@forthtilliath/expo-config-plugins 0.1.0 → 0.3.0

package/README.md

@@ -19,7 +19,8 @@ npm install --save-dev @forthtilliath/expo-config-plugins
         { "propertyPrefix": "MYAPP" }
       ],
       "@forthtilliath/expo-config-plugins/withAndroidAbis",
-      "@forthtilliath/expo-config-plugins/withShortCxxPath"
+      "@forthtilliath/expo-config-plugins/withShortCxxPath",
+      "@forthtilliath/expo-config-plugins/withKotlinJvmTarget"
     ]
   }
 }
@@ -59,9 +60,33 @@ On Windows, release builds can overflow the 260-character path limit inside `and
 | ------------ | -------- | --------------------------------- |
 | `stagingDir` | `string` | `C:/rncxx` on Windows, else unset |
 
+## `withKotlinJvmTarget` — one JVM target for Kotlin
+
+Some native modules (e.g. `expo-dynamic-app-icon`) compile their Kotlin code for another JVM target than the project's Java code, and the build fails with "Inconsistent JVM-target compatibility". This plugin appends a block to `android/build.gradle` forcing every Kotlin compile task, in every subproject, to the same target.
+
+| Option      | Type     | Default |
+| ----------- | -------- | ------- |
+| `jvmTarget` | `string` | `"17"`  |
+
+## `withReleaseRemovedPermissions` — a release APK that can't go online
+
+For an app that works fully offline (personal, health or intimate data), removing the `INTERNET` permission from the **release** APK makes Android itself guarantee that nothing can leave the phone — whatever a dependency (an SDK, a library's telemetry) tries. Debug builds keep the permission: Metro needs the network.
+
+```json
+"@forthtilliath/expo-config-plugins/withReleaseRemovedPermissions"
+```
+
+The plugin writes `android/app/src/release/AndroidManifest.xml`, merged by Gradle over the main manifest and every library's, with `tools:node="remove"` on each permission: it's dropped whoever declared it. It refuses to overwrite a release manifest it didn't generate, and fails the prebuild on anything but permission names (they end up in XML). Check the result with `aapt dump permissions app-release.apk`.
+
+| Option        | Type       | Default        | Notes                                                                                     |
+| ------------- | ---------- | -------------- | ----------------------------------------------------------------------------------------- |
+| `permissions` | `string[]` | `["INTERNET"]` | Short (`ACCESS_NETWORK_STATE`) or full (`com.google.android.gms.permission.AD_ID`) names. |
+
+Remove it the day a feature really needs the network (update check, Drive backup…): without `INTERNET`, every request fails.
+
 ## Testing your own setup
 
-The transforms behind the plugins are exported as pure functions from `@forthtilliath/expo-config-plugins/transforms` (`applyReleaseSigning`, `applyAndroidAbis`, `applyShortCxxPath`).
+The transforms behind the plugins are exported as pure functions from `@forthtilliath/expo-config-plugins/transforms` (`applyReleaseSigning`, `applyAndroidAbis`, `applyShortCxxPath`, `applyKotlinJvmTarget`, `buildReleaseRemovedPermissionsManifest`).
 
 ## Scripts
 

package/dist/transforms.d.ts

@@ -38,6 +38,20 @@ export declare function applyAndroidAbis(properties: GradlePropertiesItem[], abi
  * @throws When the `namespace` line to anchor on isn't found.
  */
 export declare function applyShortCxxPath(contents: string, stagingDir: string): string;
+/**
+ * Appends to the root `android/build.gradle` a block forcing every Kotlin
+ * compile task, in every subproject, to target `jvmTarget` — the Java code's
+ * target: a native module compiling its Kotlin for another one (e.g.
+ * expo-dynamic-app-icon) fails the build with "Inconsistent JVM-target
+ * compatibility". Already-patched contents are returned as is.
+ *
+ * @throws When `jvmTarget` isn't a JVM version such as `17` or `1.8`.
+ */
+export declare function applyKotlinJvmTarget(contents: string, jvmTarget?: string): string;
+export interface KotlinJvmTargetOptions {
+    /** JVM version Kotlin compiles for, e.g. `"21"`. @defaultValue `"17"` */
+    jvmTarget?: string;
+}
 export interface ReleaseSigningOptions {
     /**
      * Prefix of the Gradle properties holding the upload key, e.g. `MYAPP` for
@@ -57,4 +71,23 @@ export interface ShortCxxPathOptions {
      */
     stagingDir?: string;
 }
+export interface ReleaseRemovedPermissionsOptions {
+    /**
+     * Android permissions to strip from the release APK only, short (`INTERNET`)
+     * or full (`android.permission.INTERNET`) names.
+     *
+     * @defaultValue `["INTERNET"]`
+     */
+    permissions?: string[];
+}
+/**
+ * The `android/app/src/release/AndroidManifest.xml` removing `permissions`
+ * from the release build: merged over the main manifest and every library's,
+ * `tools:node="remove"` drops the permission whoever declared it. Debug
+ * builds keep it (Metro needs `INTERNET`).
+ *
+ * @throws When the list is empty or holds anything but permission names —
+ *   the names end up in XML, nothing else is let through.
+ */
+export declare function buildReleaseRemovedPermissionsManifest(permissions?: readonly string[]): string;
 //# sourceMappingURL=transforms.d.ts.map

package/dist/transforms.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transforms.d.ts","sourceRoot":"","sources":["../src/transforms.ts"],"names":[],"mappings":"AAoBA;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,MAAM,CAmBR;AAED,qFAAqF;AACrF,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtB,4CAA4C;AAC5C,eAAO,MAAM,QAAQ,EAAE,SAAS,MAAM,EAAiC,CAAC;AAExE;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,oBAAoB,EAAE,EAClC,IAAI,GAAE,SAAS,MAAM,EAAa,GACjC,oBAAoB,EAAE,CAcxB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,MAAM,CAiBR;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}
+{"version":3,"file":"transforms.d.ts","sourceRoot":"","sources":["../src/transforms.ts"],"names":[],"mappings":"AAoBA;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,MAAM,CAmBR;AAED,qFAAqF;AACrF,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtB,4CAA4C;AAC5C,eAAO,MAAM,QAAQ,EAAE,SAAS,MAAM,EAAiC,CAAC;AAExE;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,oBAAoB,EAAE,EAClC,IAAI,GAAE,SAAS,MAAM,EAAa,GACjC,oBAAoB,EAAE,CAcxB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,MAAM,CAiBR;AAID;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,SAAS,SAAO,GACf,MAAM,CAkBR;AAED,MAAM,WAAW,sBAAsB;IACrC,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gCAAgC;IAC/C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAID;;;;;;;;GAQG;AACH,wBAAgB,sCAAsC,CACpD,WAAW,GAAE,SAAS,MAAM,EAAiB,GAC5C,MAAM,CA0BR"}

package/dist/transforms.js

@@ -6,6 +6,8 @@ exports.ARM_ABIS = void 0;
 exports.applyReleaseSigning = applyReleaseSigning;
 exports.applyAndroidAbis = applyAndroidAbis;
 exports.applyShortCxxPath = applyShortCxxPath;
+exports.applyKotlinJvmTarget = applyKotlinJvmTarget;
+exports.buildReleaseRemovedPermissionsManifest = buildReleaseRemovedPermissionsManifest;
 /** The `signingConfig signingConfigs.debug` of the `release` build type (not the `debug` one's). */
 const RELEASE_USES_DEBUG_KEY = /(buildTypes\s*\{[\s\S]*?release\s*\{[^}]*?)signingConfig signingConfigs\.debug/;
 function releaseSigningConfig(prefix) {
@@ -87,3 +89,63 @@ function applyShortCxxPath(contents, stagingDir) {
 
     namespace`);
 }
+const KOTLIN_JVM_TARGET_MARKER = "withKotlinJvmTarget";
+/**
+ * Appends to the root `android/build.gradle` a block forcing every Kotlin
+ * compile task, in every subproject, to target `jvmTarget` — the Java code's
+ * target: a native module compiling its Kotlin for another one (e.g.
+ * expo-dynamic-app-icon) fails the build with "Inconsistent JVM-target
+ * compatibility". Already-patched contents are returned as is.
+ *
+ * @throws When `jvmTarget` isn't a JVM version such as `17` or `1.8`.
+ */
+function applyKotlinJvmTarget(contents, jvmTarget = "17") {
+    if (!/^(1\.8|\d{1,2})$/.test(jvmTarget)) {
+        throw new Error(`withKotlinJvmTarget: invalid jvmTarget option "${jvmTarget}" (e.g. 17)`);
+    }
+    if (contents.includes(KOTLIN_JVM_TARGET_MARKER))
+        return contents;
+    return `${contents.trimEnd()}
+
+// ${KOTLIN_JVM_TARGET_MARKER}: Kotlin targets the same JVM as Java (avoids "Inconsistent JVM-target compatibility").
+subprojects {
+    tasks.withType(org.jetbrains.kotlin.gradle.tasks.KotlinCompile).configureEach {
+        compilerOptions {
+            jvmTarget.set(org.jetbrains.kotlin.gradle.dsl.JvmTarget.JVM_${jvmTarget.replace(".", "_")})
+        }
+    }
+}
+`;
+}
+const PERMISSION_NAME = /^[A-Za-z][A-Za-z0-9_]*(\.[A-Za-z][A-Za-z0-9_]*)*$/;
+/**
+ * The `android/app/src/release/AndroidManifest.xml` removing `permissions`
+ * from the release build: merged over the main manifest and every library's,
+ * `tools:node="remove"` drops the permission whoever declared it. Debug
+ * builds keep it (Metro needs `INTERNET`).
+ *
+ * @throws When the list is empty or holds anything but permission names —
+ *   the names end up in XML, nothing else is let through.
+ */
+function buildReleaseRemovedPermissionsManifest(permissions = ["INTERNET"]) {
+    if (permissions.length === 0) {
+        throw new Error("withReleaseRemovedPermissions: empty permissions list");
+    }
+    const names = permissions.map((permission) => {
+        if (!PERMISSION_NAME.test(permission)) {
+            throw new Error(`withReleaseRemovedPermissions: invalid permission name "${permission}"`);
+        }
+        return permission.includes(".")
+            ? permission
+            : `android.permission.${permission}`;
+    });
+    const lines = [...new Set(names)].map((name) => `    <uses-permission android:name="${name}" tools:node="remove"/>`);
+    return `<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by @forthtilliath/expo-config-plugins/withReleaseRemovedPermissions -->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools">
+
+${lines.join("\n")}
+</manifest>
+`;
+}

package/dist/withKotlinJvmTarget.d.ts

@@ -0,0 +1,14 @@
+import { type ConfigPlugin } from "expo/config-plugins";
+import { type KotlinJvmTargetOptions } from "./transforms.js";
+/**
+ * Makes every Kotlin compile task target the same JVM as the Java code (17
+ * by default): some native modules (e.g. expo-dynamic-app-icon) compile
+ * their Kotlin for another target, and the build fails with "Inconsistent
+ * JVM-target compatibility".
+ *
+ * `"@forthtilliath/expo-config-plugins/withKotlinJvmTarget"`, or
+ * `["@forthtilliath/expo-config-plugins/withKotlinJvmTarget", { "jvmTarget": "21" }]`
+ */
+declare const withKotlinJvmTarget: ConfigPlugin<KotlinJvmTargetOptions | undefined>;
+export = withKotlinJvmTarget;
+//# sourceMappingURL=withKotlinJvmTarget.d.ts.map

package/dist/withKotlinJvmTarget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"withKotlinJvmTarget.d.ts","sourceRoot":"","sources":["../src/withKotlinJvmTarget.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAA0B,MAAM,qBAAqB,CAAC;AAEhF,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;GAQG;AACH,QAAA,MAAM,mBAAmB,EAAE,YAAY,CAAC,sBAAsB,GAAG,SAAS,CAUtE,CAAC;AAEL,SAAS,mBAAmB,CAAC"}

package/dist/withKotlinJvmTarget.js

@@ -0,0 +1,17 @@
+"use strict";
+const config_plugins_1 = require("expo/config-plugins");
+const transforms_js_1 = require("./transforms.js");
+/**
+ * Makes every Kotlin compile task target the same JVM as the Java code (17
+ * by default): some native modules (e.g. expo-dynamic-app-icon) compile
+ * their Kotlin for another target, and the build fails with "Inconsistent
+ * JVM-target compatibility".
+ *
+ * `"@forthtilliath/expo-config-plugins/withKotlinJvmTarget"`, or
+ * `["@forthtilliath/expo-config-plugins/withKotlinJvmTarget", { "jvmTarget": "21" }]`
+ */
+const withKotlinJvmTarget = (config, options) => (0, config_plugins_1.withProjectBuildGradle)(config, (mod) => {
+    mod.modResults.contents = (0, transforms_js_1.applyKotlinJvmTarget)(mod.modResults.contents, options?.jvmTarget);
+    return mod;
+});
+module.exports = withKotlinJvmTarget;

package/dist/withReleaseRemovedPermissions.d.ts

@@ -0,0 +1,17 @@
+import { type ConfigPlugin } from "expo/config-plugins";
+import { type ReleaseRemovedPermissionsOptions } from "./transforms.js";
+/**
+ * Strips permissions from the **release** APK only — `INTERNET` by default:
+ * for an app that works fully offline, Android itself then guarantees that
+ * no data can leave the phone, whatever a dependency tries. Debug builds
+ * keep them (Metro needs the network).
+ *
+ * Writes `android/app/src/release/AndroidManifest.xml`; refuses to overwrite
+ * one it didn't generate.
+ *
+ * `"@forthtilliath/expo-config-plugins/withReleaseRemovedPermissions"`, or
+ * `["@forthtilliath/expo-config-plugins/withReleaseRemovedPermissions", { "permissions": ["INTERNET", "ACCESS_NETWORK_STATE"] }]`
+ */
+declare const withReleaseRemovedPermissions: ConfigPlugin<ReleaseRemovedPermissionsOptions | undefined>;
+export = withReleaseRemovedPermissions;
+//# sourceMappingURL=withReleaseRemovedPermissions.d.ts.map

package/dist/withReleaseRemovedPermissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"withReleaseRemovedPermissions.d.ts","sourceRoot":"","sources":["../src/withReleaseRemovedPermissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAoB,MAAM,qBAAqB,CAAC;AAI1E,OAAO,EAEL,KAAK,gCAAgC,EACtC,MAAM,iBAAiB,CAAC;AAYzB;;;;;;;;;;;GAWG;AACH,QAAA,MAAM,6BAA6B,EAAE,YAAY,CAC/C,gCAAgC,GAAG,SAAS,CAqB1C,CAAC;AAEL,SAAS,6BAA6B,CAAC"}

package/dist/withReleaseRemovedPermissions.js

@@ -0,0 +1,43 @@
+"use strict";
+const config_plugins_1 = require("expo/config-plugins");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const transforms_js_1 = require("./transforms.js");
+const GENERATED_MARK = "withReleaseRemovedPermissions";
+async function readIfExists(path) {
+    try {
+        return await (0, promises_1.readFile)(path, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Strips permissions from the **release** APK only — `INTERNET` by default:
+ * for an app that works fully offline, Android itself then guarantees that
+ * no data can leave the phone, whatever a dependency tries. Debug builds
+ * keep them (Metro needs the network).
+ *
+ * Writes `android/app/src/release/AndroidManifest.xml`; refuses to overwrite
+ * one it didn't generate.
+ *
+ * `"@forthtilliath/expo-config-plugins/withReleaseRemovedPermissions"`, or
+ * `["@forthtilliath/expo-config-plugins/withReleaseRemovedPermissions", { "permissions": ["INTERNET", "ACCESS_NETWORK_STATE"] }]`
+ */
+const withReleaseRemovedPermissions = (config, options) => (0, config_plugins_1.withDangerousMod)(config, [
+    "android",
+    async (mod) => {
+        // Built first: invalid options fail the prebuild before any write.
+        const manifest = (0, transforms_js_1.buildReleaseRemovedPermissionsManifest)(options?.permissions);
+        const dir = (0, node_path_1.join)(mod.modRequest.platformProjectRoot, "app/src/release");
+        const path = (0, node_path_1.join)(dir, "AndroidManifest.xml");
+        const existing = await readIfExists(path);
+        if (existing !== null && !existing.includes(GENERATED_MARK)) {
+            throw new Error(`withReleaseRemovedPermissions: ${path} already exists and wasn't generated by this plugin`);
+        }
+        await (0, promises_1.mkdir)(dir, { recursive: true });
+        await (0, promises_1.writeFile)(path, manifest);
+        return mod;
+    },
+]);
+module.exports = withReleaseRemovedPermissions;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@forthtilliath/expo-config-plugins",
-  "version": "0.1.0",
-  "description": "Expo config plugins for sideloaded Android apps: release signing with your own key, ARM-only native code, short CMake paths on Windows.",
+  "version": "0.3.0",
+  "description": "Expo config plugins for sideloaded Android apps: release signing with your own key, ARM-only native code, short CMake paths on Windows, one JVM target for Kotlin, permissions removed from release builds.",
   "license": "MIT",
   "publishConfig": {
     "access": "public"
@@ -20,6 +20,8 @@
     "./withReleaseSigning": "./dist/withReleaseSigning.js",
     "./withAndroidAbis": "./dist/withAndroidAbis.js",
     "./withShortCxxPath": "./dist/withShortCxxPath.js",
+    "./withKotlinJvmTarget": "./dist/withKotlinJvmTarget.js",
+    "./withReleaseRemovedPermissions": "./dist/withReleaseRemovedPermissions.js",
     "./transforms": "./dist/transforms.js",
     "./package.json": "./package.json"
   },
@@ -27,14 +29,14 @@
     "expo": ">=54.0.0"
   },
   "devDependencies": {
-    "@types/node": "^26.2.0",
-    "@vitest/coverage-v8": "5.0.2",
-    "eslint": "10.7.0",
-    "expo": "~57.0.9",
+    "@types/node": "^26.6.6",
+    "@vitest/coverage-v8": "5.0.5",
+    "eslint": "10.14.0",
+    "expo": "~57.0.31",
     "typescript": "^5.9.3",
-    "vitest": "^5.0.2",
-    "@forthtilliath/eslint-config": "0.9.0",
-    "@forthtilliath/typescript-config": "0.1.1"
+    "vitest": "^5.0.5",
+    "@forthtilliath/typescript-config": "0.1.1",
+    "@forthtilliath/eslint-config": "0.10.1"
   },
   "scripts": {
     "lint": "eslint . --max-warnings 0",