reis-mobile 0.9.0 → 0.10.0

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "AI agents for mobile engineering",
-    "version": "0.9.0"
+    "version": "0.10.0"
   },
   "plugins": [
     {
       "name": "reis-mobile",
       "source": "./",
       "description": "AI agents, skills and workflows for Flutter, Android, iOS and React Native development.",
-      "version": "0.9.0",
+      "version": "0.10.0",
       "author": {
         "name": "Warleson Reis"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "reis-mobile",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "AI agents, skills and workflows for Flutter, Android, iOS and React Native development. Use /reis-mobile:doctor, /reis-mobile:review and /reis-mobile:test.",
   "author": {
     "name": "Warleson Reis"

package/CHANGELOG.md

@@ -4,6 +4,26 @@ Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). The pr
 
 ## [Unreleased]
 
+## [0.10.0] - 2026-11-04
+
+### Added
+
+- `mobile-ci` topic skill for deployment pipelines across all five stacks, with the setup, Match, beta, release and Snapshot guides plus Xcode Cloud documentation imported from `greenstevester/fastlane-skill` (MIT), attributed and pinned to their upstream revision.
+
+- Four topic skills, each with Flutter, Android, iOS, React Native and Kotlin Multiplatform references: `mobile-privacy` for consent and data lifecycle, `mobile-networking` for API integration and request recovery, `mobile-auth` for identity/session flows, and `mobile-notifications` for push/local notification lifecycles.
+- English and Portuguese `privacy`, `networking`, `auth` and `notifications` intents, handled by the existing staff engineer, with five-stack routing, prompt discovery and explicit-override tests.
+- `mobile-billing`, `mobile-migration`, `mobile-analytics` and `mobile-hardware` topic skills, each with Flutter, Android, iOS, React Native and Kotlin Multiplatform references: in-app purchases verified by the backend before acknowledgement and recovered after process death; migrations planned as buildable steps, with on-device data that survives skipped releases and interrupted launches; tracking plans with typed events, identity reset on sign-out and consent-gated collection; device hardware from the availability check to the release of the resource, with real-device test matrices.
+- English and Portuguese `billing`, `analytics` and `hardware` intents, handled by `mobile-staff-engineer`. `mobile-migration` joins the existing `migration` route. Plain "analytics" still routes to observability.
+
+### Changed
+
+- Authentication requests now have a dedicated `auth` intent instead of relying on security vocabulary. Explicit security audits retain the security workflow.
+- `mobile-staff-engineer` serves the `billing`, `analytics` and `hardware` intents and loads `mobile-migration` for migration plans.
+
+### Fixed
+
+- The router counted any word starting with "pr" as a review request, so prompts such as "implementar paywall premium" or "definir funil de conversão do produto" went to review. "PR" and "PRs" now count only as whole words.
+
 ## [0.9.0] - 2026-10-13
 
 ### Added

package/README.md

@@ -23,7 +23,7 @@ A mobile app is not a generic project. A code review that does not know about `B
 
 🔎 **Detects the stack on its own.** Flutter (app or plugin), React Native (including Expo), Kotlin Multiplatform, native Android and iOS, with languages and target platforms. A Flutter app with `android/` and `ios/` is still Flutter.
 
-👥 **21 agents and 17 mobile skills.** Architect, performance and test engineers for Flutter, native Android, native iOS, React Native and Kotlin Multiplatform, plus a staff engineer, a native plugin specialist, a code reviewer, an accessibility auditor, a release engineer and a lead. Topic skills cover the five stacks with focused references for debugging, tests, security, Firebase, accessibility, releases, performance budgets, offline sync and production observability.
+👥 **21 agents and 26 mobile skills.** Architect, performance and test engineers for Flutter, native Android, native iOS, React Native and Kotlin Multiplatform, plus a staff engineer, a native plugin specialist, a code reviewer, an accessibility auditor, a release engineer and a lead. Topic skills cover the five stacks with focused references for debugging, tests, security, Firebase, accessibility, releases, performance budgets, offline sync, production observability, privacy, networking, authentication, notifications, in-app purchases, migrations, product analytics and device hardware.
 
 🧩 **Project-specific context.** `/reis-mobile:project` records real app symbols, owners, boundaries and validation commands in `.reis-mobile/project.md`; the team can add product rules that code cannot reveal. Refreshing the verified map preserves team-authored text.
 
@@ -44,28 +44,25 @@ A mobile app is not a generic project. A code review that does not know about `B
 ## What's new
 
 <!-- reis-mobile:latest-release:start -->
-### v0.9.0
+### v0.10.0
 
 #### Added
 
-- `core/providers/`: the multi-provider layer. Six external providers — the `codex` and `gemini` CLIs plus the OpenAI, Gemini, OpenRouter and Ollama HTTP APIs — described as data (endpoint, credential variables, request shape, model catalog), so adding one touches no command. Status, model and allowlist resolution make no network call: a CLI is found by scanning `PATH`, an HTTP provider by its credential variable.
-- `reis-mobile providers [--all] [--json]` lists every provider with the evidence behind its status (`ready`, `local`, `missing`, `disabled`, `blocked`), its endpoint and the resolved model. `reis-mobile providers --models` asks each provider which models it serves, so no model id is ever shipped as a default.
-- `reis-mobile consult [--providers a,b] [--model <id>] [--file <path>] [--timeout <ms>] <question>` asks the selected providers the same question in parallel. The core performs the call, so no API key passes through the conversation; the question is redacted on the way out and every answer on the way in. Each requested provider is reported with its own typed status — `ok`, `unavailable`, `no-model`, `timeout`, `error` — and the exit code is 1 only when nobody answered.
-- `/reis-mobile:consult [options] <question>`, also reachable as `/reis-mobile consult ...`: routes the question through the stack's specialist, requires its own position first, builds a self-contained briefing in `.reis-mobile/consults/`, consults the providers and then reconciles every outside claim against the code as confirmed with `file:line`, unverifiable or wrong.
-- `providers:` in `.reis-mobile/config.yaml`: the allowlist of external providers a repository accepts, committed with the repository. An absent key allows all, an empty list allows none, and a blocked provider says so instead of failing.
-- `providers.<id>.model` and `providers.<id>.enabled` in `~/.config/reis-mobile/config.json`, with precedence `--model`, then the provider's model variable (`OPENAI_MODEL`, `GEMINI_MODEL`, `OPENROUTER_MODEL`, `OLLAMA_MODEL`), then the config file.
-- `reis-mobile doctor` lists the configured providers under Integrations, with a single informational row when none is configured. It still makes no network call.
+- `mobile-ci` topic skill for deployment pipelines across all five stacks, with the setup, Match, beta, release and Snapshot guides plus Xcode Cloud documentation imported from `greenstevester/fastlane-skill` (MIT), attributed and pinned to their upstream revision.
+
+- Four topic skills, each with Flutter, Android, iOS, React Native and Kotlin Multiplatform references: `mobile-privacy` for consent and data lifecycle, `mobile-networking` for API integration and request recovery, `mobile-auth` for identity/session flows, and `mobile-notifications` for push/local notification lifecycles.
+- English and Portuguese `privacy`, `networking`, `auth` and `notifications` intents, handled by the existing staff engineer, with five-stack routing, prompt discovery and explicit-override tests.
+- `mobile-billing`, `mobile-migration`, `mobile-analytics` and `mobile-hardware` topic skills, each with Flutter, Android, iOS, React Native and Kotlin Multiplatform references: in-app purchases verified by the backend before acknowledgement and recovered after process death; migrations planned as buildable steps, with on-device data that survives skipped releases and interrupted launches; tracking plans with typed events, identity reset on sign-out and consent-gated collection; device hardware from the availability check to the release of the resource, with real-device test matrices.
+- English and Portuguese `billing`, `analytics` and `hardware` intents, handled by `mobile-staff-engineer`. `mobile-migration` joins the existing `migration` route. Plain "analytics" still routes to observability.
 
 #### Changed
 
-- `/reis-mobile:debate --external` selects providers through the core instead of probing with `command -v`, accepts `--providers a,b`, and no longer needs `Bash(codex:*)` or `Bash(gemini:*)`: every provider call goes through the CLI. Behavior without a ready provider is unchanged — the debate carries on with the agents alone.
-- CLI providers are asked for an opinion, not for work: `codex exec` now runs with `--sandbox read-only` and `gemini` with `--approval-mode plan`, both in a temporary working directory that is removed afterwards. The debate's previous invocation granted write access and the user's repository as a workspace, neither of which a second opinion needs.
-- `/reis-mobile:review` points at `/reis-mobile:consult` when a finding should be cross-checked outside the session, and still never sends project context itself.
+- Authentication requests now have a dedicated `auth` intent instead of relying on security vocabulary. Explicit security audits retain the security workflow.
+- `mobile-staff-engineer` serves the `billing`, `analytics` and `hardware` intents and loads `mobile-migration` for migration plans.
 
 #### Fixed
 
-- `/reis-mobile:debate --external` could not reach Codex at all on current CLI versions: `codex exec --full-auto` is rejected with `unexpected argument '--full-auto' found`, and the call ran outside a Git repository without `--skip-git-repo-check`. The provider catalog now carries the invocation verified against `codex exec --help`.
-- A failing CLI provider reported its opening banner (`YOLO mode is enabled...`) instead of the cause. The reported line is now the first one that names a failure, falling back to the last line of stderr.
+- The router counted any word starting with "pr" as a review request, so prompts such as "implementar paywall premium" or "definir funil de conversão do produto" went to review. "PR" and "PRs" now count only as whole words.
 
 <!-- reis-mobile:latest-release:end -->
 
@@ -389,6 +386,7 @@ The router never invents a specialist: if no agent serves the intent, it warns y
 | Build a plugin or debug MethodChannel/EventChannel | agent `plugin-native-expert` | ✅ |
 | Audit a screen for TalkBack, VoiceOver, touch targets and text scaling | agent `mobile-accessibility-auditor` | ✅ |
 | Check release readiness, write release notes or set up CI/CD | agent `mobile-release-engineer` | ✅ |
+| Set up fastlane lanes, Match, TestFlight or automated screenshots | skill [`mobile-ci`](skills/mobile-ci/SKILL.md) | ✅ |
 | Set startup, frame, memory and battery budgets and guard them in CI | skill `mobile-performance` | ✅ |
 | Make the app work offline, queue writes and resolve conflicts | skill `mobile-offline-sync` | ✅ |
 | Get usable crashes, errors, traces and release-health alerts in production | skill `mobile-observability` | ✅ |
@@ -407,8 +405,8 @@ The router never invents a specialist: if no agent serves the intent, it warns y
 | **Project context** | You explain the stack | Deterministic detection of stack, platform and variant |
 | **Review** | Generic | Mobile checklists: lifecycle, `BuildContext`, MASVS, manifest, ATS |
 | **Secrets in the diff** | Sent as they are | Masked before reaching the model |
-| **Specialists** | None | 21 agents and 17 mobile skills |
-| **Context cost** | Zero | ~4,700 fixed tokens (agent and skill descriptions), no hooks |
+| **Specialists** | None | 21 agents and 26 mobile skills |
+| **Context cost** | Zero | ~5,500 fixed tokens (agent and skill descriptions), no hooks |
 | **Best for** | General tasks | Teams and developers working on mobile apps |
 
 **In short:** Claude Code already knows how to code. reis-mobile makes it look at what matters in a mobile app.
@@ -468,7 +466,7 @@ For domain knowledge that code cannot reveal, optionally commit `.reis-mobile/pr
 | `kmp-test-engineer` | Kotlin Multiplatform | test | `commonTest`, target tests and Android/iOS host coverage |
 | `mobile-accessibility-auditor` | all | accessibility | Screen reader labels, roles and states, touch targets, text scaling, focus and announcements, with fixes per platform |
 | `mobile-release-engineer` | all | release, deployment, observability | Go/no-go readiness, versions and signing, crash symbols, release notes and store copy, CI/CD, staged rollout, production crash and release-health signals |
-| `mobile-staff-engineer` | all | debug, architecture, performance, test, security, migration, dependency, build, offline, observability | Cross-toolchain diagnosis and migrations when no stack specialist owns the intent |
+| `mobile-staff-engineer` | all | debug, architecture, performance, test, security, migration, dependency, build, offline, observability, privacy, networking, auth, notifications, billing, analytics, hardware | Cross-toolchain diagnosis, migrations and capability workflows when no stack specialist owns the intent |
 | `plugin-native-expert` | Flutter | on demand | MethodChannel, EventChannel, Pigeon and Kotlin/Swift bridges, threading and lifecycle |
 | `lead-mobile` | all | on demand | Coordinates the other agents and consolidates a single action plan |
 
@@ -487,9 +485,18 @@ Every skill starts with `mobile-`. **Topic** skills cover every stack with one r
 | `mobile-security` | OWASP MASVS security checks | review, security, release | Flutter (token storage), Android (intents), iOS, React Native, KMP, OAuth/OIDC and PKCE |
 | `mobile-accessibility` | Screen readers, touch targets, text scaling, contrast, localization | accessibility | Flutter (Semantics), Android (Compose and Views), iOS (SwiftUI and UIKit), React Native, KMP, localization and RTL |
 | `mobile-release` | Release readiness, store copy, billing and CI/CD | release, deployment | Flutter, Android, iOS, React Native, KMP, release notes and store listing, in-app purchases, CI/CD |
+| `mobile-ci` | CI/CD and fastlane setup, Match, beta, release and Snapshot | deployment | Flutter, Android, iOS, React Native, KMP, imported fastlane guides and Xcode Cloud |
 | `mobile-performance` | Startup, rendering, memory, battery, app size and regression gates | performance | Flutter, Android, iOS, React Native, KMP, background execution and battery |
 | `mobile-offline-sync` | Local store, outbox, idempotency, conflict resolution, reconnection | offline | Flutter, Android, iOS, React Native, KMP |
 | `mobile-observability` | Crashes, errors, breadcrumbs, traces, alerts, sampling and privacy | observability | Flutter, Android, iOS, React Native, KMP |
+| `mobile-privacy` | Consent lifecycle, SDK collection, account/data deletion and retention | privacy | Flutter, Android, iOS, React Native, KMP |
+| `mobile-networking` | API contracts, cancellation, pagination, refresh coordination and resumable transfers | networking | Flutter, Android, iOS, React Native, KMP |
+| `mobile-auth` | Sign-in, passkeys, recovery, provider linking and session transitions | auth | Flutter, Android, iOS, React Native, KMP |
+| `mobile-notifications` | Push/local notifications, token bindings, permissions and cold-start taps | notifications | Flutter, Android, iOS, React Native, KMP |
+| `mobile-billing` | In-app purchases, subscriptions, backend verification, acknowledgement and restore | billing | Flutter, Android, iOS, React Native, KMP |
+| `mobile-migration` | Toolchain and library upgrades, incremental UI moves and on-device data migrations | migration | Flutter, Android, iOS, React Native, KMP |
+| `mobile-analytics` | Tracking plans, typed events, funnels, analytics identity and consent-gated collection | analytics | Flutter, Android, iOS, React Native, KMP |
+| `mobile-hardware` | Camera, Bluetooth and BLE, NFC, location, sensors, scanning and haptics | hardware | Flutter, Android, iOS, React Native, KMP |
 | `mobile-firebase` | Firebase setup and 13 products | — | Flutter, Android, iOS, React Native, KMP; check installed SDK support |
 | `mobile-flutter` | Flutter and Dart specifics | review, performance, accessibility, migration | UI and navigation, data, native code, performance, accessibility and i18n, Dart, setup |
 | `mobile-android` | Native Android specifics, from the Android team | performance, release, migration, build, dependency | Compose UI, AGP 9 and R8, profiling, Google Play, identity, camera and media, on-device AI, Wear OS, TV, XR |
@@ -498,7 +505,23 @@ Every skill starts with `mobile-`. **Topic** skills cover every stack with one r
 | `mobile-kmp` | Kotlin Multiplatform shared and target boundaries | architecture, test, performance, review, debug and more | Source sets, Apple interop, shared Compose UI, build and profiling |
 | `mobile-detect-stack` | Deterministic stack detection with the CLI | — | — |
 
-Skills marked — are triggered by Claude Code when the request matches their description, for example *"add push notifications with FCM"* → `mobile-firebase`.
+Skills marked — are triggered by Claude Code when the request matches their description, for example *"configure Firestore rules"* → `mobile-firebase`. Notification requests route to `mobile-notifications`, which links Firebase guidance when FCM is the installed provider.
+
+The seven capability intents (`privacy`, `networking`, `auth`, `notifications`, `billing`, `analytics` and `hardware`) select `mobile-staff-engineer` and the matching topic skill; `mobile-migration` joins the existing `migration` route. Use these from your mobile app directory:
+
+```bash
+reis-mobile route "implement account deletion"
+reis-mobile route "implement resumable uploads"
+reis-mobile route "implement sign-in with passkeys"
+reis-mobile route "implement local notifications"
+reis-mobile route "add in-app purchases"
+reis-mobile route "create a tracking plan"
+reis-mobile route "connect to a Bluetooth device"
+reis-mobile route "migrate from BLoC to Riverpod"
+reis-mobile route --intent auth "review the session lifecycle"
+```
+
+The CLI returns the selected agent and instruction paths; it does not implement a login, delete an account, send a notification or make a purchase. An explicit intent takes precedence over the prompt. Existing security audits, tests and release work retain their own routes, and a plain "analytics" request still goes to `mobile-observability`. When a short prompt is ambiguous, pass `--intent` or invoke the skill directly in the host.
 
 About 85 guides come from [flutter/skills](https://github.com/flutter/skills), [dart-lang/skills](https://github.com/dart-lang/skills), [evanca/flutter-ai-rules](https://github.com/evanca/flutter-ai-rules) and [android/skills](https://github.com/android/skills), unchanged and credited in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
 
@@ -514,7 +537,7 @@ About 85 guides come from [flutter/skills](https://github.com/flutter/skills), [
 
 **Exception: external providers.** Two workflows, and only these two, send project context to a third party: `/reis-mobile:debate --external` and `/reis-mobile:consult`. Both state which providers receive it, and both are opt-in — no other command calls a provider. What leaves is the briefing, including the code excerpts you include; each provider has its own data policy. The question and every answer pass through `redact.mjs`, which is a protection layer and not a guarantee: read the briefing before sending it. API keys are read from the environment by the CLI and never enter the conversation, and `providers:` in `.reis-mobile/config.yaml` lets a team restrict which providers a repository allows. CLI providers (`codex`, `gemini-cli`) are asked for an opinion, not for work: they run in read-only mode (`codex exec --sandbox read-only`, `gemini --approval-mode plan`) inside a temporary directory, never in your repository.
 
-**Context cost.** Claude Code loads the descriptions of 21 agents and 17 skills; the full content of each skill is loaded only when it is used. The exact description cost depends on the host and plugin version.
+**Context cost.** Claude Code loads the descriptions of 21 agents and 26 skills; the full content of each skill is loaded only when it is used. The exact description cost depends on the host and plugin version.
 
 **One session hook.** On session startup or resume, the plugin checks for a newer release and warns only when the installed plugin is outdated. It does not read the project or modify the plugin installation.
 
@@ -544,7 +567,8 @@ About 85 guides come from [flutter/skills](https://github.com/flutter/skills), [
 | v0.7.3 | `/reis-mobile:release` with per-target evidence, required gates and deterministic readiness verdicts (previously planned for v0.8.0) | ✅ |
 | v0.8.0 | `mobile-performance`, `mobile-offline-sync` and `mobile-observability` topic skills with a reference per stack, plus background execution, OAuth/PKCE, billing lifecycle and localization references | ✅ |
 | v0.9.0 | Multi-provider layer (OpenAI, Gemini, OpenRouter, Ollama and the Codex/Gemini CLIs), `reis-mobile providers`, `reis-mobile consult` and `/reis-mobile:consult` — previously planned for v0.10.0 | ✅ |
-| v0.10.0 | MCP server | ⏳ |
+| v0.10.0 | `mobile-privacy`, `mobile-networking`, `mobile-auth` and `mobile-notifications` topic skills with a reference per stack, plus the `privacy`, `networking`, `auth` and `notifications` intents | ✅ |
+| v0.11.0 | MCP server | ⏳ |
 | v1.0.0 | First stable version: Flutter, Android, iOS and React Native | ⏳ |
 
 ---
@@ -576,7 +600,7 @@ The plugin's skills live in the `reis-mobile:` namespace and do not conflict, bu
 Yes: `reis-mobile init eng` installs the plugin in Codex too. See [installation](#install). Installation does not confirm parity with the Claude Code agents and commands; the `reis-mobile` CLI can also be run by Codex to get diagnostics and context.
 
 **Does it work in Cursor?**
-The Cursor integration has not been validated yet. The MCP server remains on the roadmap for v0.8.0.
+The Cursor integration has not been validated yet. The MCP server remains on the roadmap for v0.11.0.
 
 **What does reis-mobile send outside my machine?**
 The project analysis commands do not make network requests. The update hook and `reis-mobile update-check` request the public npm package metadata without sending project files or identifiers. What the model reads during `/reis-mobile:review` follows the same rules as any Claude Code session.
@@ -612,6 +636,7 @@ Questions: [Discussions](https://github.com/wrsilva/reis-mobile/discussions). Wh
 
 ## Attribution
 
+- **[greenstevester/fastlane-skill](https://github.com/greenstevester/fastlane-skill)** (MIT): five fastlane guides and Xcode Cloud documentation in [`mobile-ci`](skills/mobile-ci/SKILL.md). The source revision and license are recorded in [Third-Party Notices](THIRD_PARTY_NOTICES.md).
 - **[flutter/skills](https://github.com/flutter/skills)** (BSD-3-Clause): 25 Flutter skills.
 - **[dart-lang/skills](https://github.com/dart-lang/skills)** (BSD-3-Clause): 8 Dart skills.
 - **[evanca/flutter-ai-rules](https://github.com/evanca/flutter-ai-rules)** (MIT): 28 Flutter, testing and Firebase skills.

package/THIRD_PARTY_NOTICES.md

@@ -1,5 +1,38 @@
 # Third-Party Notices
 
+## greenstevester/fastlane-skill
+
+- Source: https://github.com/greenstevester/fastlane-skill
+- Revision: `cab4eff8e678391671916228d7b6446d438da4a9`
+- License: MIT
+- Integrated into `mobile-ci` as references; no standalone upstream skills are registered.
+- Adapted files under `skills/`: `setup-fastlane` → `mobile-ci/references/fastlane/setup-fastlane.md` and `mobile-ci/references/fastlane/xcode-cloud.md` (upstream `docs/xcode-cloud.md`); `match` → `mobile-ci/references/fastlane/match.md`; `beta` → `mobile-ci/references/fastlane/beta.md`; `release` → `mobile-ci/references/fastlane/release.md`; `snapshot` → `mobile-ci/references/fastlane/snapshot.md`.
+- Adaptation: removed skill frontmatter, added attribution and relocated the Xcode Cloud link. Original guide bodies are otherwise preserved; project-specific integration guidance lives in `mobile-ci/SKILL.md`.
+
+```text
+MIT License
+
+Copyright (c) 2024 greenstevester
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
 reis-mobile is distributed under the MIT License (see [LICENSE](LICENSE)). The skills listed below were derived from third-party projects and remain under their original licenses. Each of these skills declares `source` and `license` in its `SKILL.md` frontmatter.
 
 Changes made by reis-mobile: every third-party skill was moved into a reis-mobile skill (`mobile-test`, `mobile-firebase`, `mobile-code-review`, `mobile-debug`, `mobile-security`, `mobile-architecture`, `mobile-flutter`, `mobile-android`). Its instructions are unchanged apart from a leading attribution line and the removed frontmatter; skills that shipped extra files (references, scripts, examples) moved as whole folders with the instructions in `GUIDE.md`, so their relative links still work. Each section lists the upstream skill and the file that holds it now. Some copies correspond to earlier revisions of the upstream files.

package/agents/mobile-release-engineer.md

@@ -28,6 +28,8 @@ Use the [project brief](../docs/agent-context.md) once or reuse the supplied bri
 
 ## Scope and decision
 
+For pipeline implementation and fastlane automation, load [mobile-ci](../skills/mobile-ci/SKILL.md) and its relevant platform and task references.
+
 A release audit authorizes inspection and preparation. Version bumps, tags and publishing follow the user's requested scope; do not infer an upload from a readiness question. For an explicitly requested deployment, complete the reviewable preparation and reuse existing authorization. Avoid executing a lane before inspecting whether it publishes.
 
 Return the release identity, GO/GO WITH RISKS/NO-GO verdict where relevant, gates with evidence, exact prepared commands/artifacts and outstanding external state. Define rollout monitoring using the project's metrics and thresholds; proposed thresholds must be labeled as proposals. Never imply that halting store distribution removes a binary already installed.

package/agents/mobile-staff-engineer.md

@@ -1,10 +1,10 @@
 ---
 name: mobile-staff-engineer
-description: Use this agent for senior-level guidance across Flutter/Dart, Android (Kotlin) and iOS (Swift) — debugging complex build and runtime issues, architecture decisions for native apps, migrations, dependency and build problems, CI/CD and release pipelines, security and cross-platform trade-offs. Typical triggers are "the Android build broke after upgrading Gradle", planning a payment flow and choosing between native and cross-platform approaches.
+description: Use this agent for senior-level guidance across Flutter/Dart, Android (Kotlin) and iOS (Swift) — debugging complex build and runtime issues, architecture decisions for native apps, migrations, dependency and build problems, CI/CD and release pipelines, security, privacy, API integration, authentication, notifications, in-app purchases, product analytics, device hardware and cross-platform trade-offs. Typical triggers are "the Android build broke after upgrading Gradle", planning a payment flow and choosing between native and cross-platform approaches.
 model: inherit
 color: blue
 tools: ["Read", "Grep", "Glob", "Bash"]
-intents: [debug, architecture, performance, test, security, migration, dependency, build, offline, observability]
+intents: [debug, architecture, performance, test, security, migration, dependency, build, offline, observability, privacy, networking, auth, notifications, billing, analytics, hardware]
 stacks: ["*"]
 ---
 
@@ -14,6 +14,20 @@ Read the [project brief](../docs/agent-context.md) once or reuse the supplied br
 
 ## Build a causal chain
 
+For privacy work, load [mobile-privacy](../skills/mobile-privacy/SKILL.md). Follow its implementation and verification workflow using actual app objects; the failure record below applies when diagnosing a defect, not to every capability request.
+
+For API integration and network lifecycle work, load [mobile-networking](../skills/mobile-networking/SKILL.md) and bind its request/cancellation contract to the actual client and repository.
+
+For identity and session flows, load [mobile-auth](../skills/mobile-auth/SKILL.md) and trace the provider, session owner and account-scoped data boundaries.
+
+For push or local notification flows, load [mobile-notifications](../skills/mobile-notifications/SKILL.md) and trace token ownership, app lifecycle and authorized tap navigation.
+
+For in-app purchases and subscriptions, load [mobile-billing](../skills/mobile-billing/SKILL.md) and trace the purchase listener, backend verification and every entitlement read.
+
+For product analytics, load [mobile-analytics](../skills/mobile-analytics/SKILL.md) and trace each event from its trigger through the app's analytics boundary to the destination.
+
+For camera, Bluetooth, NFC, location, sensors or haptics, load [mobile-hardware](../skills/mobile-hardware/SKILL.md) and trace each capability from its availability check to the release of the resource.
+
 1. Recover the exact command, working directory, app root, variant/scheme and first actionable error. Locate the failure phase: resolution, generation, compilation, linking, signing, packaging, startup or runtime.
 2. Read the last relevant change and the versions actually selected by wrappers, lock files and CI. Compare local and CI toolchain evidence; a declared dependency constraint is not necessarily the resolved version.
 3. Trace the failing symbol/configuration from the error to its source file or build input. In cross-platform apps, distinguish Dart/JavaScript callers, generated integration code and native implementation. Identify the source of generated files before proposing an edit.
@@ -22,7 +36,7 @@ Read the [project brief](../docs/agent-context.md) once or reuse the supplied br
 
 ## Migrations need a compatibility contract
 
-Record the current and target toolchain/dependency versions from verified sources, minimum supported platforms, affected native modules and generated code. Split the migration into buildable steps with a check after each. Preserve the app's existing state, storage and public API contracts unless changing them is the objective.
+Load [mobile-migration](../skills/mobile-migration/SKILL.md) for the step plan, on-device data migrations and rollout. Record the current and target toolchain/dependency versions from verified sources, minimum supported platforms, affected native modules and generated code. Split the migration into buildable steps with a check after each. Preserve the app's existing state, storage and public API contracts unless changing them is the objective.
 
 Compare two viable options only when the choice matters. Name the actual module/type changed by each, operational cost, reversible step and condition that would invalidate the decision. Avoid broad prescriptions such as replacing the state library or upgrading every dependency to solve one failure.
 

package/core/router/intent-detector.mjs

@@ -1,4 +1,4 @@
-import { AREAS, DEBUG_DOMINATES, INTENTS, INTENT_IDS, STACK_HINTS } from './intents.mjs';
+import { AREAS, DEBUG_DOMINATES, INTENTS, INTENT_IDS, STACK_HINTS, WHOLE_WORDS } from './intents.mjs';
 
 export function normalize(text) {
   return String(text ?? '')
@@ -48,7 +48,8 @@ function matchTerms(text, groups) {
   const counts = new Map();
 
   for (const { id, word } of terms) {
-    const pattern = new RegExp(`(?<![\\p{L}\\p{N}])${escapeRegExp(word)}`, 'gu');
+    const wordEnd = WHOLE_WORDS.has(word) ? '(?![\\p{L}\\p{N}])' : '';
+    const pattern = new RegExp(`(?<![\\p{L}\\p{N}])${escapeRegExp(word)}${wordEnd}`, 'gu');
     for (const match of text.matchAll(pattern)) {
       const start = match.index;
       const end = start + word.length;

package/core/router/intents.mjs

@@ -11,7 +11,7 @@ export const INTENTS = {
   security: [
     'seguranca', 'security', 'vulnerab', 'owasp', 'secret', 'credencia', 'criptograf',
     'encrypt', 'ssl pinning', 'certificate pinning', 'jailbreak', 'root detection',
-    'keychain', 'secure storage', 'autentica',
+    'keychain', 'secure storage',
   ],
   performance: [
     'performance', 'desempenho', 'lento', 'lentidao', 'slow', 'jank', 'fps', 'memoria',
@@ -52,7 +52,7 @@ export const INTENTS = {
     'talkback', 'voiceover', 'contraste', 'semantics',
   ],
   review: [
-    'review', 'revis', 'code review', 'pull request', 'pr', 'analis', 'avali', 'audit',
+    'review', 'revis', 'code review', 'pull request', 'pr', 'prs', 'analis', 'avali', 'audit',
     'code smell',
   ],
   migration: ['migra', 'migrate', 'upgrade', 'null safety'],
@@ -67,10 +67,59 @@ export const INTENTS = {
     'deploy', 'pipeline', 'ci/cd', 'github actions', 'fastlane', 'codemagic', 'bitrise',
     'azure devops',
   ],
+  privacy: [
+    'privacy', 'privacidade', 'consent', 'consentimento', 'account deletion',
+    'delete account', 'exclusao de conta', 'excluir conta', 'data retention',
+    'retencao de dados', 'privacy manifest', 'data safety', 'analytics consent',
+  ],
+  networking: [
+    'networking', 'api integration', 'integracao de api', 'integrar api',
+    'http client', 'cliente http', 'pagination', 'paginacao', 'resumable upload',
+    'upload retomavel', 'websocket', 'request cancellation', 'cancelar requisic',
+  ],
+  auth: [
+    'authentication', 'autentica', 'passkey', 'sign-in', 'sign in', 'login',
+    'logout', 'oauth', 'oidc', 'pkce', 'session management', 'gestao de sessao',
+    'account linking', 'vincular conta', 'token refresh', 'renovacao de token',
+  ],
+  notifications: [
+    'push notification', 'local notification', 'notification permission',
+    'notification channel', 'notification tap', 'notifica', 'fcm', 'apns',
+  ],
+  // "assinatura", "subscription" and "entitlement" alone also mean code signing, a stream
+  // subscription and an iOS signing entitlement, so only specific phrases route here.
+  billing: [
+    'billing', 'cobranca', 'in-app purchase', 'in app purchase', 'compra no app',
+    'compras no app', 'compra dentro do app', 'compras dentro do app', 'compra in-app',
+    'compras in-app', 'subscription purchase', 'in-app subscription', 'auto-renewable',
+    'assinatura no app', 'assinaturas no app', 'assinatura recorrente', 'paywall', 'storekit',
+    'play billing', 'restore purchase', 'restaurar compra', 'revenuecat',
+  ],
+  // Plain "analytics" stays with observability; these longer phrases claim their span first.
+  analytics: [
+    'product analytics', 'analytics de produto', 'tracking plan', 'plano de tracking',
+    'plano de rastreamento', 'event tracking', 'rastreamento de eventos', 'event taxonomy',
+    'taxonomia de eventos', 'analytics event', 'evento de analytics', 'eventos de analytics',
+    'funnel', 'funil', 'conversion event', 'evento de conversao', 'user properties',
+    'propriedades de usuario', 'mixpanel', 'posthog', 'amplitude analytics', 'amplitude sdk',
+  ],
+  // "localizacao" alone also means translation, so location uses specific phrases; "ble" is a
+  // whole word (see WHOLE_WORDS). Biometrics belongs to auth and security.
+  hardware: [
+    'hardware', 'bluetooth', 'ble', 'nfc', 'camera', 'microphone', 'microfone', 'sensor',
+    'accelerometer', 'acelerometro', 'gyroscope', 'giroscopio', 'gps', 'geolocation',
+    'geolocaliza', 'geofenc', 'background location', 'localizacao em segundo plano',
+    'location updates', 'atualizacoes de localizacao', 'barcode', 'codigo de barras', 'qr code',
+    'codigo qr', 'haptic', 'vibration', 'vibracao', 'usb',
+  ],
 };
 
 export const INTENT_IDS = Object.keys(INTENTS);
 
+// Terms matched as whole words instead of stems: as stems, "pr" would also claim "premium",
+// "product" and "preço", and "ble" would claim "blend".
+export const WHOLE_WORDS = new Set(['pr', 'prs', 'ble']);
+
 // A failing build or pipeline is a debugging task, not a build/deploy task.
 export const DEBUG_DOMINATES = new Set(['build', 'deployment', 'dependency', 'migration']);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "reis-mobile",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "AI agents and skills for Flutter, Android, iOS, React Native and Kotlin Multiplatform — a Claude Code and Codex plugin for reviews, debugging, tests, architecture, security and Firebase.",
   "type": "module",
   "license": "MIT",

package/skills/mobile-analytics/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: mobile-analytics
+description: Designs and reviews product analytics across Flutter, Android, iOS, React Native and Kotlin Multiplatform. Use for tracking plans, event names and properties, funnels and conversion events, screen tracking, analytics identity across sign-in and sign-out, consent-gated collection and validating events before release. Crash, error and performance telemetry belong to mobile-observability.
+intents: [analytics]
+stacks: ["*"]
+---
+
+# Mobile Analytics
+
+An analytics event is a contract with whoever reads the dashboard. Trace each event from the user action to the destination and to the question it answers. Reuse the [project brief](../../docs/agent-context.md), then inspect the SDK initialization, the existing event calls, the tracking plan if one exists and the owner of consent state before adding events.
+
+## Pick the reference
+
+| Project | Read |
+|---|---|
+| Flutter | [references/flutter.md](references/flutter.md) |
+| Android | [references/android.md](references/android.md) |
+| iOS | [references/ios.md](references/ios.md) |
+| React Native / Expo | [references/react-native.md](references/react-native.md) |
+| Kotlin Multiplatform | [references/kotlin-multiplatform.md](references/kotlin-multiplatform.md) |
+
+Cross-platform apps also need the native references: SDKs often collect automatically before Dart or JavaScript runs. Confirm the SDK and its version from the lock file.
+
+## Write the tracking plan first
+
+For each event record the name, the exact trigger, the properties with their types and allowed values, the owner and the product question it answers. "Order completed" fires after the server confirms the order, not when the button is tapped. Follow the naming already in the plan or the SDK's conventions, and check the destination's documented limits for names, property counts and value lengths. An event nobody reads costs battery, data and privacy review; remove it from the plan.
+
+## Emit through one boundary
+
+- Send every event through one app-owned analytics interface with typed events. SDK calls scattered across screens cannot be gated by consent, tested or moved to another vendor.
+- Fire each event once, on the confirmed outcome. Rebuilds, recomposition, re-renders, retries, back navigation and app resume must not duplicate it.
+- Track screen views from the navigation owner, not from build or render code.
+- Attach no direct personal data: no email, phone number, name or free text the user typed. Identify users with a stable internal id, never with an email.
+
+## Identity and consent
+
+- Before sign-in, events belong to the SDK's anonymous id. On sign-in, set the internal user id. On sign-out or an account switch, reset the analytics identity so the next user's events are not attributed to the previous one.
+- Collection follows the consent state owned by [mobile-privacy](../mobile-privacy/SKILL.md). Start with collection disabled where the SDK supports it until consent is known, and stop sending on withdrawal.
+- Whether a use counts as tracking under Apple's rules, and what the store data disclosures must declare, depends on the data and its recipients. Check the declarations against the actual collection.
+
+## Delivery and trust
+
+SDKs batch and upload events, so events can arrive late, offline events can be dropped by the SDK's limits and events in flight can be lost when the process dies. Do not use client analytics as the source of truth for revenue or business records: purchase revenue comes from the backend and store notifications through [mobile-billing](../mobile-billing/SKILL.md).
+
+## Verify and deliver
+
+Unit-test that a flow produces the expected typed events through a fake analytics implementation, including no events before consent, one event per confirmed outcome and an identity reset on sign-out. Then use the destination's debug or live event view with a debug build to confirm names and properties arrive as planned.
+
+Return the tracking plan changes, `path:symbol` for each emission, test results and any dashboard or destination configuration you could not verify. Use [mobile-observability](../mobile-observability/SKILL.md) for crashes, errors and performance signals and [mobile-firebase](../mobile-firebase/SKILL.md) for Firebase Analytics setup.
+
+## Official sources
+
+- [Firebase Analytics events](https://firebase.google.com/docs/analytics/events)
+- [Apple user privacy and data use](https://developer.apple.com/app-store/user-privacy-and-data-use/)
+- [Google Play Data safety](https://support.google.com/googleplay/android-developer/answer/10787469)

package/skills/mobile-analytics/references/android.md

@@ -0,0 +1,9 @@
+# Analytics on Android
+
+- Read the SDK from the version catalog or Gradle files and inspect what it collects automatically at startup; a consent switch in the UI cannot stop an initializer that already ran. When collection must wait for consent, disable automatic collection in the manifest as the [data collection guide](https://firebase.google.com/docs/analytics/configure-data-collection?platform=android) describes for Firebase, and enable it after consent.
+- In Compose, do not log from a composable body: recomposition repeats it. Log screen views from navigation callbacks such as `NavController.addOnDestinationChangedListener`, and one-time events from the ViewModel after the outcome is confirmed.
+- Firebase consent, screen views and DebugView setup are in the [Firebase Analytics reference](../../mobile-firebase/references/android/analytics.md).
+- Reset the analytics identity in the sign-out flow, before the next account's events start.
+- Test the ViewModel or use case with a fake analytics interface, and confirm delivery in the destination's debug view with a debug build.
+
+Official reference: [Firebase Analytics events](https://firebase.google.com/docs/analytics/events?platform=android).

package/skills/mobile-analytics/references/flutter.md

@@ -0,0 +1,10 @@
+# Analytics in Flutter
+
+- Confirm the SDK in `pubspec.lock` and the native SDK it wraps. Native code can collect automatic events before `runApp`, so disable that natively when collection must wait for consent. For Firebase, use the [Firebase Analytics reference](../../mobile-firebase/references/flutter/analytics.md) and the native switches in [Android](android.md) and [iOS](ios.md).
+- Keep one Dart analytics interface with typed events, injected where the state owners can reach it. Do not call the SDK from `build()`: rebuilds repeat it.
+- Track screen views with a navigator observer on the app's router (`FirebaseAnalyticsObserver` for Firebase) or from the router's route-change callback.
+- Fire conversion events from the state owner after the repository confirms the outcome, not from the button callback.
+- On sign-out, reset the SDK identity in the same flow that clears account data.
+- Test with a fake analytics implementation in unit and widget tests, and confirm delivery on device builds.
+
+Official reference: [FirebaseAnalyticsObserver](https://pub.dev/documentation/firebase_analytics/latest/observer/FirebaseAnalyticsObserver-class.html).

package/skills/mobile-analytics/references/ios.md

@@ -0,0 +1,9 @@
+# Analytics on iOS
+
+- Inventory the SDKs linked into the app and its extensions, what they collect at launch and what their privacy manifests declare. When Firebase collection must wait for consent, set `FIREBASE_ANALYTICS_COLLECTION_ENABLED` to `NO` in `Info.plist` and call `Analytics.setAnalyticsCollectionEnabled(true)` after consent.
+- In SwiftUI, `.onAppear` runs again on tab switches and back navigation. Decide what a screen view means and log it from the navigation owner or with the SDK's screen modifier, not from `body`.
+- Keep App Tracking Transparency separate from analytics consent: request ATT only when the data use is tracking, and never infer one from the other.
+- Firebase consent, screen views and DebugView are in the [Firebase Analytics reference](../../mobile-firebase/references/ios/analytics.md).
+- Reset the analytics identity during sign-out. Test event emission with a fake analytics protocol, and confirm delivery with the destination's debug view.
+
+Official references: [configure data collection](https://firebase.google.com/docs/analytics/configure-data-collection?platform=ios), [user privacy and data use](https://developer.apple.com/app-store/user-privacy-and-data-use/).

package/skills/mobile-analytics/references/kotlin-multiplatform.md

@@ -0,0 +1,8 @@
+# Analytics in Kotlin Multiplatform
+
+- Define the typed events and the analytics interface in `commonMain`, and implement it per host with the native SDK unless the project already uses a multiplatform SDK.
+- Keep consent and identity transitions in shared code when the project shares them, but leave automatic collection settings and SDK startup in each host: a `commonMain` flag does not stop a collector the host initialized first.
+- Emit events from shared state owners after the outcome is confirmed, and map them to each SDK's names in one place.
+- Test event emission in `commonTest` with a fake implementation. Verify each host's SDK delivery separately with [Android](android.md) and [iOS](ios.md).
+
+Official reference: [platform-specific declarations](https://kotlinlang.org/docs/multiplatform/multiplatform-expect-actual.html).

package/skills/mobile-analytics/references/react-native.md

@@ -0,0 +1,9 @@
+# Analytics in React Native and Expo
+
+- Confirm the SDK in `package.json` and the native SDK it wraps. Native code can collect before the JavaScript bundle runs: configure collection defaults natively, through a config plugin or the native files, instead of in a `useEffect`.
+- Track screen views from the navigation container: with React Navigation, compare routes in `onStateChange` through a navigation ref; with Expo Router, react to `usePathname` changes.
+- Fire conversion events after the mutation resolves, not on press. React Strict Mode runs effects twice in development, so emit from the handler of the confirmed outcome rather than from a mount effect.
+- Firebase screen views, consent flags and DebugView are in the [Firebase Analytics reference](../../mobile-firebase/references/react-native/analytics.md).
+- Reset the analytics identity in the sign-out flow. Test the boundary in Jest with the SDK mocked, and confirm delivery on native builds.
+
+Official references: [React Navigation screen tracking](https://reactnavigation.org/docs/screen-tracking/), [Expo Router screen tracking](https://docs.expo.dev/router/reference/screen-tracking/). Apply the [Android](android.md) and [iOS](ios.md) references to native collection settings.

package/skills/mobile-auth/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: mobile-auth
+description: Implements and reviews mobile identity and session flows across Flutter, Android, iOS, React Native and Kotlin Multiplatform. Use for sign-in, passkeys, account recovery, provider linking, reauthentication, logout and concurrent refresh. Security audits belong to mobile-security; account deletion belongs to mobile-privacy.
+intents: [auth]
+stacks: ["*"]
+---
+
+# Mobile Authentication
+
+Use the [project brief](../../docs/agent-context.md) to find the provider SDK/configuration, session owner, credential store, redirect handlers and account-scoped repositories. Preserve the chosen provider and the requested audit/implementation scope. Read installed versions and the provider's actual backend contract before selecting APIs.
+
+## Pick the reference
+
+| Project | Read |
+|---|---|
+| Flutter | [references/flutter.md](references/flutter.md) |
+| Android | [references/android.md](references/android.md) |
+| iOS | [references/ios.md](references/ios.md) |
+| React Native / Expo | [references/react-native.md](references/react-native.md) |
+| Kotlin Multiplatform | [references/kotlin-multiplatform.md](references/kotlin-multiplatform.md) |
+
+## Define identity and session transitions
+
+- Separate provider identity, backend account, session credentials and local unlock. Biometric approval alone is not server authentication.
+- Model restoring, signed out, authenticating, signed in, reauthentication required and signing out as needed by the real flow. Temporary offline restoration is distinct from proven invalid credentials.
+- Give each attempt a correlation identifier and cancellation owner. A cancelled sign-in or reauthentication preserves any existing valid session; it cannot silently replace it with a partially authenticated account.
+- Complete account switching by invalidating old jobs, caches and notification bindings before exposing the new account's data. Fence late callbacks with account/session generation.
+
+## Choose the provider-supported ceremony
+
+- For OAuth/OIDC native login, use a maintained provider/library implementation of Authorization Code with PKCE through the system authentication browser. Keep client secrets off the app; verify redirect association and response binding using the SDK's documented protections.
+- For passkeys, the backend issues challenges and verifies registration/authentication responses, relying-party identity and replay protections. Native credential APIs alone do not prove identity to your backend. Define recovery for unavailable credentials without weakening authentication.
+- Link providers only after proving control according to the provider contract; matching email strings is not sufficient authority to merge accounts. Define collisions, cancellation and recovery before altering account ownership.
+- Treat sensitive actions as backend-authorized operations with the required fresh authentication. Do not bypass reauthentication by changing a UI flag.
+
+## Refresh, logout and recovery
+
+- Use the provider SDK's session management if it already owns refresh. Otherwise coalesce refresh work per session; every waiter receives success, cancellation or failure, and retries have a bound.
+- Before saving a refresh result, check that the session is still current. Logout/account switch must make an old result inert, including its queued request replays.
+- Apply the provider's supported refresh-token protection. OAuth security guidance supports rotation or sender-constrained refresh tokens for public clients; do not invent a rotation endpoint or override SDK behavior.
+- On logout, invalidate local access and clear scoped state. Track remote revocation separately when supported; if offline, report that it was not confirmed and use the provider's documented recovery strategy. Browser SSO logout and app logout are different operations.
+- Recovery, MFA and linking error messages follow the actual identity provider and product requirements. Avoid exposing whether another account exists through custom recovery behavior.
+
+## Verify and deliver
+
+Test cancelled login, malformed/replayed callback, process recreation during login, concurrent refresh, offline restoration, logout during refresh, account switching, unavailable passkey, linking collision and cancelled reauthentication. Exercise provider integration in its test environment; keep tokens and personal data out of fixtures/logs.
+
+Return a transition table tied to real symbols, provider/backend boundaries, storage and redirect changes, test results and remaining configuration evidence. Use [mobile-security](../mobile-security/SKILL.md) for threat review and secure storage, [mobile-firebase](../mobile-firebase/SKILL.md) for Firebase Auth APIs, and [mobile-privacy](../mobile-privacy/SKILL.md) for deletion.
+
+## Official sources
+
+- [OAuth for native apps, RFC 8252](https://www.rfc-editor.org/rfc/rfc8252.html)
+- [OAuth security best current practice, RFC 9700](https://www.rfc-editor.org/rfc/rfc9700.html)
+- [Android Credential Manager](https://developer.android.com/identity/credential-manager)
+- [Apple AuthenticationServices](https://developer.apple.com/documentation/authenticationservices)