@callstack/react-native-brownfield 5.0.2 → 5.1.1

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/plugin/RNBrownfieldPlugin.kt

@@ -3,6 +3,7 @@ package com.callstack.react.brownfield.plugin
 import com.android.build.api.variant.LibraryAndroidComponentsExtension
 import com.android.build.api.variant.LibraryVariant
 import com.callstack.react.brownfield.artifacts.ArtifactsResolver
+import com.callstack.react.brownfield.artifacts.RncTransitiveDependencyDiscoverer
 import com.callstack.react.brownfield.expo.ExpoPublishingHelper
 import com.callstack.react.brownfield.expo.utils.ExpoGradleProjectProjection
 import com.callstack.react.brownfield.processors.AssetTaskProcessor
@@ -15,9 +16,13 @@ import com.callstack.react.brownfield.processors.VariantHelper
 import com.callstack.react.brownfield.processors.VariantPackagesProperty
 import com.callstack.react.brownfield.processors.VariantTaskProvider
 import com.callstack.react.brownfield.shared.BaseProject
+import com.callstack.react.brownfield.shared.Constants
 import com.callstack.react.brownfield.shared.Constants.PROJECT_ID
 import com.callstack.react.brownfield.shared.Logging
+import com.callstack.react.brownfield.shared.PublishingMetadataInjector
 import com.callstack.react.brownfield.shared.UnresolvedArtifactInfo
+import com.callstack.react.brownfield.shared.VersionMediatingDependencySet
+import com.callstack.react.brownfield.shared.dropHardExcludedDependencies
 import com.callstack.react.brownfield.utils.AndroidArchiveLibrary
 import com.callstack.react.brownfield.utils.DirectoryManager
 import com.callstack.react.brownfield.utils.Extension
@@ -54,8 +59,9 @@ class RNBrownfieldPlugin : Plugin<Project> {
         }
 
         var expoProjects = listOf<ExpoGradleProjectProjection>()
+        var expoPublishingHelper: ExpoPublishingHelper? = null
         if (this.isExpoProject) {
-            val expoPublishingHelper = ExpoPublishingHelper(brownfieldAppProject = project)
+            expoPublishingHelper = ExpoPublishingHelper(brownfieldAppProject = project)
             expoProjects = expoPublishingHelper.configure()
         }
 
@@ -65,6 +71,18 @@ class RNBrownfieldPlugin : Plugin<Project> {
         val artifactsResolver = ArtifactsResolver(project, isExpoProject)
         val artifacts = artifactsResolver.processDefaultDependencies(expoProjects)
 
+        // Registered eagerly: Gradle disallows registering tasks from afterEvaluate. Only the
+        // dependency set supplied below has to wait.
+        val injector = PublishingMetadataInjector(project)
+
+        // whenReady, not afterEvaluate: afterEvaluate guarantees only that *this* project is
+        // configured, not the embedded module projects we read dependencies from — theirs were
+        // empirically still empty at that point. whenReady fires once the whole task graph is
+        // resolved (so every embedded module is configured) but before any task runs.
+        project.gradle.taskGraph.whenReady {
+            configureTransitiveDependencyInjection(project, injector, expoPublishingHelper, expoProjects, artifacts)
+        }
+
         val variantTaskProvider = VariantTaskProvider(project)
 
         val androidComponents = project.extensions.getByType(LibraryAndroidComponentsExtension::class.java)
@@ -77,6 +95,79 @@ class RNBrownfieldPlugin : Plugin<Project> {
         const val EXPO_PROJECT_LOCATOR = ":expo"
     }
 
+    @Suppress("LongMethod")
+    private fun configureTransitiveDependencyInjection(
+        project: Project,
+        injector: PublishingMetadataInjector,
+        expoPublishingHelper: ExpoPublishingHelper?,
+        expoProjects: List<ExpoGradleProjectProjection>,
+        artifacts: List<UnresolvedArtifactInfo>,
+    ) {
+        val transitiveDeps = VersionMediatingDependencySet()
+        var rncSupersededCoordinates: Set<Pair<String, String>> = emptySet()
+
+        if (isExpoProject && expoPublishingHelper != null) {
+            val expoTransitiveDeps = expoPublishingHelper.discoverAllExpoTransitiveDependencies(expoProjects)
+            Logging.log("Merged ${expoTransitiveDeps.size} transitive dependencies discovered from Expo")
+            expoTransitiveDeps.forEach {
+                Logging.log(
+                    "(*) dependency ${it.groupId}:${it.artifactId}:${it.version} (scope: ${it.scope}, " +
+                        "${if (it.optional) "optional" else "required"})",
+                )
+            }
+            transitiveDeps.addAll(expoTransitiveDeps)
+        }
+        // Never on Expo: the path above already covers every embedded module there, and the RNC
+        // discoverer doesn't filter by the Expo blacklist, so running both leaks Expo coordinates.
+        if (!isExpoProject && extension.experimentalIncludeTransitiveDependencies) {
+            val rncDiscovery = RncTransitiveDependencyDiscoverer(project).discover(artifacts)
+            Logging.log(
+                "Merged ${rncDiscovery.dependencies.size} transitive dependencies discovered by the RNC discoverer",
+            )
+            transitiveDeps.addAll(rncDiscovery.dependencies)
+            rncSupersededCoordinates = rncDiscovery.supersededCoordinates
+        }
+
+        if (isExpoProject || extension.experimentalIncludeTransitiveDependencies) {
+            // Coordinates that must never be published: they're embedded in the AAR, not
+            // resolvable from Maven. Distinct from "superseded" coordinates, which ARE re-injected
+            // (replacing a stale entry) and so must not be dropped here.
+            val hardExcludePredicate: (String, String) -> Boolean = { groupId, artifactId ->
+                (expoPublishingHelper?.shouldExcludeDependency(groupId, artifactId) ?: (groupId == project.rootProject.name)) ||
+                    artifacts.any { it.moduleGroup == groupId && it.moduleName == artifactId }
+            }
+            dropHardExcludedDependencies(transitiveDeps, hardExcludePredicate)
+
+            Logging.log(
+                "Total of ${transitiveDeps.size} unique transitive dependencies merged for POM/module.json injection",
+            )
+
+            val removalPredicate: (String, String) -> Boolean = { groupId, artifactId ->
+                hardExcludePredicate(groupId, artifactId) || rncSupersededCoordinates.contains(groupId to artifactId)
+            }
+
+            injector.configure(transitiveDeps, removalPredicate)
+            Logging.log("PublishingMetadataInjector ran: injected merged transitive dependencies into POM and Gradle Module Metadata")
+
+            // Informational only — throwing would recreate the upgrade break that the namespaced
+            // task name exists to prevent. `names` avoids realizing the task from whenReady.
+            if (project.tasks.names.contains(Constants.LEGACY_CONSUMER_MODULE_METADATA_TASK_NAME)) {
+                Logging.log(
+                    "NOTE: this project still registers a hand-written " +
+                        "'${Constants.LEGACY_CONSUMER_MODULE_METADATA_TASK_NAME}' task. The plugin now performs " +
+                        "that removal itself (plus transitive-dependency injection) via " +
+                        "'${Constants.MODULE_METADATA_POST_PROCESS_TASK_NAME}'. The hand-written task is " +
+                        "redundant and can be deleted; leaving it in place is harmless.",
+                )
+            }
+        } else {
+            Logging.log(
+                "PublishingMetadataInjector skipped: project is not an Expo project and " +
+                    "experimentalIncludeTransitiveDependencies is disabled",
+            )
+        }
+    }
+
     private fun initializers() {
         RClassTransformer.project = project
         Logging.project = project

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/Constants.kt

@@ -1,6 +1,5 @@
 package com.callstack.react.brownfield.shared
 
-import com.callstack.react.brownfield.expo.utils.DependencyInfo
 import com.callstack.react.brownfield.utils.StringMatcher
 
 /**
@@ -40,6 +39,18 @@ object Constants {
 
     const val INTERMEDIATES_TEMP_DIR = PLUGIN_NAME
 
+    /**
+     * Plugin-owned task that post-processes generated Gradle Module Metadata.
+     *
+     * Never rename to the bare [LEGACY_CONSUMER_MODULE_METADATA_TASK_NAME]: the plugin registers
+     * during `apply()`, before the consumer's script body, so claiming that name breaks every
+     * consumer still following the setup docs with "a task with that name already exists".
+     */
+    const val MODULE_METADATA_POST_PROCESS_TASK_NAME = "brownfieldRemoveDependenciesFromModuleFile"
+
+    /** The name the setup docs tell consumers to register themselves; must stay free for them. */
+    const val LEGACY_CONSUMER_MODULE_METADATA_TASK_NAME = "removeDependenciesFromModuleFile"
+
     val BROWNFIELD_EXPO_TRANSITIVE_DEPS_WHITELISTED_MODULES_FOR_DISCOVERY =
         setOf("expo-modules-core", "expo-constants", "expo", "expo-updates")
     val BROWNFIELD_EXPO_TRANSITIVE_DEPS_ARTIFACTS_BLACKLIST =

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/{expo/utils/BrownfieldPrimitives.kt → shared/DependencyInfo.kt}

@@ -1,10 +1,4 @@
-package com.callstack.react.brownfield.expo.utils
-
-data class BrownfieldPublishingInfo(
-    val groupId: String,
-    val artifactId: String,
-    val version: String,
-)
+package com.callstack.react.brownfield.shared
 
 data class DependencyInfo(
     val groupId: String,
@@ -18,12 +12,13 @@ data class DependencyInfo(
             groupId: String,
             artifactId: String,
             version: String?,
+            scope: String = "compile",
         ): DependencyInfo {
             return DependencyInfo(
                 groupId = groupId,
                 artifactId = artifactId,
                 version = version,
-                scope = "compile",
+                scope = scope,
                 optional = false,
             )
         }

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/DependencyPublishability.kt

@@ -0,0 +1,22 @@
+package com.callstack.react.brownfield.shared
+
+/** Matches Maven/Gradle version-range syntax, e.g. `[1.0,2.0)`, `(,2.0]`, `[1.0,)`. */
+private val VERSION_RANGE_REGEX = Regex("^[\\[(].*,.*[\\])]$")
+
+/** Reserved Gradle/Maven dynamic-version keywords that resolve to whatever is newest at build time. */
+private val DYNAMIC_VERSION_KEYWORDS = setOf("latest.release", "latest.integration", "latest", "release")
+
+/**
+ * Whether [dependency] is safe to publish as-is. Rejects dynamic versions (`+`, `latest.*`, ranges)
+ * and blank ones: the former resolve non-reproducibly for consumers, the latter emit a
+ * `<dependency>` with no version at all.
+ */
+fun isPublishableCoordinate(dependency: DependencyInfo): Boolean {
+    val version = dependency.version
+    if (version.isNullOrBlank()) return false
+    val trimmed = version.trim()
+    if (trimmed.contains("+")) return false
+    if (trimmed.lowercase() in DYNAMIC_VERSION_KEYWORDS) return false
+    if (VERSION_RANGE_REGEX.matches(trimmed)) return false
+    return true
+}

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/GradleDependencyCollector.kt

@@ -0,0 +1,44 @@
+package com.callstack.react.brownfield.shared
+
+import org.gradle.api.Project
+import org.gradle.api.internal.artifacts.dependencies.DefaultProjectDependency
+
+/**
+ * Configurations inspected when discovering a project's direct external dependencies.
+ *
+ * Not flavor-aware — `releaseImplementation` and friends are missed. Fine for Expo packages, which
+ * don't use them; extend if an RNC-CLI native module turns out to.
+ */
+val TRANSITIVE_DEPENDENCY_CONFIG_NAMES = listOf("implementation", "api", "runtimeOnly")
+
+/** Maven scope per configuration; `runtimeOnly` maps to `runtime` to keep it off the compile classpath. */
+private val CONFIG_NAME_TO_SCOPE =
+    mapOf(
+        "implementation" to "compile",
+        "api" to "compile",
+        "runtimeOnly" to "runtime",
+    )
+
+/**
+ * [project]'s direct external (non-project) dependencies on [TRANSITIVE_DEPENDENCY_CONFIG_NAMES],
+ * minus anything [isPublishableCoordinate] rejects. Shared by the Expo fallback and RNC paths so
+ * both get the same guarantees.
+ */
+fun collectPublishableGradleDependencies(project: Project): List<DependencyInfo> {
+    val result = mutableListOf<DependencyInfo>()
+
+    TRANSITIVE_DEPENDENCY_CONFIG_NAMES.forEach { configName ->
+        val configuration = project.configurations.findByName(configName) ?: return@forEach
+        val scope = CONFIG_NAME_TO_SCOPE.getValue(configName)
+
+        configuration.dependencies.forEach { dependency ->
+            if (dependency is DefaultProjectDependency) return@forEach
+            val group = dependency.group ?: return@forEach
+
+            val info = DependencyInfo.fromGradleDep(group, dependency.name, dependency.version, scope)
+            if (isPublishableCoordinate(info)) result.add(info)
+        }
+    }
+
+    return result
+}

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/PublishingMetadataInjector.kt

@@ -0,0 +1,181 @@
+package com.callstack.react.brownfield.shared
+
+import groovy.json.JsonOutput
+import groovy.json.JsonSlurper
+import groovy.util.Node
+import groovy.util.NodeList
+import org.gradle.api.Project
+import org.gradle.api.publish.PublishingExtension
+import org.gradle.api.publish.maven.MavenPublication
+import org.gradle.api.publish.tasks.GenerateModuleMetadata
+
+/**
+ * Removes every `<dependency>` matching [shouldExclude] from [dependenciesNode], then appends one
+ * per entry in [dependencies].
+ *
+ * Removal must run before appending: [shouldExclude] matches on coordinate alone, so afterwards it
+ * couldn't tell a stale superseded entry from the one just appended for it, and would drop both.
+ */
+internal fun mutatePomDependenciesNode(
+    dependenciesNode: Node,
+    dependencies: VersionMediatingDependencySet,
+    shouldExclude: (groupId: String, artifactId: String) -> Boolean,
+) {
+    dependenciesNode.children()
+        .filterIsInstance<Node>()
+        .filter { dependency ->
+            val groupId = (dependency["groupId"] as NodeList).text()
+            val artifactId = (dependency["artifactId"] as NodeList).text()
+            shouldExclude(groupId, artifactId)
+        }
+        .forEach { dependency ->
+            dependenciesNode.remove(dependency)
+        }
+
+    dependencies.forEach { dependencyToAdd ->
+        val childTags =
+            mutableMapOf(
+                "groupId" to dependencyToAdd.groupId,
+                "artifactId" to dependencyToAdd.artifactId,
+                "scope" to dependencyToAdd.scope,
+                "optional" to dependencyToAdd.optional.toString(),
+            )
+
+        if (dependencyToAdd.version?.isNotBlank() == true) {
+            childTags["version"] = dependencyToAdd.version
+        }
+
+        dependenciesNode.appendNode("dependency").let { newDepNode ->
+            childTags.forEach { (tagName, tagValue) ->
+                newDepNode.appendNode(tagName, tagValue)
+            }
+        }
+    }
+}
+
+/**
+ * The POM's `<dependencies>` element, created if absent — a publication with no dependencies has
+ * none, and `first()` throws on it. Extracted so tests exercise this code rather than
+ * reimplementing the fallback and passing regardless of what production does.
+ */
+internal fun resolveOrCreateDependenciesNode(root: Node): Node =
+    (root.get("dependencies") as NodeList).firstOrNull() as? Node
+        ?: root.appendNode("dependencies")
+
+/**
+ * The `module.json` equivalent of [mutatePomDependenciesNode], applied to every variant's
+ * `dependencies` list. Same removal-before-append requirement, for the same reason.
+ */
+internal fun mutateModuleJsonVariants(
+    json: Map<*, *>,
+    dependencies: VersionMediatingDependencySet,
+    shouldExclude: (groupId: String, artifactId: String) -> Boolean,
+) {
+    @Suppress("UNCHECKED_CAST")
+    (json["variants"] as? List<MutableMap<String, Any>>)?.forEach { variant ->
+        (variant["dependencies"] as? MutableList<Map<String, Any>>)?.removeAll {
+            val group = it["group"] as String
+            val module = it["module"] as String
+            shouldExclude(group, module)
+        }
+    }
+
+    dependencies.forEach { dependencyToAdd ->
+        @Suppress("UNCHECKED_CAST")
+        (json["variants"] as? List<MutableMap<String, Any>>)?.forEach { variant ->
+            // Known gap: every dependency lands in every variant, so runtime-scoped ones are
+            // compile-visible to Gradle consumers. A fix must key on provenance, NOT on
+            // `scope`, which means different things per path: on the Expo path "runtime" is what
+            // Gradle emits for `implementation` (73 of 84 deps across the upstream Expo POMs), on
+            // the RNC path it means `runtimeOnly`. Filtering on it would strip react-android and
+            // appcompat from Expo consumers. Needs a `fromRuntimeOnlyConfiguration` flag on
+            // DependencyInfo, and its own PR.
+            (variant["dependencies"] as? MutableList<MutableMap<String, Any>>)?.add(
+                mutableMapOf<String, Any>(
+                    "group" to dependencyToAdd.groupId,
+                    "module" to dependencyToAdd.artifactId,
+                ).apply {
+                    dependencyToAdd.version?.let { version ->
+                        put("version", mapOf("requires" to version))
+                    }
+                },
+            )
+        }
+    }
+}
+
+/**
+ * Injects transitive dependencies into the generated Maven POM and Gradle Module Metadata for
+ * every `MavenPublication` on [project], removing any existing entry the exclusion predicate
+ * matches. Used identically by the Expo and RNC-CLI paths.
+ *
+ * Hooks are registered eagerly on construction, since Gradle disallows registering tasks from
+ * `afterEvaluate`. The dependency set isn't known until then, so [configure] supplies it later;
+ * until it's called, injection is disabled and the hooks are no-ops.
+ */
+class PublishingMetadataInjector(private val project: Project) {
+    private var dependencies = VersionMediatingDependencySet()
+    private var shouldExclude: (groupId: String, artifactId: String) -> Boolean = { _, _ -> false }
+    private var enabled = false
+
+    init {
+        registerModuleJsonInjectors()
+        registerPomInjector()
+    }
+
+    /** Supplies the dependencies to inject and enables injection on the hooks registered in [init]. */
+    fun configure(
+        dependencies: VersionMediatingDependencySet,
+        shouldExclude: (groupId: String, artifactId: String) -> Boolean,
+    ) {
+        this.dependencies = dependencies
+        this.shouldExclude = shouldExclude
+        this.enabled = true
+    }
+
+    private fun registerModuleJsonInjectors() {
+        // One task, not one per publication registered from a GenerateModuleMetadata
+        // configureEach — that crashes with "DefaultTaskContainer#register(String) ... cannot be
+        // executed in the current context". Walking each task's outputFile at execution time also
+        // avoids hardcoding a publication name. Name is namespaced: see Constants.
+        val removeDependenciesFromModuleFileTask =
+            project.tasks.register(Constants.MODULE_METADATA_POST_PROCESS_TASK_NAME)
+        removeDependenciesFromModuleFileTask.configure { task ->
+            task.onlyIf { enabled }
+            task.doLast {
+                project.tasks.withType(GenerateModuleMetadata::class.java).forEach { metadataTask ->
+                    val moduleFile = metadataTask.outputFile.get().asFile
+                    if (!moduleFile.exists()) return@forEach
+
+                    val json = moduleFile.inputStream().use { JsonSlurper().parse(it) as Map<*, *> }
+                    mutateModuleJsonVariants(json, dependencies, shouldExclude)
+                    moduleFile.writer().use {
+                        it.write(JsonOutput.prettyPrint(JsonOutput.toJson(json)))
+                    }
+                }
+            }
+        }
+
+        // Finalizing with an already-registered task is safe here, unlike registering one.
+        project.tasks.withType(GenerateModuleMetadata::class.java).configureEach { metadataTask ->
+            metadataTask.finalizedBy(removeDependenciesFromModuleFileTask)
+        }
+    }
+
+    private fun registerPomInjector() {
+        project.pluginManager.withPlugin("maven-publish") {
+            project.extensions.configure(PublishingExtension::class.java) { publishing ->
+                publishing.publications.withType(MavenPublication::class.java)
+                    .configureEach { pub ->
+                        pub.pom.withXml {
+                            if (!enabled) return@withXml
+
+                            val root = it.asNode()
+                            val dependenciesNode = resolveOrCreateDependenciesNode(root)
+                            mutatePomDependenciesNode(dependenciesNode, dependencies, shouldExclude)
+                        }
+                    }
+            }
+        }
+    }
+}

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/TransitiveDependencyFiltering.kt

@@ -0,0 +1,17 @@
+package com.callstack.react.brownfield.shared
+
+/**
+ * Drops coordinates matching [hardExcludePredicate] — ones that are embedded in the AAR and so
+ * would never resolve from Maven. A discovery path can surface these without knowing it: the RNC
+ * discoverer has no Expo awareness, so an embedded module depending on an Expo module coordinate
+ * would otherwise be published as an ordinary dependency.
+ *
+ * [hardExcludePredicate] must never include superseded coordinates — those are meant to be
+ * re-injected with the mediated version, and dropping them here removes them entirely.
+ */
+internal fun dropHardExcludedDependencies(
+    transitiveDeps: VersionMediatingDependencySet,
+    hardExcludePredicate: (groupId: String, artifactId: String) -> Boolean,
+): VersionMediatingDependencySet {
+    return transitiveDeps.filter { !hardExcludePredicate(it.groupId, it.artifactId) }
+}

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/{expo/utils → shared}/VersionMediatingDependencySet.kt

@@ -1,4 +1,4 @@
-package com.callstack.react.brownfield.expo.utils
+package com.callstack.react.brownfield.shared
 
 import io.github.g00fy2.versioncompare.Version
 

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/utils/Extension.kt

@@ -53,4 +53,15 @@ open class Extension {
      * listOf("libdatadog-ndk.so")
      */
     var ignoreEmbeddedLibs = listOf<String>()
+
+    /**
+     * Whether to publish embedded native modules' third-party dependencies into the generated POM
+     * and Gradle Module Metadata, so consuming apps resolve them instead of declaring them by hand.
+     *
+     * Experimental; behavior may still change. Applies to non-Expo (RNC CLI) projects only — Expo
+     * gets this unconditionally. Set to `false` to hand-declare them instead.
+     *
+     * Default is `true`.
+     */
+    var experimentalIncludeTransitiveDependencies = true
 }

package/gradle-plugin/brownfield/src/test/kotlin/com/callstack/react/brownfield/artifacts/RncTransitiveDependencyDiscovererTest.kt

@@ -0,0 +1,171 @@
+package com.callstack.react.brownfield.artifacts
+
+import com.callstack.react.brownfield.shared.DependencyInfo
+import com.callstack.react.brownfield.shared.UnresolvedArtifactInfo
+import org.gradle.testfixtures.ProjectBuilder
+import org.junit.jupiter.api.Test
+import kotlin.test.assertEquals
+import kotlin.test.assertFalse
+import kotlin.test.assertTrue
+
+class RncTransitiveDependencyDiscovererTest {
+    private fun defaultArtifacts(root: org.gradle.api.Project) =
+        listOf(
+            UnresolvedArtifactInfo(
+                moduleGroup = root.name,
+                moduleName = "react-native-fake-module",
+                moduleVersion = "unspecified",
+                file = null,
+                isExpoPublishDependency = false,
+            ),
+        )
+
+    @Test
+    fun `a dynamic consumer-declared version never becomes a mediation candidate`() {
+        // Module-side versions are validated by collectPublishableGradleDependencies; the
+        // consumer side must be validated too, or `1.+` can win mediation and be published.
+        val root = ProjectBuilder.builder().build()
+        val consumer = ProjectBuilder.builder().withParent(root).withName("BrownfieldLib").build()
+        val embeddedModule = ProjectBuilder.builder().withParent(root).withName("react-native-fake-module").build()
+
+        embeddedModule.configurations.create("implementation")
+        embeddedModule.dependencies.add("implementation", "androidx.appcompat:appcompat:1.0.0")
+
+        consumer.configurations.create("implementation")
+        consumer.dependencies.add("implementation", "androidx.appcompat:appcompat:1.+")
+
+        val result = RncTransitiveDependencyDiscoverer(consumer).discover(defaultArtifacts(root))
+
+        val appcompat = result.dependencies.first { it.groupId == "androidx.appcompat" }
+        assertEquals("1.0.0", appcompat.version, "the dynamic consumer version must not win mediation")
+        assertFalse(result.dependencies.any { it.version == "1.+" }, "'1.+' must never reach the published set")
+    }
+
+    @Test
+    fun `a versionless consumer declaration still supersedes, so the coordinate is not duplicated`() {
+        // Declared via BOM/platform, so `.version` is null. A version-only lookup returns null
+        // here, never marks the coordinate superseded, and leaves two entries for it in the POM.
+        val root = ProjectBuilder.builder().build()
+        val consumer = ProjectBuilder.builder().withParent(root).withName("BrownfieldLib").build()
+        val embeddedModule = ProjectBuilder.builder().withParent(root).withName("react-native-fake-module").build()
+
+        embeddedModule.configurations.create("implementation")
+        embeddedModule.dependencies.add("implementation", "androidx.appcompat:appcompat:1.7.1")
+
+        consumer.configurations.create("implementation")
+        consumer.dependencies.add("implementation", "androidx.appcompat:appcompat")
+
+        val result = RncTransitiveDependencyDiscoverer(consumer).discover(defaultArtifacts(root))
+
+        assertTrue(
+            result.supersededCoordinates.contains("androidx.appcompat" to "appcompat"),
+            "a declared-but-versionless coordinate must still be superseded",
+        )
+        assertEquals("1.7.1", result.dependencies.first { it.groupId == "androidx.appcompat" }.version)
+    }
+
+    @Test
+    fun `discovers a module's direct external dependencies, skipping project deps and non-publishable coordinates`() {
+        val root = ProjectBuilder.builder().build()
+        val consumer = ProjectBuilder.builder().withParent(root).withName("BrownfieldLib").build()
+        val embeddedModule = ProjectBuilder.builder().withParent(root).withName("react-native-fake-module").build()
+        val siblingProject = ProjectBuilder.builder().withParent(root).withName("some-other-module").build()
+
+        embeddedModule.configurations.create("implementation")
+        embeddedModule.configurations.create("api")
+        embeddedModule.configurations.create("runtimeOnly")
+
+        embeddedModule.dependencies.add("implementation", "androidx.appcompat:appcompat:1.7.1")
+        embeddedModule.dependencies.add("implementation", "com.facebook.react:react-native:+")
+        embeddedModule.dependencies.add("runtimeOnly", "androidx.annotation:annotation:1.9.1")
+        embeddedModule.dependencies.add(
+            "implementation",
+            embeddedModule.dependencies.project(mapOf("path" to siblingProject.path)),
+        )
+
+        consumer.configurations.create("api")
+
+        val result = RncTransitiveDependencyDiscoverer(consumer).discover(defaultArtifacts(root))
+        val discovered = result.dependencies
+
+        assertEquals(2, discovered.size)
+        assertTrue(
+            discovered.contains(
+                DependencyInfo("androidx.appcompat", "appcompat", "1.7.1", "compile", false),
+            ),
+        )
+        assertTrue(
+            discovered.contains(
+                DependencyInfo("androidx.annotation", "annotation", "1.9.1", "runtime", false),
+            ),
+        )
+        assertFalse(discovered.contains(DependencyInfo("com.facebook.react", "react-native", "+", "compile", false)))
+        assertFalse(discovered.contains(DependencyInfo(root.name, "some-other-module", "unspecified", "compile", false)))
+        assertTrue(result.supersededCoordinates.isEmpty())
+    }
+
+    @Test
+    fun `publishes a runtimeOnly dependency under Maven runtime scope, not compile`() {
+        val root = ProjectBuilder.builder().build()
+        val consumer = ProjectBuilder.builder().withParent(root).withName("BrownfieldLib").build()
+        val embeddedModule = ProjectBuilder.builder().withParent(root).withName("react-native-fake-module").build()
+
+        embeddedModule.configurations.create("implementation")
+        embeddedModule.configurations.create("api")
+        embeddedModule.configurations.create("runtimeOnly")
+        embeddedModule.dependencies.add("runtimeOnly", "androidx.annotation:annotation:1.9.1")
+
+        val discovered = RncTransitiveDependencyDiscoverer(consumer).discover(defaultArtifacts(root)).dependencies
+
+        val annotationDep = discovered.first { it.groupId == "androidx.annotation" }
+        assertEquals("runtime", annotationDep.scope)
+    }
+
+    @Test
+    fun `a module's higher version requirement wins over, and supersedes, the consumer's own lower declaration`() {
+        val root = ProjectBuilder.builder().build()
+        val consumer = ProjectBuilder.builder().withParent(root).withName("BrownfieldLib").build()
+        val embeddedModule = ProjectBuilder.builder().withParent(root).withName("react-native-fake-module").build()
+
+        embeddedModule.configurations.create("implementation")
+        embeddedModule.configurations.create("api")
+        embeddedModule.configurations.create("runtimeOnly")
+        embeddedModule.dependencies.add("implementation", "androidx.appcompat:appcompat:1.7.1")
+
+        consumer.configurations.create("api")
+        consumer.dependencies.add("api", "androidx.appcompat:appcompat:1.6.0")
+
+        val result = RncTransitiveDependencyDiscoverer(consumer).discover(defaultArtifacts(root))
+
+        val appcompatDep = result.dependencies.first { it.groupId == "androidx.appcompat" }
+        assertEquals("1.7.1", appcompatDep.version, "the module's higher requirement must win mediation")
+        assertTrue(
+            result.supersededCoordinates.contains("androidx.appcompat" to "appcompat"),
+            "the consumer's stale lower-version entry must be marked for replacement",
+        )
+    }
+
+    @Test
+    fun `does not regress or supersede when the consumer's own version already satisfies the module`() {
+        val root = ProjectBuilder.builder().build()
+        val consumer = ProjectBuilder.builder().withParent(root).withName("BrownfieldLib").build()
+        val embeddedModule = ProjectBuilder.builder().withParent(root).withName("react-native-fake-module").build()
+
+        embeddedModule.configurations.create("implementation")
+        embeddedModule.configurations.create("api")
+        embeddedModule.configurations.create("runtimeOnly")
+        embeddedModule.dependencies.add("implementation", "androidx.appcompat:appcompat:1.6.0")
+
+        consumer.configurations.create("api")
+        consumer.dependencies.add("api", "androidx.appcompat:appcompat:1.7.1")
+
+        val result = RncTransitiveDependencyDiscoverer(consumer).discover(defaultArtifacts(root))
+
+        val appcompatDep = result.dependencies.first { it.groupId == "androidx.appcompat" }
+        assertEquals("1.7.1", appcompatDep.version, "the consumer's already-higher version must be preserved, not downgraded")
+        assertTrue(
+            result.supersededCoordinates.contains("androidx.appcompat" to "appcompat"),
+            "still marked superseded so the injector re-declares it at the mediated (unchanged) version instead of duplicating it",
+        )
+    }
+}