[PAY-3439] Add hono to create-audius-app

[raymondjacobson]

Description

npx create-audius-app

Will by default now give you a full-stack framework with a cloudflare-ready deployable serverless backend

• Add additional example called react-hono and make that the default.
• Slim down existing react to not do writes.
• Add AuthContext for the hono example, so there's session login built-in
• Add hook for useSdk
• Update tests & CI

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Provide repro instructions & any configuration.

Ran both examples locally and ran tests

For the react-hono one, to test

# copy example.env to .env
npm i
npm run dev
# or
npm run start # previews with wrangler

[changeset-bot]

🦋 Changeset detected

Latest commit: a974494

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@audius/sdk	Patch
create-audius-app	Patch
@audius/sp-actions	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[audius-infra]

Preview this change https://demo.audius.co/rj-pay-3439

[audius-infra]

Preview this change https://demo.audius.co/rj-pay-3439

[audius-infra]

Preview this change https://demo.audius.co/rj-pay-3439

[audius-infra]

Preview this change https://demo.audius.co/rj-pay-3439

[gitguardian]

⚠️ GitGuardian has uncovered 13 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
11648675	Triggered	Generic High Entropy Secret	34423d4	mediorum/mediorum_pkg/run.go	View secret
11648675	Triggered	Generic High Entropy Secret	34423d4	mediorum/main.go	View secret
11648678	Triggered	Generic High Entropy Secret	34423d4	mediorum/main.go	View secret
11648678	Triggered	Generic High Entropy Secret	34423d4	mediorum/mediorum_pkg/run.go	View secret
11648679	Triggered	Generic High Entropy Secret	34423d4	core/infra/dev_config/standalone-console.env	View secret
11648679	Triggered	Generic High Entropy Secret	34423d4	mediorum/main.go	View secret
11648679	Triggered	Generic High Entropy Secret	34423d4	mediorum/mediorum_pkg/run.go	View secret
11648680	Triggered	Generic High Entropy Secret	34423d4	mediorum/mediorum_pkg/run.go	View secret
11648680	Triggered	Generic High Entropy Secret	34423d4	mediorum/main.go	View secret
11648681	Triggered	Generic High Entropy Secret	34423d4	mediorum/mediorum_pkg/run.go	View secret
11648681	Triggered	Generic High Entropy Secret	34423d4	mediorum/main.go	View secret
2416685	Triggered	Generic High Entropy Secret	e16593a	packages/libs/src/sdk/config/staging.ts	View secret
2460750	Triggered	Generic High Entropy Secret	e16593a	packages/libs/src/sdk/config/production.ts	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secrets safely. Learn here the best practices.
3. Revoke and rotate these secrets.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[sliptype]

So many small details to get this working! Nice job

[samgutentag]

lgtm!

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@audius/harmony@0.2.0	environment Transitive: eval, filesystem, network, unsafe	+140	64.7 MB	sliptype
npm/@audius/sdk@5.1.0	eval Transitive: environment, filesystem, network, shell, unsafe	+431	201 MB	sliptype
npm/@tanstack/react-query@5.32.0	environment	+1	3.84 MB	tannerlinsley
npm/@types/react-dom@18.2.0	None	0	29.1 kB	types
npm/@types/react@18.2.0	None	+3	1.61 MB	types
npm/@typescript-eslint/eslint-plugin@6.0.0	Transitive: environment, filesystem	+45	8.12 MB	jameshenry
npm/@typescript-eslint/parser@6.0.0	Transitive: environment, filesystem	+31	2.94 MB	jameshenry
npm/@vitejs/plugin-react@4.0.3	Transitive: environment, filesystem, shell, unsafe	+52	11.7 MB	vitebot
npm/env-cmd@10.1.0	environment, filesystem Transitive: shell	+5	170 kB	toddbluhm
npm/eslint-plugin-react-hooks@4.6.0	environment	0	118 kB	gnoff
npm/eslint-plugin-react-refresh@0.4.3	None	0	11.6 kB	arnaud-barre
npm/eslint@8.56.0	environment, filesystem Transitive: eval, shell, unsafe	+92	10.7 MB	eslintbot
npm/react-dom@18.2.0	environment	+3	4.62 MB	gnoff
npm/react@18.2.0	environment	+2	337 kB	gnoff
npm/typescript@5.0.2	None	0	39.2 MB	typescript-bot
npm/vite@4.4.5	environment, eval, filesystem, network, shell, unsafe	+32	252 MB	vitebot

🚮 Removed packages:npm/@alch/alchemy-web3@1.4.6, npm/@amplitude/node@1.9.2, npm/@amplitude/react-native@2.17.2, npm/@apollo/client@3.3.7, npm/@apollo/protobufjs@1.2.7, npm/@apollo/usage-reporting-protobuf@4.1.1, npm/@apollo/utils.dropunuseddefinitions@2.0.1, npm/@apollo/utils.keyvaluecache@2.1.1, npm/@apollo/utils.logger@2.0.1, npm/@apollo/utils.printwithreducedwhitespace@2.0.1, npm/@apollo/utils.removealiases@2.0.1, npm/@apollo/utils.sortast@2.0.1, npm/@apollo/utils.stripsensitiveliterals@2.0.1, npm/@apollo/utils.usagereporting@2.1.0, npm/@audius/fetch-nft@0.2.7, npm/@babel/cli@7.7.0, npm/@babel/code-frame@7.23.5, npm/@babel/compat-data@7.23.5, npm/@babel/generator@7.23.6, npm/@babel/helper-annotate-as-pure@7.22.5, npm/@babel/helper-compilation-targets@7.23.6, npm/@babel/helper-define-polyfill-provider@0.3.3, npm/@babel/helper-environment-visitor@7.22.20, npm/@babel/helper-function-name@7.23.0, npm/@babel/helper-hoist-variables@7.22.5, npm/@babel/helper-module-imports@7.22.15, npm/@babel/helper-plugin-utils@7.22.5, npm/@babel/helper-split-export-declaration@7.22.6, npm/@babel/helper-validator-identifier@7.22.20, npm/@babel/helper-validator-option@7.23.5, npm/@babel/highlight@7.23.4, npm/@babel/parser@7.24.1, npm/@babel/plugin-transform-react-jsx@7.21.0, npm/@babel/plugin-transform-runtime@7.18.2, npm/@babel/preset-env@7.22.15, npm/@babel/preset-typescript@7.22.15, npm/@babel/register@7.7.0, npm/@babel/template@7.22.15, npm/@babel/traverse@7.23.6, npm/@babel/types@7.23.6, npm/@changesets/cli@2.27.1, npm/@coinbase/cbpay-js@1.2.0, npm/@coinflowlabs/react@3.1.5, npm/@elastic/elasticsearch@8.1.0, npm/@emotion/babel-plugin@11.11.0, npm/@emotion/babel-preset-css-prop@11.11.0, npm/@emotion/css@11.11.2, npm/@emotion/eslint-plugin@11.11.0, npm/@emotion/is-prop-valid@1.2.1, npm/@emotion/memoize@0.8.1, npm/@emotion/native@11.11.0, npm/@emotion/react@11.11.1, npm/@emotion/server@11.11.0, npm/@emotion/styled@11.11.0, npm/@emotion/unitless@0.8.1, npm/@escape.tech/mookme@2.4.1, npm/@eslint-community/regexpp@4.10.0, npm/@ethereumjs/common@3.2.0, npm/@ethereumjs/tx@4.2.0, npm/@fingerprintjs/fingerprintjs-pro-server-api@4.1.2, npm/@fingerprintjs/fingerprintjs-pro@3.5.6, npm/@google/model-viewer@3.3.0, npm/@gorhom/bottom-sheet@4.6.4, npm/@gorhom/portal@1.0.9, npm/@graphql-tools/merge@8.4.2, npm/@graphql-tools/schema@9.0.19, npm/@graphql-tools/utils@9.2.1, npm/@graphql-typed-document-node/core@3.2.0, npm/@hcaptcha/react-hcaptcha@0.3.6, npm/@humanwhocodes/config-array@0.11.13, npm/@isaacs/cliui@8.0.2, npm/@josephg/resolvable@1.0.1, npm/@jridgewell/resolve-uri@3.1.1, npm/@jridgewell/set-array@1.1.2, npm/@jridgewell/sourcemap-codec@1.4.15, npm/@jridgewell/trace-mapping@0.3.20, npm/@juggle/resize-observer@3.3.1, npm/@jup-ag/api@6.0.6, npm/alchemy-sdk@2.0.1, npm/prom-client@14.0.1

View full report↗︎

[socket-security]

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note	Source	CI
AI-detected potential code anomaly	npm/esm@3.2.25	Notes: The code exhibits behavior that allows for the dynamic loading and execution of untrusted code, which poses a significant security risk. The use of 'proto' directly on objects and manipulation of 'module' properties further increases the risk. Confidence: 1.00 Severity: 0.60	packages/ddex/entrypoint/package.json	🚫
Protestware or potentially unwanted behavior	npm/es5-ext@0.10.64	Note: This package prints a protestware console message on install regarding Ukraine for users with Russian language locale	Source	⚠︎

View full report↗︎

Next steps

What is an AI-detected potential code anomaly?

AI has identified unusual behaviors that may pose a security risk.

An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

What is protestware?

This package is a joke, parody, or includes undocumented or hidden behavior unrelated to its primary function.

Consider that consuming this package may come along with functionality unrelated to its primary purpose.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

• @SocketSecurity ignore npm/esm@3.2.25
• @SocketSecurity ignore npm/es5-ext@0.10.64