@ramonclaudio/create-vexpo 0.1.0 → 0.1.2

package/dist/templates/default/__tests__/lib/text-style.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, test } from "vitest";
+
+import { textStyleForSize } from "@/lib/text-style";
+
+describe("textStyleForSize", () => {
+  test("maps every point size in the template's type scale to a Font.TextStyle", () => {
+    expect(textStyleForSize(34)).toBe("largeTitle");
+    expect(textStyleForSize(32)).toBe("largeTitle");
+    expect(textStyleForSize(30)).toBe("title");
+    expect(textStyleForSize(28)).toBe("title");
+    expect(textStyleForSize(24)).toBe("title2");
+    expect(textStyleForSize(22)).toBe("title2");
+    expect(textStyleForSize(20)).toBe("title3");
+    expect(textStyleForSize(18)).toBe("title3");
+    expect(textStyleForSize(17)).toBe("body");
+    expect(textStyleForSize(16)).toBe("callout");
+    expect(textStyleForSize(15)).toBe("subheadline");
+    expect(textStyleForSize(14)).toBe("footnote");
+    expect(textStyleForSize(13)).toBe("footnote");
+    expect(textStyleForSize(12)).toBe("caption");
+    expect(textStyleForSize(11)).toBe("caption2");
+  });
+
+  test("clamps sizes below the scale to caption2", () => {
+    expect(textStyleForSize(8)).toBe("caption2");
+  });
+
+  test("clamps sizes above the scale to largeTitle", () => {
+    expect(textStyleForSize(64)).toBe("largeTitle");
+  });
+});

package/dist/templates/default/_env.example

@@ -1,10 +1,10 @@
-# .env.local template. Copy to .env.local then run `bun run setup`.
-# `bun run setup` writes most of these for you. The two identity vars
+# .env.local template. Copy to .env.local then run `npm run setup`.
+# `npm run setup` writes most of these for you. The two identity vars
 # (EXPO_PUBLIC_APP_BUNDLE_ID and EXPO_PUBLIC_APPLE_TEAM_ID) are prompted by
-# `bun run setup:convex`. Edit by hand if you prefer.
+# `npm run setup:convex`. Edit by hand if you prefer.
 
 # ---------------------------------------------------------------------------
-# Convex deployment (written by `bun run setup:convex`)
+# Convex deployment (written by `npm run setup:convex`)
 # ---------------------------------------------------------------------------
 CONVEX_DEPLOYMENT=
 EXPO_PUBLIC_CONVEX_URL=
@@ -12,7 +12,7 @@ EXPO_PUBLIC_CONVEX_SITE_URL=
 EXPO_PUBLIC_SITE_URL=
 
 # ---------------------------------------------------------------------------
-# iOS identity (prompted by `bun run setup:convex`, also pushed to Convex env)
+# iOS identity (prompted by `npm run setup:convex`, also pushed to Convex env)
 # ---------------------------------------------------------------------------
 # Reverse-DNS bundle id, e.g. com.you.vexpo.
 EXPO_PUBLIC_APP_BUNDLE_ID=
@@ -26,9 +26,9 @@ EXPO_PUBLIC_APPLE_TEAM_ID=
 # EXPO_PUBLIC_EXPO_OWNER=
 # Toggles `name` to "Vexpo (Dev)" so dev and prod can install side-by-side.
 # APP_VARIANT=development
-# Pre-fills the full-access Resend key for `bun run setup:resend` (else prompts).
+# Pre-fills the full-access Resend key for `npm run setup:resend` (else prompts).
 # RESEND_FULL_ACCESS_KEY=
-# Skips prompts in `bun run setup:apple` / `setup:asc`.
+# Skips prompts in `npm run setup:apple` / `setup:asc`.
 # APPLE_P8_PATH=
 # APPLE_AUTH_KEY_PATH=
 # APPLE_ASC_ISSUER_ID=

package/dist/templates/default/_gitattributes

@@ -2,6 +2,6 @@
 README.md merge=ours
 .env.example merge=ours
 package.json merge=ours
-bun.lock merge=ours
+package-lock.json merge=ours
 app.json merge=ours
 eas.json merge=ours

package/dist/templates/default/_gitignore

@@ -5,6 +5,7 @@ node_modules/
 .env
 .env.*
 !.env.example
+.envrc
 
 # Expo
 .expo/
@@ -22,12 +23,26 @@ ios/
 AuthKey_*
 SubscriptionKey_*
 
+# EAS Update code-signing private key. The matching public cert at
+# `certs/certificate.pem` IS committed (it's bundled in the .ipa and used
+# on-device to verify OTA bundles). The private key lives only on the
+# author's machine + as an EAS file-type secret (`EAS_UPDATE_PRIVATE_KEY`).
+keys/
+private-key.pem
+*.private-key.pem
+
 # EAS (CLI state; keep workflows tracked)
 .eas/*
 !.eas/workflows/
 
-# Agents / local AI tooling
-.claude/
+# Agents / local AI tooling.
+# The monorepo .gitignore drops .claude/ repo-wide; the template re-includes
+# its own .claude/settings.json so the scaffolded SDK 56 agent config ships
+# with the template. Everything else inside .claude/ (transcripts, hooks,
+# local state) stays untracked.
+!.claude/
+.claude/*
+!.claude/settings.json
 .agents/
 .cursor/
 .aider*

package/dist/templates/default/_npmrc

@@ -0,0 +1,7 @@
+# Expo's preview tags advance React + React DOM independently of the rest of
+# the dep tree, so transitive peerOptional `react-dom` resolves to a newer
+# version than the root `react` pin. npm 7+ rejects this by default (ERESOLVE);
+# bun installs it loose. Setting legacy-peer-deps mirrors bun's behavior and
+# matches Expo's own template defaults. Drop this once the Expo SDK ships with
+# react + react-dom aligned and EAS Build's npm version is happy with it.
+legacy-peer-deps=true

package/dist/templates/default/_oxlintrc.json

@@ -19,7 +19,7 @@
     "import/no-unassigned-import": "off",
     "no-await-in-loop": "off",
     "unicorn/consistent-function-scoping": "off",
-    "no-underscore-dangle": ["warn", { "allow": ["_id", "_creationTime"] }],
+    "no-underscore-dangle": ["warn", { "allow": ["_id", "_creationTime", "_contentAvailable"] }],
     "no-shadow": ["warn", { "allow": ["resolve", "reject"] }]
   },
   "ignorePatterns": [

package/dist/templates/default/app-store/accessibility.config.json

@@ -0,0 +1,20 @@
+{
+  "_comment": "Drives `vexpo asc:accessibility lint`. The starter template ships VoiceOver labels, DynamicType, reduced-motion respect, and DynamicColorIOS for high-contrast support. Audit each feature against your actual user flows before declaring FULLY_SUPPORTS in production.",
+  "entries": [
+    {
+      "deviceFamily": "IPHONE",
+      "features": {
+        "VOICE_OVER": "FULLY_SUPPORTS",
+        "VOICE_CONTROL": "FULLY_SUPPORTS",
+        "LARGER_TEXT": "FULLY_SUPPORTS",
+        "DARK_INTERFACE": "FULLY_SUPPORTS",
+        "SUFFICIENT_CONTRAST": "FULLY_SUPPORTS",
+        "DIFFERENTIATION_WITHOUT_COLOR_ALONE": "FULLY_SUPPORTS",
+        "REDUCED_MOTION": "FULLY_SUPPORTS",
+        "CAPTIONS": "NOT_APPLICABLE",
+        "AUDIO_DESCRIPTIONS": "NOT_APPLICABLE"
+      },
+      "notes": "Verify against the actual screens in your app before submission. The defaults reflect what the vexpo template ships, not what your app delivers."
+    }
+  ]
+}

package/dist/templates/default/app-store/privacy.config.json

@@ -0,0 +1,27 @@
+{
+  "_comment": "Drives `vexpo asc:privacy lint`. The dashboard form at App Store Connect is the source of truth for submission; this file is for keeping a versioned, reviewable copy alongside the code. Default state: the starter collects no data beyond what Better Auth needs for sign-in (email + opaque user id), which `IDENTIFIERS` covers. Tighten or expand to match your app.",
+  "collectsData": true,
+  "entries": [
+    {
+      "category": "CONTACT_INFO",
+      "collected": true,
+      "usedForTracking": false,
+      "linkedToUser": true,
+      "purposes": ["APP_FUNCTIONALITY"]
+    },
+    {
+      "category": "IDENTIFIERS",
+      "collected": true,
+      "usedForTracking": false,
+      "linkedToUser": true,
+      "purposes": ["APP_FUNCTIONALITY"]
+    },
+    {
+      "category": "DIAGNOSTICS",
+      "collected": true,
+      "usedForTracking": false,
+      "linkedToUser": false,
+      "purposes": ["ANALYTICS", "APP_FUNCTIONALITY"]
+    }
+  ]
+}

package/dist/templates/default/app.config.ts

@@ -1,10 +1,22 @@
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
 import type { ConfigContext, ExpoConfig } from "expo/config";
 
-import pkg from "./package.json";
+// Read JSON via fs, not a static import or `require`. Node 24 strips TS types
+// natively and loads this file as ESM (it has `export default`), where bare
+// JSON imports need an attribute and `require`/`__dirname` don't exist. The
+// expo CLI path transpiles to CJS via sucrase. `fs` + `process.cwd()` is the
+// only shape that reads identically under both, and cwd is the project root in
+// every context that evaluates this config (expo, eas, prebuild).
+const pkg = JSON.parse(readFileSync(resolve(process.cwd(), "package.json"), "utf8")) as {
+  name: string;
+  version: string;
+};
 
 const IS_DEV = process.env.APP_VARIANT === "development";
 
-// Identity comes from .env.local (written by `bun run setup:convex`). Fallbacks
+// Identity comes from .env.local (written by `npm run setup:convex`). Fallbacks
 // keep `expo prebuild` from crashing on a fresh checkout, but a real build
 // requires real values.
 const BUNDLE_ID = process.env.EXPO_PUBLIC_APP_BUNDLE_ID ?? `com.example.${pkg.name}`;
@@ -24,7 +36,9 @@ type StoreConfig = {
 };
 const storeConfig: StoreConfig | undefined = (() => {
   try {
-    return require("./store.config.json") as StoreConfig;
+    return JSON.parse(
+      readFileSync(resolve(process.cwd(), "store.config.json"), "utf8"),
+    ) as StoreConfig;
   } catch {
     return undefined;
   }
@@ -38,11 +52,24 @@ const SUPPORT = {
 };
 
 export default ({ config }: ConfigContext): ExpoConfig => {
-  // `eas init` writes `extra.eas.projectId` into app.json. The static config
-  // is merged into our return value via `...config`, so reading from
-  // `config.extra?.eas?.projectId` here picks up the EAS project id without
-  // hand-editing this file every time `eas init` runs.
-  const projectId = (config.extra as { eas?: { projectId?: string } } | undefined)?.eas?.projectId;
+  // Primary source: `eas init` writes `extra.eas.projectId` into app.json, and
+  // the static config is merged into our return value via `...config`. Reading
+  // from `config.extra?.eas?.projectId` picks that up without hand-editing
+  // this file.
+  //
+  // Fallback: `process.env.EAS_PROJECT_ID`. Useful when the var is in the
+  // parent process env at eas-cli invocation time — e.g. shell export, direnv
+  // auto-load, or an eas.json profile `env` entry. Note that eas-cli itself
+  // does NOT auto-load `.env.local` for projectId resolution (it spawns
+  // `expo config` with `EXPO_NO_DOTENV=1` to keep config eval deterministic),
+  // so dropping `EAS_PROJECT_ID` into `.env.local` alone won't skip the
+  // `Configure this project?` prompt on a fresh checkout. The fallback DOES
+  // help vexpo's own CLI commands (which load `.env.local` themselves) and
+  // any tooling that pre-populates process.env before invoking expo/eas.
+  // See `README.md` for the recommended direnv-based local setup.
+  const projectId =
+    (config.extra as { eas?: { projectId?: string } } | undefined)?.eas?.projectId ??
+    process.env.EAS_PROJECT_ID;
 
   return {
     ...config,
@@ -61,41 +88,60 @@ export default ({ config }: ConfigContext): ExpoConfig => {
     scheme: "vexpo",
     icon: "./assets/icon.png",
     ...(EXPO_OWNER ? { owner: EXPO_OWNER } : {}),
+    // Fingerprint policy: a native change auto-bumps the runtime hash so OTA
+    // updates never load against an incompatible binary. The local-vs-EAS
+    // drift that broke earlier SDK 56 builds no longer reproduces on current
+    // deps (precompiled modules + codegen land in `ios/`, which fingerprint
+    // ignores; jsi artifacts covered by @expo/fingerprint >=0.19.3 defaults),
+    // so no autolinking workaround is needed. Verified by unpatched EAS builds
+    // clearing CONFIGURE_EXPO_UPDATES.
     runtimeVersion: { policy: "fingerprint" },
     developmentClient: {
       silentLaunch: true,
     },
     updates: {
+      // Derived from projectId, which resolves identically locally and on EAS
+      // workers because both read the plaintext `EAS_PROJECT_ID` env var. That
+      // symmetry keeps `extra.eas`/`updates.url`/`enabled` in fingerprint parity
+      // with no `sourceSkips`. If projectId is unset (fresh fork before setup),
+      // this is false on both sides: still consistent, OTA just stays inactive
+      // until configured.
       enabled: !!projectId,
       checkAutomatically: "ON_LOAD",
-      fallbackToCacheTimeout: 0,
-      enableBsdiffPatchSupport: true,
+      // Brief patience for the update server before falling back to the
+      // bundled JS. Zero blocks every cold launch indefinitely on flaky
+      // networks (hotel WiFi, captive portals). 2 seconds is enough for
+      // a fast check on good networks and a graceful timeout otherwise.
+      fallbackToCacheTimeout: 2000,
       ...(projectId ? { url: `https://u.expo.dev/${projectId}` } : {}),
       // `expo-channel-name` request header is required for runtime channel
-      // surfing via `Updates.setUpdateRequestHeadersOverride`. Baseline
-      // value is overwritten per-build by EAS Build (it reads the channel
-      // from the eas.json build profile). Without this baseline declared
-      // here, override calls reject with "unknown header".
-      requestHeaders: { "expo-channel-name": "production" },
+      // surfing via `Updates.setUpdateRequestHeadersOverride`. EAS Build
+      // overwrites the baseline per-build from the eas.json build profile,
+      // so the value here only matters for local dev/prebuild without an
+      // EAS profile. `development` is the safe default; a missed profile
+      // override won't accidentally pull production OTA into a dev build.
+      requestHeaders: { "expo-channel-name": "development" },
       // Only ship icon + splash with each OTA. Fonts, sounds, and other
       // build-baked assets stay in the .ipa and never download. Shrinks
       // bundle by ~95% on diff-able updates.
       assetPatternsToBeBundled: ["assets/icon.png", "assets/splash-image-*.png"],
-      // Production/Enterprise plan opt-in. Sign updates with a private key
-      // checked against the bundled certificate so a compromised CDN can't
-      // ship arbitrary JS. Generate keypair + cert via:
-      //   bunx expo-updates codesigning:generate \
-      //     --certificate-output-directory certs \
-      //     --key-output-directory ../keys \
-      //     --certificate-validity-duration-years 10 \
-      //     --certificate-common-name "Your Organization Name"
-      // Store `../keys/private-key.pem` as an EAS env file-type secret
-      // (`EAS_UPDATE_PRIVATE_KEY`) and reference it from
-      // `.eas/workflows/deploy-production.yml`'s update job via
-      // `params.private_key_path: "$EAS_UPDATE_PRIVATE_KEY"`. Then
-      // uncomment the block below.
-      // codeSigningCertificate: "./certs/certificate.pem",
-      // codeSigningMetadata: { keyid: "main", alg: "rsa-v1_5-sha256" },
+      // End-to-end OTA code signing. The cert is committed at
+      // `./certs/certificate.pem` and bundled with each .ipa; the device
+      // verifies every update against it before applying. The matching
+      // private key lives ONLY as an EAS file-type secret
+      // (`EAS_UPDATE_PRIVATE_KEY`) and never lands in the repo.
+      // Generate the keypair once with `npm run updates:gen-cert`, upload
+      // the key to EAS, and every subsequent `eas update` signs locally
+      // before publishing. A compromised CDN or EAS account cannot ship
+      // arbitrary JS. Until the cert exists the block stays off and
+      // updates ship unsigned (fine for prototyping; not for production).
+      // https://docs.expo.dev/eas-update/code-signing/
+      ...(existsSync(resolve(process.cwd(), "certs", "certificate.pem"))
+        ? {
+            codeSigningCertificate: "./certs/certificate.pem",
+            codeSigningMetadata: { keyid: "main", alg: "rsa-v1_5-sha256" },
+          }
+        : {}),
     },
     ios: {
       supportsTablet: false,
@@ -108,6 +154,17 @@ export default ({ config }: ConfigContext): ExpoConfig => {
         ITSAppUsesNonExemptEncryption: false,
         LSApplicationQueriesSchemes: ["mailto", "tel", "sms", "itms-apps"],
       },
+      // App Attest entitlement. `@expo/app-integrity` calls the
+      // DCAppAttestService API; iOS rejects unentitled access. The value
+      // `production` keeps every signed/distributed build (TestFlight,
+      // App Store) in the production AAGUID. Local debug builds with the
+      // Xcode debugger attached attest against the development AAGUID
+      // automatically without changing this value, so the same entry
+      // works across simulator-impossible and real-device paths.
+      // https://developer.apple.com/documentation/bundleresources/entitlements/com.apple.developer.devicecheck.appattest-environment
+      entitlements: {
+        "com.apple.developer.devicecheck.appattest-environment": "production",
+      },
       associatedDomains: [
         `applinks:${process.env.EXPO_PUBLIC_CONVEX_SITE_URL?.replace(/^https?:\/\//, "") ?? "example.convex.site"}`,
       ],
@@ -138,9 +195,8 @@ export default ({ config }: ConfigContext): ExpoConfig => {
       [
         "expo-router",
         {
-          asyncRoutes: {
-            default: "development",
-          },
+          sitemap: false,
+          headOrigin: process.env.EXPO_PUBLIC_HEAD_ORIGIN,
         },
       ],
       [
@@ -179,6 +235,8 @@ export default ({ config }: ConfigContext): ExpoConfig => {
           faceIDPermission: "Allow $(PRODUCT_NAME) to use Face ID to confirm sensitive actions.",
         },
       ],
+      "expo-image",
+      "expo-sqlite",
       "expo-system-ui",
       "expo-secure-store",
       "expo-web-browser",
@@ -191,6 +249,20 @@ export default ({ config }: ConfigContext): ExpoConfig => {
     extra: {
       ...config.extra,
       support: SUPPORT,
+      // Inject the resolved projectId so eas-cli commands that read
+      // `extra.eas.projectId` directly (e.g. `eas project:info`) see the
+      // env-var fallback too, not just `updates.url`. Existing
+      // `config.extra.eas` keys (if any) survive the merge. projectId stays
+      // in fingerprint parity because local and EAS both resolve it from the
+      // plaintext `EAS_PROJECT_ID` env var, so no `sourceSkips` are needed.
+      ...(projectId
+        ? {
+            eas: {
+              ...(config.extra as { eas?: Record<string, unknown> } | undefined)?.eas,
+              projectId,
+            },
+          }
+        : {}),
     },
     experiments: {
       typedRoutes: true,

package/dist/templates/default/app.json

@@ -1,11 +1,3 @@
 {
-  "expo": {
-    "extra": {
-      "router": {
-        "asyncRoutes": {
-          "default": "development"
-        }
-      }
-    }
-  }
+  "expo": {}
 }

package/dist/templates/default/convex/_generated/api.d.ts

@@ -9,6 +9,9 @@
  */
 
 import type * as admin from "../admin.js";
+import type * as appAttest from "../appAttest.js";
+import type * as appAttestStore from "../appAttestStore.js";
+import type * as apple from "../apple.js";
 import type * as auth from "../auth.js";
 import type * as constants from "../constants.js";
 import type * as crons from "../crons.js";
@@ -17,10 +20,13 @@ import type * as env from "../env.js";
 import type * as errors from "../errors.js";
 import type * as functions from "../functions.js";
 import type * as http from "../http.js";
+import type * as log from "../log.js";
+import type * as pushSender from "../pushSender.js";
 import type * as pushTokens from "../pushTokens.js";
 import type * as rateLimit from "../rateLimit.js";
 import type * as users from "../users.js";
 import type * as validators from "../validators.js";
+import type * as webhook from "../webhook.js";
 
 import type {
   ApiFromModules,
@@ -30,6 +36,9 @@ import type {
 
 declare const fullApi: ApiFromModules<{
   admin: typeof admin;
+  appAttest: typeof appAttest;
+  appAttestStore: typeof appAttestStore;
+  apple: typeof apple;
   auth: typeof auth;
   constants: typeof constants;
   crons: typeof crons;
@@ -38,10 +47,13 @@ declare const fullApi: ApiFromModules<{
   errors: typeof errors;
   functions: typeof functions;
   http: typeof http;
+  log: typeof log;
+  pushSender: typeof pushSender;
   pushTokens: typeof pushTokens;
   rateLimit: typeof rateLimit;
   users: typeof users;
   validators: typeof validators;
+  webhook: typeof webhook;
 }>;
 
 /**

package/dist/templates/default/convex/admin.ts

@@ -1,8 +1,3 @@
-/**
- * Admin actions for fixture / review accounts. Internal-only, never exposed
- * to client code. Run via `bunx convex run admin:<fn>` (or your PM's dlx).
- */
-
 import { v } from "convex/values";
 
 import { components } from "./_generated/api";
@@ -11,9 +6,6 @@ import { createAuth } from "./auth";
 import { rateLimiter, type RateLimitName } from "./rateLimit";
 
 /**
- * Create a fully verified review account. Used by `setup:review-account`
- * to seed Apple's App Review with a working sign-in.
- *
  * Idempotent: if the user already exists, just re-asserts emailVerified=true.
  * Does NOT rotate the password on re-run, delete the user from the dashboard
  * first if you need a fresh password.
@@ -83,11 +75,6 @@ export const createReviewAccount = internalAction({
   },
 });
 
-/**
- * Reset a rate-limit bucket. Run from the dashboard:
- * `bunx convex run admin:resetRateLimit '{"name":"avatarUpload","key":"<userId>"}'`
- * Omit `key` to reset the shared bucket.
- */
 export const resetRateLimit = internalMutation({
   args: { name: v.string(), key: v.optional(v.string()) },
   returns: v.object({