/kanbangit/desktop/kotlin/RustPlugin.kt

@@ -1,85 +0,0 @@
-import com.android.build.api.dsl.ApplicationExtension
-import org.gradle.api.DefaultTask
-import org.gradle.api.Plugin
-import org.gradle.api.Project
-import org.gradle.kotlin.dsl.configure
-import org.gradle.kotlin.dsl.get
-
-const val TASK_GROUP = "rust"
-
-open class Config {
-    lateinit var rootDirRel: String
-}
-
-open class RustPlugin : Plugin<Project> {
-    private lateinit var config: Config
-
-    override fun apply(project: Project) = with(project) {
-        config = extensions.create("rust", Config::class.java)
-
-        val defaultAbiList = listOf("arm64-v8a", "armeabi-v7a", "x86", "x86_64");
-        val abiList = (findProperty("abiList") as? String)?.split(',') ?: defaultAbiList
-
-        val defaultArchList = listOf("arm64", "arm", "x86", "x86_64");
-        val archList = (findProperty("archList") as? String)?.split(',') ?: defaultArchList
-
-        val targetsList = (findProperty("targetList") as? String)?.split(',') ?: listOf("aarch64", "armv7", "i686", "x86_64")
-
-        extensions.configure<ApplicationExtension> {
-            @Suppress("UnstableApiUsage")
-            flavorDimensions.add("abi")
-            productFlavors {
-                create("universal") {
-                    dimension = "abi"
-                    ndk {
-                        abiFilters += abiList
-                    }
-                }
-                defaultArchList.forEachIndexed { index, arch ->
-                    create(arch) {
-                        dimension = "abi"
-                        ndk {
-                            abiFilters.add(defaultAbiList[index])
-                        }
-                    }
-                }
-            }
-        }
-
-        afterEvaluate {
-            for (profile in listOf("debug", "release")) {
-                val profileCapitalized = profile.replaceFirstChar { it.uppercase() }
-                val buildTask = tasks.maybeCreate(
-                    "rustBuildUniversal$profileCapitalized",
-                    DefaultTask::class.java
-                ).apply {
-                    group = TASK_GROUP
-                    description = "Build dynamic library in $profile mode for all targets"
-                }
-
-                tasks["mergeUniversal${profileCapitalized}JniLibFolders"].dependsOn(buildTask)
-
-                for (targetPair in targetsList.withIndex()) {
-                    val targetName = targetPair.value
-                    val targetArch = archList[targetPair.index]
-                    val targetArchCapitalized = targetArch.replaceFirstChar { it.uppercase() }
-                    val targetBuildTask = project.tasks.maybeCreate(
-                        "rustBuild$targetArchCapitalized$profileCapitalized",
-                        BuildTask::class.java
-                    ).apply {
-                        group = TASK_GROUP
-                        description = "Build dynamic library in $profile mode for $targetArch"
-                        rootDirRel = config.rootDirRel
-                        target = targetName
-                        release = profile == "release"
-                    }
-
-                    buildTask.dependsOn(targetBuildTask)
-                    tasks["merge$targetArchCapitalized${profileCapitalized}JniLibFolders"].dependsOn(
-                        targetBuildTask
-                    )
-                }
-            }
-        }
-    }
-}

native/src-tauri/gen/android/gradle.properties

@@ -1,25 +0,0 @@
-# Project-wide Gradle settings.
-# IDE (e.g. Android Studio) users:
-# Gradle settings configured through the IDE *will override*
-# any settings specified in this file.
-# For more details on how to configure your build environment visit
-# http://www.gradle.org/docs/current/userguide/build_environment.html
-# Specifies the JVM arguments used for the daemon process.
-# The setting is particularly useful for tweaking memory settings.
-org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8
-# When configured, Gradle will run in incubating parallel mode.
-# This option should only be used with decoupled projects. More details, visit
-# http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects
-# org.gradle.parallel=true
-# AndroidX package structure to make it clearer which packages are bundled with the
-# Android operating system, and which are packaged with your app"s APK
-# https://developer.android.com/topic/libraries/support-library/androidx-rn
-android.useAndroidX=true
-# Kotlin code style for this project: "official" or "obsolete":
-kotlin.code.style=official
-# Enables namespacing of each library's R class so that its R class includes only the
-# resources declared in the library itself and none from the library's dependencies,
-# thereby reducing the size of the R class for that library
-android.nonTransitiveRClass=true
-android.nonFinalResIds=false
-android.builder.sdkDownload=false

native/src-tauri/gen/android/gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +0,0 @@
-#Tue May 10 19:22:52 CST 2022
-distributionBase=GRADLE_USER_HOME
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-bin.zip
-distributionPath=wrapper/dists
-zipStorePath=wrapper/dists
-zipStoreBase=GRADLE_USER_HOME

native/src-tauri/gen/android/gradlew

@@ -1,185 +0,0 @@
-#!/usr/bin/env sh
-
-#
-# Copyright 2015 the original author or authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-##############################################################################
-##
-##  Gradle start up script for UN*X
-##
-##############################################################################
-
-# Attempt to set APP_HOME
-# Resolve links: $0 may be a link
-PRG="$0"
-# Need this for relative symlinks.
-while [ -h "$PRG" ] ; do
-    ls=`ls -ld "$PRG"`
-    link=`expr "$ls" : '.*-> \(.*\)$'`
-    if expr "$link" : '/.*' > /dev/null; then
-        PRG="$link"
-    else
-        PRG=`dirname "$PRG"`"/$link"
-    fi
-done
-SAVED="`pwd`"
-cd "`dirname \"$PRG\"`/" >/dev/null
-APP_HOME="`pwd -P`"
-cd "$SAVED" >/dev/null
-
-APP_NAME="Gradle"
-APP_BASE_NAME=`basename "$0"`
-
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
-
-# Use the maximum available, or set MAX_FD != -1 to use that value.
-MAX_FD="maximum"
-
-warn () {
-    echo "$*"
-}
-
-die () {
-    echo
-    echo "$*"
-    echo
-    exit 1
-}
-
-# OS specific support (must be 'true' or 'false').
-cygwin=false
-msys=false
-darwin=false
-nonstop=false
-case "`uname`" in
-  CYGWIN* )
-    cygwin=true
-    ;;
-  Darwin* )
-    darwin=true
-    ;;
-  MINGW* )
-    msys=true
-    ;;
-  NONSTOP* )
-    nonstop=true
-    ;;
-esac
-
-CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
-
-
-# Determine the Java command to use to start the JVM.
-if [ -n "$JAVA_HOME" ] ; then
-    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
-        # IBM's JDK on AIX uses strange locations for the executables
-        JAVACMD="$JAVA_HOME/jre/sh/java"
-    else
-        JAVACMD="$JAVA_HOME/bin/java"
-    fi
-    if [ ! -x "$JAVACMD" ] ; then
-        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
-
-Please set the JAVA_HOME variable in your environment to match the
-location of your Java installation."
-    fi
-else
-    JAVACMD="java"
-    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
-
-Please set the JAVA_HOME variable in your environment to match the
-location of your Java installation."
-fi
-
-# Increase the maximum file descriptors if we can.
-if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then
-    MAX_FD_LIMIT=`ulimit -H -n`
-    if [ $? -eq 0 ] ; then
-        if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
-            MAX_FD="$MAX_FD_LIMIT"
-        fi
-        ulimit -n $MAX_FD
-        if [ $? -ne 0 ] ; then
-            warn "Could not set maximum file descriptor limit: $MAX_FD"
-        fi
-    else
-        warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
-    fi
-fi
-
-# For Darwin, add options to specify how the application appears in the dock
-if $darwin; then
-    GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
-fi
-
-# For Cygwin or MSYS, switch paths to Windows format before running java
-if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then
-    APP_HOME=`cygpath --path --mixed "$APP_HOME"`
-    CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
-
-    JAVACMD=`cygpath --unix "$JAVACMD"`
-
-    # We build the pattern for arguments to be converted via cygpath
-    ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
-    SEP=""
-    for dir in $ROOTDIRSRAW ; do
-        ROOTDIRS="$ROOTDIRS$SEP$dir"
-        SEP="|"
-    done
-    OURCYGPATTERN="(^($ROOTDIRS))"
-    # Add a user-defined pattern to the cygpath arguments
-    if [ "$GRADLE_CYGPATTERN" != "" ] ; then
-        OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
-    fi
-    # Now convert the arguments - kludge to limit ourselves to /bin/sh
-    i=0
-    for arg in "$@" ; do
-        CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
-        CHECK2=`echo "$arg"|egrep -c "^-"`                                 ### Determine if an option
-
-        if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then                    ### Added a condition
-            eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
-        else
-            eval `echo args$i`="\"$arg\""
-        fi
-        i=`expr $i + 1`
-    done
-    case $i in
-        0) set -- ;;
-        1) set -- "$args0" ;;
-        2) set -- "$args0" "$args1" ;;
-        3) set -- "$args0" "$args1" "$args2" ;;
-        4) set -- "$args0" "$args1" "$args2" "$args3" ;;
-        5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
-        6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
-        7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
-        8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
-        9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
-    esac
-fi
-
-# Escape application args
-save () {
-    for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done
-    echo " "
-}
-APP_ARGS=`save "$@"`
-
-# Collect all arguments for the java command, following the shell quoting and substitution rules
-eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS"
-
-exec "$JAVACMD" "$@"

native/src-tauri/gen/android/gradlew.bat

@@ -1,89 +0,0 @@
-@rem
-@rem Copyright 2015 the original author or authors.
-@rem
-@rem Licensed under the Apache License, Version 2.0 (the "License");
-@rem you may not use this file except in compliance with the License.
-@rem You may obtain a copy of the License at
-@rem
-@rem      https://www.apache.org/licenses/LICENSE-2.0
-@rem
-@rem Unless required by applicable law or agreed to in writing, software
-@rem distributed under the License is distributed on an "AS IS" BASIS,
-@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-@rem See the License for the specific language governing permissions and
-@rem limitations under the License.
-@rem
-
-@if "%DEBUG%" == "" @echo off
-@rem ##########################################################################
-@rem
-@rem  Gradle startup script for Windows
-@rem
-@rem ##########################################################################
-
-@rem Set local scope for the variables with windows NT shell
-if "%OS%"=="Windows_NT" setlocal
-
-set DIRNAME=%~dp0
-if "%DIRNAME%" == "" set DIRNAME=.
-set APP_BASE_NAME=%~n0
-set APP_HOME=%DIRNAME%
-
-@rem Resolve any "." and ".." in APP_HOME to make it shorter.
-for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
-
-@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
-
-@rem Find java.exe
-if defined JAVA_HOME goto findJavaFromJavaHome
-
-set JAVA_EXE=java.exe
-%JAVA_EXE% -version >NUL 2>&1
-if "%ERRORLEVEL%" == "0" goto execute
-
-echo.
-echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
-
-goto fail
-
-:findJavaFromJavaHome
-set JAVA_HOME=%JAVA_HOME:"=%
-set JAVA_EXE=%JAVA_HOME%/bin/java.exe
-
-if exist "%JAVA_EXE%" goto execute
-
-echo.
-echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
-
-goto fail
-
-:execute
-@rem Setup the command line
-
-set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
-
-
-@rem Execute Gradle
-"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
-
-:end
-@rem End local scope for the variables with windows NT shell
-if "%ERRORLEVEL%"=="0" goto mainEnd
-
-:fail
-rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
-rem the _cmd.exe /c_ return code!
-if  not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
-exit /b 1
-
-:mainEnd
-if "%OS%"=="Windows_NT" endlocal
-
-:omega

native/src-tauri/gen/android/settings.gradle

@@ -1,3 +0,0 @@
-include ':app'
-
-apply from: 'tauri.settings.gradle'

native/src-tauri/gen/apple/Sources/kanbangit-native/WorkspacePolicy.swift

@@ -29,13 +29,6 @@ struct WorkspaceServer: Codable, Equatable {
             && destination.user == nil && destination.password == nil
     }
 
-    static func allowsExternal(_ destination: URL) -> Bool {
-        ["https", "http"].contains(destination.scheme?.lowercased() ?? "")
-            && destination.host?.isEmpty == false
-            && (destination.port.map({ (1...65535).contains($0) }) ?? true)
-            && destination.user == nil && destination.password == nil
-    }
-
     static func selecting(_ url: URL, current: WorkspaceServer?) -> WorkspaceServer {
         current?.url == url ? current! : WorkspaceServer(url: url, profile: UUID())
     }

native/src-tauri/gen/apple/Sources/kanbangit-native/WorkspaceViewController.swift

@@ -39,7 +39,6 @@ final class WorkspaceViewController: UIViewController, WKNavigationDelegate, WKU
     private let connectButton = UIButton(type: .system)
     private let resumeButton = UIButton(type: .system)
     private let toolbar = UIToolbar()
-    private var historyObservation: NSKeyValueObservation?
     private var backButton: UIBarButtonItem!
     private var appearance: UISegmentedControl!
 
@@ -193,7 +192,6 @@ final class WorkspaceViewController: UIViewController, WKNavigationDelegate, WKU
         guard let data = try? JSONEncoder().encode(selected) else { status.text = text("storageError"); return }
         defaults.set(data, forKey: serverKey)
         timeout?.cancel()
-        historyObservation = nil
         workspace?.stopLoading()
         workspace?.navigationDelegate = nil
         workspace?.removeFromSuperview()
@@ -217,9 +215,6 @@ final class WorkspaceViewController: UIViewController, WKNavigationDelegate, WKU
             webview.trailingAnchor.constraint(equalTo: view.safeAreaLayoutGuide.trailingAnchor),
         ])
         workspace = webview
-        historyObservation = webview.observe(\.canGoBack, options: [.initial, .new]) { [weak self] view, _ in
-            self?.backButton.isEnabled = view.canGoBack
-        }
         view.endEditing(true)
         address.text = url.absoluteString
         beginNavigation()
@@ -266,17 +261,8 @@ final class WorkspaceViewController: UIViewController, WKNavigationDelegate, WKU
     @objc private func goBack() { if workspace?.canGoBack == true { workspace?.goBack() } }
 
     func webView(_ webView: WKWebView, decidePolicyFor action: WKNavigationAction, decisionHandler: @escaping (WKNavigationActionPolicy) -> Void) {
-        guard webView === workspace, let url = action.request.url else { decisionHandler(.cancel); return }
-        guard server?.allows(url) == true else {
-            decisionHandler(.cancel)
-            if action.navigationType == .linkActivated,
-               action.sourceFrame.isMainFrame,
-               action.targetFrame == nil || action.targetFrame?.isMainFrame == true,
-               WorkspaceServer.allowsExternal(url) {
-                UIApplication.shared.open(url)
-            }
-            return
-        }
+        guard webView === workspace, let url = action.request.url,
+              server?.allows(url) == true else { decisionHandler(.cancel); return }
         if action.targetFrame == nil {
             decisionHandler(.cancel)
             webView.load(action.request)

native/src-tauri/gen/apple/Sources/kanbangit-native/en.lproj/InfoPlist.strings

@@ -1,2 +0,0 @@
-"NSCameraUsageDescription" = "Choose a profile picture using your camera.";
-"NSPhotoLibraryUsageDescription" = "Choose a profile picture from your photo library.";

native/src-tauri/gen/apple/Tests/WorkspaceTests.swift

@@ -17,54 +17,6 @@ final class WorkspaceTests: XCTestCase {
         }
     }
 
-    func testExternalLinksStayOutsideTheSelectedServer() throws {
-        let server = WorkspaceServer(url: URL(string: "https://example.com/")!, profile: UUID())
-        for value in ["https://git.example.com/org/repo/pulls/1#diff", "http://git.example.com/repo", "https://example.com:8443/other"] {
-            let url = try XCTUnwrap(URL(string: value))
-            XCTAssertTrue(WorkspaceServer.allowsExternal(url))
-            XCTAssertFalse(server.allows(url))
-        }
-        for value in ["https://user:secret@git.example.com/", "https://example.com:99999/", "javascript:alert(1)", "file:///etc/passwd", "tauri://localhost/action/open", "mailto:user@example.com", "data:text/html,test"] {
-            XCTAssertFalse(WorkspaceServer.allowsExternal(try XCTUnwrap(URL(string: value))), value)
-        }
-    }
-
-    @MainActor
-    func testBackButtonTracksSameDocumentHistory() async throws {
-        let name = "KAN55-history-\(UUID())"
-        let defaults = try XCTUnwrap(UserDefaults(suiteName: name))
-        defer { defaults.removePersistentDomain(forName: name) }
-        let controller = WorkspaceViewController(defaults: defaults)
-        controller.loadViewIfNeeded()
-        let url = try XCTUnwrap(WorkspaceServer.normalize("https://example.invalid/"))
-        controller.open(url)
-        let webview = try XCTUnwrap(controller.workspace)
-        webview.stopLoading()
-        webview.loadHTMLString("<html><body><input id='draft' value='unsaved'></body></html>", baseURL: url)
-        var loaded = false
-        for _ in 0..<50 {
-            if let value = try? await webview.evaluateJavaScript("document.getElementById('draft')?.value"),
-               value as? String == "unsaved" { loaded = true; break }
-            try await Task.sleep(for: .milliseconds(100))
-        }
-        XCTAssertTrue(loaded)
-        _ = try await webview.evaluateJavaScript("history.pushState({}, '', '#ticket')")
-        let toolbar = try XCTUnwrap(controller.view.subviews.compactMap { $0 as? UIToolbar }.first)
-        for _ in 0..<20 {
-            if toolbar.items?.first?.isEnabled == true { break }
-            try await Task.sleep(for: .milliseconds(50))
-        }
-        XCTAssertTrue(webview.canGoBack)
-        XCTAssertTrue(toolbar.items?.first?.isEnabled == true)
-        webview.goBack()
-        for _ in 0..<20 {
-            if let hash = try? await webview.evaluateJavaScript("location.hash"), hash as? String == "" { break }
-            try await Task.sleep(for: .milliseconds(50))
-        }
-        let draft = try await webview.evaluateJavaScript("document.getElementById('draft').value")
-        XCTAssertEqual(draft as? String, "unsaved")
-    }
-
     func testServerChangesNeverReusePreviousProfile() throws {
         let firstURL = try XCTUnwrap(WorkspaceServer.normalize("https://example.com/"))
         let otherURL = try XCTUnwrap(WorkspaceServer.normalize("https://example.com/other/"))

native/src-tauri/gen/apple/kanbangit-native.xcodeproj/project.pbxproj

@@ -22,7 +22,6 @@
 		B939982700E800053A9C7663 /* Security.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = DE3B71153677F722CAC6DCF7 /* Security.framework */; };
 		C362C102D4950A81D89BB8C8 /* WebKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 92EBA86D28BBFD1C822CC6F6 /* WebKit.framework */; };
 		C44BDCDEA454DBD106D51C9C /* WorkspaceViewController.swift in Sources */ = {isa = PBXBuildFile; fileRef = EE63F98563975EF4FF2A10FB /* WorkspaceViewController.swift */; };
-		C53E7EC983C008DF98244C74 /* InfoPlist.strings in Resources */ = {isa = PBXBuildFile; fileRef = 2AB6F9398EA3CB62A68287D2 /* InfoPlist.strings */; };
 		CD64D99EBD87E6FFC0C9001C /* MetalKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = D581BB90601D7A89F8F188E2 /* MetalKit.framework */; };
 		D8772A5E508092D6F831058A /* libapp.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 91991DFDB0C064B06DF854ED /* libapp.a */; };
 		EB37EAF992C1A156795CAEC0 /* CoreGraphics.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 0CF713E7BFE3F6B5BAA3550E /* CoreGraphics.framework */; };
@@ -46,7 +45,6 @@
 		23960010246A2A72E9940D3F /* kanbangit-native_iOS.app */ = {isa = PBXFileReference; includeInIndex = 0; lastKnownFileType = wrapper.application; path = "kanbangit-native_iOS.app"; sourceTree = BUILT_PRODUCTS_DIR; };
 		2B96972F58CC158AB3DFF94A /* lib.rs */ = {isa = PBXFileReference; path = lib.rs; sourceTree = "<group>"; };
 		31630170C358EA8657E34854 /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = Assets.xcassets; sourceTree = "<group>"; };
-		47C531812A31207F97A89C5F /* en */ = {isa = PBXFileReference; lastKnownFileType = text.plist.strings; name = en; path = en.lproj/InfoPlist.strings; sourceTree = "<group>"; };
 		4C76059D31C50B198779A5F7 /* en.lproj */ = {isa = PBXFileReference; path = en.lproj; sourceTree = "<group>"; };
 		554AB059B4228085924F4959 /* WorkspacePolicy.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WorkspacePolicy.swift; sourceTree = "<group>"; };
 		63685B1189795CAEA85F7AB7 /* QuartzCore.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = QuartzCore.framework; path = System/Library/Frameworks/QuartzCore.framework; sourceTree = SDKROOT; };
@@ -55,7 +53,6 @@
 		91991DFDB0C064B06DF854ED /* libapp.a */ = {isa = PBXFileReference; lastKnownFileType = archive.ar; path = libapp.a; sourceTree = "<group>"; };
 		92EBA86D28BBFD1C822CC6F6 /* WebKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = WebKit.framework; path = System/Library/Frameworks/WebKit.framework; sourceTree = SDKROOT; };
 		946BA5CC3FD90AD90D101A36 /* kanbangit-native_iOS.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = "kanbangit-native_iOS.entitlements"; sourceTree = "<group>"; };
-		9C56BE6890F0452F69D64795 /* android.rs */ = {isa = PBXFileReference; path = android.rs; sourceTree = "<group>"; };
 		9CAD0AE17A7966154CA29001 /* WorkspaceUITests.xctest */ = {isa = PBXFileReference; includeInIndex = 0; lastKnownFileType = wrapper.cfbundle; path = WorkspaceUITests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
 		A372EBDD353022BDB3E78972 /* WorkspaceTests.xctest */ = {isa = PBXFileReference; includeInIndex = 0; lastKnownFileType = wrapper.cfbundle; path = WorkspaceTests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
 		AEBAD9ABE758897C50BC1F2E /* locale.rs */ = {isa = PBXFileReference; path = locale.rs; sourceTree = "<group>"; };
@@ -140,7 +137,6 @@
 		335B1262A9019C70C7F887A5 /* src */ = {
 			isa = PBXGroup;
 			children = (
-				9C56BE6890F0452F69D64795 /* android.rs */,
 				05A753935B6CB0316DA56D96 /* desktop.rs */,
 				CAF08AD60D2F29A879CDAEBB /* ios.rs */,
 				2B96972F58CC158AB3DFF94A /* lib.rs */,
@@ -195,7 +191,6 @@
 				554AB059B4228085924F4959 /* WorkspacePolicy.swift */,
 				EE63F98563975EF4FF2A10FB /* WorkspaceViewController.swift */,
 				2A11A26F0082A5075CD710C6 /* bindings */,
-				2AB6F9398EA3CB62A68287D2 /* InfoPlist.strings */,
 				C8C02BC0E757897278EB954A /* Localizable.strings */,
 			);
 			path = "kanbangit-native";
@@ -304,7 +299,6 @@
 			buildActionMask = 2147483647;
 			files = (
 				0FAB3CC7BB466BFF871C0C30 /* Assets.xcassets in Resources */,
-				C53E7EC983C008DF98244C74 /* InfoPlist.strings in Resources */,
 				34C189B72A1B9EBE33D700D1 /* LaunchScreen.storyboard in Resources */,
 				A46344B6DF1B3A0F2798B751 /* Localizable.strings in Resources */,
 			);
@@ -376,14 +370,6 @@
 /* End PBXTargetDependency section */
 
 /* Begin PBXVariantGroup section */
-		2AB6F9398EA3CB62A68287D2 /* InfoPlist.strings */ = {
-			isa = PBXVariantGroup;
-			children = (
-				47C531812A31207F97A89C5F /* en */,
-			);
-			name = InfoPlist.strings;
-			sourceTree = "<group>";
-		};
 		C8C02BC0E757897278EB954A /* Localizable.strings */ = {
 			isa = PBXVariantGroup;
 			children = (

native/src-tauri/gen/apple/kanbangit-native_iOS/Info.plist

@@ -20,10 +20,6 @@
 	<string>0.1.0</string>
 	<key>LSRequiresIPhoneOS</key>
 	<true/>
-	<key>NSCameraUsageDescription</key>
-	<string>Choose a profile picture using your camera.</string>
-	<key>NSPhotoLibraryUsageDescription</key>
-	<string>Choose a profile picture from your photo library.</string>
 	<key>UILaunchStoryboardName</key>
 	<string>LaunchScreen</string>
 	<key>UIRequiredDeviceCapabilities</key>

native/src-tauri/gen/apple/project.yml

@@ -41,8 +41,6 @@ targets:
     info:
       path: kanbangit-native_iOS/Info.plist
       properties:
-        NSCameraUsageDescription: Choose a profile picture using your camera.
-        NSPhotoLibraryUsageDescription: Choose a profile picture from your photo library.
         LSRequiresIPhoneOS: true
         UILaunchStoryboardName: LaunchScreen
         UIRequiredDeviceCapabilities: [arm64, metal]

native/src-tauri/src/android.rs

@@ -1,22 +0,0 @@
-use tauri::{WebviewUrl, WebviewWindowBuilder};
-
-pub fn context<R: tauri::Runtime>() -> tauri::Context<R> {
-    tauri::generate_context!()
-}
-
-pub fn builder() -> tauri::Builder<tauri::Wry> {
-    tauri::Builder::default().setup(|app| {
-        WebviewWindowBuilder::new(app, "launcher", WebviewUrl::App("index.html".into()))
-            .use_https_scheme(true)
-            .on_navigation(|url| {
-                url.scheme() == "https"
-                    && url.host_str() == Some("tauri.localhost")
-                    && url.port().is_none()
-                    && url.username().is_empty()
-                    && url.password().is_none()
-                    && matches!(url.path(), "/" | "/index.html")
-            })
-            .build()?;
-        Ok(())
-    })
-}

native/src-tauri/src/desktop.rs

@@ -39,26 +39,6 @@ fn allows_server_navigation(server: &Url, destination: &Url) -> bool {
         && destination.password().is_none()
 }
 
-fn allows_external_navigation(destination: &Url) -> bool {
-    matches!(destination.scheme(), "https" | "http")
-        && destination.host_str().is_some()
-        && destination.username().is_empty()
-        && destination.password().is_none()
-}
-
-fn open_external(destination: &Url) {
-    if allows_external_navigation(destination) {
-        // Arguments are passed directly to Launch Services, never through a shell.
-        let destination = destination.to_string();
-        std::thread::spawn(move || {
-            let _ = std::process::Command::new("/usr/bin/open")
-                .arg("--")
-                .arg(destination)
-                .status();
-        });
-    }
-}
-
 fn allows_launcher_navigation(destination: &Url) -> bool {
     destination.scheme() == "tauri"
         && destination.host_str() == Some("localhost")
@@ -166,9 +146,6 @@ fn open_workspace(app: &AppHandle, input: &str) -> Result<(), &'static str> {
     let handle = app.clone();
     let navigation_label = label.clone();
     let server_url = server.url.clone();
-    let popup_server = server_url.clone();
-    let popup_handle = app.clone();
-    let popup_label = label.clone();
     let window = WebviewWindowBuilder::new(app, &label, WebviewUrl::External(server.url))
         .title(en::APP_NAME)
         .inner_size(1280.0, 850.0)
@@ -178,22 +155,12 @@ fn open_workspace(app: &AppHandle, input: &str) -> Result<(), &'static str> {
         .data_store_identifier(server.profile)
         .on_navigation(move |destination| {
             if !allows_server_navigation(&server_url, destination) {
-                open_external(destination);
                 return false;
             }
             begin_navigation(&handle, &navigation_label);
             true
         })
-        .on_new_window(move |destination, _| {
-            if allows_server_navigation(&popup_server, &destination) {
-                if let Some(window) = popup_handle.get_webview_window(&popup_label) {
-                    let _ = window.navigate(destination);
-                }
-            } else {
-                open_external(&destination);
-            }
-            NewWindowResponse::Deny
-        })
+        .on_new_window(|_, _| NewWindowResponse::Deny)
         .on_page_load(|window, payload| {
             if payload.event() != PageLoadEvent::Finished {
                 return;
@@ -310,31 +277,11 @@ pub fn builder() -> tauri::Builder<tauri::Wry> {
                     .select_all()
                     .build()?,
             )
-            .item(
-                &SubmenuBuilder::new(app, en::NAVIGATION)
-                    .text("workspace-back", en::BACK)
-                    .text("workspace-forward", en::FORWARD)
-                    .build()?,
-            )
             .build()?;
         app.set_menu(menu)?;
         app.on_menu_event(|app, event| {
             if event.id().as_ref() == "server-settings" {
                 show_launcher(app);
-            } else if let Some(script) = match event.id().as_ref() {
-                "workspace-back" => Some("window.history.back()"),
-                "workspace-forward" => Some("window.history.forward()"),
-                _ => None,
-            } {
-                let label = app
-                    .state::<Mutex<Connection>>()
-                    .lock()
-                    .unwrap()
-                    .label
-                    .clone();
-                if let Some(window) = label.and_then(|label| app.get_webview_window(&label)) {
-                    let _ = window.eval(script);
-                }
             }
         });
         let handle = app.handle().clone();
@@ -400,26 +347,6 @@ pub fn builder() -> tauri::Builder<tauri::Wry> {
 mod tests {
     use super::*;
 
-    #[test]
-    fn external_links_accept_only_web_urls_without_credentials() {
-        for input in [
-            "https://git.example.com/org/repo/pulls/1#diff",
-            "http://git.example.com/repo",
-        ] {
-            assert!(allows_external_navigation(&Url::parse(input).unwrap()));
-        }
-        for input in [
-            "https://user:secret@git.example.com/",
-            "file:///etc/passwd",
-            "javascript:alert(1)",
-            "tauri://localhost/action/open",
-            "mailto:user@example.com",
-            "data:text/html,test",
-        ] {
-            assert!(!allows_external_navigation(&Url::parse(input).unwrap()));
-        }
-    }
-
     #[test]
     fn navigation_is_limited_to_the_selected_https_origin() {
         let server = validate_url("https://example.com:8443/app/").unwrap();

native/src-tauri/src/lib.rs

@@ -1,17 +1,13 @@
-#[cfg(target_os = "android")]
-mod android;
-#[cfg(not(any(target_os = "android", target_os = "ios")))]
+#[cfg(not(target_os = "ios"))]
 mod desktop;
 #[cfg(target_os = "ios")]
 mod ios;
-#[cfg(not(any(target_os = "android", target_os = "ios")))]
+#[cfg(not(target_os = "ios"))]
 mod locale;
-#[cfg(not(any(target_os = "android", target_os = "ios")))]
+#[cfg(not(target_os = "ios"))]
 mod server;
 
-#[cfg(target_os = "android")]
-pub use android::{builder, context};
-#[cfg(not(any(target_os = "android", target_os = "ios")))]
+#[cfg(not(target_os = "ios"))]
 pub use desktop::{builder, context};
 #[cfg(target_os = "ios")]
 pub use ios::{builder, context};

native/src-tauri/src/locale.rs

@@ -1,8 +1,5 @@
 pub mod en {
     pub const APP_NAME: &str = "KanbanGit";
     pub const SERVER_SETTINGS: &str = "Server settings…";
-    pub const NAVIGATION: &str = "Navigation";
-    pub const BACK: &str = "Back";
-    pub const FORWARD: &str = "Forward";
     pub const EDIT: &str = "Edit";
 }

native/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
     "$schema": "https://schema.tauri.app/config/2",
     "productName": "KanbanGit",
-    "version": "0.1.1",
+    "version": "0.1.0",
     "identifier": "de.kanbangit.desktop",
     "build": {
         "frontendDist": "../ui"

native/tests/macos-ci.test.js

@@ -1,193 +0,0 @@
-import assert from 'node:assert/strict';
-import {
-    existsSync,
-    mkdirSync,
-    mkdtempSync,
-    readFileSync,
-    rmSync,
-    writeFileSync,
-} from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import test from 'node:test';
-import {
-    packageNotarizedApp,
-    releaseMetadata,
-    verifyNotarizedApp,
-} from '../macos-ci.mjs';
-
-function fixture(t) {
-    const directory = mkdtempSync(join(tmpdir(), 'kanbangit-ci-test-'));
-    t.after(() => rmSync(directory, { recursive: true, force: true }));
-    mkdirSync(join(directory, 'src-tauri'));
-    const config = {
-        version: '1.2.3',
-        productName: 'KanbanGit',
-        identifier: 'de.kanbangit.desktop',
-    };
-    writeFileSync(
-        join(directory, 'src-tauri/tauri.conf.json'),
-        JSON.stringify(config),
-    );
-    writeFileSync(
-        join(directory, 'package.json'),
-        JSON.stringify({ version: '1.2.3' }),
-    );
-    writeFileSync(
-        join(directory, 'src-tauri/Cargo.toml'),
-        '[package]\nname = "kanbangit-native"\nversion = "1.2.3"\n[dependencies]\nother = "2"\n',
-    );
-    const env = {
-        RELEASE_TAG: 'macos-v1.2.3',
-        APPLE_SIGNING_IDENTITY:
-            'Developer ID Application: Example (ZZX2KZGTHU)',
-    };
-    const calls = [];
-    const run = (command, args) => {
-        calls.push({ command, args });
-        if (command === 'codesign' && args.includes('--display')) {
-            return 'CodeDirectory flags=0x10000(runtime)\nCDHash=abcdef123456';
-        }
-        if (command === 'plutil') {
-            return '1.2.3';
-        }
-        if (command === 'lipo') {
-            return 'arm64';
-        }
-        if (command === 'ditto' && args.includes('-c')) {
-            writeFileSync(args.at(-1), 'notarized archive');
-        }
-        return '';
-    };
-    return { directory, env, config, run, calls };
-}
-
-test('release metadata binds tag, all app versions, identity and architecture', (t) => {
-    const f = fixture(t);
-    assert.deepEqual(releaseMetadata(f.env, f.directory), {
-        version: '1.2.3',
-        target: 'aarch64-apple-darwin',
-        arch: 'arm64',
-        filename: 'KanbanGit-1.2.3-aarch64-apple-darwin.zip',
-    });
-    assert.equal(
-        releaseMetadata(
-            { ...f.env, MACOS_RELEASE_TARGET: 'x86_64-apple-darwin' },
-            f.directory,
-        ).arch,
-        'x86_64',
-    );
-});
-
-for (const env of [
-    { RELEASE_TAG: 'v1.2.3' },
-    { RELEASE_TAG: 'macos-v1.2.4' },
-    { RELEASE_TAG: 'macos-v1.2.3; echo bad' },
-    { MACOS_RELEASE_TARGET: 'x86_64-unknown-linux-gnu' },
-    { APPLE_SIGNING_IDENTITY: '-' },
-    { APPLE_SIGNING_IDENTITY: 'Apple Development: Example (ZZX2KZGTHU)' },
-    {
-        APPLE_SIGNING_IDENTITY:
-            'Developer ID Application: Example (OLDTEAM123)',
-    },
-]) {
-    test(`rejects invalid release inputs ${JSON.stringify(env)}`, (t) => {
-        const f = fixture(t);
-        assert.throws(() => releaseMetadata({ ...f.env, ...env }, f.directory));
-    });
-}
-
-for (const [file, contents] of [
-    ['package.json', '{"version":"1.2.4"}'],
-    ['src-tauri/Cargo.toml', '[package]\nversion = "1.2.4"'],
-    ['src-tauri/tauri.conf.json', '{"version":"01.2.3"}'],
-    [
-        'src-tauri/tauri.conf.json',
-        '{"version":"1.2.3","identifier":"other","productName":"KanbanGit"}',
-    ],
-]) {
-    test(`rejects inconsistent metadata in ${file}: ${contents}`, (t) => {
-        const f = fixture(t);
-        writeFileSync(join(f.directory, file), contents);
-        assert.throws(() => releaseMetadata(f.env, f.directory));
-    });
-}
-
-test('packages only a verified app and checks the extracted download again', (t) => {
-    const f = fixture(t);
-    const output = packageNotarizedApp(f);
-    assert.equal(
-        readFileSync(join(output.directory, output.filename), 'utf8'),
-        'notarized archive',
-    );
-    assert.equal(
-        readFileSync(
-            join(output.directory, `${output.filename}.sha256`),
-            'utf8',
-        ),
-        `${output.checksum}  ${output.filename}\n`,
-    );
-    assert.equal(f.calls.filter((call) => call.command === 'spctl').length, 2);
-    assert.equal(f.calls.filter((call) => call.command === 'xcrun').length, 2);
-    assert.match(
-        f.calls.findLast((call) => call.command === 'spctl').args.at(-1),
-        /extracted\/KanbanGit\.app$/,
-    );
-    assert.throws(() => packageNotarizedApp(f), /already exists/);
-});
-
-for (const failure of ['codesign', 'lipo', 'xcrun', 'spctl', 'ditto']) {
-    test(`does not publish local output when ${failure} verification fails`, (t) => {
-        const f = fixture(t);
-        const run = f.run;
-        f.run = (command, args) => {
-            if (command === failure) {
-                throw new Error('verification failed');
-            }
-            return run(command, args);
-        };
-        assert.throws(() => packageNotarizedApp(f), /verification failed/);
-        assert.equal(
-            existsSync(
-                join(
-                    f.directory,
-                    'src-tauri/target/macos-release/1.2.3-aarch64-apple-darwin',
-                ),
-            ),
-            false,
-        );
-    });
-}
-
-test('rejects an app built for a different architecture', (t) => {
-    const f = fixture(t);
-    const metadata = releaseMetadata(f.env, f.directory);
-    assert.throws(
-        () =>
-            verifyNotarizedApp('KanbanGit.app', metadata, (command, args) =>
-                command === 'lipo' ? 'x86_64' : f.run(command, args),
-            ),
-        /architecture/,
-    );
-});
-
-test('failed validation of the extracted app discards staged download', (t) => {
-    const f = fixture(t);
-    const run = f.run;
-    f.run = (command, args) => {
-        if (command === 'spctl' && args.at(-1).includes('extracted/')) {
-            throw new Error('roundtrip invalid');
-        }
-        return run(command, args);
-    };
-    assert.throws(() => packageNotarizedApp(f), /roundtrip invalid/);
-    assert.equal(
-        existsSync(
-            join(
-                f.directory,
-                'src-tauri/target/macos-release/1.2.3-aarch64-apple-darwin',
-            ),
-        ),
-        false,
-    );
-});

native/tests/macos-release.test.js

@@ -1,554 +0,0 @@
-import assert from 'node:assert/strict';
-import { createHash } from 'node:crypto';
-import {
-    existsSync,
-    mkdirSync,
-    mkdtempSync,
-    readFileSync,
-    readdirSync,
-    rmSync,
-    writeFileSync,
-} from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import test from 'node:test';
-import { releaseMacos } from '../release-macos.mjs';
-
-const identity = 'Developer ID Application: Example Developer (ZZX2KZGTHU)';
-const submissionId = '3aa7effe-4333-4b03-925c-78427354a3e6';
-const cdhash = 'a3850211578ca9130445ec77918a619778cb465d';
-
-function fixture(t, overrides = {}) {
-    const directory = mkdtempSync(join(tmpdir(), 'kanbangit-release-test-'));
-    t.after(() => rmSync(directory, { recursive: true, force: true }));
-    const config = {
-        productName: 'KanbanGit',
-        identifier: 'de.kanbangit.desktop',
-        version: '1.2.3',
-    };
-    const configPath = join(directory, 'src-tauri/tauri.conf.json');
-    mkdirSync(dirname(configPath), { recursive: true });
-    writeFileSync(configPath, JSON.stringify(config));
-
-    const calls = [];
-    const releaseDirectory = join(directory, 'src-tauri/target/macos-release');
-    const destination = join(releaseDirectory, '1.2.3-aarch64-apple-darwin');
-    let stapled = false;
-    const options = {
-        directory,
-        platform: 'darwin',
-        arch: 'arm64',
-        log() {},
-        env: {
-            APPLE_SIGNING_IDENTITY: identity,
-            APPLE_NOTARY_KEYCHAIN_PROFILE: 'kanbangit-notary',
-        },
-        run(command, args, settings) {
-            calls.push({ command, args, settings });
-
-            if (overrides.failStep === settings.step) {
-                throw new Error('Simulated external failure');
-            }
-
-            if (command === 'security') {
-                return (
-                    overrides.identities ??
-                    `1) ABCDEF "${identity}"\n1 valid identities found`
-                );
-            }
-
-            if (command === 'pnpm' && !overrides.missingApp) {
-                const target = args[args.indexOf('--target') + 1];
-                mkdirSync(
-                    join(
-                        directory,
-                        'src-tauri/target',
-                        target,
-                        'release/bundle/macos/KanbanGit.app',
-                    ),
-                    { recursive: true },
-                );
-            }
-
-            if (command === 'codesign' && args.includes('--display')) {
-                return (
-                    overrides.signature ??
-                    `CodeDirectory v=20500 size=1024 flags=0x10000(runtime) hashes=10\nCDHash=${cdhash}`
-                );
-            }
-
-            if (command === 'plutil') {
-                return overrides.version ?? '1.2.3';
-            }
-
-            if (
-                command === 'xcrun' &&
-                args[0] === 'notarytool' &&
-                args[1] === 'submit'
-            ) {
-                return (
-                    overrides.submissionResult ??
-                    JSON.stringify({ id: submissionId })
-                );
-            }
-
-            if (
-                command === 'xcrun' &&
-                args[0] === 'notarytool' &&
-                args[1] === 'wait'
-            ) {
-                return (
-                    overrides.notaryResult ??
-                    JSON.stringify({ status: 'Accepted', id: submissionId })
-                );
-            }
-
-            if (
-                command === 'xcrun' &&
-                args[0] === 'notarytool' &&
-                args[1] === 'log'
-            ) {
-                return (
-                    overrides.notaryLog ??
-                    JSON.stringify({
-                        jobId: submissionId,
-                        status: 'Accepted',
-                        issues: null,
-                        ticketContents: [
-                            {
-                                path: 'notarization.zip/KanbanGit.app',
-                                cdhash,
-                                arch:
-                                    options.env.MACOS_RELEASE_TARGET ===
-                                    'x86_64-apple-darwin'
-                                        ? 'x86_64'
-                                        : 'arm64',
-                            },
-                        ],
-                    })
-                );
-            }
-
-            if (
-                command === 'xcrun' &&
-                args[0] === 'stapler' &&
-                args[1] === 'staple'
-            ) {
-                stapled = true;
-            }
-
-            if (command === 'ditto') {
-                writeFileSync(
-                    args.at(-1),
-                    stapled
-                        ? 'archive with stapled ticket'
-                        : 'archive before notarization',
-                );
-            }
-
-            return '';
-        },
-    };
-
-    return {
-        options,
-        calls,
-        config,
-        configPath,
-        releaseDirectory,
-        destination,
-    };
-}
-
-test('publishes only the stapled app archive with its exact SHA-256 checksum after verification', (t) => {
-    const f = fixture(t);
-    const result = releaseMacos(f.options);
-    const contents = readFileSync(result.archive, 'utf8');
-    assert.equal(contents, 'archive with stapled ticket');
-    assert.equal(
-        result.checksum,
-        createHash('sha256').update(contents).digest('hex'),
-    );
-    assert.equal(
-        readFileSync(`${result.archive}.sha256`, 'utf8'),
-        `${result.checksum}  KanbanGit-1.2.3-aarch64-apple-darwin.zip\n`,
-    );
-    assert.deepEqual(readdirSync(f.destination).sort(), [
-        'KanbanGit-1.2.3-aarch64-apple-darwin.zip',
-        'KanbanGit-1.2.3-aarch64-apple-darwin.zip.sha256',
-    ]);
-    assert.deepEqual(readdirSync(f.releaseDirectory), [
-        '1.2.3-aarch64-apple-darwin',
-    ]);
-    const labels = f.calls.map((call) => call.settings.step);
-    assert.ok(
-        labels.indexOf('Checking Gatekeeper acceptance') <
-            labels.indexOf('Packaging notarized download'),
-    );
-    const verify = f.calls.find((call) => call.args.includes('-R'));
-    assert.ok(verify.args.includes('--strict'));
-    assert.ok(verify.args.includes('--deep'));
-    assert.match(
-        verify.args[verify.args.indexOf('-R') + 1],
-        /anchor apple generic.*de\.kanbangit\.desktop.*ZZX2KZGTHU.*1\.2\.840\.113635\.100\.6\.1\.13/,
-    );
-});
-
-for (const [name, env, expected] of [
-    [
-        'missing identity',
-        { APPLE_SIGNING_IDENTITY: '' },
-        /APPLE_SIGNING_IDENTITY/,
-    ],
-    [
-        'ad hoc identity',
-        { APPLE_SIGNING_IDENTITY: '-' },
-        /Developer ID Application/,
-    ],
-    [
-        'development certificate',
-        { APPLE_SIGNING_IDENTITY: 'Apple Development: Example (ZZX2KZGTHU)' },
-        /Developer ID Application/,
-    ],
-    [
-        'old team certificate',
-        {
-            APPLE_SIGNING_IDENTITY:
-                'Developer ID Application: Example (OLDTEAM123)',
-        },
-        /ZZX2KZGTHU/,
-    ],
-    ['old team environment', { APPLE_TEAM_ID: 'OLDTEAM123' }, /APPLE_TEAM_ID/],
-    [
-        'missing notary profile',
-        { APPLE_NOTARY_KEYCHAIN_PROFILE: '  ' },
-        /APPLE_NOTARY_KEYCHAIN_PROFILE/,
-    ],
-    [
-        'unsupported target',
-        { MACOS_RELEASE_TARGET: 'aarch64-apple-ios' },
-        /MACOS_RELEASE_TARGET/,
-    ],
-]) {
-    test(`${name} fails before running external commands`, (t) => {
-        const f = fixture(t);
-        Object.assign(f.options.env, env);
-        assert.throws(() => releaseMacos(f.options), expected);
-        assert.equal(f.calls.length, 0);
-        assert.equal(existsSync(f.destination), false);
-    });
-}
-
-test('does not allow a non-macOS host', (t) => {
-    const f = fixture(t);
-    assert.throws(
-        () => releaseMacos({ ...f.options, platform: 'linux' }),
-        /require a Mac/,
-    );
-    assert.equal(f.calls.length, 0);
-});
-
-for (const change of [
-    { identifier: 'de.oldteam.app' },
-    { productName: '../Other' },
-    { version: '../outside' },
-    { version: '1.2.3-beta.1' },
-    { version: '01.2.3' },
-]) {
-    test(`rejects inconsistent release configuration ${JSON.stringify(change)}`, (t) => {
-        const f = fixture(t);
-        writeFileSync(f.configPath, JSON.stringify({ ...f.config, ...change }));
-        assert.throws(() => releaseMacos(f.options), /release/);
-        assert.equal(f.calls.length, 0);
-    });
-}
-
-test('requires the exact installed signing identity before building', (t) => {
-    const f = fixture(t, { identities: '0 valid identities found' });
-    assert.throws(() => releaseMacos(f.options), /including its private key/);
-    assert.equal(f.calls.length, 1);
-});
-
-test('validates notarization access before the build', (t) => {
-    const f = fixture(t, {
-        failStep:
-            'Checking notarization access (check the keychain profile if this fails)',
-    });
-    assert.throws(() => releaseMacos(f.options), /external failure/);
-    assert.equal(
-        f.calls.some((call) => call.command === 'pnpm'),
-        false,
-    );
-});
-
-test('pins release signing, hardening and target directory without inheriting unrelated Apple credentials', (t) => {
-    const f = fixture(t);
-    Object.assign(f.options.env, {
-        APPLE_ID: 'old-account@example.test',
-        APPLE_PASSWORD: 'must-not-be-passed',
-        APPLE_API_KEY: 'old-key',
-        APPLE_CERTIFICATE: 'old-certificate',
-        APPLE_TEAM_ID: 'ZZX2KZGTHU',
-        TAURI_CONFIG: '{"bundle":{"macOS":{"hardenedRuntime":false}}}',
-        CARGO_TARGET_DIR: '/other-build',
-        APPLE_NOTARY_KEYCHAIN: '/ci/release.keychain-db',
-    });
-    const originalEnv = { ...f.options.env };
-    releaseMacos(f.options);
-    assert.deepEqual(f.options.env, originalEnv);
-    const build = f.calls.find((call) => call.command === 'pnpm');
-    assert.equal(build.args.includes('--debug'), false);
-    assert.deepEqual(build.args.slice(-2), ['--', '--locked']);
-    assert.deepEqual(
-        JSON.parse(build.args[build.args.indexOf('--config') + 1]),
-        {
-            bundle: {
-                createUpdaterArtifacts: false,
-                macOS: { signingIdentity: identity, hardenedRuntime: true },
-            },
-        },
-    );
-    assert.equal(build.settings.env.APPLE_SIGNING_IDENTITY, identity);
-    assert.equal(
-        build.settings.env.CARGO_TARGET_DIR,
-        join(f.options.directory, 'src-tauri/target'),
-    );
-    for (const key of [
-        'APPLE_ID',
-        'APPLE_PASSWORD',
-        'APPLE_API_KEY',
-        'APPLE_CERTIFICATE',
-        'TAURI_CONFIG',
-    ]) {
-        assert.equal(build.settings.env[key], undefined);
-    }
-    for (const call of f.calls.filter(
-        (call) => call.args[0] === 'notarytool',
-    )) {
-        assert.equal(
-            call.args[call.args.indexOf('--keychain-profile') + 1],
-            'kanbangit-notary',
-        );
-        assert.equal(
-            call.args[call.args.indexOf('--keychain') + 1],
-            '/ci/release.keychain-db',
-        );
-    }
-});
-
-test('supports an explicit Intel target with distinct output naming', (t) => {
-    const f = fixture(t);
-    f.options.env.MACOS_RELEASE_TARGET = 'x86_64-apple-darwin';
-    const result = releaseMacos(f.options);
-    assert.equal(result.target, 'x86_64-apple-darwin');
-    assert.match(
-        result.archive,
-        /1\.2\.3-x86_64-apple-darwin\/KanbanGit-1\.2\.3-x86_64-apple-darwin\.zip$/,
-    );
-});
-
-for (const [name, override, expected] of [
-    ['missing app', { missingApp: true }, /did not produce/],
-    [
-        'missing hardened runtime',
-        { signature: 'CodeDirectory flags=0x0(none)' },
-        /Hardened Runtime/,
-    ],
-    ['mismatched version', { version: '0.9.0' }, /version/],
-]) {
-    test(`${name} prevents submission to Apple`, (t) => {
-        const f = fixture(t, override);
-        assert.throws(() => releaseMacos(f.options), expected);
-        assert.equal(
-            f.calls.some((call) => call.args[1] === 'submit'),
-            false,
-        );
-        assert.equal(existsSync(f.destination), false);
-    });
-}
-
-for (const failStep of [
-    'Building signed macOS release',
-    'Verifying Developer ID signature and team',
-    'Preparing notarization archive',
-    'Submitting to Apple',
-    'Waiting for Apple notarization',
-    'Checking Apple notarization log',
-    'Stapling notarization ticket',
-    'Validating notarization ticket',
-    'Verifying final app signature',
-    'Checking Gatekeeper acceptance',
-    'Packaging notarized download',
-]) {
-    test(`${failStep} failure never publishes a download`, (t) => {
-        const f = fixture(t, { failStep });
-        assert.throws(() => releaseMacos(f.options), /external failure/);
-        assert.equal(existsSync(f.destination), false);
-        if (existsSync(f.releaseDirectory)) {
-            assert.deepEqual(readdirSync(f.releaseDirectory), []);
-        }
-    });
-}
-
-for (const notaryResult of [
-    '{"status":"Invalid","id":"rejected-id"}',
-    '{"status":"In Progress","id":"pending-id"}',
-    '{"id":"no-status"}',
-    'not valid JSON',
-]) {
-    test(`unaccepted notarization prevents stapling and publication: ${notaryResult}`, (t) => {
-        const f = fixture(t, { notaryResult });
-        assert.throws(() => releaseMacos(f.options));
-        assert.equal(
-            f.calls.some((call) => call.args[0] === 'stapler'),
-            false,
-        );
-        assert.equal(existsSync(f.destination), false);
-        assert.deepEqual(readdirSync(f.releaseDirectory), []);
-    });
-}
-
-test('never overwrites an existing verified release', (t) => {
-    const f = fixture(t);
-    const result = releaseMacos(f.options);
-    const original = readFileSync(result.archive);
-    f.calls.length = 0;
-    assert.throws(() => releaseMacos(f.options), /already exists/);
-    assert.deepEqual(readFileSync(result.archive), original);
-    assert.equal(f.calls.length, 0);
-});
-
-test('persists submission ID on timeout and resumes the same app without rebuilding or uploading', (t) => {
-    const overrides = { failStep: 'Waiting for Apple notarization' };
-    const f = fixture(t, overrides);
-    assert.throws(
-        () => releaseMacos(f.options),
-        new RegExp(`Apple may still be processing.*--resume ${submissionId}`),
-    );
-    const record = JSON.parse(
-        readFileSync(
-            join(
-                f.options.directory,
-                'src-tauri/target',
-                `notarization-${submissionId}.submission.json`,
-            ),
-            'utf8',
-        ),
-    );
-    assert.deepEqual(record, {
-        submissionId,
-        version: '1.2.3',
-        target: 'aarch64-apple-darwin',
-        cdhash,
-    });
-    assert.equal(existsSync(f.destination), false);
-    overrides.failStep = null;
-    f.calls.length = 0;
-    const result = releaseMacos({
-        ...f.options,
-        resumeSubmissionId: submissionId,
-    });
-    assert.equal(
-        readFileSync(result.archive, 'utf8'),
-        'archive with stapled ticket',
-    );
-    assert.equal(
-        f.calls.some(
-            (call) => call.command === 'pnpm' || call.args[1] === 'submit',
-        ),
-        false,
-    );
-    assert.equal(
-        f.calls.find((call) => call.args[1] === 'wait').args[2],
-        submissionId,
-    );
-});
-
-test('rejects invalid resume arguments before any commands', (t) => {
-    const f = fixture(t);
-    assert.throws(
-        () => releaseMacos({ ...f.options, resumeSubmissionId: '--invalid' }),
-        /submission UUID/,
-    );
-    assert.equal(f.calls.length, 0);
-});
-
-test('resume never rebuilds a missing previously submitted app', (t) => {
-    const f = fixture(t);
-    assert.throws(
-        () => releaseMacos({ ...f.options, resumeSubmissionId: submissionId }),
-        /did not produce/,
-    );
-    assert.equal(
-        f.calls.some(
-            (call) => call.command === 'pnpm' || call.args[1] === 'submit',
-        ),
-        false,
-    );
-});
-
-for (const submissionResult of ['{}', '{"id":"not-a-uuid"}', 'invalid JSON']) {
-    test(`invalid submission response cannot continue: ${submissionResult}`, (t) => {
-        const f = fixture(t, { submissionResult });
-        assert.throws(() => releaseMacos(f.options));
-        assert.equal(
-            f.calls.some(
-                (call) => call.args[1] === 'wait' || call.args[0] === 'stapler',
-            ),
-            false,
-        );
-        assert.equal(existsSync(f.destination), false);
-    });
-}
-
-for (const change of [
-    { jobId: '00000000-0000-0000-0000-000000000000' },
-    { status: 'Invalid' },
-    { ticketContents: [] },
-    {
-        ticketContents: [
-            {
-                path: 'notarization.zip/KanbanGit.app',
-                cdhash: 'different-code',
-                arch: 'arm64',
-            },
-        ],
-    },
-    {
-        ticketContents: [
-            { path: 'notarization.zip/KanbanGit.app', cdhash, arch: 'x86_64' },
-        ],
-    },
-    {
-        ticketContents: [
-            { path: 'notarization.zip/Other.app', cdhash, arch: 'arm64' },
-        ],
-    },
-    { issues: [{ severity: 'warning', message: 'Review this warning' }] },
-]) {
-    test(`Apple log must approve the exact app without outstanding issues: ${JSON.stringify(change)}`, (t) => {
-        const notaryLog = JSON.stringify({
-            jobId: submissionId,
-            status: 'Accepted',
-            issues: null,
-            ticketContents: [
-                {
-                    path: 'notarization.zip/KanbanGit.app',
-                    cdhash,
-                    arch: 'arm64',
-                },
-            ],
-            ...change,
-        });
-        const f = fixture(t, { notaryLog });
-        assert.throws(
-            () => releaseMacos(f.options),
-            /does not match|notarization issues/,
-        );
-        assert.equal(
-            f.calls.some((call) => call.args[0] === 'stapler'),
-            false,
-        );
-        assert.equal(existsSync(f.destination), false);
-    });
-}

native/tests/macos-workflow.test.js

@@ -1,161 +0,0 @@
-import assert from 'node:assert/strict';
-import { spawnSync } from 'node:child_process';
-import {
-    mkdirSync,
-    mkdtempSync,
-    readFileSync,
-    rmSync,
-    writeFileSync,
-} from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import process from 'node:process';
-import test from 'node:test';
-
-const workflow = readFileSync(
-    new URL('../../.github/workflows/macos-release.yml', import.meta.url),
-    'utf8',
-);
-const selectRef = workflow
-    .split(
-        '      - name: Select an existing version tag contained in main\n',
-    )[1]
-    .split('\n      - name:')[0]
-    .split('        run: |\n')[1]
-    .split('\n')
-    .map((line) => line.replace(/^ {10}/, ''))
-    .join('\n');
-
-function fixture(t) {
-    const directory = mkdtempSync(join(tmpdir(), 'kanbangit-release-ref-'));
-    t.after(() => rmSync(directory, { recursive: true, force: true }));
-    const remote = join(directory, 'remote');
-    const checkout = join(directory, 'checkout');
-    mkdirSync(remote);
-    const env = {
-        ...process.env,
-        GIT_AUTHOR_NAME: 'Release test',
-        GIT_COMMITTER_NAME: 'Release test',
-        GIT_AUTHOR_EMAIL: 'release@example.invalid',
-        GIT_COMMITTER_EMAIL: 'release@example.invalid',
-        GIT_CONFIG_NOSYSTEM: '1',
-        GIT_CONFIG_GLOBAL: '/dev/null',
-    };
-    const git = (cwd, ...args) => {
-        const result = spawnSync('git', args, { cwd, env, encoding: 'utf8' });
-        assert.equal(result.status, 0, result.stderr);
-        return result.stdout.trim();
-    };
-    git(remote, 'init', '-b', 'main');
-    writeFileSync(join(remote, 'app.txt'), 'release');
-    git(remote, 'add', 'app.txt');
-    git(remote, '-c', 'commit.gpgsign=false', 'commit', '-m', 'Release');
-    const commit = git(remote, 'rev-parse', 'HEAD');
-    git(remote, 'tag', 'macos-v1.2.3');
-    git(directory, 'clone', remote, checkout);
-    const output = join(directory, 'outputs');
-    const run = (overrides = {}) => {
-        writeFileSync(output, '');
-        const result = spawnSync(
-            'bash',
-            ['--noprofile', '--norc', '-c', selectRef],
-            {
-                cwd: checkout,
-                encoding: 'utf8',
-                env: {
-                    ...env,
-                    GITHUB_EVENT_NAME: 'push',
-                    GITHUB_REF: 'refs/tags/macos-v1.2.3',
-                    REQUESTED_TAG: '',
-                    MACOS_RUNNER: 'macos-local',
-                    GITHUB_OUTPUT: output,
-                    ...overrides,
-                },
-            },
-        );
-        return { ...result, output: readFileSync(output, 'utf8') };
-    };
-    return { run, git, checkout, commit };
-}
-
-test('release selection succeeds using Git alone without an administrative API token', (t) => {
-    const f = fixture(t);
-    const result = f.run({
-        GITEA_TOKEN: '',
-        GITHUB_TOKEN: '',
-        GITHUB_API_URL: 'http://127.0.0.1:1',
-    });
-    assert.equal(result.status, 0, result.stderr);
-    assert.equal(result.output, `commit=${f.commit}\ntag=macos-v1.2.3\n`);
-    assert.equal(f.git(f.checkout, 'rev-parse', 'HEAD'), f.commit);
-});
-
-test('macOS scheduling uses a repository variable while release steps remain gated by preparation', () => {
-    const release = workflow.split('\n  release:\n')[1];
-    const runner = release.match(/^ {4}runs-on: (.+)$/m)?.[1];
-    assert.equal(runner, '${{ vars.MACOS_RUNNER }}');
-    assert.match(release, /^ {4}needs: prepare$/m);
-    assert.match(release, /ref: \$\{\{ needs\.prepare\.outputs\.commit \}\}/);
-    assert.match(
-        release,
-        /RELEASE_TAG: \$\{\{ needs\.prepare\.outputs\.tag \}\}/,
-    );
-});
-
-test('manual release on main accepts an existing tag without moving it', (t) => {
-    const f = fixture(t);
-    const result = f.run({
-        GITHUB_EVENT_NAME: 'workflow_dispatch',
-        GITHUB_REF: 'refs/heads/main',
-        REQUESTED_TAG: 'macos-v1.2.3',
-    });
-    assert.equal(result.status, 0, result.stderr);
-    assert.equal(f.git(f.checkout, 'rev-parse', 'macos-v1.2.3'), f.commit);
-});
-
-for (const [name, overrides] of [
-    ['web release tag', { GITHUB_REF: 'refs/tags/v1.2.3' }],
-    ['missing tag', { GITHUB_REF: 'refs/tags/macos-v9.9.9' }],
-    [
-        'shell characters in tag',
-        { GITHUB_REF: 'refs/tags/macos-v1.2.3;exit 0' },
-    ],
-    ['missing runner label', { MACOS_RUNNER: '' }],
-    [
-        'output injection in runner label',
-        { MACOS_RUNNER: 'macos-local\ncommit=other' },
-    ],
-    [
-        'manual release outside main',
-        {
-            GITHUB_EVENT_NAME: 'workflow_dispatch',
-            GITHUB_REF: 'refs/heads/feature',
-            REQUESTED_TAG: 'macos-v1.2.3',
-        },
-    ],
-]) {
-    test(`release selection rejects ${name} before producing job outputs`, (t) => {
-        const result = fixture(t).run(overrides);
-        assert.notEqual(result.status, 0);
-        assert.equal(result.output, '');
-    });
-}
-
-test('release selection rejects a tag whose commit is outside main', (t) => {
-    const f = fixture(t);
-    f.git(f.checkout, 'switch', '-c', 'unmerged');
-    f.git(
-        f.checkout,
-        '-c',
-        'commit.gpgsign=false',
-        'commit',
-        '--allow-empty',
-        '-m',
-        'Unmerged',
-    );
-    f.git(f.checkout, 'tag', 'macos-v1.2.4');
-    const result = f.run({ GITHUB_REF: 'refs/tags/macos-v1.2.4' });
-    assert.notEqual(result.status, 0);
-    assert.match(result.stderr, /Release tag must belong to main/);
-    assert.equal(result.output, '');
-});

native/tests/mobile-launcher.test.js

@@ -1,89 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-
-class Element {
-    constructor() {
-        this.events = {};
-        this.attributes = {};
-        this.dataset = {};
-        this.hidden = true;
-        this.value = '';
-    }
-    addEventListener(name, callback) {
-        this.events[name] = callback;
-    }
-    setAttribute(name, value) {
-        this.attributes[name] = value;
-    }
-    removeAttribute(name) {
-        delete this.attributes[name];
-    }
-    focus() {}
-    fire(name) {
-        this.events[name]({ preventDefault() {}, target: this });
-    }
-}
-
-test('Android launcher sends only explicit local actions and preserves switch confirmation', async () => {
-    const elements = new Map();
-    const element = (selector) => {
-        if (!elements.has(selector)) {
-            elements.set(selector, new Element());
-        }
-        return elements.get(selector);
-    };
-    const messages = [];
-    globalThis.document = {
-        querySelectorAll: () => [],
-        querySelector: element,
-        documentElement: new Element(),
-    };
-    globalThis.window = {
-        nativeLauncher: {
-            postMessage: (value) => messages.push(new URL(value)),
-        },
-    };
-    globalThis.location = { href: 'https://tauri.localhost/index.html' };
-    try {
-        await import('../ui/main.js');
-        assert.equal(messages.shift().pathname, '/action/ready');
-        window.updateLauncher(
-            'server=https%3A%2F%2Fexample.com%2F&phase=idle&ready=false&platform=android',
-        );
-        assert.equal(element('#server-url').value, 'https://example.com/');
-        element('#server-url').value = 'http://example.com';
-        element('#server-form').fire('submit');
-        assert.equal(messages.length, 0);
-        assert.equal(element('#server-url').attributes['aria-invalid'], 'true');
-        element('#server-url').value = 'https://example.com/';
-        element('#server-form').fire('submit');
-        assert.equal(messages[0].pathname, '/action/open');
-        assert.equal(
-            messages.shift().searchParams.get('server'),
-            'https://example.com/',
-        );
-        window.updateLauncher(
-            'server=https%3A%2F%2Fexample.com%2F&phase=connected&ready=true&platform=android',
-        );
-        assert.match(
-            element('#connection-status').textContent,
-            /Use Server settings/,
-        );
-        element('#resume').fire('click');
-        assert.equal(messages.shift().pathname, '/action/resume');
-        element('#server-url').value = 'https://other.example.com/';
-        element('#server-form').fire('submit');
-        assert.equal(messages.length, 0);
-        assert.equal(element('#switch-confirmation').hidden, false);
-        element('#confirm-switch').fire('click');
-        assert.equal(
-            messages.shift().searchParams.get('server'),
-            'https://other.example.com/',
-        );
-        assert.equal(location.href, 'https://tauri.localhost/index.html');
-    } finally {
-        delete globalThis.window;
-        delete globalThis.document;
-        delete globalThis.location;
-    }
-});

native/tests/publish-macos.test.js

@@ -1,340 +0,0 @@
-import assert from 'node:assert/strict';
-import { Buffer } from 'node:buffer';
-import { createHash } from 'node:crypto';
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import test from 'node:test';
-import { publishMacos, storageConfiguration } from '../publish-macos.mjs';
-
-function fixture(t) {
-    const directory = mkdtempSync(join(tmpdir(), 'kanbangit-upload-test-'));
-    t.after(() => rmSync(directory, { recursive: true, force: true }));
-    const metadata = {
-        version: '1.2.3',
-        target: 'aarch64-apple-darwin',
-        filename: 'KanbanGit-1.2.3-aarch64-apple-darwin.zip',
-    };
-    const archive = Buffer.from('verified release');
-    const checksum = createHash('sha256').update(archive).digest('hex');
-    writeFileSync(join(directory, metadata.filename), archive);
-    writeFileSync(
-        join(directory, `${metadata.filename}.sha256`),
-        `${checksum}  ${metadata.filename}\n`,
-    );
-    const env = {
-        S3_BUCKET: 'release-bucket',
-        S3_REGION: 'nbg1',
-        AWS_ACCESS_KEY_ID: 'test-key',
-        AWS_SECRET_ACCESS_KEY: 'test-secret',
-    };
-    const objects = new Map();
-    const events = [];
-    const run = (command, args) => {
-        assert.equal(command, 'aws');
-        assert.equal(args[1], 'https://nbg1.your-objectstorage.com');
-        const operation = args[args.indexOf('s3api') + 1];
-        const value = (name) => args[args.indexOf(name) + 1];
-        const key = value('--key');
-        events.push({ operation, key });
-        if (operation === 'get-bucket-versioning') {
-            assert.equal(value('--output'), 'json');
-            return '';
-        }
-        if (operation === 'put-object') {
-            assert.equal(value('--if-none-match'), '*');
-            if (objects.has(key)) {
-                throw new Error(
-                    'aws failed: (PreconditionFailed) object exists',
-                );
-            }
-            objects.set(key, readFileSync(value('--body')));
-            return '{}';
-        }
-        if (operation === 'get-object') {
-            writeFileSync(args.at(-1), objects.get(key));
-            return '{}';
-        }
-        throw new Error(`Unexpected S3 operation: ${operation}`);
-    };
-    const fetchPublic = async (url, options) => {
-        assert.equal(options.redirect, 'error');
-        assert.equal(
-            new URL(url).hostname,
-            'release-bucket.nbg1.your-objectstorage.com',
-        );
-        const key = new URL(url).pathname.slice(1);
-        events.push({ operation: 'public-get', key });
-        return {
-            ok: objects.has(key),
-            arrayBuffer: async () => objects.get(key),
-        };
-    };
-    return {
-        directory,
-        metadata,
-        env,
-        objects,
-        events,
-        run,
-        fetchPublic,
-        wait: async () => {},
-    };
-}
-
-test('uploads immutable files and writes completion record after public verification', async (t) => {
-    const f = fixture(t);
-    const url = await publishMacos(f);
-    assert.equal(
-        url,
-        `https://release-bucket.nbg1.your-objectstorage.com/releases/macos/aarch64-apple-darwin/1.2.3/${f.metadata.filename}`,
-    );
-    assert.deepEqual(
-        f.events.map((event) => event.operation),
-        [
-            'get-bucket-versioning',
-            'put-object',
-            'public-get',
-            'put-object',
-            'public-get',
-            'put-object',
-            'public-get',
-        ],
-    );
-    assert.equal(f.objects.size, 3);
-    assert(f.events.at(-1).key.endsWith('/release.json'));
-    assert(![...f.objects.keys()].some((key) => key.includes('latest')));
-    assert.deepEqual(JSON.parse(f.objects.get(f.events.at(-1).key)), {
-        version: '1.2.3',
-        target: f.metadata.target,
-        url,
-        sha256: createHash('sha256').update('verified release').digest('hex'),
-        checksumUrl: `${url}.sha256`,
-    });
-});
-
-for (const response of ['', ' \n\t', '{}']) {
-    test(`unversioned bucket response ${JSON.stringify(response)} permits a verified upload`, async (t) => {
-        const f = fixture(t);
-        const run = f.run;
-        f.run = (command, args) => {
-            const result = run(command, args);
-            return args.includes('get-bucket-versioning') ? response : result;
-        };
-        await publishMacos(f);
-        assert.equal(f.objects.size, 3);
-        assert.equal(f.events.at(-1).operation, 'public-get');
-        assert(f.events.at(-1).key.endsWith('/release.json'));
-    });
-}
-
-for (const response of ['{', 'null', '[]', '"Enabled"', 'false']) {
-    test(`invalid versioning response ${response} aborts before any upload`, async (t) => {
-        const f = fixture(t);
-        f.run = (_command, args) => {
-            assert(args.includes('get-bucket-versioning'));
-            return response;
-        };
-        await assert.rejects(publishMacos(f), /Invalid .*versioning/);
-        assert.equal(f.objects.size, 0);
-    });
-}
-
-test('retry accepts byte-identical objects without replacing them', async (t) => {
-    const f = fixture(t);
-    await publishMacos(f);
-    const originals = [...f.objects.entries()];
-    await publishMacos(f);
-    assert.deepEqual([...f.objects.entries()], originals);
-    assert.equal(
-        f.events.filter((event) => event.operation === 'get-object').length,
-        3,
-    );
-});
-
-test('different existing release is never overwritten', async (t) => {
-    const f = fixture(t);
-    const key = `releases/macos/${f.metadata.target}/1.2.3/${f.metadata.filename}`;
-    f.objects.set(key, Buffer.from('previous version content'));
-    await assert.rejects(publishMacos(f), /bump the app version/);
-    assert.equal(f.objects.get(key).toString(), 'previous version content');
-    assert.equal(f.objects.size, 1);
-});
-
-test('checksum mismatch aborts before contacting S3', async (t) => {
-    const f = fixture(t);
-    writeFileSync(join(f.directory, f.metadata.filename), 'tampered');
-    await assert.rejects(publishMacos(f), /SHA-256/);
-    assert.equal(f.events.length, 0);
-});
-
-for (const status of ['Enabled', 'Suspended']) {
-    test(`rejects ${status} bucket versioning before any write`, async (t) => {
-        const f = fixture(t);
-        f.run = () => JSON.stringify({ Status: status });
-        await assert.rejects(publishMacos(f), /unversioned/);
-        assert.equal(f.objects.size, 0);
-    });
-}
-
-for (const operation of ['get-bucket-versioning', 'put-object', 'get-object']) {
-    test(`${operation} access or network failure cannot be mistaken for a missing object`, async (t) => {
-        const f = fixture(t);
-        await publishMacos(f);
-        const run = f.run;
-        f.events.length = 0;
-        f.run = (command, args) => {
-            if (args.includes(operation)) {
-                throw new Error('AccessDenied');
-            }
-            return run(command, args);
-        };
-        await assert.rejects(publishMacos(f), /AccessDenied/);
-        assert(!f.events.some((event) => event.key.endsWith('/release.json')));
-    });
-}
-
-for (const failure of ['private', 'wrong-content', 'network']) {
-    test(`public download ${failure} prevents completion record`, async (t) => {
-        const f = fixture(t);
-        f.fetchPublic = async () => {
-            if (failure === 'network') {
-                throw new Error('network failure');
-            }
-            return {
-                ok: failure !== 'private',
-                status: failure === 'private' ? 403 : 200,
-                arrayBuffer: async () => Buffer.from('wrong'),
-            };
-        };
-        await assert.rejects(publishMacos(f));
-        assert(
-            ![...f.objects.keys()].some((key) => key.endsWith('/release.json')),
-        );
-    });
-}
-
-test('a partial upload can resume with the same files', async (t) => {
-    const f = fixture(t);
-    const run = f.run;
-    f.run = (command, args) => {
-        if (
-            args.includes('put-object') &&
-            args[args.indexOf('--key') + 1].endsWith('.sha256')
-        ) {
-            throw new Error('upload interrupted');
-        }
-        return run(command, args);
-    };
-    await assert.rejects(publishMacos(f), /interrupted/);
-    assert.equal(f.objects.size, 1);
-    f.run = run;
-    await publishMacos(f);
-    assert.equal(f.objects.size, 3);
-});
-
-for (const status of [403, 404, 408, 429, 500, 502, 503, 504, 'network']) {
-    test(`temporary public download failure ${status} recovers before completion`, async (t) => {
-        const f = fixture(t);
-        const fetchPublic = f.fetchPublic;
-        let attempts = 0;
-        let cancelled = 0;
-        const waits = [];
-        f.wait = async (ms) => waits.push(ms);
-        f.fetchPublic = async (...args) => {
-            if (++attempts <= 2) {
-                if (status === 'network') {
-                    throw new Error('temporary network failure');
-                }
-                return {
-                    ok: false,
-                    status,
-                    body: { cancel: async () => cancelled++ },
-                };
-            }
-            return fetchPublic(...args);
-        };
-        await publishMacos(f);
-        assert.deepEqual(waits, [2000, 2000]);
-        assert.equal(cancelled, status === 'network' ? 0 : 2);
-        assert.equal(f.objects.size, 3);
-        assert(f.events.at(-1).key.endsWith('/release.json'));
-    });
-}
-
-test('persistent public access denial stops after five attempts with HTTP status', async (t) => {
-    const f = fixture(t);
-    let attempts = 0;
-    const waits = [];
-    f.wait = async (ms) => waits.push(ms);
-    f.fetchPublic = async () => {
-        attempts++;
-        return { ok: false, status: 403 };
-    };
-    await assert.rejects(publishMacos(f), /HTTP 403/);
-    assert.equal(attempts, 5);
-    assert.equal(waits.length, 4);
-    assert.equal(f.objects.size, 1);
-});
-
-test('incorrect public bytes fail immediately without retry or completion record', async (t) => {
-    const f = fixture(t);
-    f.wait = async () => assert.fail('Do not retry mismatched content');
-    f.fetchPublic = async () => ({
-        ok: true,
-        arrayBuffer: async () => Buffer.from('incorrect'),
-    });
-    await assert.rejects(publishMacos(f), /SHA-256 mismatch/);
-    assert.equal(f.objects.size, 1);
-});
-
-test('checksum access retries finish before publishing the completion record', async (t) => {
-    const f = fixture(t);
-    const fetchPublic = f.fetchPublic;
-    let failures = 0;
-    f.fetchPublic = async (url, options) => {
-        if (url.endsWith('.sha256') && ++failures <= 2) {
-            assert.equal(f.objects.size, 2);
-            return { ok: false, status: 403 };
-        }
-        return fetchPublic(url, options);
-    };
-    await publishMacos(f);
-    assert.equal(failures, 3);
-    assert.equal(f.objects.size, 3);
-});
-
-for (const overrides of [
-    { S3_REGION: '' },
-    { S3_REGION: 'eu-central-1' },
-    { S3_BUCKET: '' },
-    { S3_BUCKET: 'other/../bucket' },
-    { S3_PREFIX: '../other' },
-    { S3_PUBLIC_BASE_URL: 'http://downloads.example.com' },
-    { S3_PUBLIC_BASE_URL: 'https://secret@downloads.example.com' },
-    { S3_PUBLIC_BASE_URL: 'https://downloads.example.com?token=secret' },
-    { AWS_ACCESS_KEY_ID: '' },
-    { AWS_SECRET_ACCESS_KEY: '' },
-]) {
-    test(`invalid storage configuration is rejected before S3 access: ${JSON.stringify(overrides)}`, async (t) => {
-        const f = fixture(t);
-        f.env = { ...f.env, ...overrides };
-        await assert.rejects(publishMacos(f));
-        assert.equal(f.events.length, 0);
-    });
-}
-
-test('derives Hetzner endpoints and supports an explicit public proxy URL', () => {
-    for (const region of ['nbg1', 'fsn1', 'hel1']) {
-        const config = storageConfiguration({
-            S3_REGION: region,
-            S3_BUCKET: 'release-bucket',
-            S3_PUBLIC_BASE_URL: 'https://downloads.example.com/',
-        });
-        assert.equal(
-            config.endpoint,
-            `https://${region}.your-objectstorage.com`,
-        );
-        assert.equal(config.publicBase, 'https://downloads.example.com');
-    }
-});

native/ui/locales/en.js

@@ -16,8 +16,6 @@ export const en = {
     connecting: 'Connecting to your server…',
     connected:
         'Your workspace is open. Use KanbanGit → Server settings to change servers.',
-    connectedMobile:
-        'Your workspace is open. Use Server settings to change servers.',
     connectionError:
         'The server did not finish loading. Check your connection, server address and HTTPS certificate, then try again. An already open workspace and its inputs are kept.',
     invalidServer:

native/ui/main.js

@@ -20,11 +20,7 @@ function action(name, server) {
     if (server) {
         url.searchParams.set('server', server);
     }
-    if (window.nativeLauncher) {
-        window.nativeLauncher.postMessage(url.href);
-    } else {
-        location.href = url.href;
-    }
+    location.href = url.href;
 }
 
 window.updateLauncher = (query) => {
@@ -38,12 +34,7 @@ window.updateLauncher = (query) => {
     if (phase === 'connecting' || phase === 'connected') {
         activeServer = server;
     }
-    status.textContent =
-        en[
-            phase === 'connected' && state.get('platform') === 'android'
-                ? 'connectedMobile'
-                : phase
-        ] ?? '';
+    status.textContent = en[phase] ?? '';
     status.dataset.state = phase;
     open.disabled = phase === 'connecting';
     open.textContent =
@@ -94,7 +85,3 @@ resume.addEventListener('click', () => action('resume'));
 document.querySelector('#appearance').addEventListener('change', (event) => {
     document.documentElement.dataset.appearance = event.target.value;
 });
-
-if (window.nativeLauncher) {
-    action('ready');
-}

resources/js/components/TwoFactorSetupModal.vue

@@ -19,7 +19,6 @@ import { Label } from '@/components/ui/label';
 import { useFormProtection } from '@/composables/useFormProtection';
 import { useLocalization } from '@/composables/useLocalization';
 import { useTwoFactorAuth } from '@/composables/useTwoFactorAuth';
-import { copyText } from '@/lib/clipboard';
 import { confirm } from '@/routes/two-factor';
 
 const props = defineProps<{
@@ -95,7 +94,7 @@ async function copyKey(): Promise<void> {
     }
     copyError.value = false;
     try {
-        await copyText(key);
+        await navigator.clipboard.writeText(key);
         if (isOpen.value && manualSetupKey.value === key) {
             copied.value = true;
         }

resources/js/components/projects/ProjectAccessEditorDialog.vue

@@ -1,199 +0,0 @@
-<script setup lang="ts">
-import { useForm } from '@inertiajs/vue3';
-import { computed, watch } from 'vue';
-import {
-    updateTeamPermissions,
-    updateUserPermissions,
-} from '@/actions/App/Http/Controllers/ProjectController';
-import FormFeedback from '@/components/FormFeedback.vue';
-import InputError from '@/components/InputError.vue';
-import { Button } from '@/components/ui/button';
-import {
-    Dialog,
-    DialogContent,
-    DialogDescription,
-    DialogFooter,
-    DialogHeader,
-    DialogTitle,
-} from '@/components/ui/dialog';
-import { useFormProtection } from '@/composables/useFormProtection';
-import { useLocalization } from '@/composables/useLocalization';
-import type { PermissionOption } from '@/types';
-import {
-    projectPermissionDescriptions,
-    projectPermissionLabels,
-} from '@/types/project-access';
-import type { ProjectAccessTarget } from '@/types/project-access';
-
-const props = defineProps<{
-    projectId: number;
-    target: ProjectAccessTarget | null;
-    permissionOptions: PermissionOption[];
-}>();
-const emit = defineEmits<{ close: [] }>();
-const { t } = useLocalization();
-const form = useForm({ permissions: [] as string[] });
-const protection = useFormProtection(form, {
-    isDirty: () => props.target !== null && form.isDirty,
-});
-const selectionError = computed(
-    () =>
-        Object.entries(form.errors).find(([key]) =>
-            key.startsWith('permissions'),
-        )?.[1],
-);
-const options = computed(() =>
-    props.permissionOptions
-        .filter((option) => option.value in projectPermissionLabels)
-        .map((option) => ({
-            value: option.value,
-            label: t(
-                projectPermissionLabels[
-                    option.value as keyof typeof projectPermissionLabels
-                ],
-            ),
-            description: t(
-                projectPermissionDescriptions[
-                    option.value as keyof typeof projectPermissionDescriptions
-                ],
-            ),
-        })),
-);
-watch(
-    () => props.target,
-    (target) => {
-        form.defaults({ permissions: [...(target?.permissions ?? [])] });
-        form.resetAndClearErrors();
-        protection.clearFeedback();
-    },
-);
-function close(open: boolean): void {
-    if (open || form.processing || !protection.confirmLeave()) {
-        return;
-    }
-    form.resetAndClearErrors();
-    emit('close');
-}
-function submit(): void {
-    if (!props.target || form.processing) {
-        return;
-    }
-    const route =
-        props.target.kind === 'user'
-            ? updateUserPermissions([props.projectId, props.target.id])
-            : updateTeamPermissions([props.projectId, props.target.id]);
-    protection.submit(route, {
-        preserveScroll: true,
-        onSuccess: () => {
-            form.defaults();
-            form.resetAndClearErrors();
-            emit('close');
-        },
-    });
-}
-</script>
-
-<template>
-    <Dialog :open="target !== null" @update:open="close">
-        <DialogContent
-            :show-close-button="!form.processing"
-            @escape-key-down="form.processing && $event.preventDefault()"
-            @interact-outside="form.processing && $event.preventDefault()"
-        >
-            <DialogHeader>
-                <DialogTitle class="break-words">{{
-                    t('projectAccess.editFor', { name: target?.name ?? '' })
-                }}</DialogTitle>
-                <DialogDescription>{{
-                    t(
-                        target?.kind === 'team'
-                            ? 'projectAccess.teamHelp'
-                            : 'projectAccess.directHelp',
-                    )
-                }}</DialogDescription>
-            </DialogHeader>
-            <form class="grid min-w-0 gap-5" @submit.prevent="submit">
-                <FormFeedback
-                    :state="protection.state.value"
-                    :title="
-                        protection.responseStatus.value === 403
-                            ? t('projectAccess.forbidden')
-                            : undefined
-                    "
-                    :description="
-                        protection.responseStatus.value === 403
-                            ? t('projectAccess.forbiddenHelp')
-                            : undefined
-                    "
-                    :retryable="protection.responseStatus.value !== 403"
-                    @retry="submit"
-                />
-                <fieldset
-                    :disabled="form.processing"
-                    class="grid min-w-0 gap-3"
-                    :aria-invalid="!!selectionError"
-                    aria-describedby="project-permission-error"
-                >
-                    <legend class="mb-3 text-sm font-semibold">
-                        {{
-                            t(
-                                target?.kind === 'team'
-                                    ? 'projectAccess.teamPermissions'
-                                    : 'projectAccess.directPermissions',
-                            )
-                        }}
-                    </legend>
-                    <label
-                        v-for="option in options"
-                        :key="option.value"
-                        class="hover:bg-accent flex cursor-pointer items-start gap-3 rounded-lg border p-3"
-                    >
-                        <input
-                            v-model="form.permissions"
-                            type="checkbox"
-                            :value="option.value"
-                            :aria-label="option.label"
-                            class="accent-primary focus-visible:ring-ring mt-0.5 size-5 shrink-0 focus-visible:ring-2"
-                        />
-                        <span class="grid gap-1"
-                            ><span class="text-sm font-medium">{{
-                                option.label
-                            }}</span
-                            ><span class="text-muted-foreground text-xs">{{
-                                option.description
-                            }}</span></span
-                        >
-                    </label>
-                    <InputError
-                        id="project-permission-error"
-                        :message="selectionError"
-                    />
-                </fieldset>
-                <p class="text-muted-foreground text-sm">
-                    {{ t('projectAccess.clearHelp') }}
-                </p>
-                <p
-                    v-if="target?.globalAdmin"
-                    class="bg-accent text-accent-foreground rounded-lg p-3 text-sm"
-                >
-                    {{ t('projectAccess.globalHelp') }}
-                </p>
-                <p class="text-muted-foreground text-xs">
-                    {{ t('projectAccess.selfHelp') }}
-                </p>
-                <DialogFooter>
-                    <Button
-                        type="button"
-                        variant="outline"
-                        :disabled="form.processing"
-                        @click="close(false)"
-                        >{{ t('common.cancel') }}</Button
-                    >
-                    <Button type="submit" :disabled="form.processing">{{
-                        t('projectAccess.save')
-                    }}</Button>
-                </DialogFooter>
-            </form>
-        </DialogContent>
-    </Dialog>
-</template>

resources/js/components/projects/ProjectPermissionBadges.vue

@@ -1,26 +0,0 @@
-<script setup lang="ts">
-import { Badge } from '@/components/ui/badge';
-import { useLocalization } from '@/composables/useLocalization';
-import { projectPermissionLabels } from '@/types/project-access';
-
-defineProps<{ permissions: string[]; emptyLabel: string }>();
-const { t } = useLocalization();
-</script>
-
-<template>
-    <div class="flex flex-wrap gap-1.5">
-        <template
-            v-for="(label, value) in projectPermissionLabels"
-            :key="value"
-        >
-            <Badge v-if="permissions.includes(value)" variant="secondary">{{
-                t(label)
-            }}</Badge>
-        </template>
-        <span
-            v-if="permissions.length === 0"
-            class="text-muted-foreground text-sm"
-            >{{ emptyLabel }}</span
-        >
-    </div>
-</template>

resources/js/components/teams/TeamEditorDialog.vue

@@ -1,351 +0,0 @@
-<script setup lang="ts">
-import { useForm } from '@inertiajs/vue3';
-import { computed, ref, watch } from 'vue';
-import {
-    store,
-    updateMembers,
-    updateUserPermissions,
-} from '@/actions/App/Http/Controllers/TeamController';
-import FormFeedback from '@/components/FormFeedback.vue';
-import InputError from '@/components/InputError.vue';
-import UserAvatar from '@/components/ui/avatar/UserAvatar.vue';
-import { Button } from '@/components/ui/button';
-import {
-    Dialog,
-    DialogContent,
-    DialogDescription,
-    DialogFooter,
-    DialogHeader,
-    DialogTitle,
-} from '@/components/ui/dialog';
-import { Input } from '@/components/ui/input';
-import { Label } from '@/components/ui/label';
-import { useFormProtection } from '@/composables/useFormProtection';
-import { useLocalization } from '@/composables/useLocalization';
-import type { TeamEditorProps } from '@/types/teams';
-
-const props = defineProps<TeamEditorProps>();
-const emit = defineEmits<{ close: [] }>();
-const { t } = useLocalization();
-const search = ref('');
-const userId = ref<number | null>(null);
-const form = useForm({
-    name: '',
-    user_ids: [] as number[],
-    permissions: [] as string[],
-});
-const protection = useFormProtection(form, {
-    isDirty: () => props.target !== null && form.isDirty,
-});
-const team = computed(() =>
-    props.target && props.target.kind !== 'create' ? props.target.team : null,
-);
-const visibleUsers = computed(() =>
-    props.users.filter((user) =>
-        `${user.name} ${user.email}`
-            .toLocaleLowerCase()
-            .includes(search.value.trim().toLocaleLowerCase()),
-    ),
-);
-const title = computed(() =>
-    t(
-        props.target?.kind === 'create'
-            ? 'teams.create'
-            : props.target?.kind === 'members'
-              ? 'teams.manageMembers'
-              : 'teams.permissions',
-    ),
-);
-const selectionError = computed(
-    () =>
-        Object.entries(form.errors).find(([key]) =>
-            key.startsWith(
-                props.target?.kind === 'members' ? 'user_ids' : 'permissions',
-            ),
-        )?.[1],
-);
-const permissionLabels = {
-    'team:invite': 'teams.permissionInvite',
-    'team:manage': 'teams.permissionManage',
-    'team:admin': 'teams.permissionAdmin',
-} as const;
-function permissionLabel(value: string, fallback: string): string {
-    return value in permissionLabels
-        ? t(permissionLabels[value as keyof typeof permissionLabels])
-        : fallback;
-}
-watch(
-    () => props.target,
-    () => {
-        userId.value = null;
-        search.value = '';
-        form.defaults({
-            name: '',
-            user_ids: [...(team.value?.user_ids ?? [])],
-            permissions: [],
-        });
-        form.resetAndClearErrors();
-        protection.clearFeedback();
-    },
-);
-function chooseUser(event: Event): void {
-    const select = event.target as HTMLSelectElement;
-    if (!protection.confirmLeave()) {
-        select.value = String(userId.value ?? '');
-        return;
-    }
-    userId.value = select.value ? Number(select.value) : null;
-    form.defaults('permissions', [
-        ...(props.teamPermissions[team.value?.id ?? '']?.[userId.value ?? ''] ??
-            []),
-    ]);
-    form.resetAndClearErrors('permissions');
-    protection.clearFeedback();
-}
-function close(open: boolean): void {
-    if (open || form.processing || !protection.confirmLeave()) {
-        return;
-    }
-    form.resetAndClearErrors();
-    emit('close');
-}
-function submit(): void {
-    const target = props.target;
-    if (
-        !target ||
-        form.processing ||
-        (target.kind === 'permissions' && userId.value === null)
-    ) {
-        return;
-    }
-    const route =
-        target.kind === 'create'
-            ? store()
-            : target.kind === 'members'
-              ? updateMembers(target.team.id)
-              : updateUserPermissions([target.team.id, userId.value!]);
-    form.transform((data) =>
-        target.kind === 'create'
-            ? { name: data.name }
-            : target.kind === 'members'
-              ? { user_ids: data.user_ids }
-              : { permissions: data.permissions },
-    );
-    protection.submit(route, {
-        preserveScroll: true,
-        onSuccess: () => {
-            form.resetAndClearErrors();
-            emit('close');
-        },
-    });
-}
-</script>
-
-<template>
-    <Dialog :open="target !== null" @update:open="close">
-        <DialogContent
-            :show-close-button="!form.processing"
-            @escape-key-down="form.processing && $event.preventDefault()"
-            @interact-outside="form.processing && $event.preventDefault()"
-        >
-            <DialogHeader>
-                <DialogTitle>{{ title }}</DialogTitle>
-                <DialogDescription class="break-words">{{
-                    team?.name ?? t('teams.createDescription')
-                }}</DialogDescription>
-            </DialogHeader>
-            <form class="grid min-w-0 gap-5" @submit.prevent="submit">
-                <FormFeedback
-                    :state="protection.state.value"
-                    :title="
-                        protection.responseStatus.value === 403
-                            ? t('teams.forbidden')
-                            : undefined
-                    "
-                    :description="
-                        protection.responseStatus.value === 403
-                            ? t('teams.forbiddenDescription')
-                            : undefined
-                    "
-                    :retryable="protection.responseStatus.value !== 403"
-                    @retry="submit"
-                />
-                <fieldset
-                    :disabled="form.processing"
-                    class="grid min-w-0 gap-4"
-                >
-                    <template v-if="target?.kind === 'create'">
-                        <div class="grid gap-2">
-                            <Label for="team-name">{{ t('teams.name') }}</Label>
-                            <Input
-                                id="team-name"
-                                v-model="form.name"
-                                required
-                                maxlength="255"
-                                :placeholder="t('teams.namePlaceholder')"
-                                :aria-invalid="!!form.errors.name"
-                                aria-describedby="team-name-error"
-                            />
-                            <InputError
-                                id="team-name-error"
-                                :message="form.errors.name"
-                            />
-                        </div>
-                    </template>
-                    <template v-else-if="target?.kind === 'members'">
-                        <p class="text-muted-foreground text-sm">
-                            {{ t('teams.membersHelp') }}
-                        </p>
-                        <div class="grid gap-2">
-                            <Label for="member-search">{{
-                                t('teams.searchPeople')
-                            }}</Label>
-                            <Input
-                                id="member-search"
-                                v-model="search"
-                                type="search"
-                                :placeholder="
-                                    t('teams.searchPeoplePlaceholder')
-                                "
-                            />
-                        </div>
-                        <p class="text-muted-foreground text-sm" role="status">
-                            {{
-                                t('teams.selected', {
-                                    count: form.user_ids.length,
-                                })
-                            }}
-                        </p>
-                        <div
-                            class="grid max-h-64 gap-1 overflow-y-auto rounded-md border p-2"
-                            role="group"
-                            :aria-label="t('teams.members')"
-                            :aria-invalid="!!selectionError"
-                            aria-describedby="team-selection-error"
-                        >
-                            <label
-                                v-for="user in visibleUsers"
-                                :key="user.id"
-                                class="hover:bg-accent flex min-w-0 cursor-pointer items-center gap-3 rounded-md p-2"
-                            >
-                                <input
-                                    v-model="form.user_ids"
-                                    type="checkbox"
-                                    :value="user.id"
-                                    class="accent-primary focus-visible:ring-ring size-5 shrink-0 focus-visible:ring-2"
-                                />
-                                <UserAvatar
-                                    :user="user"
-                                    class="size-8 shrink-0"
-                                />
-                                <span class="grid min-w-0 gap-0.5 text-sm"
-                                    ><span class="break-words font-medium">{{
-                                        user.name
-                                    }}</span
-                                    ><span
-                                        class="text-muted-foreground break-all text-xs"
-                                        >{{ user.email }}</span
-                                    ></span
-                                >
-                            </label>
-                            <p
-                                v-if="visibleUsers.length === 0"
-                                class="text-muted-foreground p-3 text-sm"
-                            >
-                                {{ t('teams.noPeople') }}
-                            </p>
-                        </div>
-                        <InputError
-                            id="team-selection-error"
-                            :message="selectionError"
-                        />
-                    </template>
-                    <template v-else-if="target?.kind === 'permissions'">
-                        <p class="text-muted-foreground text-sm">
-                            {{ t('teams.permissionsHelp') }}
-                        </p>
-                        <div class="grid gap-2">
-                            <Label for="permission-user">{{
-                                t('teams.person')
-                            }}</Label>
-                            <select
-                                id="permission-user"
-                                :value="userId ?? ''"
-                                class="border-input bg-background focus-visible:ring-ring h-11 w-full min-w-0 rounded-md border px-3 text-sm focus-visible:ring-2"
-                                @change="chooseUser"
-                            >
-                                <option value="" disabled>
-                                    {{ t('teams.choosePerson') }}
-                                </option>
-                                <option
-                                    v-for="user in users"
-                                    :key="user.id"
-                                    :value="user.id"
-                                >
-                                    {{ user.name }} ({{ user.email }})
-                                </option>
-                            </select>
-                        </div>
-                        <fieldset
-                            v-if="userId !== null"
-                            class="grid gap-2"
-                            :aria-invalid="!!selectionError"
-                            aria-describedby="team-selection-error"
-                        >
-                            <legend class="mb-2 text-sm font-medium">
-                                {{ t('teams.directPermissions') }}
-                            </legend>
-                            <label
-                                v-for="option in permissionOptions"
-                                :key="option.value"
-                                class="hover:bg-accent flex cursor-pointer items-center gap-3 rounded-md border p-3 text-sm"
-                            >
-                                <input
-                                    v-model="form.permissions"
-                                    type="checkbox"
-                                    :value="option.value"
-                                    class="accent-primary focus-visible:ring-ring size-5 shrink-0 focus-visible:ring-2"
-                                />
-                                {{
-                                    permissionLabel(option.value, option.label)
-                                }}
-                            </label>
-                            <p class="text-muted-foreground text-sm">
-                                {{ t('teams.permissionsClearHelp') }}
-                            </p>
-                        </fieldset>
-                        <InputError
-                            id="team-selection-error"
-                            :message="selectionError"
-                        />
-                    </template>
-                </fieldset>
-                <DialogFooter>
-                    <Button
-                        type="button"
-                        variant="outline"
-                        :disabled="form.processing"
-                        @click="close(false)"
-                        >{{ t('common.cancel') }}</Button
-                    >
-                    <Button
-                        type="submit"
-                        :disabled="
-                            form.processing ||
-                            (target?.kind === 'permissions' && userId === null)
-                        "
-                        >{{
-                            t(
-                                target?.kind === 'create'
-                                    ? 'teams.create'
-                                    : target?.kind === 'members'
-                                      ? 'teams.saveMembers'
-                                      : 'teams.savePermissions',
-                            )
-                        }}</Button
-                    >
-                </DialogFooter>
-            </form>
-        </DialogContent>
-    </Dialog>
-</template>

resources/js/lib/clipboard.ts

@@ -1,64 +0,0 @@
-/** Copy only after a user action; WebViews may not expose the async Clipboard API. */
-export async function copyText(text: string): Promise<void> {
-    if (navigator.clipboard?.writeText) {
-        try {
-            await navigator.clipboard.writeText(text);
-            return;
-        } catch {
-            // Embedded browsers can deny the async API while allowing a selected copy.
-        }
-    }
-
-    const active = document.activeElement;
-    const selection = window.getSelection();
-    const ranges = selection
-        ? Array.from({ length: selection.rangeCount }, (_, index) =>
-              selection.getRangeAt(index).cloneRange(),
-          )
-        : [];
-    const inputSelection =
-        active instanceof HTMLInputElement ||
-        active instanceof HTMLTextAreaElement
-            ? ([
-                  active.selectionStart,
-                  active.selectionEnd,
-                  active.selectionDirection,
-              ] as const)
-            : null;
-    const field = document.createElement('textarea');
-    field.value = text;
-    field.readOnly = true;
-    field.style.cssText =
-        'position:fixed;opacity:0;pointer-events:none;font-size:16px';
-    (active?.closest('[role="dialog"]') ?? document.body).append(field);
-    try {
-        field.focus({ preventScroll: true });
-        field.select();
-        field.setSelectionRange(0, text.length);
-        if (!document.execCommand('copy')) {
-            throw new Error('Clipboard access unavailable');
-        }
-    } finally {
-        field.remove();
-        if (active instanceof HTMLElement) {
-            active.focus({ preventScroll: true });
-        }
-        if (selection) {
-            selection.removeAllRanges();
-            ranges.forEach((range) => selection.addRange(range));
-        }
-        if (
-            inputSelection &&
-            inputSelection[0] !== null &&
-            inputSelection[1] !== null &&
-            (active instanceof HTMLInputElement ||
-                active instanceof HTMLTextAreaElement)
-        ) {
-            active.setSelectionRange(
-                inputSelection[0],
-                inputSelection[1],
-                inputSelection[2] ?? undefined,
-            );
-        }
-    }
-}

resources/js/locales/en.ts

@@ -1,58 +1,4 @@
 export const en = {
-    'projectAccess.pageTitle': '{project} · Project access',
-    'projectAccess.title': 'Project access',
-    'projectAccess.description':
-        'Manage who can access {project} and see where their permissions come from.',
-    'projectAccess.back': 'Back to project',
-    'projectAccess.saved': 'Project permissions saved.',
-    'projectAccess.howItWorks': 'How project access works',
-    'projectAccess.additiveHelp':
-        'Direct user permissions and permissions from every team are combined. Write includes read; administrator includes write and read.',
-    'projectAccess.limitsHelp':
-        'Project administrators can change project assignments here. Global permissions and team membership are managed separately.',
-    'projectAccess.search': 'Search people or teams',
-    'projectAccess.people': 'People and effective access',
-    'projectAccess.effective': 'Effective permissions',
-    'projectAccess.noAccess': 'No project access',
-    'projectAccess.globalSource':
-        'Global administrator · all project permissions',
-    'projectAccess.direct': 'Direct:',
-    'projectAccess.none': 'None',
-    'projectAccess.viaTeam': 'Via {name}:',
-    'projectAccess.editFor': 'Edit access for {name}',
-    'projectAccess.editDirect': 'Edit direct access',
-    'projectAccess.editTeam': 'Edit team access',
-    'projectAccess.teamPermissions': 'Team permissions',
-    'projectAccess.directPermissions': 'Direct permissions',
-    'projectAccess.teamHelp':
-        'These project permissions apply to every current and future member of the team.',
-    'projectAccess.directHelp':
-        'Change only this person’s direct project permissions. Team and global permissions continue to apply.',
-    'projectAccess.noPeopleResults': 'No matching people',
-    'projectAccess.noPeople': 'No people available',
-    'projectAccess.noTeamResults': 'No matching teams',
-    'projectAccess.noTeams': 'No teams yet',
-    'projectAccess.noTeamsHelp':
-        'Create a team and add members before assigning shared project access.',
-    'projectAccess.noTeamAccess': 'No project permissions assigned',
-    'projectAccess.read': 'Read',
-    'projectAccess.write': 'Write',
-    'projectAccess.admin': 'Administrator',
-    'projectAccess.readHelp': 'View the project and its tickets.',
-    'projectAccess.writeHelp': 'Create and edit tickets. Includes read access.',
-    'projectAccess.adminHelp':
-        'Manage project access and project administration. Includes write and read access.',
-    'projectAccess.clearHelp':
-        'Clear all selections to remove this assignment. Access granted by other teams, direct assignments or global administration is preserved.',
-    'projectAccess.globalHelp':
-        'This person is a global administrator. Changing these project assignments cannot remove their global access.',
-    'projectAccess.selfHelp':
-        'If you remove your own administrator access, you will return to Projects.',
-    'projectAccess.save': 'Save permissions',
-    'projectAccess.forbidden': 'Project access can no longer be changed',
-    'projectAccess.forbiddenHelp':
-        'Your administrator permission may have changed. Close this dialog and reopen the project to check your current access.',
-
     'notifications.title': 'Notifications',
     'notifications.pageTitle': '{project} · Notifications',
     'notifications.description':
@@ -226,52 +172,6 @@ export const en = {
     'templates.deleteImpact':
         '{count} linked projects will stop inheriting from this template. Their current configuration and tickets are kept.',
 
-    'teams.eyebrow': 'People & access',
-    'teams.description':
-        'Bring people together in reusable teams. Manage membership and the permissions to administer each team.',
-    'teams.create': 'Create team',
-    'teams.createDescription':
-        'Group people into a team to share project access.',
-    'teams.name': 'Team name',
-    'teams.namePlaceholder': 'Platform team',
-    'teams.yourTeams': 'Teams you manage',
-    'teams.search': 'Search teams',
-    'teams.clearSearch': 'Clear search',
-    'teams.empty': 'No teams to manage',
-    'teams.emptyCreate': 'Create a team to start organizing your people.',
-    'teams.emptyDescription':
-        'No teams are available for your current permissions.',
-    'teams.noResults': 'No matching teams',
-    'teams.noResultsDescription': 'Try another team name or clear your search.',
-    'teams.manageMembers': 'Manage members',
-    'teams.manageMembersFor': 'Manage members of {name}',
-    'teams.permissionsFor': 'Manage permissions for {name}',
-    'teams.members': 'Members',
-    'teams.noMembers': 'No members yet.',
-    'teams.membersHelp':
-        'Select the people who belong to this team. Changes apply when you save.',
-    'teams.selected': '{count} selected',
-    'teams.searchPeople': 'Find people',
-    'teams.searchPeoplePlaceholder': 'Search by name or email',
-    'teams.noPeople': 'No matching people.',
-    'teams.saveMembers': 'Save members',
-    'teams.permissions': 'Team permissions',
-    'teams.permissionsHelp':
-        'Direct team permissions are separate from membership. Choose any user to review or change their assignments.',
-    'teams.person': 'User',
-    'teams.choosePerson': 'Choose a user',
-    'teams.directPermissions': 'Direct permissions',
-    'teams.permissionInvite': 'Team invite',
-    'teams.permissionManage': 'Team manage',
-    'teams.permissionAdmin': 'Team admin',
-    'teams.permissionsClearHelp':
-        'Clear every checkbox to remove direct permissions. Other existing access remains in effect.',
-    'teams.savePermissions': 'Save permissions',
-    'teams.updated': 'Team changes saved.',
-    'teams.forbidden': 'You no longer have permission',
-    'teams.forbiddenDescription':
-        'Your changes have not been saved. Close this dialog and reload the page to check your current access.',
-    'teams.memberCount': { one: '{count} member', other: '{count} members' },
     'workflow.title': 'Board workflow',
     'workflow.pageTitle': '{project} · Board workflow',
     'workflow.description':

resources/js/pages/projects/Access.vue

@@ -1,344 +1,308 @@
 <script setup lang="ts">
-import { Head, Link, usePage } from '@inertiajs/vue3';
-import { ArrowLeft, Search, ShieldCheck, Users } from 'lucide-vue-next';
-import { computed, ref } from 'vue';
-import FeedbackState from '@/components/FeedbackState.vue';
-import ProjectAccessEditorDialog from '@/components/projects/ProjectAccessEditorDialog.vue';
-import ProjectPermissionBadges from '@/components/projects/ProjectPermissionBadges.vue';
-import UserAvatar from '@/components/ui/avatar/UserAvatar.vue';
+import { Form, Head, Link } from '@inertiajs/vue3';
+import ProjectController from '@/actions/App/Http/Controllers/ProjectController';
+import Heading from '@/components/Heading.vue';
 import { Badge } from '@/components/ui/badge';
 import { Button } from '@/components/ui/button';
-import { Input } from '@/components/ui/input';
-import { Label } from '@/components/ui/label';
-import { useLocalization } from '@/composables/useLocalization';
+import {
+    Card,
+    CardContent,
+    CardDescription,
+    CardHeader,
+    CardTitle,
+} from '@/components/ui/card';
 import AppLayout from '@/layouts/AppLayout.vue';
-import { access, index, show } from '@/routes/projects';
-import { general } from '@/routes/projects/settings';
+import { access, index, show } from '@/routes/projects/index';
+import { general as generalSettings } from '@/routes/projects/settings';
 import type { BreadcrumbItem, ProjectAccessPageProps } from '@/types';
-import type { ProjectAccessTarget } from '@/types/project-access';
 
 const props = defineProps<ProjectAccessPageProps>();
-const page = usePage();
-const { t } = useLocalization();
-const search = ref('');
-const target = ref<ProjectAccessTarget | null>(null);
-const breadcrumbs = computed<BreadcrumbItem[]>(() => [
-    { title: t('navigation.projects'), href: index() },
-    { title: props.project.name, href: show(props.project.id) },
-    { title: t('navigation.access'), href: access(props.project.id) },
-]);
-const matches = (value: string) =>
-    value.toLocaleLowerCase().includes(search.value.trim().toLocaleLowerCase());
-const visibleUsers = computed(() =>
-    props.users.filter((user) => matches(`${user.name} ${user.email}`)),
-);
-const visibleTeams = computed(() =>
-    props.teams.filter((team) => matches(team.name)),
-);
-const inheritedTeams = (userId: number) =>
-    props.teams.filter(
-        (team) =>
-            team.user_ids.includes(userId) &&
-            (props.teamPermissions[team.id] ?? []).length > 0,
-    );
+
+const breadcrumbs: BreadcrumbItem[] = [
+    {
+        title: 'Projects',
+        href: index(),
+    },
+    {
+        title: props.project.name,
+        href: show(props.project.id),
+    },
+    {
+        title: 'Access',
+        href: access(props.project.id),
+    },
+];
+
+const hasPermission = (
+    permissions: Record<string, string[]>,
+    actorId: number,
+    permission: string,
+) => (permissions[actorId] ?? []).includes(permission);
 </script>
 
 <template>
     <AppLayout :breadcrumbs="breadcrumbs">
-        <Head
-            :title="t('projectAccess.pageTitle', { project: project.name })"
-        />
-        <main
-            class="mx-auto flex w-full min-w-0 max-w-7xl flex-1 flex-col gap-6 p-4 sm:p-6 lg:p-8"
-        >
-            <header
+        <Head :title="`${project.name} access`" />
+
+        <div class="flex flex-1 flex-col gap-6 p-4">
+            <div
                 class="flex flex-col gap-4 sm:flex-row sm:items-start sm:justify-between"
             >
-                <div class="grid min-w-0 gap-2">
-                    <p
-                        class="text-primary break-all text-xs font-semibold uppercase tracking-wider"
-                    >
+                <div class="space-y-3">
+                    <Badge variant="outline" class="px-3 py-1">
                         {{ project.key }}
-                    </p>
-                    <h1 class="text-headline-mobile sm:text-headline">
-                        {{ t('projectAccess.title') }}
-                    </h1>
-                    <p
-                        class="text-muted-foreground max-w-2xl break-words text-sm"
-                    >
-                        {{
-                            t('projectAccess.description', {
-                                project: project.name,
-                            })
-                        }}
-                    </p>
+                    </Badge>
+                    <Heading
+                        :title="`${project.name} access`"
+                        description="Assign direct user permissions or inherited team permissions for this project."
+                    />
                 </div>
-                <div class="flex shrink-0 flex-wrap gap-2">
+
+                <div class="flex flex-wrap gap-3">
                     <Button
-                        v-if="page.props.auth.permissions.globalAdmin"
+                        v-if="$page.props.auth.permissions.globalAdmin"
                         as-child
                         variant="outline"
-                        ><Link :href="general(project.id)">{{
-                            t('navigation.general')
-                        }}</Link></Button
-                    >
-                    <Button as-child variant="outline"
-                        ><Link :href="show(project.id)"
-                            ><ArrowLeft class="size-4" aria-hidden="true" />{{
-                                t('projectAccess.back')
-                            }}</Link
-                        ></Button
                     >
+                        <Link :href="generalSettings(project.id)">
+                            General settings
+                        </Link>
+                    </Button>
+
+                    <Button as-child variant="outline">
+                        <Link :href="show(project.id)">Back to project</Link>
+                    </Button>
                 </div>
-            </header>
-            <FeedbackState
-                v-if="status"
-                state="success"
-                :title="t('projectAccess.saved')"
-            />
-            <aside
-                class="bg-accent/60 flex items-start gap-3 rounded-xl border p-4"
-                :aria-label="t('projectAccess.howItWorks')"
-            >
-                <ShieldCheck
-                    class="text-primary mt-0.5 size-5 shrink-0"
-                    aria-hidden="true"
-                />
-                <div class="grid gap-1">
-                    <h2 class="text-sm font-semibold">
-                        {{ t('projectAccess.howItWorks') }}
-                    </h2>
-                    <p class="text-muted-foreground text-sm">
-                        {{ t('projectAccess.additiveHelp') }}
-                    </p>
-                    <p class="text-muted-foreground text-sm">
-                        {{ t('projectAccess.limitsHelp') }}
-                    </p>
-                </div>
-            </aside>
-            <div class="relative sm:max-w-md">
-                <Label for="access-search" class="sr-only">{{
-                    t('projectAccess.search')
-                }}</Label
-                ><Search
-                    class="text-muted-foreground pointer-events-none absolute left-3 top-3 size-4"
-                    aria-hidden="true"
-                /><Input
-                    id="access-search"
-                    v-model="search"
-                    type="search"
-                    class="pl-9"
-                    :placeholder="t('projectAccess.search')"
-                />
             </div>
-            <section
-                class="grid min-w-0 gap-4"
-                aria-labelledby="people-heading"
+
+            <div
+                v-if="status"
+                class="rounded-xl border border-emerald-200 bg-emerald-50 px-4 py-3 text-sm text-emerald-900 dark:border-emerald-900/70 dark:bg-emerald-950/40 dark:text-emerald-100"
             >
-                <div class="flex items-center gap-2">
-                    <h2 id="people-heading" class="text-lg font-semibold">
-                        {{ t('projectAccess.people') }}
-                    </h2>
-                    <Badge variant="secondary">{{ users.length }}</Badge>
-                </div>
-                <FeedbackState
-                    v-if="visibleUsers.length === 0"
-                    state="empty"
-                    :title="
-                        t(
-                            users.length
-                                ? 'projectAccess.noPeopleResults'
-                                : 'projectAccess.noPeople',
-                        )
-                    "
-                />
-                <ul
-                    v-else
-                    class="bg-card min-w-0 divide-y rounded-xl border"
-                    :aria-label="t('projectAccess.people')"
-                >
-                    <li
-                        v-for="user in visibleUsers"
-                        :key="user.id"
-                        class="grid min-w-0 gap-4 p-4 sm:p-5 lg:grid-cols-[minmax(0,1fr)_minmax(0,1.3fr)_auto] lg:items-center"
-                        :data-user-id="user.id"
-                    >
-                        <div class="flex min-w-0 items-center gap-3">
-                            <UserAvatar :user="user" class="size-10 shrink-0" />
-                            <div class="grid min-w-0 gap-1">
-                                <h3 class="break-words text-sm font-semibold">
-                                    {{ user.name }}
-                                </h3>
-                                <p
-                                    class="text-muted-foreground break-all text-xs"
-                                >
-                                    {{ user.email }}
-                                </p>
-                            </div>
-                        </div>
-                        <div class="grid min-w-0 gap-2">
-                            <p
-                                class="text-muted-foreground text-xs font-medium"
-                            >
-                                {{ t('projectAccess.effective') }}
-                            </p>
-                            <ProjectPermissionBadges
-                                :permissions="
-                                    effectivePermissions[user.id] ?? []
-                                "
-                                :empty-label="t('projectAccess.noAccess')"
-                            />
-                            <div
-                                class="text-muted-foreground grid gap-1 text-xs"
-                            >
-                                <span
-                                    v-if="globalAdminUserIds.includes(user.id)"
-                                    >{{ t('projectAccess.globalSource') }}</span
-                                >
-                                <div class="flex flex-wrap items-center gap-2">
-                                    <span>{{ t('projectAccess.direct') }}</span
-                                    ><ProjectPermissionBadges
-                                        :permissions="
-                                            directPermissions[user.id] ?? []
-                                        "
-                                        :empty-label="t('projectAccess.none')"
-                                    />
-                                </div>
-                                <div
-                                    v-for="team in inheritedTeams(user.id)"
-                                    :key="team.id"
-                                    class="flex min-w-0 flex-wrap items-center gap-2"
-                                >
-                                    <span class="break-words">{{
-                                        t('projectAccess.viaTeam', {
-                                            name: team.name,
-                                        })
-                                    }}</span
-                                    ><ProjectPermissionBadges
-                                        :permissions="
-                                            teamPermissions[team.id] ?? []
-                                        "
-                                        :empty-label="t('projectAccess.none')"
-                                    />
-                                </div>
-                            </div>
-                        </div>
-                        <Button
-                            type="button"
-                            variant="outline"
-                            :aria-label="
-                                t('projectAccess.editFor', { name: user.name })
-                            "
-                            @click="
-                                target = {
-                                    kind: 'user',
-                                    id: user.id,
-                                    name: user.name,
-                                    permissions:
-                                        directPermissions[user.id] ?? [],
-                                    globalAdmin: globalAdminUserIds.includes(
-                                        user.id,
-                                    ),
-                                }
-                            "
-                            >{{ t('projectAccess.editDirect') }}</Button
+                {{ status }}
+            </div>
+
+            <Card class="gap-0 overflow-hidden">
+                <CardHeader class="border-b">
+                    <CardTitle>User permissions</CardTitle>
+                    <CardDescription>
+                        Direct assignments apply only to the selected user
+                        inside this project.
+                    </CardDescription>
+                </CardHeader>
+
+                <CardContent class="p-0">
+                    <div class="overflow-x-auto">
+                        <table
+                            class="divide-border min-w-full divide-y text-sm"
                         >
-                    </li>
-                </ul>
-            </section>
-            <section class="grid min-w-0 gap-4" aria-labelledby="teams-heading">
-                <div class="grid gap-1">
-                    <div class="flex items-center gap-2">
-                        <h2 id="teams-heading" class="text-lg font-semibold">
-                            {{ t('projectAccess.teamPermissions') }}
-                        </h2>
-                        <Badge variant="secondary">{{ teams.length }}</Badge>
+                            <thead
+                                class="bg-muted/40 text-muted-foreground text-left"
+                            >
+                                <tr>
+                                    <th class="px-4 py-3 font-medium">User</th>
+                                    <th class="px-4 py-3 font-medium">Email</th>
+                                    <th class="px-4 py-3 font-medium">
+                                        Permissions
+                                    </th>
+                                    <th
+                                        class="px-4 py-3 text-right font-medium"
+                                    >
+                                        Action
+                                    </th>
+                                </tr>
+                            </thead>
+                            <tbody class="divide-border divide-y">
+                                <tr
+                                    v-for="user in users"
+                                    :key="user.id"
+                                    class="bg-background align-top"
+                                >
+                                    <td
+                                        class="text-foreground px-4 py-4 font-medium"
+                                    >
+                                        {{ user.name }}
+                                    </td>
+                                    <td class="text-muted-foreground px-4 py-4">
+                                        {{ user.email }}
+                                    </td>
+                                    <td class="px-4 py-4">
+                                        <Form
+                                            v-bind="
+                                                ProjectController.updateUserPermissions.form(
+                                                    [project.id, user.id],
+                                                )
+                                            "
+                                            class="flex flex-wrap gap-3"
+                                            v-slot="{ processing }"
+                                        >
+                                            <label
+                                                v-for="option in permissionOptions"
+                                                :key="`${user.id}-${option.value}`"
+                                                class="border-border inline-flex items-center gap-2 rounded-lg border px-3 py-2 text-sm"
+                                            >
+                                                <input
+                                                    type="checkbox"
+                                                    name="permissions[]"
+                                                    :value="option.value"
+                                                    :checked="
+                                                        hasPermission(
+                                                            directPermissions,
+                                                            user.id,
+                                                            option.value,
+                                                        )
+                                                    "
+                                                    class="border-input text-primary focus:ring-ring size-4 rounded"
+                                                />
+                                                <span>{{ option.label }}</span>
+                                            </label>
+
+                                            <div class="w-full sm:hidden" />
+
+                                            <Button
+                                                type="submit"
+                                                size="sm"
+                                                variant="outline"
+                                                :disabled="processing"
+                                            >
+                                                Save
+                                            </Button>
+                                        </Form>
+                                    </td>
+                                    <td
+                                        class="text-muted-foreground px-4 py-4 text-right"
+                                    >
+                                        Direct
+                                    </td>
+                                </tr>
+                            </tbody>
+                        </table>
                     </div>
-                    <p class="text-muted-foreground text-sm">
-                        {{ t('projectAccess.teamHelp') }}
-                    </p>
-                </div>
-                <FeedbackState
-                    v-if="visibleTeams.length === 0"
-                    state="empty"
-                    :title="
-                        t(
-                            teams.length
-                                ? 'projectAccess.noTeamResults'
-                                : 'projectAccess.noTeams',
-                        )
-                    "
-                    :description="
-                        teams.length
-                            ? undefined
-                            : t('projectAccess.noTeamsHelp')
-                    "
-                />
-                <ul
-                    v-else
-                    class="grid min-w-0 gap-4 lg:grid-cols-2"
-                    :aria-label="t('projectAccess.teamPermissions')"
-                >
-                    <li
-                        v-for="team in visibleTeams"
-                        :key="team.id"
-                        class="bg-card grid min-w-0 gap-4 rounded-xl border p-5"
-                        :data-team-id="team.id"
+                </CardContent>
+            </Card>
+
+            <Card class="gap-0 overflow-hidden">
+                <CardHeader class="border-b">
+                    <CardTitle>Team permissions</CardTitle>
+                    <CardDescription>
+                        Team assignments are inherited by every current and
+                        future member of that team.
+                    </CardDescription>
+                </CardHeader>
+
+                <CardContent class="p-0">
+                    <div
+                        v-if="teams.length === 0"
+                        class="text-muted-foreground p-6 text-sm"
                     >
-                        <div class="flex min-w-0 items-center gap-3">
-                            <span
-                                class="bg-accent text-primary flex size-10 shrink-0 items-center justify-center rounded-lg"
-                                ><Users class="size-5" aria-hidden="true"
-                            /></span>
-                            <div class="min-w-0">
-                                <h3 class="break-words text-sm font-semibold">
-                                    {{ team.name }}
-                                </h3>
-                                <p class="text-muted-foreground text-xs">
-                                    {{
-                                        t('teams.memberCount', {
-                                            count: team.users.length,
-                                        })
-                                    }}
-                                </p>
-                            </div>
-                        </div>
-                        <ProjectPermissionBadges
-                            :permissions="teamPermissions[team.id] ?? []"
-                            :empty-label="t('projectAccess.noTeamAccess')"
-                        />
-                        <p class="text-muted-foreground break-words text-xs">
-                            {{
-                                team.users
-                                    .map((user) => user.name)
-                                    .join(', ') || t('teams.noMembers')
-                            }}
-                        </p>
-                        <Button
-                            type="button"
-                            variant="outline"
-                            :aria-label="
-                                t('projectAccess.editFor', { name: team.name })
-                            "
-                            @click="
-                                target = {
-                                    kind: 'team',
-                                    id: team.id,
-                                    name: team.name,
-                                    permissions: teamPermissions[team.id] ?? [],
-                                }
-                            "
-                            >{{ t('projectAccess.editTeam') }}</Button
+                        No teams exist yet. Create teams first to assign
+                        inherited permissions.
+                    </div>
+
+                    <div v-else class="overflow-x-auto">
+                        <table
+                            class="divide-border min-w-full divide-y text-sm"
                         >
-                    </li>
-                </ul>
-            </section>
-            <ProjectAccessEditorDialog
-                :project-id="project.id"
-                :target="target"
-                :permission-options="permissionOptions"
-                @close="target = null"
-            />
-        </main>
+                            <thead
+                                class="bg-muted/40 text-muted-foreground text-left"
+                            >
+                                <tr>
+                                    <th class="px-4 py-3 font-medium">Team</th>
+                                    <th class="px-4 py-3 font-medium">
+                                        Members
+                                    </th>
+                                    <th class="px-4 py-3 font-medium">
+                                        Permissions
+                                    </th>
+                                    <th
+                                        class="px-4 py-3 text-right font-medium"
+                                    >
+                                        Action
+                                    </th>
+                                </tr>
+                            </thead>
+                            <tbody class="divide-border divide-y">
+                                <tr
+                                    v-for="team in teams"
+                                    :key="team.id"
+                                    class="bg-background align-top"
+                                >
+                                    <td
+                                        class="text-foreground px-4 py-4 font-medium"
+                                    >
+                                        {{ team.name }}
+                                    </td>
+                                    <td class="px-4 py-4">
+                                        <div class="flex flex-wrap gap-2">
+                                            <Badge
+                                                v-for="member in team.users"
+                                                :key="member.id"
+                                                variant="secondary"
+                                            >
+                                                {{ member.name }}
+                                            </Badge>
+                                            <span
+                                                v-if="team.users.length === 0"
+                                                class="text-muted-foreground"
+                                            >
+                                                No members assigned
+                                            </span>
+                                        </div>
+                                    </td>
+                                    <td class="px-4 py-4">
+                                        <Form
+                                            v-bind="
+                                                ProjectController.updateTeamPermissions.form(
+                                                    [project.id, team.id],
+                                                )
+                                            "
+                                            class="flex flex-wrap gap-3"
+                                            v-slot="{ processing }"
+                                        >
+                                            <label
+                                                v-for="option in permissionOptions"
+                                                :key="`${team.id}-${option.value}`"
+                                                class="border-border inline-flex items-center gap-2 rounded-lg border px-3 py-2 text-sm"
+                                            >
+                                                <input
+                                                    type="checkbox"
+                                                    name="permissions[]"
+                                                    :value="option.value"
+                                                    :checked="
+                                                        hasPermission(
+                                                            teamPermissions,
+                                                            team.id,
+                                                            option.value,
+                                                        )
+                                                    "
+                                                    class="border-input text-primary focus:ring-ring size-4 rounded"
+                                                />
+                                                <span>{{ option.label }}</span>
+                                            </label>
+
+                                            <div class="w-full sm:hidden" />
+
+                                            <Button
+                                                type="submit"
+                                                size="sm"
+                                                variant="outline"
+                                                :disabled="processing"
+                                            >
+                                                Save
+                                            </Button>
+                                        </Form>
+                                    </td>
+                                    <td
+                                        class="text-muted-foreground px-4 py-4 text-right"
+                                    >
+                                        Inherited
+                                    </td>
+                                </tr>
+                            </tbody>
+                        </table>
+                    </div>
+                </CardContent>
+            </Card>
+        </div>
     </AppLayout>
 </template>

resources/js/pages/settings/Applications.vue

@@ -23,7 +23,6 @@ import { Label } from '@/components/ui/label';
 import { useFormProtection } from '@/composables/useFormProtection';
 import { useLocalization } from '@/composables/useLocalization';
 import AppLayout from '@/layouts/AppLayout.vue';
-import { copyText } from '@/lib/clipboard';
 import SettingsLayout from '@/layouts/settings/Layout.vue';
 import { edit } from '@/routes/applications/index';
 import type { BreadcrumbItem, SettingsApplicationsPageProps } from '@/types';
@@ -84,7 +83,7 @@ async function copyKey(): Promise<void> {
     }
     copyError.value = false;
     try {
-        await copyText(key);
+        await navigator.clipboard.writeText(key);
         if (props.applicationKey === key) {
             copied.value = true;
         }

resources/js/pages/teams/Index.vue

@@ -1,204 +1,356 @@
 <script setup lang="ts">
-import { Head } from '@inertiajs/vue3';
-import { Plus, Search, Shield, Users } from 'lucide-vue-next';
-import { computed, ref } from 'vue';
-import FeedbackState from '@/components/FeedbackState.vue';
-import TeamEditorDialog from '@/components/teams/TeamEditorDialog.vue';
-import UserAvatar from '@/components/ui/avatar/UserAvatar.vue';
+import { Form, Head } from '@inertiajs/vue3';
+import { Shield } from 'lucide-vue-next';
+import TeamController from '@/actions/App/Http/Controllers/TeamController';
+import Heading from '@/components/Heading.vue';
+import InputError from '@/components/InputError.vue';
 import { Badge } from '@/components/ui/badge';
 import { Button } from '@/components/ui/button';
+import {
+    Card,
+    CardContent,
+    CardDescription,
+    CardHeader,
+    CardTitle,
+} from '@/components/ui/card';
 import { Input } from '@/components/ui/input';
 import { Label } from '@/components/ui/label';
-import { useLocalization } from '@/composables/useLocalization';
 import AppLayout from '@/layouts/AppLayout.vue';
-import { index } from '@/routes/teams';
+import { index as teamsIndex } from '@/routes/teams';
 import type { BreadcrumbItem, TeamsIndexPageProps } from '@/types';
-import type { TeamEditorTarget } from '@/types/teams';
 
 const props = defineProps<TeamsIndexPageProps>();
-const { t } = useLocalization();
-const search = ref('');
-const target = ref<TeamEditorTarget | null>(null);
-const breadcrumbs = computed<BreadcrumbItem[]>(() => [
-    { title: t('navigation.teams'), href: index() },
-]);
-const visibleTeams = computed(() =>
-    props.teams.filter((team) =>
-        team.name
-            .toLocaleLowerCase()
-            .includes(search.value.trim().toLocaleLowerCase()),
-    ),
-);
+
+const breadcrumbs: BreadcrumbItem[] = [
+    {
+        title: 'Teams',
+        href: teamsIndex(),
+    },
+];
+
+const hasPermission = (
+    permissions: Record<string, string[]>,
+    actorId: number,
+    permission: string,
+) => (permissions[actorId] ?? []).includes(permission);
+
+const permissionsForTeam = (teamId: number): Record<string, string[]> =>
+    props.teamPermissions[teamId] ?? {};
 </script>
 
 <template>
     <AppLayout :breadcrumbs="breadcrumbs">
-        <Head :title="t('navigation.teams')" />
-        <main
-            class="mx-auto flex w-full max-w-7xl flex-1 flex-col gap-6 p-4 sm:p-6 lg:p-8"
-        >
-            <header
+        <Head title="Teams" />
+
+        <div class="flex flex-1 flex-col gap-6 p-4">
+            <div
                 class="flex flex-col gap-4 sm:flex-row sm:items-start sm:justify-between"
             >
-                <div class="grid min-w-0 gap-2">
-                    <p
-                        class="text-primary text-xs font-semibold uppercase tracking-wider"
-                    >
-                        {{ t('teams.eyebrow') }}
-                    </p>
-                    <h1 class="text-headline-mobile sm:text-headline">
-                        {{ t('navigation.teams') }}
-                    </h1>
-                    <p class="text-muted-foreground max-w-2xl text-sm">
-                        {{ t('teams.description') }}
-                    </p>
-                </div>
-                <Button
-                    v-if="canCreateTeams"
-                    type="button"
-                    class="shrink-0"
-                    @click="target = { kind: 'create' }"
-                    ><Plus class="size-4" aria-hidden="true" />{{
-                        t('teams.create')
-                    }}</Button
-                >
-            </header>
-            <FeedbackState
-                v-if="status"
-                state="success"
-                :title="t('teams.updated')"
-            />
+                <Heading
+                    title="Teams"
+                    description="Create reusable teams, manage memberships, and assign team-scoped permissions to users."
+                />
+
+                <Badge variant="outline" class="gap-1.5 px-3 py-1">
+                    <Shield class="size-3.5" />
+                    {{ canCreateTeams ? 'Global admin' : 'Team-scoped access' }}
+                </Badge>
+            </div>
+
             <div
-                class="bg-card flex flex-col gap-4 rounded-xl border p-4 sm:flex-row sm:items-center sm:justify-between"
+                v-if="status"
+                class="rounded-xl border border-emerald-200 bg-emerald-50 px-4 py-3 text-sm text-emerald-900 dark:border-emerald-900/70 dark:bg-emerald-950/40 dark:text-emerald-100"
             >
-                <div class="flex items-center gap-2">
-                    <Users class="text-primary size-5" aria-hidden="true" />
-                    <h2 class="font-semibold">{{ t('teams.yourTeams') }}</h2>
-                    <Badge variant="secondary">{{ teams.length }}</Badge>
-                </div>
-                <div class="relative sm:w-80">
-                    <Label for="team-search" class="sr-only">{{
-                        t('teams.search')
-                    }}</Label
-                    ><Search
-                        class="text-muted-foreground pointer-events-none absolute left-3 top-3 size-4"
-                        aria-hidden="true"
-                    /><Input
-                        id="team-search"
-                        v-model="search"
-                        type="search"
-                        class="pl-9"
-                        :placeholder="t('teams.search')"
-                    />
+                {{ status }}
+            </div>
+
+            <div
+                class="grid gap-6"
+                :class="
+                    canCreateTeams
+                        ? 'xl:grid-cols-[22rem_minmax(0,1fr)]'
+                        : 'xl:grid-cols-1'
+                "
+            >
+                <Card v-if="canCreateTeams">
+                    <CardHeader>
+                        <CardTitle>Create team</CardTitle>
+                        <CardDescription>
+                            Teams group users so project permissions can be
+                            granted once and inherited by every member.
+                        </CardDescription>
+                    </CardHeader>
+
+                    <CardContent>
+                        <Form
+                            v-bind="TeamController.store.form()"
+                            class="space-y-4"
+                            v-slot="{ errors, processing }"
+                        >
+                            <div class="grid gap-2">
+                                <Label for="name">Team name</Label>
+                                <Input
+                                    id="name"
+                                    name="name"
+                                    required
+                                    autofocus
+                                    placeholder="Platform Team"
+                                />
+                                <InputError :message="errors.name" />
+                            </div>
+
+                            <Button type="submit" :disabled="processing">
+                                Create team
+                            </Button>
+                        </Form>
+                    </CardContent>
+                </Card>
+
+                <div class="grid gap-4">
+                    <Card
+                        v-for="team in teams"
+                        :key="team.id"
+                        class="gap-0 overflow-hidden"
+                    >
+                        <CardHeader class="border-b">
+                            <div
+                                class="flex flex-col gap-3 md:flex-row md:items-start md:justify-between"
+                            >
+                                <div>
+                                    <CardTitle>{{ team.name }}</CardTitle>
+                                    <CardDescription>
+                                        {{ team.users.length }} member{{
+                                            team.users.length === 1 ? '' : 's'
+                                        }}
+                                    </CardDescription>
+                                </div>
+
+                                <div class="flex flex-wrap gap-2">
+                                    <Badge
+                                        v-for="member in team.users"
+                                        :key="member.id"
+                                        variant="secondary"
+                                    >
+                                        {{ member.name }}
+                                    </Badge>
+                                </div>
+                            </div>
+                        </CardHeader>
+
+                        <CardContent class="space-y-6 pt-6">
+                            <Form
+                                v-bind="
+                                    TeamController.updateMembers.form(team.id)
+                                "
+                                class="space-y-4"
+                                v-slot="{ processing }"
+                            >
+                                <div class="grid gap-2">
+                                    <Label :for="`team-members-${team.id}`">
+                                        Members
+                                    </Label>
+                                    <select
+                                        :id="`team-members-${team.id}`"
+                                        name="user_ids[]"
+                                        multiple
+                                        class="border-input bg-background shadow-xs focus-visible:border-ring focus-visible:ring-ring/50 min-h-44 rounded-md border px-3 py-2 text-sm outline-none transition-[color,box-shadow] focus-visible:ring-[3px]"
+                                    >
+                                        <option
+                                            v-for="user in users"
+                                            :key="user.id"
+                                            :value="user.id"
+                                            :selected="
+                                                team.user_ids.includes(user.id)
+                                            "
+                                        >
+                                            {{ user.name }} ({{ user.email }})
+                                        </option>
+                                    </select>
+                                    <p class="text-muted-foreground text-sm">
+                                        Hold Cmd or Ctrl to select multiple
+                                        users.
+                                    </p>
+                                </div>
+
+                                <Button
+                                    type="submit"
+                                    variant="outline"
+                                    :disabled="processing"
+                                >
+                                    Save members
+                                </Button>
+                            </Form>
+
+                            <div class="space-y-4 border-t pt-6">
+                                <div class="space-y-1">
+                                    <h3 class="text-foreground font-medium">
+                                        Team permissions
+                                    </h3>
+                                    <p class="text-muted-foreground text-sm">
+                                        Direct user permissions on this team are
+                                        stored separately from team membership.
+                                    </p>
+                                </div>
+
+                                <div class="overflow-x-auto">
+                                    <table
+                                        class="divide-border min-w-full divide-y text-sm"
+                                    >
+                                        <thead
+                                            class="bg-muted/40 text-muted-foreground text-left"
+                                        >
+                                            <tr>
+                                                <th
+                                                    class="px-4 py-3 font-medium"
+                                                >
+                                                    User
+                                                </th>
+                                                <th
+                                                    class="px-4 py-3 font-medium"
+                                                >
+                                                    Current permissions
+                                                </th>
+                                                <th
+                                                    class="px-4 py-3 text-right font-medium"
+                                                >
+                                                    Action
+                                                </th>
+                                            </tr>
+                                        </thead>
+                                        <tbody class="divide-border divide-y">
+                                            <tr
+                                                v-for="user in users"
+                                                :key="`${team.id}-${user.id}`"
+                                                class="bg-background align-top"
+                                            >
+                                                <td class="px-4 py-4">
+                                                    <div
+                                                        class="text-foreground font-medium"
+                                                    >
+                                                        {{ user.name }}
+                                                    </div>
+                                                    <div
+                                                        class="text-muted-foreground text-xs"
+                                                    >
+                                                        {{ user.email }}
+                                                    </div>
+                                                </td>
+                                                <td class="px-4 py-4">
+                                                    <div
+                                                        class="flex flex-wrap gap-2"
+                                                    >
+                                                        <Badge
+                                                            v-for="option in permissionOptions"
+                                                            v-show="
+                                                                hasPermission(
+                                                                    permissionsForTeam(
+                                                                        team.id,
+                                                                    ),
+                                                                    user.id,
+                                                                    option.value,
+                                                                )
+                                                            "
+                                                            :key="`${team.id}-${user.id}-${option.value}-badge`"
+                                                            variant="secondary"
+                                                        >
+                                                            {{ option.label }}
+                                                        </Badge>
+                                                        <span
+                                                            v-if="
+                                                                (
+                                                                    permissionsForTeam(
+                                                                        team.id,
+                                                                    )[
+                                                                        user.id
+                                                                    ] ?? []
+                                                                ).length === 0
+                                                            "
+                                                            class="text-muted-foreground"
+                                                        >
+                                                            No direct team
+                                                            permissions
+                                                        </span>
+                                                    </div>
+                                                </td>
+                                                <td class="px-4 py-4">
+                                                    <div
+                                                        class="flex justify-end"
+                                                    >
+                                                        <Form
+                                                            v-bind="
+                                                                TeamController.updateUserPermissions.form(
+                                                                    [
+                                                                        team.id,
+                                                                        user.id,
+                                                                    ],
+                                                                )
+                                                            "
+                                                            class="flex flex-wrap justify-end gap-3"
+                                                            v-slot="{
+                                                                processing,
+                                                            }"
+                                                        >
+                                                            <label
+                                                                v-for="option in permissionOptions"
+                                                                :key="`${team.id}-${user.id}-${option.value}`"
+                                                                class="border-border inline-flex items-center gap-2 rounded-lg border px-3 py-2 text-sm"
+                                                            >
+                                                                <input
+                                                                    type="checkbox"
+                                                                    name="permissions[]"
+                                                                    :value="
+                                                                        option.value
+                                                                    "
+                                                                    :checked="
+                                                                        hasPermission(
+                                                                            permissionsForTeam(
+                                                                                team.id,
+                                                                            ),
+                                                                            user.id,
+                                                                            option.value,
+                                                                        )
+                                                                    "
+                                                                    class="border-input text-primary focus:ring-ring size-4 rounded"
+                                                                />
+                                                                <span>
+                                                                    {{
+                                                                        option.label
+                                                                    }}
+                                                                </span>
+                                                            </label>
+
+                                                            <div
+                                                                class="w-full sm:hidden"
+                                                            />
+
+                                                            <Button
+                                                                type="submit"
+                                                                size="sm"
+                                                                variant="outline"
+                                                                :disabled="
+                                                                    processing
+                                                                "
+                                                            >
+                                                                Save
+                                                            </Button>
+                                                        </Form>
+                                                    </div>
+                                                </td>
+                                            </tr>
+                                        </tbody>
+                                    </table>
+                                </div>
+                            </div>
+                        </CardContent>
+                    </Card>
+
+                    <Card v-if="teams.length === 0">
+                        <CardContent class="text-muted-foreground p-6 text-sm">
+                            No teams are available for your current permissions.
+                        </CardContent>
+                    </Card>
                 </div>
             </div>
-            <FeedbackState
-                v-if="teams.length === 0"
-                state="empty"
-                :title="t('teams.empty')"
-                :description="
-                    t(
-                        canCreateTeams
-                            ? 'teams.emptyCreate'
-                            : 'teams.emptyDescription',
-                    )
-                "
-            />
-            <FeedbackState
-                v-else-if="visibleTeams.length === 0"
-                state="empty"
-                :title="t('teams.noResults')"
-                :description="t('teams.noResultsDescription')"
-                ><Button type="button" variant="outline" @click="search = ''">{{
-                    t('teams.clearSearch')
-                }}</Button></FeedbackState
-            >
-            <ul
-                v-else
-                class="grid min-w-0 gap-4 lg:grid-cols-2"
-                :aria-label="t('teams.yourTeams')"
-            >
-                <li
-                    v-for="team in visibleTeams"
-                    :key="team.id"
-                    class="bg-card flex min-w-0 flex-col rounded-xl border"
-                    :data-team-id="team.id"
-                >
-                    <div class="flex min-w-0 items-start gap-3 p-5">
-                        <span
-                            class="bg-accent text-primary flex size-11 shrink-0 items-center justify-center rounded-lg"
-                            ><Users class="size-5" aria-hidden="true"
-                        /></span>
-                        <div class="grid min-w-0 gap-1">
-                            <h3 class="break-words font-semibold">
-                                {{ team.name }}
-                            </h3>
-                            <p class="text-muted-foreground text-sm">
-                                {{
-                                    t('teams.memberCount', {
-                                        count: team.users.length,
-                                    })
-                                }}
-                            </p>
-                        </div>
-                    </div>
-                    <div class="flex-1 px-5 pb-5">
-                        <ul
-                            v-if="team.users.length"
-                            class="flex flex-wrap gap-2"
-                            :aria-label="t('teams.members')"
-                        >
-                            <li
-                                v-for="member in team.users"
-                                :key="member.id"
-                                class="bg-muted/60 flex min-w-0 max-w-full items-center gap-2 rounded-full py-1 pl-1 pr-3"
-                            >
-                                <UserAvatar
-                                    :user="member"
-                                    class="size-6 shrink-0"
-                                /><span class="min-w-0 break-words text-xs">{{
-                                    member.name
-                                }}</span>
-                            </li>
-                        </ul>
-                        <p v-else class="text-muted-foreground text-sm">
-                            {{ t('teams.noMembers') }}
-                        </p>
-                    </div>
-                    <div
-                        class="bg-muted/20 grid gap-2 border-t p-4 sm:grid-cols-2"
-                    >
-                        <Button
-                            type="button"
-                            variant="outline"
-                            :aria-label="
-                                t('teams.manageMembersFor', { name: team.name })
-                            "
-                            @click="target = { kind: 'members', team }"
-                            ><Users class="size-4" aria-hidden="true" />{{
-                                t('teams.manageMembers')
-                            }}</Button
-                        ><Button
-                            type="button"
-                            variant="ghost"
-                            :aria-label="
-                                t('teams.permissionsFor', { name: team.name })
-                            "
-                            @click="target = { kind: 'permissions', team }"
-                            ><Shield class="size-4" aria-hidden="true" />{{
-                                t('teams.permissions')
-                            }}</Button
-                        >
-                    </div>
-                </li>
-            </ul>
-        </main>
-        <TeamEditorDialog
-            :target="target"
-            :users="users"
-            :permission-options="permissionOptions"
-            :team-permissions="teamPermissions"
-            @close="target = null"
-        />
+        </div>
     </AppLayout>
 </template>

resources/js/types/page-props.ts

@@ -117,8 +117,6 @@ export type PermissionOption = {
 
 export type ProjectAccessPageProps = {
     directPermissions: Record<string, string[]>;
-    effectivePermissions: Record<string, string[]>;
-    globalAdminUserIds: number[];
     permissionOptions: PermissionOption[];
     project: ProjectModel;
     status?: string | null;

resources/js/types/project-access.ts

@@ -1,19 +0,0 @@
-export const projectPermissionLabels = {
-    'project:read': 'projectAccess.read',
-    'project:write': 'projectAccess.write',
-    'project:admin': 'projectAccess.admin',
-} as const;
-
-export const projectPermissionDescriptions = {
-    'project:read': 'projectAccess.readHelp',
-    'project:write': 'projectAccess.writeHelp',
-    'project:admin': 'projectAccess.adminHelp',
-} as const;
-
-export type ProjectAccessTarget = {
-    kind: 'user' | 'team';
-    id: number;
-    name: string;
-    permissions: string[];
-    globalAdmin?: boolean;
-};

resources/js/types/teams.ts

@@ -1,14 +0,0 @@
-import type { PermissionOption } from '@/types';
-import type { TeamModel } from '@/types/models/team-model';
-import type { UserModel } from '@/types/models/user-model';
-
-export type TeamEditorTarget =
-    | { kind: 'create' }
-    | { kind: 'members' | 'permissions'; team: TeamModel };
-
-export type TeamEditorProps = {
-    target: TeamEditorTarget | null;
-    users: UserModel[];
-    permissionOptions: PermissionOption[];
-    teamPermissions: Record<string, Record<string, string[]>>;
-};

tests/Feature/Projects/ProjectAccessTest.php

@@ -1,153 +0,0 @@
-<?php
-
-namespace Tests\Feature\Projects;
-
-use App\Actions\Permissions\PermissionService;
-use App\Enums\Permission;
-use App\Models\Project;
-use App\Models\Team;
-use App\Models\User;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-use Illuminate\Support\Facades\DB;
-use Inertia\Testing\AssertableInertia as Assert;
-use Tests\TestCase;
-
-class ProjectAccessTest extends TestCase
-{
-    use RefreshDatabase;
-
-    public function test_access_summary_matches_existing_permission_rules_and_excludes_other_scopes(): void
-    {
-        $admin = User::factory()->admin()->create();
-        $writer = User::factory()->create();
-        $member = User::factory()->create();
-        $outsider = User::factory()->create();
-        $project = Project::factory()->create();
-        $otherProject = Project::factory()->create();
-        $team = Team::factory()->create();
-        $otherTeam = Team::factory()->create();
-        $team->users()->attach([$writer->id, $member->id]);
-        $otherTeam->users()->attach($writer);
-        $service = app(PermissionService::class);
-        $service->sync($writer, $project, [Permission::ProjectRead]);
-        $service->sync($team, $project, [Permission::ProjectWrite]);
-        $service->sync($otherTeam, $project, [Permission::ProjectRead]);
-        $service->sync($outsider, $otherProject, [Permission::ProjectAdmin]);
-        $service->sync($outsider, null, [Permission::ProjectCreate]);
-        $service->sync($outsider, $team, [Permission::TeamAdmin]);
-
-        $map = $service->projectAccessMap(User::all(), $project);
-        foreach (User::all() as $user) {
-            $expected = array_values(array_filter(Permission::projectAssignable(), fn (Permission $permission): bool => $service->allows($user, $permission, $project)));
-            $this->assertSame(Permission::values($expected), $map['effectivePermissions'][$user->id]);
-        }
-        $this->assertSame([], $map['effectivePermissions'][$outsider->id]);
-        $this->assertSame(['project:read', 'project:write'], $map['effectivePermissions'][$writer->id]);
-        $this->assertSame([$admin->id], $map['globalAdminUserIds']);
-        $this->actingAs($admin)->get(route('projects.access', $project))->assertOk()
-            ->assertInertia(fn (Assert $page) => $page->component('projects/Access')
-                ->where("effectivePermissions.{$writer->id}", ['project:read', 'project:write'])
-                ->where("directPermissions.{$writer->id}", ['project:read'])
-                ->where("teamPermissions.{$team->id}", ['project:write'])
-                ->where('globalAdminUserIds', [$admin->id]));
-    }
-
-    public function test_bulk_access_summary_uses_a_bounded_number_of_queries(): void
-    {
-        $project = Project::factory()->create();
-        User::factory()->create();
-        $service = app(PermissionService::class);
-        $countQueries = function () use ($service, $project): int {
-            $users = User::all();
-            DB::enableQueryLog();
-            DB::flushQueryLog();
-            $service->projectAccessMap($users, $project);
-            $count = count(DB::getQueryLog());
-            DB::disableQueryLog();
-
-            return $count;
-        };
-        $initialCount = $countQueries();
-        $users = User::factory()->count(10)->create();
-        $team = Team::factory()->create();
-        $team->users()->attach($users);
-        $service->sync($team, $project, [Permission::ProjectWrite]);
-        $this->assertSame($initialCount, $countQueries());
-        $this->assertLessThanOrEqual(4, $initialCount);
-    }
-
-    public function test_readers_writers_and_unrelated_admins_cannot_manage_project_access(): void
-    {
-        $project = Project::factory()->create();
-        $other = Project::factory()->create();
-        $member = User::factory()->create();
-        $team = Team::factory()->create();
-        $service = app(PermissionService::class);
-        $service->sync($member, $project, [Permission::ProjectRead]);
-        $service->sync($team, $project, [Permission::ProjectWrite]);
-        foreach ([[], [Permission::ProjectRead], [Permission::ProjectWrite]] as $permissions) {
-            $actor = User::factory()->create();
-            $service->sync($actor, $project, $permissions);
-            $service->sync($actor, $other, [Permission::ProjectAdmin]);
-            $this->actingAs($actor)->get(route('projects.access', $project))->assertForbidden();
-            foreach ([['users', $member], ['teams', $team]] as [$kind, $assignee]) {
-                $this->patch(route("projects.permissions.{$kind}.update", [$project, $assignee]), ['permissions' => ['project:admin']])->assertForbidden();
-            }
-        }
-        $this->assertSame(['project:read'], $service->assignmentMap(User::class, $project)[$member->id]);
-        $this->assertSame(['project:write'], $service->assignmentMap(Team::class, $project)[$team->id]);
-    }
-
-    public function test_invalid_assignments_preserve_both_user_and_team_permissions(): void
-    {
-        $admin = User::factory()->admin()->create();
-        $project = Project::factory()->create();
-        $service = app(PermissionService::class);
-        foreach ([['users', User::factory()->create()], ['teams', Team::factory()->create()]] as [$kind, $assignee]) {
-            $service->sync($assignee, $project, [Permission::ProjectRead]);
-            foreach ([['global:admin'], ['team:admin'], ['unknown'], ['project:read', 'project:read']] as $permissions) {
-                $this->actingAs($admin)->patch(route("projects.permissions.{$kind}.update", [$project, $assignee]), ['permissions' => $permissions])
-                    ->assertSessionHasErrors('permissions.0');
-                $this->assertSame(['project:read'], $service->assignmentMap($assignee::class, $project)[$assignee->id]);
-            }
-        }
-    }
-
-    public function test_clearing_assignments_preserves_access_from_other_sources(): void
-    {
-        $admin = User::factory()->admin()->create();
-        $member = User::factory()->create();
-        $project = Project::factory()->create();
-        $team = Team::factory()->create();
-        $team->users()->attach($member);
-        $service = app(PermissionService::class);
-        $service->sync($member, $project, [Permission::ProjectRead]);
-        $service->sync($team, $project, [Permission::ProjectWrite]);
-        $this->actingAs($admin)->patch(route('projects.permissions.users.update', [$project, $member]), ['permissions' => []])
-            ->assertRedirect(route('projects.access', $project))->assertSessionHasNoErrors();
-        $this->assertTrue($service->allows($member, Permission::ProjectWrite, $project));
-        $service->sync($member, $project, [Permission::ProjectRead]);
-        $this->patch(route('projects.permissions.teams.update', [$project, $team]), ['permissions' => []])
-            ->assertRedirect(route('projects.access', $project))->assertSessionHasNoErrors();
-        $this->assertTrue($service->allows($member, Permission::ProjectRead, $project));
-        $this->assertFalse($service->allows($member, Permission::ProjectWrite, $project));
-    }
-
-    public function test_removing_own_admin_access_redirects_to_projects_for_direct_and_team_grants(): void
-    {
-        $service = app(PermissionService::class);
-        foreach (['users', 'teams'] as $kind) {
-            $actor = User::factory()->create();
-            $project = Project::factory()->create();
-            $assignee = $actor;
-            if ($kind === 'teams') {
-                $assignee = Team::factory()->create();
-                $assignee->users()->attach($actor);
-            }
-            $service->sync($assignee, $project, [Permission::ProjectAdmin]);
-            $this->actingAs($actor)->patch(route("projects.permissions.{$kind}.update", [$project, $assignee]), ['permissions' => []])
-                ->assertRedirect(route('projects.index'))->assertSessionHasNoErrors();
-            $this->assertFalse($service->allows($actor, Permission::ProjectAdmin, $project));
-        }
-    }
-}

tests/Feature/Projects/ProjectAccessUiTest.php

@@ -1,19 +0,0 @@
-<?php
-
-namespace Tests\Feature\Projects;
-
-use Symfony\Component\Process\Process;
-use Tests\TestCase;
-
-class ProjectAccessUiTest extends TestCase
-{
-    public function test_access_overview_renders_sources_empty_states_and_localization(): void
-    {
-        $process = new Process(['node', 'tests/Fixtures/project-access.mjs'], base_path());
-        $process->setTimeout(60);
-        $process->run();
-
-        $this->assertTrue($process->isSuccessful(), $process->getOutput().$process->getErrorOutput());
-        $this->assertStringContainsString('Project access presentation checks passed.', $process->getOutput());
-    }
-}

tests/Feature/Teams/TeamControllerTest.php

@@ -214,89 +214,4 @@ class TeamControllerTest extends TestCase
             'scope_type' => $team->getMorphClass(),
         ]);
     }
-
-    public function test_team_managers_only_see_their_manageable_teams(): void
-    {
-        $manager = User::factory()->create();
-        $managed = Team::factory()->create();
-        $other = Team::factory()->create();
-        $other->users()->attach($manager);
-        $this->syncTeamPermissions($managed, $manager, ['team:manage']);
-
-        $this->actingAs($manager)->get(route('teams.index'))
-            ->assertInertia(fn (Assert $page) => $page
-                ->has('teams', 1)
-                ->where('teams.0.id', $managed->id)
-                ->where('canCreateTeams', false)
-            );
-
-        $this->actingAs($manager)->patch(route('teams.members.update', $other), ['user_ids' => []])
-            ->assertForbidden();
-        $this->actingAs($manager)->patch(route('teams.permissions.users.update', [$other, $manager]), ['permissions' => ['team:admin']])
-            ->assertForbidden();
-        $this->assertDatabaseHas('team_user', ['team_id' => $other->id, 'user_id' => $manager->id]);
-        $this->assertDatabaseMissing('permission_assignments', ['scope_id' => $other->id, 'scope_type' => $other->getMorphClass()]);
-    }
-
-    public function test_invalid_team_names_are_rejected(): void
-    {
-        $admin = User::factory()->admin()->create();
-        $team = Team::factory()->create();
-
-        foreach (['', $team->name, str_repeat('a', 256)] as $name) {
-            $this->actingAs($admin)->from(route('teams.index'))->post(route('teams.store'), ['name' => $name])
-                ->assertRedirect(route('teams.index'))->assertSessionHasErrors('name');
-        }
-        $this->assertDatabaseCount('teams', 1);
-    }
-
-    public function test_invalid_members_preserve_existing_membership(): void
-    {
-        $admin = User::factory()->admin()->create();
-        $member = User::factory()->create();
-        $team = Team::factory()->create();
-        $team->users()->attach($member);
-
-        foreach ([[$member->id, $member->id], [999999], ['invalid']] as $ids) {
-            $this->actingAs($admin)->patch(route('teams.members.update', $team), ['user_ids' => $ids])
-                ->assertSessionHasErrors('user_ids.0');
-            $this->assertSame([$member->id], $team->users()->pluck('users.id')->all());
-        }
-    }
-
-    public function test_membership_and_direct_permissions_can_be_cleared_independently(): void
-    {
-        $manager = User::factory()->create();
-        $member = User::factory()->create();
-        $team = Team::factory()->create();
-        $team->users()->attach($member);
-        $this->syncTeamPermissions($team, $manager, ['team:manage']);
-        $this->syncTeamPermissions($team, $member, ['team:invite']);
-
-        $this->actingAs($manager)->patch(route('teams.members.update', $team), ['user_ids' => []])
-            ->assertRedirect(route('teams.index'))->assertSessionHasNoErrors();
-        $this->assertDatabaseMissing('team_user', ['team_id' => $team->id]);
-        $this->assertDatabaseHas('permission_assignments', ['assignee_id' => $member->id, 'scope_id' => $team->id, 'permission' => 'team:invite']);
-
-        $team->users()->attach($member);
-        $this->actingAs($manager)->patch(route('teams.permissions.users.update', [$team, $member]), ['permissions' => []])
-            ->assertRedirect(route('teams.index'))->assertSessionHasNoErrors();
-        $this->assertDatabaseHas('team_user', ['team_id' => $team->id, 'user_id' => $member->id]);
-        $this->assertDatabaseMissing('permission_assignments', ['assignee_id' => $member->id, 'scope_id' => $team->id, 'scope_type' => $team->getMorphClass()]);
-    }
-
-    public function test_invalid_permissions_preserve_existing_assignments(): void
-    {
-        $admin = User::factory()->admin()->create();
-        $member = User::factory()->create();
-        $team = Team::factory()->create();
-        $this->syncTeamPermissions($team, $member, ['team:invite']);
-
-        foreach ([['global:admin'], ['team:manage', 'team:manage'], ['unknown']] as $permissions) {
-            $this->actingAs($admin)->patch(route('teams.permissions.users.update', [$team, $member]), ['permissions' => $permissions])
-                ->assertSessionHasErrors('permissions.0');
-            $this->assertDatabaseHas('permission_assignments', ['assignee_id' => $member->id, 'scope_id' => $team->id, 'permission' => 'team:invite']);
-            $this->assertDatabaseMissing('permission_assignments', ['assignee_id' => $member->id, 'permission' => 'global:admin']);
-        }
-    }
 }

tests/Feature/Teams/TeamPresentationTest.php

@@ -1,19 +0,0 @@
-<?php
-
-namespace Tests\Feature\Teams;
-
-use Symfony\Component\Process\Process;
-use Tests\TestCase;
-
-class TeamPresentationTest extends TestCase
-{
-    public function test_team_overview_respects_permissions_empty_states_and_localization(): void
-    {
-        $process = new Process(['node', 'tests/Fixtures/teams.mjs'], base_path());
-        $process->setTimeout(60);
-        $process->run();
-
-        $this->assertTrue($process->isSuccessful(), $process->getOutput().$process->getErrorOutput());
-        $this->assertStringContainsString('Teams presentation checks passed.', $process->getOutput());
-    }
-}

tests/Fixtures/clipboard-browser.mjs

@@ -1,105 +0,0 @@
-import assert from 'node:assert/strict';
-import process from 'node:process';
-import { createServer } from 'vite';
-
-const { chromium } = await import(
-    process.env.PLAYWRIGHT_MODULE ?? 'playwright'
-);
-const server = await createServer({
-    configFile: false,
-    optimizeDeps: { noDiscovery: true, include: [] },
-    server: { host: '127.0.0.1', port: 0, hmr: false },
-    appType: 'custom',
-});
-server.middlewares.use((request, response, next) => {
-    if (request.url !== '/') {
-        return next();
-    }
-    response.setHeader('Content-Type', 'text/html');
-    response.end(`<!doctype html><html><body>
-        <div role="dialog"><input id="draft" value="unsaved draft"><button id="copy">Copy</button></div>
-        <script type="module">
-            import { copyText } from '/resources/js/lib/clipboard.ts';
-            window.originalClipboard = navigator.clipboard;
-            window.copyText = copyText;
-            document.querySelector('#copy').onclick = async () => {
-                window.result = 'pending';
-                const input = document.querySelector('#draft');
-                input.focus(); input.setSelectionRange(1, 5);
-                try { await copyText('kan55 selected text'); window.result = 'copied'; }
-                catch { window.result = 'failed'; }
-            };
-        </script></body></html>`);
-});
-await server.listen();
-const browser = await chromium.launch({ channel: 'chrome', headless: true });
-const context = await browser.newContext({
-    permissions: ['clipboard-read', 'clipboard-write'],
-});
-const page = await context.newPage();
-try {
-    await page.goto(`http://127.0.0.1:${server.httpServer.address().port}/`);
-    await page.waitForFunction(() => typeof window.copyText === 'function');
-    for (const mode of ['modern', 'absent', 'denied']) {
-        await page.evaluate(async (mode) => {
-            Object.defineProperty(navigator, 'clipboard', {
-                configurable: true,
-                value:
-                    mode === 'modern'
-                        ? window.originalClipboard
-                        : mode === 'absent'
-                          ? undefined
-                          : {
-                                writeText: () =>
-                                    Promise.reject(
-                                        new DOMException(
-                                            'Denied',
-                                            'NotAllowedError',
-                                        ),
-                                    ),
-                            },
-            });
-            await window.originalClipboard.writeText('previous');
-            // Simulate the modal's focus boundary used by the two-factor setup dialog.
-            document.onfocusin = (event) => {
-                if (!event.target.closest('[role="dialog"]')) {
-                    document.querySelector('#draft').focus();
-                }
-            };
-        }, mode);
-        await page.getByRole('button', { name: 'Copy', exact: true }).click();
-        await page.waitForFunction(() => window.result === 'copied');
-        assert.equal(
-            await page.evaluate(() => window.originalClipboard.readText()),
-            'kan55 selected text',
-            mode,
-        );
-        assert.deepEqual(
-            await page.evaluate(() => {
-                const input = document.querySelector('#draft');
-                return [
-                    document.activeElement === input,
-                    input.value,
-                    input.selectionStart,
-                    input.selectionEnd,
-                    document.querySelectorAll('textarea').length,
-                ];
-            }),
-            [true, 'unsaved draft', 1, 5, 0],
-            mode,
-        );
-    }
-    await page.evaluate(() => {
-        document.execCommand = () => false;
-    });
-    await page.getByRole('button', { name: 'Copy', exact: true }).click();
-    await page.waitForFunction(() => window.result === 'failed');
-    assert.equal(await page.locator('textarea').count(), 0);
-    assert.equal(await page.locator('#draft').inputValue(), 'unsaved draft');
-    console.log(
-        'Clipboard browser checks passed: async API, unavailable/denied API fallback, modal focus, input selection and failure cleanup.',
-    );
-} finally {
-    await browser.close();
-    await server.close();
-}

tests/Fixtures/project-access-browser.mjs

@@ -1,189 +0,0 @@
-import assert from 'node:assert/strict';
-import process from 'node:process';
-const { chromium } = await import(
-    process.env.PLAYWRIGHT_MODULE ?? 'playwright'
-);
-const browser = await chromium.launch({ channel: 'chrome', headless: true });
-const context = await browser.newContext({ reducedMotion: 'reduce' });
-const page = await context.newPage();
-page.setDefaultTimeout(10000);
-const errors = [];
-page.on('pageerror', (error) => errors.push(error.message));
-const base = 'http://127.0.0.1:4198';
-const result = (value) =>
-    context.addCookies([{ name: 'access_result', value, url: base }]);
-const visit = async (query = '') => {
-    await result('success');
-    await page.goto(base + '/projects/1/access?reset' + query);
-    await page
-        .getByRole('heading', { name: 'Project access', exact: true })
-        .waitFor();
-};
-const button = (name) => page.getByRole('button', { name, exact: true });
-const dialog = () => page.getByRole('dialog');
-const checkbox = (name) =>
-    dialog().getByRole('checkbox', { name, exact: true });
-const state = (value) =>
-    dialog()
-        .locator('[data-form-state="' + value + '"]')
-        .waitFor({ state: 'visible' });
-const noOverflow = async () =>
-    assert.equal(
-        await page.evaluate(
-            () => document.documentElement.scrollWidth <= innerWidth,
-        ),
-        true,
-    );
-const save = async () => {
-    const request = page.waitForRequest((r) => r.method() === 'PATCH');
-    await dialog()
-        .getByRole('button', { name: 'Save permissions', exact: true })
-        .click();
-    return await request;
-};
-try {
-    for (const width of [1440, 390, 320]) {
-        await page.setViewportSize({ width, height: 1000 });
-        for (const theme of ['light', 'dark']) {
-            await page.emulateMedia({ colorScheme: theme });
-            await visit();
-            await noOverflow();
-            const trigger = button('Edit access for Sam Taylor');
-            await trigger.focus();
-            await page.keyboard.press('Enter');
-            await dialog().waitFor();
-            await noOverflow();
-            assert.equal(await checkbox('Read').isChecked(), true);
-            assert.equal(
-                await checkbox('Write').isChecked(),
-                false,
-                'Inherited write must not be editable as a direct grant',
-            );
-            await checkbox('Write').focus();
-            await page.keyboard.press('Space');
-            assert.equal(await checkbox('Write').isChecked(), true);
-            await page.keyboard.press('Space');
-            await page.keyboard.press('Tab');
-            assert.equal(
-                await dialog().evaluate((el) =>
-                    el.contains(document.activeElement),
-                ),
-                true,
-            );
-            await page.screenshot({
-                path:
-                    '/private/tmp/kan48-dialog-' + width + '-' + theme + '.png',
-            });
-            await page.keyboard.press('Escape');
-            await dialog().waitFor({ state: 'hidden' });
-            assert.equal(
-                await trigger.evaluate((el) => el === document.activeElement),
-                true,
-            );
-            await page.screenshot({
-                path: '/private/tmp/kan48-' + width + '-' + theme + '.png',
-                fullPage: true,
-            });
-        }
-    }
-    await page.locator('#access-search').fill('SAM@EXAMPLE');
-    assert.equal(await page.locator('[data-user-id]').count(), 1);
-    await page.getByText('No matching teams', { exact: true }).waitFor();
-    await page.locator('#access-search').fill('unmatched');
-    await page.getByText('No matching people', { exact: true }).waitFor();
-    await visit('&empty&noUsers');
-    await page.getByText('No teams yet', { exact: true }).waitFor();
-    await page.getByText('No people available', { exact: true }).waitFor();
-    await visit();
-    await button('Edit access for Alex Morgan').click();
-    await dialog()
-        .getByText('This person is a global administrator.', { exact: false })
-        .waitFor();
-    await page.keyboard.press('Escape');
-    await button('Edit access for Sam Taylor').click();
-    await checkbox('Read').uncheck();
-    const request = await save();
-    assert.equal(
-        new URL(request.url()).pathname,
-        '/projects/1/permissions/users/2',
-    );
-    assert.deepEqual(request.postDataJSON(), { permissions: [] });
-    await dialog().waitFor({ state: 'hidden' });
-    await page
-        .locator('[data-user-id="2"]')
-        .getByText('Write', { exact: true })
-        .first()
-        .waitFor();
-    await button('Edit access for Sam Taylor').click();
-    assert.equal(await checkbox('Read').isChecked(), false);
-    await page.keyboard.press('Escape');
-    await button('Edit access for Platform team').click();
-    await checkbox('Write').uncheck();
-    await save();
-    await dialog().waitFor({ state: 'hidden' });
-    await page
-        .locator('[data-user-id="2"]')
-        .getByText('No project access', { exact: true })
-        .waitFor();
-
-    await button('Edit access for Sam Taylor').click();
-    await checkbox('Administrator').check();
-    await result('validation');
-    await save();
-    await state('validation');
-    await dialog()
-        .getByText('This permission is unavailable.', { exact: true })
-        .waitFor();
-    assert.equal(await checkbox('Administrator').isChecked(), true);
-    assert.equal(
-        await dialog().locator('fieldset').getAttribute('aria-invalid'),
-        'true',
-    );
-    await result('server');
-    await save();
-    await state('server');
-    await result('success');
-    await page.route('**/permissions/users/2', (route) =>
-        route.abort('failed'),
-    );
-    await save();
-    await state('network');
-    await page.unroute('**/permissions/users/2');
-    await dialog()
-        .getByRole('button', { name: 'Try again', exact: true })
-        .click();
-    await dialog().waitFor({ state: 'hidden' });
-    await page
-        .locator('[data-user-id="2"]')
-        .getByText('Administrator', { exact: true })
-        .first()
-        .waitFor();
-    await button('Edit access for Sam Taylor').click();
-    assert.equal(await checkbox('Administrator').isChecked(), true);
-    await result('forbidden');
-    await save();
-    await state('server');
-    await dialog()
-        .getByText('Project access can no longer be changed', { exact: true })
-        .waitFor();
-    assert.equal(
-        await dialog().getByRole('button', { name: 'Try again' }).count(),
-        0,
-    );
-    await page.keyboard.press('Escape');
-    await visit();
-    await button('Edit access for Sam Taylor').click();
-    await checkbox('Write').check();
-    page.once('dialog', (d) => d.dismiss());
-    await page.keyboard.press('Escape');
-    assert.equal(await dialog().isVisible(), true);
-    page.once('dialog', (d) => d.accept());
-    await page.keyboard.press('Escape');
-    await dialog().waitFor({ state: 'hidden' });
-    assert.deepEqual(errors, []);
-    console.log(
-        'Project access browser checks passed: direct/team updates and clearing, effective access refresh, errors/retry, unsaved changes, keyboard, 320/390/1440px, both themes.',
-    );
-} finally {
-    await browser.close();
-}

tests/Fixtures/project-access-preview.mjs

@@ -1,15 +0,0 @@
-import { createApp, h } from 'vue';
-import { createInertiaApp } from '@inertiajs/vue3';
-import '../../resources/css/app.css';
-import Access from '../../resources/js/pages/projects/Access.vue';
-import { createAppearance } from '../../resources/js/composables/useAppearance';
-import { createLocalization } from '../../resources/js/lib/localization';
-createInertiaApp({
-    resolve: () => Access,
-    setup: ({ el, App, props, plugin }) =>
-        createApp({ render: () => h(App, props) })
-            .use(plugin)
-            .use(createLocalization())
-            .use(createAppearance())
-            .mount(el),
-});

tests/Fixtures/project-access.mjs

@@ -1,229 +0,0 @@
-import assert from 'node:assert/strict';
-import process from 'node:process';
-import { fileURLToPath } from 'node:url';
-import vue from '@vitejs/plugin-vue';
-import tailwind from '@tailwindcss/vite';
-import { createServer } from 'vite';
-import { createSSRApp, h } from 'vue';
-import { renderToString } from 'vue/server-renderer';
-import { createInertiaApp } from '@inertiajs/vue3';
-const serve = process.argv.includes('--serve');
-const server = await createServer({
-    configFile: false,
-    cacheDir: 'node_modules/.vite/project-access-fixture',
-    plugins: [vue(), ...(serve ? [tailwind()] : [])],
-    resolve: {
-        alias: {
-            '@': fileURLToPath(new URL('../../resources/js', import.meta.url)),
-        },
-    },
-    server: serve
-        ? { host: '127.0.0.1', port: 4198, strictPort: true, hmr: false }
-        : { middlewareMode: true, hmr: false, watch: null },
-    appType: 'custom',
-});
-const users = [
-    { id: 1, name: 'Alex Morgan', email: 'alex@example.test', avatar: null },
-    { id: 2, name: 'Sam Taylor', email: 'sam@example.test', avatar: null },
-    {
-        id: 3,
-        name: 'Jordan Longname With Several Names',
-        email: 'jordan.long.email.address@example.test',
-        avatar: null,
-    },
-];
-function initial() {
-    return {
-        project: { id: 1, name: 'Core platform', key: 'CORE' },
-        users,
-        status: null,
-        globalAdminUserIds: [1],
-        directPermissions: { 2: ['project:read'] },
-        teamPermissions: { 1: ['project:write'] },
-        effectivePermissions: {
-            1: ['project:read', 'project:write', 'project:admin'],
-            2: ['project:read', 'project:write'],
-            3: [],
-        },
-        teams: [
-            { id: 1, name: 'Platform team', user_ids: [2], users: [users[1]] },
-            { id: 2, name: 'Delivery team', user_ids: [], users: [] },
-        ],
-        permissionOptions: ['read', 'write', 'admin'].map((name) => ({
-            value: 'project:' + name,
-            label: name,
-        })),
-    };
-}
-const makePage = (extra = {}) => ({
-    component: 'Access',
-    url: '/projects/1/access',
-    version: null,
-    clearHistory: false,
-    encryptHistory: false,
-    props: {
-        name: 'KanbanGit',
-        errors: {},
-        sidebarOpen: true,
-        appearance: 'system',
-        auth: {
-            user: users[0],
-            permissions: {
-                globalAdmin: false,
-                projectCreate: false,
-                canManageTeams: true,
-            },
-        },
-        navigation: { project: null },
-        ...initial(),
-        ...extra,
-    },
-});
-if (serve) {
-    let data = initial();
-    server.middlewares.use(async (request, response, next) => {
-        if (!request.url.startsWith('/projects/1/')) {
-            return next();
-        }
-        const url = new URL(request.url, 'http://localhost');
-        if (url.searchParams.has('reset')) {
-            data = initial();
-        }
-        if (url.searchParams.has('noUsers')) {
-            data.users = [];
-        }
-        if (url.searchParams.has('empty')) {
-            data.teams = [];
-        }
-        let errors = {};
-        if (request.method !== 'GET') {
-            const result =
-                request.headers.cookie?.match(/access_result=(\w+)/)?.[1] ??
-                'success';
-            if (['server', 'forbidden'].includes(result)) {
-                response.statusCode = result === 'forbidden' ? 403 : 503;
-                response.end('Simulated failure');
-                return;
-            }
-            let body = '';
-            for await (const chunk of request) {
-                body += chunk;
-            }
-            const submitted = JSON.parse(body || '{}');
-            if (result === 'validation') {
-                errors = { 'permissions.0': 'This permission is unavailable.' };
-            } else {
-                const parts = url.pathname.split('/');
-                const kind = parts[4];
-                const id = parts[5];
-                data[
-                    kind === 'users' ? 'directPermissions' : 'teamPermissions'
-                ][id] = submitted.permissions;
-                for (const user of users) {
-                    const grants = [
-                        ...(data.directPermissions[user.id] ?? []),
-                        ...data.teams
-                            .filter((team) => team.user_ids.includes(user.id))
-                            .flatMap(
-                                (team) => data.teamPermissions[team.id] ?? [],
-                            ),
-                    ];
-                    data.effectivePermissions[user.id] =
-                        data.globalAdminUserIds.includes(user.id) ||
-                        grants.includes('project:admin')
-                            ? ['project:read', 'project:write', 'project:admin']
-                            : grants.includes('project:write')
-                              ? ['project:read', 'project:write']
-                              : grants.includes('project:read')
-                                ? ['project:read']
-                                : [];
-                }
-            }
-            if (Object.keys(errors).length === 0) {
-                data.status = 'Saved';
-            }
-        }
-        const page = makePage({ ...data, errors });
-        response.setHeader('Vary', 'X-Inertia');
-        if (request.headers['x-inertia']) {
-            response.setHeader('X-Inertia', 'true');
-            response.setHeader('Content-Type', 'application/json');
-            response.end(JSON.stringify(page));
-            return;
-        }
-        const escaped = JSON.stringify(page)
-            .replaceAll('&', '&')
-            .replaceAll('"', '"')
-            .replaceAll('<', '&lt;');
-        response.setHeader('Content-Type', 'text/html');
-        response.end(
-            await server.transformIndexHtml(
-                request.url,
-                '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"></head><body><div id="app" data-page="' +
-                    escaped +
-                    '"></div><script type="module" src="/tests/Fixtures/project-access-preview.mjs"></script></body></html>',
-            ),
-        );
-    });
-    await server.listen();
-    console.log('Project access fixture ready.');
-} else {
-    try {
-        const { createLocalization } = await server.ssrLoadModule(
-            '/resources/js/lib/localization.ts',
-        );
-        const { createAppearance } = await server.ssrLoadModule(
-            '/resources/js/composables/useAppearance.ts',
-        );
-        const { en } = await server.ssrLoadModule(
-            '/resources/js/locales/en.ts',
-        );
-        const component = (
-            await server.ssrLoadModule(
-                '/resources/js/pages/projects/Access.vue',
-            )
-        ).default;
-        const render = async (extra = {}, locale = createLocalization()) =>
-            (
-                await createInertiaApp({
-                    page: makePage(extra),
-                    resolve: () => component,
-                    render: renderToString,
-                    setup: ({ App, props, plugin }) =>
-                        createSSRApp({ render: () => h(App, props) })
-                            .use(plugin)
-                            .use(locale)
-                            .use(createAppearance()),
-                })
-            ).body;
-        const html = await render();
-        assert.match(html, /People and effective access/);
-        assert.match(html, /Global administrator · all project permissions/);
-        assert.match(html, /Via Platform team:/);
-        assert.match(html, /No project access/);
-        assert.match(html, /Edit access for Sam Taylor/);
-        assert.match(html, /No project permissions assigned/);
-        assert.doesNotMatch(html, /<table|type="checkbox"/);
-        assert.doesNotMatch(html, /href="[^"]*settings\/general/);
-        assert.match(await render({ teams: [] }), /No teams yet/);
-        assert.match(await render({ users: [] }), /No people available/);
-        const translated = await render(
-            {},
-            createLocalization(
-                { locale: 'de' },
-                {
-                    de: {
-                        ...en,
-                        'projectAccess.title': 'Projektzugriff',
-                        'projectAccess.read': 'Lesen',
-                    },
-                },
-            ),
-        );
-        assert.match(translated, /Projektzugriff/);
-        assert.match(translated, /Lesen/);
-        console.log('Project access presentation checks passed.');
-    } finally {
-        await server.close();
-    }
-}

tests/Fixtures/security-browser.mjs

@@ -82,25 +82,6 @@ try {
                 ),
                 true,
             );
-            await page.evaluate(() => {
-                window.savedClipboard = navigator.clipboard;
-                Object.defineProperty(navigator, 'clipboard', {
-                    configurable: true,
-                    value: undefined,
-                });
-            });
-            await button('Copy key').click();
-            assert.equal(
-                await page.evaluate(() => window.savedClipboard.readText()),
-                'MANUALSETUPTESTKEY',
-            );
-            assert.equal(await dialog().locator('textarea').count(), 0);
-            await page.evaluate(() => {
-                Object.defineProperty(navigator, 'clipboard', {
-                    configurable: true,
-                    value: window.savedClipboard,
-                });
-            });
             await button('Continue').click();
             const code = page.getByLabel('Authentication code', {
                 exact: true,

tests/Fixtures/teams-browser.mjs

@@ -1,200 +0,0 @@
-import assert from 'node:assert/strict';
-import process from 'node:process';
-const { chromium } = await import(
-    process.env.PLAYWRIGHT_MODULE ?? 'playwright'
-);
-const browser = await chromium.launch({ channel: 'chrome', headless: true });
-const context = await browser.newContext({ reducedMotion: 'reduce' });
-const page = await context.newPage();
-page.setDefaultTimeout(10000);
-const errors = [];
-page.on('pageerror', (error) => errors.push(error.message));
-const base = 'http://127.0.0.1:4197';
-const result = (value) =>
-    context.addCookies([{ name: 'teams_result', value, url: base }]);
-const visit = async (query = '') => {
-    await result('success');
-    await page.goto(base + '/teams?reset' + query);
-    await page.getByRole('heading', { name: 'Teams', exact: true }).waitFor();
-};
-const button = (name) => page.getByRole('button', { name, exact: true });
-const dialog = () => page.getByRole('dialog');
-const state = (value) =>
-    dialog()
-        .locator('[data-form-state="' + value + '"]')
-        .waitFor({ state: 'visible' });
-const noOverflow = async () =>
-    assert.equal(
-        await page.evaluate(
-            () => document.documentElement.scrollWidth <= innerWidth,
-        ),
-        true,
-    );
-const save = async (label) => {
-    const request = page.waitForRequest((r) =>
-        ['POST', 'PATCH'].includes(r.method()),
-    );
-    await dialog().getByRole('button', { name: label, exact: true }).click();
-    return (await request).postDataJSON();
-};
-try {
-    for (const width of [1440, 390, 320]) {
-        await page.setViewportSize({ width, height: 900 });
-        for (const theme of ['light', 'dark']) {
-            await page.emulateMedia({ colorScheme: theme });
-            await visit();
-            await noOverflow();
-            await page.screenshot({
-                path: '/private/tmp/kan47-' + width + '-' + theme + '.png',
-                fullPage: true,
-            });
-            const trigger = button('Manage members of Platform team');
-            await trigger.focus();
-            await page.keyboard.press('Enter');
-            await dialog().waitFor();
-            await page.keyboard.press('Tab');
-            assert.equal(
-                await dialog().evaluate((el) =>
-                    el.contains(document.activeElement),
-                ),
-                true,
-            );
-            await noOverflow();
-            await page.screenshot({
-                path:
-                    '/private/tmp/kan47-members-' +
-                    width +
-                    '-' +
-                    theme +
-                    '.png',
-                fullPage: true,
-            });
-            await page.keyboard.press('Escape');
-            await dialog().waitFor({ state: 'hidden' });
-            assert.equal(
-                await trigger.evaluate((el) => document.activeElement === el),
-                true,
-            );
-        }
-    }
-    await visit('&manager');
-    assert.equal(await button('Create team').count(), 0);
-    await visit('&empty');
-    await page.getByText('No teams to manage', { exact: true }).waitFor();
-    await visit();
-    await page.getByLabel('Search teams', { exact: true }).fill('missing');
-    await page.getByText('No matching teams', { exact: true }).waitFor();
-    await button('Clear search').click();
-    await button('Create team').click();
-    await page.getByLabel('Team name', { exact: true }).fill('New team');
-    await result('validation');
-    assert.deepEqual(await save('Create team'), { name: 'New team' });
-    await state('validation');
-    assert.equal(
-        await page.getByLabel('Team name', { exact: true }).inputValue(),
-        'New team',
-    );
-    await page
-        .getByText('This team name is already taken.', { exact: true })
-        .waitFor();
-    await result('success');
-    await save('Create team');
-    await dialog().waitFor({ state: 'hidden' });
-    await page
-        .getByRole('heading', { name: 'New team', exact: true })
-        .waitFor();
-
-    await button('Manage members of Platform team').click();
-    const person = (name) =>
-        dialog().getByRole('checkbox', { name: new RegExp(name) });
-    await page.getByLabel('Find people').fill('sam@');
-    await person('Sam Taylor').check();
-    await page.getByLabel('Find people').fill('');
-    assert.equal(await person('Alex Morgan').isChecked(), true);
-    let dismissed = false;
-    page.once('dialog', async (d) => {
-        dismissed = true;
-        await d.dismiss();
-    });
-    await dialog().getByRole('button', { name: 'Cancel', exact: true }).click();
-    assert.equal(dismissed, true);
-    assert.equal(await dialog().isVisible(), true);
-    await result('validation');
-    assert.deepEqual(await save('Save members'), { user_ids: [1, 2] });
-    await state('validation');
-    await page
-        .getByText('This user is unavailable.', { exact: true })
-        .waitFor();
-    assert.equal(await person('Sam Taylor').isChecked(), true);
-    await page.route('**/teams/1/members', (route) => route.abort('failed'));
-    await save('Save members');
-    await state('network');
-    await page.unroute('**/teams/1/members');
-    await result('server');
-    await save('Save members');
-    await state('server');
-    await result('success');
-    await dialog()
-        .getByRole('button', { name: 'Try again', exact: true })
-        .click();
-    await dialog().waitFor({ state: 'hidden' });
-    await button('Manage members of Platform team').click();
-    await person('Alex Morgan').uncheck();
-    await person('Sam Taylor').uncheck();
-    assert.deepEqual(await save('Save members'), { user_ids: [] });
-    await dialog().waitFor({ state: 'hidden' });
-
-    await button('Manage permissions for Platform team').click();
-    assert.equal(
-        await dialog()
-            .getByRole('button', { name: 'Save permissions', exact: true })
-            .isDisabled(),
-        true,
-    );
-    await page.getByLabel('User', { exact: true }).selectOption('2');
-    assert.equal(await person('Team invite').isChecked(), true);
-    await person('Team manage').check();
-    page.once('dialog', (d) => d.dismiss());
-    await page.getByLabel('User', { exact: true }).selectOption('3');
-    assert.equal(
-        await page.getByLabel('User', { exact: true }).inputValue(),
-        '2',
-    );
-    await result('validation');
-    assert.deepEqual(await save('Save permissions'), {
-        permissions: ['team:invite', 'team:manage'],
-    });
-    await state('validation');
-    await page
-        .getByText('This permission is unavailable.', { exact: true })
-        .waitFor();
-    await result('forbidden');
-    await save('Save permissions');
-    await state('server');
-    await page
-        .getByText('You no longer have permission', { exact: true })
-        .waitFor();
-    assert.equal(
-        await dialog()
-            .getByRole('button', { name: 'Try again', exact: true })
-            .count(),
-        0,
-    );
-    assert.equal(await person('Team manage').isChecked(), true);
-    await result('success');
-    await save('Save permissions');
-    await dialog().waitFor({ state: 'hidden' });
-    await button('Manage permissions for Platform team').click();
-    await page.getByLabel('User', { exact: true }).selectOption('2');
-    assert.equal(await person('Team manage').isChecked(), true);
-    await person('Team invite').uncheck();
-    await person('Team manage').uncheck();
-    assert.deepEqual(await save('Save permissions'), { permissions: [] });
-    await dialog().waitFor({ state: 'hidden' });
-    assert.deepEqual(errors, []);
-    console.log(
-        'Teams browser checks passed: creation, membership, permissions, empty selections, validation, network/server/403, draft protection, focus, keyboard, themes and mobile.',
-    );
-} finally {
-    await browser.close();
-}

tests/Fixtures/teams-preview.mjs

@@ -1,15 +0,0 @@
-import { createApp, h } from 'vue';
-import { createInertiaApp } from '@inertiajs/vue3';
-import '../../resources/css/app.css';
-import Teams from '../../resources/js/pages/teams/Index.vue';
-import { createAppearance } from '../../resources/js/composables/useAppearance';
-import { createLocalization } from '../../resources/js/lib/localization';
-createInertiaApp({
-    resolve: () => Teams,
-    setup: ({ el, App, props, plugin }) =>
-        createApp({ render: () => h(App, props) })
-            .use(plugin)
-            .use(createLocalization())
-            .use(createAppearance())
-            .mount(el),
-});

tests/Fixtures/teams.mjs

@@ -1,220 +0,0 @@
-import assert from 'node:assert/strict';
-import process from 'node:process';
-import { fileURLToPath } from 'node:url';
-import vue from '@vitejs/plugin-vue';
-import tailwind from '@tailwindcss/vite';
-import { createServer } from 'vite';
-import { createSSRApp, h } from 'vue';
-import { renderToString } from 'vue/server-renderer';
-import { createInertiaApp } from '@inertiajs/vue3';
-const serve = process.argv.includes('--serve');
-const server = await createServer({
-    configFile: false,
-    cacheDir: 'node_modules/.vite/teams-fixture',
-    plugins: [vue(), ...(serve ? [tailwind()] : [])],
-    resolve: {
-        alias: {
-            '@': fileURLToPath(new URL('../../resources/js', import.meta.url)),
-        },
-    },
-    server: serve
-        ? { host: '127.0.0.1', port: 4197, strictPort: true, hmr: false }
-        : { middlewareMode: true, hmr: false, watch: null },
-    appType: 'custom',
-});
-const users = [
-    { id: 1, name: 'Alex Morgan', email: 'alex@example.test', avatar: null },
-    { id: 2, name: 'Sam Taylor', email: 'sam@example.test', avatar: null },
-    {
-        id: 3,
-        name: 'Jordan Longname With Several Names',
-        email: 'jordan.long.email.address@example.test',
-        avatar: null,
-    },
-];
-function initial() {
-    return {
-        canCreateTeams: true,
-        users,
-        status: null,
-        teams: [
-            { id: 1, name: 'Platform team', user_ids: [1], users: [users[0]] },
-            { id: 2, name: 'Delivery team', user_ids: [], users: [] },
-        ],
-        teamPermissions: { 1: { 2: ['team:invite'] } },
-        permissionOptions: ['invite', 'manage', 'admin'].map((name) => ({
-            value: 'team:' + name,
-            label: 'Team ' + name,
-        })),
-    };
-}
-const makePage = (extra = {}) => ({
-    component: 'Teams',
-    url: '/teams',
-    version: null,
-    clearHistory: false,
-    encryptHistory: false,
-    props: {
-        name: 'KanbanGit',
-        errors: {},
-        sidebarOpen: true,
-        appearance: 'system',
-        auth: {
-            user: users[0],
-            permissions: {
-                globalAdmin: false,
-                projectCreate: false,
-                canManageTeams: true,
-            },
-        },
-        navigation: { project: null },
-        ...initial(),
-        ...extra,
-    },
-});
-if (serve) {
-    let data = initial();
-    server.middlewares.use(async (request, response, next) => {
-        if (!request.url.startsWith('/teams')) {
-            return next();
-        }
-        const url = new URL(request.url, 'http://localhost');
-        if (url.searchParams.has('reset')) {
-            data = initial();
-        }
-        if (url.searchParams.has('manager')) {
-            data.canCreateTeams = false;
-        }
-        if (url.searchParams.has('empty')) {
-            data.teams = [];
-        }
-        let errors = {};
-        if (request.method !== 'GET') {
-            const result =
-                request.headers.cookie?.match(/teams_result=(\w+)/)?.[1] ??
-                'success';
-            if (['server', 'forbidden'].includes(result)) {
-                response.statusCode = result === 'forbidden' ? 403 : 503;
-                response.end('Simulated failure');
-                return;
-            }
-            let body = '';
-            for await (const chunk of request) {
-                body += chunk;
-            }
-            const submitted = JSON.parse(body || '{}');
-            if (result === 'validation') {
-                errors = url.pathname.endsWith('/members')
-                    ? { 'user_ids.0': 'This user is unavailable.' }
-                    : url.pathname.includes('/permissions/')
-                      ? { 'permissions.0': 'This permission is unavailable.' }
-                      : { name: 'This team name is already taken.' };
-            } else if (request.method === 'POST') {
-                data.teams.push({
-                    id: 3,
-                    name: submitted.name,
-                    user_ids: [],
-                    users: [],
-                });
-            } else if (url.pathname.endsWith('/members')) {
-                const team = data.teams.find(
-                    (team) => team.id === Number(url.pathname.split('/')[2]),
-                );
-                team.user_ids = submitted.user_ids;
-                team.users = users.filter((user) =>
-                    team.user_ids.includes(user.id),
-                );
-            } else {
-                const [, , teamId, , , userId] = url.pathname.split('/');
-                data.teamPermissions[teamId] ??= {};
-                data.teamPermissions[teamId][userId] = submitted.permissions;
-            }
-            if (Object.keys(errors).length === 0) {
-                data.status = 'Saved';
-            }
-        }
-        const page = makePage({ ...data, errors });
-        response.setHeader('Vary', 'X-Inertia');
-        if (request.headers['x-inertia']) {
-            response.setHeader('X-Inertia', 'true');
-            response.setHeader('Content-Type', 'application/json');
-            response.end(JSON.stringify(page));
-            return;
-        }
-        const escaped = JSON.stringify(page)
-            .replaceAll('&', '&')
-            .replaceAll('"', '"')
-            .replaceAll('<', '&lt;');
-        response.setHeader('Content-Type', 'text/html');
-        response.end(
-            await server.transformIndexHtml(
-                request.url,
-                '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"></head><body><div id="app" data-page="' +
-                    escaped +
-                    '"></div><script type="module" src="/tests/Fixtures/teams-preview.mjs"></script></body></html>',
-            ),
-        );
-    });
-    await server.listen();
-    console.log('Teams fixture ready.');
-} else {
-    try {
-        const { createLocalization } = await server.ssrLoadModule(
-            '/resources/js/lib/localization.ts',
-        );
-        const { createAppearance } = await server.ssrLoadModule(
-            '/resources/js/composables/useAppearance.ts',
-        );
-        const { en } = await server.ssrLoadModule(
-            '/resources/js/locales/en.ts',
-        );
-        const component = (
-            await server.ssrLoadModule('/resources/js/pages/teams/Index.vue')
-        ).default;
-        const render = async (extra = {}, locale = createLocalization()) =>
-            (
-                await createInertiaApp({
-                    page: makePage(extra),
-                    resolve: () => component,
-                    render: renderToString,
-                    setup: ({ App, props, plugin }) =>
-                        createSSRApp({ render: () => h(App, props) })
-                            .use(plugin)
-                            .use(locale)
-                            .use(createAppearance()),
-                })
-            ).body;
-        const html = await render();
-        assert.match(html, /Platform team/);
-        assert.match(html, /1 member/);
-        assert.match(html, /0 members/);
-        assert.match(html, /Manage members of Platform team/);
-        assert.match(html, /Manage permissions for Platform team/);
-        assert.match(html, /No members yet/);
-        assert.match(html, /Create team/);
-        assert.doesNotMatch(html, /Global admin|Hold Cmd|<select/);
-        assert.doesNotMatch(
-            await render({ canCreateTeams: false }),
-            /Create team/,
-        );
-        assert.match(await render({ teams: [] }), /No teams to manage/);
-        const translated = await render(
-            {},
-            createLocalization(
-                { locale: 'de' },
-                {
-                    de: {
-                        ...en,
-                        'navigation.teams': 'Arbeitsgruppen',
-                        'teams.create': 'Team anlegen',
-                    },
-                },
-            ),
-        );
-        assert.match(translated, /Arbeitsgruppen/);
-        assert.match(translated, /Team anlegen/);
-        console.log('Teams presentation checks passed.');
-    } finally {
-        await server.close();
-    }
-}