@simple-auth-kit/cli 1.0.0

package/registry/core/two-factor.ts

@@ -0,0 +1,108 @@
+// RFC 6238 TOTP + RFC 4648 base32, hand-rolled on node:crypto to avoid a dependency.
+import { createHmac, randomBytes } from "node:crypto";
+import { hashToken, timingSafeEqualString } from "./crypto.js";
+
+const BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+const TOTP_STEP_SECONDS = 30;
+const TOTP_DIGITS = 6;
+const TOTP_SECRET_BYTES = 20; // 160 bits, the RFC 4226 recommendation for HMAC-SHA1
+
+function base32Encode(buffer: Buffer): string {
+  let bits = 0;
+  let value = 0;
+  let output = "";
+  for (const byte of buffer) {
+    value = (value << 8) | byte;
+    bits += 8;
+    while (bits >= 5) {
+      output += BASE32_ALPHABET[(value >>> (bits - 5)) & 0x1f];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) output += BASE32_ALPHABET[(value << (5 - bits)) & 0x1f];
+  return output;
+}
+
+function base32Decode(encoded: string): Buffer {
+  const clean = encoded.toUpperCase().replace(/=+$/, "");
+  let bits = 0;
+  let value = 0;
+  const bytes: number[] = [];
+  for (const char of clean) {
+    const index = BASE32_ALPHABET.indexOf(char);
+    if (index === -1) continue; // tolerate whitespace/hyphens some authenticator apps insert
+    value = (value << 5) | index;
+    bits += 5;
+    if (bits >= 8) {
+      bytes.push((value >>> (bits - 8)) & 0xff);
+      bits -= 8;
+    }
+  }
+  return Buffer.from(bytes);
+}
+
+function hotp(secret: Buffer, counter: number): string {
+  const counterBuffer = Buffer.alloc(8);
+  counterBuffer.writeBigUInt64BE(BigInt(counter));
+  const hmac = createHmac("sha1", secret).update(counterBuffer).digest();
+  const offset = hmac[hmac.length - 1] & 0x0f;
+  const binCode =
+    ((hmac[offset] & 0x7f) << 24) | ((hmac[offset + 1] & 0xff) << 16) | ((hmac[offset + 2] & 0xff) << 8) | (hmac[offset + 3] & 0xff);
+  return (binCode % 10 ** TOTP_DIGITS).toString().padStart(TOTP_DIGITS, "0");
+}
+
+export function generateTotpSecret(): string {
+  return base32Encode(randomBytes(TOTP_SECRET_BYTES));
+}
+
+/** `otpauth://` URI for QR-code enrollment, the format every major authenticator app understands. */
+export function buildTotpProvisioningUri(opts: { secret: string; accountName: string; issuer: string }): string {
+  const label = encodeURIComponent(`${opts.issuer}:${opts.accountName}`);
+  const params = new URLSearchParams({
+    secret: opts.secret,
+    issuer: opts.issuer,
+    algorithm: "SHA1",
+    digits: String(TOTP_DIGITS),
+    period: String(TOTP_STEP_SECONDS),
+  });
+  return `otpauth://totp/${label}?${params.toString()}`;
+}
+
+export function generateTotpCode(secret: string): string {
+  const counter = Math.floor(Date.now() / 1000 / TOTP_STEP_SECONDS);
+  return hotp(base32Decode(secret), counter);
+}
+
+/**
+ * Checks `code` against the current 30s step, tolerating `window` steps of clock drift on
+ * either side (default 1 = accepts the previous/current/next step, ±30s).
+ */
+export function verifyTotpCode(secret: string, code: string, opts: { window?: number } = {}): boolean {
+  const window = opts.window ?? 1;
+  const normalized = code.trim();
+  if (!/^\d{6}$/.test(normalized)) return false;
+
+  const secretBytes = base32Decode(secret);
+  const counter = Math.floor(Date.now() / 1000 / TOTP_STEP_SECONDS);
+  for (let offset = -window; offset <= window; offset++) {
+    if (counter + offset < 0) continue;
+    if (timingSafeEqualString(hotp(secretBytes, counter + offset), normalized)) return true;
+  }
+  return false;
+}
+
+export interface BackupCode {
+  code: string;
+  hash: string;
+}
+
+export function generateBackupCodes(count = 10): BackupCode[] {
+  return Array.from({ length: count }, () => {
+    const code = randomBytes(5).toString("hex"); // 10 hex chars, easy to type back in
+    return { code, hash: hashToken(code) };
+  });
+}
+
+export function verifyBackupCode(code: string, hash: string): boolean {
+  return timingSafeEqualString(hashToken(code.trim().toLowerCase()), hash);
+}

package/registry/core/types.ts

@@ -0,0 +1,127 @@
+// HS256: one symmetric secret signs and verifies. `kid` is header-only metadata, not consulted
+// on the verify path — there is only ever one secret to check against.
+export interface JwtSigningKey {
+  kid: string;
+  secret: Uint8Array;
+}
+
+export interface AccessTokenClaims {
+  sub: string;
+  sessionId: string;
+  roles: string[];
+  permissions: string[];
+  jti: string;
+}
+
+// `roles`/`permissions` omitted (not empty arrays) means "resolve authorization elsewhere" —
+// a combo that resolves it from the database per request passes neither field.
+export interface AccessTokenInput {
+  sub: string;
+  sessionId: string;
+  roles?: string[];
+  permissions?: string[];
+}
+
+export interface RefreshTokenClaims {
+  sub: string;
+  sessionId: string;
+  sv: number;
+  jti: string;
+}
+
+// Holds no usable credential: `currentRefreshJti` is the id of the valid refresh token, never
+// the token itself — a read of this table hands an attacker nothing they can present.
+export interface SessionRecord {
+  id: string;
+  userId: string;
+  sessionVersion: number;
+  currentRefreshJti: string;
+  /** Which login produced this session — an OAuth provider name, or absent for a password login. */
+  provider?: string;
+  expiresAt: string;
+  revokedAt: string | null;
+  /** The user who revoked it. Absent when it was revoked by something other than a person. */
+  revokedBy?: string;
+  revokedByIp?: string;
+  createdAt: string;
+  userAgent?: string;
+  ip?: string;
+}
+
+// Optional throughout: a revocation with no actor (a refresh-reuse kill) is a real case, and
+// writing a wrong actor would be worse than writing none.
+export interface Revoker {
+  userId?: string;
+  ip?: string;
+}
+
+export type AuditEvent =
+  | { type: "session_created"; sessionId: string; userId: string }
+  | { type: "session_revoked"; sessionId: string; userId: string }
+  | { type: "all_sessions_revoked"; userId: string }
+  | { type: "other_sessions_revoked"; userId: string; keepSessionId: string }
+  | { type: "refresh_reuse_detected"; sessionId: string; userId: string }
+  | { type: "user_blocked"; userId: string }
+  | { type: "user_deactivated"; userId: string }
+  | { type: "password_reset_requested"; userId: string }
+  | { type: "password_reset_completed"; userId: string }
+  | { type: "two_factor_enabled"; userId: string }
+  | { type: "two_factor_disabled"; userId: string }
+  | { type: "two_factor_challenge_failed"; userId: string }
+  | { type: "oauth_account_linked"; userId: string; provider: string }
+  | { type: "role_assigned"; userId: string; role: string }
+  | { type: "role_revoked"; userId: string; role: string }
+  | { type: "permission_granted"; userId: string; permission: string }
+  | { type: "permission_revoked"; userId: string; permission: string };
+
+export class AuthCoreError extends Error {
+  constructor(
+    message: string,
+    public readonly code: string,
+  ) {
+    super(message);
+    this.name = "AuthCoreError";
+  }
+}
+
+export class RefreshInvalidError extends AuthCoreError {
+  constructor(message = "refresh token is invalid or revoked") {
+    super(message, "REFRESH_INVALID");
+  }
+}
+
+export class RefreshReuseDetectedError extends AuthCoreError {
+  constructor(message = "refresh token reuse detected, session family revoked") {
+    super(message, "REFRESH_REUSE_DETECTED");
+  }
+}
+
+export class AccessTokenInvalidError extends AuthCoreError {
+  constructor(message = "access token is invalid, expired, or revoked") {
+    super(message, "ACCESS_TOKEN_INVALID");
+  }
+}
+
+export class TwoFactorChallengeInvalidError extends AuthCoreError {
+  constructor(message = "two-factor challenge token is invalid or expired") {
+    super(message, "TWO_FACTOR_CHALLENGE_INVALID");
+  }
+}
+
+export class PasswordResetTokenInvalidError extends AuthCoreError {
+  constructor(message = "password reset token is invalid, expired, or already used") {
+    super(message, "PASSWORD_RESET_TOKEN_INVALID");
+  }
+}
+
+export class OAuthExchangeError extends AuthCoreError {
+  constructor(message = "OAuth code exchange with the provider failed") {
+    super(message, "OAUTH_EXCHANGE_FAILED");
+  }
+}
+
+export class OAuthProfileInvalidError extends AuthCoreError {
+  constructor(message = "OAuth provider id_token is invalid or could not be verified") {
+    super(message, "OAUTH_PROFILE_INVALID");
+  }
+}

package/registry/mobile-apps/README.md

@@ -0,0 +1,65 @@
+# `registry/mobile-apps/` — mobile app templates
+
+Two products, same `shared/` + `variants/{base,workspaces}` composition and byte-identical
+hoisting rule as `registry/admin-apps/`, `installMode: "scaffold"` (see
+`registry/admin-apps/README.md` for what that means concretely — a whole standalone app written
+into the target directory, not a fragment merged into a host project).
+
+| Product | `kind` in `packages/cli/registry.json` | Extracted from |
+|---|---|---|
+| `mobile-expo` | `mobile` | `apps/mobile-expo` + `apps/mobile-expo-workspaces` |
+| `mobile-bare-rn` | `mobile` | `apps/mobile-bare-rn` + `apps/mobile-bare-rn-workspaces` |
+
+Both decompose cleanly — the base/workspaces split in the source apps already *was* conceptually a
+shared+variant pair (each source app's own `package.json` description says as much: "a deliberate
+copy... rather than a shared abstraction"). The same 5 source files carry the workspace-scoping
+diff in both products (`api/authClient.ts`, `navigation/RootNavigator.tsx`, `navigation/types.ts`,
+`screens/HomeScreen.tsx`, `store/authStore.ts`), and the same 3 files are pure workspaces-only
+additions (`screens/WorkspaceSelectScreen.tsx`, `store/workspaceStore.ts`,
+`workspace/activeWorkspace.ts`). Dependencies are byte-identical between each product's own two
+source apps.
+
+## `mobile-bare-rn`: native identity retemplating
+
+This is the one place a plain copy isn't enough. Bare React Native bakes a fixed app identity into
+its native scaffolding: Android `applicationId`/package folder (`com.mobilebarern`), iOS Xcode
+project/scheme/bundle id (`MobileBareRn`). In the source apps this is byte-identical between `base`
+and `workspaces` — which only works because the two are never built side by side. Copying either
+one's `android/`/`ios/` verbatim into every generated app would mean **every app this combo
+generates collides on the same `applicationId`/bundle id**, which is silently fine until someone
+tries to install two of them on the same device or submit both to an app store.
+
+`packages/cli/lib/rename-native.ts` fixes this as a post-copy step, run only for this combo (via the
+`nativeIdentity` field on its `packages/cli/registry.json` entry — `{ name: "MobileBareRn", package:
+"com.mobilebarern" }`), driven by `--name`:
+
+1. Moves the Android Kotlin package folder (`android/app/src/main/java/com/mobilebarern/` →
+   `.../com/<newpackage>/`).
+2. Renames every file or directory anywhere under `ios/` whose name is the old identity or starts
+   with `<oldName>.` — the `.xcodeproj`, the source folder, the `.xcscheme` — not a hardcoded list
+   of three paths, so it keeps working if a future RN version's template adds another
+   identity-named file.
+3. Blanket string-replaces the old name/package with the new ones across every remaining text file
+   under `android/`/`ios/`, plus the root `app.json` — `build.gradle`, `settings.gradle`,
+   `strings.xml`, `project.pbxproj`, `Podfile`, `Info.plist`. This mirrors what `react-native
+   rename` tooling does; surgically parsing a semi-structured `.pbxproj` for no real benefit isn't
+   worth the fragility.
+4. Reconciles `auth.lock.json`'s manifest to follow every rename (chaining a nested file's own
+   move with its parent directory's later move — e.g. a scheme file renamed while still inside the
+   old-named `.xcodeproj`, whose folder is itself renamed one step after), so a future re-sync
+   doesn't see every native file as spuriously removed or user-modified.
+
+`mobile-expo` has none of this — Expo's managed workflow has no `ios/`/`android/` folders at all,
+so its copy is exactly as simple as the backend combos'.
+
+**Not verified**: the actual native (Xcode/Gradle) build of a generated `mobile-bare-rn` app. This
+environment has no Xcode/Android SDK. What's verified is that the identity strings end up
+consistent and unique per generated app (confirmed by generating two apps with different `--name`
+values and diffing their `applicationId`/bundle id/package paths) and that the TypeScript side
+installs and typechecks cleanly. If a native build ever fails on a freshly generated app, start by
+checking whether some other identity-bearing file wasn't caught by step 2 or 3 above.
+
+## `@simple-auth-kit/auth-client`
+
+Same as `registry/admin-apps/README.md` — resolved from the published npm package, no
+monorepo/pnpm workspace required.

package/registry/mobile-apps/bare-rn/shared/.bundle/config

@@ -0,0 +1,2 @@
+BUNDLE_PATH: "vendor/bundle"
+BUNDLE_FORCE_RUBY_PLATFORM: 1

package/registry/mobile-apps/bare-rn/shared/.eslintrc.js

@@ -0,0 +1,4 @@
+module.exports = {
+  root: true,
+  extends: '@react-native',
+};

package/registry/mobile-apps/bare-rn/shared/.prettierrc.js

@@ -0,0 +1,5 @@
+module.exports = {
+  arrowParens: 'avoid',
+  singleQuote: true,
+  trailingComma: 'all',
+};

package/registry/mobile-apps/bare-rn/shared/.watchmanconfig

@@ -0,0 +1 @@
+{}

package/registry/mobile-apps/bare-rn/shared/App.tsx

@@ -0,0 +1,28 @@
+/**
+ * mobile-bare-rn — end-user auth app for the simple-auth-kit backend.
+ *
+ * @format
+ */
+
+import './global.css';
+
+import React from 'react';
+import { StatusBar, useColorScheme } from 'react-native';
+import { GestureHandlerRootView } from 'react-native-gesture-handler';
+import { SafeAreaProvider } from 'react-native-safe-area-context';
+import { RootNavigator } from './src/navigation/RootNavigator';
+
+function App(): React.JSX.Element {
+  const isDarkMode = useColorScheme() === 'dark';
+
+  return (
+    <GestureHandlerRootView style={{ flex: 1 }}>
+      <SafeAreaProvider>
+        <StatusBar barStyle={isDarkMode ? 'light-content' : 'dark-content'} />
+        <RootNavigator />
+      </SafeAreaProvider>
+    </GestureHandlerRootView>
+  );
+}
+
+export default App;

package/registry/mobile-apps/bare-rn/shared/Gemfile

@@ -0,0 +1,17 @@
+source 'https://rubygems.org'
+
+# You may use http://rbenv.org/ or https://rvm.io/ to install and use this version
+ruby ">= 2.6.10"
+
+# Exclude problematic versions of cocoapods and activesupport that causes build failures.
+gem 'cocoapods', '>= 1.13', '!= 1.15.0', '!= 1.15.1'
+gem 'activesupport', '>= 6.1.7.5', '!= 7.1.0'
+gem 'xcodeproj', '< 1.26.0'
+gem 'concurrent-ruby', '< 1.3.4'
+
+# Ruby 3.4.0 has removed some libraries from the standard library.
+gem 'bigdecimal'
+gem 'logger'
+gem 'benchmark'
+gem 'mutex_m'
+gem 'nkf'

package/registry/mobile-apps/bare-rn/shared/README.md

@@ -0,0 +1,97 @@
+This is a new [**React Native**](https://reactnative.dev) project, bootstrapped using [`@react-native-community/cli`](https://github.com/react-native-community/cli).
+
+# Getting Started
+
+> **Note**: Make sure you have completed the [Set Up Your Environment](https://reactnative.dev/docs/set-up-your-environment) guide before proceeding.
+
+## Step 1: Start Metro
+
+First, you will need to run **Metro**, the JavaScript build tool for React Native.
+
+To start the Metro dev server, run the following command from the root of your React Native project:
+
+```sh
+# Using npm
+npm start
+
+# OR using Yarn
+yarn start
+```
+
+## Step 2: Build and run your app
+
+With Metro running, open a new terminal window/pane from the root of your React Native project, and use one of the following commands to build and run your Android or iOS app:
+
+### Android
+
+```sh
+# Using npm
+npm run android
+
+# OR using Yarn
+yarn android
+```
+
+### iOS
+
+For iOS, remember to install CocoaPods dependencies (this only needs to be run on first clone or after updating native deps).
+
+The first time you create a new project, run the Ruby bundler to install CocoaPods itself:
+
+```sh
+bundle install
+```
+
+Then, and every time you update your native dependencies, run:
+
+```sh
+bundle exec pod install
+```
+
+For more information, please visit [CocoaPods Getting Started guide](https://guides.cocoapods.org/using/getting-started.html).
+
+```sh
+# Using npm
+npm run ios
+
+# OR using Yarn
+yarn ios
+```
+
+If everything is set up correctly, you should see your new app running in the Android Emulator, iOS Simulator, or your connected device.
+
+This is one way to run your app — you can also build it directly from Android Studio or Xcode.
+
+## Step 3: Modify your app
+
+Now that you have successfully run the app, let's make changes!
+
+Open `App.tsx` in your text editor of choice and make some changes. When you save, your app will automatically update and reflect these changes — this is powered by [Fast Refresh](https://reactnative.dev/docs/fast-refresh).
+
+When you want to forcefully reload, for example to reset the state of your app, you can perform a full reload:
+
+- **Android**: Press the <kbd>R</kbd> key twice or select **"Reload"** from the **Dev Menu**, accessed via <kbd>Ctrl</kbd> + <kbd>M</kbd> (Windows/Linux) or <kbd>Cmd ⌘</kbd> + <kbd>M</kbd> (macOS).
+- **iOS**: Press <kbd>R</kbd> in iOS Simulator.
+
+## Congratulations! :tada:
+
+You've successfully run and modified your React Native App. :partying_face:
+
+### Now what?
+
+- If you want to add this new React Native code to an existing application, check out the [Integration guide](https://reactnative.dev/docs/integration-with-existing-apps).
+- If you're curious to learn more about React Native, check out the [docs](https://reactnative.dev/docs/getting-started).
+
+# Troubleshooting
+
+If you're having issues getting the above steps to work, see the [Troubleshooting](https://reactnative.dev/docs/troubleshooting) page.
+
+# Learn More
+
+To learn more about React Native, take a look at the following resources:
+
+- [React Native Website](https://reactnative.dev) - learn more about React Native.
+- [Getting Started](https://reactnative.dev/docs/environment-setup) - an **overview** of React Native and how setup your environment.
+- [Learn the Basics](https://reactnative.dev/docs/getting-started) - a **guided tour** of the React Native **basics**.
+- [Blog](https://reactnative.dev/blog) - read the latest official React Native **Blog** posts.
+- [`@facebook/react-native`](https://github.com/facebook/react-native) - the Open Source; GitHub **repository** for React Native.

package/registry/mobile-apps/bare-rn/shared/__mocks__/reactNativeConfigMock.js

@@ -0,0 +1,3 @@
+// react-native-config reads its native module's getConfig() result at import time; there is no
+// native module under jest, so importing the real package throws before any test can run.
+module.exports = {};

package/registry/mobile-apps/bare-rn/shared/__mocks__/styleMock.js

@@ -0,0 +1 @@
+module.exports = {};

package/registry/mobile-apps/bare-rn/shared/__tests__/App.test.tsx

@@ -0,0 +1,13 @@
+/**
+ * @format
+ */
+
+import React from 'react';
+import ReactTestRenderer from 'react-test-renderer';
+import App from '../App';
+
+test('renders correctly', async () => {
+  await ReactTestRenderer.act(() => {
+    ReactTestRenderer.create(<App />);
+  });
+});

package/registry/mobile-apps/bare-rn/shared/android/app/build.gradle

@@ -0,0 +1,121 @@
+apply plugin: "com.android.application"
+apply plugin: "org.jetbrains.kotlin.android"
+apply plugin: "com.facebook.react"
+// react-native-config: injects the repo-root .env into BuildConfig fields (Config.API_BASE_URL etc).
+apply from: project(':react-native-config').projectDir.getPath() + "/dotenv.gradle"
+
+/**
+ * This is the configuration block to customize your React Native Android app.
+ * By default you don't need to apply any configuration, just uncomment the lines you need.
+ */
+react {
+    /* Folders */
+    //   The root of your project, i.e. where "package.json" lives. Default is '../..'
+    // root = file("../../")
+    //   The folder where the react-native NPM package is. Default is ../../node_modules/react-native
+    // reactNativeDir = file("../../node_modules/react-native")
+    //   The folder where the react-native Codegen package is. Default is ../../node_modules/@react-native/codegen
+    // codegenDir = file("../../node_modules/@react-native/codegen")
+    //   The cli.js file which is the React Native CLI entrypoint. Default is ../../node_modules/react-native/cli.js
+    // cliFile = file("../../node_modules/react-native/cli.js")
+
+    /* Variants */
+    //   The list of variants to that are debuggable. For those we're going to
+    //   skip the bundling of the JS bundle and the assets. Default is "debug", "debugOptimized".
+    //   If you add flavors like lite, prod, etc. you'll have to list your debuggableVariants.
+    // debuggableVariants = ["liteDebug", "liteDebugOptimized", "prodDebug", "prodDebugOptimized"]
+
+    /* Bundling */
+    //   A list containing the node command and its flags. Default is just 'node'.
+    // nodeExecutableAndArgs = ["node"]
+    //
+    //   The command to run when bundling. By default is 'bundle'
+    // bundleCommand = "ram-bundle"
+    //
+    //   The path to the CLI configuration file. Default is empty.
+    // bundleConfig = file(../rn-cli.config.js)
+    //
+    //   The name of the generated asset file containing your JS bundle
+    // bundleAssetName = "MyApplication.android.bundle"
+    //
+    //   The entry file for bundle generation. Default is 'index.android.js' or 'index.js'
+    // entryFile = file("../js/MyApplication.android.js")
+    //
+    //   A list of extra flags to pass to the 'bundle' commands.
+    //   See https://github.com/react-native-community/cli/blob/main/docs/commands.md#bundle
+    // extraPackagerArgs = []
+
+    /* Hermes Commands */
+    //   The hermes compiler command to run. By default it is 'hermesc'
+    // hermesCommand = "$rootDir/my-custom-hermesc/bin/hermesc"
+    //
+    //   The list of flags to pass to the Hermes compiler. By default is "-O", "-output-source-map"
+    // hermesFlags = ["-O", "-output-source-map"]
+
+    /* Autolinking */
+    autolinkLibrariesWithApp()
+}
+
+/**
+ * Set this to true to Run Proguard on Release builds to minify the Java bytecode.
+ */
+def enableProguardInReleaseBuilds = false
+
+/**
+ * The preferred build flavor of JavaScriptCore (JSC)
+ *
+ * For example, to use the international variant, you can use:
+ * `def jscFlavor = io.github.react-native-community:jsc-android-intl:2026004.+`
+ *
+ * The international variant includes ICU i18n library and necessary data
+ * allowing to use e.g. `Date.toLocaleString` and `String.localeCompare` that
+ * give correct results when using with locales other than en-US. Note that
+ * this variant is about 6MiB larger per architecture than default.
+ */
+def jscFlavor = 'io.github.react-native-community:jsc-android:2026004.+'
+
+android {
+    ndkVersion rootProject.ext.ndkVersion
+    buildToolsVersion rootProject.ext.buildToolsVersion
+    compileSdk rootProject.ext.compileSdkVersion
+
+    namespace "com.mobilebarern"
+    defaultConfig {
+        applicationId "com.mobilebarern"
+        minSdkVersion rootProject.ext.minSdkVersion
+        targetSdkVersion rootProject.ext.targetSdkVersion
+        versionCode 1
+        versionName "1.0"
+    }
+    signingConfigs {
+        debug {
+            storeFile file('debug.keystore')
+            storePassword 'android'
+            keyAlias 'androiddebugkey'
+            keyPassword 'android'
+        }
+    }
+    buildTypes {
+        debug {
+            signingConfig signingConfigs.debug
+        }
+        release {
+            // Caution! In production, you need to generate your own keystore file.
+            // see https://reactnative.dev/docs/signed-apk-android.
+            signingConfig signingConfigs.debug
+            minifyEnabled enableProguardInReleaseBuilds
+            proguardFiles getDefaultProguardFile("proguard-android.txt"), "proguard-rules.pro"
+        }
+    }
+}
+
+dependencies {
+    // The version of react-native is set by the React Native Gradle Plugin
+    implementation("com.facebook.react:react-android")
+
+    if (hermesEnabled.toBoolean()) {
+        implementation("com.facebook.react:hermes-android")
+    } else {
+        implementation jscFlavor
+    }
+}

package/registry/mobile-apps/bare-rn/shared/android/app/proguard-rules.pro

@@ -0,0 +1,10 @@
+# Add project specific ProGuard rules here.
+# By default, the flags in this file are appended to flags specified
+# in /usr/local/Cellar/android-sdk/24.3.3/tools/proguard/proguard-android.txt
+# You can edit the include path and order by changing the proguardFiles
+# directive in build.gradle.
+#
+# For more details, see
+#   http://developer.android.com/guide/developing/tools/proguard.html
+
+# Add any project specific keep options here:

package/registry/mobile-apps/bare-rn/shared/android/app/src/main/AndroidManifest.xml

@@ -0,0 +1,27 @@
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <uses-permission android:name="android.permission.INTERNET" />
+
+    <application
+      android:name=".MainApplication"
+      android:label="@string/app_name"
+      android:icon="@mipmap/ic_launcher"
+      android:roundIcon="@mipmap/ic_launcher_round"
+      android:allowBackup="false"
+      android:theme="@style/AppTheme"
+      android:usesCleartextTraffic="${usesCleartextTraffic}"
+      android:supportsRtl="true">
+      <activity
+        android:name=".MainActivity"
+        android:label="@string/app_name"
+        android:configChanges="keyboard|keyboardHidden|orientation|screenLayout|screenSize|smallestScreenSize|uiMode"
+        android:launchMode="singleTask"
+        android:windowSoftInputMode="adjustResize"
+        android:exported="true">
+        <intent-filter>
+            <action android:name="android.intent.action.MAIN" />
+            <category android:name="android.intent.category.LAUNCHER" />
+        </intent-filter>
+      </activity>
+    </application>
+</manifest>