Repository · Mobile · Environment Audit — 2026-08-06

Field	Value
WP	WP-REPOSITORY-ARCH-ENV-AUDIT-01
Path	`D:\welife`
Device / emulator	NOT TESTED
Secrets printed	NO

Repository

Item	Value
Package manager	npm
Workspace	None (custom multi-app; root scripts `--prefix`)
Build orchestrator	None
Main apps	`api` · `mobile` · `partner` · `driver` · `dashboard`
Shared packages	NOT PRESENT (`packages/` missing)

Git status before (summary)

Large dirty tree from prior WPs (design JPG move, Google prep, P8, API root, hygiene deletes).
Tracked env templates only (.env.example / .env.*.example) — no live .env in git ls-files.
Firebase JSON/plist gitignored, not tracked.
Merge conflict markers: none found.
Lockfiles: package-lock.json only (no pnpm/yarn dual lock).

Tree / statistics

Outputs:

REPOSITORY-TREE-CURRENT.md
REPOSITORY-TREE-CURRENT.txt
Generator: scripts/repo-tree-audit.mjs

Scope	Files	.ts	.tsx	Tests	.env*	Media
Walk (excl. node_modules/dist/…)	1007	299	267	20	23	73

(Per-folder breakdown in tree report.)

Architecture verdict

Area	Verdict	Notes
Repository structure	PARTIAL	Clear apps; no workspaces/`packages/shared`
Mobile structure	PASS (local)	Feature folders · single API client · SecureStore · React Navigation
API structure	PASS (local)	Nest modules · Prisma in services · `/api/v1` · Socket.IO
Shared packages	PARTIAL	Missing; client API logic triplicated
Documentation	PASS	Architecture docs + inventories added this WP

Mobile

Item	Value
Framework	Expo 54
Navigation	React Navigation
State	AuthContext (no Redux/RQ)
API client	`src/services/api.ts` + `src/config/env.ts`
Storage	SecureStore tokens · AsyncStorage flags
Features	36 domains · ~126 screens
Native config	scheme `welife` · `cloud.minhtien.welife`
Device test	NOT PERFORMED

API

Item	Value
Framework	NestJS 11
Modules	39
Database	Prisma + Postgres/PostGIS
Redis	OTP + token blacklist
Object storage	MinIO/S3
Email	SMTP / Mailpit
WebSocket	`/socket.io` · ns `/chat` · `/rides`
Health	`/api/v1/health` · index `/api/v1`
Config	`assertSecureBoot` + `env:check`

Partner / Driver / Dashboard

Surface	Kind	Static tsc	Notes
Partner	Expo 57 thin	PASS	SDK drift vs mobile 54
Driver	Expo 57 thin	PASS	SDK drift
Dashboard	Vite React	PASS	Admin modules

Environment

Metric	Count / status
Vars referenced in code	87 (ENV-INVENTORY.md)
Live PRESENT	61
Live MISSING	24 (mostly optional/unused-on-this-machine)
Live PLACEHOLDER	1 (Google)
Live EMPTY	1
CRITICALSECRET_EXPOSURE (`EXPO_PUBLIC` + server secret pattern)	0
`.env.example` apps	root · api · mobile · dashboard · partner · driver

Cross-app: Google FE/BE PLACEHOLDER → OWNER_REQUIRED. Validation: Google placeholder reject · JWT distinct · prod OTP_DEV ban.

Critical findings

Google OAuth Client ID PLACEHOLDER — Sign-In e2e blocked (OWNER).
No packages/shared — DTO/API client duplication FE surfaces (deferred WP).

High findings

Expo SDK drift — mobile 54 vs partner/driver 57.
mobile/src/services/api.ts size — maintainability; future split by domain.
.env-backups/ on disk — ensure never committed (gitignored pattern present).

Medium findings

Firebase native files present locally but not wired in app.json (OK until FCM WP).
Nested mobile/.git historically warned (structure audit) — still OWNER decision.
api/.agents local AI clutter — non-blocking.

Low findings

Root only orchestration — acceptable; document as non-workspace.
Few automated FE unit tests vs API.

Files created / changed (this WP)

Created

scripts/repo-tree-audit.mjs
scripts/env-inventory.mjs
docs/reports/REPOSITORY-TREE-CURRENT.md / .txt
docs/reports/ENV-INVENTORY.md / .csv
docs/architecture/REPOSITORY-STRUCTURE.md
docs/architecture/MOBILE-ARCHITECTURE.md
docs/architecture/ENVIRONMENT-VARIABLES.md
docs/reports/REPOSITORY-AUDIT-2026-08-06.md (this file)
mobile/src/config/env.ts

Changed

mobile/src/services/api.ts — reads mobileEnv
docs/00-DOC-MAP.md — links

Bugs fixed

Root cause: Public env reads scattered in api.ts without typed hub. Fix: config/env.ts + wire API base/WS/debug. Evidence: mobile tsc exit 0.

Tests (re-run after changes)

Check	Result
`npm run env:check`	PASS
API tsc	PASS
Mobile tsc	PASS
Dashboard tsc	PASS
Partner tsc	PASS
Driver tsc	PASS
Unit (api-root + google util)	9/9 PASS
API smoke health/root/chat	PASS
Lint full-repo	NO SCRIPT at root
Device	NOT TESTED

Secrets

Secret printed: NO
Secret invented: NO
Secret committed: NO (examples only tracked)
Rotation required: NO (unless OWNER previously committed secrets outside this audit)

Remaining OWNER requirements

Google Web OAuth Client ID (real)
Pay / SMS live keys (separate WPs)
EAS cloud login
Optional: align Expo SDK partner/driver ↔ mobile

Recommended work packages

WP-SHARED-CONTRACTS-01 — scaffold packages/shared types + zod (no big FE rewrite day-1)
WP-EXPO-SDK-ALIGN-01 — partner/driver ↔ mobile SDK alignment plan
WP-MOBILE-API-SPLIT-01 — split services/api.ts by domain
WP-AUTH-GOOGLE-E2E-01 — after OWNER Client ID

Final verdict

REPOSITORY STRUCTURE: PARTIAL
MOBILE ARCHITECTURE: PASS
API ARCHITECTURE: PASS
ENVIRONMENT COVERAGE: PARTIAL (Google OWNER + optional vars missing)
LOCAL DEVELOPMENT READINESS: PASS
PRODUCTION READINESS: PARTIAL
DEVICE / EMULATOR: NOT TESTED
APPLICATION REGRESSION: NO