Outhere mobile app, every prototype screen, on Supabase

.github/workflows/mobile.yml

@@ -0,0 +1,46 @@
+name: Mobile
+
+on:
+  pull_request:
+    paths:
+      - "apps/mobile/**"
+      - "packages/core/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - ".npmrc"
+      - ".github/workflows/mobile.yml"
+  push:
+    branches: [main]
+    paths:
+      - "apps/mobile/**"
+      - "packages/core/**"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+
+concurrency:
+  group: mobile-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      # Typecheck and test the phone app and the shared package it uses.
+      - run: pnpm turbo run typecheck test --filter "@outhere/mobile..."
+      - name: Web build (local data)
+        working-directory: apps/mobile
+        run: pnpm exec expo export --platform web --output-dir /tmp/web
+      - name: Web build (Supabase mode)
+        working-directory: apps/mobile
+        env:
+          EXPO_PUBLIC_SUPABASE_URL: https://example.supabase.co
+          EXPO_PUBLIC_SUPABASE_ANON_KEY: ci-placeholder
+        run: pnpm exec expo export --platform web --clear --output-dir /tmp/web-remote

.github/workflows/supabase.yml

@@ -0,0 +1,51 @@
+name: Database
+
+on:
+  pull_request:
+    paths: ["supabase/**", ".github/workflows/supabase.yml"]
+  push:
+    branches: [main]
+    paths: ["supabase/**"]
+
+jobs:
+  migrations:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:17
+        env:
+          POSTGRES_PASSWORD: postgres
+        ports: ["5432:5432"]
+        options: >-
+          --health-cmd pg_isready --health-interval 5s --health-timeout 5s --health-retries 10
+    env:
+      PGHOST: localhost
+      PGUSER: postgres
+      PGPASSWORD: postgres
+    steps:
+      - uses: actions/checkout@v4
+      - name: Migrate, seed and test
+        run: ./supabase/tests/run.sh
+      - name: Types are up to date
+        run: |
+          createdb oh_types
+          sed "/^create role/d" supabase/tests/shim.sql | psql -d oh_types -q > /dev/null
+          for f in supabase/migrations/*.sql; do psql -d oh_types -q -v ON_ERROR_STOP=1 -f "$f" > /dev/null; done
+          python3 supabase/scripts/gen_types.py oh_types /tmp/database.ts
+          diff -u supabase/types/database.ts /tmp/database.ts
+
+  functions:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: denoland/setup-deno@v2
+        with:
+          deno-version: v2.x
+      # Run from the functions folder so Deno reads its own deno.json and
+      # leaves the pnpm workspace at the root alone.
+      - name: Typecheck Edge Functions
+        working-directory: supabase/functions
+        run: deno check story-media/index.ts
+      - name: Test the R2 helper
+        working-directory: supabase/functions
+        run: deno test --allow-env _shared/r2_test.ts

Docs/Prd.md

@@ -2,8 +2,8 @@
 
 ## Status
 - This document defines product behaviour, rules, and UX requirements.
-- Engineering execution order lives in docs/BUILD_PLAN.md.
-- Codex tasks live in docs/TASKS/.
+- Engineering execution order lives in Docs/ROADMAP.md (phases) and Docs/build_plan.md (original tasks).
+- Task specs live in Docs/Task/.
 
 ## Non-negotiables
 - City-first identity (no borough dependency).
@@ -14,8 +14,8 @@
 - Tabs: Home, Move, Outside/Arena, Clubs (Crews), Profile.
 
 ## Current repo notes
-- Expo Router tabs live in frontend/app/(tabs)/
-- API client in frontend/src/services/api.ts defines current endpoints.
+- Expo Router tabs live in apps/mobile/src/app/(tabs)/
+- API client in apps/mobile/src/services/api.js defines current endpoints.
 
 ## Product Requirements Document (PRD)
 

Docs/ROADMAP.md

@@ -0,0 +1,70 @@
+# OutHere Roadmap
+
+The app's screens and navigation are largely built, but much of what they show is hardcoded, there are no real accounts, and the backend trusts whatever the phone sends. This roadmap replaces what sits underneath the screens, one phase per pull request, without redesigning them.
+
+Each phase starts only once the previous phase's "done when" check passes.
+
+## Phase 0: Clean foundation (done)
+
+- One app: `apps/mobile`. The old Emergent `frontend/` app and generated root clutter are removed.
+- The Anything (create.xyz) runtime is gone: no fetch override, launcher menu, remote error reporting or sandbox messaging.
+- Step sync posts the real count (it used to post 0 every 30 seconds) and uses the local calendar day.
+- The DEV BYPASS button only exists in development builds; a failed signup no longer onboards a local-only account.
+- The committed Mapbox token is removed; route planning falls back to OSRM without one.
+- App identity: name `OutHere`, scheme `outhere`, bundle ID `com.outhere.app`, real permission strings. Native projects are generated by `expo prebuild` / EAS instead of committed.
+- iOS maps use Apple Maps (Google Maps needs an SDK and key we don't ship).
+- The backend installs from `requirements.txt` and its smoke tests live in `backend/tests`.
+
+**Done when:** the app bundles for iOS, Android and web with only OutHere's own config.
+
+## Phase 0.5: The whole app working on the phone (done)
+
+The server decision is parked so the product can be built and felt first.
+
+- `src/data/engine.js` owns all data in AsyncStorage, simulates a seeded world of 24 players and 5 crews, and applies the rules for XP, OUT, streaks, battles, crews, events, drops, rewards and memberships.
+- Every screen reads through React Query hooks (`src/data/hooks.js`) and is built from one design kit (`src/components/ui`). All mock arrays, fake fallbacks, `/api/*` fetches and dead buttons are gone.
+- Membership limits are enforced and open an upgrade sheet. Payments are not live, so switching plan is free in this build.
+- The old `services/api.js` client and the unused Mapbox and RevenueCat packages are removed, so the app runs in Expo Go.
+
+**Done when:** every tab and detail screen works end to end offline. A server later replaces `engine.js` behind the same functions.
+
+## Phase 1: Accounts and real data
+
+- A dedicated Supabase project: real tables, Row Level Security, Storage for crew logos.
+- Sign in with Apple, Google or an email code. The random `device_id` is retired.
+- Step ingest goes through a server function that rejects future dates, caps backdating at one day and caps daily steps.
+- `src/services/api.js` moves onto Supabase.
+
+**Done when:** two test users cannot read or change each other's data.
+
+## Phase 2: Core loop for real
+
+- Home, Move, Crew and Arena on live data; runs saved to the server.
+- Battles and the XP/OUT ledger become database functions with unique keys (no double payouts), and battles complete on a schedule.
+- Crew chat and feed in realtime. Every mock array and fake fallback is removed, with proper empty and error states.
+
+**Done when:** none of the five main tabs shows hardcoded data.
+
+## Phase 3: Memberships and payments
+
+- RevenueCat in-app purchases for Pro and Black, with a 14-day Pro trial.
+- A store webhook sets the membership tier; gating is enforced on the server.
+- Black application and invite flow behind the 14-day streak.
+
+**Done when:** a sandbox purchase unlocks Pro end to end.
+
+## Phase 4: Events, drops, rewards and social
+
+- Events and drops run from a simple admin, with RSVP capacity enforced.
+- Rewards catalogue and OUT redemption with weekly limits.
+- Friends, user search, news feed and push notifications.
+
+**Done when:** spec tasks 001 to 008 in `Docs/Task` all pass their checks.
+
+## Phase 5: Launch readiness
+
+- Apple Health and Google Fit, background step tracking.
+- Crash reporting, analytics, anti-cheat caps and rate limits.
+- EAS builds, TestFlight beta, store listings and a privacy policy.
+
+**Done when:** a TestFlight beta is live with real users in London.

Docs/build_plan.md

@@ -1,5 +1,8 @@
-# docs/BUILD_PLAN.md
-# OutHere Build Plan (Single Source of Execution Truth)
+# Docs/build_plan.md
+# OutHere Build Plan
+
+> Tasks 001 to 008 below are largely built as a demo. The current plan for making them real
+> (accounts, real data, payments, launch) lives in [ROADMAP.md](ROADMAP.md).
 
 ## Goal
 Deliver OutHere in stable, shippable increments without breaking existing tracking, UI, or API.
@@ -38,26 +41,26 @@ This plan is deliberately strict because it prevents the agent from “helpfully
 ---
 
 ## Repo structure assumptions (for agent context)
-- Frontend lives in: `frontend/`
+- Frontend lives in: `apps/mobile/` (the old `frontend/` app was removed in phase 0)
 - Backend lives in: `backend/`
-- Tabs and navigation live in: `frontend/app/(tabs)/`
-- API client lives in: `frontend/src/services/api.ts`
+- Tabs and navigation live in: `apps/mobile/src/app/(tabs)/`
+- API client lives in: `apps/mobile/src/services/api.js`
 If the repo differs, tasks must be adjusted to actual paths without inventing new architecture.
 
 ---
 
 ## Working Method (How to Run Codex)
 For each task:
 1. Ensure the following files exist and are current:
-   - `docs/PRD.md`
-   - `docs/BUILD_PLAN.md` (this file)
-   - `docs/TASKS/00X_*.md` (the task you are running)
+   - `Docs/Prd.md`
+   - `Docs/build_plan.md` (this file)
+   - `Docs/Task/00X_*.md` (the task you are running)
 2. Create a branch named:
    - `task/00X-short-name`
 3. Run Codex with instructions:
-   - Read `docs/PRD.md`
-   - Read `docs/BUILD_PLAN.md`
-   - Read the target task file in `docs/TASKS/`
+   - Read `Docs/Prd.md`
+   - Read `Docs/build_plan.md`
+   - Read the target task file in `Docs/Task/`
    - Implement **only** that task file
    - Output **git diff patch only**
 4. Apply patch locally.
@@ -98,10 +101,10 @@ If a task introduces regressions:
 
 # Execution Tasks (These are the ONLY tasks to run)
 These tasks must be completed in order.
-They are stored as markdown files in `docs/TASKS/` and numbered 001–008.
+They are stored as markdown files in `Docs/Task/` and numbered 001–008.
 
 ## TASK-001 - Arena Tab (Replace Challenges) + Hub Layout
-**Task file:** `docs/TASKS/001_ARENA_TAB.md`
+**Task file:** `Docs/Task/001_ARENA_TAB.md`
 
 Purpose:
 - Establish the new product centre: Arena as the hub.
@@ -119,7 +122,7 @@ Smoke test focus:
 ---
 
 ## TASK-002 - Backend: 1v1 Battles (Create, List, Detail, Complete)
-**Task file:** `docs/TASKS/002_BATTLES_1V1_BACKEND.md`
+**Task file:** `Docs/Task/002_BATTLES_1V1_BACKEND.md`
 
 Purpose:
 - Create the first “competitive retention loop”.
@@ -140,7 +143,7 @@ Smoke test focus:
 ---
 
 ## TASK-003 - Frontend: 1v1 Battles UI (Create + List + Detail)
-**Task file:** `docs/TASKS/003_BATTLES_1V1_FRONTEND.md`
+**Task file:** `Docs/Task/003_BATTLES_1V1_FRONTEND.md`
 
 Purpose:
 - Make battles visible and usable from Arena.
@@ -157,7 +160,7 @@ Smoke test focus:
 ---
 
 ## TASK-004 - XP + OUT Ledgers (Server Source of Truth) + Client UI
-**Task file:** `docs/TASKS/004_XP_OUT_LEDGER.md`
+**Task file:** `Docs/Task/004_XP_OUT_LEDGER.md`
 
 Purpose:
 - Establish the platform economy correctly from day one.
@@ -179,7 +182,7 @@ Smoke test focus:
 ---
 
 ## TASK-005 - Memberships: Free, Pro, Black + Feature Gating + Black Eligibility (14-day)
-**Task file:** `docs/TASKS/005_MEMBERSHIPS_GATING.md`
+**Task file:** `Docs/Task/005_MEMBERSHIPS_GATING.md`
 
 Purpose:
 - Add monetisation and status access control without breaking the UX.
@@ -200,7 +203,7 @@ Smoke test focus:
 ---
 
 ## TASK-006 - Crews: Ownership, Roles, Logo Upload (Pro/Black) + No Custom Colours
-**Task file:** `docs/TASKS/006_CREW_OWNERSHIP_LOGOS.md`
+**Task file:** `Docs/Task/006_CREW_OWNERSHIP_LOGOS.md`
 
 Purpose:
 - Turn crews into identity assets and community engines, without design chaos.
@@ -223,7 +226,7 @@ Smoke test focus:
 ---
 
 ## TASK-007 - Drops + Rewards Catalogue + OUT Redemption
-**Task file:** `docs/TASKS/007_REWARDS_DROPS_SHOP.md`
+**Task file:** `Docs/Task/007_REWARDS_DROPS_SHOP.md`
 
 Purpose:
 - Introduce the commerce loop (drops + redemption) without building a full e-commerce platform prematurely.
@@ -246,7 +249,7 @@ Smoke test focus:
 ---
 
 ## TASK-008 - Events: List, RSVP, Check-in, Rewards
-**Task file:** `docs/TASKS/008_EVENTS_RSVP_CHECKIN.md`
+**Task file:** `Docs/Task/008_EVENTS_RSVP_CHECKIN.md`
 
 Purpose:
 - Make OutHere physical and sponsor-ready, linking digital status to real-world presence.

README.md

@@ -11,7 +11,8 @@ pnpm workspaces with Turborepo.
 - `apps/web` - the website at weouthere.app
 - `apps/app` - the member app: clubs, battles, league, Club HQ, and the public club pages (`/<club>`, `/join/<club>`, `/@<handle>`)
 - `apps/admin` - Outhere HQ, the staff app
-- `apps/mobile` - Expo phone app (primary client). It still installs with npm from its own folder: one dependency is a GitHub tarball, and its patch-package patches and npm overrides move to `pnpm-workspace.yaml` when it joins.
+- `apps/mobile` - Expo phone app (primary client). Run it with `pnpm --filter @outhere/mobile start`. Its package pins and patches live in `pnpm-workspace.yaml`, and it shares rules with `packages/core`.
+- `supabase` - the database: migrations, seed data, tests and Edge Functions (see [supabase/README.md](supabase/README.md))
 - `packages/core` - shared types, rules and data access (example data and Supabase)
 - `packages/ui` - shared React components and the stylesheet
 - `backend` - API/backend services
@@ -76,15 +77,14 @@ Bottom tabs:
 ### Install
 
 ```bash
-cd apps/mobile
-npm install
+corepack enable
+pnpm install            # from the repo root
 ```
 
 ### Run mobile app
 
 ```bash
-cd apps/mobile
-npx expo start
+pnpm --filter @outhere/mobile start
 ```
 
 Useful options:

apps/admin/vite.config.ts

@@ -3,6 +3,9 @@ import { defineConfig } from "vite";
 
 export default defineConfig({
   plugins: [react()],
+  // The workspace installs a flat node_modules for the phone app, which hoists
+  // its older React to the root. Resolve React from this package everywhere.
+  resolve: { dedupe: ["react", "react-dom"] },
   // Share the member app's images (/img/...) and favicon instead of copying them.
   publicDir: "../app/public",
   server: { port: 5174 },

apps/app/vite.config.ts

@@ -3,13 +3,17 @@ import { defineConfig } from "vite";
 
 export default defineConfig({
   plugins: [reactRouter()],
-  resolve: { tsconfigPaths: true },
+  // The workspace installs a flat node_modules for the phone app, which hoists
+  // its older React to the root. Resolve React from this package everywhere.
+  resolve: { tsconfigPaths: true, dedupe: ["react", "react-dom", "react-router"] },
   server: { port: 5173 },
   // weouthere.app is the website, which passes every path it doesn't own to
   // this app. A folder name the website will never use keeps the two apart.
   build: { assetsDir: "_app" },
   ssr: {
     // Workspace packages ship TypeScript source, so Vite compiles them.
-    noExternal: ["@outhere/core", "@outhere/ui"],
+    // React and React Router are bundled too, so the server render and
+    // react-dom always share this app's copy of React.
+    noExternal: ["@outhere/core", "@outhere/ui", "react", "react-dom", "react-router"],
   },
 });

apps/mobile/.env.example

@@ -1,3 +1,13 @@
-# OUT HERE Mobile — Environment Variables
-# The backend URL for API calls. When running the backend locally:
+# Outhere mobile environment variables. Copy to .env and fill in.
+
+# Backend API base URL (the FastAPI server in /backend while it is still in use).
 EXPO_PUBLIC_BACKEND_URL=http://localhost:8000
+
+# Mapbox public token for walking route planning. Optional: without it the
+# Move tab falls back to the public OSRM router.
+EXPO_PUBLIC_MAPBOX_ACCESS_TOKEN=
+
+# Outhere's own Supabase project (never the other app's). Leave blank to run
+# on local demo data on the phone.
+EXPO_PUBLIC_SUPABASE_URL=
+EXPO_PUBLIC_SUPABASE_ANON_KEY=