@ramonclaudio/create-vexpo 0.1.0 → 0.1.1

package/dist/templates/default/convex/validators.ts

@@ -1,39 +1,16 @@
-/**
- * Validator Utilities
- *
- * Function argument and return-type validators.
- * Schema-level field validators live in schema.ts.
- */
-
 import { literals } from "convex-helpers/validators";
 import { v } from "convex/values";
 
-/**
- * Paginated response structure.
- * Spread into a v.object() alongside the page shape.
- */
 export const paginatedResponseFields = {
   continueCursor: v.string(),
   isDone: v.boolean(),
 };
 
-// ============================================================================
-// User Profile Validators
-// ============================================================================
-
-/**
- * User profile fields accepted by updateProfile.
- * Name changes go through Better Auth (authClient.updateUser) directly.
- */
+// Name changes go through Better Auth (authClient.updateUser) directly.
 export const userProfileUpdateFields = {
   bio: v.optional(v.string()),
 };
 
-/**
- * Public user profile returned by api.users.getUser and in listUsers pages.
- * Merges app-owned fields (bio, avatar storage resolved to URL) with Better
- * Auth identity fields (name, username).
- */
 export const publicUserProfileValidator = v.object({
   _id: v.id("users"),
   _creationTime: v.number(),
@@ -43,29 +20,15 @@ export const publicUserProfileValidator = v.object({
   bio: v.optional(v.string()),
 });
 
-/**
- * Paginated user list response.
- */
 export const paginatedUsersValidator = v.object({
   page: v.array(publicUserProfileValidator),
   ...paginatedResponseFields,
 });
 
-// ============================================================================
-// Mobile Validators
-// ============================================================================
-
 export const deviceTypeValidator = literals("ios");
 
-// ============================================================================
-// Validation Helpers
-// ============================================================================
-
 const BIO_MAX_LENGTH = 500;
 
-/**
- * Validate a bio field.
- */
 export function validateBio(bio: string): { valid: boolean; error?: string } {
   if (bio.length > BIO_MAX_LENGTH) {
     return { valid: false, error: `Bio must be ${BIO_MAX_LENGTH} characters or less` };

package/dist/templates/default/convex/webhook.ts

@@ -1,32 +1,12 @@
-// Webhook handler factory for Convex HTTP routes.
-//
-// Every webhook source we accept (EAS Build/Submit, Resend delivery events,
-// future Stripe / GitHub) follows the same shape: a signed POST with a
-// shared secret, JSON body, signature in a header. Centralising the
-// boilerplate here means each route gets:
-//
-//   - Body-size cap (defend against runaway upload eating the function budget)
-//   - Constant-time signature verification (HMAC, configurable algorithm)
-//   - Optional replay protection (timestamp window check)
-//   - Per-request correlation ID + structured access log with timing
-//   - Uniform JSON error responses with a `requestId` for grepping
-//
-// The handler the caller supplies receives the parsed JSON body, raw text
-// body (in case re-hashing is needed), and the request ID. It returns a
-// `Response`; the factory wraps timing + logging around it.
-
 import type { GenericActionCtx } from "convex/server";
 
-import { log, newRequestId } from "./log.ts";
+import { log, newRequestId } from "./log";
 
 export type SignatureAlgorithm = "sha1" | "sha256";
 
 export type WithWebhookOptions = {
-  /** Stable name in logs. Example: "eas-webhook", "resend-webhook". */
   source: string;
-  /** Request header carrying the signature. Example: "expo-signature". */
   signatureHeader: string;
-  /** Convex env var holding the shared secret. Example: "EAS_WEBHOOK_SECRET". */
   secretEnv: string;
   /** HMAC algorithm. EAS uses SHA-1, Stripe uses SHA-256, Resend uses Svix's HMAC-SHA256. */
   algorithm: SignatureAlgorithm;
@@ -35,16 +15,9 @@ export type WithWebhookOptions = {
    * EAS sends `sha1=<hex>`, Stripe sends `t=<ts>,v1=<hex>`, etc. Default `""`.
    */
   signaturePrefix?: string;
-  /** Cap the request body size in bytes. Defaults to 1 MiB. */
   maxBodyBytes?: number;
-  /**
-   * Optional max age of the request in seconds. If set, the handler reads
-   * the timestamp from the named header and rejects if too old. Defaults
-   * to "no replay window check."
-   */
   replay?: {
     header: string;
-    /** Allowed clock skew in seconds. */
     maxAgeSeconds: number;
   };
 };
@@ -136,9 +109,6 @@ export function withWebhook<T = unknown>(
         status: response.status,
         durationMs: Date.now() - start,
       });
-      // Always attach X-Request-Id to the response so callers can correlate
-      // logs even when the handler doesn't set it explicitly. Don't clobber
-      // a value the handler already chose.
       if (!response.headers.get("X-Request-Id")) {
         const headers = new Headers(response.headers);
         headers.set("X-Request-Id", requestId);

package/dist/templates/default/convex.json

@@ -1,6 +1,5 @@
 {
   "bundler": {
     "includeSourcesContent": false
-  },
-  "typescriptCompiler": "tsgo"
+  }
 }

package/dist/templates/default/metro.config.js

@@ -3,7 +3,15 @@ const { getDefaultConfig } = require("expo/metro-config");
 /** @type {import('expo/metro-config').MetroConfig} */
 const config = getDefaultConfig(__dirname);
 
-config.resolver.blockList = [/\.env\.convex\.local$/];
+// Extend, don't replace: Expo's default blockList excludes `.expo/types`
+// (prevents spurious Fast Refresh on generated typed-routes declarations),
+// `ios/Pods`, and Metro's `__tests__` dir. Reassigning would drop all of those.
+config.resolver.blockList = [
+  ...(Array.isArray(config.resolver.blockList)
+    ? config.resolver.blockList
+    : [config.resolver.blockList]),
+  /\.env\.convex\.local$/,
+];
 
 config.transformer.minifierConfig = {
   compress: {

package/dist/templates/default/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vexpo",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "private": true,
   "main": "expo-router/entry",
   "scripts": {
@@ -20,102 +20,99 @@
     "ios:dev": "expo run:ios",
     "ios:device": "node scripts/_run.mjs scripts/clean.ts --metro && expo prebuild --clean --platform ios && expo run:ios --device --no-build-cache",
     "prebuild": "expo prebuild --clean --platform ios",
-    "eas:dev": "bunx eas build -p ios --profile development:simulator",
-    "eas:dev:device": "bunx eas build -p ios --profile development:device",
-    "eas:tf": "bunx eas build -p ios --profile production --auto-submit-with-profile testflight",
-    "eas:prod": "bunx eas build -p ios --profile production",
-    "metadata:lint": "bunx eas metadata:lint",
-    "metadata:push": "bunx eas metadata:lint && bunx eas metadata:push",
-    "metadata:pull": "bunx eas metadata:pull",
-    "env:pull": "bunx eas env:pull --environment development",
-    "env:pull:prod": "bunx eas env:pull --environment production",
+    "eas:dev": "npx eas build -p ios --profile development:simulator",
+    "eas:dev:device": "npx eas build -p ios --profile development:device",
+    "eas:tf": "npx eas build -p ios --profile production --auto-submit-with-profile testflight",
+    "eas:prod": "npx eas build -p ios --profile production",
+    "metadata:lint": "npx eas metadata:lint",
+    "metadata:push": "npx eas metadata:lint && npx eas metadata:push",
+    "metadata:pull": "npx eas metadata:pull",
+    "env:pull": "npx eas env:pull --environment development",
+    "env:pull:prod": "npx eas env:pull --environment production",
     "clean": "node scripts/_run.mjs scripts/clean.ts",
     "clean:metro": "node scripts/_run.mjs scripts/clean.ts --metro",
     "clean:state": "node scripts/_run.mjs scripts/clean.ts --state",
     "typecheck": "tsc --noEmit",
-    "fp": "bunx @expo/fingerprint fingerprint:generate",
-    "fp:diff": "bunx @expo/fingerprint fingerprint:diff",
+    "fp": "npx @expo/fingerprint fingerprint:generate",
+    "fp:diff": "npx @expo/fingerprint fingerprint:diff",
     "lint": "oxlint",
     "format": "oxfmt",
     "format:check": "oxfmt --check",
     "test": "vitest run",
     "test:watch": "vitest",
-    "upgrade": "bunx expo install expo@canary && bunx expo install --fix",
-    "upgrade:stable": "bunx expo install expo@latest && bunx expo install --fix"
+    "upgrade": "npx expo install expo@next && npx expo install --fix",
+    "upgrade:stable": "npx expo install expo@latest && npx expo install --fix",
+    "updates:gen-cert": "node scripts/gen-update-cert.mjs"
   },
   "dependencies": {
-    "@better-auth/expo": "1.6.9",
-    "@convex-dev/better-auth": "file:./patches/convex-dev-better-auth-0.12.2.tgz",
+    "@better-auth/expo": "1.6.16",
+    "@convex-dev/better-auth": "0.12.3",
     "@convex-dev/rate-limiter": "^0.3.2",
-    "@convex-dev/resend": "^0.2.3",
-    "@expo/ui": "56.0.0-canary-20260506-03817f5",
-    "@react-navigation/native": "7.2.3",
-    "better-auth": "1.6.9",
-    "convex": "^1.37.0",
-    "convex-helpers": "^0.1.116",
-    "expo": "56.0.0-canary-20260506-03817f5",
-    "expo-apple-authentication": "56.0.0-canary-20260506-03817f5",
-    "expo-application": "56.0.0-canary-20260506-03817f5",
-    "expo-asset": "56.0.0-canary-20260506-03817f5",
-    "expo-blur": "56.0.0-canary-20260506-03817f5",
-    "expo-build-properties": "56.0.0-canary-20260506-03817f5",
-    "expo-clipboard": "56.0.0-canary-20260506-03817f5",
-    "expo-constants": "56.0.0-canary-20260506-03817f5",
-    "expo-dev-client": "56.0.0-canary-20260506-03817f5",
-    "expo-device": "56.0.0-canary-20260506-03817f5",
-    "expo-font": "56.0.0-canary-20260506-03817f5",
-    "expo-glass-effect": "56.0.0-canary-20260506-03817f5",
-    "expo-haptics": "56.0.0-canary-20260506-03817f5",
-    "expo-image": "56.0.0-canary-20260506-03817f5",
-    "expo-image-picker": "56.0.0-canary-20260506-03817f5",
-    "expo-insights": "56.0.0-canary-20260506-03817f5",
-    "expo-linking": "56.0.0-canary-20260506-03817f5",
-    "expo-local-authentication": "56.0.0-canary-20260506-03817f5",
-    "expo-network": "56.0.0-canary-20260506-03817f5",
-    "expo-notifications": "56.0.0-canary-20260506-03817f5",
-    "expo-router": "56.0.0-canary-20260506-03817f5",
-    "expo-secure-store": "56.0.0-canary-20260506-03817f5",
-    "expo-sharing": "56.0.0-canary-20260506-03817f5",
-    "expo-splash-screen": "56.0.0-canary-20260506-03817f5",
-    "expo-sqlite": "56.0.0-canary-20260506-03817f5",
-    "expo-status-bar": "56.0.0-canary-20260506-03817f5",
-    "expo-symbols": "56.0.0-canary-20260506-03817f5",
-    "expo-system-ui": "56.0.0-canary-20260506-03817f5",
-    "expo-task-manager": "56.0.0-canary-20260506-03817f5",
-    "expo-updates": "56.0.0-canary-20260506-03817f5",
-    "expo-web-browser": "56.0.0-canary-20260506-03817f5",
+    "@convex-dev/resend": "^0.2.4",
+    "@expo/app-integrity": "~56.0.3",
+    "@expo/ui": "~56.0.16",
+    "better-auth": "1.6.16",
+    "cbor-x": "^1.6.4",
+    "convex": "^1.40.0",
+    "convex-helpers": "^0.1.118",
+    "expo": "~56.0.9",
+    "expo-apple-authentication": "~56.0.4",
+    "expo-application": "~56.0.3",
+    "expo-asset": "~56.0.10",
+    "expo-blur": "~56.0.3",
+    "expo-build-properties": "~56.0.17",
+    "expo-clipboard": "~56.0.4",
+    "expo-constants": "~56.0.11",
+    "expo-dev-client": "~56.0.19",
+    "expo-device": "~56.0.4",
+    "expo-font": "~56.0.4",
+    "expo-glass-effect": "~56.0.4",
+    "expo-haptics": "~56.0.3",
+    "expo-image": "~56.0.10",
+    "expo-image-picker": "~56.0.16",
+    "expo-insights": "~56.0.16",
+    "expo-linking": "~56.0.13",
+    "expo-local-authentication": "~56.0.4",
+    "expo-network": "~56.0.5",
+    "expo-notifications": "~56.0.16",
+    "expo-router": "~56.2.9",
+    "expo-secure-store": "~56.0.4",
+    "expo-sharing": "~56.0.16",
+    "expo-splash-screen": "~56.0.10",
+    "expo-sqlite": "~56.0.4",
+    "expo-status-bar": "~56.0.4",
+    "expo-symbols": "~56.0.6",
+    "expo-system-ui": "~56.0.5",
+    "expo-task-manager": "~56.0.17",
+    "expo-updates": "~56.0.18",
+    "expo-web-browser": "~56.0.5",
     "react": "19.2.3",
+    "react-dom": "19.2.3",
     "react-native": "0.85.3",
     "react-native-gesture-handler": "~2.31.2",
     "react-native-keyboard-controller": "1.21.6",
-    "react-native-reanimated": "4.3.0",
+    "react-native-reanimated": "4.3.1",
     "react-native-safe-area-context": "~5.7.0",
-    "react-native-screens": "4.25.0-beta.1",
+    "react-native-screens": "4.25.2",
     "react-native-worklets": "0.8.3",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@ramonclaudio/vexpo": "^0.1.0",
-    "@types/node": "^25.6.0",
-    "@types/react": "~19.2.14",
-    "@vitest/ui": "^4.1.5",
-    "convex-test": "^0.0.51",
-    "oxfmt": "^0.48.0",
-    "oxlint": "^1.63.0",
-    "tsx": "^4.21.0",
+    "@types/node": "^25.9.0",
+    "@types/react": "~19.2.16",
+    "@vitest/ui": "^4.1.8",
+    "convex-test": "^0.0.53",
+    "oxfmt": "^0.54.0",
+    "oxlint": "^1.68.0",
+    "tsx": "^4.22.4",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.5"
+    "vitest": "^4.1.8"
   },
   "overrides": {
-    "@better-auth/passkey": "1.6.9",
-    "@expo/ui": "56.0.0-canary-20260506-03817f5"
+    "react-dom": "19.2.3"
   },
   "expo": {
-    "install": {
-      "exclude": [
-        "react-native-reanimated"
-      ]
-    },
     "doctor": {
       "reactNativeDirectoryCheck": {
         "enabled": true,

package/dist/templates/default/plugins/README.md

@@ -6,4 +6,8 @@ Forces automatic code signing for the Xcode project during local `prebuild`. Set
 
 No-ops when `EAS_BUILD` is set, so EAS continues to use the provisioning profile from the build credentials.
 
-Use: local `bun run ios` on a physical device without juggling provisioning profiles in Xcode.
+Use: local `npm run ios` on a physical device without juggling provisioning profiles in Xcode.
+
+## `with-pod-deployment-target.js`
+
+Forces every CocoaPods target to `IPHONEOS_DEPLOYMENT_TARGET = 16.4` during `prebuild`, injected into the `Podfile` right after `react_native_post_install`. Without it, transitive pods can fall back to a lower minimum and break the iOS 16.4 floor the template targets. Re-running is safe: a marker comment makes it a no-op once applied.

package/dist/templates/default/scripts/README.md

@@ -1,6 +1,6 @@
 # scripts
 
-Build and maintenance scripts. Setup orchestration lives in the published `vexpo` CLI (run via `bunx vexpo`), not here.
+Build and maintenance scripts. Setup orchestration lives in the published `vexpo` CLI (run via `npx vexpo`), not here.
 
 ## What's in this directory
 
@@ -17,18 +17,18 @@ Anything else (preflight checks, env validation, version bumps) lives in the `ve
 Use the `vexpo` CLI:
 
 ```bash
-bunx vexpo lite               # dev-mode setup (Convex + Better Auth only)
-bunx vexpo full               # full provisioning to TestFlight-ready
-bunx vexpo doctor             # cross-source drift detection
-bunx vexpo env push           # sync from .env.local + .env.prod to Convex/EAS
-bunx vexpo apple asc-key      # validate ASC API key
-bunx vexpo apple services-id  # attach SIWA capability to App ID
-bunx vexpo apple jwt          # sign client_secret JWT, push to Convex
+npx vexpo lite               # dev-mode setup (Convex + Better Auth only)
+npx vexpo full               # full provisioning to TestFlight-ready
+npx vexpo doctor             # cross-source drift detection
+npx vexpo env push           # sync from .env.local + .env.prod to Convex/EAS
+npx vexpo apple asc-key      # validate ASC API key
+npx vexpo apple services-id  # attach SIWA capability to App ID
+npx vexpo apple jwt          # sign client_secret JWT, push to Convex
 ```
 
 Version bumps run through `eas build:version:set` / `eas build:version:sync` (`appVersionSource: "remote"` in `eas.json` puts EAS in charge of the version).
 
-The CLI itself ships from [`vexpo` on npm](https://www.npmjs.com/package/vexpo). Source lives at [`github.com/ramonclaudio/vexpo`](https://github.com/ramonclaudio/vexpo).
+The CLI itself ships from [`@ramonclaudio/vexpo` on npm](https://www.npmjs.com/package/@ramonclaudio/vexpo). Source lives at [`github.com/ramonclaudio/vexpo`](https://github.com/ramonclaudio/vexpo).
 
 ## Conventions
 

package/dist/templates/default/scripts/_run.mjs

@@ -1,21 +1,8 @@
 #!/usr/bin/env node
 /**
- * Runtime-agnostic launcher for vexpo's TypeScript setup scripts.
- *
- * Picks the first available runtime that handles full TypeScript syntax:
- *
- *   1. bun. native TS, fastest startup
- *   2. tsx (devDep). esbuild-based TS runner, works under any node 18+
- *
- * Note: we don't use node's `--experimental-strip-types` because it's
- * strip-only. it doesn't transform syntax (parameter properties, enums,
- * namespaces, etc all error out). bun and tsx handle full TS.
- *
- * Then re-execs the target script with the selected runtime, forwarding
- * argv and stdio. Exit code mirrors the child.
- *
- * Usage (from package.json scripts):
- *   node scripts/_run.mjs scripts/setup.ts [args...]
+ * We don't use node's `--experimental-strip-types` because it's strip-only.
+ * It doesn't transform syntax (parameter properties, enums, namespaces, etc
+ * all error out). bun and tsx handle full TS.
  */
 
 import { spawn, spawnSync } from "node:child_process";
@@ -46,18 +33,14 @@ function which(bin) {
 }
 
 function pickRuntime() {
-  // Already running under bun? Use it directly (fastest).
   if (process.versions.bun) return { cmd: process.execPath, args: [target] };
 
-  // bun on PATH
   const bun = which("bun");
   if (bun) return { cmd: bun, args: [target] };
 
-  // tsx fallback (any node 18+)
   const tsx = resolve(REPO, "node_modules", ".bin", "tsx");
   if (existsSync(tsx)) return { cmd: tsx, args: [target] };
 
-  // tsx via npx as last resort
   const npx = which("npx");
   if (npx) return { cmd: npx, args: ["tsx", target] };