Release/2.0.26

.github/workflows/api-tests.yml

@@ -30,12 +30,11 @@ jobs:
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
-          cache: true
 
       - name: Install dependencies
         env:
           PACKRAT_NATIVEWIND_UI_GITHUB_TOKEN: ${{ secrets.PACKRAT_NATIVEWIND_UI_GITHUB_TOKEN }}
-        run: bun install
+        run: bun install --frozen-lockfile
 
       - name: Run API tests
         run: bun run --cwd packages/api test 2>&1 | tee /tmp/api-tests-output.log

.github/workflows/checks.yml

@@ -27,11 +27,10 @@ jobs:
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
-          cache: true
       - name: Install dependencies
         env:
           PACKRAT_NATIVEWIND_UI_GITHUB_TOKEN: ${{ secrets.PACKRAT_NATIVEWIND_UI_GITHUB_TOKEN }}
-        run: bun install
+        run: bun install --frozen-lockfile
       - name: Run Biome (check mode)
         if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.fix == true) }}
         run: bun biome check

.github/workflows/copilot-setup-steps.yml

@@ -66,7 +66,6 @@ jobs:
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: ${{ steps.bun-version.outputs.version }}
-          cache: true
 
       # Sanity-check that the runner satisfies the repo's engine constraints.
       - name: Verify runtime versions

.github/workflows/e2e-tests.yml

@@ -84,7 +84,7 @@ jobs:
       - name: Install dependencies
         env:
           PACKRAT_NATIVEWIND_UI_GITHUB_TOKEN: ${{ secrets.PACKRAT_NATIVEWIND_UI_GITHUB_TOKEN }}
-        run: bun install
+        run: bun install --frozen-lockfile
 
       - name: Setup Expo
         uses: expo/expo-github-action@v8
@@ -343,7 +343,7 @@ jobs:
       - name: Install dependencies
         env:
           PACKRAT_NATIVEWIND_UI_GITHUB_TOKEN: ${{ secrets.PACKRAT_NATIVEWIND_UI_GITHUB_TOKEN }}
-        run: bun install
+        run: bun install --frozen-lockfile
 
       - name: Setup Expo
         uses: expo/expo-github-action@v8

.github/workflows/lighthouse.yml

@@ -29,7 +29,6 @@ jobs:
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
-          cache: true
 
       - name: Install dependencies
         env:
@@ -60,7 +59,6 @@ jobs:
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
-          cache: true
 
       - name: Install dependencies
         env:

.github/workflows/migrations.yml

@@ -39,12 +39,11 @@ jobs:
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
-          cache: true
 
       - name: Install dependencies
         env:
           PACKRAT_NATIVEWIND_UI_GITHUB_TOKEN: ${{ secrets.PACKRAT_NATIVEWIND_UI_GITHUB_TOKEN }}
-        run: bun install
+        run: bun install --frozen-lockfile
 
       - name: Determine target environment
         id: env

.github/workflows/release-ios.yml

@@ -47,7 +47,6 @@ jobs:
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.3.10
-          cache: true
 
       - name: Validate release tag and app versions
         run: bun .github/scripts/validate-release-version.ts "${{ steps.release_tag.outputs.tag }}"

.github/workflows/sync-guides-r2.yml

@@ -32,14 +32,13 @@ jobs:
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
-          cache: true
 
       - name: Authenticate with GitHub for private packages
         run: |
           echo "PACKRAT_NATIVEWIND_UI_GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}" >> $GITHUB_ENV
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
         timeout-minutes: 5
 
       - name: Sync guides to R2 bucket

.github/workflows/unit-tests.yml

@@ -50,12 +50,11 @@ jobs:
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
-          cache: true
 
       - name: Install dependencies
         env:
           PACKRAT_NATIVEWIND_UI_GITHUB_TOKEN: ${{ secrets.PACKRAT_NATIVEWIND_UI_GITHUB_TOKEN }}
-        run: bun install
+        run: bun install --frozen-lockfile
 
       - name: Run API unit tests
         run: bun run --cwd packages/api test:unit:coverage
@@ -80,12 +79,11 @@ jobs:
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
-          cache: true
 
       - name: Install dependencies
         env:
           PACKRAT_NATIVEWIND_UI_GITHUB_TOKEN: ${{ secrets.PACKRAT_NATIVEWIND_UI_GITHUB_TOKEN }}
-        run: bun install
+        run: bun install --frozen-lockfile
 
       - name: Run Expo unit tests
         run: bun run --cwd apps/expo test:coverage

apps/admin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "packrat-admin-app",
-  "version": "2.0.25",
+  "version": "2.0.26",
   "private": true,
   "scripts": {
     "build": "next build",

apps/expo/app.config.ts

@@ -37,7 +37,7 @@ export default (): ExpoConfig =>
     {
       name: getAppName(),
       slug: 'packrat',
-      version: '2.0.25',
+      version: '2.0.26',
       scheme: 'packrat',
       web: {
         bundler: 'metro',

apps/expo/app/(app)/trip/location-search.tsx

@@ -44,6 +44,7 @@ export default function LocationSearchScreen() {
         )}&key=${GOOGLE_MAPS_API_KEY}`,
       );
 
+      if (!response.ok) throw new Error(`Geocode request failed: ${response.status}`);
       const data = await response.json();
 
       if (data.status === 'OK' && data.results.length > 0) {

apps/expo/app/auth/index.tsx

@@ -119,7 +119,7 @@ export default function AuthIndexScreen() {
                   size={Platform.select({ ios: 'lg', default: 'md' })}
                   onPress={signInWithApple}
                 >
-                  <Text className="ios:text-foreground absolute left-4 text-[22px]"></Text>
+                  <Text className="ios:text-foreground absolute left-4 text-[22px]">{''}</Text>
                   <Text className="ios:text-foreground">{t('auth.continueWithApple')}</Text>
                 </Button>
               )}

apps/expo/app/auth/one-time-password.tsx

@@ -15,7 +15,6 @@ import {
   type NativeSyntheticEvent,
   Platform,
   Pressable,
-  type TargetedEvent,
   type TextInput,
   type TextInputKeyPressEventData,
   View,
@@ -27,7 +26,7 @@ import { useSafeAreaInsets } from 'react-native-safe-area-context';
 const LOGO_SOURCE = require('expo-app/assets/packrat-app-icon-gradient.png');
 
 const COUNTDOWN_SECONDS_TO_RESEND_CODE = 60;
-const NUM_OF_CODE_CHARACTERS = 5;
+const NUM_OF_CODE_CHARACTERS = 6;
 const SCREEN_OPTIONS = {
   headerBackTitle: 'Back',
   headerTransparent: true,
@@ -266,12 +265,6 @@ function OTPField({
     }
   }
 
-  function onFocus(_e: NativeSyntheticEvent<TargetedEvent>) {
-    inputRef.current?.setNativeProps({
-      selection: { start: 0, end: value?.toString().length },
-    });
-  }
-
   function onChangeText(text: string) {
     setCodeValues((prev) => {
       const values = [...prev];
@@ -311,7 +304,6 @@ ios:border ios:border-border ios:rounded-lg "
       clearButtonMode="never"
       materialHideActionIcons
       materialRingColor={hasError ? colors.destructive : undefined}
-      onFocus={onFocus}
       onKeyPress={onKeyPress}
       onChangeText={onChangeText}
       onSubmitEditing={

apps/expo/features/auth/hooks/useAuthActions.ts

@@ -1,3 +1,4 @@
+import { clientEnvs } from '@packrat/env/expo-client';
 import { asBoolean, asString } from '@packrat/guards';
 import AsyncStorage from '@react-native-async-storage/async-storage';
 import {
@@ -188,19 +189,27 @@ export function useAuthActions() {
   };
 
   const forgotPassword = async (email: string) => {
-    const { error } = await authClient.requestPasswordReset({
-      email,
-      redirectTo: 'packrat://reset-password',
+    const res = await fetch(`${clientEnvs.EXPO_PUBLIC_API_URL}/api/password-reset/request`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email }),
     });
-    if (error) throw new Error(error.message ?? 'Forgot password failed');
+    if (!res.ok) {
+      const data = (await res.json()) as { error?: string };
+      throw new Error(data.error ?? 'Forgot password failed');
+    }
   };
 
-  const resetPassword = async (_email: string, opts: { token: string; newPassword: string }) => {
-    const { error } = await authClient.resetPassword({
-      token: opts.token,
-      newPassword: opts.newPassword,
+  const resetPassword = async (email: string, opts: { token: string; newPassword: string }) => {
+    const res = await fetch(`${clientEnvs.EXPO_PUBLIC_API_URL}/api/password-reset/verify`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email, code: opts.token, newPassword: opts.newPassword }),
     });
-    if (error) throw new Error(error.message ?? 'Reset password failed');
+    if (!res.ok) {
+      const data = (await res.json()) as { error?: string };
+      throw new Error(data.error ?? 'Reset password failed');
+    }
   };
 
   const verifyEmail = async (_email: string, token: string) => {

apps/expo/lib/api/packrat.ts

@@ -1,20 +1,48 @@
 import { createApiClient } from '@packrat/api-client';
 import { clientEnvs } from '@packrat/env/expo-client';
+import { fromZod } from '@packrat/guards';
 import { store } from 'expo-app/atoms/store';
 import { needsReauthAtom } from 'expo-app/features/auth/atoms/authAtoms';
 import { authClient } from 'expo-app/lib/auth-client';
+import * as SecureStore from 'expo-secure-store';
+import { z } from 'zod';
+
+// The expoClient plugin serialises all cookies into SecureStore under this key.
+// Parsing it locally avoids a network round-trip on every API request.
+const COOKIE_STORE_KEY = 'packrat_cookie';
+
+const CookieStoreSchema = z.record(z.object({ value: z.string() }));
+
+// expoClient stores cookies as JSON: { "better-auth.session_token": { value, expires } }
+// HTTPS servers (remote dev/prod) prefix the cookie name with __Secure-; HTTP (local) does not.
+function parseSessionToken(cookieJson: string | null): string | null {
+  if (!cookieJson) return null;
+  const cookies = fromZod(CookieStoreSchema)(JSON.parse(cookieJson));
+  if (!cookies) return null;
+  return (
+    cookies['better-auth.session_token']?.value ??
+    cookies['__Secure-better-auth.session_token']?.value ??
+    null
+  );
+}
 
 export const apiClient = createApiClient({
   baseUrl: clientEnvs.EXPO_PUBLIC_API_URL,
   auth: {
+    // Read the token from SecureStore — no network call on every API request.
     getAccessToken: async () => {
-      const { data } = await authClient.getSession();
-      return data?.session?.token ?? null;
+      const cookieStr = await SecureStore.getItemAsync(COOKIE_STORE_KEY);
+      return parseSessionToken(cookieStr);
     },
-    // Better Auth manages session renewal internally — no separate refresh token flow.
+    // Better Auth has no separate refresh-token endpoint; the 7-day session
+    // token is the only credential. Returning null here is intentional.
     getRefreshToken: () => null,
     onAccessTokenRefreshed: () => {},
-    onNeedsReauth: () => {
+    onNeedsReauth: async () => {
+      // A 401 can be transient (e.g. the server briefly returned an error).
+      // Verify the session is actually gone before alarming the user.
+      const { data } = await authClient.getSession();
+      if (data?.session) return;
       store.set(needsReauthAtom, true);
     },
   },

apps/expo/lib/hooks/useColorScheme.tsx

@@ -18,7 +18,7 @@ function useColorScheme() {
   }
 
   function toggleColorScheme() {
-    return setColorScheme(colorScheme === 'light' ? 'dark' : 'light');
+    return setColorScheme((colorScheme ?? 'light') === 'light' ? 'dark' : 'light');
   }
 
   return {

apps/expo/package.json

@@ -1,6 +1,6 @@
 {
   "name": "packrat-expo-app",
-  "version": "2.0.25",
+  "version": "2.0.26",
   "private": true,
   "main": "expo-router/entry",
   "scripts": {

apps/expo/utils/__tests__/weight.test.ts

@@ -28,34 +28,34 @@ function makeItem(
 // ---------------------------------------------------------------------------
 describe('convertWeight', () => {
   it('returns the same value when from === to', () => {
-    expect(convertWeight(100, 'g', 'g')).toBe(100);
-    expect(convertWeight(5, 'oz', 'oz')).toBe(5);
-    expect(convertWeight(2, 'kg', 'kg')).toBe(2);
-    expect(convertWeight(1, 'lb', 'lb')).toBe(1);
+    expect(convertWeight(100, { from: 'g', to: 'g' })).toBe(100);
+    expect(convertWeight(5, { from: 'oz', to: 'oz' })).toBe(5);
+    expect(convertWeight(2, { from: 'kg', to: 'kg' })).toBe(2);
+    expect(convertWeight(1, { from: 'lb', to: 'lb' })).toBe(1);
   });
 
   it('converts grams to ounces', () => {
-    expect(convertWeight(100, 'g', 'oz')).toBeCloseTo(3.53, 1);
+    expect(convertWeight(100, { from: 'g', to: 'oz' })).toBeCloseTo(3.53, 1);
   });
 
   it('converts ounces to grams', () => {
-    expect(convertWeight(1, 'oz', 'g')).toBeCloseTo(28.349523125, 8);
+    expect(convertWeight(1, { from: 'oz', to: 'g' })).toBeCloseTo(28.349523125, 8);
   });
 
   it('converts grams to kilograms', () => {
-    expect(convertWeight(1000, 'g', 'kg')).toBe(1);
+    expect(convertWeight(1000, { from: 'g', to: 'kg' })).toBe(1);
   });
 
   it('converts kilograms to grams', () => {
-    expect(convertWeight(1, 'kg', 'g')).toBe(1000);
+    expect(convertWeight(1, { from: 'kg', to: 'g' })).toBe(1000);
   });
 
   it('converts grams to pounds', () => {
-    expect(convertWeight(453.59, 'g', 'lb')).toBeCloseTo(1, 1);
+    expect(convertWeight(453.59, { from: 'g', to: 'lb' })).toBeCloseTo(1, 1);
   });
 
   it('converts pounds to grams', () => {
-    expect(convertWeight(1, 'lb', 'g')).toBeCloseTo(453.59237, 4);
+    expect(convertWeight(1, { from: 'lb', to: 'g' })).toBeCloseTo(453.59237, 4);
   });
 });
 

apps/guides/package.json

@@ -1,6 +1,6 @@
 {
   "name": "packrat-guides-app",
-  "version": "2.0.25",
+  "version": "2.0.26",
   "private": true,
   "scripts": {
     "build": "bun run generate-og-images && bun run build-content && next build",

apps/landing/package.json

@@ -1,6 +1,6 @@
 {
   "name": "packrat-landing-app",
-  "version": "2.0.25",
+  "version": "2.0.26",
   "private": true,
   "scripts": {
     "build": "bun run generate-og-images && next build",