umpordez 1.4.0 → 1.5.1

package/.claude/settings.local.json

@@ -54,7 +54,16 @@
       "Bash(tar -xzf expo-57.0.4.tgz package/bundledNativeModules.json package/package.json)",
       "Bash(npx expo-doctor *)",
       "Bash(pkill -f \"expo start --port 8090\")",
-      "Bash(git *)"
+      "Bash(git *)",
+      "Bash(npm init *)",
+      "Bash(awk 'NR>=383 && NR<=386 {print NR\": \"substr\\($0,1,120\\)}' '/Users/ligeiro/dev/umpordez-cli/template/mobile/{{PROJECT_SLUG}}/src/pages/auth/AuthLanding.tsx')",
+      "Bash(awk 'NR>=394 && NR<=410 {print NR\": \"substr\\($0,1,100\\)}' '/Users/ligeiro/dev/umpordez-cli/template/mobile/{{PROJECT_SLUG}}/src/pages/auth/AuthLanding.tsx')",
+      "Bash(diskutil info *)",
+      "Bash(mount)",
+      "Bash(bash -n template/scripts/clean-appledouble.sh)",
+      "Bash(bash -n template/scripts/prebuild.sh)",
+      "Bash(bash -n template/scripts/run-ios.sh)",
+      "Bash(bash -n template/install.sh)"
     ]
   }
 }

package/create.mjs

@@ -146,6 +146,7 @@ async function promptComponents() {
     // profile.
     let authApple = true;
     let authGoogle = true;
+    let iap = true;
     if (mobile) {
         ({ authApple } = await inquirer.prompt([{
             type: 'confirm',
@@ -161,9 +162,19 @@ async function promptComponents() {
                 + 'OAuth flow)',
             default: true,
         }]));
+        // Disabling IAP strips the expo-iap dependency, its config
+        // plugin and the Android BILLING permission — PremiumGate
+        // then renders everything unlocked (a fully free app).
+        ({ iap } = await inquirer.prompt([{
+            type: 'confirm',
+            name: 'iap',
+            message: 'In-app purchases? (premium subscriptions via '
+                + 'expo-iap + server receipt validation)',
+            default: true,
+        }]));
     }
 
-    return { components, appLanding, authApple, authGoogle };
+    return { components, appLanding, authApple, authGoogle, iap };
 }
 
 async function promptProjectDetails() {
@@ -172,7 +183,7 @@ async function promptProjectDetails() {
     console.log('');
 
     const {
-        components, appLanding, authApple, authGoogle
+        components, appLanding, authApple, authGoogle, iap
     } = await promptComponents();
     const preset = presetNameForComponents(components);
 
@@ -355,6 +366,7 @@ async function promptProjectDetails() {
         appLanding,
         authApple,
         authGoogle,
+        iap,
         name: name.trim(),
         // Defaults for the parts the user didn't see — they're still
         // referenced by replacements (some unconditionally), so we fill
@@ -382,6 +394,104 @@ function validatePort(v) {
         : 'Must be a valid port number';
 }
 
+// Filesystems that can't store extended attributes or symlinks. On
+// macOS these make the OS scatter AppleDouble `._*` sidecar files next
+// to everything npm installs — CocoaPods then fails parsing a
+// `._Foo.podspec` during `expo prebuild`, and node_modules symlinks
+// break. Generating an Expo project on one of these is a trap, so we
+// warn before doing it.
+const NON_NATIVE_FS = new Set([
+    'exfat', 'msdos', 'fat32', 'vfat',
+    'ntfs', 'ntfs-3g', 'fuseblk',
+    'smbfs', 'cifs', 'nfs', 'afpfs', 'webdav',
+]);
+
+// Resolve the filesystem type backing `targetPath`. The output dir
+// usually doesn't exist yet, so we walk up to the nearest existing
+// ancestor, then match it against the longest mount point in `mount`.
+// Returns { mountPoint, fsType } or null (non-darwin, or undetectable).
+function volumeInfo(targetPath) {
+    if (process.platform !== 'darwin') {
+        return null;
+    }
+
+    let dir = path.resolve(targetPath);
+    while (dir !== path.dirname(dir) && !fs.existsSync(dir)) {
+        dir = path.dirname(dir);
+    }
+
+    let mounts;
+    try {
+        mounts = execSync('mount', { encoding: 'utf-8' });
+    } catch {
+        return null;
+    }
+
+    // Lines look like: `/dev/disk10s1 on /Volumes/big (exfat, local, …)`
+    let best = null;
+    for (const line of mounts.split('\n')) {
+        const m = line.match(/ on (.+?) \(([^,)]+)/);
+        if (!m) {
+            continue;
+        }
+        const mountPoint = m[1];
+        const fsType = m[2].trim().toLowerCase();
+        const prefix = mountPoint.endsWith('/') ? mountPoint : mountPoint + '/';
+        if (dir === mountPoint || dir.startsWith(prefix)) {
+            if (!best || mountPoint.length > best.mountPoint.length) {
+                best = { mountPoint, fsType };
+            }
+        }
+    }
+    return best;
+}
+
+// Warn (and confirm) before generating a mobile project onto a
+// filesystem macOS can't build native code on. Returns true to
+// proceed, false to abort. Only meaningful when a mobile app is part
+// of the project — the acute failure is CocoaPods + `expo prebuild`.
+async function confirmFilesystem(outputDir, components) {
+    if (!components.mobile) {
+        return true;
+    }
+    const vol = volumeInfo(outputDir);
+    if (!vol || !NON_NATIVE_FS.has(vol.fsType)) {
+        return true;
+    }
+
+    console.log('');
+    console.log(red.bold(
+        `  ⚠  ${vol.mountPoint} is a ${vol.fsType} volume.`
+    ));
+    console.log(dim(
+        '     macOS can\'t store extended attributes or symlinks there,'
+    ));
+    console.log(dim(
+        '     so it scatters AppleDouble `._*` files next to everything'
+    ));
+    console.log(dim(
+        '     npm installs. `expo prebuild` then fails when CocoaPods'
+    ));
+    console.log(dim(
+        '     tries to parse a `._Foo.podspec`, and node_modules'
+    ));
+    console.log(dim('     symlinks break.'));
+    console.log('');
+    console.log(dim(
+        '     Recommended: generate on your internal drive (e.g. ~/dev),'
+    ));
+    console.log(dim('     an APFS / Mac OS Extended volume.'));
+    console.log('');
+
+    const { proceed } = await inquirer.prompt([{
+        type: 'confirm',
+        name: 'proceed',
+        message: `Generate on the ${vol.fsType} volume anyway?`,
+        default: false,
+    }]);
+    return proceed;
+}
+
 function componentsLabel(c) {
     const parts = [];
     if (c.server)  parts.push('server API');
@@ -432,6 +542,9 @@ function showSummary(details) {
         if (details.authApple)  providers.push('Apple');
         if (details.authGoogle) providers.push('Google');
         console.log(`  ${chalk.bold('Sign-in:')}      ${providers.join(' | ')}`);
+        console.log(`  ${chalk.bold('IAP:')}          ${details.iap
+            ? 'premium subscriptions (expo-iap)'
+            : 'none (all features unlocked)'}`);
     }
     console.log('');
     console.log(dim('  Generates:'));
@@ -589,6 +702,11 @@ export async function createProject() {
 
     const outputDir = path.resolve(details.outputDir);
 
+    if (!await confirmFilesystem(outputDir, details.components)) {
+        console.log(chalk.yellow('Aborted. No files were created.'));
+        return;
+    }
+
     if (fs.existsSync(outputDir)) {
         const { overwrite } = await inquirer.prompt([{
             type: 'confirm',
@@ -695,6 +813,7 @@ export async function createProject() {
     if (details.components.mobile) {
         scripts.push(
             'scripts/bump-version.sh',
+            'scripts/clean-appledouble.sh',
             'scripts/prebuild.sh',
             'scripts/run-ios.sh',
             'scripts/release-android.sh',

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "umpordez",
     "type": "module",
-    "version": "1.4.0",
+    "version": "1.5.1",
     "description": "SaaS starter kit generator — server, admin SPA, public site (i18n), mobile app (offline-first, IAP, native push)",
     "main": "cli.mjs",
     "scripts": {

package/template/AGENTS.md

@@ -312,7 +312,7 @@ if (!ok) return;
 - **Services own data access** — pages never call `getDb()` directly
 - **User-scoped writes check `demandSigned()`** — reads always work, writes no-op when gate closed
 - Every string through `t()` — no bare text in JSX
-- NitroModules crash in Expo Go — lazy-load with `try/require`
+- Native-module crash in Expo Go (e.g. `expo-iap`) — lazy-load with `try/require`
 - Never `expo prebuild --clean` (wipes native code; use `scripts/prebuild.sh`)
 
 ### i18n Coverage

package/template/CLAUDE.md

@@ -97,7 +97,7 @@ HTTP request builds a fresh `Context` with every model instantiated
 | 1 | auth flows, theme, navigation, splash, toasts, typed fetch |
 | 2 | offline SQLite (USER vs SHARED tables), cloud backup/restore |
 | 3 | server-driven content sync + HMAC-signed presigned asset URLs |
-| 4 | IAP via `react-native-iap`, premium gate, foreground re-check |
+| 4 | IAP via `expo-iap` (optional at scaffold), premium gate, foreground re-check |
 | 5 | custom-native local notifications with cold-start tap dispatch |
 | 6 | Apple Health + Android Health Connect unified surface |
 | 7 | native cookbook (Hello iOS/Android + Live Activity scaffold) |

package/template/README.md

@@ -112,7 +112,7 @@ HTTP request builds a fresh `Context` with every model instantiated
 | 1 | auth flows, theme, navigation, splash, toasts, typed fetch |
 | 2 | offline SQLite (USER vs SHARED tables), cloud backup/restore via S3 |
 | 3 | server-driven content sync + HMAC-signed presigned asset URLs |
-| 4 | IAP (`react-native-iap`), receipt validation, premium gate, foreground re-check |
+| 4 | IAP (`expo-iap`, optional at scaffold), receipt validation, premium gate, foreground re-check |
 | 5 | custom-native local notifications with cold-start tap dispatch |
 | 6 | Apple Health + Android Health Connect unified surface |
 | 7 | native modules cookbook (Hello iOS/Android + Live Activity scaffold + gotchas) |

package/template/doc/index.html

@@ -514,8 +514,11 @@ POST /api/logout</code></pre>
         <section id="iap">
             <h2>IAP &amp; premium <span class="badge">Phase 4</span></h2>
             <p>
-                <code>react-native-iap</code> v15 lazy-loaded with
-                try/require so Expo Go gets graceful no-ops.
+                <code>expo-iap</code> lazy-loaded with try/require so
+                Expo Go gets graceful no-ops. Optional at scaffold
+                time &mdash; when disabled, the dependency ships
+                stripped and PremiumGate renders everything
+                unlocked.
             </p>
             <pre><code>const { activatePremium } = useAuth();
 const purchase = await purchaseSubscription(PRODUCT_IDS.annual);

package/template/gitignore

@@ -5,6 +5,8 @@ build/
 dist/
 *.log
 .DS_Store
+._*
+.AppleDouble
 *.swp
 *.swo
 *~

package/template/install.sh

@@ -55,6 +55,10 @@ if [ -d "mobile/{{PROJECT_SLUG}}" ]; then
 
         if [[ "$(uname)" == "Darwin" ]]; then
             if [ -d "mobile/{{PROJECT_SLUG}}/ios" ]; then
+                # Strip AppleDouble `._*` files (exFAT/NTFS/network
+                # volumes) so pod install doesn't choke on a
+                # `._Foo.podspec`. No-op on APFS.
+                ./scripts/clean-appledouble.sh "mobile/{{PROJECT_SLUG}}"
                 echo "Installing iOS pods..."
                 (cd "mobile/{{PROJECT_SLUG}}/ios" && pod install)
             fi

package/template/mobile/{{PROJECT_SLUG}}/CLAUDE.md

@@ -25,7 +25,7 @@ src/
 │   ├── db/                    SQLite (USER_TABLES vs SHARED_TABLES)
 │   ├── backup/                Two-phase S3 backup (premium)
 │   ├── content/               Versioned catalog + HMAC-signed URLs
-│   ├── iap/                   react-native-iap wrapped lazily
+│   ├── iap/                   expo-iap wrapped lazily (optional)
 │   └── notifications/         Custom-native, cold-start tap dispatch
 └── components/
     ├── AnimatedSplash.tsx
@@ -86,9 +86,12 @@ hasCompletedOnboarding
 - **Every user-facing string goes through `t()`.** Even pt-BR
   default strings. No bare strings in JSX.
 
-- **NitroModules + Expo Go = crash on import.** Anything using
-  nitro (e.g. `react-native-iap` v15) must be lazy-loaded with
-  `try/require`. See `services/iap/index.ts`.
+- **Native modules + Expo Go = crash on import.** Anything whose
+  native side isn't bundled in Expo Go (e.g. `expo-iap`) must be
+  lazy-loaded with `try/require`. See `services/iap/index.ts`.
+  IAP itself is optional at scaffold time: `config.iap === false`
+  means the expo-iap dependency was never installed and PremiumGate
+  renders everything unlocked.
 
 - **`expo prebuild --clean` will silently delete native code.**
   Use `./scripts/prebuild.sh` (refuses --clean). To genuinely

package/template/mobile/{{PROJECT_SLUG}}/app.json

@@ -22,8 +22,7 @@
                 "backgroundColor": "{{PRIMARY_COLOR}}"
             },
             "permissions": [
-                "android.permission.INTERNET",
-                "com.android.vending.BILLING"
+                "android.permission.INTERNET"{{IAP_BILLING_PERMISSION_JSON}}
             ]
         },
         "web": {
@@ -51,8 +50,7 @@
                 }
             ],
             "expo-web-browser",{{APPLE_AUTH_PLUGIN_JSON}}
-            "expo-sqlite",
-            "react-native-iap"
+            "expo-sqlite"{{IAP_PLUGIN_JSON}}
         ],
         "extra": {
             "eas": {

package/template/mobile/{{PROJECT_SLUG}}/eslint.config.js

@@ -11,7 +11,18 @@ export default [
         rules: {
             "@stylistic/indent": ["error", 4],
             "@stylistic/semi": ["error", "always"],
-            "@stylistic/max-len": ["error", { "code": 80 }],
+            // ignorePattern: SVG path data (brand icons) can't be
+            // wrapped without corrupting the artwork.
+            "@stylistic/max-len": ["error", {
+                "code": 80,
+                "ignorePattern": "\\sd=\""
+            }],
+            // Underscore prefix = intentionally unused (e.g. a screen
+            // that takes navigation props but doesn't read them yet).
+            "@typescript-eslint/no-unused-vars": ["error", {
+                "argsIgnorePattern": "^_",
+                "varsIgnorePattern": "^_"
+            }],
             "curly": ["error", "all"]
         }
     }

package/template/mobile/{{PROJECT_SLUG}}/native/README.md

@@ -89,9 +89,9 @@ these are auto-installed** — copy out what you need:
   `scripts/prebuild.sh` refuses `--clean`. To genuinely reset, move
   customizations into config plugins under `./plugins/` first.
 
-- **NitroModules + Expo Go = crash on import.** Anything using nitro
-  (e.g. react-native-iap v15) needs to be lazy-loaded with
-  `try/require` so Expo Go doesn't blow up. See
+- **Native modules + Expo Go = crash on import.** Anything whose
+  native side isn't in Expo Go (e.g. expo-iap) needs to be
+  lazy-loaded with `try/require` so Expo Go doesn't blow up. See
   `src/services/iap/index.ts` for the pattern.
 
 - **iOS HealthKit needs an entitlement.** It's wired in `app.json`

package/template/mobile/{{PROJECT_SLUG}}/package.json

@@ -28,7 +28,7 @@
         "expo-auth-session": "~57.0.2",
         "expo-build-properties": "~57.0.3",
         "expo-constants": "~57.0.3",
-        "expo-file-system": "~57.0.0",
+        "expo-file-system": "~57.0.0",{{IAP_DEP_JSON}}
         "expo-linking": "~57.0.2",
         "expo-localization": "~57.0.0",
         "expo-splash-screen": "~57.0.2",
@@ -42,8 +42,6 @@
         "react-native": "0.86.0",
         "react-i18next": "^15.1.1",
         "react-native-gesture-handler": "~2.32.0",
-        "react-native-iap": "^15.3.6",
-        "react-native-nitro-modules": "^0.35.4",
         "react-native-reanimated": "4.5.0",
         "react-native-safe-area-context": "~5.7.0",
         "react-native-screens": "4.25.2",

package/template/mobile/{{PROJECT_SLUG}}/src/components/AnimatedSplash.tsx

@@ -25,6 +25,10 @@ const { width, height } = Dimensions.get('window');
 const BG = DARK.bg;
 const GLOW_COLOR = DARK.primary;
 
+// Static asset — require() is the RN idiom for bundled images.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const SPLASH_ICON = require('../../assets/splash-icon.png');
+
 // Glow + ring sit at screen-centre because our generated splash-icon
 // is a trimmed glyph composited onto a transparent square canvas (see
 // icons.mjs renderFromScratch — splash mode). With resizeMode:contain
@@ -177,7 +181,7 @@ export default function AnimatedSplash({ onDone }: Props) {
             />
 
             <Animated.Image
-                source={require('../../assets/splash-icon.png')}
+                source={SPLASH_ICON}
                 style={[
                     s.splash,
                     { opacity: logoOp, transform: [{ scale: logoSc }] }

package/template/mobile/{{PROJECT_SLUG}}/src/components/PremiumGate.tsx

@@ -7,6 +7,7 @@ import {
 } from 'react-native';
 import { Lock } from 'lucide-react-native';
 import { useTranslation } from 'react-i18next';
+import config from '../config';
 import { useAuth } from '../contexts/AuthContext';
 import { useTheme } from '../contexts/ThemeContext';
 
@@ -39,7 +40,9 @@ export default function PremiumGate({
     const finalDescription =
         description ?? t('premiumGate.defaultDescription');
 
-    if (user?.is_premium) {
+    // Projects scaffolded without in-app purchases have nothing to
+    // sell — every feature renders unlocked.
+    if (!config.iap || user?.is_premium) {
         return <>{children}</>;
     }
 

package/template/mobile/{{PROJECT_SLUG}}/src/config.ts

@@ -56,6 +56,15 @@ export const SPLASH_ANIMATED = {{SPLASH_ANIMATED}};
 const GOOGLE_AUTH_ENABLED = {{AUTH_GOOGLE_ENABLED}};
 const APPLE_AUTH_ENABLED = {{AUTH_APPLE_ENABLED}};
 
+// In-app purchases, chosen at scaffold time via `umpordez create`.
+// When disabled the expo-iap dependency, config plugin and Android
+// BILLING permission were stripped from the scaffold — PremiumGate
+// renders its children unlocked and the iap service no-ops. To turn
+// IAP on later: `npx expo install expo-iap`, add "expo-iap" to
+// app.json plugins, re-add com.android.vending.BILLING, restore the
+// try/require in src/services/iap/index.ts and flip this to true.
+const IAP_ENABLED = {{IAP_ENABLED}};
+
 if (__DEV__) {
     console.log(
         `[config] API: ${baseApiUrl} | prod=${isProdBuild} `
@@ -73,5 +82,6 @@ export default {
     googleIosClientId: GOOGLE_IOS_CLIENT_ID,
     googleAuth: GOOGLE_AUTH_ENABLED,
     appleAuth: APPLE_AUTH_ENABLED,
+    iap: IAP_ENABLED,
     scheme: '{{MOBILE_SCHEME}}'
 };

package/template/mobile/{{PROJECT_SLUG}}/src/services/content/signing.ts

@@ -19,7 +19,8 @@ import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils.js';
 
 // CHANGE THIS to a long random string and keep it in sync with
 // server/.env CONTENT_SECRET. Same value at both ends.
-export const CONTENT_SECRET = '{{CONTENT_SECRET}}';
+export const CONTENT_SECRET =
+    '{{CONTENT_SECRET}}';
 
 interface SignedHeaders {
     'X-Content-Timestamp': string;

package/template/mobile/{{PROJECT_SLUG}}/src/services/iap/index.ts

@@ -1,7 +1,7 @@
 /**
- * In-App Purchase service — wraps `react-native-iap` v15 with:
+ * In-App Purchase service — wraps `expo-iap` (OpenIAP) with:
  *
- *  - Lazy-load via try/require so Expo Go (no NitroModules) gets
+ *  - Lazy-load via try/require so Expo Go (no native module) gets
  *    graceful no-ops instead of crashing on import.
  *  - One source of truth for product IDs (PRODUCT_IDS below — change
  *    them to match what you set up in App Store Connect / Play Console).
@@ -13,6 +13,7 @@
  */
 
 import { Platform } from 'react-native';
+import config from '../../config';
 import { fetchApi } from '../fetch-api';
 import type { ApiUser } from '../api';
 
@@ -35,22 +36,13 @@ interface IAPNative {
         isConsumable: boolean;
     }) => Promise<unknown>;
     getAvailablePurchases: () => Promise<NativePurchase[]>;
-    deepLinkToSubscriptionsIOS?: () => Promise<unknown>;
-    deepLinkToSubscriptions?: (args: {
-        packageNameAndroid: string;
-        skuAndroid: string;
-    }) => Promise<unknown>;
+    deepLinkToSubscriptions?: (args?: {
+        packageNameAndroid?: string;
+        skuAndroid?: string;
+    } | null) => Promise<unknown>;
 }
 
-let _iap: IAPNative | null = null;
-try {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    _iap = require('react-native-iap') as IAPNative;
-} catch {
-    console.info(
-        '[iap] react-native-iap not available (Expo Go) — IAP disabled'
-    );
-}
+{{IAP_REQUIRE_BLOCK}}
 
 const isAvailable = !!_iap;
 
@@ -60,8 +52,8 @@ const isAvailable = !!_iap;
 // product IDs) and Google Play Console (Monetize → Subscriptions). The
 // strings can be anything but must match across all three places.
 export const PRODUCT_IDS = {
-    monthly: '{{PROJECT_SLUG}}_premium_monthly',
-    annual:  '{{PROJECT_SLUG}}_premium_annual'
+    monthly: '{{PROJECT_SLUG_UNDERSCORE}}_premium_monthly',
+    annual:  '{{PROJECT_SLUG_UNDERSCORE}}_premium_annual'
 } as const;
 
 const PRODUCT_ID_LIST = Object.values(PRODUCT_IDS);
@@ -314,7 +306,7 @@ export async function openSubscriptionManagement(): Promise<boolean> {
     }
     try {
         if (Platform.OS === 'ios') {
-            await _iap!.deepLinkToSubscriptionsIOS?.();
+            await _iap!.deepLinkToSubscriptions?.();
             return true;
         }
         await _iap!.deepLinkToSubscriptions?.({
@@ -350,9 +342,9 @@ export async function validateWithServer(
 ): Promise<ValidateResponse> {
     let body: Record<string, unknown>;
     if (Platform.OS === 'ios') {
-        // StoreKit 2 / react-native-iap v15 no longer exposes a
-        // receipt blob — server validates via transactionId using the
-        // App Store Server API.
+        // StoreKit 2 / expo-iap no longer exposes a receipt blob —
+        // server validates via transactionId using the App Store
+        // Server API.
         const originalTransactionId =
             purchase.originalTransactionIdentifierIOS
             ?? purchase.transactionId;
@@ -397,6 +389,9 @@ export async function fetchPremiumStatus(token: string): Promise<{
     ok: boolean;
     is_premium: boolean;
 }> {
+    if (!config.iap) {
+        return { ok: false, is_premium: false };
+    }
     try {
         return await fetchApi('/api/iap/status', { token });
     } catch (err) {

package/template/scripts/clean-appledouble.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+#
+# clean-appledouble — remove macOS AppleDouble `._*` sidecar files.
+#
+# macOS drops a `._<name>` metadata file next to every file that carries
+# extended attributes when it lives on a filesystem that can't store
+# xattrs natively (exFAT, MS-DOS/FAT, NTFS, SMB/NFS network mounts).
+# CocoaPods then scans for `*.podspec`, finds `._Foo.podspec`, tries to
+# parse the binary metadata as Ruby, and `pod install` — and therefore
+# `expo prebuild` / `expo run:ios` — dies with:
+#
+#   Invalid `Podfile` file: Invalid podspec file at path
+#   .../node_modules/.../ios/._Foo.podspec
+#
+# On APFS / Mac OS Extended there are none, so this is a fast no-op. Run
+# it before any pod install / prebuild / native build.
+#
+# The real fix is to keep the project on an APFS / Mac OS Extended disk
+# (e.g. ~/dev) — exFAT/NTFS regenerate these files on every npm install.
+#
+# Usage: ./scripts/clean-appledouble.sh [dir]   (default: repo root)
+
+set -euo pipefail
+
+# AppleDouble files are a macOS-only artifact.
+[[ "$(uname)" == "Darwin" ]] || exit 0
+
+TARGET="${1:-$(cd "$(dirname "$0")/.." && pwd)}"
+[[ -d "$TARGET" ]] || exit 0
+
+n=$(
+    find "$TARGET" -name '._*' -type f -print -delete 2>/dev/null \
+        | wc -l | tr -d ' '
+)
+
+if [[ "${n:-0}" -gt 0 ]]; then
+    echo "==> Removed $n AppleDouble ._* file(s) under $TARGET"
+    echo "    This disk can't store macOS extended attributes (likely"
+    echo "    exFAT/NTFS/network), so they'll return on the next npm"
+    echo "    install. For clean native builds, move the project to an"
+    echo "    APFS / Mac OS Extended disk (e.g. ~/dev)."
+fi

package/template/scripts/prebuild.sh

@@ -24,5 +24,12 @@ for arg in "$@"; do
     esac
 done
 
-cd "$(dirname "$0")/../mobile/{{PROJECT_SLUG}}"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+cd "$SCRIPT_DIR/../mobile/{{PROJECT_SLUG}}"
+
+# Strip macOS AppleDouble `._*` files before prebuild — CocoaPods
+# chokes on `._Foo.podspec` when the project lives on exFAT/NTFS/network
+# volumes. No-op on APFS. See scripts/clean-appledouble.sh.
+"$SCRIPT_DIR/clean-appledouble.sh" "$PWD"
+
 exec npx expo prebuild "$@"

package/template/scripts/run-ios.sh

@@ -53,6 +53,11 @@ done
 
 cd "$APP_DIR"
 
+# Strip macOS AppleDouble `._*` files so the pod install triggered by
+# `expo run:ios` doesn't choke on `._Foo.podspec` (exFAT/NTFS/network
+# volumes). No-op on APFS. See scripts/clean-appledouble.sh.
+"$SCRIPT_DIR/clean-appledouble.sh" "$APP_DIR"
+
 if [[ $CLEAN -eq 1 ]]; then
     echo "==> Cleaning iOS build artifacts..."
     rm -rf ios/build

package/template-variables.mjs

@@ -52,6 +52,29 @@
 //                            when off (the plugin adds the Sign in
 //                            with Apple entitlement unconditionally,
 //                            so it must not ship when disabled).
+// {{PROJECT_SLUG_UNDERSCORE}} — Slug with dashes → underscores. Used
+//                            for IAP product IDs (Apple rejects
+//                            dashes in product identifiers).
+// {{IAP_ENABLED}}          — "true"/"false" — in-app purchases picked
+//                            at scaffold time. Consumed by mobile
+//                            src/config.ts; gates PremiumGate and the
+//                            iap service.
+// {{IAP_DEP_JSON}}         — package.json fragment: the `"expo-iap"`
+//                            dependency line when IAP is on, empty
+//                            when off (expo-iap autolinks its native
+//                            billing code whenever installed, so the
+//                            dep itself must not ship when disabled).
+// {{IAP_PLUGIN_JSON}}      — app.json fragment: the `"expo-iap"`
+//                            plugins entry when IAP is on, empty
+//                            when off.
+// {{IAP_BILLING_PERMISSION_JSON}} — app.json fragment: the Android
+//                            `com.android.vending.BILLING` permission
+//                            when IAP is on, empty when off.
+// {{IAP_REQUIRE_BLOCK}}    — services/iap/index.ts fragment: the lazy
+//                            try/require of expo-iap when IAP is on;
+//                            a stub comment when off (Metro resolves
+//                            require() statically, so the literal
+//                            must not appear when the dep is absent).
 
 // ─── Site landing variants ────────────────────────────────────────────────────
 // The public site ships two landing flavors. The SaaS landing (CTAs →
@@ -355,6 +378,7 @@ export function buildReplacements(details) {
         '{{PROJECT_SLUG_UPPER}}': details.slug
             .toUpperCase()
             .replace(/-/g, '_'),
+        '{{PROJECT_SLUG_UNDERSCORE}}': details.slug.replace(/-/g, '_'),
         '{{PROJECT_DESCRIPTION}}': details.description,
         '{{DOMAIN}}': details.domain,
         '{{DB_NAME}}': details.dbName,
@@ -402,5 +426,37 @@ export function buildReplacements(details) {
         '{{APPLE_AUTH_PLUGIN_JSON}}': details.authApple === false
             ? ''
             : '\n            "expo-apple-authentication",',
+        // In-app purchases chosen at scaffold time. Defaults to
+        // enabled so legacy manifests (which never recorded a
+        // choice) keep their current behavior on update. When
+        // disabled, the expo-iap dependency / config plugin /
+        // BILLING permission / require() all disappear — the iap
+        // service and PremiumGate degrade to graceful no-ops.
+        '{{IAP_ENABLED}}': details.iap === false ? 'false' : 'true',
+        '{{IAP_DEP_JSON}}': details.iap === false
+            ? ''
+            : '\n        "expo-iap": "^4.4.0",',
+        '{{IAP_PLUGIN_JSON}}': details.iap === false
+            ? ''
+            : ',\n            "expo-iap"',
+        '{{IAP_BILLING_PERMISSION_JSON}}': details.iap === false
+            ? ''
+            : ',\n                "com.android.vending.BILLING"',
+        '{{IAP_REQUIRE_BLOCK}}': details.iap === false
+            ? '// IAP disabled at scaffold time (`umpordez create`\n'
+                + '// without in-app purchases) — expo-iap is not\n'
+                + '// installed and every function below no-ops.\n'
+                + 'const _iap: IAPNative | null = null;'
+            : 'let _iap: IAPNative | null = null;\n'
+                + 'try {\n'
+                + '    // eslint-disable-next-line '
+                + '@typescript-eslint/no-require-imports\n'
+                + '    _iap = require(\'expo-iap\') as IAPNative;\n'
+                + '} catch {\n'
+                + '    console.info(\n'
+                + '        \'[iap] expo-iap not available (Expo Go)'
+                + ' — IAP disabled\'\n'
+                + '    );\n'
+                + '}',
     };
 }