Add 216 JS unit tests across 20 new test files covering every untested
module in @clerk/expo: hooks (useUserProfileModal, useNativeAuthEvents,
useNativeSession), native components (AuthView, InlineAuthView,
UserProfileView, InlineUserProfileView, UserButton), provider
(ClerkProvider init flow, NativeSessionSync, native-to-JS auth sync),
utilities (runtime, errors, native-module), caches (token-cache,
resource-cache), and the Expo config plugin (withClerkAndroid,
withClerkExpo, withClerkIOS).

Add 8 Kotlin unit tests for the Android native bridge code covering
session ID change detection logic, per-view ViewModelStore isolation,
and sign-out cleanup behavior.

Add 23 Maestro e2e flow files targeting the clerk-expo-quickstart
NativeComponentQuickstart app, including 5 regression flows for bugs
shipped in chris/fix-inline-authview-sso (forgot-password OAuth,
Get Help loop, re-sign-in cycle, theming reset, cold-launch flash).

Add manual-trigger GitHub Actions workflow for running Maestro flows
on both iOS simulator and Android emulator.

Source changes (non-breaking):
- packages/expo/app.plugin.js: export sub-plugins for unit testing
- packages/expo/src/provider/ClerkProvider.tsx: export NativeSessionSync
- packages/expo/android/build.gradle: add JUnit/Robolectric test deps

Local iOS validation surfaced several issues in the Maestro flow files
and runner scripts. This commit has all the fixes needed to get the
core happy-path and regression flows passing end-to-end against the
clerk-expo-quickstart NativeComponentQuickstart app on an iPhone 17
simulator (iOS 26).

Validated passing flows:
- flows/sign-in/email-password.yaml (34s)
- flows/cycles/sign-in-sign-out-sign-in.yaml (53s) -- THE REGRESSION
- flows/smoke/cold-launch-no-flash.yaml (7s)

Remaining flows need follow-up iteration to handle iOS-specific
UserProfile UI copy (e.g. Edit profile, Log out button text) and
the secondary test user env vars for different-user cycles.

Fixes in this commit:

1. Scripts portability -- macOS ships bash 3.2 which lacks mapfile.
   Replace with while-read loop.

2. Maestro subdirectory recursion -- `maestro test flows/` does not
   walk subdirectories. Use `find` + explicit file list.

3. Platform disambiguation -- with both iOS sim and Android emu booted,
   Maestro auto-picked the wrong driver. Pass `--platform ios|android`.

4. Env var interpolation -- Maestro does not auto-read shell env. Pass
   CLERK_TEST_EMAIL/PASSWORD via explicit `-e KEY=value` flags.

5. Regex patterns -- Maestro's `text:` and `visible:` use full-string
   regex match. Use `.*term.*` for substring, `\.?` for optional
   trailing punctuation, single quotes in YAML to avoid escape issues.

6. Dev launcher URL differs -- iOS uses http://localhost:8081, Android
   uses http://10.0.2.2:8081. Match with `.*:8081` regex.

7. Dev menu dismissal -- tap Close accessibility ID with backdrop
   fallback at 50%,20%.

8. Session persistence across clearState -- Clerk's token in iOS
   Keychain (AFTER_FIRST_UNLOCK) survives app reinstall. Add a
   conditional sign-out step to open-app.yaml.

9. inputText appends, not replaces -- add `eraseText: 50` before every
   inputText in sign-in-email-password.yaml.

10. iOS trailing period differs -- clerk-ios renders "Welcome! Sign in
    to continue" (no period), clerk-android renders with period. Use
    `\.?` regex to match both.

Also adds integration-mobile/.gitignore to prevent config/.env from
being committed (it contains a Clerk publishable key for the
delicate-crab-73 dev instance).

iOS UserProfile uses different copy than Android:
- "Edit profile" (Android) -> "Update profile" (iOS)
- "Log out" (Android) -> "Sign out" (iOS)
- The Close (X) button matches on accessibilityText "Close", not id

Use cross-platform regex alternation ("(Edit|Update) profile",
"Log out|Sign out") and switch from `id: "Close"` to `text: "Close"`
since Maestro's id matches resource-id (SF Symbol name "xmark" on iOS).

Also switch sheet-dismiss from `- back` (iOS has no back button) to
tap the Close X with back fallback for Android.

Mark 3 flows as `skip` until prerequisites are in place:
- sign-out-then-sign-in-different-user: needs CLERK_TEST_EMAIL_SECONDARY
  and a second test user in the dev instance
- email-verification: sign-up selector flow still needs iOS-specific
  verification steps
- custom-theme-applied: check-theme-color.js needs pngjs, and iOS
  quickstart doesn't bundle clerk-theme.json yet

Passing flows on iPhone 17 simulator:
- email-password
- sign-in-sign-out-sign-in (THE REGRESSION)
- cold-launch-no-flash
- open-profile-modal
- sign-out-from-profile
- edit-first-name

cold-launch-no-flash inlines its own launcher logic (doesn't use
open-app.yaml) so it was missing the conditional sign-out step added
to open-app.yaml. When the previous flow left the user signed in, the
cold-launch assertion "Welcome! Sign in to continue" failed because
the app launched to the signed-in home screen.

Also update the dev menu dismissal to use the same Close-X-first,
backdrop-fallback pattern as open-app.yaml.

Result: 6/6 non-skipped iOS Maestro flows passing in 4m 14s on
iPhone 17 simulator (iOS 26) against delicate-crab-73 dev instance:
- email-password
- sign-in-sign-out-sign-in (the shipped regression)
- cold-launch-no-flash
- open-profile-modal
- sign-out-from-profile
- edit-first-name

Add Google Password Manager auto-dismissal to open-app.yaml and
sign-in-email-password.yaml. After sign-in, Android shows a "Save
password?" sheet from Google Password Manager. The sheet button text
varies between "Not now" (first prompt) and "Never" (after declining
once), so use regex alternation.

Skip dark-mode-applied -- same pngjs dependency issue as
custom-theme-applied; both need the theme-color helper script
prerequisites before they can run.

Result: 7/7 non-skipped Android Maestro flows passing against
Pixel 9 Pro emulator (API 34) and delicate-crab-73 dev instance:
- email-password (57s)
- sign-in-sign-out-sign-in (1m 28s) -- the shipped regression
- cold-launch-no-flash (24s)
- get-help-loop-regression (1m 10s) -- the shipped Android regression
- open-profile-modal (1m 9s)
- sign-out-from-profile (1m 4s)
- edit-first-name (1m 16s)

Combined with iOS (6/6 passing), the Maestro suite now catches the
full user journey end-to-end on both platforms.

Mirrors the /integration (Playwright) secret pattern: read pk/sk from a
named entry in the existing INTEGRATION_INSTANCE_KEYS JSON secret and
provision a fresh test user per run via the Clerk Backend API. Cleans up
the user on teardown (always).

Instance name is a placeholder ("expo-native") pending SDK team confirmation
of which dev/staging instance this workflow should target. The secret slot
is left blank in the repo until that's resolved.

mac runners default /bin/bash to Apple's 3.2 fork, which lacks
mapfile. Use the same find | while | grep | xargs pipeline as the
Android job; skip-messages go to stderr so xargs only sees kept paths.

…arallel

Previous concurrency group was keyed only by github.ref, so dispatches
from both iOS and Android compat gates against the same receiver branch
share the same group. With cancel-in-progress: true, firing the Android
gate cancels an in-flight iOS run (and vice-versa).

Scope the group by which platform's compat gate fired the dispatch
(ios / android / full) so the two can run concurrently. Rapid
re-dispatch within the same scope still cancels (intended behavior).

The folded scalar (>-) only joins same-indent lines with spaces;
more-indented lines preserve newlines, which broke the shell's
while/do/done pairing and produced 'end of file unexpected expecting done'.

Bandaid pass to stop chasing single-flow timing flakes:
- assert-signed-in: convert all assertVisible to extendedWaitUntil
  (20s for "Manage Profile", 5s for "Sign Out" and "Welcome")
- assert-signed-out: extendedWaitUntil 20s for "Welcome!" instead of
  bare assertVisible
- sign-out-via-button: extendedWaitUntil 20s for "Welcome!" + bump
  email-field wait 10s -> 25s (this is the consistently-slowest path)
- sign-in-email-password: extendedWaitUntil 20s for "Welcome!" + bump
  email-field wait 10s -> 25s, take a debug screenshot before the wait
  so future failures here are diagnosable

assertVisible has no retry; extendedWaitUntil retries until timeout,
which is what we want everywhere in CI where renders are slow.

iOS's system 'Save Password' / iCloud Keychain prompt overlays the home
screen after sign-in. The flow already dismisses Android's Google
Password Manager equivalent; mirror that for the iOS variants
("Save Password", "Strong Password", "AutoFill Passwords") by tapping
the dismissal button ("Not Now", "Never for This Website", "Don't Save").

Also adds two screenshots so the next failure isn't blind:
- debug-04-after-password-continue at the end of sign-in
- debug-assert-signed-in-state at the start of assert-signed-in

Move 'Sign Out' to the lead assertion at 20s timeout. It's the same
shape (TouchableOpacity > Text) that Android already passes against,
so if it fails we know we're not actually signed in; if Sign Out passes
but Manage Profile still times out, we have a specific iOS accessibility
quirk to chase rather than a generic timing issue.

Diagnostic-only reorder — same three assertions, different order.

P1 (cache honesty): the compat-gate pin steps mutate the working tree
(packages/expo/app.plugin.js, packages/expo/android/build.gradle), but the
bin-hash that keys the .app / .apk cache was computed from `git ls-tree -r
HEAD`, which reads committed blobs. A stale cache hit could install an OLD
SDK ref while claiming to test a new one. Fold clerk_ios_ref,
clerk_android_ref, and clerk_android_snapshot_suffix into the hash on both
jobs so the cache key reflects what's actually being built.

P2 (Swift tests on production code): pulled the two pure predicates the
existing tests were mirroring — `isSuccessfulAuth` (from
ClerkAuthWrapperViewController.viewDidDisappear) and the presentWhenReady
guard (from ClerkAuthNativeView) — into ClerkAuthLogic.swift in the pod
source files. ClerkViewFactory.swift now imports ClerkExpo and calls
ClerkAuthSessionLogic; ClerkExpoModule.swift's view layer now calls
ClerkPresentationLogic. The XCTest files `@testable import ClerkExpo`
and exercise the same public symbols production runs against — no more
duplicated logic to drift. The maxPresentationAttempts constant lives on
the production type so a bump can't silently break the test.

P2 (forgot-password OAuth automated): split google-sso-from-forgot-password
into two files. The original bug was that tapping "Sign in with Google"
from the forgot-password screen was a silent no-op on iOS — that part is
now automated by asserting the system OAuth presentation appears
("Wants to Use" / "accounts.google.com" / "Continue" / "google.com").
The actual Google credentialed completion still needs real OAuth and lives
in google-sso-from-forgot-password-manual.yaml with the `manual` tag, so
the default workflow exclude (manual,skip) keeps it out of CI but it's
runnable as a one-off.

P2 (local scripts pre-filter): Maestro's `--exclude-tags` is a no-op when
explicit file paths are passed, which run-ios.sh / run-android.sh /
run-regressions.sh all do. Added scripts/lib/filter-flows.sh — a shared
helper that scans each flow's YAML frontmatter for tag-list entries
matching the excluded set — and routed all three scripts through it
before they invoke maestro.

The Android pre-filter was only excluding "flakyAndroid" on top of the
user-supplied EXCLUDE_TAGS — it never excluded the platform-scope tag
"iosOnly", so any flow tagged iosOnly was being run on the Android
emulator anyway. Caught by the new google-sso-from-forgot-password
flow, which is correctly tagged iosOnly but failed on Android because
the system OAuth presentation strings ("Wants to Use" /
"accounts.google.com" / "Continue") never appear there.

iOS already had the symmetric guard ("$EXCLUDE_TAGS,androidOnly").

Android side: artifact screenshots from yesterday's gate-run failure
showed the AuthView fully rendered with the email field's placeholder
text on screen, but Maestro's accessibility-tree query for it timed out
after 25s. That's a known cold-emulator quirk — the screen renders
before the a11y tree is fully populated, and whichever flow happens to
run first eats the cost. Added a one-shot warmup against
flows/common/_warmup.yaml before the per-flow xargs loop so the JS
bundle and a11y tree are primed when the real flows start. Also added
`| sort` to the find pipeline so flow ordering is deterministic across
runs.

iOS side: `expo run:ios` BUILT and INSTALLED successfully, then tried
to deep-link com.<bundle>://expo-development-client/?url=http://<LAN-IP>:8081
to launch the dev launcher. On GitHub-hosted macos-15 runners the LAN
IP is unreachable from the simulator and `xcrun simctl openurl` times
out at 60s, exiting the expo CLI with code 1 even though the .app is
sitting in DerivedData ready to use. We don't need the post-install
launch (Maestro re-installs and opens the app cleanly later), so trap
the exit code and let the .app-exists check below decide whether to
proceed. Caught by today's manual full e2e run where the iOS job failed
with "Operation timed out" right after "Build Succeeded".