@cometchat/skills-cli 2.1.0 → 2.2.0

package/dist/index.js

@@ -309,7 +309,10 @@ var EMPTY = {
   router: null,
   bundler: null,
   ssr_strategy: null,
-  env_prefix: null
+  env_prefix: null,
+  expo_mode: null,
+  expo_version: null,
+  react_native_version: null
 };
 function allDeps(pkg) {
   return {
@@ -320,6 +323,50 @@ function allDeps(pkg) {
 function hasViteConfig(root) {
   return pathExists(p(root, "vite.config.ts")) || pathExists(p(root, "vite.config.js")) || pathExists(p(root, "vite.config.mjs")) || pathExists(p(root, "vite.config.mts"));
 }
+function detectExpo(root, deps, pkg) {
+  if (!deps["expo"]) return null;
+  const expoVersion = extractVersion(deps["expo"]);
+  const rnVersion = deps["react-native"] ? extractVersion(deps["react-native"]) : null;
+  const hasExpoRouter = !!deps["expo-router"];
+  const mainIsExpoRouter = pkg.main === "expo-router/entry" || pkg.main === "expo-router/entry.js";
+  const hasAppLayout = pathExists(p(root, "app/_layout.tsx")) || pathExists(p(root, "app/_layout.ts")) || pathExists(p(root, "app/_layout.jsx")) || pathExists(p(root, "app/_layout.js"));
+  const usingExpoRouter = hasExpoRouter && (mainIsExpoRouter || hasAppLayout);
+  const expoMode = usingExpoRouter ? "expo-router" : "managed";
+  return {
+    framework: "expo",
+    framework_version: expoVersion,
+    router: usingExpoRouter ? "expo-router" : "react-navigation",
+    bundler: "metro",
+    ssr_strategy: "native-no-ssr",
+    env_prefix: "EXPO_PUBLIC_",
+    expo_mode: expoMode,
+    expo_version: expoVersion,
+    react_native_version: rnVersion
+  };
+}
+function detectBareReactNative(root, deps) {
+  if (!deps["react-native"]) return null;
+  if (deps["expo"]) return null;
+  const hasNativeIos = pathExists(p(root, "ios")) && (pathExists(p(root, "ios/Podfile")) || pathExists(p(root, "ios/Podfile.properties.json")));
+  const hasNativeAndroid = pathExists(p(root, "android")) && pathExists(p(root, "android/build.gradle"));
+  const hasRnConfig = pathExists(p(root, "react-native.config.js")) || pathExists(p(root, "react-native.config.ts"));
+  if (!hasNativeIos && !hasNativeAndroid && !hasRnConfig) {
+    return null;
+  }
+  const rnVersion = extractVersion(deps["react-native"]);
+  return {
+    framework: "react-native",
+    framework_version: rnVersion,
+    router: "react-navigation",
+    bundler: "metro",
+    ssr_strategy: "native-no-ssr",
+    env_prefix: null,
+    // Bare RN uses react-native-dotenv or a config module — no prefix
+    expo_mode: null,
+    expo_version: null,
+    react_native_version: rnVersion
+  };
+}
 function detectNextjs(root, deps) {
   if (!deps["next"]) return null;
   const version = extractVersion(deps["next"]);
@@ -421,7 +468,7 @@ function detectFramework(root) {
   const pkg = readJsonOrNull(p(root, "package.json"));
   if (!pkg) return EMPTY;
   const deps = allDeps(pkg);
-  return detectNextjs(root, deps) ?? detectAstro(root, deps) ?? detectReactRouter(root, deps) ?? detectReactjs(root, deps) ?? EMPTY;
+  return detectExpo(root, deps, pkg) ?? detectBareReactNative(root, deps) ?? detectNextjs(root, deps) ?? detectAstro(root, deps) ?? detectReactRouter(root, deps) ?? detectReactjs(root, deps) ?? EMPTY;
 }
 
 // src/detectors/package-manager.ts
@@ -633,10 +680,49 @@ function computeCompatibility(fw) {
     return {
       supported: false,
       warnings: [
-        "Could not detect a supported React framework. CometChat skills v2 supports: reactjs (Vite/CRA), nextjs, react-router (v6/v7), astro."
+        "Could not detect a supported React framework. CometChat skills supports: reactjs (Vite/CRA), nextjs, react-router (v6/v7), astro, expo (managed + Expo Router), and react-native (bare CLI)."
       ]
     };
   }
+  if (fw.framework === "expo") {
+    if (fw.expo_version) {
+      const expoMajor = parseInt(fw.expo_version.split(".")[0] ?? "0", 10);
+      if (expoMajor < 49) {
+        return {
+          supported: false,
+          warnings: [
+            `Expo SDK ${fw.expo_version} is older than the tested baseline (49+). CometChat React Native UI Kit v5 requires Expo SDK 49 or newer. Run \`npx expo install expo\` to upgrade.`
+          ]
+        };
+      }
+    }
+    if (fw.react_native_version) {
+      const rnMinor = parseFloat(fw.react_native_version.split(".").slice(0, 2).join("."));
+      if (!isNaN(rnMinor) && rnMinor < 0.72) {
+        warnings.push(
+          `React Native ${fw.react_native_version} is below the recommended baseline (0.72+). Some UI Kit v5 features may not work.`
+        );
+      }
+    }
+  }
+  if (fw.framework === "react-native") {
+    if (fw.react_native_version) {
+      const rnMinor = parseFloat(fw.react_native_version.split(".").slice(0, 2).join("."));
+      if (!isNaN(rnMinor) && rnMinor < 0.7) {
+        return {
+          supported: false,
+          warnings: [
+            `React Native ${fw.react_native_version} is older than the tested baseline (0.70+). CometChat React Native UI Kit v5 requires RN 0.70 or newer.`
+          ]
+        };
+      }
+      if (rnMinor < 0.72) {
+        warnings.push(
+          `React Native ${fw.react_native_version} is below the recommended baseline (0.72+). Upgrade is recommended.`
+        );
+      }
+    }
+  }
   if (fw.framework === "nextjs") {
     if (fw.router === null) {
       warnings.push(
@@ -750,6 +836,9 @@ async function runDetectors(root) {
     env_prefix: fw.env_prefix,
     uses_jsx: fw.uses_jsx,
     react_router_mode: fw.react_router_mode,
+    expo_mode: fw.expo_mode,
+    expo_version: fw.expo_version,
+    react_native_version: fw.react_native_version,
     package_manager,
     credentials,
     existing_integration,
@@ -826,10 +915,17 @@ function printHumanReadable(r) {
   lines.push("");
   lines.push(`  Project:           ${r.project_root}`);
   lines.push(`  Framework:         ${r.framework ?? "unknown"}${r.framework_version ? ` (${r.framework_version})` : ""}`);
+  if (r.expo_mode && r.expo_mode !== null) lines.push(`  Expo mode:         ${r.expo_mode}`);
+  if (r.react_native_version && r.framework === "expo") {
+    lines.push(`  React Native:      ${r.react_native_version}`);
+  }
   if (r.router !== null) lines.push(`  Router:            ${r.router}`);
   if (r.bundler !== null) lines.push(`  Bundler:           ${r.bundler}`);
   if (r.ssr_strategy !== null) lines.push(`  SSR strategy:      ${r.ssr_strategy}`);
   if (r.env_prefix !== null) lines.push(`  Env var prefix:    ${r.env_prefix}`);
+  if (r.framework === "react-native" && r.env_prefix === null) {
+    lines.push(`  Env var prefix:    (none \u2014 bare RN uses react-native-dotenv or a config module)`);
+  }
   if (r.package_manager !== null) lines.push(`  Package manager:   ${r.package_manager}`);
   if (r.uses_jsx === true) {
     lines.push(`  Source language:   JavaScript (.jsx) \u2014 \u26A0 apply will refuse, the v6 templates are TypeScript-only`);
@@ -2890,6 +2986,73 @@ function checkInitBeforeLogin(root, ownedAndPatchedFiles) {
   }
   return { status: "skip", reason: "no file calling CometChatUIKit.init found" };
 }
+function checkGestureHandlerLine1(root) {
+  const entryCandidates = ["index.js", "index.ts", "App.tsx", "App.jsx", "app/_layout.tsx", "app/_layout.js"];
+  for (const e of entryCandidates) {
+    if (!pathExists(p(root, e))) continue;
+    const content = readFileOrNull(p(root, e));
+    if (!content) continue;
+    const firstLine = content.split(/\r?\n/)[0]?.trim() ?? "";
+    if (/^import\s+['"]react-native-gesture-handler['"]/.test(firstLine)) {
+      return { status: "pass" };
+    }
+    return {
+      status: "fail",
+      reason: `${e}: \`import "react-native-gesture-handler"\` is not the first line`
+    };
+  }
+  return { status: "skip", reason: "no entry file found" };
+}
+function checkFourWrapperChain(root, ownedAndPatchedFiles) {
+  const wrappers = ["GestureHandlerRootView", "SafeAreaProvider", "CometChatThemeProvider", "CometChatProvider"];
+  const hits = /* @__PURE__ */ new Set();
+  for (const file of ownedAndPatchedFiles) {
+    const content = readFileOrNull(p(root, file));
+    if (!content) continue;
+    for (const w of wrappers) {
+      if (content.includes(w)) hits.add(w);
+    }
+  }
+  const missing = wrappers.filter((w) => !hits.has(w));
+  if (missing.length === 0) return { status: "pass" };
+  return {
+    status: "fail",
+    reason: `missing wrapper(s): ${missing.join(", ")}`
+  };
+}
+function checkHideReplyInThread(root, ownedAndPatchedFiles, ownedFiles) {
+  for (const file of ownedAndPatchedFiles) {
+    const content = readFileOrNull(p(root, file));
+    if (content && content.includes("CometChatThreadHeader")) {
+      return { status: "pass" };
+    }
+  }
+  for (const file of ownedFiles) {
+    const content = readFileOrNull(p(root, file));
+    if (!content) continue;
+    const lists = (content.match(/<\s*CometChatMessageList\b/g) ?? []).length;
+    const flagged = (content.match(/hideReplyInThreadOption/g) ?? []).length;
+    if (lists > flagged) {
+      return {
+        status: "fail",
+        reason: `${file}: ${lists - flagged} MessageList without hideReplyInThreadOption`
+      };
+    }
+  }
+  return { status: "pass" };
+}
+function checkPodInstall(root) {
+  if (!pathExists(p(root, "ios/Podfile"))) {
+    return { status: "skip", reason: "no ios/Podfile (Expo managed or no iOS target)" };
+  }
+  if (pathExists(p(root, "ios/Podfile.lock"))) {
+    return { status: "pass" };
+  }
+  return {
+    status: "fail",
+    reason: "ios/Podfile.lock missing \u2014 run `cd ios && pod install && cd ..`"
+  };
+}
 function checkErrorUiVisible(root, ownedFiles) {
   for (const file of ownedFiles) {
     const content = readFileOrNull(p(root, file));
@@ -2927,7 +3090,15 @@ async function verify(args) {
     ...state2.files_owned,
     ...state2.files_patched.map((p2) => p2.path)
   ];
-  const checks = {
+  const isRn2 = state2.framework === "expo" || state2.framework === "react-native";
+  const checks = isRn2 ? {
+    gesture_handler_line_1: checkGestureHandlerLine1(root),
+    four_wrapper_chain_present: checkFourWrapperChain(root, ownedAndPatched),
+    hide_reply_in_thread_option: checkHideReplyInThread(root, ownedAndPatched, state2.files_owned),
+    no_auth_key_in_source: checkNoAuthKeyInSource(root, state2.files_owned),
+    init_before_login: checkInitBeforeLogin(root, ownedAndPatched),
+    ...state2.framework === "react-native" ? { pod_install_run: checkPodInstall(root) } : {}
+  } : {
     css_variables_imported_once: checkCssVariablesImport(root, ownedAndPatched),
     init_before_login: checkInitBeforeLogin(root, ownedAndPatched),
     render_gated_on_login_resolve: checkRenderGatedOnLogin(root, ownedAndPatched),
@@ -3337,24 +3508,485 @@ function printHumanReadable7(r) {
 init_state();
 import { readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join10, resolve as resolve9 } from "node:path";
+init_config();
+
+// src/utils/rn-production-templates.ts
+var HEADER = `/**
+ * /cometchat-token \u2014 server-side endpoint that mints CometChat auth tokens.
+ *
+ * This is the production-mode replacement for client-side login({ uid }) +
+ * Auth Key. The Auth Key NEVER leaves the server. The RN app calls this
+ * endpoint to get a short-lived auth token, then passes it to
+ * CometChatUIKit.login({ authToken }).
+ *
+ * Generated by \`cometchat production-auth\`. Customize freely:
+ *   - Replace the ?uid= query param with real auth: read the session token,
+ *     extract the user ID, map it to a CometChat UID.
+ *   - Add rate limiting if exposed publicly.
+ *   - Cache tokens per UID for short windows to reduce CometChat API load.
+ *
+ * Security: this file MUST NOT use EXPO_PUBLIC_ prefixes for the Auth Key.
+ * The whole point is to keep the Auth Key out of the client bundle.
+ */`;
+var EXPRESS_TEMPLATE = `${HEADER}
+import express from "express";
+
+const app = express();
+app.use(express.json());
+
+const COMETCHAT_APP_ID = process.env.COMETCHAT_APP_ID!;
+const COMETCHAT_REGION = process.env.COMETCHAT_REGION!;
+const COMETCHAT_AUTH_KEY = process.env.COMETCHAT_AUTH_KEY!;
+
+app.get("/cometchat-token", async (req, res) => {
+  // \u26A0 Replace this with your real auth: extract the session token, verify it,
+  // and map your user record to a CometChat UID. Do not trust the query param.
+  const uid = typeof req.query.uid === "string" ? req.query.uid : "cometchat-uid-1";
+
+  if (!COMETCHAT_APP_ID || !COMETCHAT_REGION || !COMETCHAT_AUTH_KEY) {
+    return res.status(500).json({ error: "CometChat credentials not configured on the server" });
+  }
+
+  try {
+    const upstream = await fetch(
+      \`https://\${COMETCHAT_APP_ID}.api-\${COMETCHAT_REGION}.cometchat.io/v3/users/\${encodeURIComponent(uid)}/auth_tokens\`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          appid: COMETCHAT_APP_ID,
+          apikey: COMETCHAT_AUTH_KEY,
+        },
+      },
+    );
+    if (!upstream.ok) {
+      const text = await upstream.text();
+      return res.status(502).json({ error: \`CometChat token mint failed (\${upstream.status})\`, detail: text });
+    }
+    const body = (await upstream.json()) as { data?: { authToken?: string } };
+    const authToken = body.data?.authToken;
+    if (!authToken) {
+      return res.status(502).json({ error: "CometChat API returned no authToken" });
+    }
+    return res.json({ authToken });
+  } catch (err) {
+    return res.status(500).json({ error: "Upstream CometChat request failed", detail: String(err) });
+  }
+});
+
+const PORT = Number(process.env.PORT ?? 8787);
+app.listen(PORT, () => console.log(\`cometchat-token endpoint listening on :\${PORT}\`));
+`;
+var HONO_TEMPLATE = `${HEADER}
+import { Hono } from "hono";
+
+const app = new Hono();
+
+app.get("/cometchat-token", async (c) => {
+  const COMETCHAT_APP_ID = process.env.COMETCHAT_APP_ID!;
+  const COMETCHAT_REGION = process.env.COMETCHAT_REGION!;
+  const COMETCHAT_AUTH_KEY = process.env.COMETCHAT_AUTH_KEY!;
+
+  // \u26A0 Replace this with your real auth: extract the session token, verify it,
+  // and map your user record to a CometChat UID. Do not trust the query param.
+  const uid = c.req.query("uid") ?? "cometchat-uid-1";
+
+  if (!COMETCHAT_APP_ID || !COMETCHAT_REGION || !COMETCHAT_AUTH_KEY) {
+    return c.json({ error: "CometChat credentials not configured on the server" }, 500);
+  }
+
+  try {
+    const upstream = await fetch(
+      \`https://\${COMETCHAT_APP_ID}.api-\${COMETCHAT_REGION}.cometchat.io/v3/users/\${encodeURIComponent(uid)}/auth_tokens\`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          appid: COMETCHAT_APP_ID,
+          apikey: COMETCHAT_AUTH_KEY,
+        },
+      },
+    );
+    if (!upstream.ok) {
+      return c.json({ error: \`CometChat token mint failed (\${upstream.status})\` }, 502);
+    }
+    const body = (await upstream.json()) as { data?: { authToken?: string } };
+    const authToken = body.data?.authToken;
+    if (!authToken) return c.json({ error: "CometChat API returned no authToken" }, 502);
+    return c.json({ authToken });
+  } catch (err) {
+    return c.json({ error: "Upstream CometChat request failed", detail: String(err) }, 500);
+  }
+});
+
+export default app;
+`;
+var FIREBASE_TEMPLATE = `${HEADER}
+import { onRequest } from "firebase-functions/v2/https";
+import { defineSecret } from "firebase-functions/params";
+
+const COMETCHAT_APP_ID = defineSecret("COMETCHAT_APP_ID");
+const COMETCHAT_REGION = defineSecret("COMETCHAT_REGION");
+const COMETCHAT_AUTH_KEY = defineSecret("COMETCHAT_AUTH_KEY");
+
+export const cometchatToken = onRequest(
+  { secrets: [COMETCHAT_APP_ID, COMETCHAT_REGION, COMETCHAT_AUTH_KEY] },
+  async (req, res) => {
+    // \u26A0 Replace this with your real auth: verify Firebase ID token, map the
+    // Firebase uid to a CometChat UID. Do not trust the query param.
+    const uid = typeof req.query.uid === "string" ? req.query.uid : "cometchat-uid-1";
+
+    try {
+      const upstream = await fetch(
+        \`https://\${COMETCHAT_APP_ID.value()}.api-\${COMETCHAT_REGION.value()}.cometchat.io/v3/users/\${encodeURIComponent(uid)}/auth_tokens\`,
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            appid: COMETCHAT_APP_ID.value(),
+            apikey: COMETCHAT_AUTH_KEY.value(),
+          },
+        },
+      );
+      if (!upstream.ok) {
+        res.status(502).json({ error: \`CometChat token mint failed (\${upstream.status})\` });
+        return;
+      }
+      const body = (await upstream.json()) as { data?: { authToken?: string } };
+      const authToken = body.data?.authToken;
+      if (!authToken) {
+        res.status(502).json({ error: "CometChat API returned no authToken" });
+        return;
+      }
+      res.json({ authToken });
+    } catch (err) {
+      res.status(500).json({ error: "Upstream CometChat request failed", detail: String(err) });
+    }
+  },
+);
+`;
+var NEXTJS_API_TEMPLATE = `${HEADER}
+import { NextRequest, NextResponse } from "next/server";
+
+const COMETCHAT_APP_ID = process.env.COMETCHAT_APP_ID!;
+const COMETCHAT_REGION = process.env.COMETCHAT_REGION!;
+const COMETCHAT_AUTH_KEY = process.env.COMETCHAT_AUTH_KEY!;
+
+export async function GET(request: NextRequest) {
+  // \u26A0 Replace this with your real auth: read the session, extract the user ID,
+  // then map it to a CometChat UID. Do not trust the query param in production.
+  const uid = request.nextUrl.searchParams.get("uid") ?? "cometchat-uid-1";
+
+  if (!COMETCHAT_APP_ID || !COMETCHAT_REGION || !COMETCHAT_AUTH_KEY) {
+    return NextResponse.json(
+      { error: "CometChat credentials not configured on the server" },
+      { status: 500 },
+    );
+  }
+
+  try {
+    const upstream = await fetch(
+      \`https://\${COMETCHAT_APP_ID}.api-\${COMETCHAT_REGION}.cometchat.io/v3/users/\${encodeURIComponent(uid)}/auth_tokens\`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          appid: COMETCHAT_APP_ID,
+          apikey: COMETCHAT_AUTH_KEY,
+        },
+      },
+    );
+    if (!upstream.ok) {
+      const text = await upstream.text();
+      return NextResponse.json({ error: \`CometChat token mint failed (\${upstream.status})\`, detail: text }, { status: 502 });
+    }
+    const body = (await upstream.json()) as { data?: { authToken?: string } };
+    const authToken = body.data?.authToken;
+    if (!authToken) return NextResponse.json({ error: "CometChat API returned no authToken" }, { status: 502 });
+    return NextResponse.json({ authToken });
+  } catch (err) {
+    return NextResponse.json({ error: "Upstream CometChat request failed", detail: String(err) }, { status: 500 });
+  }
+}
+`;
+var USER_MGMT_HEADER = `/**
+ * /cometchat-user \u2014 server-side user CRUD endpoint.
+ *
+ * Proxies to the CometChat REST API to keep your AUTH_KEY out of the client.
+ * Wire this into your app's signup / profile-update / account-deletion flows
+ * so every app user has a matching CometChat user.
+ *
+ * Generated by \`cometchat add-user-mgmt\`. Ships UNAUTHENTICATED \u2014 you MUST
+ * add session checks (verify the caller's auth token / cookie) before
+ * deploying. Anyone hitting this endpoint can create/update/delete arbitrary
+ * CometChat users.
+ */`;
+var EXPRESS_USER_TEMPLATE = `${USER_MGMT_HEADER}
+import express from "express";
+
+const app = express();
+app.use(express.json());
+
+const APP_ID = process.env.COMETCHAT_APP_ID!;
+const REGION = process.env.COMETCHAT_REGION!;
+const AUTH_KEY = process.env.COMETCHAT_AUTH_KEY!;
+const BASE = \`https://\${APP_ID}.api-\${REGION}.cometchat.io/v3/users\`;
+
+async function cometchat(method: string, path: string, body?: unknown): Promise<Response> {
+  return fetch(\`\${BASE}\${path}\`, {
+    method,
+    headers: { "Content-Type": "application/json", appid: APP_ID, apikey: AUTH_KEY },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+}
+
+app.post("/cometchat-user", async (req, res) => {
+  // \u26A0 Add auth check here \u2014 verify the caller owns the uid they're creating.
+  const { uid, name, avatar, metadata } = req.body ?? {};
+  if (!uid || !name) return res.status(400).json({ error: "uid + name required" });
+  const r = await cometchat("POST", "", { uid, name, avatar, metadata });
+  return res.status(r.ok ? 201 : r.status).json(await r.json());
+});
+
+app.patch("/cometchat-user/:uid", async (req, res) => {
+  const r = await cometchat("PUT", \`/\${encodeURIComponent(req.params.uid)}\`, req.body);
+  return res.status(r.ok ? 200 : r.status).json(await r.json());
+});
+
+app.delete("/cometchat-user/:uid", async (req, res) => {
+  const r = await cometchat("DELETE", \`/\${encodeURIComponent(req.params.uid)}?permanent=true\`);
+  return res.status(r.ok ? 200 : r.status).json(r.ok ? { deleted: true } : await r.json());
+});
+
+const PORT = Number(process.env.PORT ?? 8787);
+app.listen(PORT, () => console.log(\`cometchat-user endpoint listening on :\${PORT}\`));
+`;
+var HONO_USER_TEMPLATE = `${USER_MGMT_HEADER}
+import { Hono } from "hono";
+
+const app = new Hono();
+
+async function cometchat(method: string, path: string, body?: unknown): Promise<Response> {
+  const APP_ID = process.env.COMETCHAT_APP_ID!;
+  const REGION = process.env.COMETCHAT_REGION!;
+  const AUTH_KEY = process.env.COMETCHAT_AUTH_KEY!;
+  return fetch(\`https://\${APP_ID}.api-\${REGION}.cometchat.io/v3/users\${path}\`, {
+    method,
+    headers: { "Content-Type": "application/json", appid: APP_ID, apikey: AUTH_KEY },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+}
+
+app.post("/cometchat-user", async (c) => {
+  // \u26A0 Add auth check here \u2014 verify the caller owns the uid they're creating.
+  const { uid, name, avatar, metadata } = (await c.req.json()) ?? {};
+  if (!uid || !name) return c.json({ error: "uid + name required" }, 400);
+  const r = await cometchat("POST", "", { uid, name, avatar, metadata });
+  return c.json(await r.json(), r.ok ? 201 : (r.status as 500));
+});
+
+app.patch("/cometchat-user/:uid", async (c) => {
+  const r = await cometchat("PUT", \`/\${encodeURIComponent(c.req.param("uid"))}\`, await c.req.json());
+  return c.json(await r.json(), r.ok ? 200 : (r.status as 500));
+});
+
+app.delete("/cometchat-user/:uid", async (c) => {
+  const r = await cometchat("DELETE", \`/\${encodeURIComponent(c.req.param("uid"))}?permanent=true\`);
+  return c.json(r.ok ? { deleted: true } : await r.json(), r.ok ? 200 : (r.status as 500));
+});
+
+export default app;
+`;
+var FIREBASE_USER_TEMPLATE = `${USER_MGMT_HEADER}
+import { onRequest } from "firebase-functions/v2/https";
+import { defineSecret } from "firebase-functions/params";
+
+const COMETCHAT_APP_ID = defineSecret("COMETCHAT_APP_ID");
+const COMETCHAT_REGION = defineSecret("COMETCHAT_REGION");
+const COMETCHAT_AUTH_KEY = defineSecret("COMETCHAT_AUTH_KEY");
+
+async function cometchat(method: string, path: string, body?: unknown): Promise<Response> {
+  return fetch(\`https://\${COMETCHAT_APP_ID.value()}.api-\${COMETCHAT_REGION.value()}.cometchat.io/v3/users\${path}\`, {
+    method,
+    headers: {
+      "Content-Type": "application/json",
+      appid: COMETCHAT_APP_ID.value(),
+      apikey: COMETCHAT_AUTH_KEY.value(),
+    },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+}
+
+export const cometchatUser = onRequest(
+  { secrets: [COMETCHAT_APP_ID, COMETCHAT_REGION, COMETCHAT_AUTH_KEY] },
+  async (req, res) => {
+    // \u26A0 Add auth check: verify Firebase ID token, authorize the caller.
+    const method = req.method;
+    const segs = (req.path ?? "").split("/").filter(Boolean); // ["cometchat-user"] or ["cometchat-user", "<uid>"]
+    const uid = segs.length >= 2 ? segs[1] : null;
+
+    if (method === "POST" && !uid) {
+      const { uid: newUid, name, avatar, metadata } = (req.body ?? {}) as Record<string, unknown>;
+      if (!newUid || !name) { res.status(400).json({ error: "uid + name required" }); return; }
+      const r = await cometchat("POST", "", { uid: newUid, name, avatar, metadata });
+      res.status(r.ok ? 201 : r.status).json(await r.json()); return;
+    }
+    if (method === "PATCH" && uid) {
+      const r = await cometchat("PUT", \`/\${encodeURIComponent(uid)}\`, req.body);
+      res.status(r.ok ? 200 : r.status).json(await r.json()); return;
+    }
+    if (method === "DELETE" && uid) {
+      const r = await cometchat("DELETE", \`/\${encodeURIComponent(uid)}?permanent=true\`);
+      res.status(r.ok ? 200 : r.status).json(r.ok ? { deleted: true } : await r.json()); return;
+    }
+    res.status(405).json({ error: "method/path not allowed" });
+  },
+);
+`;
+var NEXTJS_USER_TEMPLATE = `${USER_MGMT_HEADER}
+import { NextRequest, NextResponse } from "next/server";
+
+const APP_ID = process.env.COMETCHAT_APP_ID!;
+const REGION = process.env.COMETCHAT_REGION!;
+const AUTH_KEY = process.env.COMETCHAT_AUTH_KEY!;
+const BASE = \`https://\${APP_ID}.api-\${REGION}.cometchat.io/v3/users\`;
+
+async function cometchat(method: string, path: string, body?: unknown): Promise<Response> {
+  return fetch(\`\${BASE}\${path}\`, {
+    method,
+    headers: { "Content-Type": "application/json", appid: APP_ID, apikey: AUTH_KEY },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+}
+
+// POST /api/cometchat-user \u2014 create user. Wire into your signup flow.
+export async function POST(request: NextRequest) {
+  // \u26A0 Add auth check here \u2014 verify the caller's session.
+  const { uid, name, avatar, metadata } = await request.json();
+  if (!uid || !name) return NextResponse.json({ error: "uid + name required" }, { status: 400 });
+  const r = await cometchat("POST", "", { uid, name, avatar, metadata });
+  return NextResponse.json(await r.json(), { status: r.ok ? 201 : r.status });
+}
+
+// PATCH /api/cometchat-user?uid=<id> \u2014 update user.
+export async function PATCH(request: NextRequest) {
+  const uid = request.nextUrl.searchParams.get("uid");
+  if (!uid) return NextResponse.json({ error: "uid query param required" }, { status: 400 });
+  const r = await cometchat("PUT", \`/\${encodeURIComponent(uid)}\`, await request.json());
+  return NextResponse.json(await r.json(), { status: r.ok ? 200 : r.status });
+}
+
+// DELETE /api/cometchat-user?uid=<id> \u2014 permanent user delete.
+export async function DELETE(request: NextRequest) {
+  const uid = request.nextUrl.searchParams.get("uid");
+  if (!uid) return NextResponse.json({ error: "uid query param required" }, { status: 400 });
+  const r = await cometchat("DELETE", \`/\${encodeURIComponent(uid)}?permanent=true\`);
+  return NextResponse.json(r.ok ? { deleted: true } : await r.json(), { status: r.ok ? 200 : r.status });
+}
+`;
+function rnUserMgmtTemplate(backend) {
+  switch (backend) {
+    case "express":
+      return {
+        filename: "cometchat-user.ts",
+        content: EXPRESS_USER_TEMPLATE,
+        deps: ["express"],
+        runCommand: "npx tsx cometchat-user.ts",
+        label: "Express user-mgmt endpoint"
+      };
+    case "hono":
+      return {
+        filename: "cometchat-user.ts",
+        content: HONO_USER_TEMPLATE,
+        deps: ["hono"],
+        runCommand: "npx tsx cometchat-user.ts  # or bun run",
+        label: "Hono user-mgmt endpoint"
+      };
+    case "firebase-functions":
+      return {
+        filename: "cometchatUser.ts",
+        content: FIREBASE_USER_TEMPLATE,
+        deps: ["firebase-functions"],
+        runCommand: "firebase deploy --only functions",
+        label: "Firebase Functions user-mgmt endpoint"
+      };
+    case "nextjs-api":
+      return {
+        filename: "route.ts",
+        content: NEXTJS_USER_TEMPLATE,
+        deps: [],
+        runCommand: null,
+        label: "Next.js API route (drop into src/app/api/cometchat-user/route.ts)"
+      };
+  }
+}
+function rnBackendTemplate(backend) {
+  switch (backend) {
+    case "express":
+      return {
+        filename: "cometchat-token.ts",
+        content: EXPRESS_TEMPLATE,
+        deps: ["express"],
+        runCommand: "npx tsx cometchat-token.ts",
+        label: "Express server"
+      };
+    case "hono":
+      return {
+        filename: "cometchat-token.ts",
+        content: HONO_TEMPLATE,
+        deps: ["hono"],
+        runCommand: "npx tsx cometchat-token.ts  # or bun run, depending on your runtime",
+        label: "Hono router (works with Bun, Cloudflare Workers, Node, Deno)"
+      };
+    case "firebase-functions":
+      return {
+        filename: "cometchatToken.ts",
+        content: FIREBASE_TEMPLATE,
+        deps: ["firebase-functions"],
+        runCommand: "firebase deploy --only functions",
+        label: "Firebase Cloud Functions (v2)"
+      };
+    case "nextjs-api":
+      return {
+        filename: "route.ts",
+        content: NEXTJS_API_TEMPLATE,
+        deps: [],
+        runCommand: null,
+        label: "Next.js App Router API route (add to an existing Next app under src/app/api/cometchat-token/route.ts)"
+      };
+  }
+}
+var RN_BACKENDS = ["express", "hono", "firebase-functions", "nextjs-api"];
+
+// src/commands/production-auth.ts
 var HELP8 = `
 cometchat production-auth \u2014 upgrade dev integration to server-side tokens
 
-Usage:
+Usage (web \u2014 nextjs / react-router / astro):
   cometchat production-auth [--path <p>] [--json]
 
+Usage (React Native \u2014 expo / react-native):
+  cometchat production-auth --backend <express|hono|firebase-functions|nextjs-api>
+                            [--out-dir <path>] [--path <p>] [--json]
+
 What this does:
-  Replaces client-side login(UID) + setAuthKey() with a server-side token
-  endpoint so your AUTH_KEY never reaches the browser. Creates the API
-  route file and auto-rewrites the canonical client login chain into a
-  fetch('/api/cometchat-token?uid=...') \u2192 loginWithAuthToken flow. If the
-  client file was customized, the auto-patch is skipped and manual steps
-  are surfaced. Supports nextjs, react-router, and astro.
+  Web: replaces client-side login(UID) + setAuthKey() with a server-side
+       token endpoint so your AUTH_KEY never reaches the browser. Creates
+       the API route file and auto-rewrites the client login chain.
+  RN:  writes a standalone token endpoint (your choice of backend \u2014 Express,
+       Hono, Firebase Functions, or a Next.js API route file you drop into
+       an adjacent Next app). Does not patch the RN client \u2014 prints manual
+       steps to update your CometChatProvider.
 
 Flags:
-  --path <p>  Project root (defaults to cwd).
-  --json      Machine-readable JSON output.
-  --help, -h  Show this help.
+  --backend <name>  (RN only) Backend flavor. One of: express, hono,
+                    firebase-functions, nextjs-api.
+  --out-dir <path>  (RN only) Directory to write the endpoint file to
+                    (default: ./server for express/hono/nextjs-api,
+                    ./functions/src for firebase-functions).
+  --path <p>        Project root (defaults to cwd).
+  --json            Machine-readable JSON output.
+  --help, -h        Show this help.
 `;
 function isJsonMode9(args) {
   return args.flags.json === true || args.flags.json === "true";
@@ -3425,13 +4057,29 @@ async function productionAuth(args) {
     return 0;
   }
   const root = projectPath8(args);
-  if (!hasState(root)) {
+  const stateFramework = hasState(root) ? readState(root)?.framework ?? null : null;
+  const cfgFramework = readConfig(root)?.framework ?? null;
+  const resolvedFramework = stateFramework ?? cfgFramework;
+  if (!resolvedFramework) {
     const result2 = {
       status: "no-integration",
       framework: "",
       files_created: [],
       next_steps: [],
-      error: "API_ERROR: ERR_NO_INTEGRATION No integration found. Run `cometchat apply` first to create the dev integration, then run this command to upgrade to production-ready auth."
+      error: "API_ERROR: ERR_NO_INTEGRATION No integration found. Run `cometchat apply` (web) or `/cometchat` (React Native) first to create the dev integration, then re-run this command."
+    };
+    return outputResult5(args, result2, 1);
+  }
+  if (resolvedFramework === "expo" || resolvedFramework === "react-native") {
+    return productionAuthRn(args, root, resolvedFramework);
+  }
+  if (!hasState(root)) {
+    const result2 = {
+      status: "no-integration",
+      framework: resolvedFramework,
+      files_created: [],
+      next_steps: [],
+      error: "API_ERROR: ERR_NO_STATE Web production-auth requires state.json. Run `cometchat apply` first (or `cometchat state record` if your integration was hand-written)."
     };
     return outputResult5(args, result2, 1);
   }
@@ -3639,6 +4287,84 @@ function printHumanReadable8(r) {
   lines.push("");
   console.log(lines.join("\n"));
 }
+function productionAuthRn(args, root, framework) {
+  const backendFlag = args.flags.backend;
+  const outDirFlag = args.flags["out-dir"];
+  if (typeof backendFlag !== "string" || !RN_BACKENDS.includes(backendFlag)) {
+    const result2 = {
+      status: "error",
+      framework,
+      files_created: [],
+      next_steps: [],
+      error: `React Native production-auth requires --backend <${RN_BACKENDS.join("|")}>. Example: \`cometchat production-auth --backend express --out-dir ./server\`. RN apps don't have a colocated backend, so you pick which flavor to scaffold.`
+    };
+    return outputResult5(args, result2, 1);
+  }
+  const backend = backendFlag;
+  const tpl = rnBackendTemplate(backend);
+  const defaultOutDir = backend === "firebase-functions" ? "functions/src" : backend === "nextjs-api" ? "src/app/api/cometchat-token" : "server";
+  const outDir = typeof outDirFlag === "string" ? outDirFlag : defaultOutDir;
+  const filePath = join10(outDir, tpl.filename);
+  let writeResult;
+  try {
+    writeResult = applyWrites(root, [
+      { type: "create", path: filePath, content: tpl.content, owned: true }
+    ]);
+  } catch (err) {
+    return errorOut3(args, "RN production-auth apply failed: " + (err instanceof Error ? err.message : String(err)));
+  }
+  if (writeResult.files_skipped.length > 0) {
+    const result2 = {
+      status: "already-applied",
+      framework,
+      files_created: [],
+      next_steps: [
+        `Skipped: ${filePath} already exists. Delete it to regenerate with a different --backend.`
+      ],
+      error: `API_ERROR: ERR_ALREADY_APPLIED ${filePath} already exists.`
+    };
+    return outputResult5(args, result2, 0);
+  }
+  const depsStr = tpl.deps.length > 0 ? tpl.deps.join(" ") : null;
+  const restart = framework === "expo" ? "npx expo start --clear" : "npm start -- --reset-cache";
+  const next_steps = [
+    `1. Backend deps: ${depsStr ? `\`npm install ${depsStr}\` in ${outDir.split("/")[0] ?? outDir}` : "(none \u2014 route file ships ready to deploy)"}.`,
+    `2. Set server env vars (NO EXPO_PUBLIC_ prefix):`,
+    `     COMETCHAT_APP_ID=<your-app-id>`,
+    `     COMETCHAT_REGION=<us|eu|in>`,
+    `     COMETCHAT_AUTH_KEY=<your-auth-key>   # SERVER-ONLY, keep out of the RN bundle`,
+    `3. Start the backend: ${tpl.runCommand ?? "(deploy per platform convention)"}`,
+    `4. Remove \`EXPO_PUBLIC_COMETCHAT_AUTH_KEY\` (or bare COMETCHAT_AUTH_KEY for bare RN) from your RN .env \u2014 the client no longer needs it.`,
+    `5. Client-side change in your CometChatProvider:`,
+    `   - Remove \`.setAuthKey(...)\` from UIKitSettingsBuilder (keep setAppId + setRegion).`,
+    `   - In your ensureLoggedIn() helper, replace \`login({ uid })\` with:`,
+    `       const res = await fetch(\`\${API_BASE}/cometchat-token?uid=\${uid}\`);`,
+    `       const { authToken } = await res.json();`,
+    `       await CometChatUIKit.login({ authToken });`,
+    `6. Restart Metro with \`${restart}\` and log in. The CometChat SDK never sees your Auth Key anymore.`,
+    `   See cometchat-native-production skill for auth-provider integrations (Firebase Auth, Supabase, Clerk, Auth0) and token caching.`
+  ];
+  appendAuditEntry(root, {
+    command: "production-auth",
+    summary: `Scaffolded ${tpl.label} token endpoint at ${filePath}`,
+    inputs: { framework, backend, "out-dir": outDir },
+    decisions: {
+      backend: `${tpl.label}. RN apps call out to a separate backend (not colocated), so the CLI scaffolds just the endpoint file; you wire the client-side change manually in CometChatProvider because the RN login flow structure varies across dispatchers.`,
+      file: `Wrote ${filePath} (owned). Deps: ${depsStr ?? "none"}.`
+    },
+    files_patched: [filePath],
+    next_actions: next_steps
+  });
+  const result = {
+    status: "applied",
+    framework,
+    files_created: [filePath],
+    client_patch: "n/a",
+    // RN client-side is manual — too much structural variation to auto-patch
+    next_steps
+  };
+  return outputResult5(args, result, 0);
+}
 
 // src/commands/apply-theme.ts
 init_state();
@@ -3803,6 +4529,75 @@ function buildOverrideBlock(theme) {
   }
   return { css: lines.join("\n") + "\n", variables: vars };
 }
+function isReactNativeFramework(framework) {
+  return framework === "expo" || framework === "react-native";
+}
+function buildRnThemeSource(theme, useTs) {
+  const vars = [];
+  const lightColorLines = [];
+  lightColorLines.push(`      primary: "${theme.primaryColor}",`);
+  vars.push("color.primary");
+  if (theme.textColor) {
+    lightColorLines.push(`      textPrimary: "${theme.textColor}",`);
+    vars.push("color.textPrimary");
+  }
+  if (theme.backgroundColor) {
+    lightColorLines.push(`      background1: "${theme.backgroundColor}",`);
+    vars.push("color.background1");
+  }
+  const typographyLines = [];
+  if (theme.fontFamily) {
+    typographyLines.push(`      body1: { fontFamily: "${theme.fontFamily}" },`);
+    typographyLines.push(`      heading1: { fontFamily: "${theme.fontFamily}" },`);
+    vars.push("typography.body1.fontFamily");
+    vars.push("typography.heading1.fontFamily");
+  }
+  const darkBlock = [];
+  if (theme.darkMode) {
+    darkBlock.push("  dark: {");
+    darkBlock.push("    color: {");
+    darkBlock.push(`      primary: "${theme.primaryColor}",`);
+    darkBlock.push(`      background1: "#0A0A0A",`);
+    darkBlock.push(`      background2: "#1A1A1A",`);
+    darkBlock.push(`      background3: "#2A2A2A",`);
+    darkBlock.push(`      textPrimary: "#EDEDED",`);
+    darkBlock.push("    },");
+    darkBlock.push("  },");
+    vars.push("dark.color.primary");
+    vars.push("dark.color.background1-3");
+    vars.push("dark.color.textPrimary");
+  }
+  const exportType = useTs ? ": Partial<CometChatTheme>" : "";
+  const lines = [];
+  lines.push("// CometChat theme \u2014 generated by `cometchat apply-theme`");
+  lines.push("// Pass this to <CometChatThemeProvider theme={cometchatTheme}> in your app root.");
+  lines.push("");
+  if (useTs) {
+    lines.push(`import type { CometChatTheme } from "@cometchat/chat-uikit-react-native";`);
+    lines.push("");
+  }
+  lines.push(`export const cometchatTheme${exportType} = {`);
+  lines.push("  light: {");
+  lines.push("    color: {");
+  lightColorLines.forEach((l) => lines.push(l));
+  lines.push("    },");
+  if (typographyLines.length > 0) {
+    lines.push("    typography: {");
+    typographyLines.forEach((l) => lines.push(l));
+    lines.push("    },");
+  }
+  lines.push("  },");
+  if (darkBlock.length > 0) {
+    darkBlock.forEach((l) => lines.push(l));
+  }
+  lines.push("};");
+  lines.push("");
+  return { content: lines.join("\n"), variables: vars };
+}
+function rnThemePath(root) {
+  const isTs = pathExists(p(root, "tsconfig.json"));
+  return isTs ? "providers/CometChatTheme.ts" : "providers/CometChatTheme.js";
+}
 function buildThemeOp(framework, cssBlock, root) {
   const targets = {
     reactjs: ["src/index.css", "src/main.css", "src/styles.css"],
@@ -3904,6 +4699,54 @@ async function applyTheme(args) {
       `Error: pass either --preset <name> or --primary-color <hex>. Available presets: ${listPresets().join(", ")}. Or use --primary-color #6852D6 with optional --text-color, --background-color, --font-family, --border-radius, --dark-mode.`
     );
   }
+  if (isReactNativeFramework(framework)) {
+    const themePath = rnThemePath(root);
+    const useTs = themePath.endsWith(".ts");
+    const { content, variables: rnVariables } = buildRnThemeSource(theme, useTs);
+    let writeResult2;
+    try {
+      writeResult2 = applyWrites(root, [
+        { type: "create", path: themePath, content, owned: true }
+      ]);
+    } catch (err) {
+      return errorOut4(args, "Theme apply failed: " + (err instanceof Error ? err.message : String(err)));
+    }
+    const wasSkipped2 = writeResult2.files_skipped.length > 0;
+    const wireHint = `Wire it in: import { cometchatTheme } from "./${themePath.replace(/\.(ts|js)$/, "")}"; then <CometChatThemeProvider theme={cometchatTheme}>\u2026</CometChatThemeProvider>`;
+    const result2 = {
+      status: "applied",
+      framework,
+      file_modified: themePath,
+      variables_applied: rnVariables,
+      next_steps: [
+        wasSkipped2 ? `Skipped: ${themePath} already exists. Delete it to regenerate.` : `Theme object written to ${themePath}.`,
+        wireHint,
+        framework === "expo" ? "Restart Metro with `npx expo start --clear` to pick up the new theme." : "Restart Metro with `npm start -- --reset-cache` to pick up the new theme.",
+        "To remove the theme, delete the file and drop the `theme` prop on CometChatThemeProvider."
+      ]
+    };
+    if (!wasSkipped2) {
+      const presetFlag = getStringFlag3(args, "preset");
+      appendAuditEntry(root, {
+        command: "apply-theme",
+        summary: presetFlag ? `Applied "${presetFlag}" theme preset to ${framework} integration` : `Applied custom theme overrides to ${framework} integration`,
+        inputs: {
+          framework,
+          ...presetFlag ? { preset: presetFlag } : {},
+          ...theme.primaryColor ? { "primary-color": theme.primaryColor } : {},
+          ...theme.darkMode ? { "dark-mode": true } : {}
+        },
+        decisions: {
+          target: `${framework}: wrote theme module at ${themePath} for use with <CometChatThemeProvider theme={...}>. RN uses a JS theme object, not CSS.`,
+          ...presetFlag ? { preset: `picked the "${presetFlag}" preset bundle (primary + text + background + font + dark-mode)` } : {},
+          variables_set: rnVariables.join(", ")
+        },
+        files_patched: [themePath],
+        next_actions: result2.next_steps
+      });
+    }
+    return outputResult6(args, result2, 0);
+  }
   const { css, variables } = buildOverrideBlock(theme);
   const { op, targetPath, specialHint } = buildThemeOp(framework, css, root);
   if (!op || !targetPath) {
@@ -4037,6 +4880,11 @@ async function hasSecretTool() {
   }
 }
 async function detectBackend() {
+  const override = process.env.CC_AUTH_BACKEND;
+  if (override === "file") return "file";
+  if (override === "keychain-macos") return "keychain-macos";
+  if (override === "keychain-linux") return "keychain-linux";
+  if (override === "keychain-windows") return "keychain-windows";
   if (process.platform === "darwin") return "keychain-macos";
   if (process.platform === "win32") return "keychain-windows";
   if (process.platform === "linux" && await hasSecretTool()) return "keychain-linux";
@@ -4477,7 +5325,20 @@ function loadCatalog() {
   cachedCatalog = JSON.parse(readFileSync9(path, "utf8"));
   return cachedCatalog;
 }
-function nextStepsForFeature(feature) {
+function resolveFramework(root) {
+  if (hasState(root)) {
+    const state2 = readState(root);
+    if (state2?.framework) return state2.framework;
+  }
+  const cfg = readConfig(root);
+  if (cfg?.framework) return cfg.framework;
+  return "reactjs";
+}
+function isRn(framework) {
+  return framework === "expo" || framework === "react-native";
+}
+function nextStepsForFeature(feature, framework = "reactjs") {
+  const rn = isRn(framework);
   switch (feature.type) {
     case "default":
       return [
@@ -4520,19 +5381,44 @@ function nextStepsForFeature(feature) {
       }
       return lines;
     }
-    case "package-install":
-      return [
+    case "package-install": {
+      const pkg = rn && feature.package_native ? feature.package_native : feature.package;
+      const peers = rn ? feature.package_native_peers ?? [] : [];
+      const installCmd = framework === "expo" ? `npx expo install ${[pkg, ...peers].filter(Boolean).join(" ")}` : `npm install ${[pkg, ...peers].filter(Boolean).join(" ")}`;
+      const restartCmd = framework === "expo" ? "npx expo start --clear" : rn ? "npm start -- --reset-cache" : "npm run dev";
+      const docsPath = rn ? "react-native" : "react";
+      const baseSteps = [
         `${feature.name} requires installing an additional npm package.`,
         "",
         "Steps to enable:",
-        `  1. Install the package:`,
-        `       npm install ${feature.package}`,
-        `  2. Restart your dev server. After the next login, the UI Kit's initiateAfterLogin() automatically calls enableCalling(), which detects the calls SDK and wires up the default CallingExtension. No manual setExtensions() or setCallsExtension() needed for the default behavior.`,
-        `  3. Call buttons appear in CometChatMessageHeader; incoming calls render via the global call listener.`,
-        ...feature.components && feature.components.length > 0 ? [`  4. Components automatically enabled: ${feature.components.join(", ")}`] : [],
-        `  Note: to customize the calling UI (custom CallingExtension, group calls config, recording), pass your own instance via UIKitSettingsBuilder.setCallsExtension(new CallingExtension({...})) before init.`,
-        ...feature.docs_topic ? [`  Docs: https://www.cometchat.com/docs/ui-kit/react/${feature.docs_topic}`] : []
+        `  1. Install:`,
+        `       ${installCmd}`
       ];
+      if (framework === "react-native") {
+        baseSteps.push(`  2. Run \`cd ios && pod install && cd ..\` to link the native modules.`);
+        baseSteps.push(`  3. Restart Metro with \`${restartCmd}\`. After the next login, the UI Kit's initiateAfterLogin() auto-wires the CometChat calling listeners.`);
+        baseSteps.push(`  4. Call buttons appear in CometChatMessageHeader; incoming calls render via the CometChatIncomingCall listener.`);
+      } else if (framework === "expo") {
+        baseSteps.push(`  2. Run \`npx expo prebuild --clean\` (calling requires a dev build \u2014 Expo Go cannot load WebRTC).`);
+        baseSteps.push(`  3. Restart Metro with \`${restartCmd}\`. After the next login, the UI Kit's initiateAfterLogin() auto-wires the CometChat calling listeners.`);
+        baseSteps.push(`  4. Call buttons appear in CometChatMessageHeader; incoming calls render via the CometChatIncomingCall listener.`);
+      } else {
+        baseSteps.push(`  2. Restart your dev server (\`${restartCmd}\`). After the next login, the UI Kit's initiateAfterLogin() automatically calls enableCalling(), which detects the calls SDK and wires up the default CallingExtension. No manual setExtensions() or setCallsExtension() needed for the default behavior.`);
+        baseSteps.push(`  3. Call buttons appear in CometChatMessageHeader; incoming calls render via the global call listener.`);
+      }
+      if (feature.components && feature.components.length > 0) {
+        baseSteps.push(`  Components automatically enabled: ${feature.components.join(", ")}`);
+      }
+      if (rn) {
+        baseSteps.push(`  Note: on React Native you customize calling UI via custom view templates (see cometchat-native-features skill \xA7 Calls).`);
+      } else {
+        baseSteps.push(`  Note: to customize the calling UI (custom CallingExtension, group calls config, recording), pass your own instance via UIKitSettingsBuilder.setCallsExtension(new CallingExtension({...})) before init.`);
+      }
+      if (feature.docs_topic) {
+        baseSteps.push(`  Docs: https://www.cometchat.com/docs/ui-kit/${docsPath}/${feature.docs_topic}`);
+      }
+      return baseSteps;
+    }
     case "component-swap":
       return [
         `${feature.name} is enabled by replacing one component with a variant.`,
@@ -4811,10 +5697,12 @@ function featuresInfo(args, name) {
     }
     return 1;
   }
+  const root = projectPath10(args);
+  const framework = resolveFramework(root);
   const result = {
     status: "found",
     feature: fuzzy,
-    next_steps: nextStepsForFeature(fuzzy)
+    next_steps: nextStepsForFeature(fuzzy, framework)
   };
   if (isJsonMode11(args)) {
     console.log(JSON.stringify(result, null, 2));
@@ -4873,8 +5761,11 @@ function projectPath11(args) {
   if (typeof fromFlag === "string") return resolve12(fromFlag);
   return resolve12(process.cwd());
 }
-function runQuickVerify(root, ownedFiles, patchedFiles = []) {
+function runQuickVerify(root, ownedFiles, patchedFiles = [], framework = null) {
   if (ownedFiles.length === 0) return { status: "skip", failed: [] };
+  if (framework === "expo" || framework === "react-native") {
+    return runQuickVerifyRn(root, ownedFiles, patchedFiles, framework);
+  }
   const failed = [];
   const HEX_KEY = /[a-f0-9]{32,}/;
   const cssCandidates = /* @__PURE__ */ new Set([
@@ -4917,6 +5808,69 @@ function runQuickVerify(root, ownedFiles, patchedFiles = []) {
   if (!errorUiFound) failed.push("error_ui_visible_on_failure");
   return { status: failed.length === 0 ? "pass" : "fail", failed };
 }
+function runQuickVerifyRn(root, ownedFiles, patchedFiles, framework) {
+  const failed = [];
+  const HEX_KEY = /[a-f0-9]{32,}/;
+  const allFiles = /* @__PURE__ */ new Set([...ownedFiles, ...patchedFiles]);
+  const entryCandidates = ["index.js", "index.ts", "App.tsx", "App.jsx", "app/_layout.tsx", "app/_layout.js"];
+  let gestureHandlerLine1 = false;
+  for (const e of entryCandidates) {
+    if (!pathExists(p(root, e))) continue;
+    const content = readFileOrNull(p(root, e));
+    if (!content) continue;
+    const firstLine = content.split(/\r?\n/)[0]?.trim() ?? "";
+    if (/^import\s+['"]react-native-gesture-handler['"]/.test(firstLine)) {
+      gestureHandlerLine1 = true;
+      break;
+    }
+  }
+  if (!gestureHandlerLine1) failed.push("gesture_handler_line_1");
+  const wrappers = ["GestureHandlerRootView", "SafeAreaProvider", "CometChatThemeProvider", "CometChatProvider"];
+  const wrapperHits = /* @__PURE__ */ new Set();
+  for (const file of allFiles) {
+    const content = readFileOrNull(p(root, file));
+    if (!content) continue;
+    for (const w of wrappers) {
+      if (content.includes(w)) wrapperHits.add(w);
+    }
+  }
+  if (wrapperHits.size < wrappers.length) failed.push("four_wrapper_chain_present");
+  let hasThreadPanel = false;
+  for (const file of allFiles) {
+    const content = readFileOrNull(p(root, file));
+    if (content && content.includes("CometChatThreadHeader")) {
+      hasThreadPanel = true;
+      break;
+    }
+  }
+  if (!hasThreadPanel) {
+    for (const file of ownedFiles) {
+      const content = readFileOrNull(p(root, file));
+      if (!content) continue;
+      const lists = (content.match(/<\s*CometChatMessageList\b/g) ?? []).length;
+      const flagged = (content.match(/hideReplyInThreadOption/g) ?? []).length;
+      if (lists > flagged) {
+        failed.push("hide_reply_in_thread_option");
+        break;
+      }
+    }
+  }
+  for (const file of ownedFiles) {
+    const content = readFileOrNull(p(root, file));
+    if (!content) continue;
+    const m = content.match(HEX_KEY);
+    if (m && m[0].length >= 40) {
+      failed.push("no_auth_key_in_source");
+      break;
+    }
+  }
+  if (framework === "react-native" && pathExists(p(root, "ios/Podfile"))) {
+    if (!pathExists(p(root, "ios/Podfile.lock"))) {
+      failed.push("pod_install_run");
+    }
+  }
+  return { status: failed.length === 0 ? "pass" : "fail", failed };
+}
 function buildIssues(args) {
   const issues = [];
   if (!args.hasIntegration) {
@@ -4964,6 +5918,23 @@ function buildIssues(args) {
     error_ui_visible_on_failure: {
       msg: "No visible error UI (color: red) found in any owned file.",
       fix: "Add a `<div style={{color: 'red'}}>{error}</div>` block to your CometChatNoSSR.tsx (or equivalent) so init/login failures are visible to the user instead of silently rendering nothing."
+    },
+    // ── React Native checks ─────────────────────────────────────────────────
+    gesture_handler_line_1: {
+      msg: '`import "react-native-gesture-handler"` is not line 1 of the entry file (index.js / App.tsx / app/_layout.tsx).',
+      fix: 'Add `import "react-native-gesture-handler";` as the FIRST line of your entry file \u2014 above every other import. Gesture handler requires native setup that must happen before any React code runs, and some bundlers defer non-leading imports which breaks release builds silently.'
+    },
+    four_wrapper_chain_present: {
+      msg: "One or more of the 4 required wrappers is missing: GestureHandlerRootView \u2192 SafeAreaProvider \u2192 CometChatThemeProvider \u2192 CometChatProvider.",
+      fix: "Wrap your app root (App.tsx or app/_layout.tsx) with all 4 wrappers in that exact order. Omitting any of them breaks gestures, safe areas, theming, or login state \u2014 and it fails silently in dev. See cometchat-native-core \xA7 3."
+    },
+    hide_reply_in_thread_option: {
+      msg: "A <CometChatMessageList> was found without `hideReplyInThreadOption`, and no <CometChatThreadHeader> is wired.",
+      fix: 'Add `hideReplyInThreadOption={true}` to every <CometChatMessageList> in the integration \u2014 OR wire a full thread panel (CometChatThreadHeader + scoped list + composer with parentMessageId). Without the flag, tapping a message shows a "Reply in Thread" action that leads to a broken thread screen.'
+    },
+    pod_install_run: {
+      msg: "ios/Podfile exists but ios/Podfile.lock is missing \u2014 pod install has not been run.",
+      fix: "Run `cd ios && pod install && cd ..` to link the native modules. After a new package install, pod install must run before `npm run ios` or Xcode build will fail."
     }
   };
   for (const failed of args.verify.failed) {
@@ -5029,7 +6000,8 @@ async function doctor(args) {
     verifyResult = runQuickVerify(
       root,
       stateInfo.files_owned,
-      stateInfo.files_patched.map((p2) => p2.path)
+      stateInfo.files_patched.map((p2) => p2.path),
+      stateInfo.framework
     );
   }
   const expectedEnvVars = detected.env_prefix !== null ? [
@@ -5544,6 +6516,7 @@ function printHumanReadable12(r) {
 init_state();
 import { readFileSync as readFileSync11 } from "node:fs";
 import { join as join14, resolve as resolve15 } from "node:path";
+init_config();
 var HELP14 = `
 cometchat add-user-mgmt \u2014 create server-side user management endpoints
 
@@ -5589,13 +6562,28 @@ async function addUserMgmt(args) {
     return 0;
   }
   const root = projectPath14(args);
-  if (!hasState(root)) {
+  const stateFramework = hasState(root) ? readState(root)?.framework ?? null : null;
+  const cfgFramework = readConfig(root)?.framework ?? null;
+  const resolvedFramework = stateFramework ?? cfgFramework;
+  if (!resolvedFramework) {
     return outputResult10(args, {
       status: "no-integration",
       framework: "",
       files_created: [],
       next_steps: [],
-      error: "API_ERROR: ERR_NO_INTEGRATION No integration found. Run `cometchat apply` first to create the base integration, then run `cometchat add-user-mgmt`."
+      error: "API_ERROR: ERR_NO_INTEGRATION No integration found. Run `cometchat apply` (web) or `/cometchat` (React Native) first, then re-run `cometchat add-user-mgmt`."
+    }, 1);
+  }
+  if (resolvedFramework === "expo" || resolvedFramework === "react-native") {
+    return addUserMgmtRn(args, root, resolvedFramework);
+  }
+  if (!hasState(root)) {
+    return outputResult10(args, {
+      status: "no-integration",
+      framework: resolvedFramework,
+      files_created: [],
+      next_steps: [],
+      error: "API_ERROR: ERR_NO_STATE Web add-user-mgmt requires state.json. Run `cometchat apply` first (or `cometchat state record` if your integration was hand-written)."
     }, 1);
   }
   const state2 = readState(root);
@@ -5742,6 +6730,74 @@ function printHumanReadable13(r) {
   lines.push("");
   console.log(lines.join("\n"));
 }
+function addUserMgmtRn(args, root, framework) {
+  const backendFlag = args.flags.backend;
+  const outDirFlag = args.flags["out-dir"];
+  if (typeof backendFlag !== "string" || !RN_BACKENDS.includes(backendFlag)) {
+    return outputResult10(args, {
+      status: "error",
+      framework,
+      files_created: [],
+      next_steps: [],
+      error: `React Native add-user-mgmt requires --backend <${RN_BACKENDS.join("|")}>. Example: \`cometchat add-user-mgmt --backend express --out-dir ./server\`. Typically pair it with the same backend you chose for \`production-auth\`.`
+    }, 1);
+  }
+  const backend = backendFlag;
+  const tpl = rnUserMgmtTemplate(backend);
+  const defaultOutDir = backend === "firebase-functions" ? "functions/src" : backend === "nextjs-api" ? "src/app/api/cometchat-user" : "server";
+  const outDir = typeof outDirFlag === "string" ? outDirFlag : defaultOutDir;
+  const filePath = join14(outDir, tpl.filename);
+  let writeResult;
+  try {
+    writeResult = applyWrites(root, [
+      { type: "create", path: filePath, content: tpl.content, owned: true }
+    ]);
+  } catch (err) {
+    return errorOut7(args, "RN add-user-mgmt apply failed: " + (err instanceof Error ? err.message : String(err)));
+  }
+  if (writeResult.files_skipped.length > 0) {
+    return outputResult10(args, {
+      status: "already-applied",
+      framework,
+      files_created: [],
+      next_steps: [
+        `Skipped: ${filePath} already exists. Delete it to regenerate.`
+      ],
+      error: `API_ERROR: ERR_ALREADY_APPLIED ${filePath} already exists.`
+    }, 0);
+  }
+  const next_steps = [
+    `1. Backend deps: ${tpl.deps.length > 0 ? `\`npm install ${tpl.deps.join(" ")}\` in ${outDir.split("/")[0] ?? outDir}` : "(none \u2014 endpoint ships ready to deploy)"}.`,
+    `2. Set server env vars (NO EXPO_PUBLIC_ prefix):`,
+    `     COMETCHAT_APP_ID=<your-app-id>`,
+    `     COMETCHAT_REGION=<us|eu|in>`,
+    `     COMETCHAT_AUTH_KEY=<your-auth-key>   # SERVER-ONLY`,
+    `3. Start the backend: ${tpl.runCommand ?? "(deploy per platform convention)"}`,
+    `4. \u26A0 Add authentication BEFORE deploying. The endpoint ships unauthenticated \u2014 anyone who hits it can create/update/delete CometChat users. Verify the caller's session / token in each handler.`,
+    `5. Wire the endpoint into your RN app's flows:`,
+    `   - On signup (after your auth provider creates a user): POST /cometchat-user with { uid, name, avatar? }`,
+    `   - On profile update: PATCH /cometchat-user/<uid> with the changed fields`,
+    `   - On account delete: DELETE /cometchat-user/<uid>`,
+    `   See cometchat-native-production skill \xA7 6 for Firebase Auth / Supabase / Clerk / Auth0 recipes.`
+  ];
+  appendAuditEntry(root, {
+    command: "add-user-mgmt",
+    summary: `Scaffolded ${tpl.label} at ${filePath}`,
+    inputs: { framework, backend, "out-dir": outDir },
+    decisions: {
+      backend: `${tpl.label}. Ships unauthenticated \u2014 caller must add session checks.`,
+      file: `Wrote ${filePath} (owned). Deps: ${tpl.deps.length > 0 ? tpl.deps.join(", ") : "none"}.`
+    },
+    files_patched: [filePath],
+    next_actions: next_steps
+  });
+  return outputResult10(args, {
+    status: "applied",
+    framework,
+    files_created: [filePath],
+    next_steps
+  }, 0);
+}
 
 // src/commands/apply-feature.ts
 init_state();
@@ -6711,6 +7767,8 @@ function stripNoise(result) {
     return result;
   }
   const { apiHost: _h, backend: _b, ...rest } = result;
+  void _h;
+  void _b;
   return rest;
 }
 function emit(json, result) {
@@ -6876,7 +7934,7 @@ async function provisionSetup(args) {
     return 1;
   }
   if (!frameworkFlag) {
-    const msg = "Missing --framework. One of: reactjs, nextjs, react-router, astro.";
+    const msg = "Missing --framework. One of: reactjs, nextjs, react-router, astro, expo, react-native.";
     if (json) return emitError(true, msg);
     console.error(msg);
     return 1;
@@ -6965,7 +8023,10 @@ var ENV_PREFIX_BY_FRAMEWORK = {
   reactjs: "VITE_",
   nextjs: "NEXT_PUBLIC_",
   "react-router": "VITE_",
-  astro: "PUBLIC_"
+  astro: "PUBLIC_",
+  expo: "EXPO_PUBLIC_",
+  "react-native": ""
+  // bare RN uses react-native-dotenv — no prefix
 };
 async function provisionList(args) {
   const json = isJsonMode19(args);
@@ -8437,6 +9498,14 @@ function projectPath18(args) {
   if (typeof fromFlag === "string") return resolve21(fromFlag);
   return resolve21(process.cwd());
 }
+var STATE_ENV_PREFIX_BY_FRAMEWORK = {
+  reactjs: "VITE_",
+  nextjs: "NEXT_PUBLIC_",
+  "react-router": "VITE_",
+  astro: "PUBLIC_",
+  expo: "EXPO_PUBLIC_",
+  "react-native": ""
+};
 async function state(args) {
   if (args.flags.help || args.flags.h) {
     console.log(HELP21);
@@ -8474,7 +9543,7 @@ async function stateRecord(args) {
     return 1;
   }
   if (!envPrefix) {
-    envPrefix = framework === "nextjs" ? "NEXT_PUBLIC_" : framework === "astro" ? "PUBLIC_" : "VITE_";
+    envPrefix = STATE_ENV_PREFIX_BY_FRAMEWORK[framework] ?? "VITE_";
   }
   const experienceStr = asString5(args.flags.experience) ?? "0";
   const experience = parseInt(experienceStr, 10);