@ramonclaudio/create-vexpo 0.1.0 → 0.1.2

package/dist/templates/default/src/lib/appAttest.ts

@@ -0,0 +1,78 @@
+import {
+  attestKeyAsync,
+  generateAssertionAsync,
+  generateKeyAsync,
+  isSupported,
+} from "@expo/app-integrity";
+
+export type AppAttestClient = {
+  issueChallenge: () => Promise<{ nonce: string }>;
+  verifyAttestation: (args: {
+    keyId: string;
+    attestation: string;
+    challenge: string;
+  }) => Promise<{ keyId: string }>;
+  verifyAssertion: (args: {
+    keyId: string;
+    assertion: string;
+    payload: string;
+  }) => Promise<{ counter: number }>;
+};
+
+const STORAGE_KEY = "vexpo.app-attest.key-id";
+
+let cachedKeyId: string | null = null;
+
+/**
+ * Whether the running device supports App Attest. False on iOS Simulator
+ * and on iOS < 14.
+ */
+export const supportsAppAttest = (): boolean => isSupported;
+
+/**
+ * App Attest requires the same keyId across a device's lifetime; the caller
+ * should persist the returned keyId and reuse it on every assertion. Rotating
+ * it costs a fresh attestation round-trip.
+ */
+export async function attestThisDevice(client: AppAttestClient): Promise<string> {
+  if (!isSupported) {
+    throw new Error("app-attest: device does not support App Attest");
+  }
+  const { nonce } = await client.issueChallenge();
+  const keyId = await generateKeyAsync();
+  const attestation = await attestKeyAsync(keyId, nonce);
+  await client.verifyAttestation({ keyId, attestation, challenge: nonce });
+  cachedKeyId = keyId;
+  return keyId;
+}
+
+/**
+ * `payload` must be a deterministic encoding signed as the *exact* same bytes
+ * the server will verify (e.g. JSON.stringify with sorted keys, or the raw
+ * mutation arg string).
+ */
+export async function signRequest(
+  client: AppAttestClient,
+  keyId: string,
+  payload: string,
+): Promise<{ counter: number }> {
+  if (!isSupported) {
+    throw new Error("app-attest: device does not support App Attest");
+  }
+  // Sign the exact bytes the server reconstructs: it hashes `payload` and
+  // verifies the signature over sha256(authData || sha256(payload)). Replay is
+  // blocked server-side by the strictly-increasing assertion counter, so no
+  // per-request challenge is needed here (challenges are an attestation step).
+  const assertion = await generateAssertionAsync(keyId, payload);
+  return client.verifyAssertion({ keyId, assertion, payload });
+}
+
+export function getCachedKeyId(): string | null {
+  return cachedKeyId;
+}
+
+export function setCachedKeyId(keyId: string | null): void {
+  cachedKeyId = keyId;
+}
+
+export const APP_ATTEST_STORAGE_KEY = STORAGE_KEY;

package/dist/templates/default/src/lib/assets.ts

@@ -0,0 +1,9 @@
+export const assets = {
+  icon: require("@/assets/icon.png"),
+  brandIconLight: require("@/assets/brand-icon-light.png"),
+  brandIconDark: require("@/assets/brand-icon-dark.png"),
+  splashLight: require("@/assets/splash-image-light.png"),
+  splashDark: require("@/assets/splash-image-dark.png"),
+} as const;
+
+export const assetModules = Object.values(assets);

package/dist/templates/default/src/lib/deep-link.ts

@@ -0,0 +1,82 @@
+import type { Href } from "expo-router";
+import { parse, createURL } from "expo-linking";
+
+export const DeepLinkRoutes = {
+  "/": "/",
+  "/welcome": "/welcome",
+  "/settings": "/(app)/(tabs)/settings",
+  "/about": "/help",
+  "/help": "/help",
+  "/privacy": "/privacy",
+  "/auth/sign-in": "/auth/sign-in",
+  "/auth/sign-up": "/auth/sign-up",
+  "/auth/forgot-password": "/auth/forgot-password",
+  "/auth/reset-password": "/auth/reset-password",
+  "/sign-in": "/auth/sign-in",
+  "/sign-up": "/auth/sign-up",
+  "/forgot-password": "/auth/forgot-password",
+  "/reset-password": "/auth/reset-password",
+  "/linked": "/linked",
+} as const satisfies Record<string, Href>;
+
+export type DeepLinkPath = keyof typeof DeepLinkRoutes;
+
+function normalizePath(raw: string | null | undefined): string {
+  const trimmed = "/" + (raw ?? "").replace(/^\//, "").replace(/\/+$/, "");
+  return trimmed === "/" ? "/" : trimmed;
+}
+
+export function isDeepLinkPath(path: string): path is DeepLinkPath {
+  return path in DeepLinkRoutes;
+}
+
+export function isValidDeepLink(url: string): boolean {
+  if (!url || typeof url !== "string") return false;
+  if (url.includes("..")) return false;
+
+  let parsed;
+  try {
+    parsed = parse(url);
+  } catch {
+    return false;
+  }
+
+  const isRelativePath = url.startsWith("/") && !url.startsWith("//");
+  if (!isRelativePath && !parsed.scheme) return false;
+
+  return isDeepLinkPath(normalizePath(parsed.path));
+}
+
+export type ResolvedDeepLink = {
+  path: DeepLinkPath | null;
+  href: Href | null;
+  params: Record<string, string>;
+};
+
+export function resolveDeepLink(url: string): ResolvedDeepLink {
+  const empty: ResolvedDeepLink = { path: null, href: null, params: {} };
+  if (!url || typeof url !== "string") return empty;
+
+  let parsed;
+  try {
+    parsed = parse(url);
+  } catch {
+    return empty;
+  }
+
+  if (!isValidDeepLink(url)) return empty;
+
+  const path = normalizePath(parsed.path) as DeepLinkPath;
+
+  const params: Record<string, string> = {};
+  if (parsed.queryParams) {
+    for (const [key, value] of Object.entries(parsed.queryParams)) {
+      if (value == null) continue;
+      params[key] = Array.isArray(value) ? value.join(",") : value;
+    }
+  }
+
+  return { path, href: DeepLinkRoutes[path], params };
+}
+
+export { createURL };

package/dist/templates/default/{lib → src/lib}/dev-menu.ts

@@ -43,10 +43,6 @@ function clearLocalStorage() {
   console.log("[DevMenu] localStorage cleared");
 }
 
-/**
- * Registers custom dev menu items visible when shaking the device.
- * Call once at app startup. No-op in production builds.
- */
 export function registerDevMenuItems() {
   if (!__DEV__) return;
 

package/dist/templates/default/{lib → src/lib}/device.ts

@@ -1,40 +1,28 @@
 import Constants, { ExecutionEnvironment } from "expo-constants";
 
-/** Current execution environment: Bare, Standalone, or StoreClient. */
 export const executionEnvironment = Constants.executionEnvironment;
 
-/** Production/release build created with or without EAS Build. */
 export const isStandalone = executionEnvironment === ExecutionEnvironment.Standalone;
 
-/** Running in Expo Go or a development build with expo-dev-client. */
 export const isStoreClient = executionEnvironment === ExecutionEnvironment.StoreClient;
 
-/** True when running in debug mode (__DEV__). */
 export const debugMode = Constants.debugMode;
 
-/** Unique per app session. Changes on every fresh launch. */
 export const sessionId = Constants.sessionId;
 
-/** True if the app is running headless (background task, no UI). */
 export const isHeadless = Constants.isHeadless;
 
-/** Default status bar height in points. Does not account for calls or location tracking. */
+/** Does not account for calls or location tracking. */
 export const statusBarHeight = Constants.statusBarHeight;
 
-/** Runtime version string. Null on web. */
 export const expoRuntimeVersion = Constants.expoRuntimeVersion;
 
-/** Human-readable device name (e.g. "Ramon's iPhone"). */
 export const deviceName = Constants.deviceName;
 
-/** System font names available on this device. */
 export const systemFonts = Constants.systemFonts;
 
-/** EAS config object. Non-null when built with EAS Build. */
 export const easConfig = Constants.easConfig;
 
-/** iOS-specific manifest: buildNumber, model, systemVersion, etc. */
 export const iosManifest = Constants.platform?.ios;
 
-/** Resolves the user agent string a webview would send from this device. */
 export const getWebViewUserAgentAsync = Constants.getWebViewUserAgentAsync;

package/dist/templates/default/{lib → src/lib}/dynamic-font.ts

@@ -1,7 +1,8 @@
 import { useCallback } from "react";
-import { useWindowDimensions } from "react-native";
 import { font } from "@expo/ui/swift-ui/modifiers";
 
+import { textStyleForSize } from "@/lib/text-style";
+
 type FontParams = Parameters<typeof font>[0];
 type Weight = NonNullable<FontParams["weight"]>;
 type Design = NonNullable<FontParams["design"]>;
@@ -36,14 +37,16 @@ function resolveFamily(weight: Weight | undefined, design: Design | undefined):
   return GEIST_BY_WEIGHT[w];
 }
 
+// upstream expo/expo#46007: passing the `font` modifier a `textStyle` scales the
+// Geist family with iOS Dynamic Type natively (Apple's Larger Text path) instead
+// of a JS-side `fontScale` multiply. `textStyleForSize` picks the style from the
+// declared size, which stays the base, so default-size rendering is unchanged
+// and SwiftUI rescales without a JS re-render.
 export function useDynamicFont() {
-  const { fontScale } = useWindowDimensions();
-  return useCallback(
-    (params: FontParams) => {
-      const family = params.family ?? resolveFamily(params.weight, params.design);
-      const size = params.size != null ? params.size * fontScale : params.size;
-      return font({ ...params, family, size });
-    },
-    [fontScale],
-  );
+  return useCallback((params: FontParams) => {
+    const family = params.family ?? resolveFamily(params.weight, params.design);
+    const textStyle =
+      params.textStyle ?? (params.size != null ? textStyleForSize(params.size) : undefined);
+    return font({ ...params, family, textStyle });
+  }, []);
 }

package/dist/templates/default/src/lib/dynamic-symbol-size.ts

@@ -0,0 +1,33 @@
+import { useCallback } from "react";
+import { useWindowDimensions } from "react-native";
+
+// Ceiling on the Dynamic Type multiplier for SF Symbols. At the largest
+// accessibility sizes `fontScale` passes 3x, which overruns icons pinned to a
+// fixed frame (the 80x80 welcome glyph, the 44x44 eye toggle). `dynamicTypeSize`
+// can't bound these: the size is computed here in JS, not through the SwiftUI
+// Dynamic Type environment. So cap the multiplier, the icon analogue of the
+// `dynamicTypeSize` clamp on fixed-geometry text (upstream expo/expo#46540).
+//
+// WORKAROUND, superseded by expo/expo#46714 (open). That PR makes ImageView's
+// SF symbol branch honor font/imageScale/dynamicTypeSize modifiers, so the
+// clamp can move into the SwiftUI Dynamic Type environment natively. Once it
+// merges and ships in an `@expo/ui` release: put `dynamicTypeSize` on each
+// `<Image systemName>` consumer and delete this hook. Consumers are every
+// importer of `useSymbolSize` (grep it, 14 files).
+const MAX_SYMBOL_SCALE = 1.6;
+
+/**
+ * Scales an SF Symbol `<Image systemName>` size with the system Dynamic Type
+ * slider, bounded at `MAX_SYMBOL_SCALE` so icons in fixed frames don't overflow.
+ * SwiftUI `Label` carries this automatically when icons are paired with text;
+ * standalone `Image systemName=` calls don't, so multiply the base size here.
+ *
+ * Temporary: replaced by native modifiers when expo/expo#46714 ships.
+ */
+export function useSymbolSize(): (size: number) => number {
+  const { fontScale } = useWindowDimensions();
+  return useCallback(
+    (size: number) => Math.round(size * Math.min(fontScale, MAX_SYMBOL_SCALE)),
+    [fontScale],
+  );
+}

package/dist/templates/default/src/lib/masks.ts

@@ -0,0 +1,21 @@
+import { USERNAME_MAX_LENGTH } from "@/convex/constants";
+
+// Synchronous input masks for `@expo/ui` `TextField`/`SecureField`. Marked
+// `"worklet"` so an `onTextChange` worklet can call them on the UI thread and
+// rewrite the field's bound `useNativeState` on the same frame the keystroke
+// lands. Sanitizing on the JS thread instead paints the raw character first,
+// then strips it a frame later once the round-trip completes. that flicker is
+// exactly what the worklet path removes (SDK 56 Expo UI worklet integration).
+
+export function maskOtp(text: string): string {
+  "worklet";
+  return text.replace(/\D/g, "").slice(0, 6);
+}
+
+export function maskUsername(text: string): string {
+  "worklet";
+  return text
+    .toLowerCase()
+    .replace(/[^a-z0-9._]/g, "")
+    .slice(0, USERNAME_MAX_LENGTH);
+}

package/dist/templates/default/src/lib/native-state.ts

@@ -0,0 +1,20 @@
+import { useNativeState } from "@expo/ui/swift-ui";
+import { runOnUI } from "react-native-worklets";
+
+type ObservableState<T> = ReturnType<typeof useNativeState<T>>;
+
+// Hops a write to `ObservableState.value` onto the UI worklet runtime so the
+// update lands synchronously on the thread that drives the SwiftUI host. Reads
+// of `.value` are safe from any thread. A JS-thread write still applies, but
+// it's scheduled to the UI thread asynchronously (not readable until it lands)
+// and emits a one-time dev `console.warn` ("ObservableState.value was set from
+// the JS thread..."). The worklet hop lands the write on the same frame and
+// silences that warning. `@expo/ui/swift-ui` registers the SharedObject
+// worklet serializer (`State/index.fx`) so `state` crosses thread boundaries
+// safely.
+export function setNativeValue<T>(state: ObservableState<T>, value: T): void {
+  runOnUI(() => {
+    "worklet";
+    state.value = value;
+  })();
+}

package/dist/templates/default/{lib → src/lib}/notifications.ts

@@ -3,10 +3,6 @@ import * as Device from "expo-device";
 import * as TaskManager from "expo-task-manager";
 import Constants from "expo-constants";
 
-// ---------------------------------------------------------------------------
-// Background task
-// ---------------------------------------------------------------------------
-
 export const BACKGROUND_NOTIFICATION_TASK = "BACKGROUND_NOTIFICATION";
 
 try {
@@ -24,10 +20,6 @@ try {
   if (__DEV__) console.warn("[Notification] defineTask failed:", e);
 }
 
-// ---------------------------------------------------------------------------
-// Foreground handler
-// ---------------------------------------------------------------------------
-
 interface ForegroundOptions {
   shouldShowBanner?: boolean;
   shouldShowList?: boolean;
@@ -36,7 +28,9 @@ interface ForegroundOptions {
 }
 
 export function setForegroundHandler(options?: ForegroundOptions) {
-  if (!Device.isDevice) return;
+  // No Device guard: setNotificationHandler is pure JS (no APNs, no native
+  // gate) and runs fine on the simulator, where local notifications scheduled
+  // via the helpers below still surface a foreground banner.
   try {
     Notifications.setNotificationHandler({
       handleNotification: async () => ({
@@ -53,17 +47,13 @@ export function setForegroundHandler(options?: ForegroundOptions) {
 
 export function registerBackgroundTask() {
   if (!Device.isDevice) return;
-  try {
-    Notifications.registerTaskAsync(BACKGROUND_NOTIFICATION_TASK);
-  } catch (e) {
+  // registerTaskAsync is async: a try/catch around the un-awaited call can't
+  // trap its rejection (e.g. UnavailabilityError), so attach .catch instead.
+  Notifications.registerTaskAsync(BACKGROUND_NOTIFICATION_TASK).catch((e) => {
     if (__DEV__) console.warn("[Notification] registerTaskAsync failed:", e);
-  }
+  });
 }
 
-// ---------------------------------------------------------------------------
-// Permissions
-// ---------------------------------------------------------------------------
-
 export async function getPermissionStatus() {
   const settings = await Notifications.getPermissionsAsync();
   return {
@@ -93,10 +83,6 @@ export async function requestPermission() {
   };
 }
 
-// ---------------------------------------------------------------------------
-// Push tokens
-// ---------------------------------------------------------------------------
-
 export async function getExpoPushToken(): Promise<string | null> {
   if (!Device.isDevice) return null;
 
@@ -127,10 +113,6 @@ export async function getDevicePushToken(): Promise<string | null> {
   }
 }
 
-// ---------------------------------------------------------------------------
-// Scheduling
-// ---------------------------------------------------------------------------
-
 type ContentInput = Notifications.NotificationContentInput;
 type TriggerInput = Notifications.NotificationTriggerInput;
 
@@ -212,10 +194,6 @@ export function scheduleYearly(
   });
 }
 
-// ---------------------------------------------------------------------------
-// Schedule management
-// ---------------------------------------------------------------------------
-
 export function getAllScheduled() {
   return Notifications.getAllScheduledNotificationsAsync();
 }
@@ -235,10 +213,6 @@ export async function getNextTriggerDate(
   return timestamp ? new Date(timestamp) : null;
 }
 
-// ---------------------------------------------------------------------------
-// Badge
-// ---------------------------------------------------------------------------
-
 export function getBadgeCount() {
   return Notifications.getBadgeCountAsync();
 }
@@ -247,10 +221,6 @@ export function setBadgeCount(count: number) {
   return Notifications.setBadgeCountAsync(count);
 }
 
-// ---------------------------------------------------------------------------
-// Dismiss
-// ---------------------------------------------------------------------------
-
 export function dismissNotification(id: string) {
   return Notifications.dismissNotificationAsync(id);
 }
@@ -259,18 +229,10 @@ export function dismissAllNotifications() {
   return Notifications.dismissAllNotificationsAsync();
 }
 
-// ---------------------------------------------------------------------------
-// Presented notifications
-// ---------------------------------------------------------------------------
-
 export function getPresentedNotifications() {
   return Notifications.getPresentedNotificationsAsync();
 }
 
-// ---------------------------------------------------------------------------
-// Last notification response
-// ---------------------------------------------------------------------------
-
 export function clearLastNotificationResponse() {
   Notifications.clearLastNotificationResponse();
 }

package/dist/templates/default/{lib → src/lib}/preferences.ts

@@ -6,8 +6,6 @@ export type ReduceMotionPref = "system" | "always" | "never";
 
 const hapticsStore = createStorage<boolean>("pref.hapticsEnabled", true);
 const reduceMotionStore = createStorage<ReduceMotionPref>("pref.reduceMotion", "system");
-// Default on in dev, off in production. Reveals the Debug screen with version,
-// device, OTA update, and push diagnostics.
 const debugEnabledStore = createStorage<boolean>("pref.debugEnabled", __DEV__);
 
 export const preferences = {

package/dist/templates/default/{lib → src/lib}/schemas.ts

@@ -1,12 +1,3 @@
-/**
- * Form validation schemas.
- *
- * Each form parses raw input via `schema.safeParse(values)` inside
- * `useActionState`. Errors flatten to inline `Section.footer` text under each
- * field. Constants and reserved-name helpers come from `@/convex/constants`
- * to keep client/server in sync.
- */
-
 import { z } from "zod";
 
 import {
@@ -32,9 +23,6 @@ const usernameSchema = z
   .regex(USERNAME_FORMAT_REGEX, { error: "Letters, numbers, dots, and underscores only" })
   .refine((value) => !isReservedUsername(value), { error: "That username is reserved" });
 
-// Optional variant used at sign-up: empty string is valid (the user can pick
-// a handle later from the profile screen). Format and reserved checks only
-// apply when the user actually typed something.
 const optionalUsernameSchema = z
   .string()
   .trim()
@@ -117,6 +105,17 @@ export const profileUpdateSchema = z.object({
   email: emailSchema,
 });
 
+// Accounts can exist without a username (the column is nullable), and the
+// profile field shows "" for them. The strict `usernameSchema` rejects ""
+// (min length 3), which would block those users from saving name/email/bio
+// they never touched. This variant accepts "" so the username stays untouched
+// while the other fields update, mirroring how `signUpSchema` treats it.
+export const profileUpdateOptionalUsernameSchema = z.object({
+  name: nameSchema,
+  username: optionalUsernameSchema,
+  email: emailSchema,
+});
+
 export type SignInValues = z.infer<typeof signInSchema>;
 export type SignInEmailValues = z.infer<typeof signInEmailSchema>;
 export type SignInUsernameValues = z.infer<typeof signInUsernameSchema>;
@@ -125,13 +124,17 @@ export type ForgotPasswordValues = z.infer<typeof forgotPasswordSchema>;
 export type ResetPasswordValues = z.infer<typeof resetPasswordSchema>;
 export type ProfileUpdateValues = z.infer<typeof profileUpdateSchema>;
 
-/**
- * Extract the first error message from a zod safeParse result, formatted for
- * inline display. Returns `null` if validation succeeded.
- */
 export function firstError(
   result: { success: false; error: z.ZodError } | { success: true; data: unknown },
 ): string | null {
   if (result.success) return null;
   return result.error.issues[0]?.message ?? "Invalid input";
 }
+
+export function firstErrorField(
+  result: { success: false; error: z.ZodError } | { success: true; data: unknown },
+): string | null {
+  if (result.success) return null;
+  const first = result.error.issues[0]?.path[0];
+  return typeof first === "string" ? first : null;
+}

package/dist/templates/default/src/lib/text-style.ts

@@ -0,0 +1,20 @@
+import type { font } from "@expo/ui/swift-ui/modifiers";
+
+type TextStyle = NonNullable<Parameters<typeof font>[0]["textStyle"]>;
+
+// upstream expo/expo#46007: map the template's point-size scale onto a SwiftUI
+// `Font.TextStyle` so text rides Apple's Dynamic Type curves (the Larger Text
+// path). The declared size stays the base, the style only sets the scaling
+// curve, so default-size rendering is unchanged.
+export function textStyleForSize(size: number): TextStyle {
+  if (size >= 31) return "largeTitle";
+  if (size >= 26) return "title";
+  if (size >= 21) return "title2";
+  if (size >= 18) return "title3";
+  if (size >= 17) return "body";
+  if (size >= 16) return "callout";
+  if (size >= 15) return "subheadline";
+  if (size >= 13) return "footnote";
+  if (size >= 12) return "caption";
+  return "caption2";
+}

package/dist/templates/default/{lib → src/lib}/updates.ts

@@ -1,5 +1,4 @@
 import {
-  // Constants
   isEnabled,
   updateId,
   channel,
@@ -11,8 +10,6 @@ import {
   manifest,
   createdAt,
   launchDuration,
-
-  // Methods
   checkForUpdateAsync,
   fetchUpdateAsync,
   reloadAsync,
@@ -24,15 +21,11 @@ import {
   setUpdateURLAndRequestHeadersOverride,
   showReloadScreen,
   hideReloadScreen,
-
-  // Enums (runtime values)
   UpdateCheckResultNotAvailableReason,
   UpdatesLogEntryCode,
   UpdatesLogEntryLevel,
   UpdatesCheckAutomaticallyValue,
   UpdateInfoType,
-
-  // Hook
   useUpdates,
 } from "expo-updates";
 

package/dist/templates/default/store.config.json

@@ -40,7 +40,7 @@
       "lastName": "YOUR_LAST_NAME",
       "email": "reviewer@example.com",
       "phone": "+15555555555",
-      "notes": "Run `bunx vexpo rebrand` (or `bunx vexpo full`) before submitting. The wizard replaces every placeholder in this file with your fork's real values.",
+      "notes": "Run `npx vexpo rebrand` (or `npx vexpo full`) before submitting. The wizard replaces every placeholder in this file with your fork's real values.",
       "demoUsername": "review@example.com",
       "demoPassword": "REPLACE_BEFORE_SUBMIT"
     },

package/dist/templates/default/tsconfig.json

@@ -5,7 +5,9 @@
     "allowImportingTsExtensions": true,
     "noEmit": true,
     "paths": {
-      "@/*": ["./*"]
+      "@/convex/*": ["./convex/*"],
+      "@/assets/*": ["./assets/*"],
+      "@/*": ["./src/*"]
     }
   },
   "include": ["**/*.ts", "**/*.tsx", ".expo/types/**/*.ts", "expo-env.d.ts"],

package/dist/templates/default/vitest.config.ts

@@ -2,9 +2,16 @@ import { defineConfig } from "vitest/config";
 import path from "node:path";
 
 export default defineConfig({
+  // Metro injects `__DEV__` at bundle time; define it for node so RN/Expo
+  // modules that branch on it (e.g. `+native-intent.tsx`) are unit-testable.
+  define: {
+    __DEV__: "false",
+  },
   resolve: {
     alias: {
-      "@": path.resolve(__dirname),
+      "@/convex": path.resolve(__dirname, "convex"),
+      "@/assets": path.resolve(__dirname, "assets"),
+      "@": path.resolve(__dirname, "src"),
     },
   },
   test: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ramonclaudio/create-vexpo",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Scaffold a new vexpo project. Expo SDK 56 + Convex + Better Auth + Resend, wired for iOS, real auth, real push, real OTA, real App Store submission.",
   "keywords": [
     "better-auth",
@@ -31,8 +31,7 @@
     "create-vexpo": "./dist/index.js"
   },
   "files": [
-    "dist",
-    "templates"
+    "dist"
   ],
   "type": "module",
   "exports": {
@@ -47,18 +46,19 @@
   "scripts": {
     "build": "tsup",
     "dev": "tsup --watch",
+    "prepublishOnly": "npm run build",
     "typecheck": "tsc --noEmit",
     "test": "echo '(create-vexpo: no per-package tests yet. covered by template e2e)'"
   },
   "dependencies": {
-    "commander": "^14.0.3",
+    "commander": "^15.0.0",
     "execa": "^9.6.1",
     "kleur": "^4.1.5",
     "ora": "^9.4.0",
     "prompts": "^2.4.2"
   },
   "devDependencies": {
-    "@types/node": "^25.6.0",
+    "@types/node": "^25.9.0",
     "@types/prompts": "^2.4.9",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3"