release: 1.7.0 (authoritative map, pass-the-app, clearer sign-in, security)

Bump 1.6.8 -> 1.7.0. Notes: canonical map + restored spot; Android share-app
card; 3-card sign-in with per-session desktop welcome; zod 4 + nostrify 0.50 +
react-router 7 + vitest 5 (audit 35 -> 8). APK built + published + verified.

AGENTS.md

@@ -2232,7 +2232,7 @@ Rules:
     `SIGN_WITH="$(sed -n 's/^SIGN_WITH=//p' ~/.config/skatespots/zsp.env)"; export SIGN_WITH`.
     Complete non-interactive publish:
     `SIGN_WITH="$(sed -n 's/^SIGN_WITH=//p' ~/.config/skatespots/zsp.env)"; export SIGN_WITH; zsp publish --quiet zapstore.yaml`
-    ✅ **Published 1.6.1–1.6.8 on 2026-10-12/26** — the app's usual path is an **inline
+    ✅ **Published 1.6.1–1.7.0 on 2026-10-12/26** — the app's usual path is an **inline
     `SIGN_WITH=<nsec1…>`** (the value lives only in the shell/history, never in
     the repo); verify the signer is the app identity first (`nak key public` →
     `npub1yrnuj…` / hex `20e7c953…`). Use **`~/go/bin/zsp`** (v0.4.11) — the

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "skate-spots",
-  "version": "1.6.8",
+  "version": "1.7.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "skate-spots",
-      "version": "1.6.8",
+      "version": "1.7.0",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@bitcoinerlab/secp256k1": "^1.2.0",

package.json

@@ -1,7 +1,7 @@
 {
   "name": "skate-spots",
   "private": true,
-  "version": "1.6.8",
+  "version": "1.7.0",
   "license": "AGPL-3.0-only",
   "type": "module",
   "homepage": "https://skate-spots.org",

release-notes.txt

@@ -1,3 +1,25 @@
+🗺 The map is authoritative again
+- Spots and shops on the map now come only from the SkateSpots community relay,
+  so everyone sees the same pins — and it fixes the empty map some of you hit.
+- A missing spot was restored to the community relay.
+
+📲 Pass SkateSpots on
+- On Android, the About page now has a "Share SkateSpots" card: show a QR, use
+  the share sheet, or write the install link to an NFC tag.
+
+🔑 A clearer way in
+- Sign-in now leads with three plain choices — browser extension, signer app, or
+  sign in with your phone — plus a quiet secret-key option.
+- On desktop the welcome sign-in appears once per session for logged-out
+  visitors (dismissible).
+
+🛡 Security & stability
+- Updated core libraries (router, validation, Nostr client) and cleared the
+  known app-facing vulnerabilities; the dependency scanner now runs in the
+  scheduled job too.
+
+---
+
 🔑 A clearer way in
 - Sign-in now leads with three clear choices — browser extension, signer app
   (bunker/Amber), or scan a code to sign in with your phone — plus a quiet