@simple-auth-kit/cli 1.3.2 → 1.4.1

package/registry/combos/nestjs-prisma/shared/src/auth.controller.ts

@@ -1,8 +1,33 @@
-import { BadRequestException, Body, Controller, Get, Inject, Ip, Param, Patch, Post, Query, Req, UseGuards } from "@nestjs/common";
-import { ApiBearerAuth, ApiBody, ApiOperation, ApiParam, ApiQuery, ApiResponse, ApiTags } from "@nestjs/swagger";
+import {
+  BadRequestException,
+  Body,
+  Controller,
+  Get,
+  Inject,
+  Ip,
+  Param,
+  Patch,
+  Post,
+  Query,
+  Req,
+  UseGuards,
+} from "@nestjs/common";
+import {
+  ApiBearerAuth,
+  ApiBody,
+  ApiOperation,
+  ApiParam,
+  ApiQuery,
+  ApiResponse,
+  ApiTags,
+} from "@nestjs/swagger";
 import { SkipThrottle } from "@nestjs/throttler";
 import type { Request } from "express";
-import { AUTH_CONFIG, AuthConfig, defaultThrottleBuckets } from "./auth.config.js";
+import {
+  AUTH_CONFIG,
+  AuthConfig,
+  defaultThrottleBuckets,
+} from "./auth.config.js";
 import { AuthGuard } from "./auth.guard.js";
 import { AuthService } from "./auth.service.js";
 import { AuthzGuard } from "./authz.guard.js";
@@ -24,17 +49,18 @@ import {
   SelfProfileDto,
   SessionSummaryDto,
   SignupDto,
-  TwoFactorChallengeDto,
   TwoFactorCodeDto,
   UpdateUserDto,
 } from "./dto/auth.dto.js";
 
 function requireString(value: unknown, field: string): string {
-  if (typeof value !== "string" || value.length === 0) throw new BadRequestException(`${field} is required`);
+  if (typeof value !== "string" || value.length === 0)
+    throw new BadRequestException(`${field} is required`);
   return value;
 }
 
-const optionalString = (value: unknown): string | undefined => (typeof value === "string" ? value : undefined);
+const optionalString = (value: unknown): string | undefined =>
+  typeof value === "string" ? value : undefined;
 
 /**
  * Identity endpoints — everything that is about *a user*, never about a group of them.
@@ -53,7 +79,11 @@ export class AuthController {
   @ApiOperation({ summary: "Create a user and issue a session" })
   @ApiBody({ type: SignupDto })
   @ApiResponse({ status: 201, type: AuthTokensDto })
-  async signup(@Body() body: Record<string, unknown>, @Req() req: Request, @Ip() ip: string) {
+  async signup(
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+    @Ip() ip: string,
+  ) {
     return this.auth.signup({
       email: requireString(body.email, "email"),
       password: requireString(body.password, "password"),
@@ -71,11 +101,24 @@ export class AuthController {
   @Public()
   @ApiOperation({
     summary: "Log in with email, username, or phone + password",
-    description: "identifier is matched against email, username, and phone, in that order. Returns tokens directly, or a 2FA challenge if the account has 2FA enabled.",
+    description:
+      "identifier is matched against email, username, and phone, in that order. Returns tokens directly, or a 2FA challenge if the account has 2FA enabled.",
   })
   @ApiBody({ type: LoginDto })
-  @ApiResponse({ status: 201, schema: { oneOf: [{ $ref: "#/components/schemas/AuthTokensDto" }, { $ref: "#/components/schemas/TwoFactorChallengeDto" }] } })
-  async login(@Body() body: Record<string, unknown>, @Req() req: Request, @Ip() ip: string) {
+  @ApiResponse({
+    status: 201,
+    schema: {
+      oneOf: [
+        { $ref: "#/components/schemas/AuthTokensDto" },
+        { $ref: "#/components/schemas/TwoFactorChallengeDto" },
+      ],
+    },
+  })
+  async login(
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+    @Ip() ip: string,
+  ) {
     return this.auth.login({
       identifier: requireString(body.identifier, "identifier"),
       password: requireString(body.password, "password"),
@@ -89,7 +132,11 @@ export class AuthController {
   @ApiOperation({ summary: "Complete the 2FA challenge from POST /auth/login" })
   @ApiBody({ type: LoginTwoFactorDto })
   @ApiResponse({ status: 201, type: AuthTokensDto })
-  async loginTwoFactor(@Body() body: Record<string, unknown>, @Req() req: Request, @Ip() ip: string) {
+  async loginTwoFactor(
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+    @Ip() ip: string,
+  ) {
     return this.auth.loginTwoFactor({
       challengeToken: requireString(body.challengeToken, "challengeToken"),
       code: requireString(body.code, "code"),
@@ -100,7 +147,9 @@ export class AuthController {
 
   @Post("refresh")
   @Public()
-  @ApiOperation({ summary: "Rotate a refresh token for a new access+refresh pair" })
+  @ApiOperation({
+    summary: "Rotate a refresh token for a new access+refresh pair",
+  })
   @ApiBody({ type: RefreshDto })
   @ApiResponse({ status: 201, type: RefreshResponseDto })
   async refresh(@Body() body: Record<string, unknown>) {
@@ -111,7 +160,11 @@ export class AuthController {
   @Authenticated()
   // Clients hit this on every navigation to verify the token is still live — identity checks
   // must not consume the abuse budget. Metadata only in variants that don't register the guard.
-  @SkipThrottle(Object.fromEntries(defaultThrottleBuckets.map((bucket) => [bucket.name, true])))
+  @SkipThrottle(
+    Object.fromEntries(
+      defaultThrottleBuckets.map((bucket) => [bucket.name, true]),
+    ),
+  )
   @ApiBearerAuth()
   @UseGuards(AuthGuard, AuthzGuard)
   @ApiOperation({
@@ -125,7 +178,10 @@ export class AuthController {
   @ApiResponse({ status: 200, type: CurrentUserDto })
   async me(@Req() req: Request) {
     const { sub, sessionId } = req.auth!;
-    const [{ twoFactorEnabled }, profile] = await Promise.all([this.auth.getTwoFactorStatus(sub), this.auth.getProfile(sub)]);
+    const [{ twoFactorEnabled }, profile] = await Promise.all([
+      this.auth.getTwoFactorStatus(sub),
+      this.auth.getProfile(sub),
+    ]);
     // The same `req.authz` AbilityGuard's ability was built from — not re-resolved here.
     return {
       sub,
@@ -147,7 +203,9 @@ export class AuthController {
   @Authenticated()
   @ApiBearerAuth()
   @UseGuards(AuthGuard)
-  @ApiOperation({ summary: "List the current user's active (non-revoked) sessions" })
+  @ApiOperation({
+    summary: "List the current user's active (non-revoked) sessions",
+  })
   @ApiResponse({ status: 200, type: [SessionSummaryDto] })
   async sessions(@Req() req: Request) {
     return this.auth.listActiveSessions(req.auth!.sub);
@@ -163,7 +221,10 @@ export class AuthController {
     const { sessionId, jti, sub } = req.auth!;
     // The revoker is the caller themselves. Recorded so the row can later be told apart from a
     // session an administrator ended — see `sessions.revoked_by`.
-    await this.auth.logout(sessionId, jti, this.config.accessTokenTtlSeconds, { userId: sub, ip });
+    await this.auth.logout(sessionId, jti, this.config.accessTokenTtlSeconds, {
+      userId: sub,
+      ip,
+    });
     return { ok: true };
   }
 
@@ -185,7 +246,10 @@ export class AuthController {
   @ApiOperation({ summary: "Revoke every session except the current one" })
   @ApiResponse({ status: 201, type: OkResponseDto })
   async logoutOthers(@Req() req: Request, @Ip() ip: string) {
-    await this.auth.logoutOthers(req.auth!.sub, req.auth!.sessionId, { userId: req.auth!.sub, ip });
+    await this.auth.logoutOthers(req.auth!.sub, req.auth!.sessionId, {
+      userId: req.auth!.sub,
+      ip,
+    });
     return { ok: true };
   }
 
@@ -195,11 +259,15 @@ export class AuthController {
   @UseGuards(AuthGuard)
   @ApiOperation({
     summary: "Change the current password",
-    description: "Requires the current password. Every other session is revoked; the one making this call is left alone.",
+    description:
+      "Requires the current password. Every other session is revoked; the one making this call is left alone.",
   })
   @ApiBody({ type: ChangePasswordDto })
   @ApiResponse({ status: 201, type: OkResponseDto })
-  async changePassword(@Body() body: Record<string, unknown>, @Req() req: Request) {
+  async changePassword(
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
     await this.auth.changePassword(req.auth!.sub, req.auth!.sessionId, {
       currentPassword: requireString(body.currentPassword, "currentPassword"),
       newPassword: requireString(body.newPassword, "newPassword"),
@@ -213,15 +281,18 @@ export class AuthController {
   @UseGuards(AuthGuard)
   @ApiOperation({
     summary: "Update the current user's own profile",
-    description: "Self-service — no admin permission required. Updates the caller's own row directly; unrelated to any workspace.",
+    description:
+      "Self-service — no admin permission required. Updates the caller's own row directly; unrelated to any workspace.",
   })
   @ApiBody({ type: UpdateUserDto })
   @ApiResponse({ status: 200, type: SelfProfileDto })
   async updateMe(@Body() body: Record<string, unknown>, @Req() req: Request) {
     return this.auth.updateProfile(req.auth!.sub, {
-      firstName: body.firstName === null ? null : optionalString(body.firstName),
+      firstName:
+        body.firstName === null ? null : optionalString(body.firstName),
       lastName: body.lastName === null ? null : optionalString(body.lastName),
-      displayName: body.displayName === null ? null : optionalString(body.displayName),
+      displayName:
+        body.displayName === null ? null : optionalString(body.displayName),
       phone: body.phone === null ? null : optionalString(body.phone),
       username: body.username === null ? null : optionalString(body.username),
       photo: body.photo === null ? null : optionalString(body.photo),
@@ -232,7 +303,10 @@ export class AuthController {
   @Authenticated()
   @ApiBearerAuth()
   @UseGuards(AuthGuard)
-  @ApiOperation({ summary: "Begin TOTP enrollment", description: "Not active until confirmed via POST /auth/2fa/confirm." })
+  @ApiOperation({
+    summary: "Begin TOTP enrollment",
+    description: "Not active until confirmed via POST /auth/2fa/confirm.",
+  })
   @ApiResponse({ status: 201, type: EnrollTwoFactorResponseDto })
   async enrollTwoFactor(@Req() req: Request) {
     return this.auth.enrollTwoFactor(req.auth!.sub);
@@ -242,28 +316,51 @@ export class AuthController {
   @Authenticated()
   @ApiBearerAuth()
   @UseGuards(AuthGuard)
-  @ApiOperation({ summary: "Confirm TOTP enrollment with a code", description: "Enables 2FA and returns one-time backup codes, shown only here." })
+  @ApiOperation({
+    summary: "Confirm TOTP enrollment with a code",
+    description:
+      "Enables 2FA and returns one-time backup codes, shown only here.",
+  })
   @ApiBody({ type: TwoFactorCodeDto })
   @ApiResponse({ status: 201, type: ConfirmTwoFactorResponseDto })
-  async confirmTwoFactor(@Body() body: Record<string, unknown>, @Req() req: Request) {
-    return this.auth.confirmTwoFactor(req.auth!.sub, requireString(body.code, "code"));
+  async confirmTwoFactor(
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
+    return this.auth.confirmTwoFactor(
+      req.auth!.sub,
+      requireString(body.code, "code"),
+    );
   }
 
   @Post("2fa/disable")
   @Authenticated()
   @ApiBearerAuth()
   @UseGuards(AuthGuard)
-  @ApiOperation({ summary: "Disable 2FA", description: "Requires a valid TOTP or backup code." })
+  @ApiOperation({
+    summary: "Disable 2FA",
+    description: "Requires a valid TOTP or backup code.",
+  })
   @ApiBody({ type: TwoFactorCodeDto })
   @ApiResponse({ status: 201, type: OkResponseDto })
-  async disableTwoFactor(@Body() body: Record<string, unknown>, @Req() req: Request) {
-    await this.auth.disableTwoFactor(req.auth!.sub, requireString(body.code, "code"));
+  async disableTwoFactor(
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
+    await this.auth.disableTwoFactor(
+      req.auth!.sub,
+      requireString(body.code, "code"),
+    );
     return { ok: true };
   }
 
   @Post("password/forgot")
   @Public()
-  @ApiOperation({ summary: "Request a password reset", description: "Always reports success, whether or not the email exists — avoids account enumeration." })
+  @ApiOperation({
+    summary: "Request a password reset",
+    description:
+      "Always reports success, whether or not the email exists — avoids account enumeration.",
+  })
   @ApiBody({ type: ForgotPasswordDto })
   @ApiResponse({ status: 201, type: OkResponseDto })
   async forgotPassword(@Body() body: Record<string, unknown>) {
@@ -273,11 +370,17 @@ export class AuthController {
 
   @Post("password/reset")
   @Public()
-  @ApiOperation({ summary: "Complete a password reset", description: "Revokes every existing session for the user on success." })
+  @ApiOperation({
+    summary: "Complete a password reset",
+    description: "Revokes every existing session for the user on success.",
+  })
   @ApiBody({ type: ResetPasswordDto })
   @ApiResponse({ status: 201, type: OkResponseDto })
   async resetPassword(@Body() body: Record<string, unknown>) {
-    await this.auth.resetPassword(requireString(body.token, "token"), requireString(body.newPassword, "newPassword"));
+    await this.auth.resetPassword(
+      requireString(body.token, "token"),
+      requireString(body.newPassword, "newPassword"),
+    );
     return { ok: true };
   }
 
@@ -292,12 +395,22 @@ export class AuthController {
 
   @Get("oauth/:provider/callback")
   @Public()
-  @ApiOperation({ summary: "OAuth provider callback — exchanges the code and completes login" })
+  @ApiOperation({
+    summary: "OAuth provider callback — exchanges the code and completes login",
+  })
   @ApiParam({ name: "provider", enum: ["google", "apple"] })
   @ApiQuery({ name: "code", required: true })
   @ApiQuery({ name: "state", required: true })
   @ApiResponse({ status: 200, type: AuthTokensDto })
-  async oauthCallback(@Param("provider") provider: string, @Query("code") code: string, @Query("state") state: string) {
-    return this.auth.completeOAuthCallback(provider, requireString(code, "code"), requireString(state, "state"));
+  async oauthCallback(
+    @Param("provider") provider: string,
+    @Query("code") code: string,
+    @Query("state") state: string,
+  ) {
+    return this.auth.completeOAuthCallback(
+      provider,
+      requireString(code, "code"),
+      requireString(state, "state"),
+    );
   }
 }

package/registry/combos/nestjs-prisma/shared/src/route-tiers.ts

@@ -5,7 +5,11 @@
 // also verifies the guards actually attached match the declared tier, so a route marked
 // @Authenticated() with no AuthGuard can't masquerade as gated.
 import { RequestMethod, SetMetadata } from "@nestjs/common";
-import { GUARDS_METADATA, METHOD_METADATA, PATH_METADATA } from "@nestjs/common/constants.js";
+import {
+  GUARDS_METADATA,
+  METHOD_METADATA,
+  PATH_METADATA,
+} from "@nestjs/common/constants.js";
 import type { PermissionSlug } from "./rbac.defaults.js";
 
 export const ROUTE_TIER_KEY = "routeTier";
@@ -13,17 +17,22 @@ export const CHECK_ABILITY_KEY = "checkAbility";
 
 export type RouteTier = "public" | "authenticated" | "ability";
 
-export const Public = () => SetMetadata(ROUTE_TIER_KEY, "public" satisfies RouteTier);
+export const Public = () =>
+  SetMetadata(ROUTE_TIER_KEY, "public" satisfies RouteTier);
 
 // Pair with @UseGuards(AuthGuard) — the startup check refuses a route that claims this tier
 // without an authentication guard behind it.
-export const Authenticated = () => SetMetadata(ROUTE_TIER_KEY, "authenticated" satisfies RouteTier);
+export const Authenticated = () =>
+  SetMetadata(ROUTE_TIER_KEY, "authenticated" satisfies RouteTier);
 
 // Requires AuthGuard, then the variant's authorization guard, then AbilityGuard. All named
 // slugs must be held — the guard ANDs them. The argument is typed as `PermissionSlug` (the
 // catalog in rbac.defaults.ts) so a route can't be gated on a slug nothing will ever grant.
 export const CheckAbility = (...abilities: PermissionSlug[]) =>
-  applyBoth(SetMetadata(ROUTE_TIER_KEY, "ability" satisfies RouteTier), SetMetadata(CHECK_ABILITY_KEY, abilities as string[]));
+  applyBoth(
+    SetMetadata(ROUTE_TIER_KEY, "ability" satisfies RouteTier),
+    SetMetadata(CHECK_ABILITY_KEY, abilities as string[]),
+  );
 
 /** `applyDecorators` from @nestjs/common, minus its class-decorator branch — these two are method decorators. */
 function applyBoth(...decorators: MethodDecorator[]): MethodDecorator {
@@ -33,11 +42,27 @@ function applyBoth(...decorators: MethodDecorator[]): MethodDecorator {
   };
 }
 
+// `any` here is real type erasure, not laziness: controllers/guards have heterogeneous
+// constructor signatures (AdminController takes an AuthService, AuthGuard takes different deps,
+// etc.), and these types only need to carry a class/method identity through reflection — never
+// construct or invoke anything — so `unknown` params would reject every real, differently-typed
+// class assigned to them.
+/* eslint-disable @typescript-eslint/no-explicit-any -- see comment above */
+/** A NestJS controller/guard class reference — reflected on via metadata, never constructed here. */
+type Ctor = abstract new (...args: any[]) => object;
+
+/** A route-handler method — reflected on and invoked by Nest's own pipeline, never called directly here. */
+type HandlerFn = (...args: any[]) => unknown;
+/* eslint-enable @typescript-eslint/no-explicit-any */
+
 /** A guard entry in `@UseGuards` may be a class or an already-constructed instance; both reduce to a class. */
-type GuardEntry = Function | { constructor: Function };
+type GuardEntry = Ctor | { constructor: Ctor };
 
-const guardClassesOn = (target: object): Function[] =>
-  ((Reflect.getMetadata(GUARDS_METADATA, target) as GuardEntry[] | undefined) ?? []).map((g) => (typeof g === "function" ? g : g.constructor));
+const guardClassesOn = (target: object): Ctor[] =>
+  (
+    (Reflect.getMetadata(GUARDS_METADATA, target) as
+      GuardEntry[] | undefined) ?? []
+  ).map((g) => (typeof g === "function" ? g : g.constructor));
 
 const joinPath = (...parts: unknown[]) =>
   "/" +
@@ -48,20 +73,31 @@ const joinPath = (...parts: unknown[]) =>
     .join("/");
 
 /** Own methods carrying Nest's route metadata. Controllers here are flat classes; inherited routes are not a shape this combo uses. */
-function routeHandlersOf(controller: Function): Array<{ name: string; handler: Function }> {
+function routeHandlersOf(
+  controller: Ctor,
+): Array<{ name: string; handler: HandlerFn }> {
   const prototype = controller.prototype as Record<string, unknown>;
   return Object.getOwnPropertyNames(prototype)
     .filter((name) => name !== "constructor")
     .map((name) => ({ name, handler: prototype[name] }))
-    .filter((entry): entry is { name: string; handler: Function } => typeof entry.handler === "function")
-    .filter((entry) => Reflect.getMetadata(PATH_METADATA, entry.handler) !== undefined);
+    .filter(
+      (entry): entry is { name: string; handler: HandlerFn } =>
+        typeof entry.handler === "function",
+    )
+    .filter(
+      (entry) =>
+        Reflect.getMetadata(PATH_METADATA, entry.handler) !== undefined,
+    );
 }
 
 // Fail-closed at startup over the whole route table this library owns. Called from
 // `AuthModule.forRoot` with the same array that populates `controllers:`, so nothing can be
 // added to the module and left out of the check. Covers only this combo's own controllers, not
 // the consuming application's.
-export function assertEveryRouteDeclaresATier(controllers: readonly Function[], guards: { authentication: Function; ability: Function }): void {
+export function assertEveryRouteDeclaresATier(
+  controllers: readonly Ctor[],
+  guards: { authentication: Ctor; ability: Ctor },
+): void {
   const offenders: string[] = [];
 
   for (const controller of controllers) {
@@ -69,12 +105,19 @@ export function assertEveryRouteDeclaresATier(controllers: readonly Function[],
     const controllerGuards = guardClassesOn(controller);
 
     for (const { name, handler } of routeHandlersOf(controller)) {
-      const method = RequestMethod[Reflect.getMetadata(METHOD_METADATA, handler) as RequestMethod] ?? "?";
+      const method =
+        RequestMethod[
+          Reflect.getMetadata(METHOD_METADATA, handler) as RequestMethod
+        ] ?? "?";
       const route = `${method} ${joinPath(controllerPath, Reflect.getMetadata(PATH_METADATA, handler))} (${controller.name}.${name})`;
 
-      const tier: RouteTier | undefined = Reflect.getMetadata(ROUTE_TIER_KEY, handler) ?? Reflect.getMetadata(ROUTE_TIER_KEY, controller);
+      const tier: RouteTier | undefined =
+        Reflect.getMetadata(ROUTE_TIER_KEY, handler) ??
+        Reflect.getMetadata(ROUTE_TIER_KEY, controller);
       if (!tier) {
-        offenders.push(`${route} — declares no tier: add @Public(), @Authenticated(), or @CheckAbility(slug)`);
+        offenders.push(
+          `${route} — declares no tier: add @Public(), @Authenticated(), or @CheckAbility(slug)`,
+        );
         continue;
       }
 
@@ -84,11 +127,22 @@ export function assertEveryRouteDeclaresATier(controllers: readonly Function[],
       const authenticated = attached.includes(guards.authentication);
       const ability = attached.includes(guards.ability);
 
-      if (tier === "public" && (authenticated || ability)) offenders.push(`${route} — declares @Public() but is behind ${attached.map((g) => g.name).join(", ")}`);
-      if (tier === "authenticated" && !authenticated) offenders.push(`${route} — declares @Authenticated() but has no ${guards.authentication.name}`);
-      if (tier === "authenticated" && ability) offenders.push(`${route} — declares @Authenticated() but is behind ${guards.ability.name}; use @CheckAbility instead`);
+      if (tier === "public" && (authenticated || ability))
+        offenders.push(
+          `${route} — declares @Public() but is behind ${attached.map((g) => g.name).join(", ")}`,
+        );
+      if (tier === "authenticated" && !authenticated)
+        offenders.push(
+          `${route} — declares @Authenticated() but has no ${guards.authentication.name}`,
+        );
+      if (tier === "authenticated" && ability)
+        offenders.push(
+          `${route} — declares @Authenticated() but is behind ${guards.ability.name}; use @CheckAbility instead`,
+        );
       if (tier === "ability" && !(authenticated && ability))
-        offenders.push(`${route} — declares @CheckAbility but is not behind ${guards.authentication.name} + ${guards.ability.name}`);
+        offenders.push(
+          `${route} — declares @CheckAbility but is not behind ${guards.authentication.name} + ${guards.ability.name}`,
+        );
     }
   }
 

package/registry/mobile-apps/bare-rn/shared/.husky/commit-msg

@@ -0,0 +1 @@
+npx --no -- commitlint --edit "$1"

package/registry/mobile-apps/bare-rn/shared/.husky/pre-commit

@@ -0,0 +1 @@
+npx lint-staged

package/registry/mobile-apps/bare-rn/shared/.lintstagedrc.json

@@ -0,0 +1,4 @@
+{
+  "*.{ts,tsx,js,jsx}": "eslint --fix",
+  "*.{ts,tsx,js,jsx,json,md,css,scss}": "prettier --write"
+}

package/registry/mobile-apps/bare-rn/shared/.prettierrc.json

@@ -0,0 +1,5 @@
+{
+  "arrowParens": "avoid",
+  "singleQuote": true,
+  "trailingComma": "all"
+}

package/registry/mobile-apps/bare-rn/shared/commitlint.config.js

@@ -0,0 +1,3 @@
+module.exports = {
+  extends: ['@commitlint/config-conventional'],
+};

package/registry/mobile-apps/bare-rn/shared/eslint.config.js

@@ -0,0 +1,19 @@
+const { defineConfig } = require('eslint/config');
+const reactNativeConfig = require('@react-native/eslint-config/flat');
+
+module.exports = defineConfig([
+  {
+    ignores: ['node_modules/**', 'ios/**', 'android/**', 'coverage/**'],
+  },
+  ...reactNativeConfig,
+  {
+    // This app is TypeScript-only, no Flow — and eslint-plugin-ft-flow (pulled in by
+    // @react-native/eslint-config/flat for the .js override) calls the removed
+    // context.getAllComments() API under ESLint 9.3x+, crashing the linter on every .js file.
+    files: ['**/*.js'],
+    rules: {
+      'ft-flow/define-flow-type': 'off',
+      'ft-flow/use-flow-type': 'off',
+    },
+  },
+]);

package/registry/mobile-apps/bare-rn/shared/gitignore

@@ -0,0 +1,78 @@
+# OSX
+#
+.DS_Store
+
+# Xcode
+#
+build/
+*.pbxuser
+!default.pbxuser
+*.mode1v3
+!default.mode1v3
+*.mode2v3
+!default.mode2v3
+*.perspectivev3
+!default.perspectivev3
+xcuserdata
+*.xccheckout
+*.moved-aside
+DerivedData
+*.hmap
+*.ipa
+*.xcuserstate
+**/.xcode.env.local
+
+# Android/IntelliJ
+#
+build/
+.idea
+.gradle
+local.properties
+*.iml
+*.hprof
+.cxx/
+*.keystore
+!debug.keystore
+.kotlin/
+
+# node.js
+#
+node_modules/
+npm-debug.log
+yarn-error.log
+
+# fastlane
+#
+# It is recommended to not store the screenshots in the git repo. Instead, use fastlane to re-generate the
+# screenshots whenever they are needed.
+# For more information about the recommended setup visit:
+# https://docs.fastlane.tools/best-practices/source-control/
+
+**/fastlane/report.xml
+**/fastlane/Preview.html
+**/fastlane/screenshots
+**/fastlane/test_output
+
+# Bundle artifact
+*.jsbundle
+
+# Ruby / CocoaPods
+**/Pods/
+/vendor/bundle/
+
+# Temporary files created by Metro to check the health of the file watcher
+.metro-health-check*
+
+# testing
+/coverage
+
+# Yarn
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/sdks
+!.yarn/versions
+
+# husky-generated shim dir (recreated by the "prepare" script on install)
+.husky/_

package/registry/mobile-apps/bare-rn/variants/base/package.json

@@ -7,6 +7,7 @@
     "android": "react-native run-android",
     "ios": "react-native run-ios",
     "lint": "eslint .",
+    "prepare": "husky",
     "start": "react-native start",
     "test": "jest",
     "typecheck": "tsc --noEmit"
@@ -14,12 +15,12 @@
   "dependencies": {
     "@simple-auth-kit/auth-client": "^1.0.2",
     "@react-native-async-storage/async-storage": "^3.1.1",
-    "@react-native/new-app-screen": "0.86.2",
+    "@react-native/new-app-screen": "0.86.3",
     "@react-navigation/native": "^7.3.16",
     "@react-navigation/native-stack": "^7.18.8",
     "nativewind": "5.0.0-preview.4",
     "react": "19.2.3",
-    "react-native": "0.86.2",
+    "react-native": "0.86.3",
     "react-native-config": "^1.6.1",
     "react-native-css": "^3.0.7",
     "react-native-gesture-handler": "^3.1.0",
@@ -35,20 +36,24 @@
     "@babel/preset-env": "^7.25.3",
     "@babel/runtime": "^7.25.0",
     "@expo/metro-config": "^57.0.7",
-    "@react-native-community/cli": "20.1.0",
-    "@react-native-community/cli-platform-android": "20.1.0",
-    "@react-native-community/cli-platform-ios": "20.1.0",
-    "@react-native/babel-preset": "0.86.2",
-    "@react-native/eslint-config": "0.86.2",
-    "@react-native/jest-preset": "0.86.2",
-    "@react-native/metro-config": "0.86.2",
-    "@react-native/typescript-config": "0.86.2",
+    "@react-native-community/cli": "20.2.0",
+    "@react-native-community/cli-platform-android": "20.2.0",
+    "@react-native-community/cli-platform-ios": "20.2.0",
+    "@react-native/babel-preset": "0.86.3",
+    "@react-native/eslint-config": "0.86.3",
+    "@react-native/jest-preset": "0.86.3",
+    "@react-native/metro-config": "0.86.3",
+    "@react-native/typescript-config": "0.86.3",
     "@types/jest": "^29.5.13",
     "@types/react": "^19.2.0",
     "@types/react-test-renderer": "^19.1.0",
-    "eslint": "^8.19.0",
+    "@commitlint/cli": "^21.2.2",
+    "@commitlint/config-conventional": "^21.2.2",
+    "eslint": "^9.39.5",
+    "husky": "^9.1.7",
     "jest": "^29.6.3",
-    "prettier": "2.8.8",
+    "lint-staged": "^17.5.1",
+    "prettier": "^3.9.6",
     "react-test-renderer": "19.2.3",
     "typescript": "^5.8.3"
   },