@rune-kit/rune 2.1.1 → 2.2.1

package/extensions/mobile/PACK.md

@@ -1,273 +1,106 @@
 ---
 name: "@rune/mobile"
-description: Mobile development patterns — React Native, Flutter, app store preparation, and native bridge integration.
+description: Mobile development patterns — React Native, Flutter, deep linking, push notifications, OTA updates, app store preparation, native bridge integration, iOS build pipeline, and App Store Connect automation.
 metadata:
   author: runedev
-  version: "0.1.0"
+  version: "0.3.0"
   layer: L4
   price: "$15"
   target: Mobile developers
+  format: split
 ---
 
 # @rune/mobile
 
 ## Purpose
 
-Mobile development has platform-specific pitfalls that web developers hit repeatedly: navigation stacks that leak memory, FlatList rendering that drops frames, state management that triggers unnecessary re-renders, native module bridges that crash on type mismatches, and app store rejections for metadata violations. This pack provides patterns for both React Native and Flutter — detect the framework, audit the codebase for mobile-specific anti-patterns, and emit fixes that pass platform review.
+Mobile development has platform-specific pitfalls that web developers hit repeatedly: navigation stacks that leak memory, FlatList rendering that drops frames, New Architecture migration that silently breaks third-party libraries, deep links that work in dev but fail in production, push notifications that never arrive on iOS, OTA updates that crash on bytecode mismatch, and app store rejections for missing privacy manifests. This pack provides patterns for React Native and Flutter — detect the framework, audit for mobile-specific anti-patterns, and emit fixes that pass platform review.
 
 ## Triggers
 
 - Auto-trigger: when `react-native`, `expo`, `flutter`, `android/`, `ios/`, `app.json` (Expo) detected
 - `/rune react-native` — audit React Native architecture and performance
 - `/rune flutter` — audit Flutter architecture and state management
+- `/rune deep-linking` — set up or audit deep linking (Universal Links, App Links)
+- `/rune push-notifications` — set up or audit push notification pipeline
+- `/rune ota-updates` — set up or audit OTA update strategy
 - `/rune app-store-prep` — prepare app store submission
 - `/rune native-bridge` — audit or create native module bridges
+- `/rune ios-build` — end-to-end iOS build, sign, archive, upload pipeline
+- `/rune app-store-connect` — App Store Connect API operations (versions, screenshots, localization, IAPs)
 - Called by `cook` (L1) when mobile task detected
 - Called by `team` (L1) when porting web to mobile
 
 ## Skills Included
 
-### react-native
+| Skill | Model | Description |
+|-------|-------|-------------|
+| react-native | sonnet | New Architecture migration, navigation, state management, performance optimization |
+| flutter | sonnet | Widget composition, Riverpod/BLoC state, platform channels, adaptive layouts |
+| deep-linking | sonnet | Universal Links (iOS), App Links (Android), auth + deep link race condition |
+| push-notifications | sonnet | FCM v1, APNs, Expo Notifications, permission handling, delivery debugging |
+| ota-updates | sonnet | EAS Update, runtime version management, rollback, bytecode compatibility |
+| app-store-prep | sonnet | Screenshots, metadata, privacy manifests, submission checklist |
+| native-bridge | sonnet | Expo Modules API, TurboModules, Swift/Kotlin interop, background tasks |
+| ios-build-pipeline | sonnet | Certificate generation, provisioning, Xcode archive, IPA export, TestFlight upload |
+| app-store-connect | sonnet | Version management, localization, screenshot upload, IAP, review submission |
 
-React Native patterns — navigation, state management, native modules, performance optimization, Expo vs bare workflow decisions.
-
-#### Workflow
-
-**Step 1 — Detect React Native setup**
-Use Grep to find framework markers: `react-native` in package.json, `expo` config, navigation library (`@react-navigation`, `expo-router`), state management (`zustand`, `redux`, `jotai`), and native module usage. Read `app.json`/`app.config.js` for Expo configuration.
-
-**Step 2 — Audit performance patterns**
-Check for: FlatList without `keyExtractor` or with inline `renderItem` (re-renders), images without caching (`FastImage` or `expo-image`), heavy re-renders from context (missing `useMemo`/`useCallback`), navigation listeners not cleaned up, large JS bundle without lazy loading (`React.lazy` + `Suspense`).
-
-**Step 3 — Emit optimized patterns**
-For each issue, emit the fix: memoized FlatList item components, proper image caching setup, navigation with typed routes, optimized state selectors, and Hermes engine configuration.
-
-#### Example
-
-```tsx
-// BEFORE: FlatList anti-patterns — re-renders every item on any state change
-<FlatList
-  data={items}
-  renderItem={({ item }) => <ItemCard item={item} onPress={() => nav.navigate('Detail', { id: item.id })} />}
-/>
-
-// AFTER: memoized components, stable callbacks, proper key extraction
-const MemoizedCard = React.memo(({ item, onPress }) => (
-  <ItemCard item={item} onPress={onPress} />
-));
-
-const renderItem = useCallback(({ item }) => (
-  <MemoizedCard item={item} onPress={() => nav.navigate('Detail', { id: item.id })} />
-), [nav]);
-
-<FlatList
-  data={items}
-  renderItem={renderItem}
-  keyExtractor={item => item.id}
-  getItemLayout={(_, index) => ({ length: ITEM_HEIGHT, offset: ITEM_HEIGHT * index, index })}
-  maxToRenderPerBatch={10}
-  windowSize={5}
-/>
-```
-
----
-
-### flutter
-
-Flutter patterns — widget composition, state management (Riverpod, BLoC), platform channels, adaptive layouts.
-
-#### Workflow
-
-**Step 1 — Detect Flutter architecture**
-Use Grep to find state management (`riverpod`, `flutter_bloc`, `provider`, `get_it`), routing (`go_router`, `auto_route`), and platform channel usage. Read `pubspec.yaml` for dependencies and `lib/` structure for architecture pattern (feature-first, layer-first).
-
-**Step 2 — Audit widget tree and state**
-Check for: `setState` in complex widgets (should use state management), deeply nested widget trees (extract widgets), `BuildContext` passed through many layers (use InheritedWidget or Riverpod), missing `const` constructors (unnecessary rebuilds), platform-specific code without adaptive checks.
-
-**Step 3 — Emit refactored patterns**
-For each issue, emit: extracted widget with const constructor, Riverpod provider for state, proper error handling with `AsyncValue`, and adaptive layout using `LayoutBuilder` + breakpoints.
-
-#### Example
-
-```dart
-// BEFORE: setState in complex widget, no separation
-class HomeScreen extends StatefulWidget { ... }
-class _HomeScreenState extends State<HomeScreen> {
-  List<Item> items = [];
-  bool loading = true;
-
-  @override
-  void initState() {
-    super.initState();
-    fetchItems().then((data) => setState(() { items = data; loading = false; }));
-  }
-}
-
-// AFTER: Riverpod with AsyncValue, separated concerns
-@riverpod
-Future<List<Item>> items(Ref ref) async {
-  final repo = ref.watch(itemRepositoryProvider);
-  return repo.fetchAll();
-}
-
-class HomeScreen extends ConsumerWidget {
-  const HomeScreen({super.key});
-
-  @override
-  Widget build(BuildContext context, WidgetRef ref) {
-    final itemsAsync = ref.watch(itemsProvider);
-    return itemsAsync.when(
-      data: (items) => ItemList(items: items),
-      loading: () => const ShimmerList(),
-      error: (err, stack) => ErrorView(message: err.toString(), onRetry: () => ref.invalidate(itemsProvider)),
-    );
-  }
-}
-```
-
----
-
-### app-store-prep
-
-App store submission preparation — screenshots, metadata, privacy policy, review guidelines compliance, TestFlight/internal testing.
-
-#### Workflow
-
-**Step 1 — Audit submission readiness**
-Check for: app icon (1024x1024 for iOS, adaptive for Android), splash screen, privacy policy URL in app config, required permissions with usage descriptions (`NSCameraUsageDescription`, etc.), minimum SDK versions, and build configuration (release signing).
-
-**Step 2 — Generate metadata**
-From README and app config, generate: app title (30 chars max), subtitle (30 chars), description (4000 chars), keywords (100 chars), category selection, age rating questionnaire answers, and screenshot specifications per device size.
-
-**Step 3 — Emit submission checklist**
-Output a structured checklist covering both platforms: Apple App Store (TestFlight build, privacy declarations, review notes) and Google Play (internal testing track, data safety form, content rating questionnaire).
-
-#### Example
-
-```markdown
-## App Store Submission Checklist
-
-### iOS (Apple App Store Connect)
-- [ ] App icon: 1024x1024 PNG, no alpha, no rounded corners
-- [ ] Screenshots: 6.7" (1290x2796), 6.5" (1242x2688), 5.5" (1242x2208)
-- [ ] Privacy policy URL: https://example.com/privacy
-- [ ] NSCameraUsageDescription: "Used to scan QR codes for quick login"
-- [ ] NSLocationWhenInUseUsageDescription: "Used to show nearby stores"
-- [ ] TestFlight build uploaded and tested
-- [ ] Export compliance: Uses HTTPS only (no custom encryption) → select "No"
-
-### Android (Google Play Console)
-- [ ] Adaptive icon: foreground (108dp) + background layer
-- [ ] Feature graphic: 1024x500 PNG
-- [ ] Data safety form: camera (optional), location (optional)
-- [ ] Content rating: IARC questionnaire completed
-- [ ] Internal testing track: at least 1 build tested
-- [ ] Signing: upload key + app signing by Google Play enabled
-```
-
----
-
-### native-bridge
-
-Native bridge patterns — platform-specific code, native module creation, Swift/Kotlin interop, background tasks.
-
-#### Workflow
-
-**Step 1 — Detect bridge requirements**
-Use Grep to find platform-specific code: `Platform.OS`, `Platform.select`, `NativeModules`, `MethodChannel`, Turbo Modules (`TurboModule`), or Expo modules (`expo-modules-core`). Read existing native code in `ios/` and `android/` directories.
-
-**Step 2 — Audit bridge safety**
-Check for: type mismatches between JS/Dart and native (string expected, int sent), missing error handling on native side, synchronous bridge calls blocking UI thread, missing null checks on platform-specific returns, and hardcoded platform assumptions.
-
-**Step 3 — Emit type-safe bridge**
-For React Native: emit Turbo Module with codegen types or Expo Module with TypeScript interface. For Flutter: emit MethodChannel with proper error handling, type-safe serialization, and platform-specific implementations for both iOS (Swift) and Android (Kotlin).
-
-#### Example
-
-```typescript
-// React Native — Expo Module (type-safe, modern approach)
-// modules/haptics/index.ts
-import { NativeModule, requireNativeModule } from 'expo-modules-core';
-
-interface HapticsModule extends NativeModule {
-  impact(style: 'light' | 'medium' | 'heavy'): void;
-  notification(type: 'success' | 'warning' | 'error'): void;
-}
-
-const HapticsNative = requireNativeModule<HapticsModule>('Haptics');
-
-export function impact(style: 'light' | 'medium' | 'heavy' = 'medium') {
-  HapticsNative.impact(style);
-}
-
-// modules/haptics/ios/HapticsModule.swift
-import ExpoModulesCore
-import UIKit
-
-public class HapticsModule: Module {
-  public func definition() -> ModuleDefinition {
-    Name("Haptics")
-    Function("impact") { (style: String) in
-      let generator: UIImpactFeedbackGenerator
-      switch style {
-      case "light": generator = UIImpactFeedbackGenerator(style: .light)
-      case "heavy": generator = UIImpactFeedbackGenerator(style: .heavy)
-      default: generator = UIImpactFeedbackGenerator(style: .medium)
-      }
-      generator.impactOccurred()
-    }
-  }
-}
-```
-
----
+Skill files: `skills/<skill-name>.md`
 
 ## Connections
 
 ```
 Calls → browser-pilot (L3): device testing and screenshot automation
 Calls → asset-creator (L3): generate app icons and splash screens
+Calls → sentinel (L2): audit push notification security, deep link validation
+Calls → verification (L3): run mobile-specific checks (build, lint, type-check)
+Calls → @rune/ui (L4): design system tokens, palette, typography for mobile UI consistency
+Calls → @rune/backend (L4): API patterns for mobile backend integration (auth, push server)
+Calls → @rune/security (L4): code signing audit, API key management, certificate validation
 Called By ← cook (L1): when mobile task detected
 Called By ← team (L1): when porting web to mobile
 Called By ← launch (L1): app store submission flow
+Called By ← deploy (L2): mobile-specific deployment (EAS Build, Fastlane)
+Inter-skill: ios-build-pipeline → app-store-prep (pipeline feeds into submission checklist)
+Inter-skill: app-store-connect → app-store-prep (API automation completes manual checklist items)
+Inter-skill: ios-build-pipeline → app-store-connect (upload build → attach to version → submit)
 ```
 
 ## Tech Stack Support
 
-| Framework | State Management | Navigation | Build |
-|-----------|-----------------|------------|-------|
-| React Native (bare) | Zustand / Redux | React Navigation v7 | Metro + Gradle/Xcode |
-| Expo (managed) | Zustand | Expo Router v4 | EAS Build |
-| Flutter | Riverpod / BLoC | GoRouter | Flutter CLI |
+| Framework | State Management | Navigation | Build | OTA |
+|-----------|-----------------|------------|-------|-----|
+| React Native (bare) | Zustand / Redux | React Navigation v7 | Metro + Gradle/Xcode | CodePush |
+| Expo (managed) | Zustand | Expo Router v4 | EAS Build | EAS Update |
+| Flutter | Riverpod / BLoC | GoRouter | Flutter CLI | Shorebird |
+| Native iOS (Swift) | SwiftUI @Observable | NavigationStack | xcodebuild | — |
 
-## Constraints
+## Sharp Edges
 
-1. MUST test on both iOS and Android — never assume cross-platform behavior is identical.
-2. MUST NOT ship with debug configurations (Flipper, dev menu, debug signing) in production builds.
-3. MUST include usage descriptions for every permission requested — empty descriptions cause instant rejection.
-4. MUST use platform-adaptive components (Material on Android, Cupertino on iOS) or declare a unified design system.
-5. MUST handle offline gracefully — mobile apps lose connectivity; show cached data or clear offline state.
+Critical failures to know before using this pack:
 
-## Sharp Edges
+- **New Architecture** silently breaks legacy `NativeModules.X` and `setNativeProps` — audit all native deps against `reactnative.directory` before upgrading
+- **OTA bytecode mismatch** crashes on launch — never deploy OTA update across React Native version boundaries; use `fingerprintExperimental` runtime version
+- **Universal Links** silently break when AASA endpoint redirects (HTTP→HTTPS) — serve at exact path, verify with `curl -I`
+- **Firebase Dynamic Links** shut down August 2025 — all `page.link` URLs dead; migrate to Branch.io or standard App Links
+- **PrivacyInfo.xcprivacy** absence triggers auto-rejection on App Store (mandatory since April 2025)
+- **FCM Legacy API** fully shut down June 2024 — must use FCM v1 with service account JSON
+- **OpenSSL 3.x** `.p12` export silently fails without `-legacy` flag on macOS 14+
+- **ASC API rate limit**: 200 req/min; JWT expires in 20 min — implement auto-refresh and exponential backoff
 
-| Failure Mode | Severity | Mitigation |
-|---|---|---|
-| FlatList optimization causes blank cells on fast scroll (windowSize too small) | HIGH | Default windowSize=5, test with 1000+ items before declaring optimized |
-| Native bridge type mismatch crashes app instead of returning error | CRITICAL | Always wrap native calls in try-catch; validate types before bridge call |
-| Expo managed workflow limits native module access | MEDIUM | Detect Expo vs bare in Step 1; suggest `expo prebuild` for native module needs |
-| App store rejection for missing privacy declaration | HIGH | Cross-reference every permission in Info.plist/AndroidManifest with usage description |
-| Flutter hot reload masks state bugs that appear in release mode | MEDIUM | Test with `flutter run --release` before declaring state management correct |
-| Screenshots generated at wrong device size fail store review | LOW | Use exact pixel dimensions from current App Store/Play Store requirements |
+Full sharp edges table: see individual skill files.
 
 ## Done When
 
-- React Native/Flutter codebase audited for performance anti-patterns with specific fixes
-- FlatList/ListView optimized with memoization, key extraction, and window sizing
-- State management uses proper patterns (no `setState` in complex widgets)
-- App store metadata generated with correct dimensions, descriptions, and permissions
-- Native bridge typed and error-handled for both platforms
-- Structured report emitted for each skill invoked
+- React Native/Flutter codebase audited for New Architecture compatibility with migration plan
+- Deep links working on both platforms with authentication integration and real device verification
+- Push notifications delivering reliably via FCM v1 with proper permission handling
+- OTA update strategy configured with runtime version management and rollback procedure
+- App store metadata generated with correct dimensions, privacy manifest, and platform-specific requirements
+- Native bridges typed and error-handled for both platforms using modern APIs
+- iOS build pipeline producing signed IPA with idempotent signing state
+- App Store Connect operations automated — version, localization, screenshots, IAP, submission
 
 ## Cost Profile
 
-~8,000–16,000 tokens per full pack run (all 4 skills). Individual skill: ~2,000–4,000 tokens. Sonnet default. Use haiku for config detection; escalate to sonnet for code generation and platform-specific patterns.
+~16,000–32,000 tokens per full pack run (all 9 skills). Individual skill: ~2,000–5,000 tokens. Sonnet default. Use haiku for config detection; escalate to sonnet for code generation, build pipeline, and ASC API patterns.

package/extensions/mobile/skills/app-store-connect.md

@@ -0,0 +1,152 @@
+---
+name: "app-store-connect"
+pack: "@rune/mobile"
+description: "App Store Connect API automation — version management, localized store listings, screenshot upload, IAP/subscription creation, review submission, customer review monitoring."
+model: sonnet
+tools: [Read, Edit, Write, Grep, Glob, Bash]
+---
+
+# app-store-connect
+
+App Store Connect API automation — version management, localized store listings, screenshot upload, IAP/subscription creation, review submission, customer review monitoring.
+
+#### Workflow
+
+**Step 1 — Authenticate with ASC API**
+App Store Connect uses JWT (ES256) with 20-minute expiry:
+```typescript
+import jwt from 'jsonwebtoken';
+import fs from 'fs';
+
+function generateASCToken(keyId: string, issuerId: string, privateKeyPath: string): string {
+  const privateKey = fs.readFileSync(privateKeyPath, 'utf8');
+  return jwt.sign({}, privateKey, {
+    algorithm: 'ES256',
+    expiresIn: '20m',
+    issuer: issuerId,
+    header: {
+      alg: 'ES256',
+      kid: keyId,
+      typ: 'JWT',
+    },
+    audience: 'appstoreconnect-v1',
+  });
+}
+```
+Sharp edge: Token expires in 20 min — must auto-refresh when within 60s of expiry. Rate limit: 200 requests/minute, 429 response requires exponential backoff.
+
+**Step 2 — Version management**
+Create new App Store version:
+```
+POST /v1/appStoreVersions
+{
+  "data": {
+    "type": "appStoreVersions",
+    "attributes": {
+      "platform": "IOS",
+      "versionString": "1.2.0"
+    },
+    "relationships": {
+      "app": { "data": { "type": "apps", "id": "<app-id>" } }
+    }
+  }
+}
+```
+- Only ONE editable version allowed per platform at a time
+- Cannot create version if existing version is "Pending Developer Release"
+- Version string must be higher than current live version (semver)
+
+**Step 3 — Localized store listing**
+For each locale (`en-US`, `ja`, `de-DE`, etc.):
+- `description` (4000 chars max)
+- `keywords` (100 chars max, comma-separated)
+- `whatsNew` (4000 chars, release notes)
+- `promotionalText` (170 chars, can be updated without new version)
+
+**Step 4 — Screenshot upload (chunked reservation)**
+ASC uses a 3-step upload process:
+1. Reserve upload: `POST /v1/appScreenshots` with `fileName`, `fileSize` → get `uploadOperations` array
+2. Upload chunks: PUT each chunk to the returned URLs with correct `Content-Length` and offset headers
+3. Commit: `PATCH /v1/appScreenshots/{id}` with `uploaded: true` and SHA-256 `sourceFileChecksum`
+
+Sharp edges:
+- Chunk size dictated by API response, NOT configurable client-side
+- Must send ALL chunks before commit or upload silently fails
+- Screenshot dimensions must EXACTLY match device class (e.g., 1320×2868 for 6.9")
+- Maximum 10 screenshots per locale per device class
+
+**Step 5 — In-App Purchase & subscription management**
+Create IAP:
+```
+POST /v1/inAppPurchases
+{ "type": "inAppPurchases", "attributes": { "name": "Pro Upgrade", "productId": "com.example.pro", "inAppPurchaseType": "NON_CONSUMABLE" } }
+```
+For subscriptions: create subscription group first, then subscription within group, then set pricing per territory. Territory pricing requires concurrent requests with retry — ASC rate limits per-territory pricing endpoints aggressively.
+
+**Step 6 — Submission readiness check**
+Before submitting for review, verify completeness:
+- [ ] App Store version exists with build attached
+- [ ] All required locales have description, keywords, screenshots
+- [ ] Screenshots uploaded for ALL required device classes (6.9", 6.7", 6.5")
+- [ ] Age rating questionnaire completed
+- [ ] App review contact info set (first name, last name, phone, email)
+- [ ] Privacy policy URL set
+- [ ] Export compliance answered
+- [ ] Content rights declaration completed (if app has third-party content)
+
+**Step 7 — Submit and monitor**
+```
+POST /v1/appStoreVersionSubmissions
+{ "data": { "relationships": { "appStoreVersion": { "data": { "type": "appStoreVersions", "id": "<version-id>" } } } } }
+```
+Poll `GET /v1/appStoreVersions/{id}` for `appStoreState` transitions: `WAITING_FOR_REVIEW` → `IN_REVIEW` → `READY_FOR_SALE` (or `REJECTED`). On rejection: fetch `appStoreVersionSubmissions` for reviewer notes.
+
+#### Example
+
+```typescript
+// Complete ASC API client pattern
+interface ASCClient {
+  // Auth
+  refreshToken(): string;
+
+  // Apps
+  listApps(): Promise<ASCApp[]>;
+  getApp(id: string): Promise<ASCApp>;
+
+  // Versions
+  createVersion(appId: string, version: string): Promise<ASCVersion>;
+  attachBuild(versionId: string, buildId: string): Promise<void>;
+
+  // Localization
+  updateLocalization(versionId: string, locale: string, data: LocalizationData): Promise<void>;
+
+  // Screenshots (3-step)
+  reserveScreenshot(setId: string, fileName: string, fileSize: number): Promise<UploadOps>;
+  uploadChunks(ops: UploadOps, fileBuffer: Buffer): Promise<void>;
+  commitScreenshot(screenshotId: string, checksum: string): Promise<void>;
+
+  // IAP
+  createIAP(appId: string, name: string, productId: string, type: IAPType): Promise<ASCIAP>;
+
+  // Submission
+  checkReadiness(versionId: string): Promise<ReadinessReport>;
+  submitForReview(versionId: string): Promise<void>;
+  pollReviewStatus(versionId: string, intervalMs?: number): AsyncGenerator<ReviewStatus>;
+
+  // Reviews
+  listCustomerReviews(appId: string): Promise<CustomerReview[]>;
+  respondToReview(reviewId: string, body: string): Promise<void>;
+}
+
+// Pagination helper — ASC uses cursor-based pagination via `next` links
+async function* paginate<T>(client: ASCClient, url: string): AsyncGenerator<T> {
+  let nextUrl: string | null = url;
+  while (nextUrl) {
+    const response = await client.request(nextUrl);
+    for (const item of response.data) {
+      yield item as T;
+    }
+    nextUrl = response.links?.next ?? null;
+  }
+}
+```

package/extensions/mobile/skills/app-store-prep.md

@@ -0,0 +1,66 @@
+---
+name: "app-store-prep"
+pack: "@rune/mobile"
+description: "App store submission preparation — screenshots, metadata, privacy manifests, review guidelines compliance, TestFlight/internal testing."
+model: sonnet
+tools: [Read, Edit, Write, Grep, Glob, Bash]
+---
+
+# app-store-prep
+
+App store submission preparation — screenshots, metadata, privacy manifests, review guidelines compliance, TestFlight/internal testing.
+
+#### Workflow
+
+**Step 1 — Audit submission readiness**
+Check for:
+- App icon: 1024x1024 for iOS (no alpha, no rounded corners), adaptive icon for Android
+- Splash screen configured
+- Privacy policy URL in app config
+- Required permissions with specific (not generic) usage descriptions — "App requires access to your camera" gets rejected. Must be specific: "Used to scan QR codes for quick login"
+- `PrivacyInfo.xcprivacy` present (mandatory since April 2025): Apple requires privacy manifest for apps using file timestamp, boot time, disk space, or UserDefaults APIs. React Native core and many libraries access these APIs. Missing manifest = auto-rejection
+- Minimum SDK versions: iOS 18 SDK mandatory (Xcode 16+, April 2025), Android API 34 minimum
+- Release signing configured (not debug)
+- `.aab` format for Google Play (APK no longer accepted for new apps)
+
+**Step 2 — Generate metadata**
+From README and app config, generate: app title (30 chars max), subtitle (30 chars), description (4000 chars), keywords (100 chars), category selection, age rating questionnaire answers, and screenshot specifications per device size.
+
+Current required screenshot sizes:
+- iPhone 6.9" (1320×2868) — iPhone 16 Pro Max (NEW, required for new apps)
+- iPhone 6.7" (1290×2796)
+- iPhone 6.5" (1242×2688)
+- iPad 12.9" (2048×2732) — if app supports iPad
+- Android: feature graphic 1024×500
+
+**Step 3 — Emit submission checklist**
+Output structured checklist covering both platforms with platform-specific gotchas.
+
+#### Example
+
+```markdown
+## App Store Submission Checklist
+
+### iOS (Apple App Store Connect)
+- [ ] App icon: 1024x1024 PNG, no alpha, no rounded corners
+- [ ] Screenshots: 6.9" (1320x2868), 6.7" (1290x2796), 6.5" (1242x2688)
+- [ ] Privacy policy URL: https://example.com/privacy
+- [ ] `PrivacyInfo.xcprivacy` included (MANDATORY since April 2025)
+- [ ] NSCameraUsageDescription: "Used to scan QR codes for quick login" (SPECIFIC, not generic)
+- [ ] NSLocationWhenInUseUsageDescription: "Used to show nearby stores on the map"
+- [ ] TestFlight build uploaded and tested on physical device
+- [ ] Export compliance: Uses HTTPS only (no custom encryption) → select "No"
+- [ ] Built with Xcode 16+ / iOS 18 SDK (mandatory since April 2025)
+
+### Android (Google Play Console)
+- [ ] Adaptive icon: foreground (108dp) + background layer
+- [ ] Feature graphic: 1024x500 PNG
+- [ ] App Bundle format (.aab, NOT .apk)
+- [ ] Target API 34+ (Android 14)
+- [ ] 64-bit native libraries included (32-bit only = rejection)
+- [ ] Data safety form: accurately declare ALL collected data (analytics SDKs collect device IDs)
+- [ ] `SCHEDULE_EXACT_ALARM` justified if using scheduled notifications
+- [ ] Content rating: IARC questionnaire completed
+- [ ] Internal testing track: at least 1 build tested
+- [ ] Signing: upload key + app signing by Google Play enabled
+```

package/extensions/mobile/skills/deep-linking.md

@@ -0,0 +1,109 @@
+---
+name: "deep-linking"
+pack: "@rune/mobile"
+description: "Deep linking setup and debugging — Universal Links (iOS), App Links (Android), deferred deep links, authentication + deep link integration."
+model: sonnet
+tools: [Read, Edit, Write, Grep, Glob, Bash]
+---
+
+# deep-linking
+
+Deep linking setup and debugging — Universal Links (iOS), App Links (Android), deferred deep links, authentication + deep link integration.
+
+#### Workflow
+
+**Step 1 — Detect current deep link setup**
+Use Grep to find: `expo-linking`, `Linking.addEventListener`, `useURL`, `expo-router` deep link config, `apple-app-site-association`, `assetlinks.json`, `IntentFilter` in `AndroidManifest.xml`. Check for React Navigation `linking` config or Expo Router file-based deep link handling.
+
+**Step 2 — Audit deep link reliability**
+Check for these common failure modes:
+- **AASA file redirect**: `.well-known/apple-app-site-association` endpoint must not redirect (HTTP→HTTPS or www→non-www). Any redirect silently breaks Universal Links
+- **AASA caching**: Apple CDN caches AASA aggressively (up to 24h). Changes appear correct on server but old version is served to devices
+- **SHA-256 mismatch**: Dev/Preview builds use different signing key than Production. `assetlinks.json` must include ALL certificates (upload key + app signing key)
+- **Multiple environments**: Staging and production need separate AASA entries with different bundle IDs and team IDs
+- **Firebase Dynamic Links dead**: Shut down August 25, 2025. All `page.link` subdomains stopped working. Must migrate to Branch.io, custom server, or standard App Links/Universal Links
+- **Simulator limitation**: Universal Links and App Links do not work on simulators. Must test on real physical devices
+
+**Step 3 — Audit authentication + deep link integration**
+Check for race condition: deep link arrives before auth state resolves. Pattern: capture initial URL, wait for auth, then navigate. In React Navigation v7, `NAVIGATE` action pushes new screen even for existing routes — deep link handler must check current route before navigating.
+
+**Step 4 — Emit deep link configuration**
+For Expo Router: verify file-based route structure matches expected deep link paths. For React Navigation v7: emit typed `linking` config with authentication gate. For server: emit AASA and `assetlinks.json` with correct team ID, bundle ID, and all signing certificates.
+
+#### Example
+
+```typescript
+// Expo Router — app/_layout.tsx with auth-gated deep link handling
+import { useURL } from 'expo-linking';
+import { useRouter, useSegments } from 'expo-router';
+
+export default function RootLayout() {
+  const url = useURL();
+  const router = useRouter();
+  const segments = useSegments();
+  const { user, isLoading } = useAuth();
+  const pendingDeepLink = useRef<string | null>(null);
+
+  // Capture deep link before auth resolves
+  useEffect(() => {
+    if (url && isLoading) {
+      pendingDeepLink.current = url;
+    }
+  }, [url, isLoading]);
+
+  // Navigate after auth resolves
+  useEffect(() => {
+    if (isLoading) return;
+
+    const inAuthGroup = segments[0] === '(auth)';
+    if (!user && !inAuthGroup) {
+      router.replace('/login');
+    } else if (user && inAuthGroup) {
+      // Process pending deep link or go to home
+      if (pendingDeepLink.current) {
+        const path = new URL(pendingDeepLink.current).pathname;
+        pendingDeepLink.current = null;
+        router.replace(path);
+      } else {
+        router.replace('/');
+      }
+    }
+  }, [user, isLoading, segments]);
+
+  return <Slot />;
+}
+```
+
+```json
+// .well-known/apple-app-site-association — NO redirects on this endpoint
+{
+  "applinks": {
+    "details": [
+      {
+        "appIDs": ["TEAMID.com.example.app", "TEAMID.com.example.app.staging"],
+        "components": [
+          { "/": "/product/*", "comment": "Product deep links" },
+          { "/": "/invite/*", "comment": "Invite deep links" }
+        ]
+      }
+    ]
+  }
+}
+```
+
+```json
+// .well-known/assetlinks.json — include BOTH upload key AND app signing key
+[
+  {
+    "relation": ["delegate_permission/common.handle_all_urls"],
+    "target": {
+      "namespace": "android_app",
+      "package_name": "com.example.app",
+      "sha256_cert_fingerprints": [
+        "AA:BB:CC:...:upload_key_fingerprint",
+        "DD:EE:FF:...:app_signing_key_fingerprint"
+      ]
+    }
+  }
+]
+```