@callstack/react-native-brownfield 5.1.0 → 5.2.0

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/plugin/RNBrownfieldPlugin.kt

@@ -1,8 +1,10 @@
 package com.callstack.react.brownfield.plugin
 
+import com.android.build.api.AndroidPluginVersion
 import com.android.build.api.variant.LibraryAndroidComponentsExtension
 import com.android.build.api.variant.LibraryVariant
 import com.callstack.react.brownfield.artifacts.ArtifactsResolver
+import com.callstack.react.brownfield.artifacts.RncTransitiveDependencyDiscoverer
 import com.callstack.react.brownfield.expo.ExpoPublishingHelper
 import com.callstack.react.brownfield.expo.utils.ExpoGradleProjectProjection
 import com.callstack.react.brownfield.processors.AssetTaskProcessor
@@ -15,9 +17,13 @@ import com.callstack.react.brownfield.processors.VariantHelper
 import com.callstack.react.brownfield.processors.VariantPackagesProperty
 import com.callstack.react.brownfield.processors.VariantTaskProvider
 import com.callstack.react.brownfield.shared.BaseProject
+import com.callstack.react.brownfield.shared.Constants
 import com.callstack.react.brownfield.shared.Constants.PROJECT_ID
 import com.callstack.react.brownfield.shared.Logging
+import com.callstack.react.brownfield.shared.PublishingMetadataInjector
 import com.callstack.react.brownfield.shared.UnresolvedArtifactInfo
+import com.callstack.react.brownfield.shared.VersionMediatingDependencySet
+import com.callstack.react.brownfield.shared.dropHardExcludedDependencies
 import com.callstack.react.brownfield.utils.AndroidArchiveLibrary
 import com.callstack.react.brownfield.utils.DirectoryManager
 import com.callstack.react.brownfield.utils.Extension
@@ -36,6 +42,7 @@ class RNBrownfieldPlugin : Plugin<Project> {
 
     override fun apply(project: Project) {
         verifyAndroidPluginApplied(project)
+        verifyAgpVersion(project)
 
         this.project = project
         initializers()
@@ -54,8 +61,9 @@ class RNBrownfieldPlugin : Plugin<Project> {
         }
 
         var expoProjects = listOf<ExpoGradleProjectProjection>()
+        var expoPublishingHelper: ExpoPublishingHelper? = null
         if (this.isExpoProject) {
-            val expoPublishingHelper = ExpoPublishingHelper(brownfieldAppProject = project)
+            expoPublishingHelper = ExpoPublishingHelper(brownfieldAppProject = project)
             expoProjects = expoPublishingHelper.configure()
         }
 
@@ -65,6 +73,18 @@ class RNBrownfieldPlugin : Plugin<Project> {
         val artifactsResolver = ArtifactsResolver(project, isExpoProject)
         val artifacts = artifactsResolver.processDefaultDependencies(expoProjects)
 
+        // Registered eagerly: Gradle disallows registering tasks from afterEvaluate. Only the
+        // dependency set supplied below has to wait.
+        val injector = PublishingMetadataInjector(project)
+
+        // whenReady, not afterEvaluate: afterEvaluate guarantees only that *this* project is
+        // configured, not the embedded module projects we read dependencies from — theirs were
+        // empirically still empty at that point. whenReady fires once the whole task graph is
+        // resolved (so every embedded module is configured) but before any task runs.
+        project.gradle.taskGraph.whenReady {
+            configureTransitiveDependencyInjection(project, injector, expoPublishingHelper, expoProjects, artifacts)
+        }
+
         val variantTaskProvider = VariantTaskProvider(project)
 
         val androidComponents = project.extensions.getByType(LibraryAndroidComponentsExtension::class.java)
@@ -74,9 +94,89 @@ class RNBrownfieldPlugin : Plugin<Project> {
     }
 
     companion object {
+        /**
+         * Oldest AGP the plugin supports. This is one number that must hold in three places: the
+         * `agp` version the plugin compiles against in `gradle/libs.versions.toml`, the floor of the
+         * TestKit AGP matrix in `build.gradle.kts`, and this gate. Raise all three together.
+         */
+        val MIN_AGP = AndroidPluginVersion(8, 12)
+
         const val EXPO_PROJECT_LOCATOR = ":expo"
     }
 
+    @Suppress("LongMethod")
+    private fun configureTransitiveDependencyInjection(
+        project: Project,
+        injector: PublishingMetadataInjector,
+        expoPublishingHelper: ExpoPublishingHelper?,
+        expoProjects: List<ExpoGradleProjectProjection>,
+        artifacts: List<UnresolvedArtifactInfo>,
+    ) {
+        val transitiveDeps = VersionMediatingDependencySet()
+        var rncSupersededCoordinates: Set<Pair<String, String>> = emptySet()
+
+        if (isExpoProject && expoPublishingHelper != null) {
+            val expoTransitiveDeps = expoPublishingHelper.discoverAllExpoTransitiveDependencies(expoProjects)
+            Logging.log("Merged ${expoTransitiveDeps.size} transitive dependencies discovered from Expo")
+            expoTransitiveDeps.forEach {
+                Logging.log(
+                    "(*) dependency ${it.groupId}:${it.artifactId}:${it.version} (scope: ${it.scope}, " +
+                        "${if (it.optional) "optional" else "required"})",
+                )
+            }
+            transitiveDeps.addAll(expoTransitiveDeps)
+        }
+        // Also on Expo: the path above only covers Expo modules, not community libraries.
+        if (extension.experimentalIncludeTransitiveDependencies) {
+            val rncDiscovery = RncTransitiveDependencyDiscoverer(project).discover(artifacts)
+            Logging.log(
+                "Merged ${rncDiscovery.dependencies.size} transitive dependencies discovered by the RNC discoverer",
+            )
+            transitiveDeps.addAll(rncDiscovery.dependencies)
+            rncSupersededCoordinates = rncDiscovery.supersededCoordinates
+        }
+
+        if (isExpoProject || extension.experimentalIncludeTransitiveDependencies) {
+            // Coordinates that must never be published: they're embedded in the AAR, not
+            // resolvable from Maven. Distinct from "superseded" coordinates, which ARE re-injected
+            // (replacing a stale entry) and so must not be dropped here.
+            val hardExcludePredicate: (String, String) -> Boolean = { groupId, artifactId ->
+                (expoPublishingHelper?.shouldExcludeDependency(groupId, artifactId) ?: (groupId == project.rootProject.name)) ||
+                    artifacts.any { it.moduleGroup == groupId && it.moduleName == artifactId } ||
+                    expoProjects.any { it.publication?.groupId == groupId && it.publication?.artifactId == artifactId }
+            }
+            dropHardExcludedDependencies(transitiveDeps, hardExcludePredicate)
+
+            Logging.log(
+                "Total of ${transitiveDeps.size} unique transitive dependencies merged for POM/module.json injection",
+            )
+
+            val removalPredicate: (String, String) -> Boolean = { groupId, artifactId ->
+                hardExcludePredicate(groupId, artifactId) || rncSupersededCoordinates.contains(groupId to artifactId)
+            }
+
+            injector.configure(transitiveDeps, removalPredicate)
+            Logging.log("PublishingMetadataInjector ran: injected merged transitive dependencies into POM and Gradle Module Metadata")
+
+            // Informational only — throwing would recreate the upgrade break that the namespaced
+            // task name exists to prevent. `names` avoids realizing the task from whenReady.
+            if (project.tasks.names.contains(Constants.LEGACY_CONSUMER_MODULE_METADATA_TASK_NAME)) {
+                Logging.log(
+                    "NOTE: this project still registers a hand-written " +
+                        "'${Constants.LEGACY_CONSUMER_MODULE_METADATA_TASK_NAME}' task. The plugin now performs " +
+                        "that removal itself (plus transitive-dependency injection) via " +
+                        "'${Constants.MODULE_METADATA_POST_PROCESS_TASK_NAME}'. The hand-written task is " +
+                        "redundant and can be deleted; leaving it in place is harmless.",
+                )
+            }
+        } else {
+            Logging.log(
+                "PublishingMetadataInjector skipped: project is not an Expo project and " +
+                    "experimentalIncludeTransitiveDependencies is disabled",
+            )
+        }
+    }
+
     private fun initializers() {
         RClassTransformer.project = project
         Logging.project = project
@@ -100,6 +200,28 @@ class RNBrownfieldPlugin : Plugin<Project> {
         }
     }
 
+    /**
+     * Fails fast on AGP versions older than the plugin supports.
+     *
+     * The plugin compiles against [MIN_AGP] (see `agp` in `gradle/libs.versions.toml`), so anything
+     * at or above it is guaranteed to have every AGP symbol the plugin references. Below it, the
+     * consumer would instead hit a `NoClassDefFoundError`/`NoSuchMethodError` somewhere deep in
+     * configuration, with nothing pointing back at this plugin.
+     */
+    private fun verifyAgpVersion(project: Project) {
+        val current =
+            project.extensions
+                .getByType(LibraryAndroidComponentsExtension::class.java)
+                .pluginVersion
+        if (current < MIN_AGP) {
+            throw ProjectConfigurationException(
+                "$PROJECT_ID requires Android Gradle Plugin $MIN_AGP or newer, " +
+                    "but this project resolved AGP $current",
+                Throwable("Upgrade the Android Gradle Plugin to $MIN_AGP or newer"),
+            )
+        }
+    }
+
     private fun getAarLibraries(
         artifacts: List<UnresolvedArtifactInfo>,
         variantName: String,

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/plugin/RNSourceSets.kt

@@ -1,5 +1,6 @@
 package com.callstack.react.brownfield.plugin
 
+import com.android.build.api.dsl.AndroidSourceSet
 import com.android.build.api.dsl.LibraryExtension
 import com.android.build.api.variant.LibraryAndroidComponentsExtension
 import com.callstack.react.brownfield.exceptions.NameSpaceNotFound
@@ -41,7 +42,11 @@ object RNSourceSets {
         val componentsExtension = project.extensions.getByType(LibraryAndroidComponentsExtension::class.java)
 
         // Move the non-variant-specific configuration out of the loop
-        androidExtension.sourceSets.named("main") { sourceSet ->
+        // The parameter is typed as the `AndroidSourceSet` supertype on purpose. AGP 9 narrows
+        // this container to `AndroidLibrarySourceSet`, and letting Kotlin infer that bakes the
+        // AGP 9-only type into the lambda's `execute` signature, which blows up with
+        // NoClassDefFoundError on AGP 8 consumers. `AndroidSourceSet` is identical in both.
+        androidExtension.sourceSets.named("main") { sourceSet: AndroidSourceSet ->
             // This path is not variant-specific, so it's added once here.
             sourceSet.java.directories.add("${getModuleBuildDir()}/generated/autolinking/src/main/java")
         }

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/Constants.kt

@@ -1,6 +1,5 @@
 package com.callstack.react.brownfield.shared
 
-import com.callstack.react.brownfield.expo.utils.DependencyInfo
 import com.callstack.react.brownfield.utils.StringMatcher
 
 /**
@@ -40,6 +39,18 @@ object Constants {
 
     const val INTERMEDIATES_TEMP_DIR = PLUGIN_NAME
 
+    /**
+     * Plugin-owned task that post-processes generated Gradle Module Metadata.
+     *
+     * Never rename to the bare [LEGACY_CONSUMER_MODULE_METADATA_TASK_NAME]: the plugin registers
+     * during `apply()`, before the consumer's script body, so claiming that name breaks every
+     * consumer still following the setup docs with "a task with that name already exists".
+     */
+    const val MODULE_METADATA_POST_PROCESS_TASK_NAME = "brownfieldRemoveDependenciesFromModuleFile"
+
+    /** The name the setup docs tell consumers to register themselves; must stay free for them. */
+    const val LEGACY_CONSUMER_MODULE_METADATA_TASK_NAME = "removeDependenciesFromModuleFile"
+
     val BROWNFIELD_EXPO_TRANSITIVE_DEPS_WHITELISTED_MODULES_FOR_DISCOVERY =
         setOf("expo-modules-core", "expo-constants", "expo", "expo-updates")
     val BROWNFIELD_EXPO_TRANSITIVE_DEPS_ARTIFACTS_BLACKLIST =

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/{expo/utils/BrownfieldPrimitives.kt → shared/DependencyInfo.kt}

@@ -1,10 +1,4 @@
-package com.callstack.react.brownfield.expo.utils
-
-data class BrownfieldPublishingInfo(
-    val groupId: String,
-    val artifactId: String,
-    val version: String,
-)
+package com.callstack.react.brownfield.shared
 
 data class DependencyInfo(
     val groupId: String,
@@ -18,12 +12,13 @@ data class DependencyInfo(
             groupId: String,
             artifactId: String,
             version: String?,
+            scope: String = "compile",
         ): DependencyInfo {
             return DependencyInfo(
                 groupId = groupId,
                 artifactId = artifactId,
                 version = version,
-                scope = "compile",
+                scope = scope,
                 optional = false,
             )
         }

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/DependencyPublishability.kt

@@ -0,0 +1,22 @@
+package com.callstack.react.brownfield.shared
+
+/** Matches Maven/Gradle version-range syntax, e.g. `[1.0,2.0)`, `(,2.0]`, `[1.0,)`. */
+private val VERSION_RANGE_REGEX = Regex("^[\\[(].*,.*[\\])]$")
+
+/** Reserved Gradle/Maven dynamic-version keywords that resolve to whatever is newest at build time. */
+private val DYNAMIC_VERSION_KEYWORDS = setOf("latest.release", "latest.integration", "latest", "release")
+
+/**
+ * Whether [dependency] is safe to publish as-is. Rejects dynamic versions (`+`, `latest.*`, ranges)
+ * and blank ones: the former resolve non-reproducibly for consumers, the latter emit a
+ * `<dependency>` with no version at all.
+ */
+fun isPublishableCoordinate(dependency: DependencyInfo): Boolean {
+    val version = dependency.version
+    if (version.isNullOrBlank()) return false
+    val trimmed = version.trim()
+    if (trimmed.contains("+")) return false
+    if (trimmed.lowercase() in DYNAMIC_VERSION_KEYWORDS) return false
+    if (VERSION_RANGE_REGEX.matches(trimmed)) return false
+    return true
+}

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/GradleDependencyCollector.kt

@@ -0,0 +1,44 @@
+package com.callstack.react.brownfield.shared
+
+import org.gradle.api.Project
+import org.gradle.api.internal.artifacts.dependencies.DefaultProjectDependency
+
+/**
+ * Configurations inspected when discovering a project's direct external dependencies.
+ *
+ * Not flavor-aware — `releaseImplementation` and friends are missed. Fine for Expo packages, which
+ * don't use them; extend if an RNC-CLI native module turns out to.
+ */
+val TRANSITIVE_DEPENDENCY_CONFIG_NAMES = listOf("implementation", "api", "runtimeOnly")
+
+/** Maven scope per configuration; `runtimeOnly` maps to `runtime` to keep it off the compile classpath. */
+private val CONFIG_NAME_TO_SCOPE =
+    mapOf(
+        "implementation" to "compile",
+        "api" to "compile",
+        "runtimeOnly" to "runtime",
+    )
+
+/**
+ * [project]'s direct external (non-project) dependencies on [TRANSITIVE_DEPENDENCY_CONFIG_NAMES],
+ * minus anything [isPublishableCoordinate] rejects. Shared by the Expo fallback and RNC paths so
+ * both get the same guarantees.
+ */
+fun collectPublishableGradleDependencies(project: Project): List<DependencyInfo> {
+    val result = mutableListOf<DependencyInfo>()
+
+    TRANSITIVE_DEPENDENCY_CONFIG_NAMES.forEach { configName ->
+        val configuration = project.configurations.findByName(configName) ?: return@forEach
+        val scope = CONFIG_NAME_TO_SCOPE.getValue(configName)
+
+        configuration.dependencies.forEach { dependency ->
+            if (dependency is DefaultProjectDependency) return@forEach
+            val group = dependency.group ?: return@forEach
+
+            val info = DependencyInfo.fromGradleDep(group, dependency.name, dependency.version, scope)
+            if (isPublishableCoordinate(info)) result.add(info)
+        }
+    }
+
+    return result
+}

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/MergeClassesTask.kt

@@ -11,11 +11,13 @@ import org.gradle.api.tasks.Classpath
 import org.gradle.api.tasks.Input
 import org.gradle.api.tasks.OutputDirectory
 import org.gradle.api.tasks.TaskAction
+import org.gradle.api.tasks.UntrackedTask
 import java.io.File
 import java.nio.file.Files
 import java.nio.file.Path
 import java.nio.file.Paths
 
+@UntrackedTask(because = "Copies classes into Java and Kotlin compilation directories owned by other tasks")
 abstract class MergeClassesTask : DefaultTask() {
     @get:Classpath
     abstract val inputClassesJars: ConfigurableFileCollection

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/PublishingMetadataInjector.kt

@@ -0,0 +1,181 @@
+package com.callstack.react.brownfield.shared
+
+import groovy.json.JsonOutput
+import groovy.json.JsonSlurper
+import groovy.util.Node
+import groovy.util.NodeList
+import org.gradle.api.Project
+import org.gradle.api.publish.PublishingExtension
+import org.gradle.api.publish.maven.MavenPublication
+import org.gradle.api.publish.tasks.GenerateModuleMetadata
+
+/**
+ * Removes every `<dependency>` matching [shouldExclude] from [dependenciesNode], then appends one
+ * per entry in [dependencies].
+ *
+ * Removal must run before appending: [shouldExclude] matches on coordinate alone, so afterwards it
+ * couldn't tell a stale superseded entry from the one just appended for it, and would drop both.
+ */
+internal fun mutatePomDependenciesNode(
+    dependenciesNode: Node,
+    dependencies: VersionMediatingDependencySet,
+    shouldExclude: (groupId: String, artifactId: String) -> Boolean,
+) {
+    dependenciesNode.children()
+        .filterIsInstance<Node>()
+        .filter { dependency ->
+            val groupId = (dependency["groupId"] as NodeList).text()
+            val artifactId = (dependency["artifactId"] as NodeList).text()
+            shouldExclude(groupId, artifactId)
+        }
+        .forEach { dependency ->
+            dependenciesNode.remove(dependency)
+        }
+
+    dependencies.forEach { dependencyToAdd ->
+        val childTags =
+            mutableMapOf(
+                "groupId" to dependencyToAdd.groupId,
+                "artifactId" to dependencyToAdd.artifactId,
+                "scope" to dependencyToAdd.scope,
+                "optional" to dependencyToAdd.optional.toString(),
+            )
+
+        if (dependencyToAdd.version?.isNotBlank() == true) {
+            childTags["version"] = dependencyToAdd.version
+        }
+
+        dependenciesNode.appendNode("dependency").let { newDepNode ->
+            childTags.forEach { (tagName, tagValue) ->
+                newDepNode.appendNode(tagName, tagValue)
+            }
+        }
+    }
+}
+
+/**
+ * The POM's `<dependencies>` element, created if absent — a publication with no dependencies has
+ * none, and `first()` throws on it. Extracted so tests exercise this code rather than
+ * reimplementing the fallback and passing regardless of what production does.
+ */
+internal fun resolveOrCreateDependenciesNode(root: Node): Node =
+    (root.get("dependencies") as NodeList).firstOrNull() as? Node
+        ?: root.appendNode("dependencies")
+
+/**
+ * The `module.json` equivalent of [mutatePomDependenciesNode], applied to every variant's
+ * `dependencies` list. Same removal-before-append requirement, for the same reason.
+ */
+internal fun mutateModuleJsonVariants(
+    json: Map<*, *>,
+    dependencies: VersionMediatingDependencySet,
+    shouldExclude: (groupId: String, artifactId: String) -> Boolean,
+) {
+    @Suppress("UNCHECKED_CAST")
+    (json["variants"] as? List<MutableMap<String, Any>>)?.forEach { variant ->
+        (variant["dependencies"] as? MutableList<Map<String, Any>>)?.removeAll {
+            val group = it["group"] as String
+            val module = it["module"] as String
+            shouldExclude(group, module)
+        }
+    }
+
+    dependencies.forEach { dependencyToAdd ->
+        @Suppress("UNCHECKED_CAST")
+        (json["variants"] as? List<MutableMap<String, Any>>)?.forEach { variant ->
+            // Known gap: every dependency lands in every variant, so runtime-scoped ones are
+            // compile-visible to Gradle consumers. A fix must key on provenance, NOT on
+            // `scope`, which means different things per path: on the Expo path "runtime" is what
+            // Gradle emits for `implementation` (73 of 84 deps across the upstream Expo POMs), on
+            // the RNC path it means `runtimeOnly`. Filtering on it would strip react-android and
+            // appcompat from Expo consumers. Needs a `fromRuntimeOnlyConfiguration` flag on
+            // DependencyInfo, and its own PR.
+            (variant["dependencies"] as? MutableList<MutableMap<String, Any>>)?.add(
+                mutableMapOf<String, Any>(
+                    "group" to dependencyToAdd.groupId,
+                    "module" to dependencyToAdd.artifactId,
+                ).apply {
+                    dependencyToAdd.version?.let { version ->
+                        put("version", mapOf("requires" to version))
+                    }
+                },
+            )
+        }
+    }
+}
+
+/**
+ * Injects transitive dependencies into the generated Maven POM and Gradle Module Metadata for
+ * every `MavenPublication` on [project], removing any existing entry the exclusion predicate
+ * matches. Used identically by the Expo and RNC-CLI paths.
+ *
+ * Hooks are registered eagerly on construction, since Gradle disallows registering tasks from
+ * `afterEvaluate`. The dependency set isn't known until then, so [configure] supplies it later;
+ * until it's called, injection is disabled and the hooks are no-ops.
+ */
+class PublishingMetadataInjector(private val project: Project) {
+    private var dependencies = VersionMediatingDependencySet()
+    private var shouldExclude: (groupId: String, artifactId: String) -> Boolean = { _, _ -> false }
+    private var enabled = false
+
+    init {
+        registerModuleJsonInjectors()
+        registerPomInjector()
+    }
+
+    /** Supplies the dependencies to inject and enables injection on the hooks registered in [init]. */
+    fun configure(
+        dependencies: VersionMediatingDependencySet,
+        shouldExclude: (groupId: String, artifactId: String) -> Boolean,
+    ) {
+        this.dependencies = dependencies
+        this.shouldExclude = shouldExclude
+        this.enabled = true
+    }
+
+    private fun registerModuleJsonInjectors() {
+        // One task, not one per publication registered from a GenerateModuleMetadata
+        // configureEach — that crashes with "DefaultTaskContainer#register(String) ... cannot be
+        // executed in the current context". Walking each task's outputFile at execution time also
+        // avoids hardcoding a publication name. Name is namespaced: see Constants.
+        val removeDependenciesFromModuleFileTask =
+            project.tasks.register(Constants.MODULE_METADATA_POST_PROCESS_TASK_NAME)
+        removeDependenciesFromModuleFileTask.configure { task ->
+            task.onlyIf { enabled }
+            task.doLast {
+                project.tasks.withType(GenerateModuleMetadata::class.java).forEach { metadataTask ->
+                    val moduleFile = metadataTask.outputFile.get().asFile
+                    if (!moduleFile.exists()) return@forEach
+
+                    val json = moduleFile.inputStream().use { JsonSlurper().parse(it) as Map<*, *> }
+                    mutateModuleJsonVariants(json, dependencies, shouldExclude)
+                    moduleFile.writer().use {
+                        it.write(JsonOutput.prettyPrint(JsonOutput.toJson(json)))
+                    }
+                }
+            }
+        }
+
+        // Finalizing with an already-registered task is safe here, unlike registering one.
+        project.tasks.withType(GenerateModuleMetadata::class.java).configureEach { metadataTask ->
+            metadataTask.finalizedBy(removeDependenciesFromModuleFileTask)
+        }
+    }
+
+    private fun registerPomInjector() {
+        project.pluginManager.withPlugin("maven-publish") {
+            project.extensions.configure(PublishingExtension::class.java) { publishing ->
+                publishing.publications.withType(MavenPublication::class.java)
+                    .configureEach { pub ->
+                        pub.pom.withXml {
+                            if (!enabled) return@withXml
+
+                            val root = it.asNode()
+                            val dependenciesNode = resolveOrCreateDependenciesNode(root)
+                            mutatePomDependenciesNode(dependenciesNode, dependencies, shouldExclude)
+                        }
+                    }
+            }
+        }
+    }
+}

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/TransitiveDependencyFiltering.kt

@@ -0,0 +1,17 @@
+package com.callstack.react.brownfield.shared
+
+/**
+ * Drops coordinates matching [hardExcludePredicate] — ones that are embedded in the AAR and so
+ * would never resolve from Maven. A discovery path can surface these without knowing it: the RNC
+ * discoverer has no Expo awareness, so an embedded module depending on an Expo module coordinate
+ * would otherwise be published as an ordinary dependency.
+ *
+ * [hardExcludePredicate] must never include superseded coordinates — those are meant to be
+ * re-injected with the mediated version, and dropping them here removes them entirely.
+ */
+internal fun dropHardExcludedDependencies(
+    transitiveDeps: VersionMediatingDependencySet,
+    hardExcludePredicate: (groupId: String, artifactId: String) -> Boolean,
+): VersionMediatingDependencySet {
+    return transitiveDeps.filter { !hardExcludePredicate(it.groupId, it.artifactId) }
+}

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/{expo/utils → shared}/VersionMediatingDependencySet.kt

@@ -1,4 +1,4 @@
-package com.callstack.react.brownfield.expo.utils
+package com.callstack.react.brownfield.shared
 
 import io.github.g00fy2.versioncompare.Version
 

package/gradle-plugin/brownfield/src/main/kotlin/com/callstack/react/brownfield/utils/Extension.kt

@@ -53,4 +53,15 @@ open class Extension {
      * listOf("libdatadog-ndk.so")
      */
     var ignoreEmbeddedLibs = listOf<String>()
+
+    /**
+     * Whether to publish embedded native modules' third-party dependencies into the generated POM
+     * and Gradle Module Metadata, so consuming apps resolve them instead of declaring them by hand.
+     *
+     * Experimental; behavior may still change. On Expo projects, Expo modules' dependencies are
+     * published regardless; this covers the other native modules. Set to `false` to hand-declare them instead.
+     *
+     * Default is `true`.
+     */
+    var experimentalIncludeTransitiveDependencies = true
 }