# Den — native shell (Capacitor)

This is the iOS + Android wrapper around the Den web app. It does **not** contain
app logic of its own: it bundles the built web app (`../web`) and points it at the
live API (`https://den.fearthewild.com`). The web app detects it's running natively
(`web/src/native.ts`) and switches from cookie auth to a **Bearer token** stored in
native Preferences.

```
app/
  capacitor.config.ts   appId com.fearthewild.den, appName "Den", webDir www
  scripts/copy-web.mjs   copies ../web/dist -> www
  www/                   (generated) the built web app — gitignored
  android/               the Android Studio project (committed; build output ignored)
```

## One-time prerequisites (to build/run on a device)

- **Android Studio** — install it; it bundles the Android SDK **and** a compatible
  JDK (Capacitor 8 needs JDK 21; the IDE's bundled runtime satisfies this — the
  system `java` on this PC is 11 and is **not** enough for a command-line build).
- A **device or emulator**. For a real Samsung: enable Developer Options →
  USB debugging, plug in, accept the prompt. `adb devices` should list it.

## Everyday workflow

From `app/`:

```bash
# 1. Build the web app and copy it into www/, then sync into the native project
npm run build:web      # = cd ../web && npm run build
npm run sync           # copy:web + cap sync

# 2. Open in Android Studio and press Run (recommended first time)
npm run open:android

# …or run straight onto a connected device once tooling is set up
npm run run:android
```

After **any** change to the web app, re-run `npm run build:web && npm run sync`
so the native shell picks up the new assets.

## Auth / networking notes

- Native calls the API absolutely (`API_BASE` in `web/src/native.ts`) with
  `Authorization: Bearer <token>`; the server allows the Capacitor origins via its
  CORS allowlist (`api/src/server.ts`).
- Google sign-in is hidden on native for now (the OAuth redirect flow is web-only;
  native Google sign-in via id_token verification is a later step).
- Live cross-device sync (SSE) currently uses the browser `EventSource`, which
  can't send a Bearer header — native live-sync needs a fetch-based SSE client
  (a later step). Data still syncs on app foreground/refetch.