Paperstow 1.1 under com.app.paperstow

.github/dependabot.yml

@@ -1,8 +1,7 @@
-# Dependabot configuration for version updates
+# Dependabot: weekly bumps for Gradle (including version catalog) and Actions.
 
 version: 2
 updates:
-  # Gradle dependencies
   - package-ecosystem: "gradle"
     directory: "/"
     schedule:
@@ -16,8 +15,31 @@ updates:
     commit-message:
       prefix: "deps:"
       include: "scope"
+    groups:
+      androidx:
+        patterns:
+          - "androidx*"
+          - "com.google.android.gms*"
+          - "com.google.mlkit*"
+      kotlin-toolchain:
+        patterns:
+          - "org.jetbrains.kotlin*"
+          - "org.jetbrains.kotlinx*"
+          - "com.google.devtools.ksp*"
+      testing:
+        patterns:
+          - "org.junit*"
+          - "io.kotest*"
+          - "io.mockk*"
+          - "androidx.test*"
+      di-and-crypto:
+        patterns:
+          - "com.google.dagger*"
+          - "org.bouncycastle*"
+          - "net.lingala.zip4j*"
+          - "androidx.security*"
+          - "com.google.code.gson*"
 
-  # GitHub Actions dependencies
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:

.github/workflows/build.yml

@@ -13,9 +13,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - name: Set up JDK 17
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@v5
       with:
         java-version: '17'
         distribution: 'zulu'
@@ -25,7 +25,7 @@ jobs:
       uses: actions/cache@v4
       with:
         path: ~/.gradle/caches
-        key: gradle-${{ hashFiles('**/*.gradle*') }}
+        key: gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', '**/libs.versions.toml') }}
     - name: Bump version
       run: |
         sed -i "s/versionCode = [0-9]*/versionCode = ${{ github.run_number }}/" app/build.gradle.kts
@@ -39,6 +39,7 @@ jobs:
         mkdir -p artifacts
         cp app/build/outputs/apk/debug/app-debug.apk artifacts/document-manager-debug.apk
         cp app/build/outputs/apk/release/app-release*.apk artifacts/document-manager-release.apk 2>/dev/null || true
+        cp app/build/outputs/sbom/debug/sbom.json artifacts/sbom.json 2>/dev/null || true
     - name: Upload artifacts
       uses: actions/upload-artifact@v4
       with:

.github/workflows/codeql.yml

@@ -19,10 +19,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Set up JDK 17
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@v5
       with:
         java-version: '17'
         distribution: 'zulu'
@@ -31,7 +31,7 @@ jobs:
       uses: android-actions/setup-android@v3
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v4
       with:
         languages: java-kotlin
         build-mode: manual
@@ -42,7 +42,7 @@ jobs:
         ./gradlew assembleDebug --no-daemon
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v4
       continue-on-error: true
       with:
         category: /language:java-kotlin

.gitignore

@@ -18,7 +18,7 @@ Thumbs.db
 google-services.json
 
 # Debug output
-app/src/main/java/com/app/traveldocs/debug/debug_logs/
+app/src/main/java/com/app/paperstow/debug/debug_logs/
 
 # Build artifacts
 build_output.txt

.kiro/specs/travel-document-manager/design.md

@@ -376,7 +376,7 @@ The `device_key` is a 256-bit key generated once and stored in AndroidKeyStore.
 ### File Storage Layout
 
 ```
-/data/data/com.app.traveldocs/
+/data/data/com.app.paperstow/
 ├── databases/
 │   ├── member_{id}.db          # SQLCipher-encrypted Room DB per member
 │   └── app_meta.db             # Unencrypted: member list, app config
@@ -722,7 +722,7 @@ app/src/androidTest/       # Integration + UI tests (device/emulator)
 
 **Component**: `DebugLogger` (debug/)
 - Singleton with 3 outputs: Logcat (tag: TravelDocs), ring buffer (500), file
-- File at: `/data/data/com.app.traveldocs/files/debug_logs/traveldocs_debug.log`
+- File at: `/data/data/com.app.paperstow/files/debug_logs/traveldocs_debug.log`
 - Auto-rotates at 5MB
 
 **Component**: `DebugLogScreen` + `DebugFloatingButton` (debug/)

LICENSE

@@ -90,7 +90,7 @@
       the Work, You may choose to offer acceptance of support, warranty,
       indemnity, or other liability obligations consistent with this License.
 
-   Copyright 2024 Travel Document Manager Contributors
+   Copyright 2026 Paperstow Contributors
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

NOTICE

@@ -0,0 +1,96 @@
+Paperstow
+Copyright 2026 Paperstow Contributors
+
+This product is licensed under the Apache License, Version 2.0.
+See the LICENSE file in the repository root.
+
+This product redistributes software developed by third parties. Those
+components remain under their own licenses. A component inventory is in
+docs/THIRD_PARTY_LICENSES.md.
+
+---------------------------------------------------------------------------
+Apache License 2.0 components (selected)
+
+AndroidX (Core, Activity, Lifecycle, Navigation, Compose, Room, Biometric,
+DocumentFile, Security Crypto, Hilt Navigation, Test)
+Copyright The Android Open Source Project
+https://developer.android.com/jetpack/androidx
+
+Kotlin and kotlinx.coroutines
+Copyright JetBrains s.r.o. and Kotlin contributors
+https://github.com/JetBrains/kotlin
+
+Dagger / Hilt
+Copyright Google LLC
+https://github.com/google/dagger
+
+Zip4j
+Copyright Srikanth Lingala
+https://github.com/srikanth-lingala/zip4j
+
+Gson
+Copyright Google LLC
+https://github.com/google/gson
+
+Tink Android (via androidx.security:security-crypto)
+Copyright Google LLC
+https://github.com/tink-crypto/tink-java
+
+JSpecify
+Copyright The JSpecify Authors
+https://jspecify.dev/
+
+Kotest (test)
+https://github.com/kotest/kotest
+
+MockK (test)
+https://github.com/mockk/mockk
+
+Material Icons (Apache 2.0)
+https://fonts.google.com/icons
+
+---------------------------------------------------------------------------
+Bouncy Castle (MIT-style "Bouncy Castle Licence")
+
+bcprov-jdk18on
+Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc.
+https://www.bouncycastle.org/
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+https://www.bouncycastle.org/licence.html
+
+---------------------------------------------------------------------------
+Google ML Kit and Play services (not Apache)
+
+ML Kit Text Recognition and ML Kit Document Scanner client libraries are
+distributed under the ML Kit Terms of Service, and they pull in Google Play
+services libraries under the Android Software Development Kit License.
+
+https://developers.google.com/ml-kit/terms
+https://developer.android.com/studio/terms
+
+These terms apply to the binary SDKs. They do not change the Apache 2.0
+license of Paperstow source code.
+
+---------------------------------------------------------------------------
+Eclipse Public License 2.0 (test classpath only; not shipped in the app)
+
+JUnit 5 (Jupiter / Platform)
+https://www.eclipse.org/legal/epl-v20.html