Improve transit search and setup

README.md

@@ -90,7 +90,7 @@ That's it — happy transit-ing! 🚏🚌🚆
 
 ## 🧪 A couple of nerdy notes
 
-- **RIPTA's live feeds are HTTP-only** (no HTTPS), which Android blocks by default. There's a small, clearly-labeled `:netconfig` module that grants just that one narrow exception — see its own `build.gradle.kts` for exactly what it does and how to remove it if you'd rather stay HTTPS-only everywhere.
+- **RIPTA's live feeds are HTTP-only** (no HTTPS). A narrowly scoped `:netconfig` exception permits realtime requests only to `realtime.ripta.com`.
 - **No device GPS is used anywhere** — the SDK doesn't expose it to tools yet. Nearby-stop and location search are powered by Nominatim (OpenStreetMap) and IP-based geolocation instead. Be kind to their free APIs! 🙏
 - **Stations are deduplicated using GTFS's `parent_station`** — a big station with several platforms (subway entrances, commuter rail tracks, etc.) shows up as one marker/entry, not one per platform, while still resolving to the right platform's `stop_id` under the hood for schedule lookups. Only real platforms and boarding areas count as "member platforms" for this — GTFS also links entrances, elevators, and escalator nodes to the same parent station, and those are filtered out so a big hub's map isn't cluttered with dozens of non-boardable points.
 - **Boarding a trip is a saved reference, not a background tracker** — Pico Transit never polls a live feed while the app itself isn't open. "You've reached your stop" detection only runs while Trip Detail or the home screen is actually visible and polling, the same way every other bit of live tracking in the app works.

gradle/libs.versions.toml

@@ -42,7 +42,6 @@ ktor-client-core = { module = "io.ktor:ktor-client-core", version.ref = "ktor" }
 ktor-client-okhttp = { module = "io.ktor:ktor-client-okhttp", version.ref = "ktor" }
 ktor-client-content-negotiation = { module = "io.ktor:ktor-client-content-negotiation", version.ref = "ktor" }
 ktor-serialization-json = { module = "io.ktor:ktor-serialization-kotlinx-json", version.ref = "ktor" }
-light-keyboard = { module = "com.thelightphone.lp3keyboard:ui", version = "0.0.16"}
 androidx-camera-core = { module = "androidx.camera:camera-core", version.ref = "camerax" }
 androidx-camera-camera2 = { module = "androidx.camera:camera-camera2", version.ref = "camerax" }
 androidx-camera-lifecycle = { module = "androidx.camera:camera-lifecycle", version.ref = "camerax" }

netconfig/build.gradle.kts

@@ -3,28 +3,7 @@
 // This module exists solely to grant realtime.ripta.com a Network Security Config cleartext
 // exception (see src/main/res/xml/network_security_config.xml). RIPTA's realtime TripUpdates/
 // VehiclePositions feeds are served plain-HTTP-only with no HTTPS equivalent, and Android blocks
-// cleartext traffic by default — this module's manifest merges the exception into :tool's final
-// packaged manifest.
-//
-// Deliberately does NOT apply the com.thelightphone.light-sdk plugin — that plugin's manifest
-// generation has no field for network security config, and hand-editing an
-// AndroidManifest.xml in a plugin-applying module is rejected outright. A plain sibling library
-// module sidesteps that: the plugin's own dependency validator explicitly exempts same-build
-// project dependencies (see LightSdkPlugin.isProjectDependency), and since this module never
-// applies the plugin, none of its restrictions apply to it either. Verified against a real forced
-// rebuild that the merged attribute survives into :tool's final packaged manifest — confirmed via
-// tool/build/intermediates/packaged_manifests/.../AndroidManifest.xml, not just the intermediate
-// merge blame log.
-//
-// TO REMOVE THIS EXCEPTION (restore HTTPS-only enforcement everywhere):
-//   1. Delete this module (the netconfig/ directory).
-//   2. Remove `include(":netconfig")` from settings.gradle.kts.
-//   3. Remove `implementation(project(":netconfig"))` from tool/build.gradle.kts.
-//   4. In GtfsAgency.kt, set RIPTA's realtimeTripUpdatesUrl/realtimeVehiclePositionsUrl back to
-//      null (the original, HTTPS-only-safe state).
-//
-// UNVERIFIED: whether Light's official build/signing pipeline (builder/) accepts a sibling module
-// built this way — only confirmed against local Gradle builds so far.
+// cleartext traffic by default.
 plugins {
     alias(libs.plugins.android.library)
 }

netconfig/src/main/AndroidManifest.xml

@@ -1,9 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--
-    REMOVABLE cleartext exception (see netconfig/build.gradle.kts header for full context).
-    This attribute is merged into :tool's final AndroidManifest.xml by AGP's manifest merger.
-    To remove: delete this module entirely (see build.gradle.kts for the full removal steps).
--->
+<!-- Scoped cleartext exception for RIPTA's HTTP-only realtime feeds. -->
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">
     <application android:networkSecurityConfig="@xml/network_security_config" />
 </manifest>

netconfig/src/main/res/xml/network_security_config.xml

@@ -1,9 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--
-    REMOVABLE: scoped narrowly to realtime.ripta.com only — no blanket cleartext allowance for
-    the rest of the app. Remove this file (and the whole netconfig/ module) to restore
-    HTTPS-only enforcement everywhere; see netconfig/build.gradle.kts for full removal steps.
--->
+<!-- RIPTA has no HTTPS equivalent for these realtime endpoints. -->
 <network-security-config>
     <domain-config cleartextTrafficPermitted="true">
         <domain includeSubdomains="false">realtime.ripta.com</domain>

sdk/ui/build.gradle.kts

@@ -43,7 +43,7 @@ afterEvaluate {
 }
 
 dependencies {
-    api(libs.light.keyboard)
+    api(project(":light-keyboard-ui"))
     implementation(libs.androidx.lifecycle.viewmodel)
     implementation(libs.androidx.lifecycle.viewmodel.compose)
     implementation(libs.androidx.lifecycle.runtime.compose)

settings.gradle.kts

@@ -1,5 +1,3 @@
-import java.util.Properties
-
 pluginManagement {
     repositories {
         google()
@@ -8,26 +6,11 @@ pluginManagement {
     }
 }
 
-val localProperties = Properties()
-val localPropertiesFile = file("local.properties")
-if (localPropertiesFile.exists()) {
-    localPropertiesFile.inputStream().use { localProperties.load(it) }
-}
-val ghUsername = localProperties.getProperty("gpr.user") ?: System.getenv("GH_PACKAGES_USER")
-val ghPassword = localProperties.getProperty("gpr.key") ?: System.getenv("GH_PACKAGES_TOKEN")
-
 dependencyResolutionManagement {
     repositories {
+        mavenLocal()
         google()
         mavenCentral()
-        maven {
-            name = "GitHubPackages-Keyboard"
-            url = uri("https://maven.pkg.github.com/lightphone/light-keyboard")
-            credentials {
-                username = ghUsername
-                password = ghPassword
-            }
-        }
     }
 }
 
@@ -37,11 +20,12 @@ includeBuild("plugin")
 include(":lint-rules")
 include(":sdk:shared")
 include(":sdk:ui")
+include(":light-keyboard-ui")
+project(":light-keyboard-ui").projectDir = file("third_party/light-keyboard/ui")
 include(":sdk:client")
 include(":sdk:server")
 include(":sdk:emulator")
 include(":tool")
-// REMOVABLE: see netconfig/build.gradle.kts for what this is and how to fully remove it.
 include(":netconfig")
 include(":examples:ui-demo")
 project(":examples:ui-demo").projectDir = file("examples/ui-demo")

third_party/light-keyboard/.github/workflows/pr-check.yml

@@ -0,0 +1,40 @@
+name: PR Check
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+  packages: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: Gradle check
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - name: Set up Android SDK
+        uses: android-actions/setup-android@v3
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@v4
+
+      - name: Run check
+        env:
+          GH_PACKAGES_USER: ${{ github.actor }}
+          GH_PACKAGES_TOKEN: ${{ secrets.GH_CI_TOKEN }}
+        run: ./gradlew check --stacktrace

third_party/light-keyboard/.gitignore

@@ -0,0 +1,19 @@
+*.iml
+.gradle
+/local.properties
+/.idea/
+/.idea/caches
+/.idea/libraries
+/.idea/modules.xml
+/.idea/workspace.xml
+/.idea/markdown.xml
+/.idea/navEditor.xml
+/.idea/assetWizardSettings.xml
+/.idea/vcs.xml
+.kotlin/errors
+.DS_Store
+/build
+/captures
+.externalNativeBuild
+.cxx
+local.properties