@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/bundles/expo-supabase/README.md

@@ -0,0 +1,38 @@
+# Expo + Supabase Starter
+
+Built with [Lattice Project Builder](https://latticeai.app).
+
+## Getting Started
+
+1. Install dependencies:
+   ```bash
+   npm install
+   ```
+
+2. Review `.env.example` and add only the variables you need.
+
+3. Start development:
+   ```bash
+   npm start
+   ```
+
+## Included Scaffold
+
+- PROJECT_GUIDE.md with the planned build scope
+- AI guardrails for Cursor, Codex, and Claude Code
+- GitHub Actions CI and shared verification commands
+- Supabase auth starter files
+- Supabase migration starter files
+- Sentry runtime initialization and error boundary
+
+## Commands
+
+| Command | Description |
+|---------|-------------|
+| `npm start` | Start Expo dev server |
+| `npm run ios` | Run on iOS simulator |
+| `npm run android` | Run on Android emulator |
+| `npm run lint` | Run ESLint |
+| `npm run typecheck` | Run TypeScript checks |
+| `npm run test` | Run tests |
+| `npm run verify` | Run all checks |

package/bundles/expo-supabase/__tests__/home.test.tsx

@@ -0,0 +1,22 @@
+import { render, screen, fireEvent, waitFor } from "@testing-library/react-native";
+import { Alert } from "react-native";
+import HomeScreen from "../app/index";
+import { supabase } from "../lib/supabase/client";
+
+jest.mock("../lib/supabase/client", () => ({supabase: {auth: {
+  getSession: jest.fn().mockResolvedValue({data:{session:null}}),
+  onAuthStateChange: jest.fn(() => ({data:{subscription:{unsubscribe:jest.fn()}}})),
+  signInWithPassword: jest.fn(), signUp: jest.fn(), signOut: jest.fn(),
+}}}));
+
+it("recovers from an offline sign-in and lets the user retry", async () => {
+  const alert=jest.spyOn(Alert,"alert").mockImplementation(() => {});
+  jest.mocked(supabase.auth.signInWithPassword).mockRejectedValueOnce(new Error("Offline"));
+  await render(<HomeScreen />);
+  await fireEvent.changeText(screen.getByLabelText("Email"),"qa@example.test");
+  await fireEvent.changeText(screen.getByLabelText("Password"),"synthetic-password");
+  await fireEvent.press(screen.getByRole("button",{name:"Sign in"}));
+  await waitFor(() => expect(alert).toHaveBeenCalledWith("Authentication failed","Offline"));
+  expect(screen.getByRole("button",{name:"Sign in"})).toBeEnabled();
+  alert.mockRestore();
+});

package/bundles/expo-supabase/app/_layout.tsx

@@ -0,0 +1,14 @@
+import { Stack } from "expo-router";
+import * as Sentry from "@sentry/react-native";
+
+Sentry.init({
+  dsn: process.env.EXPO_PUBLIC_SENTRY_DSN,
+  enabled: Boolean(process.env.EXPO_PUBLIC_SENTRY_DSN),
+  tracesSampleRate: __DEV__ ? 1 : 0.1,
+});
+
+function RootLayout() {
+  return (<Stack />);
+}
+
+export default Sentry.wrap(RootLayout);

package/bundles/expo-supabase/app/index.tsx

@@ -0,0 +1,72 @@
+import { useEffect, useState } from "react";
+import { Alert, Pressable, SafeAreaView, StyleSheet, Text, TextInput, View } from "react-native";
+import type { Session } from "@supabase/supabase-js";
+import { supabase } from "@/lib/supabase/client";
+
+export default function HomeScreen() {
+  const [session, setSession] = useState<Session | null>(null);
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+  const [loading, setLoading] = useState(false);
+
+  useEffect(() => {
+    void supabase.auth.getSession().then(({ data }) => setSession(data.session));
+    const { data } = supabase.auth.onAuthStateChange((_event, nextSession) => setSession(nextSession));
+    return () => data.subscription.unsubscribe();
+  }, []);
+
+  async function authenticate(mode: "signin" | "signup") {
+    setLoading(true);
+    try {
+    const result = mode === "signin"
+      ? await supabase.auth.signInWithPassword({ email, password })
+      : await supabase.auth.signUp({ email, password });
+    if (result.error) Alert.alert("Authentication failed", result.error.message);
+    } catch (error) {
+      Alert.alert("Authentication failed", error instanceof Error ? error.message : "Please try again.");
+    } finally {
+      setLoading(false);
+    }
+  }
+
+  return (
+    <SafeAreaView style={styles.screen}>
+      <View style={styles.card}>
+        <Text style={styles.eyebrow}>Lattice Project Builder</Text>
+        <Text style={styles.title}>Expo + Supabase Starter</Text>
+        {session ? (
+          <>
+            <Text style={styles.body}>Signed in as {session.user.email}</Text>
+            <Pressable accessibilityRole="button" style={styles.primary} onPress={() => void supabase.auth.signOut()}>
+              <Text style={styles.primaryText}>Sign out</Text>
+            </Pressable>
+          </>
+        ) : (
+          <>
+            <TextInput accessibilityLabel="Email" autoCapitalize="none" keyboardType="email-address" onChangeText={setEmail} placeholder="Email" style={styles.input} value={email} />
+            <TextInput accessibilityLabel="Password" onChangeText={setPassword} placeholder="Password" secureTextEntry style={styles.input} value={password} />
+            <Pressable accessibilityRole="button" disabled={loading} style={styles.primary} onPress={() => void authenticate("signin")}>
+              <Text style={styles.primaryText}>{loading ? "Working..." : "Sign in"}</Text>
+            </Pressable>
+            <Pressable accessibilityRole="button" disabled={loading} style={styles.secondary} onPress={() => void authenticate("signup")}>
+              <Text style={styles.secondaryText}>Create account</Text>
+            </Pressable>
+          </>
+        )}
+      </View>
+    </SafeAreaView>
+  );
+}
+
+const styles = StyleSheet.create({
+  screen: { flex: 1, justifyContent: "center", backgroundColor: "#f8fafc", padding: 24 },
+  card: { gap: 14, borderRadius: 8, backgroundColor: "#fff", padding: 24 },
+  eyebrow: { color: "#1d4ed8", fontSize: 13, fontWeight: "700" },
+  title: { color: "#0f172a", fontSize: 30, fontWeight: "700" },
+  body: { color: "#475569", fontSize: 16 },
+  input: { borderWidth: 1, borderColor: "#cbd5e1", borderRadius: 6, padding: 12 },
+  primary: { alignItems: "center", borderRadius: 6, backgroundColor: "#2563eb", padding: 13 },
+  primaryText: { color: "#fff", fontWeight: "700" },
+  secondary: { alignItems: "center", borderRadius: 6, borderWidth: 1, borderColor: "#2563eb", padding: 13 },
+  secondaryText: { color: "#1d4ed8", fontWeight: "700" },
+});

package/bundles/expo-supabase/app.json

@@ -0,0 +1,33 @@
+{
+  "expo": {
+    "name": "Expo + Supabase Starter",
+    "slug": "expo---supabase-starter",
+    "version": "1.0.0",
+    "orientation": "portrait",
+    "scheme": "expo---supabase-starter",
+    "userInterfaceStyle": "automatic",
+    "ios": {
+      "bundleIdentifier": "com.exposupabasestarter.app",
+      "supportsTablet": true
+    },
+    "android": {
+      "package": "com.exposupabasestarter.app",
+      "adaptiveIcon": {
+        "backgroundColor": "#ffffff"
+      }
+    },
+    "web": {
+      "bundler": "metro",
+      "output": "static"
+    },
+    "plugins": [
+      "expo-router",
+      "expo-secure-store",
+      "@sentry/react-native/expo",
+      "./plugins/with-lattice-commons-io"
+    ],
+    "experiments": {
+      "typedRoutes": true
+    }
+  }
+}

package/bundles/expo-supabase/components/ui/Button.tsx

@@ -0,0 +1,75 @@
+import { Pressable, Text, StyleSheet, ActivityIndicator } from "react-native";
+
+interface ButtonProps {
+  title: string;
+  onPress: () => void;
+  variant?: "default" | "outline" | "destructive";
+  disabled?: boolean;
+  loading?: boolean;
+}
+
+export function Button({
+  title,
+  onPress,
+  variant = "default",
+  disabled,
+  loading,
+}: ButtonProps) {
+  const isDisabled = disabled || loading;
+
+  return (
+    <Pressable
+      style={[
+        styles.button,
+        variant === "outline" && styles.outline,
+        variant === "destructive" && styles.destructive,
+        isDisabled && styles.disabled,
+      ]}
+      onPress={onPress}
+      disabled={isDisabled}
+    >
+      {loading ? (
+        <ActivityIndicator color={variant === "outline" ? "#3b82f6" : "#fff"} />
+      ) : (
+        <Text
+          style={[
+            styles.text,
+            variant === "outline" && styles.outlineText,
+          ]}
+        >
+          {title}
+        </Text>
+      )}
+    </Pressable>
+  );
+}
+
+const styles = StyleSheet.create({
+  button: {
+    backgroundColor: "#3b82f6",
+    paddingVertical: 12,
+    paddingHorizontal: 24,
+    borderRadius: 8,
+    alignItems: "center",
+    justifyContent: "center",
+  },
+  outline: {
+    backgroundColor: "transparent",
+    borderWidth: 1,
+    borderColor: "#3b82f6",
+  },
+  destructive: {
+    backgroundColor: "#ef4444",
+  },
+  disabled: {
+    opacity: 0.5,
+  },
+  text: {
+    color: "#fff",
+    fontSize: 16,
+    fontWeight: "600",
+  },
+  outlineText: {
+    color: "#3b82f6",
+  },
+});

package/bundles/expo-supabase/components/ui/Input.tsx

@@ -0,0 +1,50 @@
+import { TextInput, View, Text, StyleSheet, TextInputProps } from "react-native";
+
+interface InputProps extends TextInputProps {
+  label?: string;
+  error?: string;
+}
+
+export function Input({ label, error, style, ...props }: InputProps) {
+  return (
+    <View style={styles.container}>
+      {label && <Text style={styles.label}>{label}</Text>}
+      <TextInput
+        style={[styles.input, error && styles.inputError, style]}
+        placeholderTextColor="#9ca3af"
+        {...props}
+      />
+      {error && <Text style={styles.error}>{error}</Text>}
+    </View>
+  );
+}
+
+const styles = StyleSheet.create({
+  container: {
+    marginBottom: 16,
+  },
+  label: {
+    fontSize: 14,
+    fontWeight: "500",
+    color: "#374151",
+    marginBottom: 4,
+  },
+  input: {
+    borderWidth: 1,
+    borderColor: "#d1d5db",
+    borderRadius: 8,
+    paddingHorizontal: 12,
+    paddingVertical: 10,
+    fontSize: 16,
+    color: "#111827",
+    backgroundColor: "#fff",
+  },
+  inputError: {
+    borderColor: "#ef4444",
+  },
+  error: {
+    fontSize: 12,
+    color: "#ef4444",
+    marginTop: 4,
+  },
+});

package/bundles/expo-supabase/components/ui/index.ts

@@ -0,0 +1,2 @@
+export { Button } from "./Button";
+export { Input } from "./Input";

package/bundles/expo-supabase/docs/LATTICE_RELEASE_WORKFLOW.md

@@ -0,0 +1,53 @@
+# Lattice Release Workflow
+
+This repository uses a portable feature-to-release contract. It coordinates work across Codex, Claude Code, GitHub Copilot, Cursor, and other tools without assuming that every provider has direct peer messaging.
+
+## Source of Truth
+
+- Policy: `.lattice/release-workflow.json`
+- Handoff schema: `.lattice/schemas/feature-handoff.schema.json`
+- Handoff template: `.lattice/templates/feature-handoff.json`
+- Feature procedure: `.agents/skills/lattice-feature-handoff/SKILL.md`
+- Release review procedure: `.agents/skills/lattice-release-manager/SKILL.md`
+- Mutable local state: `.lattice/runtime/` (Git-ignored)
+
+Stable instructions define roles and contracts. Live task IDs, production SHAs, deployment IDs, and provider state belong in current handoffs or ignored runtime state.
+
+## Workflow
+
+1. **Feature work** — A feature agent starts from an approved base in an isolated worktree, implements only the assigned scope, and runs proportionate checks.
+2. **Handoff** — The feature agent records exact base/head SHAs, diff scope, verification, operational impacts, risks, and approvals in the JSON handoff.
+3. **Release audit** — The Release Manager independently resolves the repository and reviews the exact candidate. The manager accepts for owner approval, requests rework, or blocks.
+4. **Candidate preparation** — A release candidate may be prepared only after its constituent handoffs pass review.
+5. **Owner approval** — Production promotion, migrations, provider/account writes, secret or environment changes, and destructive actions require explicit owner approval.
+6. **Deployment and live proof** — Deployment and live verification are separate states. A successful build or preview is not a production release.
+7. **Cleanup** — Feature worktrees and branches are cleaned only after the authorized candidate is proven live and rollback evidence is current.
+
+## Transport
+
+Use the narrowest available transport:
+
+1. A native task message when the environment exposes the capability and the exact destination is bound.
+2. The shared GitHub issue, pull request, or comment.
+3. The versioned handoff artifact, with its exact path surfaced to the owner.
+
+Never claim that a handoff was delivered unless the transport returned evidence. The message is notification; the handoff is the durable evidence.
+
+## Status Meanings
+
+- `READY_FOR_RELEASE`: ready for independent Release Manager review.
+- `NEEDS_REWORK`: a confirmed defect, failed gate, incomplete proof, or scope mismatch remains.
+- `BLOCKED`: lineage, authority, environment, or another prerequisite prevents safe progress.
+
+None of these statuses means merged, deployed, released, or live.
+
+## Provider Adapters
+
+- **Codex:** project custom agents in `.codex/agents/` plus the shared skills.
+- **Claude Code:** project subagents in `.claude/agents/`; the feature role requests worktree isolation.
+- **GitHub Copilot:** custom agents in `.github/agents/`; issues, pull requests, and comments are the portable control plane.
+- **Cursor:** shared `AGENTS.md`, `.cursor/rules.md`, and `.agents/skills/`. Native peer messaging is not required by this contract.
+
+## Secret and Data Boundary
+
+Do not put credentials, tokens, private keys, payment data, direct personal contact data, or secret values in a handoff. Name an environment variable or provider surface when needed; do not copy its value.

package/bundles/expo-supabase/docs/rules/codex.md

@@ -0,0 +1,62 @@
+# Codex Rules
+
+Use this file with `AGENTS.md` when you open the project in Codex. `AGENTS.md` is the durable entrypoint; this file is the deeper workflow reference.
+
+## Stack
+
+- **Framework**: Expo
+- **Language**: TypeScript (strict mode)
+- **Styling**: Tailwind CSS
+- **Testing**: Jest + React Testing Library
+
+## Operating Rules
+
+1. **Stay aligned with PROJECT_GUIDE.md** - implement what was planned before expanding scope
+2. **Prefer small diffs** - keep changes reviewable and localized
+3. **Check existing patterns first** - match the codebase before introducing new structure
+4. **Verify versions and APIs** - do not guess package behavior
+5. **Run verification before handoff** - lint, typecheck, test, build, and verify when available
+6. **Protect secrets** - never commit credentials, tokens, or private keys
+
+## Codex Surfaces
+
+- `AGENTS.md` is loaded before work begins. Keep it concise and repo-scoped.
+- `docs/rules/codex.md` is the full execution playbook.
+- `.agents/skills/lattice-verify/SKILL.md` is a portable Agent Skill for final verification and release checks.
+- `.mcp.json` contains disabled MCP examples. Enable only the tools the task needs and keep credentials in environment variables.
+- Use hooks or project config for mechanical enforcement; use skills for repeatable procedures.
+
+## Workflow
+
+1. Read `AGENTS.md` and `PROJECT_GUIDE.md`
+2. Identify the exact files you need to touch
+3. Keep implementation deterministic and production-ready
+4. Use the `lattice-verify` skill when asked to verify, ship, or prepare handoff
+5. Explain risky commands before running them
+6. Note assumptions or follow-ups in your final handoff
+
+## Verification Commands
+
+```bash
+npm run lint
+npm run typecheck
+npm run test
+npm run build
+npm run verify
+```
+
+## Related Files
+
+- `.cursor/rules.md` for shared project guardrails
+- `.cursor/rules/lattice-core.mdc` for current Cursor Agent rules
+- `.agents/skills/lattice-verify/SKILL.md` for portable verification workflow
+- `CLAUDE.md` for Claude Code compatibility
+- `.claude/rules/lattice-core.md` for Claude path-scoped code guidance
+- `.claude/settings.json` for Claude Code permissions and hooks
+
+## Hard Stops
+
+- Requirements conflict with `PROJECT_GUIDE.md`
+- A command would overwrite unrelated user work
+- Required environment variables are missing
+- You cannot verify an API or package behavior

package/bundles/expo-supabase/eslint.config.js

@@ -0,0 +1,7 @@
+const { defineConfig, globalIgnores } = require("eslint/config");
+const expoConfig = require("eslint-config-expo/flat");
+
+module.exports = defineConfig([
+  globalIgnores(["dist/*"]),
+  expoConfig,
+]);

package/bundles/expo-supabase/lib/supabase/client.ts

@@ -0,0 +1,22 @@
+import "react-native-url-polyfill/auto";
+import { createClient } from "@supabase/supabase-js";
+import * as SecureStore from "expo-secure-store";
+
+const url = process.env.EXPO_PUBLIC_SUPABASE_URL;
+const anonKey = process.env.EXPO_PUBLIC_SUPABASE_ANON_KEY;
+if (!url || !anonKey) throw new Error("Expo Supabase environment variables are required");
+
+const secureStorage = {
+  getItem: (key: string) => SecureStore.getItemAsync(key),
+  setItem: (key: string, value: string) => SecureStore.setItemAsync(key, value),
+  removeItem: (key: string) => SecureStore.deleteItemAsync(key),
+};
+
+export const supabase = createClient(url, anonKey, {
+  auth: {
+    storage: secureStorage,
+    autoRefreshToken: true,
+    persistSession: true,
+    detectSessionInUrl: false,
+  },
+});

package/bundles/expo-supabase/lib/supabase/realtime.ts

@@ -0,0 +1,10 @@
+import { supabase } from "@/lib/supabase/client";
+
+export function subscribeToTable(table: string, onChange: (payload: unknown) => void) {
+  const channel = supabase
+    .channel(`public:${table}`)
+    .on("postgres_changes", { event: "*", schema: "public", table }, onChange)
+    .subscribe();
+
+  return () => void supabase.removeChannel(channel);
+}

package/bundles/expo-supabase/lib/supabase/storage.ts

@@ -0,0 +1,6 @@
+import { supabase } from "@/lib/supabase/client";
+
+export async function uploadFile(bucket: string, path: string, uri: string) {
+  const body = await fetch(uri).then((response) => response.arrayBuffer());
+  return supabase.storage.from(bucket).upload(path, body, { upsert: false });
+}

package/bundles/expo-supabase/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "expo---supabase-starter",
+  "version": "1.0.0",
+  "main": "expo-router/entry",
+  "scripts": {
+    "start": "expo start",
+    "android": "expo start --android",
+    "ios": "expo start --ios",
+    "web": "expo start --web",
+    "lint": "eslint .",
+    "typecheck": "tsc --noEmit",
+    "test": "jest --passWithNoTests",
+    "verify": "npm run lint && npm run typecheck && npm test"
+  },
+  "dependencies": {
+    "expo": "58.0.14",
+    "expo-router": "~58.0.20",
+    "expo-constants": "~58.0.12",
+    "expo-linking": "~58.0.13",
+    "expo-file-system": "58.0.9",
+    "expo-secure-store": "~58.0.2",
+    "expo-status-bar": "~58.0.3",
+    "react": "19.3.0",
+    "react-native": "0.88.0",
+    "react-native-safe-area-context": "~5.10.1",
+    "@supabase/supabase-js": "^2.118.0",
+    "react-native-url-polyfill": "^3.0.0",
+    "@sentry/react-native": "8.31.0"
+  },
+  "devDependencies": {
+    "@expo/config-plugins": "~58.0.9",
+    "@types/react": "~19.3.0",
+    "typescript": "~6.0.3",
+    "eslint": "^9",
+    "eslint-config-expo": "58.0.4",
+    "jest": "^30.5.2",
+    "jest-expo": "~58.0.11",
+    "@types/jest": "^30",
+    "@testing-library/react-native": "^14.1.0",
+    "test-renderer": "^1.3.1",
+    "@react-native/jest-preset": "0.88.0",
+    "react-server-dom-webpack": "19.3.0",
+    "react-dom": "19.3.0"
+  },
+  "engines": {
+    "node": "24.x"
+  },
+  "overrides": {
+    "@istanbuljs/load-nyc-config": {
+      "js-yaml": "4.3.2"
+    },
+    "uuid@<11.1.1": "11.1.1",
+    "braces": "file:vendor/m2ai-braces-3.0.3-m2ai.1.tar",
+    "node-forge": "https://github.com/matthewscottconroy/forge/archive/db05494352dd3c9a5a07c5270333dcc78866cad2.tar.gz"
+  },
+  "jest": {
+    "preset": "jest-expo",
+    "maxWorkers": 2
+  }
+}

package/bundles/expo-supabase/plugins/with-lattice-commons-io.cjs

@@ -0,0 +1,42 @@
+const { withProjectBuildGradle } = require("@expo/config-plugins");
+
+const EXPECTED_EXPO_FILE_SYSTEM_VERSION = "58.0.9";
+const EXPECTED_REQUESTED_COMMONS_IO_VERSION = "1.4";
+const SELECTED_COMMONS_IO_VERSION = "2.14.0";
+const MARKER = "// LATTICE_COMMONS_IO_2_14_0_GUARD";
+
+const resolutionRule = `${MARKER}
+allprojects {
+  configurations.configureEach {
+    resolutionStrategy.eachDependency { details ->
+      if (details.requested.group == "commons-io" && details.requested.name == "commons-io" && details.requested.version == "${EXPECTED_REQUESTED_COMMONS_IO_VERSION}") {
+        details.useVersion("${SELECTED_COMMONS_IO_VERSION}")
+        details.because("GHSA-gwrp-pvrq-jmwv and CVE-2024-47554")
+      }
+    }
+  }
+}`;
+
+module.exports = function withLatticeCommonsIo(config) {
+  const actualVersion = require("expo-file-system/package.json").version;
+  if (actualVersion !== EXPECTED_EXPO_FILE_SYSTEM_VERSION) {
+    throw new Error(
+      `Lattice Commons IO guard requires expo-file-system ${EXPECTED_EXPO_FILE_SYSTEM_VERSION}; found ${actualVersion}. Review the native dependency before changing this guard.`,
+    );
+  }
+
+  return withProjectBuildGradle(config, (projectConfig) => {
+    if (projectConfig.modResults.language !== "groovy") {
+      throw new Error("Lattice Commons IO guard supports only the generated Groovy project build.gradle.");
+    }
+
+    const contents = projectConfig.modResults.contents;
+    if (!contents.includes(MARKER)) {
+      projectConfig.modResults.contents = `${contents.trimEnd()}
+
+${resolutionRule}
+`;
+    }
+    return projectConfig;
+  });
+};

package/bundles/expo-supabase/prompts/01-feature-implementation.md

@@ -0,0 +1,8 @@
+# Feature Implementation
+
+```
+Role: You are building this Expo + Supabase app.
+Goal: Implement [FEATURE] using [SUPABASE SERVICE].
+Constraints: Use RLS for security, handle offline gracefully
+Acceptance: [ ] Works on iOS/Android, [ ] RLS tested, [ ] verify passes
+```

package/bundles/expo-supabase/prompts/02-bug-fix.md

@@ -0,0 +1,9 @@
+# Bug Fix
+
+```
+Role: You are debugging this Supabase app.
+Bug: [DESCRIPTION]
+Platform: [iOS/Android/Both]
+Expected: [WHAT SHOULD HAPPEN]
+Actual: [WHAT HAPPENS]
+```

package/bundles/expo-supabase/prompts/03-safe-refactor.md

@@ -0,0 +1,8 @@
+# Safe Refactor
+
+```
+Role: You are refactoring this Supabase app.
+Goal: [IMPROVEMENT]
+Scope: [FILES]
+Constraints: RLS policies unchanged, behavior identical.
+```

package/bundles/expo-supabase/prompts/04-test-first.md

@@ -0,0 +1,7 @@
+# Test-First Development
+
+```
+Role: Write tests before implementation.
+Feature: [NAME]
+Test: Supabase queries with mocked client
+```

package/bundles/expo-supabase/prompts/05-ui-polish.md

@@ -0,0 +1,7 @@
+# UI Polish
+
+```
+Role: You are polishing this mobile app.
+Target: [SCREEN]
+Polish: loading states, error handling, offline indicators
+```

package/bundles/expo-supabase/prompts/06-security-review.md

@@ -0,0 +1,7 @@
+# Security Review
+
+```
+Role: Security review of Supabase integration.
+Check: RLS policies, secure storage, exposed keys, auth flows
+Output: | Severity | Issue | Table/File | Recommendation |
+```