@rune-kit/rune 2.8.0 → 2.11.0

package/extensions/mobile/skills/app-store-connect.md

@@ -1,152 +1,152 @@
----
-name: "app-store-connect"
-pack: "@rune/mobile"
-description: "App Store Connect API automation — version management, localized store listings, screenshot upload, IAP/subscription creation, review submission, customer review monitoring."
-model: sonnet
-tools: [Read, Edit, Write, Grep, Glob, Bash]
----
-
-# app-store-connect
-
-App Store Connect API automation — version management, localized store listings, screenshot upload, IAP/subscription creation, review submission, customer review monitoring.
-
-#### Workflow
-
-**Step 1 — Authenticate with ASC API**
-App Store Connect uses JWT (ES256) with 20-minute expiry:
-```typescript
-import jwt from 'jsonwebtoken';
-import fs from 'fs';
-
-function generateASCToken(keyId: string, issuerId: string, privateKeyPath: string): string {
-  const privateKey = fs.readFileSync(privateKeyPath, 'utf8');
-  return jwt.sign({}, privateKey, {
-    algorithm: 'ES256',
-    expiresIn: '20m',
-    issuer: issuerId,
-    header: {
-      alg: 'ES256',
-      kid: keyId,
-      typ: 'JWT',
-    },
-    audience: 'appstoreconnect-v1',
-  });
-}
-```
-Sharp edge: Token expires in 20 min — must auto-refresh when within 60s of expiry. Rate limit: 200 requests/minute, 429 response requires exponential backoff.
-
-**Step 2 — Version management**
-Create new App Store version:
-```
-POST /v1/appStoreVersions
-{
-  "data": {
-    "type": "appStoreVersions",
-    "attributes": {
-      "platform": "IOS",
-      "versionString": "1.2.0"
-    },
-    "relationships": {
-      "app": { "data": { "type": "apps", "id": "<app-id>" } }
-    }
-  }
-}
-```
-- Only ONE editable version allowed per platform at a time
-- Cannot create version if existing version is "Pending Developer Release"
-- Version string must be higher than current live version (semver)
-
-**Step 3 — Localized store listing**
-For each locale (`en-US`, `ja`, `de-DE`, etc.):
-- `description` (4000 chars max)
-- `keywords` (100 chars max, comma-separated)
-- `whatsNew` (4000 chars, release notes)
-- `promotionalText` (170 chars, can be updated without new version)
-
-**Step 4 — Screenshot upload (chunked reservation)**
-ASC uses a 3-step upload process:
-1. Reserve upload: `POST /v1/appScreenshots` with `fileName`, `fileSize` → get `uploadOperations` array
-2. Upload chunks: PUT each chunk to the returned URLs with correct `Content-Length` and offset headers
-3. Commit: `PATCH /v1/appScreenshots/{id}` with `uploaded: true` and SHA-256 `sourceFileChecksum`
-
-Sharp edges:
-- Chunk size dictated by API response, NOT configurable client-side
-- Must send ALL chunks before commit or upload silently fails
-- Screenshot dimensions must EXACTLY match device class (e.g., 1320×2868 for 6.9")
-- Maximum 10 screenshots per locale per device class
-
-**Step 5 — In-App Purchase & subscription management**
-Create IAP:
-```
-POST /v1/inAppPurchases
-{ "type": "inAppPurchases", "attributes": { "name": "Pro Upgrade", "productId": "com.example.pro", "inAppPurchaseType": "NON_CONSUMABLE" } }
-```
-For subscriptions: create subscription group first, then subscription within group, then set pricing per territory. Territory pricing requires concurrent requests with retry — ASC rate limits per-territory pricing endpoints aggressively.
-
-**Step 6 — Submission readiness check**
-Before submitting for review, verify completeness:
-- [ ] App Store version exists with build attached
-- [ ] All required locales have description, keywords, screenshots
-- [ ] Screenshots uploaded for ALL required device classes (6.9", 6.7", 6.5")
-- [ ] Age rating questionnaire completed
-- [ ] App review contact info set (first name, last name, phone, email)
-- [ ] Privacy policy URL set
-- [ ] Export compliance answered
-- [ ] Content rights declaration completed (if app has third-party content)
-
-**Step 7 — Submit and monitor**
-```
-POST /v1/appStoreVersionSubmissions
-{ "data": { "relationships": { "appStoreVersion": { "data": { "type": "appStoreVersions", "id": "<version-id>" } } } } }
-```
-Poll `GET /v1/appStoreVersions/{id}` for `appStoreState` transitions: `WAITING_FOR_REVIEW` → `IN_REVIEW` → `READY_FOR_SALE` (or `REJECTED`). On rejection: fetch `appStoreVersionSubmissions` for reviewer notes.
-
-#### Example
-
-```typescript
-// Complete ASC API client pattern
-interface ASCClient {
-  // Auth
-  refreshToken(): string;
-
-  // Apps
-  listApps(): Promise<ASCApp[]>;
-  getApp(id: string): Promise<ASCApp>;
-
-  // Versions
-  createVersion(appId: string, version: string): Promise<ASCVersion>;
-  attachBuild(versionId: string, buildId: string): Promise<void>;
-
-  // Localization
-  updateLocalization(versionId: string, locale: string, data: LocalizationData): Promise<void>;
-
-  // Screenshots (3-step)
-  reserveScreenshot(setId: string, fileName: string, fileSize: number): Promise<UploadOps>;
-  uploadChunks(ops: UploadOps, fileBuffer: Buffer): Promise<void>;
-  commitScreenshot(screenshotId: string, checksum: string): Promise<void>;
-
-  // IAP
-  createIAP(appId: string, name: string, productId: string, type: IAPType): Promise<ASCIAP>;
-
-  // Submission
-  checkReadiness(versionId: string): Promise<ReadinessReport>;
-  submitForReview(versionId: string): Promise<void>;
-  pollReviewStatus(versionId: string, intervalMs?: number): AsyncGenerator<ReviewStatus>;
-
-  // Reviews
-  listCustomerReviews(appId: string): Promise<CustomerReview[]>;
-  respondToReview(reviewId: string, body: string): Promise<void>;
-}
-
-// Pagination helper — ASC uses cursor-based pagination via `next` links
-async function* paginate<T>(client: ASCClient, url: string): AsyncGenerator<T> {
-  let nextUrl: string | null = url;
-  while (nextUrl) {
-    const response = await client.request(nextUrl);
-    for (const item of response.data) {
-      yield item as T;
-    }
-    nextUrl = response.links?.next ?? null;
-  }
-}
-```
+---
+name: "app-store-connect"
+pack: "@rune/mobile"
+description: "App Store Connect API automation — version management, localized store listings, screenshot upload, IAP/subscription creation, review submission, customer review monitoring."
+model: sonnet
+tools: [Read, Edit, Write, Grep, Glob, Bash]
+---
+
+# app-store-connect
+
+App Store Connect API automation — version management, localized store listings, screenshot upload, IAP/subscription creation, review submission, customer review monitoring.
+
+#### Workflow
+
+**Step 1 — Authenticate with ASC API**
+App Store Connect uses JWT (ES256) with 20-minute expiry:
+```typescript
+import jwt from 'jsonwebtoken';
+import fs from 'fs';
+
+function generateASCToken(keyId: string, issuerId: string, privateKeyPath: string): string {
+  const privateKey = fs.readFileSync(privateKeyPath, 'utf8');
+  return jwt.sign({}, privateKey, {
+    algorithm: 'ES256',
+    expiresIn: '20m',
+    issuer: issuerId,
+    header: {
+      alg: 'ES256',
+      kid: keyId,
+      typ: 'JWT',
+    },
+    audience: 'appstoreconnect-v1',
+  });
+}
+```
+Sharp edge: Token expires in 20 min — must auto-refresh when within 60s of expiry. Rate limit: 200 requests/minute, 429 response requires exponential backoff.
+
+**Step 2 — Version management**
+Create new App Store version:
+```
+POST /v1/appStoreVersions
+{
+  "data": {
+    "type": "appStoreVersions",
+    "attributes": {
+      "platform": "IOS",
+      "versionString": "1.2.0"
+    },
+    "relationships": {
+      "app": { "data": { "type": "apps", "id": "<app-id>" } }
+    }
+  }
+}
+```
+- Only ONE editable version allowed per platform at a time
+- Cannot create version if existing version is "Pending Developer Release"
+- Version string must be higher than current live version (semver)
+
+**Step 3 — Localized store listing**
+For each locale (`en-US`, `ja`, `de-DE`, etc.):
+- `description` (4000 chars max)
+- `keywords` (100 chars max, comma-separated)
+- `whatsNew` (4000 chars, release notes)
+- `promotionalText` (170 chars, can be updated without new version)
+
+**Step 4 — Screenshot upload (chunked reservation)**
+ASC uses a 3-step upload process:
+1. Reserve upload: `POST /v1/appScreenshots` with `fileName`, `fileSize` → get `uploadOperations` array
+2. Upload chunks: PUT each chunk to the returned URLs with correct `Content-Length` and offset headers
+3. Commit: `PATCH /v1/appScreenshots/{id}` with `uploaded: true` and SHA-256 `sourceFileChecksum`
+
+Sharp edges:
+- Chunk size dictated by API response, NOT configurable client-side
+- Must send ALL chunks before commit or upload silently fails
+- Screenshot dimensions must EXACTLY match device class (e.g., 1320×2868 for 6.9")
+- Maximum 10 screenshots per locale per device class
+
+**Step 5 — In-App Purchase & subscription management**
+Create IAP:
+```
+POST /v1/inAppPurchases
+{ "type": "inAppPurchases", "attributes": { "name": "Pro Upgrade", "productId": "com.example.pro", "inAppPurchaseType": "NON_CONSUMABLE" } }
+```
+For subscriptions: create subscription group first, then subscription within group, then set pricing per territory. Territory pricing requires concurrent requests with retry — ASC rate limits per-territory pricing endpoints aggressively.
+
+**Step 6 — Submission readiness check**
+Before submitting for review, verify completeness:
+- [ ] App Store version exists with build attached
+- [ ] All required locales have description, keywords, screenshots
+- [ ] Screenshots uploaded for ALL required device classes (6.9", 6.7", 6.5")
+- [ ] Age rating questionnaire completed
+- [ ] App review contact info set (first name, last name, phone, email)
+- [ ] Privacy policy URL set
+- [ ] Export compliance answered
+- [ ] Content rights declaration completed (if app has third-party content)
+
+**Step 7 — Submit and monitor**
+```
+POST /v1/appStoreVersionSubmissions
+{ "data": { "relationships": { "appStoreVersion": { "data": { "type": "appStoreVersions", "id": "<version-id>" } } } } }
+```
+Poll `GET /v1/appStoreVersions/{id}` for `appStoreState` transitions: `WAITING_FOR_REVIEW` → `IN_REVIEW` → `READY_FOR_SALE` (or `REJECTED`). On rejection: fetch `appStoreVersionSubmissions` for reviewer notes.
+
+#### Example
+
+```typescript
+// Complete ASC API client pattern
+interface ASCClient {
+  // Auth
+  refreshToken(): string;
+
+  // Apps
+  listApps(): Promise<ASCApp[]>;
+  getApp(id: string): Promise<ASCApp>;
+
+  // Versions
+  createVersion(appId: string, version: string): Promise<ASCVersion>;
+  attachBuild(versionId: string, buildId: string): Promise<void>;
+
+  // Localization
+  updateLocalization(versionId: string, locale: string, data: LocalizationData): Promise<void>;
+
+  // Screenshots (3-step)
+  reserveScreenshot(setId: string, fileName: string, fileSize: number): Promise<UploadOps>;
+  uploadChunks(ops: UploadOps, fileBuffer: Buffer): Promise<void>;
+  commitScreenshot(screenshotId: string, checksum: string): Promise<void>;
+
+  // IAP
+  createIAP(appId: string, name: string, productId: string, type: IAPType): Promise<ASCIAP>;
+
+  // Submission
+  checkReadiness(versionId: string): Promise<ReadinessReport>;
+  submitForReview(versionId: string): Promise<void>;
+  pollReviewStatus(versionId: string, intervalMs?: number): AsyncGenerator<ReviewStatus>;
+
+  // Reviews
+  listCustomerReviews(appId: string): Promise<CustomerReview[]>;
+  respondToReview(reviewId: string, body: string): Promise<void>;
+}
+
+// Pagination helper — ASC uses cursor-based pagination via `next` links
+async function* paginate<T>(client: ASCClient, url: string): AsyncGenerator<T> {
+  let nextUrl: string | null = url;
+  while (nextUrl) {
+    const response = await client.request(nextUrl);
+    for (const item of response.data) {
+      yield item as T;
+    }
+    nextUrl = response.links?.next ?? null;
+  }
+}
+```

package/extensions/mobile/skills/app-store-prep.md

@@ -1,66 +1,66 @@
----
-name: "app-store-prep"
-pack: "@rune/mobile"
-description: "App store submission preparation — screenshots, metadata, privacy manifests, review guidelines compliance, TestFlight/internal testing."
-model: sonnet
-tools: [Read, Edit, Write, Grep, Glob, Bash]
----
-
-# app-store-prep
-
-App store submission preparation — screenshots, metadata, privacy manifests, review guidelines compliance, TestFlight/internal testing.
-
-#### Workflow
-
-**Step 1 — Audit submission readiness**
-Check for:
-- App icon: 1024x1024 for iOS (no alpha, no rounded corners), adaptive icon for Android
-- Splash screen configured
-- Privacy policy URL in app config
-- Required permissions with specific (not generic) usage descriptions — "App requires access to your camera" gets rejected. Must be specific: "Used to scan QR codes for quick login"
-- `PrivacyInfo.xcprivacy` present (mandatory since April 2025): Apple requires privacy manifest for apps using file timestamp, boot time, disk space, or UserDefaults APIs. React Native core and many libraries access these APIs. Missing manifest = auto-rejection
-- Minimum SDK versions: iOS 18 SDK mandatory (Xcode 16+, April 2025), Android API 34 minimum
-- Release signing configured (not debug)
-- `.aab` format for Google Play (APK no longer accepted for new apps)
-
-**Step 2 — Generate metadata**
-From README and app config, generate: app title (30 chars max), subtitle (30 chars), description (4000 chars), keywords (100 chars), category selection, age rating questionnaire answers, and screenshot specifications per device size.
-
-Current required screenshot sizes:
-- iPhone 6.9" (1320×2868) — iPhone 16 Pro Max (NEW, required for new apps)
-- iPhone 6.7" (1290×2796)
-- iPhone 6.5" (1242×2688)
-- iPad 12.9" (2048×2732) — if app supports iPad
-- Android: feature graphic 1024×500
-
-**Step 3 — Emit submission checklist**
-Output structured checklist covering both platforms with platform-specific gotchas.
-
-#### Example
-
-```markdown
-## App Store Submission Checklist
-
-### iOS (Apple App Store Connect)
-- [ ] App icon: 1024x1024 PNG, no alpha, no rounded corners
-- [ ] Screenshots: 6.9" (1320x2868), 6.7" (1290x2796), 6.5" (1242x2688)
-- [ ] Privacy policy URL: https://example.com/privacy
-- [ ] `PrivacyInfo.xcprivacy` included (MANDATORY since April 2025)
-- [ ] NSCameraUsageDescription: "Used to scan QR codes for quick login" (SPECIFIC, not generic)
-- [ ] NSLocationWhenInUseUsageDescription: "Used to show nearby stores on the map"
-- [ ] TestFlight build uploaded and tested on physical device
-- [ ] Export compliance: Uses HTTPS only (no custom encryption) → select "No"
-- [ ] Built with Xcode 16+ / iOS 18 SDK (mandatory since April 2025)
-
-### Android (Google Play Console)
-- [ ] Adaptive icon: foreground (108dp) + background layer
-- [ ] Feature graphic: 1024x500 PNG
-- [ ] App Bundle format (.aab, NOT .apk)
-- [ ] Target API 34+ (Android 14)
-- [ ] 64-bit native libraries included (32-bit only = rejection)
-- [ ] Data safety form: accurately declare ALL collected data (analytics SDKs collect device IDs)
-- [ ] `SCHEDULE_EXACT_ALARM` justified if using scheduled notifications
-- [ ] Content rating: IARC questionnaire completed
-- [ ] Internal testing track: at least 1 build tested
-- [ ] Signing: upload key + app signing by Google Play enabled
-```
+---
+name: "app-store-prep"
+pack: "@rune/mobile"
+description: "App store submission preparation — screenshots, metadata, privacy manifests, review guidelines compliance, TestFlight/internal testing."
+model: sonnet
+tools: [Read, Edit, Write, Grep, Glob, Bash]
+---
+
+# app-store-prep
+
+App store submission preparation — screenshots, metadata, privacy manifests, review guidelines compliance, TestFlight/internal testing.
+
+#### Workflow
+
+**Step 1 — Audit submission readiness**
+Check for:
+- App icon: 1024x1024 for iOS (no alpha, no rounded corners), adaptive icon for Android
+- Splash screen configured
+- Privacy policy URL in app config
+- Required permissions with specific (not generic) usage descriptions — "App requires access to your camera" gets rejected. Must be specific: "Used to scan QR codes for quick login"
+- `PrivacyInfo.xcprivacy` present (mandatory since April 2025): Apple requires privacy manifest for apps using file timestamp, boot time, disk space, or UserDefaults APIs. React Native core and many libraries access these APIs. Missing manifest = auto-rejection
+- Minimum SDK versions: iOS 18 SDK mandatory (Xcode 16+, April 2025), Android API 34 minimum
+- Release signing configured (not debug)
+- `.aab` format for Google Play (APK no longer accepted for new apps)
+
+**Step 2 — Generate metadata**
+From README and app config, generate: app title (30 chars max), subtitle (30 chars), description (4000 chars), keywords (100 chars), category selection, age rating questionnaire answers, and screenshot specifications per device size.
+
+Current required screenshot sizes:
+- iPhone 6.9" (1320×2868) — iPhone 16 Pro Max (NEW, required for new apps)
+- iPhone 6.7" (1290×2796)
+- iPhone 6.5" (1242×2688)
+- iPad 12.9" (2048×2732) — if app supports iPad
+- Android: feature graphic 1024×500
+
+**Step 3 — Emit submission checklist**
+Output structured checklist covering both platforms with platform-specific gotchas.
+
+#### Example
+
+```markdown
+## App Store Submission Checklist
+
+### iOS (Apple App Store Connect)
+- [ ] App icon: 1024x1024 PNG, no alpha, no rounded corners
+- [ ] Screenshots: 6.9" (1320x2868), 6.7" (1290x2796), 6.5" (1242x2688)
+- [ ] Privacy policy URL: https://example.com/privacy
+- [ ] `PrivacyInfo.xcprivacy` included (MANDATORY since April 2025)
+- [ ] NSCameraUsageDescription: "Used to scan QR codes for quick login" (SPECIFIC, not generic)
+- [ ] NSLocationWhenInUseUsageDescription: "Used to show nearby stores on the map"
+- [ ] TestFlight build uploaded and tested on physical device
+- [ ] Export compliance: Uses HTTPS only (no custom encryption) → select "No"
+- [ ] Built with Xcode 16+ / iOS 18 SDK (mandatory since April 2025)
+
+### Android (Google Play Console)
+- [ ] Adaptive icon: foreground (108dp) + background layer
+- [ ] Feature graphic: 1024x500 PNG
+- [ ] App Bundle format (.aab, NOT .apk)
+- [ ] Target API 34+ (Android 14)
+- [ ] 64-bit native libraries included (32-bit only = rejection)
+- [ ] Data safety form: accurately declare ALL collected data (analytics SDKs collect device IDs)
+- [ ] `SCHEDULE_EXACT_ALARM` justified if using scheduled notifications
+- [ ] Content rating: IARC questionnaire completed
+- [ ] Internal testing track: at least 1 build tested
+- [ ] Signing: upload key + app signing by Google Play enabled
+```

package/extensions/mobile/skills/deep-linking.md

@@ -1,109 +1,109 @@
----
-name: "deep-linking"
-pack: "@rune/mobile"
-description: "Deep linking setup and debugging — Universal Links (iOS), App Links (Android), deferred deep links, authentication + deep link integration."
-model: sonnet
-tools: [Read, Edit, Write, Grep, Glob, Bash]
----
-
-# deep-linking
-
-Deep linking setup and debugging — Universal Links (iOS), App Links (Android), deferred deep links, authentication + deep link integration.
-
-#### Workflow
-
-**Step 1 — Detect current deep link setup**
-Use Grep to find: `expo-linking`, `Linking.addEventListener`, `useURL`, `expo-router` deep link config, `apple-app-site-association`, `assetlinks.json`, `IntentFilter` in `AndroidManifest.xml`. Check for React Navigation `linking` config or Expo Router file-based deep link handling.
-
-**Step 2 — Audit deep link reliability**
-Check for these common failure modes:
-- **AASA file redirect**: `.well-known/apple-app-site-association` endpoint must not redirect (HTTP→HTTPS or www→non-www). Any redirect silently breaks Universal Links
-- **AASA caching**: Apple CDN caches AASA aggressively (up to 24h). Changes appear correct on server but old version is served to devices
-- **SHA-256 mismatch**: Dev/Preview builds use different signing key than Production. `assetlinks.json` must include ALL certificates (upload key + app signing key)
-- **Multiple environments**: Staging and production need separate AASA entries with different bundle IDs and team IDs
-- **Firebase Dynamic Links dead**: Shut down August 25, 2025. All `page.link` subdomains stopped working. Must migrate to Branch.io, custom server, or standard App Links/Universal Links
-- **Simulator limitation**: Universal Links and App Links do not work on simulators. Must test on real physical devices
-
-**Step 3 — Audit authentication + deep link integration**
-Check for race condition: deep link arrives before auth state resolves. Pattern: capture initial URL, wait for auth, then navigate. In React Navigation v7, `NAVIGATE` action pushes new screen even for existing routes — deep link handler must check current route before navigating.
-
-**Step 4 — Emit deep link configuration**
-For Expo Router: verify file-based route structure matches expected deep link paths. For React Navigation v7: emit typed `linking` config with authentication gate. For server: emit AASA and `assetlinks.json` with correct team ID, bundle ID, and all signing certificates.
-
-#### Example
-
-```typescript
-// Expo Router — app/_layout.tsx with auth-gated deep link handling
-import { useURL } from 'expo-linking';
-import { useRouter, useSegments } from 'expo-router';
-
-export default function RootLayout() {
-  const url = useURL();
-  const router = useRouter();
-  const segments = useSegments();
-  const { user, isLoading } = useAuth();
-  const pendingDeepLink = useRef<string | null>(null);
-
-  // Capture deep link before auth resolves
-  useEffect(() => {
-    if (url && isLoading) {
-      pendingDeepLink.current = url;
-    }
-  }, [url, isLoading]);
-
-  // Navigate after auth resolves
-  useEffect(() => {
-    if (isLoading) return;
-
-    const inAuthGroup = segments[0] === '(auth)';
-    if (!user && !inAuthGroup) {
-      router.replace('/login');
-    } else if (user && inAuthGroup) {
-      // Process pending deep link or go to home
-      if (pendingDeepLink.current) {
-        const path = new URL(pendingDeepLink.current).pathname;
-        pendingDeepLink.current = null;
-        router.replace(path);
-      } else {
-        router.replace('/');
-      }
-    }
-  }, [user, isLoading, segments]);
-
-  return <Slot />;
-}
-```
-
-```json
-// .well-known/apple-app-site-association — NO redirects on this endpoint
-{
-  "applinks": {
-    "details": [
-      {
-        "appIDs": ["TEAMID.com.example.app", "TEAMID.com.example.app.staging"],
-        "components": [
-          { "/": "/product/*", "comment": "Product deep links" },
-          { "/": "/invite/*", "comment": "Invite deep links" }
-        ]
-      }
-    ]
-  }
-}
-```
-
-```json
-// .well-known/assetlinks.json — include BOTH upload key AND app signing key
-[
-  {
-    "relation": ["delegate_permission/common.handle_all_urls"],
-    "target": {
-      "namespace": "android_app",
-      "package_name": "com.example.app",
-      "sha256_cert_fingerprints": [
-        "AA:BB:CC:...:upload_key_fingerprint",
-        "DD:EE:FF:...:app_signing_key_fingerprint"
-      ]
-    }
-  }
-]
-```
+---
+name: "deep-linking"
+pack: "@rune/mobile"
+description: "Deep linking setup and debugging — Universal Links (iOS), App Links (Android), deferred deep links, authentication + deep link integration."
+model: sonnet
+tools: [Read, Edit, Write, Grep, Glob, Bash]
+---
+
+# deep-linking
+
+Deep linking setup and debugging — Universal Links (iOS), App Links (Android), deferred deep links, authentication + deep link integration.
+
+#### Workflow
+
+**Step 1 — Detect current deep link setup**
+Use Grep to find: `expo-linking`, `Linking.addEventListener`, `useURL`, `expo-router` deep link config, `apple-app-site-association`, `assetlinks.json`, `IntentFilter` in `AndroidManifest.xml`. Check for React Navigation `linking` config or Expo Router file-based deep link handling.
+
+**Step 2 — Audit deep link reliability**
+Check for these common failure modes:
+- **AASA file redirect**: `.well-known/apple-app-site-association` endpoint must not redirect (HTTP→HTTPS or www→non-www). Any redirect silently breaks Universal Links
+- **AASA caching**: Apple CDN caches AASA aggressively (up to 24h). Changes appear correct on server but old version is served to devices
+- **SHA-256 mismatch**: Dev/Preview builds use different signing key than Production. `assetlinks.json` must include ALL certificates (upload key + app signing key)
+- **Multiple environments**: Staging and production need separate AASA entries with different bundle IDs and team IDs
+- **Firebase Dynamic Links dead**: Shut down August 25, 2025. All `page.link` subdomains stopped working. Must migrate to Branch.io, custom server, or standard App Links/Universal Links
+- **Simulator limitation**: Universal Links and App Links do not work on simulators. Must test on real physical devices
+
+**Step 3 — Audit authentication + deep link integration**
+Check for race condition: deep link arrives before auth state resolves. Pattern: capture initial URL, wait for auth, then navigate. In React Navigation v7, `NAVIGATE` action pushes new screen even for existing routes — deep link handler must check current route before navigating.
+
+**Step 4 — Emit deep link configuration**
+For Expo Router: verify file-based route structure matches expected deep link paths. For React Navigation v7: emit typed `linking` config with authentication gate. For server: emit AASA and `assetlinks.json` with correct team ID, bundle ID, and all signing certificates.
+
+#### Example
+
+```typescript
+// Expo Router — app/_layout.tsx with auth-gated deep link handling
+import { useURL } from 'expo-linking';
+import { useRouter, useSegments } from 'expo-router';
+
+export default function RootLayout() {
+  const url = useURL();
+  const router = useRouter();
+  const segments = useSegments();
+  const { user, isLoading } = useAuth();
+  const pendingDeepLink = useRef<string | null>(null);
+
+  // Capture deep link before auth resolves
+  useEffect(() => {
+    if (url && isLoading) {
+      pendingDeepLink.current = url;
+    }
+  }, [url, isLoading]);
+
+  // Navigate after auth resolves
+  useEffect(() => {
+    if (isLoading) return;
+
+    const inAuthGroup = segments[0] === '(auth)';
+    if (!user && !inAuthGroup) {
+      router.replace('/login');
+    } else if (user && inAuthGroup) {
+      // Process pending deep link or go to home
+      if (pendingDeepLink.current) {
+        const path = new URL(pendingDeepLink.current).pathname;
+        pendingDeepLink.current = null;
+        router.replace(path);
+      } else {
+        router.replace('/');
+      }
+    }
+  }, [user, isLoading, segments]);
+
+  return <Slot />;
+}
+```
+
+```json
+// .well-known/apple-app-site-association — NO redirects on this endpoint
+{
+  "applinks": {
+    "details": [
+      {
+        "appIDs": ["TEAMID.com.example.app", "TEAMID.com.example.app.staging"],
+        "components": [
+          { "/": "/product/*", "comment": "Product deep links" },
+          { "/": "/invite/*", "comment": "Invite deep links" }
+        ]
+      }
+    ]
+  }
+}
+```
+
+```json
+// .well-known/assetlinks.json — include BOTH upload key AND app signing key
+[
+  {
+    "relation": ["delegate_permission/common.handle_all_urls"],
+    "target": {
+      "namespace": "android_app",
+      "package_name": "com.example.app",
+      "sha256_cert_fingerprints": [
+        "AA:BB:CC:...:upload_key_fingerprint",
+        "DD:EE:FF:...:app_signing_key_fingerprint"
+      ]
+    }
+  }
+]
+```