Application structure
apps/mobile uses Expo SDK 57, React Native and file-based Expo Router routes. Auth routes sit outside the protected tabs. Home, Todos and Profile demonstrate the shared API; Profile contains Sessions, passkeys, Organizations, notifications and optional subscriptions.
The native design layer centralizes colors, type, spacing and reusable controls. Hooks own mutations, auth transitions, dialogs and toasts. Keep route components focused on composition rather than duplicating transport policy.
Backend and scope
EXPO_PUBLIC_SERVER_URL selects the backend, with localhost:3005 as the local fallback. A physical device needs a reachable laptop LAN address. Better Auth's Expo client owns credentials; request scope captures User, Session and Organization. Organization transitions cancel stale waits and hide stale query results, including an A-to-B-to-A transition.
Offline Todo reading is scoped to the observed identity and Organization. Cached data is not authorization, and a late response from an old identity must not clear or overwrite the new one.
Native capabilities
RevenueCat requires its SDK in the native build and both billing gates. Push boot registers the platform adapter where available, with enrollment, foreground presentation and tap authorization kept separate. Widgets are opt-in through configuration and a feature flag. Biometric app lock protects local presentation, not server permission.
Extend and verify
Use the shared API contracts, then expose behavior through a mobile hook and the existing design components. Test on a development build when adding native modules. TypeScript and Hermes export do not prove device permission dialogs, purchases, background push or store signing.
The Expo SDK compatibility matrix owns native versions. Do not bump native modules merely because npm has a newer release; rebuild the dev client when the native dependency set changes. See libraries and upgrade policy.