Release v26.8.20

Co-authored-by: Tomek Wójcik <labs@tomekwojcik.pl>
Co-committed-by: Tomek Wójcik <labs@tomekwojcik.pl>

.gitea/actions/get-build-options/action.yaml

@@ -0,0 +1,26 @@
+name: "Get Build Options"
+description: "Sanitizies and unifies the environment into build options"
+outputs:
+  short-sha:
+    description: "Shortened hash if the current commit"
+  build-arch:
+    description: "Docker-compatible representation of build arch"
+  build-platform:
+    description: "Docker-compatible representation of build platform"
+runs:
+  using: "composite"
+  steps:
+    - name: "Compute Build Options"
+      shell: "bash"
+      run: |
+        set -x
+        SHORT_SHA="${GITHUB_SHA::8}"
+        BUILD_ARCH="amd64"
+        BUILD_PLATFORM="linux/amd64"
+        if [ "${RUNNER_ARCH}" = "ARM64" ];then
+          BUILD_ARCH="arm64"
+          BUILD_PLATFORM="linux/arm64"
+        fi
+        echo "short-sha=$SHORT_SHA" >> $GITHUB_OUTPUT
+        echo "build-arch=$BUILD_ARCH" >> $GITHUB_OUTPUT
+        echo "build-platform=$BUILD_PLATFORM" >> $GITHUB_OUTPUT

.gitea/actions/get-run-info/action.yaml

@@ -0,0 +1,17 @@
+name: "Get Run Info"
+description: "Sanitizies and unifies the environment into run info"
+inputs:
+  compose-project-base:
+    description: "Base for the Compose project"
+    required: true
+outputs:
+  compose-project:
+    description: "Compose project name"
+runs:
+  using: "composite"
+  steps:
+    - name: "Compute Run Info"
+      shell: "bash"
+      run: |
+        set -x
+        echo "compose-project=${{ inputs.compose-project-base }}-${GITHUB_RUN_NUMBER}" >> $GITHUB_OUTPUT

.gitea/actions/get-service-version/action.yaml

@@ -0,0 +1,27 @@
+name: "Get Run Info"
+description: "Sanitizies and unifies the environment into run info"
+inputs:
+  service:
+    description: "The service to work on"
+    required: true
+outputs:
+  version:
+    description: "Service version"
+  build-number:
+    description: "Build number"
+runs:
+  using: "composite"
+  steps:
+    - name: "Compute Service Version"
+      shell: "bash"
+      run: |
+        set -x
+        if [[ ! -z "${GITHUB_HEAD_REF}" || "${GITHUB_REF_NAME}" = "development" ]]; then
+          VERSION="${GITHUB_SHA::8}"
+          BUILD="${GITHUB_RUN_NUMBER}"
+        else
+          VERSION="v$(grep -Po '(?<=^version\s=\s")[^"]+' services/${{ inputs.service }}/pyproject.toml)"
+          BUILD="01"
+        fi
+        echo "version=$VERSION" >> $GITHUB_OUTPUT
+        echo "build-number=$BUILD" >> $GITHUB_OUTPUT

.gitea/actions/setup-ansible/action.yaml

@@ -0,0 +1,19 @@
+name: "Set up Ansible"
+description: "Downloads and installs Ansible"
+inputs:
+  version:
+    description: "Ansible version to install"
+    required: false
+    default: "10.2.0"
+runs:
+  using: "composite"
+  steps:
+    - name: "Install Ansible"
+      shell: "bash"
+      env:
+        PIP_INDEX_URL: "https://nexus.bthlabs.pl/repository/pypi/simple/"
+      run: |
+        set -x
+        python3 -m venv /opt/ansible
+
+        /opt/ansible/bin/pip install ansible==${{ inputs.version }}

.gitea/actions/setup-k8s/action.yaml

@@ -0,0 +1,32 @@
+name: "Set up k8s"
+description: "Downloads and installs k8s tools"
+inputs:
+  arch:
+    description: "Architecture"
+    required: true
+  kubectl-version:
+    description: "kubectl version to install"
+    required: false
+    default: "1.33.4"
+  kustomize-version:
+    description: "kustomize version to install"
+    required: false
+    default: "5.7.1"
+runs:
+  using: "composite"
+  steps:
+    - name: "Install k8s tools"
+      shell: "bash"
+      run: |
+        set -x
+        mkdir -p /opt/k8s/bin /opt/k8s/etc /opt/k8s/src
+
+        wget -O /opt/k8s/src/kubectl "https://nexus.bthlabs.pl/repository/ops-tools/k8s/kubectl-${{ inputs.kubectl-version }}-linux-${{ inputs.arch }}"
+        chmod a+x /opt/k8s/src/kubectl
+        mv /opt/k8s/src/kubectl /opt/k8s/bin
+
+        wget -O /opt/k8s/src/kustomize "https://nexus.bthlabs.pl/repository/ops-tools/k8s/kustomize-${{ inputs.kustomize-version }}-linux-${{ inputs.arch }}"
+        chmod a+x /opt/k8s/src/kustomize
+        mv /opt/k8s/src/kustomize /opt/k8s/bin
+
+        rm -rf /opt/k8s/src/

.gitea/tools/render-docker-compose-ci.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -e
+set +x
+set -o pipefail
+
+cat >"./docker-compose-ci-${COMPOSE_PROJECT}.yaml" <<EOF
+services:
+  postgres:
+    image: "docker-hosted.nexus.bthlabs.pl/hotpocket/postgres:15.13-${COMPOSE_PROJECT}"
+
+  keycloak:
+    image: "docker-hosted.nexus.bthlabs.pl/hotpocket/keycloak:22.0.3-${COMPOSE_PROJECT}"
+
+  rabbitmq:
+    image: "docker-hosted.nexus.bthlabs.pl/hotpocket/rabbitmq:3.10.8-${COMPOSE_PROJECT}"
+
+  apple-ci:
+    image: "docker-hosted.nexus.bthlabs.pl/hotpocket/apple:ci-${COMPOSE_PROJECT}"
+
+  backend-ci:
+    image: "docker-hosted.nexus.bthlabs.pl/hotpocket/backend:ci-${COMPOSE_PROJECT}"
+
+  extension-ci:
+    image: "docker-hosted.nexus.bthlabs.pl/hotpocket/extension:ci-${COMPOSE_PROJECT}"
+
+  packages-ci:
+    image: "docker-hosted.nexus.bthlabs.pl/hotpocket/packages:ci-${COMPOSE_PROJECT}"
+EOF

.gitea/workflows/build-deployment-images.yaml

@@ -0,0 +1,83 @@
+name: "Build deployment images"
+
+on:
+  workflow_call:
+    inputs:
+      target:
+        required: true
+        type: "string"
+      registry:
+        required: false
+        type: "string"
+        default: "docker-hosted.nexus.bthlabs.pl"
+      platform:
+        required: false
+        type: "string"
+        default: "linux/amd64,linux/arm64"
+    secrets:
+      VAULT_ROLE_ID:
+        required: true
+      VAULT_SECRET_ID:
+        required: true
+
+jobs:
+  build-deployment-images:
+    name: "Build deployment images"
+    runs-on: "ubuntu-latest"
+    steps:
+      - name: "Checkout the code"
+        uses: "actions/checkout@v2"
+      - name: "Get build options"
+        id: "get-build-options"
+        uses: "./.gitea/actions/get-build-options"
+      - name: "Get `backend` version"
+        id: "get-backend-version"
+        uses: "./.gitea/actions/get-service-version"
+        with:
+          service: "backend"
+      - name: "Import Secrets"
+        id: "import-secrets"
+        uses: "hashicorp/vault-action@v2"
+        with:
+          url: "https://vault.bthlabs.pl/"
+          method: "approle"
+          roleId: "${{ secrets.VAULT_ROLE_ID }}"
+          secretId: "${{ secrets.VAULT_SECRET_ID }}"
+          secrets: |
+            gitea/data/${{ inputs.registry }} username | DOCKER_USERNAME ;
+            gitea/data/${{ inputs.registry }} password | DOCKER_PASSWORD
+      - name: "Set up Docker Buildx"
+        id: "setup-docker-buildx"
+        uses: "docker/setup-buildx-action@v3"
+        with:
+          driver: "remote"
+          endpoint: "tcp://builder-01.bthlab:2375"
+          platforms: "linux/amd64"
+          append: |
+            - endpoint: "tcp://builder-mac-01.bthlab:2375"
+              platforms: "linux/arm64"
+      - name: "Login to Docker Registry"
+        uses: "docker/login-action@v3"
+        with:
+          registry: "${{ inputs.registry }}"
+          username: "${{ steps.import-secrets.outputs.DOCKER_USERNAME }}"
+          password: "${{ steps.import-secrets.outputs.DOCKER_PASSWORD }}"
+      - name: "Build `backend-aio` image"
+        env:
+          SHORT_SHA: "${{ steps.get-build-options.outputs.short-sha }}"
+          VERSION: "${{ steps.get-backend-version.outputs.version }}"
+          BUILD: "${{ steps.get-backend-version.outputs.build-number }}"
+        run: |
+          set -x
+          docker buildx build \
+            --cache-from "type=registry,ref=nexus.bthlab.bthlabs.net:8001/hotpocket" \
+            --cache-to "type=registry,ref=nexus.bthlab.bthlabs.net:8001/hotpocket,target=max" \
+            --push \
+            --platform "${{ inputs.platform }}" \
+            --build-arg IMAGE_ID="${{ inputs.target }}.${SHORT_SHA}" \
+            --build-arg IMAGE_VERSION="${VERSION}" \
+            --build-arg IMAGE_REVISION="${SHORT_SHA}" \
+            -f services/backend/Dockerfile \
+            --target "${{ inputs.target }}" \
+            -t "${{ inputs.registry }}/hotpocket/backend:${{ inputs.target }}-${VERSION}-${BUILD}" \
+            services/

.gitea/workflows/ci.yaml

@@ -17,8 +17,24 @@ jobs:
     steps:
       - name: "Checkout the code"
         uses: "actions/checkout@v2"
+      - name: "Get run info"
+        id: "get-run-info"
+        uses: "./.gitea/actions/get-run-info"
+        with:
+          compose-project-base: "${{ vars.COMPOSE_PROJECT_BASE }}"
+      - name: "Get build options"
+        id: "get-build-options"
+        uses: "./.gitea/actions/get-build-options"
       - name: "Set up Docker Buildx"
+        id: "setup-docker-buildx"
         uses: "docker/setup-buildx-action@v3"
+        with:
+          driver: "remote"
+          endpoint: "tcp://builder-01.bthlab:2375"
+          platforms: "linux/amd64"
+          append: |
+            - endpoint: "tcp://builder-mac-01.bthlab:2375"
+              platforms: "linux/arm64"
       - name: "Build `postgres` image"
         uses: docker/build-push-action@v6
         with:
@@ -26,7 +42,10 @@ jobs:
           context: "services/"
           push: false
           load: true
-          tags: "docker-hosted.nexus.bthlabs.pl/hotpocket/postgres:15.13-local"
+          tags: "docker-hosted.nexus.bthlabs.pl/hotpocket/postgres:15.13-${{ steps.get-run-info.outputs.compose-project }}"
+          platforms: "${{ steps.get-build-options.outputs.build-platform }}"
+          cache-from: "type=registry,ref=nexus.bthlab.bthlabs.net:8001/hotpocket"
+          cache-to: "type=registry,ref=nexus.bthlab.bthlabs.net:8001/hotpocket,mode=max"
       - name: "Build `keycloak` image"
         uses: docker/build-push-action@v6
         with:
@@ -34,7 +53,10 @@ jobs:
           context: "services/"
           push: false
           load: true
-          tags: "docker-hosted.nexus.bthlabs.pl/hotpocket/keycloak:22.0.3-local"
+          tags: "docker-hosted.nexus.bthlabs.pl/hotpocket/keycloak:22.0.3-${{ steps.get-run-info.outputs.compose-project }}"
+          platforms: "${{ steps.get-build-options.outputs.build-platform }}"
+          cache-from: "type=registry,ref=nexus.bthlab.bthlabs.net:8001/hotpocket"
+          cache-to: "type=registry,ref=nexus.bthlab.bthlabs.net:8001/hotpocket,mode=max"
       - name: "Build `rabbitmq` image"
         uses: docker/build-push-action@v6
         with:
@@ -42,7 +64,10 @@ jobs:
           context: "services/"
           push: false
           load: true
-          tags: "docker-hosted.nexus.bthlabs.pl/hotpocket/rabbitmq:3.10.8-local"
+          tags: "docker-hosted.nexus.bthlabs.pl/hotpocket/rabbitmq:3.10.8-${{ steps.get-run-info.outputs.compose-project }}"
+          platforms: "${{ steps.get-build-options.outputs.build-platform }}"
+          cache-from: "type=registry,ref=nexus.bthlab.bthlabs.net:8001/hotpocket"
+          cache-to: "type=registry,ref=nexus.bthlab.bthlabs.net:8001/hotpocket,mode=max"
       - name: "Build `backend-ci` image"
         uses: docker/build-push-action@v6
         with:
@@ -51,7 +76,10 @@ jobs:
           target: "ci"
           push: false
           load: true
-          tags: "docker-hosted.nexus.bthlabs.pl/hotpocket/backend:ci-local"
+          tags: "docker-hosted.nexus.bthlabs.pl/hotpocket/backend:ci-${{ steps.get-run-info.outputs.compose-project }}"
+          platforms: "${{ steps.get-build-options.outputs.build-platform }}"
+          cache-from: "type=registry,ref=nexus.bthlab.bthlabs.net:8001/hotpocket"
+          cache-to: "type=registry,ref=nexus.bthlab.bthlabs.net:8001/hotpocket,mode=max"
       - name: "Build `packages-ci` image"
         uses: docker/build-push-action@v6
         with:
@@ -60,7 +88,10 @@ jobs:
           target: "ci"
           push: false
           load: true
-          tags: "docker-hosted.nexus.bthlabs.pl/hotpocket/packages:ci-local"
+          tags: "docker-hosted.nexus.bthlabs.pl/hotpocket/packages:ci-${{ steps.get-run-info.outputs.compose-project }}"
+          platforms: "${{ steps.get-build-options.outputs.build-platform }}"
+          cache-from: "type=registry,ref=nexus.bthlab.bthlabs.net:8001/hotpocket"
+          cache-to: "type=registry,ref=nexus.bthlab.bthlabs.net:8001/hotpocket,mode=max"
       - name: "Build `extension-ci` image"
         uses: docker/build-push-action@v6
         with:
@@ -69,23 +100,91 @@ jobs:
           target: "ci"
           push: false
           load: true
-          tags: "docker-hosted.nexus.bthlabs.pl/hotpocket/extension:ci-local"
+          tags: "docker-hosted.nexus.bthlabs.pl/hotpocket/extension:ci-${{ steps.get-run-info.outputs.compose-project }}"
+          platforms: "${{ steps.get-build-options.outputs.build-platform }}"
+          cache-from: "type=registry,ref=nexus.bthlab.bthlabs.net:8001/hotpocket"
+          cache-to: "type=registry,ref=nexus.bthlab.bthlabs.net:8001/hotpocket,mode=max"
+      - name: "Build `apple-ci` image"
+        uses: docker/build-push-action@v6
+        with:
+          file: "services/apple/Dockerfile"
+          context: "services/"
+          target: "ci"
+          push: false
+          load: true
+          tags: "docker-hosted.nexus.bthlabs.pl/hotpocket/apple:ci-${{ steps.get-run-info.outputs.compose-project }}"
+          platforms: "${{ steps.get-build-options.outputs.build-platform }}"
+          cache-from: "type=registry,ref=nexus.bthlab.bthlabs.net:8001/hotpocket"
+          cache-to: "type=registry,ref=nexus.bthlab.bthlabs.net:8001/hotpocket,mode=max"
+      - name: "Prepare the build"
+        id: "prepare"
+        env:
+          COMPOSE_PROJECT: "${{ steps.get-run-info.outputs.compose-project }}"
+        run: |
+          set -x
+          ./.gitea/tools/render-docker-compose-ci.sh
       - name: "Run `backend` checks"
+        if: "steps.prepare.conclusion == 'success'"
+        env:
+          COMPOSE_PROJECT: "${{ steps.get-run-info.outputs.compose-project }}"
         run: |
           set -x
-          docker compose -f docker-compose.yaml -f docker-compose-ci.yaml run --rm backend-ci inv ci
+          docker compose \
+            -p "${COMPOSE_PROJECT}" \
+            -f "docker-compose.yaml" \
+            -f "docker-compose-ci.yaml" \
+            -f "docker-compose-ci-${COMPOSE_PROJECT}.yaml" \
+            run --rm \
+            backend-ci inv ci
       - name: "Run `packages` checks"
-        if: always()
+        if: "steps.prepare.conclusion == 'success'"
+        env:
+          COMPOSE_PROJECT: "${{ steps.get-run-info.outputs.compose-project }}"
         run: |
           set -x
-          docker compose -f docker-compose.yaml -f docker-compose-ci.yaml run --rm packages-ci inv ci
+          docker compose \
+            -p "${COMPOSE_PROJECT}" \
+            -f "docker-compose.yaml" \
+            -f "docker-compose-ci.yaml" \
+            -f "docker-compose-ci-${COMPOSE_PROJECT}.yaml" \
+            run --rm \
+            packages-ci inv ci
       - name: "Run `extension` checks"
-        if: always()
+        if: "steps.prepare.conclusion == 'success'"
+        env:
+          COMPOSE_PROJECT: "${{ steps.get-run-info.outputs.compose-project }}"
         run: |
           set -x
-          docker compose -f docker-compose.yaml -f docker-compose-ci.yaml run --rm extension-ci inv ci
+          docker compose \
+            -p "${COMPOSE_PROJECT}" \
+            -f "docker-compose.yaml" \
+            -f "docker-compose-ci.yaml" \
+            -f "docker-compose-ci-${COMPOSE_PROJECT}.yaml" \
+            run --rm \
+            extension-ci inv ci
+      - name: "Run `apple` checks"
+        if: "steps.prepare.conclusion == 'success'"
+        env:
+          COMPOSE_PROJECT: "${{ steps.get-run-info.outputs.compose-project }}"
+        run: |
+          set -x
+          docker compose \
+            -p "${COMPOSE_PROJECT}" \
+            -f "docker-compose.yaml" \
+            -f "docker-compose-ci.yaml" \
+            -f "docker-compose-ci-${COMPOSE_PROJECT}.yaml" \
+            run --rm \
+            apple-ci inv ci
       - name: "Clean up"
         if: always()
+        env:
+          COMPOSE_PROJECT: "${{ steps.get-run-info.outputs.compose-project }}"
         run: |
           set -x
-          docker compose -f docker-compose.yaml -f docker-compose-ci.yaml down --volumes
+          docker compose \
+            -p "${COMPOSE_PROJECT}" \
+            -f "docker-compose.yaml" \
+            -f "docker-compose-ci.yaml" \
+            -f "docker-compose-ci-${COMPOSE_PROJECT}.yaml" \
+            down --volumes --rmi all || true
+          rm -f "docker-compose-ci-${COMPOSE_PROJECT}.yaml" || true

.gitea/workflows/development.yaml

@@ -0,0 +1,91 @@
+name: "Development deployment"
+
+on:
+  push:
+    branches:
+      - "development"
+
+jobs:
+  build-for-development:
+    name: "Build"
+    uses: "./.gitea/workflows/build-deployment-images.yaml"
+    with:
+      target: "deployment"
+      platform: "linux/amd64"
+      registry: "nexus.bthlab.bthlabs.net:8002"
+    secrets:
+      VAULT_ROLE_ID: "${{ secrets.VAULT_ROLE_ID }}"
+      VAULT_SECRET_ID: "${{ secrets.VAULT_SECRET_ID }}"
+
+  deploy-to-deployment:
+    name: "Deploy"
+    runs-on: "ubuntu-latest"
+    needs:
+      - "build-for-development"
+    env:
+      KUBERNETES_NAMESPACE: "hotpocket-development"
+      KUBERNETES_CLUSTER: "k8s.bthlab"
+    steps:
+      - name: "Checkout the code"
+        uses: "actions/checkout@v2"
+      - name: "Get build options"
+        id: "get-build-options"
+        uses: "./.gitea/actions/get-build-options"
+      - name: "Get `backend` version"
+        id: "get-backend-version"
+        uses: "./.gitea/actions/get-service-version"
+        with:
+          service: "backend"
+      - name: "Setup k8s"
+        uses: "./.gitea/actions/setup-k8s"
+        with:
+          arch: "${{ steps.get-build-options.outputs.build-arch }}"
+      - name: "Import Secrets"
+        id: "import-secrets"
+        uses: "hashicorp/vault-action@v2"
+        with:
+          url: "https://vault.bthlabs.pl/"
+          method: "approle"
+          roleId: "${{ secrets.VAULT_ROLE_ID }}"
+          secretId: "${{ secrets.VAULT_SECRET_ID }}"
+          secrets: |
+            gitea/data/k8s.bthlab config | KUBECONFIG_PAYLOAD
+      - name: "Set up kubeconfig"
+        env:
+          KUBECONFIG_PAYLOAD: "${{ steps.import-secrets.outputs.KUBECONFIG_PAYLOAD }}"
+        run: |
+          set -x
+
+          echo ${KUBECONFIG_PAYLOAD} | base64 -d >"/opt/k8s/etc/kubeconfig"
+          export KUBECONFIG="/opt/k8s/etc/kubeconfig"
+          
+          /opt/k8s/bin/kubectl config use-context ${KUBERNETES_CLUSTER}
+          /opt/k8s/bin/kubectl get node
+      - name: "Run `backend` Django migrations"
+        env:
+          BACKEND_TAG: "deployment-${{ steps.get-backend-version.outputs.version }}-${{ steps.get-backend-version.outputs.build-number }}"
+        run: |
+          set -x
+
+          (
+            cd deployment/hotpocket_bthlab ;
+            export KUBECONFIG="/opt/k8s/etc/kubeconfig" ;
+            /opt/k8s/bin/kubectl config use-context ${KUBERNETES_CLUSTER} ;
+            /opt/k8s/bin/kubectl -n ${KUBERNETES_NAMESPACE} apply -f resources/backend/config-map-local-deps.yaml ;
+            /opt/k8s/bin/kubectl -n ${KUBERNETES_NAMESPACE} set image cronjobs/backend-job-migrations migrations=nexus.bthlab.bthlabs.net:8002/hotpocket/backend:${BACKEND_TAG} ;
+            /opt/k8s/bin/kubectl -n ${KUBERNETES_NAMESPACE} delete jobs --ignore-not-found=true backend-job-migrations ;
+            /opt/k8s/bin/kubectl -n ${KUBERNETES_NAMESPACE} create job backend-job-migrations --from=cronjob/backend-job-migrations ;
+            /opt/k8s/bin/kubectl -n ${KUBERNETES_NAMESPACE} wait --for=condition=complete --timeout=300s job/backend-job-migrations
+          )
+      - name: "Deploy"
+        env:
+          BACKEND_TAG: "deployment-${{ steps.get-backend-version.outputs.version }}-${{ steps.get-backend-version.outputs.build-number }}"
+        run: |
+          set -x
+          (
+            cd deployment/hotpocket_bthlab ;
+            export KUBECONFIG="/opt/k8s/etc/kubeconfig" ;
+            /opt/k8s/bin/kubectl config use-context ${KUBERNETES_CLUSTER} ;
+            /opt/k8s/bin/kustomize edit set image hotpocket-backend=nexus.bthlab.bthlabs.net:8002/hotpocket/backend:${BACKEND_TAG} ;
+            /opt/k8s/bin/kustomize build . | /opt/k8s/bin/kubectl apply -f -
+          )

.gitea/workflows/production.yaml

@@ -0,0 +1,76 @@
+name: "Production deployment"
+
+on:
+  release:
+    types: ["published"]
+
+jobs:
+  build-for-production:
+    name: "Build"
+    uses: "./.gitea/workflows/build-deployment-images.yaml"
+    with:
+      target: "deployment"
+      platform: "linux/amd64"
+    secrets:
+      VAULT_ROLE_ID: "${{ secrets.VAULT_ROLE_ID }}"
+      VAULT_SECRET_ID: "${{ secrets.VAULT_SECRET_ID }}"
+
+  deploy-to-production:
+    name: "Deploy"
+    runs-on: "ubuntu-latest"
+    needs:
+      - "build-for-production"
+    steps:
+      - name: "Checkout the code"
+        uses: "actions/checkout@v2"
+      - name: "Get build options"
+        id: "get-build-options"
+        uses: "./.gitea/actions/get-build-options"
+      - name: "Get `backend` version"
+        id: "get-backend-version"
+        uses: "./.gitea/actions/get-service-version"
+        with:
+          service: "backend"
+      - name: "Import Secrets"
+        id: "import-secrets"
+        uses: "hashicorp/vault-action@v2"
+        with:
+          url: "https://vault.bthlabs.pl/"
+          method: "approle"
+          roleId: "${{ secrets.VAULT_ROLE_ID }}"
+          secretId: "${{ secrets.VAULT_SECRET_ID }}"
+          secrets: |
+            gitea/data/hotpocket.app ansible_vault_payload | ANSIBLE_VAULT_PAYLOAD ;
+            gitea/data/hotpocket.app ansible_vault_password | ANSIBLE_VAULT_PASSWORD ;
+            gitea/data/hotpocket.app ansible_inventory_payload | ANSIBLE_INVENTORY_PAYLOAD ;
+            gitea/data/hotpocket.app ssh_key_payload | SSH_KEY_PAYLOAD
+      - name: "Setup Ansible"
+        uses: "./.gitea/actions/setup-ansible"
+      - name: "Prepare Ansible secrets"
+        run: |
+          set -x
+
+          mkdir deployment/hotpocket_app/.ci
+          echo "${ANSIBLE_VAULT_PAYLOAD}" | base64 -d >"deployment/hotpocket_app/env_vars/production/vault.yaml"
+          echo "${ANSIBLE_VAULT_PASSWORD}" >"deployment/hotpocket_app/.ci/vault_password"
+          echo "${ANSIBLE_INVENTORY_PAYLOAD}" | base64 -d >"deployment/hotpocket_app/inventory_ci.yaml"
+          echo "${SSH_KEY_PAYLOAD}" | base64 -d >"deployment/hotpocket_app/.ci/ssh_key"
+          chmod 600 deployment/hotpocket_app/.ci/ssh_key
+      - name: "Engage!"
+        env:
+          VERSION: "${{ steps.get-backend-version.outputs.version }}"
+          BUILD: "${{ steps.get-backend-version.outputs.build-number }}"
+        run: |
+          set -x
+
+          (
+            cd deployment/hotpocket_app ;
+            ANSIBLE_HOST_KEY_CHECKING="False" /opt/ansible/bin/ansible-playbook \
+              -i inventory_ci.yaml \
+              --vault-id hotpocket@.ci/vault_password \
+              -e @env_vars/production/vars.yaml \
+              -e @env_vars/production/vault.yaml \
+              -e hotpocket_app_image_tag="deployment-${VERSION}-${BUILD}" \
+              --limit "*.production.hotpocket.app" \
+              deploy.yaml
+          )

.gitea/workflows/staging.yaml

@@ -0,0 +1,76 @@
+name: "Staging deployment"
+
+on:
+  release:
+    types: ["published"]
+
+jobs:
+  build-for-staging:
+    name: "Build"
+    uses: "./.gitea/workflows/build-deployment-images.yaml"
+    with:
+      target: "aio"
+      platform: "linux/amd64"
+    secrets:
+      VAULT_ROLE_ID: "${{ secrets.VAULT_ROLE_ID }}"
+      VAULT_SECRET_ID: "${{ secrets.VAULT_SECRET_ID }}"
+
+  deploy-to-staging:
+    name: "Deploy"
+    runs-on: "ubuntu-latest"
+    needs:
+      - "build-for-staging"
+    steps:
+      - name: "Checkout the code"
+        uses: "actions/checkout@v2"
+      - name: "Get build options"
+        id: "get-build-options"
+        uses: "./.gitea/actions/get-build-options"
+      - name: "Get `backend` version"
+        id: "get-backend-version"
+        uses: "./.gitea/actions/get-service-version"
+        with:
+          service: "backend"
+      - name: "Import Secrets"
+        id: "import-secrets"
+        uses: "hashicorp/vault-action@v2"
+        with:
+          url: "https://vault.bthlabs.pl/"
+          method: "approle"
+          roleId: "${{ secrets.VAULT_ROLE_ID }}"
+          secretId: "${{ secrets.VAULT_SECRET_ID }}"
+          secrets: |
+            gitea/data/staging.hotpocket.app ansible_vault_payload | ANSIBLE_VAULT_PAYLOAD ;
+            gitea/data/staging.hotpocket.app ansible_vault_password | ANSIBLE_VAULT_PASSWORD ;
+            gitea/data/staging.hotpocket.app ansible_inventory_payload | ANSIBLE_INVENTORY_PAYLOAD ;
+            gitea/data/staging.hotpocket.app ssh_key_payload | SSH_KEY_PAYLOAD
+      - name: "Setup Ansible"
+        uses: "./.gitea/actions/setup-ansible"
+      - name: "Prepare Ansible secrets"
+        run: |
+          set -x
+
+          mkdir deployment/hotpocket_app/.ci
+          echo "${ANSIBLE_VAULT_PAYLOAD}" | base64 -d >"deployment/hotpocket_app/env_vars/staging/vault.yaml"
+          echo "${ANSIBLE_VAULT_PASSWORD}" >"deployment/hotpocket_app/.ci/vault_password"
+          echo "${ANSIBLE_INVENTORY_PAYLOAD}" | base64 -d >"deployment/hotpocket_app/inventory_ci.yaml"
+          echo "${SSH_KEY_PAYLOAD}" | base64 -d >"deployment/hotpocket_app/.ci/ssh_key"
+          chmod 600 deployment/hotpocket_app/.ci/ssh_key
+      - name: "Engage!"
+        env:
+          VERSION: "${{ steps.get-backend-version.outputs.version }}"
+          BUILD: "${{ steps.get-backend-version.outputs.build-number }}"
+        run: |
+          set -x
+
+          (
+            cd deployment/hotpocket_app ;
+            ANSIBLE_HOST_KEY_CHECKING="False" /opt/ansible/bin/ansible-playbook \
+              -i inventory_ci.yaml \
+              --vault-id hotpocket@.ci/vault_password \
+              -e @env_vars/staging/vars.yaml \
+              -e @env_vars/staging/vault.yaml \
+              -e hotpocket_app_image_tag="aio-${VERSION}-${BUILD}" \
+              --limit "*.staging.hotpocket.app" \
+              deploy.yaml
+          )

.gitignore

@@ -1,2 +1,5 @@
+.ci/
 .envrc*
 .ipythonhome/
+services/vendor/
+/docker-compose-ci-*.yaml

NOTICE.txt

@@ -86,3 +86,9 @@ Licensed under terms of the MIT License
 Pepper Hot Solid icon
 Copyright (c) Icons8
 Licensed under terms of the MIT License
+
+Spinner Loader CSS from https://css-loaders.com/
+
+cosmo, sandstone, sketchy and solar Bootswatch Themes
+Copyright 2012-2025 Thomas Park
+Licensed under terms of the MIT License

README.md

@@ -1,13 +1,30 @@
 # HotPocket by BTHLabs
 
-This repository contains the _HotPocket_ project.
+Minimal self-hosted bookmarking app :).
+
+## The what, the why and the ugly
+
+HotPocket is a minimal self-hosted bookmarking app. It combines a Web
+application, companion apps, browser extensions to give you a way to quickly
+save links for later.
+
+HotPocket came to be to fill in the blank left by Pocket, after Mozilla shut it
+down. I looked at the existing alternatives and found them either too
+feature-rich, too involved to self-host or otherwise not to my liking. So I
+decided to sit down and build something for myself.
+
+With the what and why out of the way, let's talk about the ugly... At its core
+HotPocket is a personal project. I built it by myself and for myself. It may
+or may not fit your needs. If it does, happy saving!
+
+If you're feeling up for an adventure, continue reading below :).
 
 ## Development setup
 
 ### Requirements:
 
-* Python 3.12,
+* Python 3.13,
-* Poetry 1.8.3,
+* Poetry 2.2.1,
 * `git-crypt`,
 * Docker with Docker Compose and Buildx.
 
@@ -66,7 +83,7 @@ $ docker run --rm -it \
     -e HOTPOCKET_BACKEND_INITIAL_ACCOUNT_USERNAME=hotpocket \
     -e HOTPOCKET_BACKEND_INITIAL_ACCOUNT_PASSWORD=hotpocketm4st3r \
     -p 8000:8000 \
-    docker-hosted.nexus.bthlabs.pl/hotpocket/backend:aio-v25.9.18-01
+    hotpocket/backend:aio-v26.8.20-01
 ```
 
 The command above will set up and start the application. The SQLite file will
@@ -76,8 +93,7 @@ credentials. The Web app will be reachable at `http://127.0.0.1:8000/`.
 The admin will be reachable at `http://127.0.0.1:8000/admin/`.
 
 The `DJANGO_SETTINGS_MODULE` environment variable defaults to
-`hotpocket_backend.settings.deployment.webapp`. This should be set to
+`hotpocket_backend.settings.deployment.aio`.
-`hotpocket_backend.settings.deployment.admin` in the Admin container.
 
 **NOTE:** The command above specifies wildly insecure `SECRET_KEY` which is
 used among other things to secure the session cookie. Please *please*
@@ -94,7 +110,8 @@ backend etc. The final deployment will require services for at least the Web
 app, the Celery worker and Celery Beat. Admin is optional.
 
 The `DJANGO_SETTINGS_MODULE` environment variable defaults to
-`hotpocket_backend.settings.deployment.aio`.
+`hotpocket_backend.settings.deployment.webapp`. This should be set to
+`hotpocket_backend.settings.deployment.admin` in the Admin container.
 
 The `deployment/fullstack/docker-compose.yaml` file can be used as a
 starting point for full-stack deployments.
@@ -128,6 +145,7 @@ that can be used to configure the services.
 | `HOTPOCKET_BACKEND_RUN_MIGRATIONS`           | `false` or `true`                                               | Set to `true` to run database muigrations when the container starts.                        |
 | `HOTPOCKET_BACKEND_INITIAL_ACCOUNT_USERNAME` | N/A                                                             | Username for the initial account.                                                           |
 | `HOTPOCKET_BACKEND_INITIAL_ACCOUNT_PASSWORD` | N/A                                                             | Password for the initial account.                                                           |
+| `HOTPOCKET_BACKEND_OPERATOR_EMAIL`           | N/A                                                             | Instance operator's e-mail. Used to display extra language on login page.                   |
 
 **Env and App settings**
 
@@ -158,6 +176,15 @@ method's name in the UI and defaults to `OIDC`.
 
 **NOTE:** Currently, only Keycloak has been tested with this login method.
 
+### Volumes
+
+Both images declare `/srv/run` to be a volume. It's intended to keep the
+service's runtime data, including but not limited to PID files, UNIX sockets
+etc. It's recommended to persist this volume.
+
+Additionally, the `deployment` image declares `/srv/uploads` to be a volume.
+It's recommeded to persist this volume.
+
 ## Author
 
 _HotPocket_ is developed by [BTHLabs](https://www.bthlabs.pl/).

deployment/aio/docker-compose.yaml

@@ -1,6 +1,6 @@
 services:
   backend:
-    image: "docker-hosted.nexus.bthlabs.pl/hotpocket/backend:aio-v25.9.18-01"
+    image: "bthlabs/hotpocket:aio-v26.8.20-01"
     environment:
       HOTPOCKET_BACKEND_SECRET_KEY: "thisisntright"
       HOTPOCKET_BACKEND_INITIAL_ACCOUNT_USERNAME: "hotpocket"

deployment/fullstack/docker-compose.yaml

@@ -8,7 +8,7 @@ x-backend-environment: &x-backend-environment
 
 services:
   webapp:
-    image: "docker-hosted.nexus.bthlabs.pl/hotpocket/backend:deployment-v25.9.18-01"
+    image: "bthlabs/hotpocket:deployment-v26.8.20-01"
     environment:
       <<: *x-backend-environment
       HOTPOCKET_BACKEND_ALLOWED_HOSTS: "app.staging.hotpocket.bthlab.bthlabs.net"
@@ -21,7 +21,7 @@ services:
     restart: "unless-stopped"
 
   admin:
-    image: "docker-hosted.nexus.bthlabs.pl/hotpocket/backend:deployment-v25.9.18-01"
+    image: "bthlabs/hotpocket:deployment-v26.8.20-01"
     environment:
       <<: *x-backend-environment
       HOTPOCKET_BACKEND_APP: "admin"
@@ -35,7 +35,7 @@ services:
     restart: "unless-stopped"
 
   celery-worker:
-    image: "docker-hosted.nexus.bthlabs.pl/hotpocket/backend:deployment-v25.9.18-01"
+    image: "bthlabs/hotpocket:deployment-v26.8.20-01"
     command:
       - "/srv/venv/bin/celery"
       - "-A"
@@ -57,7 +57,7 @@ services:
     restart: "unless-stopped"
 
   celery-beat:
-    image: "docker-hosted.nexus.bthlabs.pl/hotpocket/backend:deployment-v25.9.18-01"
+    image: "bthlabs/hotpocket:deployment-v26.8.20-01"
     command:
       - "/srv/venv/bin/celery"
       - "-A"

deployment/hotpocket_app/.gitignore

@@ -0,0 +1,3 @@
+.ci/
+inventory_ci.yaml
+vault.yaml

deployment/hotpocket_app/deploy.yaml

@@ -0,0 +1,5 @@
+- name: "Deploy HotPocket"
+  hosts: "hotpocket_app"
+  roles:
+    - role: "hotpocket_app"
+      tags: ["hotpocket-app"]

deployment/hotpocket_app/env_vars/production/etc/backend/entrypoint.d/01-install-customized-deps.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+export PIP_INDEX_URL="https://nexus.bthlabs.pl/repository/pypi/simple/"
+/srv/venv/bin/pip install -r /srv/lib/backend/requirements.txt

deployment/hotpocket_app/env_vars/production/etc/backend/entrypoint.d/99-collectstatic.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+(
+  cd /srv/app;
+  ./manage.py collectstatic --no-input
+)

deployment/hotpocket_app/env_vars/production/lib/backend/requirements.txt

@@ -0,0 +1 @@
+hotpocket-bthlabs>=25.10.28

deployment/hotpocket_app/env_vars/production/vars.yaml

@@ -0,0 +1,60 @@
+hotpocket_app:
+  deployment_directory: "/srv/hotpocket"
+  owner: "hotpocket"
+  group: "hotpocket"
+  mode: "fullstack"
+  loki:
+    url: "http://monitoring.vm.snakeweb.net.bthlabs.net:3100/loki/api/v1/push"
+    node: "home.vm.snakeweb.net"
+  docker:
+    extra_hosts:
+      - "home.vm:10.16.1.100"
+  backend:
+    image_tag: "{{ hotpocket_app_image_tag|default('deployment-v25.10.21-01') }}"
+    database:
+      name: "thisissecret"
+      user: "thisissecret"
+      host: "thisissecret"
+    rabbitmq:
+      vhost: "thisissecret"
+      user: "thisissecret"
+      host: "thisissecret"
+    model_auth_is_disabled: true
+    env: "production"
+    extra_env:
+      - "HOTPOCKET_BACKEND_SECRETS_PACKAGE=hotpocket_bthlabs.secrets"
+      - "VAULT_URL={{ hotpocket_app_secrets.backend.vault.url }}"
+      - "VAULT_ROLE_ID={{ hotpocket_app_secrets.backend.vault.role_id }}"
+      - "VAULT_SECRET_ID={{ hotpocket_app_secrets.backend.vault.secret_id }}"
+    oidc:
+      enabled: true
+      endpoint: "thisissecret"
+      display_name: "thisissecret"
+    webapp:
+      settings_module: "hotpocket_bthlabs.settings.webapp"
+      loki:
+        external_labels: "job=hotpocket,service=backend-webapp,environment=production"
+      allowed_hosts:
+        - "my.hotpocket.app"
+    admin:
+      settings_module: "hotpocket_bthlabs.settings.admin"
+      loki:
+        external_labels: "job=hotpocket,service=backend-admin,environment=production"
+      allowed_hosts:
+        - "admin.hotpocket.app"
+    celery_worker:
+      concurrency: 2
+      loki:
+        external_labels: "job=hotpocket,service=backend-celery-worker,environment=production"
+    celery_beat:
+      loki:
+        external_labels: "job=hotpocket,service=backend-celery-beat,environment=production"
+  customization:
+    - src: "{{ inventory_dir }}/env_vars/production/etc/backend/entrypoint.d/01-install-customized-deps.sh"
+      dest: "etc/backend/entrypoint.d/01-install-customized-deps.sh"
+      mode: "755"
+    - src: "{{ inventory_dir }}/env_vars/production/etc/backend/entrypoint.d/99-collectstatic.sh"
+      dest: "etc/backend/entrypoint.d/99-collectstatic.sh"
+      mode: "755"
+    - src: "{{ inventory_dir }}/env_vars/production/lib/backend/requirements.txt"
+      dest: "lib/backend/requirements.txt"

deployment/hotpocket_app/env_vars/staging/etc/backend/entrypoint.d/01-install-customized-deps.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+export PIP_INDEX_URL="https://nexus.bthlabs.pl/repository/pypi/simple/"
+/srv/venv/bin/pip install -r /srv/lib/backend/requirements.txt

deployment/hotpocket_app/env_vars/staging/etc/backend/entrypoint.d/99-collectstatic.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+(
+  cd /srv/app;
+  ./manage.py collectstatic --no-input
+)

deployment/hotpocket_app/env_vars/staging/lib/backend/requirements.txt

@@ -0,0 +1 @@
+hotpocket-bthlabs>=25.10.28

deployment/hotpocket_app/env_vars/staging/vars.yaml

@@ -0,0 +1,37 @@
+hotpocket_app:
+  deployment_directory: "/srv/hotpocket_staging"
+  owner: "hotpocket_staging"
+  group: "hotpocket_staging"
+  mode: "aio"
+  loki:
+    url: "http://monitoring.vm.snakeweb.net.bthlabs.net:3100/loki/api/v1/push"
+    node: "home.vm.snakeweb.net"
+  docker:
+    extra_hosts:
+      - "home.vm:10.0.1.2"
+  backend:
+    image_tag: "{{ hotpocket_app_image_tag|default('aio-v25.10.29-rc1-01') }}"
+    model_auth_is_disabled: false
+    env: "staging"
+    extra_env:
+      - "HOTPOCKET_BACKEND_SECRETS_PACKAGE=hotpocket_bthlabs.secrets"
+      - "VAULT_URL={{ hotpocket_app_secrets.backend.vault.url }}"
+      - "VAULT_ROLE_ID={{ hotpocket_app_secrets.backend.vault.role_id }}"
+      - "VAULT_SECRET_ID={{ hotpocket_app_secrets.backend.vault.secret_id }}"
+    oidc:
+      enabled: false
+    webapp:
+      settings_module: "hotpocket_bthlabs.settings.webapp"
+      loki:
+        external_labels: "job=hotpocket,service=backend-webapp,environment=staging"
+      allowed_hosts:
+        - "staging.hotpocket.app"
+  customization:
+    - src: "{{ inventory_dir }}/env_vars/staging/etc/backend/entrypoint.d/01-install-customized-deps.sh"
+      dest: "etc/backend/entrypoint.d/01-install-customized-deps.sh"
+      mode: "755"
+    - src: "{{ inventory_dir }}/env_vars/staging/etc/backend/entrypoint.d/99-collectstatic.sh"
+      dest: "etc/backend/entrypoint.d/99-collectstatic.sh"
+      mode: "755"
+    - src: "{{ inventory_dir }}/env_vars/staging/lib/backend/requirements.txt"
+      dest: "lib/backend/requirements.txt"

deployment/hotpocket_app/inventory.yaml

@@ -0,0 +1,10 @@
+hotpocket_app:
+  hosts:
+    web1.staging.hotpocket.app:
+      ansible_host: vm-125.homelab01.bthlab
+      ansible_port: 22
+      ansible_user: hotpocket_staging
+    web1.production.hotpocket.app:
+      ansible_host: vm-125.homelab01.bthlab
+      ansible_port: 22
+      ansible_user: hotpocket

deployment/hotpocket_app/roles/hotpocket_app/tasks/main.yaml

@@ -0,0 +1,73 @@
+- name: "Create workspace directories"
+  ansible.builtin.file:
+    path: "{{ hotpocket_app.deployment_directory }}/{{ item }}"
+    state: "directory"
+  loop:
+    - "etc"
+    - "etc/backend"
+    - "etc/backend/entrypoint.d"
+    - "lib"
+    - "lib/backend"
+    - "log"
+    - "run"
+    - "run/backend-admin"
+    - "run/backend-celery-beat"
+    - "run/backend-celery-worker"
+    - "run/backend-webapp"
+    - "run/uploads"
+- name: "Install docker-compose.yml"
+  ansible.builtin.template:
+    src: "templates/{{ hotpocket_app.mode }}/docker-compose.yaml.jinja2"
+    dest: "{{ hotpocket_app.deployment_directory }}/docker-compose.yaml"
+    owner: "{{ hotpocket_app.owner }}"
+    group: "{{ hotpocket_app.group }}"
+- name: "Install env files"
+  ansible.builtin.template:
+    src: "templates/{{ hotpocket_app.mode }}/{{ item }}.jinja2"
+    dest: "{{ hotpocket_app.deployment_directory }}/etc/{{ item }}"
+    owner: "{{ hotpocket_app.owner }}"
+    group: "{{ hotpocket_app.group }}"
+  loop: "{{ hotpocket_app_role.env_files[hotpocket_app.mode] }}"
+- name: "Upload customization files"
+  ansible.builtin.copy:
+    src: "{{ item.src }}"
+    dest: "{{ hotpocket_app.deployment_directory }}/{{ item.dest }}"
+    owner: "{{ hotpocket_app.owner }}"
+    group: "{{ hotpocket_app.group }}"
+    mode: "{{ item.mode|default('644') }}"
+  loop: "{{ hotpocket_app.customization }}"
+  when: "hotpocket_app.customization is defined"
+- name: "Install hotpocket_app.service unit"
+  ansible.builtin.template:
+    src: "templates/{{ hotpocket_app_role.services[hotpocket_app.mode].src }}.jinja2"
+    dest: "{{ hotpocket_app.deployment_directory }}/etc/{{ hotpocket_app_role.services[hotpocket_app.mode].dest }}"
+    owner: "{{ hotpocket_app.owner }}"
+    group: "{{ hotpocket_app.group }}"
+- name: "Stop the stack"
+  ansible.builtin.command:
+    argv:
+      - "docker"
+      - "compose"
+      - "down"
+    chdir: "{{ hotpocket_app.deployment_directory }}"
+- name: "Run backend migrations"
+  ansible.builtin.command:
+    argv:
+      - "docker"
+      - "compose"
+      - "run"
+      - "--rm"
+      - "backend-webapp"
+      - "./manage.py"
+      - "migrate"
+    chdir: "{{ hotpocket_app.deployment_directory }}"
+  when: "hotpocket_app.mode == 'fullstack' and is_manual_run is not defined"
+- name: "Start the stack"
+  ansible.builtin.command:
+    argv:
+      - "docker"
+      - "compose"
+      - "up"
+      - "-d"
+    chdir: "{{ hotpocket_app.deployment_directory }}"
+  when: "is_manual_run is not defined"

deployment/hotpocket_app/roles/hotpocket_app/templates/aio/backend_base.env.jinja2

@@ -0,0 +1,9 @@
+DJANGO_SETTINGS_MODULE="{{ hotpocket_app.backend.webapp.settings_module|default('hotpocket_backend.settings.aio')}}"
+HOTPOCKET_BACKEND_ENV="{{ hotpocket_app.backend.env|default('aio') }}"
+HOTPOCKET_BACKEND_MODEL_AUTH_IS_DISABLED="{% if hotpocket_app.backend.model_auth_is_disabled %}true{% else %}false{% endif %}"
+
+{% if hotpocket_app.backend.oidc.enabled %}HOTPOCKET_BACKEND_OIDC_PAYLOAD='{"endpoint":"{{ hotpocket_app.backend.oidc.endpoint }}","key":"{{ hotpocket_app_secrets.backend.oidc.key }}","secret":"{{ hotpocket_app_secrets.backend.oidc.secret }}","display_name":"{{ hotpocket_app.backend.oidc.display_name }}"}'{% else %}#noop{% endif %}
+
+{% for extra_env in hotpocket_app.backend.extra_env|default([]) %}
+{{ extra_env }}
+{% endfor %}

deployment/hotpocket_app/roles/hotpocket_app/templates/aio/backend_webapp.env.jinja2

@@ -0,0 +1,7 @@
+HOTPOCKET_BACKEND_SECRET_KEY: "{{ hotpocket_app_secrets.backend.webapp.secret_key }}"
+HOTPOCKET_BACKEND_ALLOWED_HOSTS="{{ hotpocket_app.backend.webapp.allowed_hosts|join(',') }}"
+HOTPOCKET_BACKEND_INITIAL_ACCOUNT_USERNAME: "{{ hotpocket_app_secrets.backend.webapp.initial_account.username }}"
+HOTPOCKET_BACKEND_INITIAL_ACCOUNT_PASSWORD: "{{ hotpocket_app_secrets.backend.webapp.initial_account.password }}"
+{% for extra_env in hotpocket_app.backend.webapp.extra_env|default([]) %}
+{{ extra_env }}
+{% endfor %}

deployment/hotpocket_app/roles/hotpocket_app/templates/aio/docker-compose.yaml.jinja2

@@ -0,0 +1,28 @@
+services:
+  backend-webapp:
+    image: "docker-hosted.nexus.bthlabs.pl/hotpocket/backend:{{ hotpocket_app.backend.image_tag }}"
+    command:
+      - "/srv/venv/bin/gunicorn"
+      - "-c"
+      - "/srv/lib/gunicorn.conf.py"
+      - "-b"
+      - "unix:///srv/run/gunicorn.sock"
+      - "hotpocket_backend.wsgi:application"
+    logging:
+      driver: "loki"
+      options:
+        loki-url: "{{ hotpocket_app.loki.url }}"
+        loki-external-labels: "{{ hotpocket_app.backend.webapp.loki.external_labels }}"
+        labels: "node"
+    labels:
+      node: "{{ hotpocket_app.loki.node }}"
+    env_file:
+      - "etc/backend_base.env"
+      - "etc/backend_webapp.env"
+    extra_hosts: [{% for extra_host in hotpocket_app.docker.extra_hosts|default([]) %}"{{ extra_host }}"{% endfor %}]
+    restart: "unless-stopped"
+    volumes:
+      - "{{ hotpocket_app.deployment_directory }}/etc/backend:/srv/etc"
+      - "{{ hotpocket_app.deployment_directory }}/lib/backend:/srv/lib/backend"
+      - "{{ hotpocket_app.deployment_directory }}/run/backend-webapp:/srv/run"
+      - "{{ hotpocket_app.deployment_directory }}/run/uploads:/srv/uploads"

deployment/hotpocket_app/roles/hotpocket_app/templates/fullstack/backend_admin.env.jinja2

@@ -0,0 +1,8 @@
+DJANGO_SETTINGS_MODULE="{{ hotpocket_app.backend.admin.settings_module|default('hotpocket_backend.settings.deployment.admin')}}"
+HOTPOCKET_BACKEND_GUNICORN_WORKERS=2
+HOTPOCKET_BACKEND_APP="admin"
+HOTPOCKET_BACKEND_SECRET_KEY="{{ hotpocket_app_secrets.backend.admin.secret_key }}"
+HOTPOCKET_BACKEND_ALLOWED_HOSTS="{{ hotpocket_app.backend.admin.allowed_hosts|join(',') }}"
+{% for extra_env in hotpocket_app.backend.admin.extra_env|default([]) %}
+{{ extra_env }}
+{% endfor %}

deployment/hotpocket_app/roles/hotpocket_app/templates/fullstack/backend_base.env.jinja2

@@ -0,0 +1,15 @@
+HOTPOCKET_BACKEND_ENV="{{ hotpocket_app.backend.env|default('deployment') }}"
+HOTPOCKET_BACKEND_DATABASE_NAME="{{ hotpocket_app.backend.database.name }}"
+HOTPOCKET_BACKEND_DATABASE_USER="{{ hotpocket_app.backend.database.user }}"
+HOTPOCKET_BACKEND_DATABASE_PASSWORD="{{ hotpocket_app_secrets.backend.database.password }}"
+HOTPOCKET_BACKEND_DATABASE_HOST="{{ hotpocket_app.backend.database.host }}"
+HOTPOCKET_BACKEND_CELERY_BROKER_URL="amqp://{{ hotpocket_app.backend.rabbitmq.user }}:{{ hotpocket_app_secrets.backend.rabbitmq.password }}@{{ hotpocket_app.backend.rabbitmq.host }}/{{ hotpocket_app.backend.rabbitmq.vhost }}"
+HOTPOCKET_BACKEND_CELERY_RESULT_BACKEND="db+postgresql+psycopg://{{ hotpocket_app.backend.database.user }}:{{ hotpocket_app_secrets.backend.database.password }}@{{ hotpocket_app.backend.database.host }}/{{ hotpocket_app.backend.database.name }}"
+HOTPOCKET_BACKEND_MODEL_AUTH_IS_DISABLED="{% if hotpocket_app.backend.model_auth_is_disabled %}true{% else %}false{% endif %}"
+
+{% if hotpocket_app.backend.oidc.enabled %}HOTPOCKET_BACKEND_OIDC_PAYLOAD='{"endpoint":"{{ hotpocket_app.backend.oidc.endpoint }}","key":"{{ hotpocket_app_secrets.backend.oidc.key }}","secret":"{{ hotpocket_app_secrets.backend.oidc.secret }}","display_name":"{{ hotpocket_app.backend.oidc.display_name }}"}'{% else %}#noop{% endif %}
+
+{% for extra_env in hotpocket_app.backend.extra_env|default([]) %}
+{{ extra_env }}
+{% endfor %}
+

deployment/hotpocket_app/roles/hotpocket_app/templates/fullstack/backend_webapp.env.jinja2

@@ -0,0 +1,9 @@
+DJANGO_SETTINGS_MODULE="{{ hotpocket_app.backend.webapp.settings_module|default('hotpocket_backend.settings.deployment.webapp')}}"
+HOTPOCKET_BACKEND_APP="webapp"
+HOTPOCKET_BACKEND_SECRET_KEY="{{ hotpocket_app_secrets.backend.webapp.secret_key }}"
+HOTPOCKET_BACKEND_ALLOWED_HOSTS="{{ hotpocket_app.backend.webapp.allowed_hosts|join(',') }}"
+HOTPOCKET_BACKEND_SAVES_SAVE_ADAPTER="hotpocket_backend.apps.saves.adapters.postgres:PostgresSaveAdapter"
+HOTPOCKET_BACKEND_SAVES_ASSOCIATION_ADAPTER="hotpocket_backend.apps.saves.adapters.postgres:PostgresAssociationAdapter"
+{% for extra_env in hotpocket_app.backend.webapp.extra_env|default([]) %}
+{{ extra_env }}
+{% endfor %}

deployment/hotpocket_app/roles/hotpocket_app/templates/fullstack/docker-compose.yaml.jinja2

@@ -0,0 +1,118 @@
+services:
+  backend-webapp:
+    image: "docker-hosted.nexus.bthlabs.pl/hotpocket/backend:{{ hotpocket_app.backend.image_tag }}"
+    command:
+      - "/srv/venv/bin/gunicorn"
+      - "-c"
+      - "/srv/lib/gunicorn.conf.py"
+      - "-b"
+      - "unix:///srv/run/gunicorn.sock"
+      - "hotpocket_backend.wsgi:application"
+    logging:
+      driver: "loki"
+      options:
+        loki-url: "{{ hotpocket_app.loki.url }}"
+        loki-external-labels: "{{ hotpocket_app.backend.webapp.loki.external_labels }}"
+        labels: "node"
+    labels:
+      node: "{{ hotpocket_app.loki.node }}"
+    env_file:
+      - "etc/backend_base.env"
+      - "etc/backend_webapp.env"
+    extra_hosts: [{% for extra_host in hotpocket_app.docker.extra_hosts %}"{{ extra_host }}"{% endfor %}]
+    restart: "unless-stopped"
+    volumes:
+      - "{{ hotpocket_app.deployment_directory }}/etc/backend:/srv/etc"
+      - "{{ hotpocket_app.deployment_directory }}/lib/backend:/srv/lib/backend"
+      - "{{ hotpocket_app.deployment_directory }}/run/backend-webapp:/srv/run"
+      - "{{ hotpocket_app.deployment_directory }}/run/uploads:/srv/uploads"
+
+  backend-admin:
+    image: "docker-hosted.nexus.bthlabs.pl/hotpocket/backend:{{ hotpocket_app.backend.image_tag }}"
+    command:
+      - "/srv/venv/bin/gunicorn"
+      - "-c"
+      - "/srv/lib/gunicorn.conf.py"
+      - "-b"
+      - "unix:///srv/run/gunicorn.sock"
+      - "hotpocket_backend.wsgi:application"
+    logging:
+      driver: "loki"
+      options:
+        loki-url: "{{ hotpocket_app.loki.url }}"
+        loki-external-labels: "{{ hotpocket_app.backend.admin.loki.external_labels }}"
+        labels: "node"
+    labels:
+      node: "{{ hotpocket_app.loki.node }}"
+    env_file:
+      - "etc/backend_base.env"
+      - "etc/backend_admin.env"
+    extra_hosts: [{% for extra_host in hotpocket_app.docker.extra_hosts %}"{{ extra_host }}"{% endfor %}]
+    restart: "unless-stopped"
+    volumes:
+      - "{{ hotpocket_app.deployment_directory }}/etc/backend:/srv/etc"
+      - "{{ hotpocket_app.deployment_directory }}/lib/backend:/srv/lib/backend"
+      - "{{ hotpocket_app.deployment_directory }}/run/backend-admin:/srv/run"
+      - "{{ hotpocket_app.deployment_directory }}/run/uploads:/srv/uploads"
+
+  backend-celery-worker:
+    image: "docker-hosted.nexus.bthlabs.pl/hotpocket/backend:{{ hotpocket_app.backend.image_tag }}"
+    command:
+      - "/srv/venv/bin/celery"
+      - "-A"
+      - "hotpocket_backend.celery:app"
+      - "worker"
+      - "-l"
+      - "INFO"
+      - "-Q"
+      - "celery,webapp"
+      - "-c"
+      - "{{ hotpocket_app.backend.celery_worker.concurrency }}"
+    logging:
+      driver: "loki"
+      options:
+        loki-url: "{{ hotpocket_app.loki.url }}"
+        loki-external-labels: "{{ hotpocket_app.backend.celery_worker.loki.external_labels }}"
+        labels: "node"
+    labels:
+      node: "{{ hotpocket_app.loki.node }}"
+    env_file:
+      - "etc/backend_base.env"
+      - "etc/backend_webapp.env"
+    extra_hosts: [{% for extra_host in hotpocket_app.docker.extra_hosts %}"{{ extra_host }}"{% endfor %}]
+    restart: "unless-stopped"
+    volumes:
+      - "{{ hotpocket_app.deployment_directory }}/etc/backend:/srv/etc"
+      - "{{ hotpocket_app.deployment_directory }}/lib/backend:/srv/lib/backend"
+      - "{{ hotpocket_app.deployment_directory }}/run/backend-celery-worker:/srv/run"
+      - "{{ hotpocket_app.deployment_directory }}/run/uploads:/srv/uploads"
+
+  backend-celery-beat:
+    image: "docker-hosted.nexus.bthlabs.pl/hotpocket/backend:{{ hotpocket_app.backend.image_tag }}"
+    command:
+      - "/srv/venv/bin/celery"
+      - "-A"
+      - "hotpocket_backend.celery:app"
+      - "beat"
+      - "-l"
+      - "INFO"
+      - "-s"
+      - "/srv/run/celery-beat-schedule"
+    logging:
+      driver: "loki"
+      options:
+        loki-url: "{{ hotpocket_app.loki.url }}"
+        loki-external-labels: "{{ hotpocket_app.backend.celery_beat.loki.external_labels }}"
+        labels: "node"
+    labels:
+      node: "{{ hotpocket_app.loki.node }}"
+    env_file:
+      - "etc/backend_base.env"
+      - "etc/backend_webapp.env"
+    extra_hosts: [{% for extra_host in hotpocket_app.docker.extra_hosts %}"{{ extra_host }}"{% endfor %}]
+    restart: "unless-stopped"
+    volumes:
+      - "{{ hotpocket_app.deployment_directory }}/etc/backend:/srv/etc"
+      - "{{ hotpocket_app.deployment_directory }}/lib/backend:/srv/lib/backend"
+      - "{{ hotpocket_app.deployment_directory }}/run/backend-celery-beat:/srv/run"
+      - "{{ hotpocket_app.deployment_directory }}/run/uploads:/srv/uploads"

deployment/hotpocket_app/roles/hotpocket_app/templates/hotpocket_app.service.jinja2

@@ -0,0 +1,15 @@
+[Unit]
+Description=hotpocket_backend.webapp
+Requires=docker.service
+After=docker.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+WorkingDirectory={{ hotpocket_app.deployment_directory }}
+ExecStart=/usr/bin/docker compose up -d
+ExecStop=/usr/bin/docker compose down
+TimeoutStartSec=0
+
+[Install]
+WantedBy=multi-user.target

deployment/hotpocket_app/roles/hotpocket_app/vars/main.yaml

@@ -0,0 +1,16 @@
+hotpocket_app_role:
+  env_files:
+    fullstack:
+      - "backend_admin.env"
+      - "backend_base.env"
+      - "backend_webapp.env"
+    aio:
+      - "backend_base.env"
+      - "backend_webapp.env"
+  services:
+    fullstack:
+      src: "hotpocket_app.service"
+      dest: "hotpocket_app.service"
+    aio:
+      src: "hotpocket_app.service"
+      dest: "staging_hotpocket_app.service"

deployment/hotpocket_bthlab/configs/backend/admin

@@ -0,0 +1,7 @@
+DJANGO_SETTINGS_MODULE=hotpocket_bthlabs.settings.admin
+HOTPOCKET_BACKEND_GUNICORN_WORKERS=2
+HOTPOCKET_BACKEND_SECRETS_PACKAGE=hotpocket_bthlabs.secrets
+HOTPOCKET_BACKEND_ENV=development
+HOTPOCKET_BACKEND_APP=admin
+HOTPOCKET_BACKEND_SECRET_KEY=thisissecret
+HOTPOCKET_BACKEND_ALLOWED_HOSTS=admin.hotpocket.bthlab.bthlabs.net

deployment/hotpocket_bthlab/configs/backend/base

@@ -0,0 +1,8 @@
+HOTPOCKET_BACKEND_ENV=deployment
+HOTPOCKET_BACKEND_DATABASE_NAME=hotpocket_development_backend
+HOTPOCKET_BACKEND_DATABASE_USER=thisissecret
+HOTPOCKET_BACKEND_DATABASE_PASSWORD=thisissecret
+HOTPOCKET_BACKEND_DATABASE_HOST=databases.bthlab
+HOTPOCKET_BACKEND_CELERY_BROKER_URL=thisissecret
+HOTPOCKET_BACKEND_CELERY_RESULT_BACKEND=thisissecret
+HOTPOCKET_BACKEND_MODEL_AUTH_IS_DISABLED=false

deployment/hotpocket_bthlab/configs/backend/webapp

@@ -0,0 +1,9 @@
+DJANGO_SETTINGS_MODULE=hotpocket_bthlabs.settings.webapp
+HOTPOCKET_BACKEND_GUNICORN_WORKERS=2
+HOTPOCKET_BACKEND_SECRETS_PACKAGE=hotpocket_bthlabs.secrets
+HOTPOCKET_BACKEND_ENV=development
+HOTPOCKET_BACKEND_APP=webapp
+HOTPOCKET_BACKEND_SECRET_KEY=thisissecret
+HOTPOCKET_BACKEND_ALLOWED_HOSTS=app.hotpocket.bthlab.bthlabs.net
+HOTPOCKET_BACKEND_SAVES_SAVE_ADAPTER=hotpocket_backend.apps.saves.adapters.postgres:PostgresSaveAdapter
+HOTPOCKET_BACKEND_SAVES_ASSOCIATION_ADAPTER=hotpocket_backend.apps.saves.adapters.postgres:PostgresAssociationAdapter

deployment/hotpocket_bthlab/kustomization.yaml

@@ -0,0 +1,40 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - resources/namespace.yaml
+  - resources/volumes.yaml
+  - resources/backend/config-map-local-deps.yaml
+  - resources/backend/job-migrations.yaml
+  - resources/backend/webapp.yaml
+  - resources/backend/webapp-service.yaml
+  - resources/backend/webapp-ingress.yaml
+  - resources/backend/admin.yaml
+  - resources/backend/admin-service.yaml
+  - resources/backend/admin-ingress.yaml
+  - resources/backend/celery-worker.yaml
+  - resources/backend/celery-beat.yaml
+
+configMapGenerator:
+  - behavior: create
+    namespace: hotpocket-development
+    envs:
+      - configs/backend/base
+    name: backend-base-config
+  - behavior: create
+    namespace: hotpocket-development
+    envs:
+      - configs/backend/webapp
+    name: backend-webapp-config
+  - behavior: create
+    namespace: hotpocket-development
+    envs:
+      - configs/backend/admin
+    name: backend-admin-config
+
+patches: []
+
+images:
+  - name: hotpocket-backend
+    newName: nexus.bthlab.bthlabs.net:8002/hotpocket/backend
+    newTag: deployment-8e09ae51-01

deployment/hotpocket_bthlab/resources/backend/admin-ingress.yaml

@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: backend-admin-ingress
+  namespace: hotpocket-development
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: "web"
+spec:
+  rules:
+  - host: admin.hotpocket.bthlab.bthlabs.net
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: backend-admin-service
+            port:
+              name: http

deployment/hotpocket_bthlab/resources/backend/admin-service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend-admin-service
+  namespace: hotpocket-development
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/app: backend-admin
+  ports:
+    - name: http
+      protocol: TCP
+      port: 8000
+      targetPort: http

deployment/hotpocket_bthlab/resources/backend/admin.yaml

@@ -0,0 +1,99 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend-admin
+  namespace: hotpocket-development
+  labels:
+    app.kubernetes.io/app: backend-admin
+spec:
+  minReadySeconds: 30
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 1
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app.kubernetes.io/app: backend-admin
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/app: backend-admin
+    spec:
+      containers:
+        - name: app
+          image: hotpocket-backend:latest
+          args:
+            - "/srv/venv/bin/gunicorn"
+            - "-c"
+            - "/srv/lib/gunicorn.conf.py"
+            - "hotpocket_backend.wsgi:application"
+          envFrom:
+            - configMapRef:
+                name: backend-base-config
+            - configMapRef:
+                name: backend-admin-config
+          env:
+            - name: VAULT_URL
+              valueFrom:
+                secretKeyRef:
+                  name: backend-vault
+                  key: url
+            - name: VAULT_ROLE_ID
+              valueFrom:
+                secretKeyRef:
+                  name: backend-vault
+                  key: role_id
+            - name: VAULT_SECRET_ID
+              valueFrom:
+                secretKeyRef:
+                  name: backend-vault
+                  key: secret_id
+          ports:
+            - containerPort: 8000
+              name: http
+              protocol: TCP
+            - containerPort: 8001
+              name: healthcheck
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: "/"
+              port: 8001
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: "/"
+              port: 8001
+            initialDelaySeconds: 2
+            periodSeconds: 5
+          volumeMounts:
+            - mountPath: /dev/shm
+              name: shm
+            - mountPath: /srv/run
+              name: backend-admin-srv-run
+            - name: backend-admin-local-deps
+              mountPath: "/srv/lib/requirements.txt"
+              subPath: "requirements.txt"
+            - name: backend-admin-local-deps
+              mountPath: "/srv/etc/entrypoint.d/01-install-extra-deps.sh"
+              subPath: "01-install-extra-deps.sh"
+            - name: backend-admin-local-deps
+              mountPath: "/srv/etc/entrypoint.d/99-collectstatic.sh"
+              subPath: "99-collectstatic.sh"
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      volumes:
+        - name: shm
+          emptyDir:
+            medium: Memory
+        - name: backend-admin-srv-run
+          emptyDir: {}
+        - name: backend-admin-local-deps
+          configMap:
+            name: "backend-local-deps"
+            defaultMode: 0755

deployment/hotpocket_bthlab/resources/backend/celery-beat.yaml

@@ -0,0 +1,80 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: backend-celery-beat
+  namespace: hotpocket-development
+  labels:
+    app.kubernetes.io/app: backend-celery-beat
+spec:
+  minReadySeconds: 30
+  replicas: 1
+  revisionHistoryLimit: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/app: backend-celery-beat
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/app: backend-celery-beat
+    spec:
+      containers:
+        - name: app
+          image: hotpocket-backend:latest
+          args:
+            - "/srv/venv/bin/celery"
+            - "-A"
+            - "hotpocket_backend.celery:app"
+            - "beat"
+            - "-l"
+            - "INFO"
+            - "-s"
+            - "/srv/run/celery-beat-schedule"
+          envFrom:
+            - configMapRef:
+                name: backend-base-config
+            - configMapRef:
+                name: backend-webapp-config
+          env:
+            - name: VAULT_URL
+              valueFrom:
+                secretKeyRef:
+                  name: backend-vault
+                  key: url
+            - name: VAULT_ROLE_ID
+              valueFrom:
+                secretKeyRef:
+                  name: backend-vault
+                  key: role_id
+            - name: VAULT_SECRET_ID
+              valueFrom:
+                secretKeyRef:
+                  name: backend-vault
+                  key: secret_id
+          volumeMounts:
+            - mountPath: /dev/shm
+              name: shm
+            - mountPath: /srv/run
+              name: backend-celery-beat-srv-run
+            - mountPath: /srv/uploads
+              name: backend-celery-beat-srv-uploads
+            - name: backend-admin-local-deps
+              mountPath: "/srv/lib/requirements.txt"
+              subPath: "requirements.txt"
+            - name: backend-admin-local-deps
+              mountPath: "/srv/etc/entrypoint.d/01-install-extra-deps.sh"
+              subPath: "01-install-extra-deps.sh"
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      volumes:
+        - name: shm
+          emptyDir:
+            medium: Memory
+        - name: backend-celery-beat-srv-run
+          persistentVolumeClaim:
+            claimName: backend-celery-beat-run
+        - name: backend-celery-beat-srv-uploads
+          emptyDir: {}
+        - name: backend-admin-local-deps
+          configMap:
+            name: "backend-local-deps"
+            defaultMode: 0755

deployment/hotpocket_bthlab/resources/backend/celery-worker.yaml

@@ -0,0 +1,88 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend-celery-worker
+  namespace: hotpocket-development
+  labels:
+    app.kubernetes.io/app: backend-celery-worker
+spec:
+  minReadySeconds: 30
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 1
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app.kubernetes.io/app: backend-celery-worker
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/app: backend-celery-worker
+    spec:
+      containers:
+        - name: app
+          image: hotpocket-backend:latest
+          args:
+            - "/srv/venv/bin/celery"
+            - "-A"
+            - "hotpocket_backend.celery:app"
+            - "worker"
+            - "-l"
+            - "INFO"
+            - "-Q"
+            - "celery,webapp"
+            - "-c"
+            - "2"
+          envFrom:
+            - configMapRef:
+                name: backend-base-config
+            - configMapRef:
+                name: backend-webapp-config
+          env:
+            - name: VAULT_URL
+              valueFrom:
+                secretKeyRef:
+                  name: backend-vault
+                  key: url
+            - name: VAULT_ROLE_ID
+              valueFrom:
+                secretKeyRef:
+                  name: backend-vault
+                  key: role_id
+            - name: VAULT_SECRET_ID
+              valueFrom:
+                secretKeyRef:
+                  name: backend-vault
+                  key: secret_id
+          volumeMounts:
+            - mountPath: /dev/shm
+              name: shm
+            - mountPath: /srv/run
+              name: backend-celery-worker-srv-run
+            - mountPath: /srv/uploads
+              name: backend-celery-worker-srv-uploads
+            - name: backend-admin-local-deps
+              mountPath: "/srv/lib/requirements.txt"
+              subPath: "requirements.txt"
+            - name: backend-admin-local-deps
+              mountPath: "/srv/etc/entrypoint.d/01-install-extra-deps.sh"
+              subPath: "01-install-extra-deps.sh"
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      volumes:
+        - name: shm
+          emptyDir:
+            medium: Memory
+        - name: backend-celery-worker-srv-run
+          emptyDir: {}
+        - name: backend-celery-worker-srv-uploads
+          persistentVolumeClaim:
+            claimName: backend-uploads
+        - name: backend-admin-local-deps
+          configMap:
+            name: "backend-local-deps"
+            defaultMode: 0755

deployment/hotpocket_bthlab/resources/backend/config-map-local-deps.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: backend-local-deps
+  namespace: hotpocket-development
+data:
+  01-install-extra-deps.sh: |
+    #!/usr/bin/env bash
+    export PIP_INDEX_URL="https://nexus.bthlabs.pl/repository/pypi/simple/"
+    /srv/venv/bin/pip install -r /srv/lib/requirements.txt
+  99-collectstatic.sh: |
+    #!/usr/bin/env bash
+    (
+      cd /srv/app;
+      ./manage.py collectstatic --no-input
+    )
+  requirements.txt: |
+    hotpocket_bthlabs>=25.10.28

deployment/hotpocket_bthlab/resources/backend/job-migrations.yaml

@@ -0,0 +1,75 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: backend-job-migrations
+  namespace: hotpocket-development
+  labels:
+    app.kubernetes.io/app: backend-job-migrations
+spec:
+  concurrencyPolicy: "Forbid"
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 1
+  startingDeadlineSeconds: 180
+  schedule: "* * * * *"
+  suspend: true
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      completions: 1
+      parallelism: 1
+      template:
+        spec:
+          containers:
+            - name: migrations
+              image: hotpocket-backend:latest
+              args:
+                - "./manage.py"
+                - "migrate"
+              envFrom:
+                - configMapRef:
+                    name: backend-base-config
+                - configMapRef:
+                    name: backend-webapp-config
+              env:
+                - name: VAULT_URL
+                  valueFrom:
+                    secretKeyRef:
+                      name: backend-vault
+                      key: url
+                - name: VAULT_ROLE_ID
+                  valueFrom:
+                    secretKeyRef:
+                      name: backend-vault
+                      key: role_id
+                - name: VAULT_SECRET_ID
+                  valueFrom:
+                    secretKeyRef:
+                      name: backend-vault
+                      key: secret_id
+              volumeMounts:
+                - mountPath: /dev/shm
+                  name: shm
+                - mountPath: /srv/run
+                  name: backend-webapp-srv-run
+                - mountPath: /srv/uploads
+                  name: backend-webapp-srv-uploads
+                - name: backend-admin-local-deps
+                  mountPath: "/srv/lib/requirements.txt"
+                  subPath: "requirements.txt"
+                - name: backend-admin-local-deps
+                  mountPath: "/srv/etc/entrypoint.d/01-install-extra-deps.sh"
+                  subPath: "01-install-extra-deps.sh"
+          dnsPolicy: ClusterFirst
+          restartPolicy: Never
+          volumes:
+            - name: shm
+              emptyDir:
+                medium: Memory
+            - name: backend-webapp-srv-run
+              emptyDir: {}
+            - name: backend-webapp-srv-uploads
+              emptyDir: {}
+            - name: backend-admin-local-deps
+              configMap:
+                name: "backend-local-deps"
+                defaultMode: 0755

deployment/hotpocket_bthlab/resources/backend/webapp-ingress.yaml

@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: backend-webapp-ingress
+  namespace: hotpocket-development
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: "web"
+spec:
+  rules:
+  - host: app.hotpocket.bthlab.bthlabs.net
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: backend-webapp-service
+            port:
+              name: http

deployment/hotpocket_bthlab/resources/backend/webapp-service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend-webapp-service
+  namespace: hotpocket-development
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/app: backend-webapp
+  ports:
+    - name: http
+      protocol: TCP
+      port: 8000
+      targetPort: http

deployment/hotpocket_bthlab/resources/backend/webapp.yaml

@@ -0,0 +1,106 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend-webapp
+  namespace: hotpocket-development
+  labels:
+    app.kubernetes.io/app: backend-webapp
+spec:
+  minReadySeconds: 30
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 1
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app.kubernetes.io/app: backend-webapp
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/app: backend-webapp
+    spec:
+      containers:
+        - name: app
+          image: hotpocket-backend:latest
+          args:
+            - "/srv/venv/bin/gunicorn"
+            - "-c"
+            - "/srv/lib/gunicorn.conf.py"
+            - "hotpocket_backend.wsgi:application"
+          envFrom:
+            - configMapRef:
+                name: backend-base-config
+            - configMapRef:
+                name: backend-webapp-config
+          env:
+            - name: VAULT_URL
+              valueFrom:
+                secretKeyRef:
+                  name: backend-vault
+                  key: url
+            - name: VAULT_ROLE_ID
+              valueFrom:
+                secretKeyRef:
+                  name: backend-vault
+                  key: role_id
+            - name: VAULT_SECRET_ID
+              valueFrom:
+                secretKeyRef:
+                  name: backend-vault
+                  key: secret_id
+            - name: HOTPOCKET_BACKEND_CREATE_INITIAL_ACCOUNT
+              value: "true"
+          ports:
+            - containerPort: 8000
+              name: http
+              protocol: TCP
+            - containerPort: 8001
+              name: healthcheck
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: "/"
+              port: 8001
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: "/"
+              port: 8001
+            initialDelaySeconds: 2
+            periodSeconds: 5
+          volumeMounts:
+            - mountPath: /dev/shm
+              name: shm
+            - mountPath: /srv/run
+              name: backend-webapp-srv-run
+            - mountPath: /srv/uploads
+              name: backend-webapp-srv-uploads
+            - name: backend-admin-local-deps
+              mountPath: "/srv/lib/requirements.txt"
+              subPath: "requirements.txt"
+            - name: backend-admin-local-deps
+              mountPath: "/srv/etc/entrypoint.d/01-install-extra-deps.sh"
+              subPath: "01-install-extra-deps.sh"
+            - name: backend-admin-local-deps
+              mountPath: "/srv/etc/entrypoint.d/99-collectstatic.sh"
+              subPath: "99-collectstatic.sh"
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      volumes:
+        - name: shm
+          emptyDir:
+            medium: Memory
+        - name: backend-webapp-srv-run
+          emptyDir: {}
+        - name: backend-webapp-srv-uploads
+          persistentVolumeClaim:
+            claimName: backend-uploads
+        - name: backend-admin-local-deps
+          configMap:
+            name: "backend-local-deps"
+            defaultMode: 0755

deployment/hotpocket_bthlab/resources/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: hotpocket-development

deployment/hotpocket_bthlab/resources/volumes.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: backend-uploads
+  namespace: hotpocket-development
+spec:
+  storageClassName: nfs-client
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: "1Gi"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: backend-celery-beat-run
+  namespace: hotpocket-development
+spec:
+  storageClassName: nfs-client
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: "1Gi"

docker-bake.json

@@ -2,6 +2,7 @@
   "group": {
     "default": {
       "targets": [
+        "apple-management",
         "backend-management",
         "caddy",
         "extension-management",
@@ -13,6 +14,28 @@
     }
   },
   "target": {
+    "apple-management": {
+      "context": "services/",
+      "dockerfile": "apple/Dockerfile",
+      "tags": [
+        "docker-hosted.nexus.bthlabs.pl/hotpocket/apple:local"
+      ],
+      "target": "development",
+      "output": [
+        "type=docker,load=true,push=false"
+      ]
+    },
+    "apple-ci": {
+      "context": "services/",
+      "dockerfile": "apple/Dockerfile",
+      "tags": [
+        "docker-hosted.nexus.bthlabs.pl/hotpocket/apple:ci-local"
+      ],
+      "target": "ci",
+      "output": [
+        "type=docker,load=true,push=false"
+      ]
+    },
     "backend-management": {
       "context": "services/",
       "dockerfile": "backend/Dockerfile",

docker-compose-ci.yaml

@@ -1,16 +1,17 @@
 services:
   postgres:
-    ports: []
+    ports: !override []
 
   keycloak:
     command: "echo 'NOOP'"
-    ports: []
+    ports: !override []
     restart: "no"
 
   rabbitmq:
-    ports: []
+    ports: !override []
 
 include:
   - path: "./services/backend/docker-compose-ci.yaml"
   - path: "./services/packages/docker-compose-ci.yaml"
   - path: "./services/extension/docker-compose-ci.yaml"
+  - path: "./services/apple/docker-compose-ci.yaml"

docker-compose.yaml

@@ -6,6 +6,7 @@ include:
   - path: "./services/backend/docker-compose.yaml"
   - path: "./services/packages/docker-compose.yaml"
   - path: "./services/extension/docker-compose.yaml"
+  - path: "./services/apple/docker-compose.yaml"
 
 volumes: {}
 

poetry.lock

@@ -1,16 +1,17 @@
-# This file is automatically @generated by Poetry 1.8.3 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand.
 
 [[package]]
 name = "hotpocket-workspace-tools"
 version = "1.0.0.dev0"
 description = "HotPocket Workspace Tools"
 optional = false
-python-versions = "^3.12"
+python-versions = "^3.13"
+groups = ["main"]
 files = []
 develop = true
 
 [package.dependencies]
-invoke = "2.2.0"
+invoke = "2.2.1"
 
 [package.source]
 type = "directory"
@@ -18,16 +19,17 @@ url = "services/packages/workspace_tools"
 
 [[package]]
 name = "invoke"
-version = "2.2.0"
+version = "2.2.1"
 description = "Pythonic task execution"
 optional = false
 python-versions = ">=3.6"
+groups = ["main"]
 files = [
-    {file = "invoke-2.2.0-py3-none-any.whl", hash = "sha256:6ea924cc53d4f78e3d98bc436b08069a03077e6f85ad1ddaa8a116d7dad15820"},
+    {file = "invoke-2.2.1-py3-none-any.whl", hash = "sha256:2413bc441b376e5cd3f55bb5d364f973ad8bdd7bf87e53c79de3c11bf3feecc8"},
-    {file = "invoke-2.2.0.tar.gz", hash = "sha256:ee6cbb101af1a859c7fe84f2a264c059020b0cb7fe3535f9424300ab568f6bd5"},
+    {file = "invoke-2.2.1.tar.gz", hash = "sha256:515bf49b4a48932b79b024590348da22f39c4942dff991ad1fb8b8baea1be707"},
 ]
 
 [metadata]
-lock-version = "2.0"
+lock-version = "2.1"
-python-versions = "^3.12"
+python-versions = "^3.13"
-content-hash = "ec33c3b3ec0f988e333872bdd134c1adce0782e98512dd2484cb85009b3da6cb"
+content-hash = "175bf795c7148fe40af7e095d6f41918fa14cf4c71be87444a4d6c467fbd38d2"

pyproject.toml

@@ -1,15 +1,14 @@
 [tool.poetry]
 name = "hotpocket-workspace"
-version = "25.9.18"
+version = "26.8.20"
 description = "HotPocket Workspace"
 authors = ["Tomek Wójcik <contact@bthlabs.pl>"]
 license = "Apache-2.0"
 package-mode = false
 
 [tool.poetry.dependencies]
-python = "^3.12"
+python = "^3.13"
 hotpocket-workspace-tools = {path = "services/packages/workspace_tools", develop = true}
-invoke = "2.2.0"
 
 [build-system]
 requires = ["poetry-core"]

services/.dockerignore

@@ -1,5 +1,8 @@
+.mypy_cache/
+.pytest_cache/
 _tmp/
-apple/
+apple/build/
+apple/DerivedData/
 backend/node_modules/
 backend/ops/metal/
 backend/hotpocket_backend/playground.py
@@ -10,4 +13,5 @@ backend/hotpocket_backend/settings/metal/
 backend/hotpocket_backend/static/
 extension/node_modules/
 extension/dist/
+vendor/
 .envrc*

services/apple/.gitignore

@@ -92,3 +92,5 @@ Shared (Extension)/Resources/content-bundle.js
 Shared (Extension)/Resources/manifest.json
 Shared (Extension)/Resources/preauth.html
 Shared (Extension)/Resources/preauth.js
+Shared (Extension)/Resources/options.html
+Shared (Extension)/Resources/options.js

services/apple/Dockerfile

@@ -0,0 +1,19 @@
+ARG APP_USER_UID=1000
+ARG APP_USER_GID=1000
+ARG IMAGE_ID=development.00000000
+
+FROM docker-hosted.nexus.bthlabs.pl/hotpocket/base:build-node-20260818-01 AS development
+
+ARG APP_USER_UID
+ARG APP_USER_GID
+ARG IMAGE_ID
+
+# COPY --chown=$APP_USER_UID:$APP_USER_GID apple/ops/bin/*.sh /srv/bin/
+
+VOLUME ["/srv/node_modules", "/srv/venv"]
+
+FROM development AS ci
+
+COPY --chown=$APP_USER_UID:$APP_USER_GID apple/ /srv/app/
+COPY --chown=$APP_USER_UID:$APP_USER_GID packages/ /srv/packages/
+COPY --chown=$APP_USER_UID:$APP_USER_GID tls/ /srv/tls/

services/apple/HotPocket.xcodeproj/project.pbxproj

@@ -7,11 +7,33 @@
 	objects = {
 
 /* Begin PBXBuildFile section */
+		4C1159202E8B055F003B34AD /* Save to HotPocket.appex in Embed Foundation Extensions */ = {isa = PBXBuildFile; fileRef = 4CBCEA4F2E81CB9500722009 /* Save to HotPocket.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
+		4C2F0C692E851BBD0033F5C2 /* Save to HotPocket.appex in Embed Foundation Extensions */ = {isa = PBXBuildFile; fileRef = 4C2F0C5E2E851BBD0033F5C2 /* Save to HotPocket.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
+		4C70F30D2E8869FB00320048 /* HPShareExtensionHelper.m in Sources */ = {isa = PBXBuildFile; fileRef = 4C70F30C2E8869FB00320048 /* HPShareExtensionHelper.m */; };
+		4C70F30E2E8869FB00320048 /* HPShareExtensionHelper.m in Sources */ = {isa = PBXBuildFile; fileRef = 4C70F30C2E8869FB00320048 /* HPShareExtensionHelper.m */; };
+		4C70F3152E886A8F00320048 /* HPSharedItem.m in Sources */ = {isa = PBXBuildFile; fileRef = 4C70F3142E886A8F00320048 /* HPSharedItem.m */; };
+		4C70F3162E886A8F00320048 /* HPSharedItem.m in Sources */ = {isa = PBXBuildFile; fileRef = 4C70F3142E886A8F00320048 /* HPSharedItem.m */; };
+		4C70F3192E886ADD00320048 /* HPSharedItemsContainer.m in Sources */ = {isa = PBXBuildFile; fileRef = 4C70F3182E886ADD00320048 /* HPSharedItemsContainer.m */; };
+		4C70F31A2E886ADD00320048 /* HPSharedItemsContainer.m in Sources */ = {isa = PBXBuildFile; fileRef = 4C70F3182E886ADD00320048 /* HPSharedItemsContainer.m */; };
 		4CABCAD62E56F0C900D8A354 /* HotPocket Extension.appex in Embed Foundation Extensions */ = {isa = PBXBuildFile; fileRef = 4CABCAD52E56F0C900D8A354 /* HotPocket Extension.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
 		4CABCAE02E56F0C900D8A354 /* HotPocket Extension.appex in Embed Foundation Extensions */ = {isa = PBXBuildFile; fileRef = 4CABCADF2E56F0C900D8A354 /* HotPocket Extension.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
+		4C1159212E8B055F003B34AD /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 4CABCA922E56F0C800D8A354 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 4CBCEA4E2E81CB9500722009;
+			remoteInfo = "macOS (Share Extension)";
+		};
+		4C2F0C672E851BBD0033F5C2 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 4CABCA922E56F0C800D8A354 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 4C2F0C5D2E851BBD0033F5C2;
+			remoteInfo = "iOS (Share Extension)";
+		};
 		4CABCAD72E56F0C900D8A354 /* PBXContainerItemProxy */ = {
 			isa = PBXContainerItemProxy;
 			containerPortal = 4CABCA922E56F0C800D8A354 /* Project object */;
@@ -36,6 +58,7 @@
 			dstSubfolderSpec = 13;
 			files = (
 				4CABCAD62E56F0C900D8A354 /* HotPocket Extension.appex in Embed Foundation Extensions */,
+				4C2F0C692E851BBD0033F5C2 /* Save to HotPocket.appex in Embed Foundation Extensions */,
 			);
 			name = "Embed Foundation Extensions";
 			runOnlyForDeploymentPostprocessing = 0;
@@ -46,6 +69,7 @@
 			dstPath = "";
 			dstSubfolderSpec = 13;
 			files = (
+				4C1159202E8B055F003B34AD /* Save to HotPocket.appex in Embed Foundation Extensions */,
 				4CABCAE02E56F0C900D8A354 /* HotPocket Extension.appex in Embed Foundation Extensions */,
 			);
 			name = "Embed Foundation Extensions";
@@ -54,22 +78,71 @@
 /* End PBXCopyFilesBuildPhase section */
 
 /* Begin PBXFileReference section */
-		4CABCAB02E56F0C900D8A354 /* HotPocket.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = HotPocket.app; sourceTree = BUILT_PRODUCTS_DIR; };
+		4C2F0C5E2E851BBD0033F5C2 /* Save to HotPocket.appex */ = {isa = PBXFileReference; explicitFileType = "wrapper.app-extension"; includeInIndex = 0; path = "Save to HotPocket.appex"; sourceTree = BUILT_PRODUCTS_DIR; };
-		4CABCAC62E56F0C900D8A354 /* HotPocket.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = HotPocket.app; sourceTree = BUILT_PRODUCTS_DIR; };
+		4C70F30B2E8869FB00320048 /* HPShareExtensionHelper.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = HPShareExtensionHelper.h; sourceTree = "<group>"; };
+		4C70F30C2E8869FB00320048 /* HPShareExtensionHelper.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = HPShareExtensionHelper.m; sourceTree = "<group>"; };
+		4C70F3132E886A8F00320048 /* HPSharedItem.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = HPSharedItem.h; sourceTree = "<group>"; };
+		4C70F3142E886A8F00320048 /* HPSharedItem.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = HPSharedItem.m; sourceTree = "<group>"; };
+		4C70F3172E886ADD00320048 /* HPSharedItemsContainer.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = HPSharedItemsContainer.h; sourceTree = "<group>"; };
+		4C70F3182E886ADD00320048 /* HPSharedItemsContainer.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = HPSharedItemsContainer.m; sourceTree = "<group>"; };
+		4CABCAB02E56F0C900D8A354 /* HotPocket Development.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = "HotPocket Development.app"; sourceTree = BUILT_PRODUCTS_DIR; };
+		4CABCAC62E56F0C900D8A354 /* HotPocket Development.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = "HotPocket Development.app"; sourceTree = BUILT_PRODUCTS_DIR; };
 		4CABCAD52E56F0C900D8A354 /* HotPocket Extension.appex */ = {isa = PBXFileReference; explicitFileType = "wrapper.app-extension"; includeInIndex = 0; path = "HotPocket Extension.appex"; sourceTree = BUILT_PRODUCTS_DIR; };
 		4CABCADF2E56F0C900D8A354 /* HotPocket Extension.appex */ = {isa = PBXFileReference; explicitFileType = "wrapper.app-extension"; includeInIndex = 0; path = "HotPocket Extension.appex"; sourceTree = BUILT_PRODUCTS_DIR; };
+		4CBCEA4F2E81CB9500722009 /* Save to HotPocket.appex */ = {isa = PBXFileReference; explicitFileType = "wrapper.app-extension"; includeInIndex = 0; path = "Save to HotPocket.appex"; sourceTree = BUILT_PRODUCTS_DIR; };
 /* End PBXFileReference section */
 
 /* Begin PBXFileSystemSynchronizedBuildFileExceptionSet section */
+		4C2F0C6D2E851BBD0033F5C2 /* Exceptions for "iOS (Share Extension)" folder in "iOS (Share Extension)" target */ = {
+			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
+			membershipExceptions = (
+				Info.plist,
+			);
+			target = 4C2F0C5D2E851BBD0033F5C2 /* iOS (Share Extension) */;
+		};
+		4C2F0C6F2E851BF90033F5C2 /* Exceptions for "Shared (App)" folder in "iOS (Share Extension)" target */ = {
+			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
+			membershipExceptions = (
+				Assets.xcassets,
+				"HotPocket 27.icon",
+				HPAPI.m,
+				HPCredentialsHelper.m,
+				HPRPCClient.m,
+				"NSBundle+HotPocketExtensions.m",
+				"NSURL+HotPocketExtensions.m",
+				"Resources/icon-glass-512.png",
+				"Resources/icon-mac-384.png",
+			);
+			target = 4C2F0C5D2E851BBD0033F5C2 /* iOS (Share Extension) */;
+		};
+		4C3B958C2E83C83A00F4F82C /* Exceptions for "macOS (App)" folder in "HotPocket (macOS)" target */ = {
+			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
+			membershipExceptions = (
+				Info.plist,
+			);
+			target = 4CABCAC52E56F0C900D8A354 /* HotPocket (macOS) */;
+		};
+		4C7A01792E867D6200DEA460 /* Exceptions for "iOS (App)" folder in "iOS (Share Extension)" target */ = {
+			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
+			membershipExceptions = (
+				MultilineLabel.m,
+				UnameLabel.m,
+			);
+			target = 4C2F0C5D2E851BBD0033F5C2 /* iOS (Share Extension) */;
+		};
 		4CABCB042E56F0C900D8A354 /* Exceptions for "Shared (App)" folder in "HotPocket (iOS)" target */ = {
 			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
 			membershipExceptions = (
-				"/Localized: Resources/Main.html",
 				Assets.xcassets,
+				"HotPocket 27.icon",
+				HPAPI.m,
+				HPAuthFlow.m,
+				HPCredentialsHelper.m,
+				HPRPCClient.m,
+				"NSBundle+HotPocketExtensions.m",
+				"NSURL+HotPocketExtensions.m",
+				"Resources/icon-glass-512.png",
 				"Resources/icon-mac-384.png",
-				Resources/Script.js,
-				Resources/Style.css,
-				ViewController.m,
 			);
 			target = 4CABCAAF2E56F0C900D8A354 /* HotPocket (iOS) */;
 		};
@@ -90,12 +163,16 @@
 		4CABCB0E2E56F0C900D8A354 /* Exceptions for "Shared (App)" folder in "HotPocket (macOS)" target */ = {
 			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
 			membershipExceptions = (
-				"/Localized: Resources/Main.html",
 				Assets.xcassets,
+				"HotPocket 27.icon",
+				HPAPI.m,
+				HPAuthFlow.m,
+				HPCredentialsHelper.m,
+				HPRPCClient.m,
+				"NSBundle+HotPocketExtensions.m",
+				"NSURL+HotPocketExtensions.m",
+				"Resources/icon-glass-512.png",
 				"Resources/icon-mac-384.png",
-				Resources/Script.js,
-				Resources/Style.css,
-				ViewController.m,
 			);
 			target = 4CABCAC52E56F0C900D8A354 /* HotPocket (macOS) */;
 		};
@@ -114,6 +191,8 @@
 				"Resources/content-bundle.js",
 				Resources/images,
 				Resources/manifest.json,
+				Resources/options.html,
+				Resources/options.js,
 				Resources/preauth.html,
 				Resources/preauth.js,
 				SafariWebExtensionHandler.m,
@@ -128,20 +207,54 @@
 				"Resources/content-bundle.js",
 				Resources/images,
 				Resources/manifest.json,
+				Resources/options.html,
+				Resources/options.js,
 				Resources/preauth.html,
 				Resources/preauth.js,
 				SafariWebExtensionHandler.m,
 			);
 			target = 4CABCADE2E56F0C900D8A354 /* HotPocket Extension (macOS) */;
 		};
+		4CBCEA612E81CB9500722009 /* Exceptions for "macOS (Share Extension)" folder in "macOS (Share Extension)" target */ = {
+			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
+			membershipExceptions = (
+				Info.plist,
+			);
+			target = 4CBCEA4E2E81CB9500722009 /* macOS (Share Extension) */;
+		};
+		4CBCEA632E81CBC800722009 /* Exceptions for "Shared (App)" folder in "macOS (Share Extension)" target */ = {
+			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
+			membershipExceptions = (
+				Assets.xcassets,
+				"HotPocket 27.icon",
+				HPAPI.m,
+				HPCredentialsHelper.m,
+				HPRPCClient.m,
+				"NSBundle+HotPocketExtensions.m",
+				"NSURL+HotPocketExtensions.m",
+				"Resources/icon-glass-512.png",
+				"Resources/icon-mac-384.png",
+			);
+			target = 4CBCEA4E2E81CB9500722009 /* macOS (Share Extension) */;
+		};
 /* End PBXFileSystemSynchronizedBuildFileExceptionSet section */
 
 /* Begin PBXFileSystemSynchronizedRootGroup section */
+		4C2F0C5F2E851BBD0033F5C2 /* iOS (Share Extension) */ = {
+			isa = PBXFileSystemSynchronizedRootGroup;
+			exceptions = (
+				4C2F0C6D2E851BBD0033F5C2 /* Exceptions for "iOS (Share Extension)" folder in "iOS (Share Extension)" target */,
+			);
+			path = "iOS (Share Extension)";
+			sourceTree = "<group>";
+		};
 		4CABCA962E56F0C800D8A354 /* Shared (App) */ = {
 			isa = PBXFileSystemSynchronizedRootGroup;
 			exceptions = (
 				4CABCB042E56F0C900D8A354 /* Exceptions for "Shared (App)" folder in "HotPocket (iOS)" target */,
 				4CABCB0E2E56F0C900D8A354 /* Exceptions for "Shared (App)" folder in "HotPocket (macOS)" target */,
+				4CBCEA632E81CBC800722009 /* Exceptions for "Shared (App)" folder in "macOS (Share Extension)" target */,
+				4C2F0C6F2E851BF90033F5C2 /* Exceptions for "Shared (App)" folder in "iOS (Share Extension)" target */,
 			);
 			path = "Shared (App)";
 			sourceTree = "<group>";
@@ -163,12 +276,16 @@
 			isa = PBXFileSystemSynchronizedRootGroup;
 			exceptions = (
 				4CABCB0D2E56F0C900D8A354 /* Exceptions for "iOS (App)" folder in "HotPocket (iOS)" target */,
+				4C7A01792E867D6200DEA460 /* Exceptions for "iOS (App)" folder in "iOS (Share Extension)" target */,
 			);
 			path = "iOS (App)";
 			sourceTree = "<group>";
 		};
 		4CABCAC72E56F0C900D8A354 /* macOS (App) */ = {
 			isa = PBXFileSystemSynchronizedRootGroup;
+			exceptions = (
+				4C3B958C2E83C83A00F4F82C /* Exceptions for "macOS (App)" folder in "HotPocket (macOS)" target */,
+			);
 			path = "macOS (App)";
 			sourceTree = "<group>";
 		};
@@ -188,9 +305,24 @@
 			path = "macOS (Extension)";
 			sourceTree = "<group>";
 		};
+		4CBCEA502E81CB9500722009 /* macOS (Share Extension) */ = {
+			isa = PBXFileSystemSynchronizedRootGroup;
+			exceptions = (
+				4CBCEA612E81CB9500722009 /* Exceptions for "macOS (Share Extension)" folder in "macOS (Share Extension)" target */,
+			);
+			path = "macOS (Share Extension)";
+			sourceTree = "<group>";
+		};
 /* End PBXFileSystemSynchronizedRootGroup section */
 
 /* Begin PBXFrameworksBuildPhase section */
+		4C2F0C5B2E851BBD0033F5C2 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		4CABCAAD2E56F0C900D8A354 /* Frameworks */ = {
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
@@ -219,18 +351,49 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		4CBCEA4C2E81CB9500722009 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 /* End PBXFrameworksBuildPhase section */
 
 /* Begin PBXGroup section */
+		4C11591F2E8B055F003B34AD /* Frameworks */ = {
+			isa = PBXGroup;
+			children = (
+			);
+			name = Frameworks;
+			sourceTree = "<group>";
+		};
+		4C70F30A2E8869D200320048 /* Shared (Share Extension) */ = {
+			isa = PBXGroup;
+			children = (
+				4C70F30B2E8869FB00320048 /* HPShareExtensionHelper.h */,
+				4C70F30C2E8869FB00320048 /* HPShareExtensionHelper.m */,
+				4C70F3132E886A8F00320048 /* HPSharedItem.h */,
+				4C70F3142E886A8F00320048 /* HPSharedItem.m */,
+				4C70F3172E886ADD00320048 /* HPSharedItemsContainer.h */,
+				4C70F3182E886ADD00320048 /* HPSharedItemsContainer.m */,
+			);
+			path = "Shared (Share Extension)";
+			sourceTree = "<group>";
+		};
 		4CABCA912E56F0C800D8A354 = {
 			isa = PBXGroup;
 			children = (
 				4CABCA962E56F0C800D8A354 /* Shared (App) */,
 				4CABCAA02E56F0C900D8A354 /* Shared (Extension) */,
+				4C70F30A2E8869D200320048 /* Shared (Share Extension) */,
 				4CABCAB22E56F0C900D8A354 /* iOS (App) */,
 				4CABCAC72E56F0C900D8A354 /* macOS (App) */,
 				4CABCAD92E56F0C900D8A354 /* iOS (Extension) */,
 				4CABCAE32E56F0C900D8A354 /* macOS (Extension) */,
+				4CBCEA502E81CB9500722009 /* macOS (Share Extension) */,
+				4C2F0C5F2E851BBD0033F5C2 /* iOS (Share Extension) */,
+				4C11591F2E8B055F003B34AD /* Frameworks */,
 				4CABCAB12E56F0C900D8A354 /* Products */,
 			);
 			sourceTree = "<group>";
@@ -238,10 +401,12 @@
 		4CABCAB12E56F0C900D8A354 /* Products */ = {
 			isa = PBXGroup;
 			children = (
-				4CABCAB02E56F0C900D8A354 /* HotPocket.app */,
+				4CABCAB02E56F0C900D8A354 /* HotPocket Development.app */,
-				4CABCAC62E56F0C900D8A354 /* HotPocket.app */,
+				4CABCAC62E56F0C900D8A354 /* HotPocket Development.app */,
 				4CABCAD52E56F0C900D8A354 /* HotPocket Extension.appex */,
 				4CABCADF2E56F0C900D8A354 /* HotPocket Extension.appex */,
+				4CBCEA4F2E81CB9500722009 /* Save to HotPocket.appex */,
+				4C2F0C5E2E851BBD0033F5C2 /* Save to HotPocket.appex */,
 			);
 			name = Products;
 			sourceTree = "<group>";
@@ -249,6 +414,28 @@
 /* End PBXGroup section */
 
 /* Begin PBXNativeTarget section */
+		4C2F0C5D2E851BBD0033F5C2 /* iOS (Share Extension) */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 4C2F0C6A2E851BBD0033F5C2 /* Build configuration list for PBXNativeTarget "iOS (Share Extension)" */;
+			buildPhases = (
+				4C2F0C5A2E851BBD0033F5C2 /* Sources */,
+				4C2F0C5B2E851BBD0033F5C2 /* Frameworks */,
+				4C2F0C5C2E851BBD0033F5C2 /* Resources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			fileSystemSynchronizedGroups = (
+				4C2F0C5F2E851BBD0033F5C2 /* iOS (Share Extension) */,
+			);
+			name = "iOS (Share Extension)";
+			packageProductDependencies = (
+			);
+			productName = "iOS (Share Extension)";
+			productReference = 4C2F0C5E2E851BBD0033F5C2 /* Save to HotPocket.appex */;
+			productType = "com.apple.product-type.app-extension";
+		};
 		4CABCAAF2E56F0C900D8A354 /* HotPocket (iOS) */ = {
 			isa = PBXNativeTarget;
 			buildConfigurationList = 4CABCB0A2E56F0C900D8A354 /* Build configuration list for PBXNativeTarget "HotPocket (iOS)" */;
@@ -262,6 +449,7 @@
 			);
 			dependencies = (
 				4CABCAD82E56F0C900D8A354 /* PBXTargetDependency */,
+				4C2F0C682E851BBD0033F5C2 /* PBXTargetDependency */,
 			);
 			fileSystemSynchronizedGroups = (
 				4CABCAB22E56F0C900D8A354 /* iOS (App) */,
@@ -270,7 +458,7 @@
 			packageProductDependencies = (
 			);
 			productName = "HotPocket (iOS)";
-			productReference = 4CABCAB02E56F0C900D8A354 /* HotPocket.app */;
+			productReference = 4CABCAB02E56F0C900D8A354 /* HotPocket Development.app */;
 			productType = "com.apple.product-type.application";
 		};
 		4CABCAC52E56F0C900D8A354 /* HotPocket (macOS) */ = {
@@ -286,6 +474,7 @@
 			);
 			dependencies = (
 				4CABCAE22E56F0C900D8A354 /* PBXTargetDependency */,
+				4C1159222E8B055F003B34AD /* PBXTargetDependency */,
 			);
 			fileSystemSynchronizedGroups = (
 				4CABCAC72E56F0C900D8A354 /* macOS (App) */,
@@ -294,7 +483,7 @@
 			packageProductDependencies = (
 			);
 			productName = "HotPocket (macOS)";
-			productReference = 4CABCAC62E56F0C900D8A354 /* HotPocket.app */;
+			productReference = 4CABCAC62E56F0C900D8A354 /* HotPocket Development.app */;
 			productType = "com.apple.product-type.application";
 		};
 		4CABCAD42E56F0C900D8A354 /* HotPocket Extension (iOS) */ = {
@@ -341,6 +530,28 @@
 			productReference = 4CABCADF2E56F0C900D8A354 /* HotPocket Extension.appex */;
 			productType = "com.apple.product-type.app-extension";
 		};
+		4CBCEA4E2E81CB9500722009 /* macOS (Share Extension) */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 4CBCEA602E81CB9500722009 /* Build configuration list for PBXNativeTarget "macOS (Share Extension)" */;
+			buildPhases = (
+				4CBCEA4B2E81CB9500722009 /* Sources */,
+				4CBCEA4C2E81CB9500722009 /* Frameworks */,
+				4CBCEA4D2E81CB9500722009 /* Resources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			fileSystemSynchronizedGroups = (
+				4CBCEA502E81CB9500722009 /* macOS (Share Extension) */,
+			);
+			name = "macOS (Share Extension)";
+			packageProductDependencies = (
+			);
+			productName = "macOS (Share Extension)";
+			productReference = 4CBCEA4F2E81CB9500722009 /* Save to HotPocket.appex */;
+			productType = "com.apple.product-type.app-extension";
+		};
 /* End PBXNativeTarget section */
 
 /* Begin PBXProject section */
@@ -350,6 +561,9 @@
 				BuildIndependentTargetsInParallel = 1;
 				LastUpgradeCheck = 1640;
 				TargetAttributes = {
+					4C2F0C5D2E851BBD0033F5C2 = {
+						CreatedOnToolsVersion = 26.0;
+					};
 					4CABCAAF2E56F0C900D8A354 = {
 						CreatedOnToolsVersion = 16.4;
 					};
@@ -362,6 +576,9 @@
 					4CABCADE2E56F0C900D8A354 = {
 						CreatedOnToolsVersion = 16.4;
 					};
+					4CBCEA4E2E81CB9500722009 = {
+						CreatedOnToolsVersion = 16.4;
+					};
 				};
 			};
 			buildConfigurationList = 4CABCA952E56F0C800D8A354 /* Build configuration list for PBXProject "HotPocket" */;
@@ -382,11 +599,20 @@
 				4CABCAC52E56F0C900D8A354 /* HotPocket (macOS) */,
 				4CABCAD42E56F0C900D8A354 /* HotPocket Extension (iOS) */,
 				4CABCADE2E56F0C900D8A354 /* HotPocket Extension (macOS) */,
+				4CBCEA4E2E81CB9500722009 /* macOS (Share Extension) */,
+				4C2F0C5D2E851BBD0033F5C2 /* iOS (Share Extension) */,
 			);
 		};
 /* End PBXProject section */
 
 /* Begin PBXResourcesBuildPhase section */
+		4C2F0C5C2E851BBD0033F5C2 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		4CABCAAE2E56F0C900D8A354 /* Resources */ = {
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
@@ -415,9 +641,26 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		4CBCEA4D2E81CB9500722009 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 /* End PBXResourcesBuildPhase section */
 
 /* Begin PBXSourcesBuildPhase section */
+		4C2F0C5A2E851BBD0033F5C2 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				4C70F30E2E8869FB00320048 /* HPShareExtensionHelper.m in Sources */,
+				4C70F3152E886A8F00320048 /* HPSharedItem.m in Sources */,
+				4C70F3192E886ADD00320048 /* HPSharedItemsContainer.m in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		4CABCAAC2E56F0C900D8A354 /* Sources */ = {
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
@@ -446,9 +689,29 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		4CBCEA4B2E81CB9500722009 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				4C70F3162E886A8F00320048 /* HPSharedItem.m in Sources */,
+				4C70F30D2E8869FB00320048 /* HPShareExtensionHelper.m in Sources */,
+				4C70F31A2E886ADD00320048 /* HPSharedItemsContainer.m in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 /* End PBXSourcesBuildPhase section */
 
 /* Begin PBXTargetDependency section */
+		4C1159222E8B055F003B34AD /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 4CBCEA4E2E81CB9500722009 /* macOS (Share Extension) */;
+			targetProxy = 4C1159212E8B055F003B34AD /* PBXContainerItemProxy */;
+		};
+		4C2F0C682E851BBD0033F5C2 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 4C2F0C5D2E851BBD0033F5C2 /* iOS (Share Extension) */;
+			targetProxy = 4C2F0C672E851BBD0033F5C2 /* PBXContainerItemProxy */;
+		};
 		4CABCAD82E56F0C900D8A354 /* PBXTargetDependency */ = {
 			isa = PBXTargetDependency;
 			target = 4CABCAD42E56F0C900D8A354 /* HotPocket Extension (iOS) */;
@@ -462,15 +725,84 @@
 /* End PBXTargetDependency section */
 
 /* Begin XCBuildConfiguration section */
+		4C2F0C6B2E851BBD0033F5C2 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				CODE_SIGN_ENTITLEMENTS = "iOS (Share Extension)/iOS (Share Extension).entitlements";
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = 2026082001;
+				DEVELOPMENT_TEAM = 648728X64K;
+				GENERATE_INFOPLIST_FILE = YES;
+				INFOPLIST_FILE = "iOS (Share Extension)/Info.plist";
+				INFOPLIST_KEY_CFBundleDisplayName = "Save to HotPocket";
+				INFOPLIST_KEY_ITSAppUsesNonExemptEncryption = NO;
+				INFOPLIST_KEY_NSHumanReadableCopyright = "Copyright © 2025-present BTHLabs";
+				IPHONEOS_DEPLOYMENT_TARGET = 18.0;
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/Frameworks",
+					"@executable_path/../../Frameworks",
+				);
+				MARKETING_VERSION = 26.8.20;
+				PRODUCT_BUNDLE_IDENTIFIER = pl.bthlabs.HotPocket.ShareExtension;
+				PRODUCT_NAME = "Save to HotPocket";
+				SDKROOT = iphoneos;
+				SKIP_INSTALL = YES;
+				STRING_CATALOG_GENERATE_SYMBOLS = YES;
+				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator";
+				SUPPORTS_MACCATALYST = NO;
+				SUPPORTS_MAC_DESIGNED_FOR_IPHONE_IPAD = NO;
+				SUPPORTS_XR_DESIGNED_FOR_IPHONE_IPAD = NO;
+				SWIFT_EMIT_LOC_STRINGS = YES;
+				TARGETED_DEVICE_FAMILY = "1,2";
+			};
+			name = Debug;
+		};
+		4C2F0C6C2E851BBD0033F5C2 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				CODE_SIGN_ENTITLEMENTS = "iOS (Share Extension)/iOS (Share Extension).entitlements";
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = 2026082001;
+				DEVELOPMENT_TEAM = 648728X64K;
+				GENERATE_INFOPLIST_FILE = YES;
+				INFOPLIST_FILE = "iOS (Share Extension)/Info.plist";
+				INFOPLIST_KEY_CFBundleDisplayName = "Save to HotPocket";
+				INFOPLIST_KEY_ITSAppUsesNonExemptEncryption = NO;
+				INFOPLIST_KEY_NSHumanReadableCopyright = "Copyright © 2025-present BTHLabs";
+				IPHONEOS_DEPLOYMENT_TARGET = 18.0;
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/Frameworks",
+					"@executable_path/../../Frameworks",
+				);
+				MARKETING_VERSION = 26.8.20;
+				PRODUCT_BUNDLE_IDENTIFIER = pl.bthlabs.HotPocket.ShareExtension;
+				PRODUCT_NAME = "Save to HotPocket";
+				SDKROOT = iphoneos;
+				SKIP_INSTALL = YES;
+				STRING_CATALOG_GENERATE_SYMBOLS = YES;
+				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator";
+				SUPPORTS_MACCATALYST = NO;
+				SUPPORTS_MAC_DESIGNED_FOR_IPHONE_IPAD = NO;
+				SUPPORTS_XR_DESIGNED_FOR_IPHONE_IPAD = NO;
+				SWIFT_EMIT_LOC_STRINGS = YES;
+				TARGETED_DEVICE_FAMILY = "1,2";
+				VALIDATE_PRODUCT = YES;
+			};
+			name = Release;
+		};
 		4CABCB062E56F0C900D8A354 /* Debug */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
+				ASSETCATALOG_COMPILER_APPICON_NAME = "HotPocket 27";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 2025091701;
+				CURRENT_PROJECT_VERSION = 2026082001;
 				DEVELOPMENT_TEAM = 648728X64K;
 				GENERATE_INFOPLIST_FILE = YES;
 				INFOPLIST_FILE = "iOS (Extension)/Info.plist";
 				INFOPLIST_KEY_CFBundleDisplayName = HotPocket;
+				INFOPLIST_KEY_ITSAppUsesNonExemptEncryption = NO;
 				INFOPLIST_KEY_NSHumanReadableCopyright = "";
 				IPHONEOS_DEPLOYMENT_TARGET = 18.0;
 				LD_RUNPATH_SEARCH_PATHS = (
@@ -478,7 +810,7 @@
 					"@executable_path/Frameworks",
 					"@executable_path/../../Frameworks",
 				);
-				MARKETING_VERSION = 25.9.17;
+				MARKETING_VERSION = 26.8.20;
 				OTHER_LDFLAGS = (
 					"-framework",
 					SafariServices,
@@ -487,6 +819,10 @@
 				PRODUCT_NAME = "HotPocket Extension";
 				SDKROOT = iphoneos;
 				SKIP_INSTALL = YES;
+				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator";
+				SUPPORTS_MACCATALYST = NO;
+				SUPPORTS_MAC_DESIGNED_FOR_IPHONE_IPAD = NO;
+				SUPPORTS_XR_DESIGNED_FOR_IPHONE_IPAD = NO;
 				SWIFT_EMIT_LOC_STRINGS = YES;
 				TARGETED_DEVICE_FAMILY = "1,2";
 			};
@@ -495,12 +831,14 @@
 		4CABCB072E56F0C900D8A354 /* Release */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
+				ASSETCATALOG_COMPILER_APPICON_NAME = "HotPocket 27";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 2025091701;
+				CURRENT_PROJECT_VERSION = 2026082001;
 				DEVELOPMENT_TEAM = 648728X64K;
 				GENERATE_INFOPLIST_FILE = YES;
 				INFOPLIST_FILE = "iOS (Extension)/Info.plist";
 				INFOPLIST_KEY_CFBundleDisplayName = HotPocket;
+				INFOPLIST_KEY_ITSAppUsesNonExemptEncryption = NO;
 				INFOPLIST_KEY_NSHumanReadableCopyright = "";
 				IPHONEOS_DEPLOYMENT_TARGET = 18.0;
 				LD_RUNPATH_SEARCH_PATHS = (
@@ -508,7 +846,7 @@
 					"@executable_path/Frameworks",
 					"@executable_path/../../Frameworks",
 				);
-				MARKETING_VERSION = 25.9.17;
+				MARKETING_VERSION = 26.8.20;
 				OTHER_LDFLAGS = (
 					"-framework",
 					SafariServices,
@@ -517,6 +855,10 @@
 				PRODUCT_NAME = "HotPocket Extension";
 				SDKROOT = iphoneos;
 				SKIP_INSTALL = YES;
+				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator";
+				SUPPORTS_MACCATALYST = NO;
+				SUPPORTS_MAC_DESIGNED_FOR_IPHONE_IPAD = NO;
+				SUPPORTS_XR_DESIGNED_FOR_IPHONE_IPAD = NO;
 				SWIFT_EMIT_LOC_STRINGS = YES;
 				TARGETED_DEVICE_FAMILY = "1,2";
 				VALIDATE_PRODUCT = YES;
@@ -526,26 +868,31 @@
 		4CABCB0B2E56F0C900D8A354 /* Debug */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
-				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+				ASSETCATALOG_COMPILER_APPICON_NAME = "HotPocket 27";
 				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
+				CODE_SIGN_ENTITLEMENTS = "iOS (App)/HotPocket (iOS).entitlements";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 2025091701;
+				CURRENT_PROJECT_VERSION = 2026082001;
 				DEVELOPMENT_TEAM = 648728X64K;
 				GENERATE_INFOPLIST_FILE = YES;
 				INFOPLIST_FILE = "iOS (App)/Info.plist";
 				INFOPLIST_KEY_CFBundleDisplayName = HotPocket;
+				INFOPLIST_KEY_ITSAppUsesNonExemptEncryption = NO;
 				INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.utilities";
 				INFOPLIST_KEY_NSHumanReadableCopyright = "Copyright © 2025-present BTHLabs";
 				INFOPLIST_KEY_UIApplicationSupportsIndirectInputEvents = YES;
 				INFOPLIST_KEY_UILaunchStoryboardName = LaunchScreen;
 				INFOPLIST_KEY_UIMainStoryboardFile = Main;
-				INFOPLIST_KEY_UISupportedInterfaceOrientations = "UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight UIInterfaceOrientationPortrait UIInterfaceOrientationPortraitUpsideDown";
+				INFOPLIST_KEY_UIRequiresFullScreen = YES;
+				INFOPLIST_KEY_UIStatusBarStyle = UIStatusBarStyleLightContent;
+				INFOPLIST_KEY_UISupportedInterfaceOrientations = UIInterfaceOrientationPortrait;
+				INFOPLIST_KEY_UISupportedInterfaceOrientations_iPad = "UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight UIInterfaceOrientationPortrait UIInterfaceOrientationPortraitUpsideDown";
 				IPHONEOS_DEPLOYMENT_TARGET = 18.0;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 25.9.17;
+				MARKETING_VERSION = 26.8.20;
 				OTHER_LDFLAGS = (
 					"-framework",
 					SafariServices,
@@ -553,7 +900,7 @@
 					WebKit,
 				);
 				PRODUCT_BUNDLE_IDENTIFIER = pl.bthlabs.HotPocket;
-				PRODUCT_NAME = HotPocket;
+				PRODUCT_NAME = "HotPocket Development";
 				SDKROOT = iphoneos;
 				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator";
 				SUPPORTS_MACCATALYST = NO;
@@ -567,26 +914,31 @@
 		4CABCB0C2E56F0C900D8A354 /* Release */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
-				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+				ASSETCATALOG_COMPILER_APPICON_NAME = "HotPocket 27";
 				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
+				CODE_SIGN_ENTITLEMENTS = "iOS (App)/HotPocket (iOS).entitlements";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 2025091701;
+				CURRENT_PROJECT_VERSION = 2026082001;
 				DEVELOPMENT_TEAM = 648728X64K;
 				GENERATE_INFOPLIST_FILE = YES;
 				INFOPLIST_FILE = "iOS (App)/Info.plist";
 				INFOPLIST_KEY_CFBundleDisplayName = HotPocket;
+				INFOPLIST_KEY_ITSAppUsesNonExemptEncryption = NO;
 				INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.utilities";
 				INFOPLIST_KEY_NSHumanReadableCopyright = "Copyright © 2025-present BTHLabs";
 				INFOPLIST_KEY_UIApplicationSupportsIndirectInputEvents = YES;
 				INFOPLIST_KEY_UILaunchStoryboardName = LaunchScreen;
 				INFOPLIST_KEY_UIMainStoryboardFile = Main;
-				INFOPLIST_KEY_UISupportedInterfaceOrientations = "UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight UIInterfaceOrientationPortrait UIInterfaceOrientationPortraitUpsideDown";
+				INFOPLIST_KEY_UIRequiresFullScreen = YES;
+				INFOPLIST_KEY_UIStatusBarStyle = UIStatusBarStyleLightContent;
+				INFOPLIST_KEY_UISupportedInterfaceOrientations = UIInterfaceOrientationPortrait;
+				INFOPLIST_KEY_UISupportedInterfaceOrientations_iPad = "UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight UIInterfaceOrientationPortrait UIInterfaceOrientationPortraitUpsideDown";
 				IPHONEOS_DEPLOYMENT_TARGET = 18.0;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 25.9.17;
+				MARKETING_VERSION = 26.8.20;
 				OTHER_LDFLAGS = (
 					"-framework",
 					SafariServices,
@@ -610,29 +962,31 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				CODE_SIGN_ENTITLEMENTS = "macOS (Extension)/HotPocket.entitlements";
-				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "-";
+				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 2025091701;
+				CURRENT_PROJECT_VERSION = 2026082001;
 				DEVELOPMENT_TEAM = 648728X64K;
 				ENABLE_HARDENED_RUNTIME = YES;
 				ENABLE_USER_SCRIPT_SANDBOXING = NO;
 				GENERATE_INFOPLIST_FILE = YES;
 				INFOPLIST_FILE = "macOS (Extension)/Info.plist";
 				INFOPLIST_KEY_CFBundleDisplayName = HotPocket;
+				INFOPLIST_KEY_ITSAppUsesNonExemptEncryption = NO;
 				INFOPLIST_KEY_NSHumanReadableCopyright = "";
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 					"@executable_path/../../../../Frameworks",
 				);
-				MACOSX_DEPLOYMENT_TARGET = 10.14;
+				MACOSX_DEPLOYMENT_TARGET = 15.0;
-				MARKETING_VERSION = 25.9.17;
+				MARKETING_VERSION = 26.8.20;
 				OTHER_LDFLAGS = (
 					"-framework",
 					SafariServices,
 				);
 				PRODUCT_BUNDLE_IDENTIFIER = pl.bthlabs.HotPocket.Extension;
 				PRODUCT_NAME = "HotPocket Extension";
+				REGISTER_APP_GROUPS = YES;
 				SDKROOT = macosx;
 				SKIP_INSTALL = YES;
 				SWIFT_EMIT_LOC_STRINGS = YES;
@@ -645,27 +999,29 @@
 				CODE_SIGN_ENTITLEMENTS = "macOS (Extension)/HotPocket.entitlements";
 				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 2025091701;
+				CURRENT_PROJECT_VERSION = 2026082001;
 				DEVELOPMENT_TEAM = 648728X64K;
 				ENABLE_HARDENED_RUNTIME = YES;
 				ENABLE_USER_SCRIPT_SANDBOXING = NO;
 				GENERATE_INFOPLIST_FILE = YES;
 				INFOPLIST_FILE = "macOS (Extension)/Info.plist";
 				INFOPLIST_KEY_CFBundleDisplayName = HotPocket;
+				INFOPLIST_KEY_ITSAppUsesNonExemptEncryption = NO;
 				INFOPLIST_KEY_NSHumanReadableCopyright = "";
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 					"@executable_path/../../../../Frameworks",
 				);
-				MACOSX_DEPLOYMENT_TARGET = 10.14;
+				MACOSX_DEPLOYMENT_TARGET = 15.0;
-				MARKETING_VERSION = 25.9.17;
+				MARKETING_VERSION = 26.8.20;
 				OTHER_LDFLAGS = (
 					"-framework",
 					SafariServices,
 				);
 				PRODUCT_BUNDLE_IDENTIFIER = pl.bthlabs.HotPocket.Extension;
 				PRODUCT_NAME = "HotPocket Extension";
+				REGISTER_APP_GROUPS = YES;
 				SDKROOT = macosx;
 				SKIP_INSTALL = YES;
 				SWIFT_EMIT_LOC_STRINGS = YES;
@@ -675,16 +1031,18 @@
 		4CABCB152E56F0C900D8A354 /* Debug */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
-				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+				ASSETCATALOG_COMPILER_APPICON_NAME = "HotPocket 27";
 				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
 				CODE_SIGN_ENTITLEMENTS = "macOS (App)/HotPocket.entitlements";
-				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "-";
+				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 2025091701;
+				CURRENT_PROJECT_VERSION = 2026082001;
 				DEVELOPMENT_TEAM = 648728X64K;
 				ENABLE_HARDENED_RUNTIME = YES;
 				GENERATE_INFOPLIST_FILE = YES;
+				INFOPLIST_FILE = "macOS (App)/Info.plist";
 				INFOPLIST_KEY_CFBundleDisplayName = HotPocket;
+				INFOPLIST_KEY_ITSAppUsesNonExemptEncryption = NO;
 				INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.utilities";
 				INFOPLIST_KEY_NSHumanReadableCopyright = "Copyright © 2025-present BTHLabs";
 				INFOPLIST_KEY_NSMainStoryboardFile = Main;
@@ -694,7 +1052,7 @@
 					"@executable_path/../Frameworks",
 				);
 				MACOSX_DEPLOYMENT_TARGET = 15.0;
-				MARKETING_VERSION = 25.9.17;
+				MARKETING_VERSION = 26.8.20;
 				OTHER_LDFLAGS = (
 					"-framework",
 					SafariServices,
@@ -702,7 +1060,7 @@
 					WebKit,
 				);
 				PRODUCT_BUNDLE_IDENTIFIER = pl.bthlabs.HotPocket;
-				PRODUCT_NAME = HotPocket;
+				PRODUCT_NAME = "HotPocket Development";
 				REGISTER_APP_GROUPS = YES;
 				SDKROOT = macosx;
 				SWIFT_EMIT_LOC_STRINGS = YES;
@@ -712,16 +1070,18 @@
 		4CABCB162E56F0C900D8A354 /* Release */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
-				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+				ASSETCATALOG_COMPILER_APPICON_NAME = "HotPocket 27";
 				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
 				CODE_SIGN_ENTITLEMENTS = "macOS (App)/HotPocket.entitlements";
 				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 2025091701;
+				CURRENT_PROJECT_VERSION = 2026082001;
 				DEVELOPMENT_TEAM = 648728X64K;
 				ENABLE_HARDENED_RUNTIME = YES;
 				GENERATE_INFOPLIST_FILE = YES;
+				INFOPLIST_FILE = "macOS (App)/Info.plist";
 				INFOPLIST_KEY_CFBundleDisplayName = HotPocket;
+				INFOPLIST_KEY_ITSAppUsesNonExemptEncryption = NO;
 				INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.utilities";
 				INFOPLIST_KEY_NSHumanReadableCopyright = "Copyright © 2025-present BTHLabs";
 				INFOPLIST_KEY_NSMainStoryboardFile = Main;
@@ -731,7 +1091,7 @@
 					"@executable_path/../Frameworks",
 				);
 				MACOSX_DEPLOYMENT_TARGET = 15.0;
-				MARKETING_VERSION = 25.9.17;
+				MARKETING_VERSION = 26.8.20;
 				OTHER_LDFLAGS = (
 					"-framework",
 					SafariServices,
@@ -859,9 +1219,78 @@
 			};
 			name = Release;
 		};
+		4CBCEA5E2E81CB9500722009 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				CODE_SIGN_ENTITLEMENTS = "macOS (Share Extension)/macOS (Share Extension).entitlements";
+				CODE_SIGN_STYLE = Automatic;
+				COMBINE_HIDPI_IMAGES = YES;
+				CURRENT_PROJECT_VERSION = 2026082001;
+				DEVELOPMENT_TEAM = 648728X64K;
+				ENABLE_HARDENED_RUNTIME = YES;
+				GENERATE_INFOPLIST_FILE = YES;
+				INFOPLIST_FILE = "macOS (Share Extension)/Info.plist";
+				INFOPLIST_KEY_CFBundleDisplayName = "Save to HotPocket";
+				INFOPLIST_KEY_ITSAppUsesNonExemptEncryption = NO;
+				INFOPLIST_KEY_NSHumanReadableCopyright = "Copyright © 2025-present BTHLabs";
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/../Frameworks",
+					"@executable_path/../../../../Frameworks",
+				);
+				MACOSX_DEPLOYMENT_TARGET = 15.0;
+				MARKETING_VERSION = 26.8.20;
+				PRODUCT_BUNDLE_IDENTIFIER = pl.bthlabs.HotPocket.ShareExtension;
+				PRODUCT_NAME = "Save to HotPocket";
+				REGISTER_APP_GROUPS = YES;
+				SDKROOT = macosx;
+				SKIP_INSTALL = YES;
+				SWIFT_EMIT_LOC_STRINGS = YES;
+			};
+			name = Debug;
+		};
+		4CBCEA5F2E81CB9500722009 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				CODE_SIGN_ENTITLEMENTS = "macOS (Share Extension)/macOS (Share Extension).entitlements";
+				CODE_SIGN_STYLE = Automatic;
+				COMBINE_HIDPI_IMAGES = YES;
+				CURRENT_PROJECT_VERSION = 2026082001;
+				DEVELOPMENT_TEAM = 648728X64K;
+				ENABLE_HARDENED_RUNTIME = YES;
+				GENERATE_INFOPLIST_FILE = YES;
+				INFOPLIST_FILE = "macOS (Share Extension)/Info.plist";
+				INFOPLIST_KEY_CFBundleDisplayName = "Save to HotPocket";
+				INFOPLIST_KEY_ITSAppUsesNonExemptEncryption = NO;
+				INFOPLIST_KEY_NSHumanReadableCopyright = "Copyright © 2025-present BTHLabs";
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/../Frameworks",
+					"@executable_path/../../../../Frameworks",
+				);
+				MACOSX_DEPLOYMENT_TARGET = 15.0;
+				MARKETING_VERSION = 26.8.20;
+				PRODUCT_BUNDLE_IDENTIFIER = pl.bthlabs.HotPocket.ShareExtension;
+				PRODUCT_NAME = "Save to HotPocket";
+				REGISTER_APP_GROUPS = YES;
+				SDKROOT = macosx;
+				SKIP_INSTALL = YES;
+				SWIFT_EMIT_LOC_STRINGS = YES;
+			};
+			name = Release;
+		};
 /* End XCBuildConfiguration section */
 
 /* Begin XCConfigurationList section */
+		4C2F0C6A2E851BBD0033F5C2 /* Build configuration list for PBXNativeTarget "iOS (Share Extension)" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				4C2F0C6B2E851BBD0033F5C2 /* Debug */,
+				4C2F0C6C2E851BBD0033F5C2 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
 		4CABCA952E56F0C800D8A354 /* Build configuration list for PBXProject "HotPocket" */ = {
 			isa = XCConfigurationList;
 			buildConfigurations = (
@@ -907,6 +1336,15 @@
 			defaultConfigurationIsVisible = 0;
 			defaultConfigurationName = Release;
 		};
+		4CBCEA602E81CB9500722009 /* Build configuration list for PBXNativeTarget "macOS (Share Extension)" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				4CBCEA5E2E81CB9500722009 /* Debug */,
+				4CBCEA5F2E81CB9500722009 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
 /* End XCConfigurationList section */
 	};
 	rootObject = 4CABCA922E56F0C800D8A354 /* Project object */;

services/apple/HotPocket.xcodeproj/xcshareddata/xcschemes/HotPocket (iOS).xcscheme

@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "2600"
+   version = "1.7">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES"
+      buildArchitectures = "Automatic">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "4CABCAAF2E56F0C900D8A354"
+               BuildableName = "HotPocket.app"
+               BlueprintName = "HotPocket (iOS)"
+               ReferencedContainer = "container:HotPocket.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      shouldAutocreateTestPlan = "YES">
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "4CABCAAF2E56F0C900D8A354"
+            BuildableName = "HotPocket.app"
+            BlueprintName = "HotPocket (iOS)"
+            ReferencedContainer = "container:HotPocket.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "4CABCAAF2E56F0C900D8A354"
+            BuildableName = "HotPocket.app"
+            BlueprintName = "HotPocket (iOS)"
+            ReferencedContainer = "container:HotPocket.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

services/apple/HotPocket.xcodeproj/xcshareddata/xcschemes/HotPocket (macOS).xcscheme

@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "2600"
+   version = "1.7">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES"
+      buildArchitectures = "Automatic">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "4CABCAC52E56F0C900D8A354"
+               BuildableName = "HotPocket.app"
+               BlueprintName = "HotPocket (macOS)"
+               ReferencedContainer = "container:HotPocket.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      shouldAutocreateTestPlan = "YES">
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "4CABCAC52E56F0C900D8A354"
+            BuildableName = "HotPocket.app"
+            BlueprintName = "HotPocket (macOS)"
+            ReferencedContainer = "container:HotPocket.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "4CABCAC52E56F0C900D8A354"
+            BuildableName = "HotPocket.app"
+            BlueprintName = "HotPocket (macOS)"
+            ReferencedContainer = "container:HotPocket.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

services/apple/HotPocket.xcodeproj/xcshareddata/xcschemes/HotPocket Extension (iOS).xcscheme

@@ -0,0 +1,97 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "2600"
+   wasCreatedForAppExtension = "YES"
+   version = "2.0">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES"
+      buildArchitectures = "Automatic">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "4CABCAD42E56F0C900D8A354"
+               BuildableName = "HotPocket Extension.appex"
+               BlueprintName = "HotPocket Extension (iOS)"
+               ReferencedContainer = "container:HotPocket.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "4CABCAAF2E56F0C900D8A354"
+               BuildableName = "HotPocket.app"
+               BlueprintName = "HotPocket (iOS)"
+               ReferencedContainer = "container:HotPocket.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      shouldAutocreateTestPlan = "YES">
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = ""
+      selectedLauncherIdentifier = "Xcode.IDEFoundation.Launcher.PosixSpawn"
+      launchStyle = "0"
+      askForAppToLaunch = "Yes"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES"
+      launchAutomaticallySubstyle = "2">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "4CABCAAF2E56F0C900D8A354"
+            BuildableName = "HotPocket.app"
+            BlueprintName = "HotPocket (iOS)"
+            ReferencedContainer = "container:HotPocket.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES"
+      askForAppToLaunch = "Yes"
+      launchAutomaticallySubstyle = "2">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "4CABCAAF2E56F0C900D8A354"
+            BuildableName = "HotPocket.app"
+            BlueprintName = "HotPocket (iOS)"
+            ReferencedContainer = "container:HotPocket.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

services/apple/HotPocket.xcodeproj/xcshareddata/xcschemes/HotPocket Extension (macOS).xcscheme

@@ -0,0 +1,97 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "2600"
+   wasCreatedForAppExtension = "YES"
+   version = "2.0">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES"
+      buildArchitectures = "Automatic">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "4CABCADE2E56F0C900D8A354"
+               BuildableName = "HotPocket Extension.appex"
+               BlueprintName = "HotPocket Extension (macOS)"
+               ReferencedContainer = "container:HotPocket.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "4CABCAC52E56F0C900D8A354"
+               BuildableName = "HotPocket.app"
+               BlueprintName = "HotPocket (macOS)"
+               ReferencedContainer = "container:HotPocket.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      shouldAutocreateTestPlan = "YES">
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = ""
+      selectedLauncherIdentifier = "Xcode.IDEFoundation.Launcher.PosixSpawn"
+      launchStyle = "0"
+      askForAppToLaunch = "Yes"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES"
+      launchAutomaticallySubstyle = "2">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "4CABCAC52E56F0C900D8A354"
+            BuildableName = "HotPocket.app"
+            BlueprintName = "HotPocket (macOS)"
+            ReferencedContainer = "container:HotPocket.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES"
+      askForAppToLaunch = "Yes"
+      launchAutomaticallySubstyle = "2">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "4CABCAC52E56F0C900D8A354"
+            BuildableName = "HotPocket.app"
+            BlueprintName = "HotPocket (macOS)"
+            ReferencedContainer = "container:HotPocket.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

services/apple/HotPocket.xcodeproj/xcshareddata/xcschemes/macOS (Share Extension).xcscheme

@@ -0,0 +1,97 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "2600"
+   wasCreatedForAppExtension = "YES"
+   version = "2.0">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES"
+      buildArchitectures = "Automatic">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "4CBCEA4E2E81CB9500722009"
+               BuildableName = "Save to HotPocket.appex"
+               BlueprintName = "macOS (Share Extension)"
+               ReferencedContainer = "container:HotPocket.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "4CABCAC52E56F0C900D8A354"
+               BuildableName = "HotPocket.app"
+               BlueprintName = "HotPocket (macOS)"
+               ReferencedContainer = "container:HotPocket.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      shouldAutocreateTestPlan = "YES">
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = ""
+      selectedLauncherIdentifier = "Xcode.IDEFoundation.Launcher.PosixSpawn"
+      launchStyle = "0"
+      askForAppToLaunch = "Yes"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES"
+      launchAutomaticallySubstyle = "2">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "4CABCAC52E56F0C900D8A354"
+            BuildableName = "HotPocket.app"
+            BlueprintName = "HotPocket (macOS)"
+            ReferencedContainer = "container:HotPocket.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES"
+      askForAppToLaunch = "Yes"
+      launchAutomaticallySubstyle = "2">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "4CABCAC52E56F0C900D8A354"
+            BuildableName = "HotPocket.app"
+            BlueprintName = "HotPocket (macOS)"
+            ReferencedContainer = "container:HotPocket.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

services/apple/Shared (App)/Assets.xcassets/AppIcon.appiconset/Contents.json

@@ -1,7 +1,7 @@
 {
   "images" : [
     {
-      "filename" : "icon-1024.png",
+      "filename" : "icon-ios-light.png",
       "idiom" : "universal",
       "platform" : "ios",
       "size" : "1024x1024"
@@ -13,7 +13,7 @@
           "value" : "dark"
         }
       ],
-      "filename" : "icon-1024 1.png",
+      "filename" : "icon-ios-dark.png",
       "idiom" : "universal",
       "platform" : "ios",
       "size" : "1024x1024"
@@ -25,31 +25,31 @@
           "value" : "tinted"
         }
       ],
-      "filename" : "icon-1024 2.png",
+      "filename" : "icon-ios-tinted.png",
       "idiom" : "universal",
       "platform" : "ios",
       "size" : "1024x1024"
     },
     {
-      "filename" : "icon-16.png",
+      "filename" : "icon-mac-16.png",
       "idiom" : "mac",
       "scale" : "1x",
       "size" : "16x16"
     },
     {
-      "filename" : "icon-32.png",
+      "filename" : "icon-mac-32.png",
       "idiom" : "mac",
       "scale" : "2x",
       "size" : "16x16"
     },
     {
-      "filename" : "icon-32 1.png",
+      "filename" : "icon-mac-32 1.png",
       "idiom" : "mac",
       "scale" : "1x",
       "size" : "32x32"
     },
     {
-      "filename" : "icon-64.png",
+      "filename" : "icon-mac-64.png",
       "idiom" : "mac",
       "scale" : "2x",
       "size" : "32x32"

services/apple/Shared (App)/Assets.xcassets/DangerColor.colorset/Contents.json

@@ -0,0 +1,20 @@
+{
+  "colors" : [
+    {
+      "color" : {
+        "color-space" : "srgb",
+        "components" : {
+          "alpha" : "1.000",
+          "blue" : "0x76",
+          "green" : "0x64",
+          "red" : "0xEE"
+        }
+      },
+      "idiom" : "universal"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}

services/apple/Shared (App)/Assets.xcassets/SuccessColor.colorset/Contents.json

@@ -0,0 +1,20 @@
+{
+  "colors" : [
+    {
+      "color" : {
+        "color-space" : "srgb",
+        "components" : {
+          "alpha" : "1.000",
+          "blue" : "0x67",
+          "green" : "0xA7",
+          "red" : "0x0E"
+        }
+      },
+      "idiom" : "universal"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}

services/apple/Shared (App)/Assets.xcassets/WarningColor.colorset/Contents.json

@@ -0,0 +1,20 @@
+{
+  "colors" : [
+    {
+      "color" : {
+        "color-space" : "srgb",
+        "components" : {
+          "alpha" : "1.000",
+          "blue" : "0x2E",
+          "green" : "0x96",
+          "red" : "0xF1"
+        }
+      },
+      "idiom" : "universal"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}

services/apple/Shared (App)/HPAPI.h

@@ -0,0 +1,32 @@
+//
+//  HPAPI.h
+//  HotPocket
+//
+//  Created by Tomek Wójcik on 23/09/2025.
+//
+
+#import <Foundation/Foundation.h>
+
+#import "HPRPCClient.h"
+
+NS_ASSUME_NONNULL_BEGIN
+
+typedef void (^HPAPICheckAuthCompletionHandler)(BOOL authValid, NSError * _Nullable error, NSString * _Nullable callId);
+
+@interface HPAPI : NSObject
+
+@property (nullable) HPRPCClient *rpcClient;
+@property NSMutableSet *callIds;
+
+-(id)initWithRPCClientDelegate:(id<HPRPCClientDelegate>)delegate;
+
++(NSDictionary *)getAccessTokenMeta;
+
+-(NSString *)checkAuth;
+-(void)checkAuth:(HPAPICheckAuthCompletionHandler)completionHandler;
+-(NSString *)save:(NSURL *)url;
+-(BOOL)save:(NSURL *)url completionHandler:(HPRPCClientCompletionHandler)completionHandler;
+
+@end
+
+NS_ASSUME_NONNULL_END

services/apple/Shared (App)/HPAPI.m

@@ -0,0 +1,145 @@
+//
+//  HPAPI.m
+//  HotPocket
+//
+//  Created by Tomek Wójcik on 23/09/2025.
+//
+
+#import "HPAPI.h"
+
+#import "HPCredentialsHelper.h"
+#import "HPRPCClient.h"
+
+@implementation HPAPI (HPAPIPrivate)
+
+#pragma mark - Private interface
+
+-(void)updateRPCClientCredentials {
+    HPCredentials *credentials = [[HPCredentialsHelper sharedHelper] getCredentials];
+    self.rpcClient.baseURL = credentials.rpcURL;
+    self.rpcClient.accessToken = credentials.accessToken;
+}
+
+@end
+
+@implementation HPAPI
+
+#pragma mark - Initialization
+
+-(id)init {
+    if (self = [super init]) {
+        self.rpcClient = [[HPRPCClient alloc] initWithBaseURL:nil accessToken:nil];
+
+        [self updateRPCClientCredentials];
+        
+        [[NSNotificationCenter defaultCenter] addObserver:self
+                                                 selector:@selector(onCredentialsChanged:)
+                                                     name:@"HPCredentialsChanged"
+                                                   object:nil];
+    }
+    
+    return self;
+}
+
+-(id)initWithRPCClientDelegate:(id<HPRPCClientDelegate>)rpcClientDelegate {
+    if (self = [self init]) {
+        self.rpcClient.delegate = rpcClientDelegate;
+    }
+    
+    return self;
+}
+
+-(void)dealloc {
+    [[NSNotificationCenter defaultCenter] removeObserver:self];
+}
+
+#pragma mark - Public interface
+
++(NSDictionary *)getAccessTokenMeta {
+    NSBundle *mainBundle = [NSBundle mainBundle];
+    
+    return @{
+        @"version": [mainBundle.infoDictionary valueForKey:@"CFBundleShortVersionString"],
+        @"platform": [mainBundle.infoDictionary valueForKey:@"HPAPIAccessTokenPlatform"],
+    };
+}
+
+-(NSString *)checkAuth {
+    if (self.rpcClient.hasCredentials == NO) {
+        return nil;
+    }
+    
+    NSString *callId = [[NSUUID UUID] UUIDString];
+
+    BOOL callResult = [self.rpcClient call:callId
+                                    method:@"accounts.auth.check_access_token"
+                                    params:@[self.rpcClient.accessToken, [HPAPI getAccessTokenMeta]]
+                                 endopoint:@"/accounts/rpc/"];
+    if (callResult == NO) {
+        return nil;
+    }
+    
+    return callId;
+}
+
+-(void)checkAuth:(HPAPICheckAuthCompletionHandler)completionHandler {
+    if (self.rpcClient.hasCredentials == NO) {
+        completionHandler(NO, nil, nil);
+    } else {
+        NSString *callId = [[NSUUID UUID] UUIDString];
+        BOOL callResult = [self.rpcClient call:callId
+                                        method:@"accounts.auth.check_access_token"
+                                        params:@[self.rpcClient.accessToken, [HPAPI getAccessTokenMeta]]
+                                     endopoint:@"/accounts/rpc/" completionHandler:^(NSString *finalCallId, HPRPCCallResult *result) {
+            BOOL authValid = YES;
+            if (result.error != nil) {
+                authValid = NO;
+            } else if ([(NSNumber *)result.result boolValue] == NO) {
+                authValid = NO;
+            }
+            
+            completionHandler(authValid, result.error, finalCallId);
+        }];
+    }
+}
+
+-(NSString *)save:(NSURL *)url {
+    if (self.rpcClient.hasCredentials == NO) {
+        return nil;
+    }
+    
+    if (url == nil) {
+        return nil;
+    }
+    
+    NSString *callId = [[NSUUID UUID] UUIDString];
+    BOOL callResult = [self.rpcClient call:callId method:@"saves.create" params:@[[url absoluteString]]];
+    if (callResult == NO) {
+        return nil;
+    }
+    
+    return callId;
+}
+
+-(BOOL)save:(NSURL *)url completionHandler:(HPRPCClientCompletionHandler)completionHandler {
+    if (self.rpcClient.hasCredentials == NO) {
+        return NO;
+    }
+    
+    if (url == nil) {
+        return NO;
+    }
+    
+    NSString *callId = [[NSUUID UUID] UUIDString];
+    return [self.rpcClient call:callId
+                         method:@"saves.create"
+                         params:@[[url absoluteString]]
+              completionHandler:completionHandler];
+}
+
+#pragma mark - Notification handlers
+
+-(void)onCredentialsChanged:(NSNotification *)notification {
+    [self updateRPCClientCredentials];
+}
+@end

services/apple/Shared (App)/HPAuthFlow.h

@@ -0,0 +1,30 @@
+//
+//  HPAuthFlow.h
+//  HotPocket (macOS)
+//
+//  Created by Tomek Wójcik on 21/09/2025.
+//
+
+#import <Foundation/Foundation.h>
+
+NS_ASSUME_NONNULL_BEGIN
+
+@interface HPAuthParams : NSObject
+
+@property (copy) NSString *authKey;
+@property (copy) NSString *sessionToken;
+
+@end
+
+@interface HPAuthFlow : NSObject
+
+@property (nullable) NSURL *baseURL;
+@property (nullable) NSString *sessionToken;
+
+-(NSURL *)start;
+-(HPAuthParams *)handlePostAuthenticateURL:(NSURL *)url;
+-(BOOL)handleAuthParams:(HPAuthParams *)authParams;
+
+@end
+
+NS_ASSUME_NONNULL_END

services/apple/Shared (App)/HPAuthFlow.m

@@ -0,0 +1,144 @@
+//
+//  HPAuthFlow.m
+//  HotPocket (macOS)
+//
+//  Created by Tomek Wójcik on 21/09/2025.
+//
+
+#import "HPAuthFlow.h"
+
+#import "HPAPI.h"
+#import "HPCredentialsHelper.h"
+#import "HPRPCClient.h"
+#import "NSBundle+HotPocketExtensions.h"
+#import "NSURL+HotPocketExtensions.h"
+
+@implementation HPAuthParams
+
+#pragma mark - HPAuthParams implementation
+
+@end
+
+@implementation HPAuthFlow (HPAuthFlowPrivate)
+
+#pragma mark - HPAuthFlow private interface
+
+-(NSURL *)resolveAuthenticateURL {
+    if (self.baseURL == nil) {
+        return nil;
+    }
+    
+    if (self.baseURL.isUsableInHotPocket == NO) {
+        return nil;
+    }
+    
+    NSBundle *mainBundle = [NSBundle mainBundle];
+    
+    NSURLComponents *authURLComponents = [NSURLComponents componentsWithURL:self.baseURL resolvingAgainstBaseURL:NO];
+    authURLComponents.path = @"/integrations/extension/authenticate/";
+    authURLComponents.queryItems = @[
+        [NSURLQueryItem queryItemWithName:@"source" value:[[mainBundle infoDictionary] valueForKey:@"HPAuthFlowSource"]],
+        [NSURLQueryItem queryItemWithName:@"session_token" value:self.sessionToken],
+    ];
+    
+    return authURLComponents.URL;
+}
+
+@end
+
+@implementation HPAuthFlow
+
+#pragma mark - Initialization
+
+-(id)init {
+    if (self = [super init]) {
+        self.baseURL = nil;
+        self.sessionToken = nil;
+    }
+    
+    return self;
+}
+
+#pragma mark - Public interface
+
+-(NSURL *)start {
+    if (self.baseURL == nil) {
+        return nil;
+    }
+    
+    if (self.sessionToken == nil) {
+        self.sessionToken = [[NSUUID UUID] UUIDString];
+    }
+    
+    return [self resolveAuthenticateURL];
+}
+
+-(HPAuthParams *)handlePostAuthenticateURL:(NSURL *)url {
+    if (url == nil) {
+        return nil;
+    }
+    
+    NSString *expectedScheme = [NSBundle postAuthenticateURLScheme];
+    NSString *expectedHost = [NSBundle postAuthenticateURLHost];
+    if (expectedScheme == nil || expectedHost == nil) {
+        return nil;
+    }
+    
+    NSURLComponents *urlComponents = [NSURLComponents componentsWithURL:url resolvingAgainstBaseURL:NO];
+    
+    if ([urlComponents.scheme isEqualToString:expectedScheme] == NO) {
+        return nil;
+    }
+    
+    if ([urlComponents.host isEqualToString:expectedHost] == NO) {
+        return nil;
+    }
+    
+    HPAuthParams *result = [[HPAuthParams alloc] init];
+    for (NSURLQueryItem *queryItem in urlComponents.queryItems) {
+        if ([queryItem.name isEqualToString:@"auth_key"] == YES) {
+            result.authKey = queryItem.value;
+        } else if ([queryItem.name isEqualToString:@"session_token"] == YES) {
+            result.sessionToken = queryItem.value;
+        }
+    }
+    
+    if ([self.sessionToken isEqualToString:result.sessionToken] == NO) {
+        return nil;
+    }
+
+    return result;
+}
+
+-(BOOL)handleAuthParams:(HPAuthParams *)authParams {
+    [[NSNotificationCenter defaultCenter] postNotificationName:@"AuthFlowDidReceiveAuthParams" object:self];
+
+    HPRPCClient *rpcClient = [[HPRPCClient alloc] initWithBaseURL:self.baseURL accessToken:nil];
+    
+    NSArray *callParams = @[
+        authParams.authKey,
+        [HPAPI getAccessTokenMeta],
+    ];
+    
+    BOOL callResult = [rpcClient call:self.sessionToken
+                               method:@"accounts.access_tokens.create"
+                               params:callParams endopoint:@"/accounts/rpc/"
+                    completionHandler:^(NSString *callId, HPRPCCallResult *result) {
+        dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(1 * NSEC_PER_SEC)), dispatch_get_main_queue(), ^{
+            if (result.error != nil) {
+                NSLog(@"-[HPAuthFlow handleAuthParams:] error=`%@`", result.error);
+            } else {
+                HPCredentialsHelper *credentialsHelper = [HPCredentialsHelper sharedHelper];
+                [credentialsHelper saveCredentials:[self.baseURL absoluteString] accessToken:(NSString *)result.result];
+            }
+            
+            self.sessionToken = nil;
+            
+            [[NSNotificationCenter defaultCenter] postNotificationName:@"AuthFlowDidFinish" object:self];
+        });
+    }];
+    
+    return callResult;
+}
+
+@end

services/apple/Shared (App)/HPCredentialsHelper.h

@@ -0,0 +1,32 @@
+//
+//  HPCredentialsHelper.h
+//  HotPocket
+//
+//  Created by Tomek Wójcik on 19/09/2025.
+//
+
+#import <Foundation/Foundation.h>
+
+NS_ASSUME_NONNULL_BEGIN
+
+@interface HPCredentials : NSObject
+
+@property (nullable) NSString *baseURL;
+@property (nullable) NSString *accessToken;
+
+@property (readonly) BOOL usable;
+@property (readonly) NSURL *rpcURL;
+
+@end
+
+@interface HPCredentialsHelper : NSObject
+
++(instancetype)sharedHelper;
+
+-(HPCredentials *)getCredentials;
+-(BOOL)saveCredentials:(NSString *)baseURL accessToken:(NSString *)accessToken;
+-(BOOL)clearCredentials;
+
+@end
+
+NS_ASSUME_NONNULL_END

services/apple/Shared (App)/HPCredentialsHelper.m

@@ -0,0 +1,218 @@
+//
+//  HPCredentialsHelper.m
+//  HotPocket
+//
+//  Created by Tomek Wójcik on 19/09/2025.
+//
+
+#import <Security/Security.h>
+
+#import "HPCredentialsHelper.h"
+
+@implementation HPCredentials
+
+#pragma mark - HPCredentials implementation
+
+-(id)init {
+    if (self = [super init]) {
+        self.baseURL = nil;
+        self.accessToken = nil;
+    }
+    
+    return self;
+}
+
+-(BOOL)usable {
+    return (self.baseURL != nil && self.accessToken != nil);
+}
+
+-(NSURL *)rpcURL {
+    return [NSURL URLWithString:self.baseURL];
+}
+
+-(NSString *)description {
+    NSMutableDictionary *attributes = [NSMutableDictionary dictionaryWithCapacity:2];
+    
+    if (self.baseURL == nil) {
+        [attributes setValue:@"(null)" forKey:@"baseURL"];
+    } else {
+        [attributes setValue:self.baseURL forKey:@"baseURL"];
+    }
+    
+    if (self.accessToken == nil) {
+        [attributes setValue:@"(null)" forKey:@"accessToken"];
+    } else {
+        [attributes setValue:@"***" forKey:@"accessToken"];
+    }
+    
+    return [NSString stringWithFormat:@"<%@: %p; %@>", NSStringFromClass([self class]), self, attributes];
+}
+
+@end
+
+@implementation HPCredentialsHelper (HPCredentialsHelperPrivate)
+
+#pragma mark - Private interface
+
+-(NSString *)getService {
+#ifdef DEBUG
+    return @"pl.bthlabs.HotPocket.Debug";
+#else
+    return @"pl.bthlabs.HotPocket";
+#endif
+}
+
+-(NSData *)getKeychainItem:(NSString *)service account:(NSString *)account {
+    if (service == nil || account == nil) {
+        return nil;
+    }
+    
+    NSDictionary *query = @{
+        (__bridge id)kSecClass: (__bridge id)kSecClassGenericPassword,
+        (__bridge id)kSecAttrService: service,
+        (__bridge id)kSecAttrAccount: account,
+        (__bridge id)kSecReturnData: @YES,
+        (__bridge id)kSecMatchLimit: (__bridge id)kSecMatchLimitOne,
+        (__bridge id)kSecAttrAccessGroup: @"648728X64K.pl.bthlabs.HotPocketShared",
+        (__bridge id)kSecUseDataProtectionKeychain: @YES,
+    };
+    
+    CFTypeRef resultData = NULL;
+    OSStatus status = SecItemCopyMatching((__bridge CFDictionaryRef)query, &resultData);
+    
+    if (status == errSecSuccess && resultData != NULL) {
+        NSData *result = (__bridge_transfer NSData *)resultData;
+        return result;
+    } else {
+        CFStringRef statusStringRef = SecCopyErrorMessageString(status, NULL);
+        NSString *statusString = (__bridge NSString *)statusStringRef;
+        NSLog(@"-[HPCredentialsHelper getKeychainItem:account:] service=`%@` account=`%@` status=%@", service, account, statusString);
+        return nil;
+    }
+}
+
+-(BOOL)createKeychainItemWithValue:(NSData *)value service:(NSString *)service account:(NSString *)account {
+    if (value == nil || service == nil || account == nil) {
+        return NO;
+    }
+    
+    NSDictionary *attributes = @{
+        (__bridge id)kSecClass: (__bridge id)kSecClassGenericPassword,
+        (__bridge id)kSecAttrService: service,
+        (__bridge id)kSecAttrAccount: account,
+        (__bridge id)kSecValueData: value,
+        (__bridge id)kSecAttrAccessGroup: @"648728X64K.pl.bthlabs.HotPocketShared",
+        (__bridge id)kSecUseDataProtectionKeychain: @YES,
+    };
+
+    OSStatus status = SecItemAdd((__bridge CFDictionaryRef)attributes, NULL);
+    
+    if (status != errSecSuccess) {
+        CFStringRef statusStringRef = SecCopyErrorMessageString(status, NULL);
+        NSString *statusString = (__bridge NSString *)statusStringRef;
+        NSLog(@"-[HPCredentialsHelper createKeychainItemWithValue:service:account:] service=`%@` account=`%@` status=%@", service, account, statusString);
+        return NO;
+    }
+    
+    return YES;
+}
+
+-(BOOL)deleteKeychainItem:(NSString *)service account:(NSString *)account {
+    if (service == nil || account == nil) {
+        return NO;
+    }
+    
+    NSDictionary *query = @{
+        (__bridge id)kSecClass: (__bridge id)kSecClassGenericPassword,
+        (__bridge id)kSecAttrService: service,
+        (__bridge id)kSecAttrAccount: account,
+        (__bridge id)kSecAttrAccessGroup: @"648728X64K.pl.bthlabs.HotPocketShared",
+        (__bridge id)kSecUseDataProtectionKeychain: @YES,
+    };
+    
+    OSStatus status = SecItemDelete((__bridge CFDictionaryRef)query);
+    
+    if (status != errSecSuccess) {
+        CFStringRef statusStringRef = SecCopyErrorMessageString(status, NULL);
+        NSString *statusString = (__bridge NSString *)statusStringRef;
+        NSLog(@"-[HPCredentialsHelper deleteKeychainItem:account:] service=`%@` account=`%@` status=%@", service, account, statusString);
+        return NO;
+    }
+    
+    return YES;
+}
+
+@end
+
+@implementation HPCredentialsHelper
+
+#pragma mark - Initialization
+
++(instancetype)sharedHelper {
+    static HPCredentialsHelper *sharedInstance = nil;
+    static dispatch_once_t initToken;
+    dispatch_once(&initToken, ^{
+        sharedInstance = [[self alloc] init];
+    });
+    
+    return sharedInstance;
+}
+
+#pragma mark - Public interface
+
+-(HPCredentials *)getCredentials {
+    HPCredentials *result = [[HPCredentials alloc] init];
+    
+    NSData *itemData = [self getKeychainItem:[self getService] account:@"RPC"];
+    if (itemData != nil) {
+        NSError *error;
+        NSDictionary *itemPayload = [NSJSONSerialization JSONObjectWithData:itemData
+                                                                         options:NSJSONReadingTopLevelDictionaryAssumed
+                                                                           error:&error];
+        
+        if (error != nil) {
+            NSLog(@"-[HPCredentialsHalper getCredentials] error=`%@`", error);
+        } else if (itemPayload != nil) {
+            result.baseURL = [itemPayload valueForKey:@"baseURL"];
+            result.accessToken = [itemPayload valueForKey:@"accessToken"];
+        }
+    }
+    
+    return result;
+}
+
+-(BOOL)saveCredentials:(NSString *)baseURL accessToken:(NSString *)accessToken {
+    NSMutableDictionary *itemPayload = [NSMutableDictionary dictionaryWithCapacity:2];
+    
+    if (baseURL != nil) {
+        [itemPayload setValue:baseURL forKey:@"baseURL"];
+    }
+    
+    if (accessToken != nil) {
+        [itemPayload setValue:accessToken forKey:@"accessToken"];
+    }
+    
+    NSError *error;
+    NSData *itemData = [NSJSONSerialization dataWithJSONObject:itemPayload options:0 error:&error];
+    
+    if (error != nil) {
+        NSLog(@"-[HPCredentialsHalper saveCredentials:accessToken:] error=`%@`", error);
+        return NO;
+    }
+    
+    BOOL saveResult = [self createKeychainItemWithValue:itemData service:[self getService] account:@"RPC"];
+    
+    [[NSNotificationCenter defaultCenter] postNotificationName:@"HPCredentialsChanged" object:self];
+    
+    return saveResult;
+}
+
+-(BOOL)clearCredentials {
+    BOOL deleteResult = [self deleteKeychainItem:[self getService] account:@"RPC"];
+    
+    [[NSNotificationCenter defaultCenter] postNotificationName:@"HPCredentialsChanged" object:self];
+    
+    return deleteResult;
+}
+
+@end

services/apple/Shared (App)/HPRPCClient.h

@@ -0,0 +1,44 @@
+//
+//  HPRPCClient.h
+//  HotPocket
+//
+//  Created by Tomek Wójcik on 19/09/2025.
+//
+
+#import <Foundation/Foundation.h>
+
+NS_ASSUME_NONNULL_BEGIN
+
+@interface HPRPCCallResult : NSObject
+
+@property (nullable) NSError *error;
+@property (nullable) id result;
+
+@end
+
+@protocol HPRPCClientDelegate <NSObject>
+
+-(void)rpcClientDidReceiveResult:(HPRPCCallResult *)result callId:(NSString *)callId;
+
+@end
+
+typedef void (^HPRPCClientCompletionHandler)(NSString * _Nullable callId, HPRPCCallResult * _Nullable result);
+
+@interface HPRPCClient : NSObject
+
+@property (nonatomic, weak) id<HPRPCClientDelegate> delegate;
+@property NSURL *baseURL;
+@property NSString *accessToken;
+@property NSURLSession *session;
+
+-(id)initWithBaseURL:(nullable NSURL *)baseURL accessToken:(nullable NSString *)accessToken;
+
+-(BOOL)hasCredentials;
+-(BOOL)call:(nullable NSString *)callId method:(NSString *)method params:(NSArray *)params endopoint:(nullable NSString *)endpoint completionHandler:(HPRPCClientCompletionHandler)completionHandler;
+-(BOOL)call:(nullable NSString *)callId method:(NSString *)method params:(NSArray *)params endopoint:(nullable NSString *)endpoint;
+-(BOOL)call:(nullable NSString *)callId method:(NSString *)method params:(NSArray *)params;
+-(BOOL)call:(nullable NSString *)callId method:(NSString *)method params:(NSArray *)params completionHandler:(HPRPCClientCompletionHandler)completionHandler;
+
+@end
+
+NS_ASSUME_NONNULL_END

services/apple/Shared (App)/HPRPCClient.m

@@ -0,0 +1,186 @@
+//
+//  HPRPCClient.m
+//  HotPocket
+//
+//  Created by Tomek Wójcik on 19/09/2025.
+//
+
+#import "HPRPCClient.h"
+
+@implementation HPRPCCallResult
+
+#pragma mark - HPRPCCallResult implementation
+
+-(id)init {
+    if (self = [super init]) {
+        self.error = nil;
+        self.result = nil;
+    }
+    
+    return self;
+}
+
+-(NSString *)description {
+    NSMutableDictionary *attributes = [NSMutableDictionary dictionaryWithCapacity:2];
+    
+    if (self.error == nil) {
+        [attributes setValue:@"(null)" forKey:@"error"];
+    } else {
+        [attributes setValue:self.error forKey:@"error"];
+    }
+    
+    if (self.result == nil) {
+        [attributes setValue:@"(null)" forKey:@"result"];
+    } else {
+        [attributes setValue:self.result forKey:@"result"];
+    }
+    
+    return [NSString stringWithFormat:@"<%@: %p; %@>", NSStringFromClass([self class]), self, attributes];
+}
+
+@end
+
+@implementation HPRPCClient
+
+#pragma mark - Initialization
+
+-(id)initWithBaseURL:(nullable NSURL *)baseURL accessToken:(nullable NSString *)accessToken {
+    if (self = [super init]) {
+        self.baseURL = baseURL;
+        self.accessToken = accessToken;
+        self.session = [NSURLSession sessionWithConfiguration:NSURLSessionConfiguration.ephemeralSessionConfiguration];
+    }
+    
+    return self;
+}
+
+#pragma mark - Public interface
+
+-(BOOL)hasCredentials {
+    return (self.baseURL != nil && self.accessToken != nil);
+}
+
+-(BOOL)call:(nullable NSString *)callId method:(NSString *)method params:(NSArray *)params endopoint:(nullable NSString *)endpoint completionHandler:(HPRPCClientCompletionHandler)completionHandler {
+    if (self.baseURL == nil) {
+        return NO;
+    }
+    
+    if (callId == nil) {
+        callId = [[NSUUID UUID] UUIDString];
+    }
+    
+    if (endpoint == nil) {
+        endpoint = @"/rpc/";
+    }
+    
+    NSBundle *mainBundle = [NSBundle mainBundle];
+
+    NSDictionary *payload = @{
+        @"jsonrpc": @"2.0",
+        @"id": callId,
+        @"method": method,
+        @"params": params,
+    };
+    
+    NSError *error;
+    NSData *jsonPayload = [NSJSONSerialization dataWithJSONObject:payload options:0 error:&error];
+    if (!jsonPayload) {
+        NSLog(@"-[HPRPCClient call:method:params:endpoint:] Unable to serialize payload: error=`%@`", error);
+        HPRPCCallResult *result = [[HPRPCCallResult alloc] init];
+        result.error = error;
+
+        if (self.delegate != nil) {
+            [self.delegate rpcClientDidReceiveResult:result callId:callId];
+        }
+
+        return NO;
+    }
+    
+    NSURLComponents *urlComponents = [NSURLComponents componentsWithURL:self.baseURL resolvingAgainstBaseURL:NO];
+    urlComponents.path = endpoint;
+    urlComponents.queryItems = @[
+        [NSURLQueryItem queryItemWithName:@"method" value:method],
+    ];
+    
+    NSURL *callURL = [urlComponents URL];
+#ifdef DEBUG
+    NSLog(@"-[HPRPCClient call:method:params:endpoint:] callURL=`%@`", callURL.absoluteString);
+#endif
+    
+    NSMutableURLRequest *request = [[NSMutableURLRequest alloc] initWithURL:callURL];
+    request.HTTPMethod = @"POST";
+    request.HTTPBody = jsonPayload;
+
+    [request setValue:@"application/json;charset=utf-8" forHTTPHeaderField:@"Content-Type"];
+    [request setValue:[[mainBundle infoDictionary] valueForKey:@"HPRPCClientOrigin"] forHTTPHeaderField:@"Origin"];
+    
+    if (self.accessToken != nil) {
+        NSString *authorization = [NSString stringWithFormat:@"Bearer %@", self.accessToken];
+        [request setValue:authorization forHTTPHeaderField:@"Authorization"];
+    }
+    
+    NSString *build = [[NSBundle mainBundle] objectForInfoDictionaryKey:@"CFBundleVersion"];
+    NSString *userAgent = [NSString stringWithFormat:@"HotPocket/%@", build];
+    [request setValue:userAgent forHTTPHeaderField:@"User-Agent"];
+    
+    NSURLSessionDataTask *task = [self.session dataTaskWithRequest:request
+                                                 completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) {
+        HPRPCCallResult *result = [[HPRPCCallResult alloc] init];
+        if (error != nil) {
+            result.error = error;
+        } else {
+            NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *)response;
+            if (httpResponse.statusCode != 200) {
+                result.error = [[NSError alloc] initWithDomain:@"pl.bthlabs.HotPocket.HPRPCClient" code:-32000 userInfo:@{
+                    @"callId": callId,
+                    @"url": httpResponse.URL,
+                    @"statusCode": [NSNumber numberWithInteger:httpResponse.statusCode],
+                    @"response": response,
+                }];
+            } else {
+                NSError *jsonDecodeError;
+                NSDictionary *callResult = [NSJSONSerialization JSONObjectWithData:data options:NSJSONReadingTopLevelDictionaryAssumed error:&error];
+                if (jsonDecodeError != nil) {
+                    result.error = jsonDecodeError;
+                } else {
+                    NSDictionary *rpcError = [callResult valueForKey:@"error"];
+                    if (rpcError != nil) {
+                        NSNumber *rpcErrorCode = [rpcError valueForKey:@"code"];
+                        if (rpcErrorCode == nil) {
+                            rpcErrorCode = [NSNumber numberWithInt:-32000];
+                        }
+
+                        result.error = [[NSError alloc] initWithDomain:@"pl.bthlabs.HotPocket.HPRPCClient" code:[rpcErrorCode integerValue] userInfo:rpcError];
+                    } else {
+                        result.result = [callResult valueForKey:@"result"];
+                    }
+                }
+            }
+        }
+        
+        if (completionHandler) {
+            completionHandler(callId, result);
+        }
+    }];
+    [task resume];
+
+    return YES;
+}
+
+-(BOOL)call:(nullable NSString *)callId method:(NSString *)method params:(NSArray *)params endopoint:(nullable NSString *)endpoint {
+    return [self call:callId method:method params:params endopoint:endpoint completionHandler:^(NSString *callId, HPRPCCallResult *result) {
+        if (self.delegate != nil) {
+            [self.delegate rpcClientDidReceiveResult:result callId:callId];
+        }
+    }];
+}
+
+-(BOOL)call:(nullable NSString *)callId method:(NSString *)method params:(NSArray *)params {
+    return [self call:callId method:method params:params endopoint:nil];
+}
+
+-(BOOL)call:(nullable NSString *)callId method:(NSString *)method params:(NSArray *)params completionHandler:(HPRPCClientCompletionHandler)completionHandler {
+    return [self call:callId method:method params:params endopoint:nil completionHandler:completionHandler];
+}
+
+@end

services/apple/Shared (App)/HotPocket 27.icon/Assets/pepper 2.svg

@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="1024px" height="1024px" viewBox="0 0 1024 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+    <!-- Generator: Sketch 61 (89581) - https://sketch.com -->
+    <title>icon-ios-tinted</title>
+    <desc>Created with Sketch.</desc>
+    <defs>
+        <filter x="-1.5%" y="-1.5%" width="103.0%" height="103.0%" filterUnits="objectBoundingBox" id="filter-1">
+            <feOffset dx="0" dy="2" in="SourceAlpha" result="shadowOffsetOuter1"></feOffset>
+            <feGaussianBlur stdDeviation="2" in="shadowOffsetOuter1" result="shadowBlurOuter1"></feGaussianBlur>
+            <feColorMatrix values="0 0 0 0 0   0 0 0 0 0   0 0 0 0 0  0 0 0 0.5 0" type="matrix" in="shadowBlurOuter1" result="shadowMatrixOuter1"></feColorMatrix>
+            <feMerge>
+                <feMergeNode in="shadowMatrixOuter1"></feMergeNode>
+                <feMergeNode in="SourceGraphic"></feMergeNode>
+            </feMerge>
+        </filter>
+    </defs>
+    <g id="icon-ios-tinted" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
+        <g id="HotPocket-Copy" transform="translate(112.000000, 136.000000)" fill="#1CBAED" fill-rule="nonzero">
+            <g id="Group" filter="url(#filter-1)">
+                <g id="pepper-hot-solid-svgrepo-com" transform="translate(174.000000, 78.000000)">
+                    <path d="M452,37.5215494 L452,0 C414.620964,0 385.466785,10.4063766 365.41868,30.779396 C353.815765,42.5781598 347.57369,55.6960499 343.975301,66.9818378 C334.428601,60.3862436 323.339725,56.2823241 311.002439,56.2823241 C263.562643,56.2823241 245.644203,93.9504515 245.203576,119.599939 C245.203576,123.703858 245.056713,128.027635 244.762969,132.497971 C232.131937,169.799663 207.604227,145.102867 207.604227,93.8038736 C147.019342,158.0009 212.304145,181.671725 175.071972,218.826858 C167.140859,226.74156 148.194321,229.81949 136.371093,215.309213 C120.729162,196.768277 152.527064,166.282018 122.4182,143.490622 C127.925922,177.787663 101.415448,170.679075 92.4562182,163.350647 C80.7798529,153.8237 59.5567872,132.864388 94.8061776,75.0430988 C58.748984,91.4587767 37.0118599,124.803127 38.407153,150.086198 C42.1524054,216.408463 144.889696,274.009913 103.398212,312.704011 C82.4688909,332.270918 41.3446022,305.81528 57.2068278,262.650846 C37.4524867,272.690787 14.246638,296.581471 21.6636925,333.736603 C26.804238,359.45937 64.2567059,417.427237 0.807803229,450.258593 C0.807803229,450.258593 1.10154815,450.331873 1.61560646,450.478451 L0,487.780142 C1.24843001,487.853422 6.31552517,488 14.4669514,488 C67.341037,488 250.344122,479.865441 362.995289,372.210844 C422.038018,315.781942 452,241.03198 452,150.086198 C452,124.143573 440.176772,75.0430988 395.600975,75.0430988 C390.093253,75.0430988 384.952727,75.775951 380.105926,76.9484994 C382.235591,70.6460423 385.907393,63.4641926 392.222918,57.0151763 C405.000813,44.1171437 425.048899,37.5215494 452,37.5215494 Z M395.600975,112.564648 C413.372552,112.564648 414.40065,149.793061 414.40065,150.086198 C414.40065,230.332485 388.330784,295.921917 337.072305,345.022372 C253.869061,424.609106 122.785376,444.322571 51.6256743,449.012765 C68.9566246,445.055405 89.8125139,436.994144 112.651186,421.604436 C222.658649,361.43805 280.526398,219.559692 282.656063,125.096264 L282.802926,125.096264 L282.802926,119.966355 C282.876358,115.569299 284.638827,93.8038736 311.002439,93.8038736 C327.084978,93.8038736 339.201951,116.595288 339.201951,131.325423 L376.801301,131.325423 C376.801301,123.264162 378.784083,112.564648 395.600975,112.564648 Z" id="Shape"></path>
+                </g>
+            </g>
+        </g>
+    </g>
+</svg>