@expokit/cli 0.4.2 → 0.4.3

package/README.md

@@ -50,12 +50,16 @@ Everything else — live previews, props, installation, theming, Pro, AI / MCP s
 
 ## Security
 
-- **No dependencies, no install scripts, no telemetry.**
+- **No dependencies, no install scripts.**
+- **Anonymous install counts only** — after a successful `add`, the CLI sends the item's name (`{"items":["button"]}`)
+  to expokit.in so the site can show how often each component is installed. No token, files, paths or machine details;
+  repeat adds count once a day. Turn it off with `DO_NOT_TRACK=1` or `EXPO_KIT_TELEMETRY=0`; it never runs in CI,
+  `--dry-run` or `update`.
 - **Writes only inside your app** — `components.json`, the `@/*` alias in `tsconfig.json` and the component files.
   `--dry-run` shows every change first; `add` never overwrites a file you changed unless you pass `--force`.
   `paths` in `components.json` that point outside the app are refused. Symlinks inside the app are followed, not
   checked, so a cloned repo that symlinks a folder elsewhere can still send writes there.
-- **Free components need no network** — they ship inside this package. Pro components are downloaded over HTTPS from
+- **Free components need no network to install** — they ship inside this package. Pro components are downloaded over HTTPS from
   expokit.in; your token is stored readable only by you, sent only to that site and never through a redirect.
   In scripts, pipe it to `login` or set `EXPO_KIT_TOKEN` (`--token` leaves it in your shell history).
 - **Runs one command:** `npx expo install` for the packages a component needs — without `EXPO_KIT_TOKEN` in its

package/bin/expo-kit.js

@@ -34,6 +34,7 @@ import {
   retryDelayMs,
   retryHint,
   tabComponentName,
+  telemetryEnabled,
   needsDevBuild,
   pickMainExport,
 } from './lib.mjs';
@@ -942,12 +943,33 @@ function cmdInit(cwd, flags, dir) {
   log(`Done. Add items with: ${RUN} add <name>`);
 }
 
-async function cmdAdd(args, cwd) {
+/**
+ * After a successful add: tells the site which item was installed — just its name, no token or project
+ * data (README "Privacy"). Off with DO_NOT_TRACK=1 / EXPO_KIT_TELEMETRY=0 and in CI. Never fails the add.
+ */
+async function reportInstalled(name) {
+  if (!telemetryEnabled(process.env)) return;
+  try {
+    parseSiteUrl(SITE_URL);
+    const res = await fetch(`${SITE_URL}/api/cli/installed`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ items: [name] }),
+      signal: AbortSignal.timeout(1500),
+    });
+    await res.arrayBuffer();
+  } catch {
+    // offline, slow or blocked: the count just misses this one
+  }
+}
+
+/** `report: false` for re-adds that aren't new installs (`update --force`). */
+async function cmdAdd(args, cwd, { report = true } = {}) {
   const { flags, positional } = parseFlags(args);
   // `add a b c` → add each in turn with the same flags.
   if (positional.length > 1 && !positional.includes('--list')) {
     const flagArgs = args.filter((a) => a.startsWith('--'));
-    for (const item of positional) await cmdAdd([item, ...flagArgs], cwd);
+    for (const item of positional) await cmdAdd([item, ...flagArgs], cwd, { report });
     return;
   }
   const name = positional[0];
@@ -1049,6 +1071,7 @@ async function cmdAdd(args, cwd) {
   const depsOk = runExpoInstall(projectRoot, meta.dependencies ?? [], false);
 
   if (depsOk) markTemplateInstalled(projectRoot, config, resolved);
+  if (report) await reportInstalled(resolved);
 
   console.log('');
   if (resolved === 'liquidglass-tab') {
@@ -1092,7 +1115,7 @@ async function cmdUpdate(args, cwd) {
   if (flags.force) {
     for (const resolved of targets) {
       log(`Full overwrite ${resolved} (--force${flags.dryRun ? ', dry run' : ''})…\n`);
-      await cmdAdd([resolved, '--force', ...(flags.dryRun ? ['--dry-run'] : [])], cwd);
+      await cmdAdd([resolved, '--force', ...(flags.dryRun ? ['--dry-run'] : [])], cwd, { report: false });
     }
     return;
   }

package/bin/lib.mjs

@@ -318,6 +318,7 @@ export function kitVersion(text) {
  */
 export const EXPO_GO_PACKAGES = new Set([
   '@expo/vector-icons',
+  '@react-native-async-storage/async-storage',
   '@shopify/react-native-skia',
   'expo-blur',
   'expo-charts',
@@ -325,6 +326,7 @@ export const EXPO_GO_PACKAGES = new Set([
   'expo-haptics',
   'expo-router',
   'expo-splash-screen',
+  'expo-status-bar',
   'react-native-gesture-handler',
   'react-native-reanimated',
   'react-native-safe-area-context',
@@ -366,6 +368,18 @@ export function mergeDependencies(...lists) {
 
 export const DEFAULT_SITE_URL = 'https://expokit.in';
 
+const OFF = /^(0|false|off|no)$/i;
+const set = (v) => v !== undefined && v !== '' && !OFF.test(v);
+
+/**
+ * Anonymous install counts (README "Privacy"): on unless DO_NOT_TRACK is set, EXPO_KIT_TELEMETRY is
+ * 0/false/off/no, or it's a CI run (builds re-adding items aren't new installs).
+ */
+export function telemetryEnabled(env) {
+  if (set(env.DO_NOT_TRACK) || set(env.CI)) return false;
+  return !(env.EXPO_KIT_TELEMETRY !== undefined && OFF.test(env.EXPO_KIT_TELEMETRY));
+}
+
 export function isLoopbackHost(hostname) {
   return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]' || hostname === '::1';
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expokit/cli",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "mcpName": "io.github.Anshkaran7/expokit",
   "description": "Animated UI components for Expo and React Native — a shadcn-style CLI that copies buttons, inputs, cards, charts and full screens into your app",
   "license": "MIT",