@callstack/react-native-brownfield 5.1.0 → 5.1.1

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/{expo/utils/BrownfieldPrimitives.kt → shared/DependencyInfo.kt}

@@ -1,10 +1,4 @@
-package com.callstack.react.brownfield.expo.utils
-
-data class BrownfieldPublishingInfo(
-    val groupId: String,
-    val artifactId: String,
-    val version: String,
-)
+package com.callstack.react.brownfield.shared
 
 data class DependencyInfo(
     val groupId: String,
@@ -18,12 +12,13 @@ data class DependencyInfo(
             groupId: String,
             artifactId: String,
             version: String?,
+            scope: String = "compile",
         ): DependencyInfo {
             return DependencyInfo(
                 groupId = groupId,
                 artifactId = artifactId,
                 version = version,
-                scope = "compile",
+                scope = scope,
                 optional = false,
             )
         }

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/DependencyPublishability.kt

@@ -0,0 +1,22 @@
+package com.callstack.react.brownfield.shared
+
+/** Matches Maven/Gradle version-range syntax, e.g. `[1.0,2.0)`, `(,2.0]`, `[1.0,)`. */
+private val VERSION_RANGE_REGEX = Regex("^[\\[(].*,.*[\\])]$")
+
+/** Reserved Gradle/Maven dynamic-version keywords that resolve to whatever is newest at build time. */
+private val DYNAMIC_VERSION_KEYWORDS = setOf("latest.release", "latest.integration", "latest", "release")
+
+/**
+ * Whether [dependency] is safe to publish as-is. Rejects dynamic versions (`+`, `latest.*`, ranges)
+ * and blank ones: the former resolve non-reproducibly for consumers, the latter emit a
+ * `<dependency>` with no version at all.
+ */
+fun isPublishableCoordinate(dependency: DependencyInfo): Boolean {
+    val version = dependency.version
+    if (version.isNullOrBlank()) return false
+    val trimmed = version.trim()
+    if (trimmed.contains("+")) return false
+    if (trimmed.lowercase() in DYNAMIC_VERSION_KEYWORDS) return false
+    if (VERSION_RANGE_REGEX.matches(trimmed)) return false
+    return true
+}

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/GradleDependencyCollector.kt

@@ -0,0 +1,44 @@
+package com.callstack.react.brownfield.shared
+
+import org.gradle.api.Project
+import org.gradle.api.internal.artifacts.dependencies.DefaultProjectDependency
+
+/**
+ * Configurations inspected when discovering a project's direct external dependencies.
+ *
+ * Not flavor-aware — `releaseImplementation` and friends are missed. Fine for Expo packages, which
+ * don't use them; extend if an RNC-CLI native module turns out to.
+ */
+val TRANSITIVE_DEPENDENCY_CONFIG_NAMES = listOf("implementation", "api", "runtimeOnly")
+
+/** Maven scope per configuration; `runtimeOnly` maps to `runtime` to keep it off the compile classpath. */
+private val CONFIG_NAME_TO_SCOPE =
+    mapOf(
+        "implementation" to "compile",
+        "api" to "compile",
+        "runtimeOnly" to "runtime",
+    )
+
+/**
+ * [project]'s direct external (non-project) dependencies on [TRANSITIVE_DEPENDENCY_CONFIG_NAMES],
+ * minus anything [isPublishableCoordinate] rejects. Shared by the Expo fallback and RNC paths so
+ * both get the same guarantees.
+ */
+fun collectPublishableGradleDependencies(project: Project): List<DependencyInfo> {
+    val result = mutableListOf<DependencyInfo>()
+
+    TRANSITIVE_DEPENDENCY_CONFIG_NAMES.forEach { configName ->
+        val configuration = project.configurations.findByName(configName) ?: return@forEach
+        val scope = CONFIG_NAME_TO_SCOPE.getValue(configName)
+
+        configuration.dependencies.forEach { dependency ->
+            if (dependency is DefaultProjectDependency) return@forEach
+            val group = dependency.group ?: return@forEach
+
+            val info = DependencyInfo.fromGradleDep(group, dependency.name, dependency.version, scope)
+            if (isPublishableCoordinate(info)) result.add(info)
+        }
+    }
+
+    return result
+}

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/PublishingMetadataInjector.kt

@@ -0,0 +1,181 @@
+package com.callstack.react.brownfield.shared
+
+import groovy.json.JsonOutput
+import groovy.json.JsonSlurper
+import groovy.util.Node
+import groovy.util.NodeList
+import org.gradle.api.Project
+import org.gradle.api.publish.PublishingExtension
+import org.gradle.api.publish.maven.MavenPublication
+import org.gradle.api.publish.tasks.GenerateModuleMetadata
+
+/**
+ * Removes every `<dependency>` matching [shouldExclude] from [dependenciesNode], then appends one
+ * per entry in [dependencies].
+ *
+ * Removal must run before appending: [shouldExclude] matches on coordinate alone, so afterwards it
+ * couldn't tell a stale superseded entry from the one just appended for it, and would drop both.
+ */
+internal fun mutatePomDependenciesNode(
+    dependenciesNode: Node,
+    dependencies: VersionMediatingDependencySet,
+    shouldExclude: (groupId: String, artifactId: String) -> Boolean,
+) {
+    dependenciesNode.children()
+        .filterIsInstance<Node>()
+        .filter { dependency ->
+            val groupId = (dependency["groupId"] as NodeList).text()
+            val artifactId = (dependency["artifactId"] as NodeList).text()
+            shouldExclude(groupId, artifactId)
+        }
+        .forEach { dependency ->
+            dependenciesNode.remove(dependency)
+        }
+
+    dependencies.forEach { dependencyToAdd ->
+        val childTags =
+            mutableMapOf(
+                "groupId" to dependencyToAdd.groupId,
+                "artifactId" to dependencyToAdd.artifactId,
+                "scope" to dependencyToAdd.scope,
+                "optional" to dependencyToAdd.optional.toString(),
+            )
+
+        if (dependencyToAdd.version?.isNotBlank() == true) {
+            childTags["version"] = dependencyToAdd.version
+        }
+
+        dependenciesNode.appendNode("dependency").let { newDepNode ->
+            childTags.forEach { (tagName, tagValue) ->
+                newDepNode.appendNode(tagName, tagValue)
+            }
+        }
+    }
+}
+
+/**
+ * The POM's `<dependencies>` element, created if absent — a publication with no dependencies has
+ * none, and `first()` throws on it. Extracted so tests exercise this code rather than
+ * reimplementing the fallback and passing regardless of what production does.
+ */
+internal fun resolveOrCreateDependenciesNode(root: Node): Node =
+    (root.get("dependencies") as NodeList).firstOrNull() as? Node
+        ?: root.appendNode("dependencies")
+
+/**
+ * The `module.json` equivalent of [mutatePomDependenciesNode], applied to every variant's
+ * `dependencies` list. Same removal-before-append requirement, for the same reason.
+ */
+internal fun mutateModuleJsonVariants(
+    json: Map<*, *>,
+    dependencies: VersionMediatingDependencySet,
+    shouldExclude: (groupId: String, artifactId: String) -> Boolean,
+) {
+    @Suppress("UNCHECKED_CAST")
+    (json["variants"] as? List<MutableMap<String, Any>>)?.forEach { variant ->
+        (variant["dependencies"] as? MutableList<Map<String, Any>>)?.removeAll {
+            val group = it["group"] as String
+            val module = it["module"] as String
+            shouldExclude(group, module)
+        }
+    }
+
+    dependencies.forEach { dependencyToAdd ->
+        @Suppress("UNCHECKED_CAST")
+        (json["variants"] as? List<MutableMap<String, Any>>)?.forEach { variant ->
+            // Known gap: every dependency lands in every variant, so runtime-scoped ones are
+            // compile-visible to Gradle consumers. A fix must key on provenance, NOT on
+            // `scope`, which means different things per path: on the Expo path "runtime" is what
+            // Gradle emits for `implementation` (73 of 84 deps across the upstream Expo POMs), on
+            // the RNC path it means `runtimeOnly`. Filtering on it would strip react-android and
+            // appcompat from Expo consumers. Needs a `fromRuntimeOnlyConfiguration` flag on
+            // DependencyInfo, and its own PR.
+            (variant["dependencies"] as? MutableList<MutableMap<String, Any>>)?.add(
+                mutableMapOf<String, Any>(
+                    "group" to dependencyToAdd.groupId,
+                    "module" to dependencyToAdd.artifactId,
+                ).apply {
+                    dependencyToAdd.version?.let { version ->
+                        put("version", mapOf("requires" to version))
+                    }
+                },
+            )
+        }
+    }
+}
+
+/**
+ * Injects transitive dependencies into the generated Maven POM and Gradle Module Metadata for
+ * every `MavenPublication` on [project], removing any existing entry the exclusion predicate
+ * matches. Used identically by the Expo and RNC-CLI paths.
+ *
+ * Hooks are registered eagerly on construction, since Gradle disallows registering tasks from
+ * `afterEvaluate`. The dependency set isn't known until then, so [configure] supplies it later;
+ * until it's called, injection is disabled and the hooks are no-ops.
+ */
+class PublishingMetadataInjector(private val project: Project) {
+    private var dependencies = VersionMediatingDependencySet()
+    private var shouldExclude: (groupId: String, artifactId: String) -> Boolean = { _, _ -> false }
+    private var enabled = false
+
+    init {
+        registerModuleJsonInjectors()
+        registerPomInjector()
+    }
+
+    /** Supplies the dependencies to inject and enables injection on the hooks registered in [init]. */
+    fun configure(
+        dependencies: VersionMediatingDependencySet,
+        shouldExclude: (groupId: String, artifactId: String) -> Boolean,
+    ) {
+        this.dependencies = dependencies
+        this.shouldExclude = shouldExclude
+        this.enabled = true
+    }
+
+    private fun registerModuleJsonInjectors() {
+        // One task, not one per publication registered from a GenerateModuleMetadata
+        // configureEach — that crashes with "DefaultTaskContainer#register(String) ... cannot be
+        // executed in the current context". Walking each task's outputFile at execution time also
+        // avoids hardcoding a publication name. Name is namespaced: see Constants.
+        val removeDependenciesFromModuleFileTask =
+            project.tasks.register(Constants.MODULE_METADATA_POST_PROCESS_TASK_NAME)
+        removeDependenciesFromModuleFileTask.configure { task ->
+            task.onlyIf { enabled }
+            task.doLast {
+                project.tasks.withType(GenerateModuleMetadata::class.java).forEach { metadataTask ->
+                    val moduleFile = metadataTask.outputFile.get().asFile
+                    if (!moduleFile.exists()) return@forEach
+
+                    val json = moduleFile.inputStream().use { JsonSlurper().parse(it) as Map<*, *> }
+                    mutateModuleJsonVariants(json, dependencies, shouldExclude)
+                    moduleFile.writer().use {
+                        it.write(JsonOutput.prettyPrint(JsonOutput.toJson(json)))
+                    }
+                }
+            }
+        }
+
+        // Finalizing with an already-registered task is safe here, unlike registering one.
+        project.tasks.withType(GenerateModuleMetadata::class.java).configureEach { metadataTask ->
+            metadataTask.finalizedBy(removeDependenciesFromModuleFileTask)
+        }
+    }
+
+    private fun registerPomInjector() {
+        project.pluginManager.withPlugin("maven-publish") {
+            project.extensions.configure(PublishingExtension::class.java) { publishing ->
+                publishing.publications.withType(MavenPublication::class.java)
+                    .configureEach { pub ->
+                        pub.pom.withXml {
+                            if (!enabled) return@withXml
+
+                            val root = it.asNode()
+                            val dependenciesNode = resolveOrCreateDependenciesNode(root)
+                            mutatePomDependenciesNode(dependenciesNode, dependencies, shouldExclude)
+                        }
+                    }
+            }
+        }
+    }
+}

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/TransitiveDependencyFiltering.kt

@@ -0,0 +1,17 @@
+package com.callstack.react.brownfield.shared
+
+/**
+ * Drops coordinates matching [hardExcludePredicate] — ones that are embedded in the AAR and so
+ * would never resolve from Maven. A discovery path can surface these without knowing it: the RNC
+ * discoverer has no Expo awareness, so an embedded module depending on an Expo module coordinate
+ * would otherwise be published as an ordinary dependency.
+ *
+ * [hardExcludePredicate] must never include superseded coordinates — those are meant to be
+ * re-injected with the mediated version, and dropping them here removes them entirely.
+ */
+internal fun dropHardExcludedDependencies(
+    transitiveDeps: VersionMediatingDependencySet,
+    hardExcludePredicate: (groupId: String, artifactId: String) -> Boolean,
+): VersionMediatingDependencySet {
+    return transitiveDeps.filter { !hardExcludePredicate(it.groupId, it.artifactId) }
+}

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/{expo/utils → shared}/VersionMediatingDependencySet.kt

@@ -1,4 +1,4 @@
-package com.callstack.react.brownfield.expo.utils
+package com.callstack.react.brownfield.shared
 
 import io.github.g00fy2.versioncompare.Version
 

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/utils/Extension.kt

@@ -53,4 +53,15 @@ open class Extension {
      * listOf("libdatadog-ndk.so")
      */
     var ignoreEmbeddedLibs = listOf<String>()
+
+    /**
+     * Whether to publish embedded native modules' third-party dependencies into the generated POM
+     * and Gradle Module Metadata, so consuming apps resolve them instead of declaring them by hand.
+     *
+     * Experimental; behavior may still change. Applies to non-Expo (RNC CLI) projects only — Expo
+     * gets this unconditionally. Set to `false` to hand-declare them instead.
+     *
+     * Default is `true`.
+     */
+    var experimentalIncludeTransitiveDependencies = true
 }

package/gradle-plugin/brownfield/src/test/kotlin/com/callstack/react/brownfield/artifacts/RncTransitiveDependencyDiscovererTest.kt

@@ -0,0 +1,171 @@
+package com.callstack.react.brownfield.artifacts
+
+import com.callstack.react.brownfield.shared.DependencyInfo
+import com.callstack.react.brownfield.shared.UnresolvedArtifactInfo
+import org.gradle.testfixtures.ProjectBuilder
+import org.junit.jupiter.api.Test
+import kotlin.test.assertEquals
+import kotlin.test.assertFalse
+import kotlin.test.assertTrue
+
+class RncTransitiveDependencyDiscovererTest {
+    private fun defaultArtifacts(root: org.gradle.api.Project) =
+        listOf(
+            UnresolvedArtifactInfo(
+                moduleGroup = root.name,
+                moduleName = "react-native-fake-module",
+                moduleVersion = "unspecified",
+                file = null,
+                isExpoPublishDependency = false,
+            ),
+        )
+
+    @Test
+    fun `a dynamic consumer-declared version never becomes a mediation candidate`() {
+        // Module-side versions are validated by collectPublishableGradleDependencies; the
+        // consumer side must be validated too, or `1.+` can win mediation and be published.
+        val root = ProjectBuilder.builder().build()
+        val consumer = ProjectBuilder.builder().withParent(root).withName("BrownfieldLib").build()
+        val embeddedModule = ProjectBuilder.builder().withParent(root).withName("react-native-fake-module").build()
+
+        embeddedModule.configurations.create("implementation")
+        embeddedModule.dependencies.add("implementation", "androidx.appcompat:appcompat:1.0.0")
+
+        consumer.configurations.create("implementation")
+        consumer.dependencies.add("implementation", "androidx.appcompat:appcompat:1.+")
+
+        val result = RncTransitiveDependencyDiscoverer(consumer).discover(defaultArtifacts(root))
+
+        val appcompat = result.dependencies.first { it.groupId == "androidx.appcompat" }
+        assertEquals("1.0.0", appcompat.version, "the dynamic consumer version must not win mediation")
+        assertFalse(result.dependencies.any { it.version == "1.+" }, "'1.+' must never reach the published set")
+    }
+
+    @Test
+    fun `a versionless consumer declaration still supersedes, so the coordinate is not duplicated`() {
+        // Declared via BOM/platform, so `.version` is null. A version-only lookup returns null
+        // here, never marks the coordinate superseded, and leaves two entries for it in the POM.
+        val root = ProjectBuilder.builder().build()
+        val consumer = ProjectBuilder.builder().withParent(root).withName("BrownfieldLib").build()
+        val embeddedModule = ProjectBuilder.builder().withParent(root).withName("react-native-fake-module").build()
+
+        embeddedModule.configurations.create("implementation")
+        embeddedModule.dependencies.add("implementation", "androidx.appcompat:appcompat:1.7.1")
+
+        consumer.configurations.create("implementation")
+        consumer.dependencies.add("implementation", "androidx.appcompat:appcompat")
+
+        val result = RncTransitiveDependencyDiscoverer(consumer).discover(defaultArtifacts(root))
+
+        assertTrue(
+            result.supersededCoordinates.contains("androidx.appcompat" to "appcompat"),
+            "a declared-but-versionless coordinate must still be superseded",
+        )
+        assertEquals("1.7.1", result.dependencies.first { it.groupId == "androidx.appcompat" }.version)
+    }
+
+    @Test
+    fun `discovers a module's direct external dependencies, skipping project deps and non-publishable coordinates`() {
+        val root = ProjectBuilder.builder().build()
+        val consumer = ProjectBuilder.builder().withParent(root).withName("BrownfieldLib").build()
+        val embeddedModule = ProjectBuilder.builder().withParent(root).withName("react-native-fake-module").build()
+        val siblingProject = ProjectBuilder.builder().withParent(root).withName("some-other-module").build()
+
+        embeddedModule.configurations.create("implementation")
+        embeddedModule.configurations.create("api")
+        embeddedModule.configurations.create("runtimeOnly")
+
+        embeddedModule.dependencies.add("implementation", "androidx.appcompat:appcompat:1.7.1")
+        embeddedModule.dependencies.add("implementation", "com.facebook.react:react-native:+")
+        embeddedModule.dependencies.add("runtimeOnly", "androidx.annotation:annotation:1.9.1")
+        embeddedModule.dependencies.add(
+            "implementation",
+            embeddedModule.dependencies.project(mapOf("path" to siblingProject.path)),
+        )
+
+        consumer.configurations.create("api")
+
+        val result = RncTransitiveDependencyDiscoverer(consumer).discover(defaultArtifacts(root))
+        val discovered = result.dependencies
+
+        assertEquals(2, discovered.size)
+        assertTrue(
+            discovered.contains(
+                DependencyInfo("androidx.appcompat", "appcompat", "1.7.1", "compile", false),
+            ),
+        )
+        assertTrue(
+            discovered.contains(
+                DependencyInfo("androidx.annotation", "annotation", "1.9.1", "runtime", false),
+            ),
+        )
+        assertFalse(discovered.contains(DependencyInfo("com.facebook.react", "react-native", "+", "compile", false)))
+        assertFalse(discovered.contains(DependencyInfo(root.name, "some-other-module", "unspecified", "compile", false)))
+        assertTrue(result.supersededCoordinates.isEmpty())
+    }
+
+    @Test
+    fun `publishes a runtimeOnly dependency under Maven runtime scope, not compile`() {
+        val root = ProjectBuilder.builder().build()
+        val consumer = ProjectBuilder.builder().withParent(root).withName("BrownfieldLib").build()
+        val embeddedModule = ProjectBuilder.builder().withParent(root).withName("react-native-fake-module").build()
+
+        embeddedModule.configurations.create("implementation")
+        embeddedModule.configurations.create("api")
+        embeddedModule.configurations.create("runtimeOnly")
+        embeddedModule.dependencies.add("runtimeOnly", "androidx.annotation:annotation:1.9.1")
+
+        val discovered = RncTransitiveDependencyDiscoverer(consumer).discover(defaultArtifacts(root)).dependencies
+
+        val annotationDep = discovered.first { it.groupId == "androidx.annotation" }
+        assertEquals("runtime", annotationDep.scope)
+    }
+
+    @Test
+    fun `a module's higher version requirement wins over, and supersedes, the consumer's own lower declaration`() {
+        val root = ProjectBuilder.builder().build()
+        val consumer = ProjectBuilder.builder().withParent(root).withName("BrownfieldLib").build()
+        val embeddedModule = ProjectBuilder.builder().withParent(root).withName("react-native-fake-module").build()
+
+        embeddedModule.configurations.create("implementation")
+        embeddedModule.configurations.create("api")
+        embeddedModule.configurations.create("runtimeOnly")
+        embeddedModule.dependencies.add("implementation", "androidx.appcompat:appcompat:1.7.1")
+
+        consumer.configurations.create("api")
+        consumer.dependencies.add("api", "androidx.appcompat:appcompat:1.6.0")
+
+        val result = RncTransitiveDependencyDiscoverer(consumer).discover(defaultArtifacts(root))
+
+        val appcompatDep = result.dependencies.first { it.groupId == "androidx.appcompat" }
+        assertEquals("1.7.1", appcompatDep.version, "the module's higher requirement must win mediation")
+        assertTrue(
+            result.supersededCoordinates.contains("androidx.appcompat" to "appcompat"),
+            "the consumer's stale lower-version entry must be marked for replacement",
+        )
+    }
+
+    @Test
+    fun `does not regress or supersede when the consumer's own version already satisfies the module`() {
+        val root = ProjectBuilder.builder().build()
+        val consumer = ProjectBuilder.builder().withParent(root).withName("BrownfieldLib").build()
+        val embeddedModule = ProjectBuilder.builder().withParent(root).withName("react-native-fake-module").build()
+
+        embeddedModule.configurations.create("implementation")
+        embeddedModule.configurations.create("api")
+        embeddedModule.configurations.create("runtimeOnly")
+        embeddedModule.dependencies.add("implementation", "androidx.appcompat:appcompat:1.6.0")
+
+        consumer.configurations.create("api")
+        consumer.dependencies.add("api", "androidx.appcompat:appcompat:1.7.1")
+
+        val result = RncTransitiveDependencyDiscoverer(consumer).discover(defaultArtifacts(root))
+
+        val appcompatDep = result.dependencies.first { it.groupId == "androidx.appcompat" }
+        assertEquals("1.7.1", appcompatDep.version, "the consumer's already-higher version must be preserved, not downgraded")
+        assertTrue(
+            result.supersededCoordinates.contains("androidx.appcompat" to "appcompat"),
+            "still marked superseded so the injector re-declares it at the mediated (unchanged) version instead of duplicating it",
+        )
+    }
+}

package/gradle-plugin/brownfield/src/test/kotlin/com/callstack/react/brownfield/expo/ExpoPublishingHelperGradleFallbackTest.kt

@@ -0,0 +1,47 @@
+package com.callstack.react.brownfield.expo
+
+import com.callstack.react.brownfield.shared.VersionMediatingDependencySet
+import org.gradle.api.Project
+import org.gradle.testfixtures.ProjectBuilder
+import org.junit.jupiter.api.Test
+import kotlin.test.assertEquals
+import kotlin.test.assertTrue
+
+class ExpoPublishingHelperGradleFallbackTest {
+    @Test
+    fun `Gradle-fallback discovery picks up runtimeOnly dependencies`() {
+        val root = ProjectBuilder.builder().build()
+        val expoPkgProject = ProjectBuilder.builder().withParent(root).withName("expo-fake-module").build()
+
+        expoPkgProject.configurations.create("implementation")
+        expoPkgProject.configurations.create("api")
+        expoPkgProject.configurations.create("runtimeOnly")
+        expoPkgProject.dependencies.add("runtimeOnly", "androidx.annotation:annotation:1.9.1")
+
+        val helper =
+            object : ExpoPublishingHelper(brownfieldAppProject = root) {
+                fun exposedAppend(
+                    pkgProject: Project,
+                    deps: VersionMediatingDependencySet,
+                ) {
+                    appendExpoTransitiveDependenciesFromGradle(pkgProject, deps)
+                }
+            }
+
+        val discovered = VersionMediatingDependencySet()
+        helper.exposedAppend(expoPkgProject, discovered)
+
+        // Coordinate-only check: VersionMediatingDependencySet keys on groupId/artifactId, so
+        // passing a scope here would be inert and would read as contradicting the scope
+        // assertion below.
+        assertTrue(
+            discovered.any { it.groupId == "androidx.annotation" && it.artifactId == "annotation" },
+            "expected the runtimeOnly dependency to be discovered via the Gradle fallback path",
+        )
+        assertEquals(
+            "runtime",
+            discovered.first { it.groupId == "androidx.annotation" }.scope,
+            "runtimeOnly dependencies should be published under Maven's runtime scope, not compile",
+        )
+    }
+}

package/gradle-plugin/brownfield/src/test/kotlin/com/callstack/react/brownfield/plugin/LegacyConsumerConfigurationTest.kt

@@ -0,0 +1,110 @@
+package com.callstack.react.brownfield.plugin
+
+import com.callstack.react.brownfield.shared.Constants
+import org.gradle.testkit.runner.GradleRunner
+import org.junit.jupiter.api.Assumptions.assumeTrue
+import org.junit.jupiter.api.Test
+import org.junit.jupiter.api.io.TempDir
+import java.io.File
+import kotlin.test.assertFalse
+
+/**
+ * Guards the pre-migration consumer shape no in-repo app has any more: one that still hand-registers
+ * `removeDependenciesFromModuleFile` as the setup docs instruct. If the plugin ever claims that name
+ * again, configuration fails outright for every consumer who hasn't migrated.
+ *
+ * Skipped without an Android SDK, since the plugin requires `com.android.library`.
+ */
+class LegacyConsumerConfigurationTest {
+    @Test
+    fun `a project still registering the documented legacy task configures successfully`(
+        @TempDir projectDir: File,
+    ) {
+        val androidSdk = System.getenv("ANDROID_HOME") ?: System.getenv("ANDROID_SDK_ROOT")
+        assumeTrue(
+            androidSdk != null && File(androidSdk).isDirectory,
+            "no Android SDK available (ANDROID_HOME/ANDROID_SDK_ROOT); skipping AGP-dependent test",
+        )
+
+        writeLegacyConsumerFixture(projectDir, androidSdk!!)
+
+        val result =
+            GradleRunner.create()
+                .withProjectDir(projectDir)
+                .withPluginClasspath()
+                .withArguments("tasks", "--stacktrace")
+                .forwardOutput()
+                .build()
+
+        // build() already failed above on any unrelated fixture breakage; this narrows a failure
+        // here to the duplicate-task-name case specifically.
+        assertFalse(
+            result.output.contains("as a task with that name already exists"),
+            "build output reports a duplicate task name; the plugin most likely claimed " +
+                "'${Constants.LEGACY_CONSUMER_MODULE_METADATA_TASK_NAME}', which the setup docs " +
+                "reserve for consumers",
+        )
+    }
+
+    private fun writeLegacyConsumerFixture(
+        projectDir: File,
+        androidSdk: String,
+    ) {
+        File(projectDir, "settings.gradle.kts").writeText(
+            """
+            dependencyResolutionManagement {
+                repositories {
+                    google()
+                    mavenCentral()
+                }
+            }
+            rootProject.name = "legacy-consumer"
+            include(":app")
+            include(":brownfieldlib")
+            """.trimIndent(),
+        )
+        File(projectDir, "local.properties").writeText("sdk.dir=$androidSdk\n")
+        // ArtifactsResolver looks for an `app` project; an empty stub is enough, this test is about
+        // the task container, not discovery.
+        File(projectDir, "app").mkdirs()
+        File(projectDir, "app/build.gradle.kts").writeText("")
+
+        // The `tasks.register("removeDependenciesFromModuleFile")` block below is verbatim from
+        // the published setup docs. Do not "modernize" it — its whole purpose is to reproduce
+        // what a not-yet-migrated consumer actually has in their build script.
+        File(projectDir, "brownfieldlib").mkdirs()
+        File(projectDir, "brownfieldlib/build.gradle.kts").writeText(
+            """
+            import groovy.json.JsonOutput
+            import groovy.json.JsonSlurper
+
+            plugins {
+                id("com.android.library")
+                id("com.callstack.react.brownfield")
+                `maven-publish`
+            }
+
+            android {
+                namespace = "com.example.legacyconsumer"
+                compileSdk = 34
+            }
+
+            val moduleBuildDir: Directory = layout.buildDirectory.get()
+
+            tasks.register("removeDependenciesFromModuleFile") {
+                doLast {
+                    file("${'$'}moduleBuildDir/publications/mavenAar/module.json").run {
+                        val json = inputStream().use { JsonSlurper().parse(it) as Map<String, Any> }
+                        (json["variants"] as? List<MutableMap<String, Any>>)?.forEach { variant ->
+                            (variant["dependencies"] as? MutableList<Map<String, Any>>)?.removeAll {
+                                it["group"] == rootProject.name
+                            }
+                        }
+                        writer().use { it.write(JsonOutput.prettyPrint(JsonOutput.toJson(json))) }
+                    }
+                }
+            }
+            """.trimIndent(),
+        )
+    }
+}