@smileid/usesmileid_mlkit_face 12.0.0 → 12.0.2

package/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 12.0.2
+
+See the repository CHANGELOG for the 12.0.2 release notes.
+
+## 12.0.1
+
+See the repository CHANGELOG for the 12.0.1 release notes.
+
 ## 12.0.0
 
 First stable release of the Smile ID v12 SDK. Provides the Android Google ML Kit face detection module for `usesmileid`.

package/README.md

@@ -20,8 +20,32 @@ No ML logic is reimplemented in this package — it's a pure passthrough.
 pnpm add @smileid/usesmileid_mlkit_face
 ```
 
-Expo's autolinking picks up `expo-module.config.json` at app build time;
-no manual native registration required.
+Expo's autolinking picks up `expo-module.config.json` at app build time, but the
+build settings the AAR needs belong to the root Gradle project, so add the
+package to `expo.plugins` in `app.json` and run `npx expo prebuild --clean`:
+
+```json
+{
+  "expo": {
+    "plugins": [
+      [
+        "@smileid/usesmileid_mlkit_face",
+        { "additionalModelDependencies": ["barcode_ui"] }
+      ]
+    ]
+  }
+}
+```
+
+The plugin pins `compileSdk`, the Kotlin/KSP versions the AAR was compiled with,
+and the `androidx.core` version that resolves under Expo's Android Gradle Plugin.
+It also claims the `com.google.mlkit.vision.DEPENDENCIES` meta-data on your
+`<application>` with `tools:replace`: this AAR declares that key as `face`, so
+without the override a second ML Kit consumer declaring its own value (for
+instance `expo-camera`'s barcode scanner, which declares `barcode_ui`) fails the
+Android manifest merger. `additionalModelDependencies` is optional — name the
+hints your other consumers declare so their models are prefetched at install
+time rather than downloaded on first use.
 
 ## Usage
 

package/android/build.gradle

@@ -17,7 +17,7 @@ plugins {
 }
 
 group = 'com.usesmileid.mlkit.face'
-version = '12.0.0'
+version = '12.0.2'
 
 android {
   namespace 'com.usesmileid.mlkit.face'
@@ -29,7 +29,7 @@ android {
   // android/build.gradle and the rest of the @expo/* modules.
   defaultConfig {
     versionCode 1
-    versionName '12.0.0'
+    versionName '12.0.2'
     // R8 keep-rules to bundle into partner apps that depend on this
     // module. Without these, R8 may rename the Expo module entry
     // point and the JS-bridged member functions, breaking autolinking.
@@ -41,7 +41,7 @@ dependencies {
   // Existing Smile ID native AAR — the entire ML pipeline lives here.
   // This Expo Module is a thin Kotlin shim that constructs the
   // session and bridges its four methods to JS via Expo Modules.
-  implementation 'com.usesmileid:mlkit-face:12.0.0'
+  implementation 'com.usesmileid:mlkit-face:12.0.2'
 
   // VisionCamera frame-processor plugin classes. The host app provides
   // this dependency via RN autolinking — react-native-vision-camera >= 4.7.3
@@ -55,4 +55,9 @@ dependencies {
   // app's VisionCamera provides the runtime classes (its camera-core is
   // 1.5.0-alpha03; the `ImageProxy` surface used here is stable since 1.0).
   compileOnly 'androidx.camera:camera-core:1.5.0-alpha03'
+
+  // `FaceDetectorAnalyzer()` takes a defaulted `FaceDetector` argument, so the compiler
+  // needs that type to emit the call. The AAR above declares ML Kit at runtime
+  // scope only — enough to execute, not to compile against.
+  compileOnly 'com.google.android.gms:play-services-mlkit-face-detection:17.1.0'
 }

package/app.plugin.js

@@ -0,0 +1,3 @@
+// Entry point Expo discovers when an app references this package in
+// `expo.plugins`. The compiled plugin lives at `plugin/build/index.js`.
+module.exports = require("./plugin/build");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smileid/usesmileid_mlkit_face",
-  "version": "12.0.0",
+  "version": "12.0.2",
   "description": "Android MLKit face detection implementation for the UseSmileID React Native (Expo) SDK.",
   "homepage": "https://usesmileid.com",
   "repository": {
@@ -31,20 +31,25 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
       "require": "./dist/index.js"
-    }
+    },
+    "./app.plugin.js": "./app.plugin.js"
   },
   "files": [
     "dist",
     "src",
     "android",
+    "plugin/build",
+    "plugin/src",
+    "plugin/tsconfig.json",
+    "app.plugin.js",
     "expo-module.config.json",
     "README.md",
     "LICENSE",
     "CHANGELOG.md"
   ],
   "dependencies": {
-    "@smileid/usesmileid_bridge": "12.0.0",
-    "@smileid/usesmileid_platform_interface": "12.0.0"
+    "@smileid/usesmileid_bridge": "12.0.2",
+    "@smileid/usesmileid_platform_interface": "12.0.2"
   },
   "peerDependencies": {
     "expo": ">=56.0.0",
@@ -52,6 +57,8 @@
     "react-native": ">=0.83.0"
   },
   "devDependencies": {
+    "@types/node": "^25.9.1",
+    "expo": "^56.0.9",
     "expo-modules-core": "^56.0.15",
     "react-native": "^0.85.3",
     "typescript": "^6.0.3"
@@ -60,10 +67,12 @@
     "access": "public"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "typecheck": "tsc -b",
+    "build": "pnpm run build:lib && pnpm run build:plugin",
+    "build:lib": "tsc -p tsconfig.json",
+    "build:plugin": "tsc -p plugin/tsconfig.json",
+    "typecheck": "tsc -b && tsc -p plugin/tsconfig.json --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
-    "clean": "rm -rf dist .turbo coverage"
+    "clean": "rm -rf dist plugin/build .turbo coverage"
   }
 }

package/plugin/build/index.d.ts

@@ -0,0 +1,11 @@
+import { type ConfigPlugin } from "expo/config-plugins";
+import { type MlkitManifestMergeOptions } from "./lib/mlkit_manifest";
+export interface MlkitFaceOptions extends MlkitManifestMergeOptions {
+    /** Overrides the default Kotlin pin (must read the AARs' metadata). */
+    kotlinVersion?: string;
+    /** Opt-in: only when Expo's lookup table lacks the pinned Kotlin. */
+    kspVersion?: string;
+}
+declare const withMlkitFace: ConfigPlugin<MlkitFaceOptions | void>;
+export default withMlkitFace;
+export type { MlkitManifestMergeOptions };

package/plugin/build/index.js

@@ -0,0 +1,27 @@
+"use strict";
+// The module is autolinked as a Gradle subproject, so it inherits the host's
+// Kotlin compiler and `compileSdk`; Expo's defaults for both are lower than the
+// AARs accept and a library cannot raise a setting the root project owns.
+Object.defineProperty(exports, "__esModule", { value: true });
+const root_project_1 = require("./lib/root_project");
+const mlkit_manifest_1 = require("./lib/mlkit_manifest");
+// Lowest Kotlin that reads the AARs' 2.4.x metadata AND has Expo
+// compiler-plugin (pika) artifacts; higher pins break expo-modules-core.
+// KSP is left to Expo's own kotlin→ksp lookup table.
+const DEFAULT_KOTLIN_VERSION = "2.3.20";
+const COMPILE_SDK_VERSION = 37;
+const FORCED_DEPENDENCIES = [
+    "androidx.core:core:1.18.0",
+    "androidx.core:core-ktx:1.18.0",
+];
+const withMlkitFace = (config, options) => {
+    const { kotlinVersion, kspVersion, ...manifestOptions } = options ?? {};
+    return (0, mlkit_manifest_1.withMlkitManifestMerge)((0, root_project_1.withAndroidRootProjectPins)(config, {
+        kotlinVersion: kotlinVersion ?? DEFAULT_KOTLIN_VERSION,
+        ...(kspVersion !== undefined ? { kspVersion } : {}),
+        compileSdkVersion: COMPILE_SDK_VERSION,
+        forcedDependencies: FORCED_DEPENDENCIES,
+    }), manifestOptions);
+};
+exports.default = withMlkitFace;
+//# sourceMappingURL=index.js.map

package/plugin/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,6EAA6E;AAC7E,gFAAgF;AAChF,0EAA0E;;AAI1E,qDAAgE;AAChE,yDAG8B;AAE9B,iEAAiE;AACjE,yEAAyE;AACzE,qDAAqD;AACrD,MAAM,sBAAsB,GAAG,QAAQ,CAAC;AACxC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,mBAAmB,GAAG;IAC1B,2BAA2B;IAC3B,+BAA+B;CAChC,CAAC;AASF,MAAM,aAAa,GAA0C,CAC3D,MAAM,EACN,OAAO,EACP,EAAE;IACF,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IACxE,OAAO,IAAA,uCAAsB,EAC3B,IAAA,yCAA0B,EAAC,MAAM,EAAE;QACjC,aAAa,EAAE,aAAa,IAAI,sBAAsB;QACtD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,iBAAiB,EAAE,mBAAmB;QACtC,kBAAkB,EAAE,mBAAmB;KACxC,CAAC,EACF,eAAe,CAChB,CAAC;AACJ,CAAC,CAAC;AAEF,kBAAe,aAAa,CAAC"}

package/plugin/build/lib/mlkit_manifest.d.ts

@@ -0,0 +1,13 @@
+import { AndroidConfig, type ConfigPlugin } from "expo/config-plugins";
+type AndroidManifest = AndroidConfig.Manifest.AndroidManifest;
+export interface MlkitManifestMergeOptions {
+    /** Hints your app's other ML Kit consumers declare, so their models prefetch at install time rather than on first use. */
+    readonly additionalModelDependencies?: readonly string[];
+}
+/** Provider hint first, then the caller's, deduplicated and order-stable. */
+export declare function mergedModelDependencies(additional: readonly string[]): string;
+/** Declares the merged `com.google.mlkit.vision.DEPENDENCIES` on the host `<application>` with `tools:replace`. */
+export declare const withMlkitManifestMerge: ConfigPlugin<MlkitManifestMergeOptions | void>;
+/** Pure form of the edit. Idempotent; a re-run replaces a stale value. */
+export declare function applyMlkitManifestMerge(manifest: AndroidManifest, value: string): AndroidManifest;
+export {};

package/plugin/build/lib/mlkit_manifest.js

@@ -0,0 +1,54 @@
+"use strict";
+// The AAR declares this meta-data without `tools:replace`, so only the host `<application>` can claim it for every ML Kit consumer at once.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withMlkitManifestMerge = void 0;
+exports.mergedModelDependencies = mergedModelDependencies;
+exports.applyMlkitManifestMerge = applyMlkitManifestMerge;
+const config_plugins_1 = require("expo/config-plugins");
+const META_DATA_NAME = "com.google.mlkit.vision.DEPENDENCIES";
+const TOOLS_NAMESPACE = "http://schemas.android.com/tools";
+/** The hint this package's AAR declares; always part of the merged value. */
+const PROVIDER_MODEL_DEPENDENCY = "face";
+// ML Kit's own hint vocabulary — lowercase words and underscores.
+const MODEL_DEPENDENCY = /^[a-z0-9_]+$/;
+/** Provider hint first, then the caller's, deduplicated and order-stable. */
+function mergedModelDependencies(additional) {
+    for (const dependency of additional) {
+        if (!MODEL_DEPENDENCY.test(dependency)) {
+            throw new Error(`[smileid-android] '${dependency}' is not a valid ML Kit model dependency. ` +
+                "Expected a lowercase hint such as 'barcode_ui', as printed in the manifest-merger error.");
+        }
+    }
+    return [...new Set([PROVIDER_MODEL_DEPENDENCY, ...additional])].join(",");
+}
+/** Declares the merged `com.google.mlkit.vision.DEPENDENCIES` on the host `<application>` with `tools:replace`. */
+const withMlkitManifestMerge = (config, options) => (0, config_plugins_1.withAndroidManifest)(config, (config) => {
+    config.modResults = applyMlkitManifestMerge(config.modResults, mergedModelDependencies(options?.additionalModelDependencies ?? []));
+    return config;
+});
+exports.withMlkitManifestMerge = withMlkitManifestMerge;
+/** Pure form of the edit. Idempotent; a re-run replaces a stale value. */
+function applyMlkitManifestMerge(manifest, value) {
+    const application = config_plugins_1.AndroidConfig.Manifest.getMainApplicationOrThrow(manifest);
+    application["meta-data"] ??= [];
+    const entries = application["meta-data"];
+    const existing = entries.find((entry) => entry?.$?.["android:name"] === META_DATA_NAME);
+    if (existing) {
+        existing.$["android:value"] = value;
+        existing.$["tools:replace"] = "android:value";
+    }
+    else {
+        entries.push({
+            $: {
+                "android:name": META_DATA_NAME,
+                "android:value": value,
+                "tools:replace": "android:value",
+            },
+        });
+    }
+    // Without the namespace on <manifest>, `tools:replace` merges as an unknown attribute.
+    manifest.manifest.$ ??= {};
+    manifest.manifest.$["xmlns:tools"] ??= TOOLS_NAMESPACE;
+    return manifest;
+}
+//# sourceMappingURL=mlkit_manifest.js.map

package/plugin/build/lib/mlkit_manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mlkit_manifest.js","sourceRoot":"","sources":["../../src/lib/mlkit_manifest.ts"],"names":[],"mappings":";AAAA,4IAA4I;;;AAgC5I,0DAUC;AAeD,0DA8BC;AArFD,wDAI6B;AAW7B,MAAM,cAAc,GAAG,sCAAsC,CAAC;AAC9D,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAE3D,6EAA6E;AAC7E,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC,kEAAkE;AAClE,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAOxC,6EAA6E;AAC7E,SAAgB,uBAAuB,CAAC,UAA6B;IACnE,KAAK,MAAM,UAAU,IAAI,UAAU,EAAE,CAAC;QACpC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,sBAAsB,UAAU,4CAA4C;gBAC1E,0FAA0F,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,yBAAyB,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED,mHAAmH;AAC5G,MAAM,sBAAsB,GAE/B,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CACtB,IAAA,oCAAmB,EAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;IACrC,MAAM,CAAC,UAAU,GAAG,uBAAuB,CACzC,MAAM,CAAC,UAAU,EACjB,uBAAuB,CAAC,OAAO,EAAE,2BAA2B,IAAI,EAAE,CAAC,CACpE,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC,CAAC;AATQ,QAAA,sBAAsB,0BAS9B;AAEL,0EAA0E;AAC1E,SAAgB,uBAAuB,CACrC,QAAyB,EACzB,KAAa;IAEb,MAAM,WAAW,GACf,8BAAa,CAAC,QAAQ,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC7D,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAA0B,CAAC;IAElE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAC3B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,cAAc,CACzD,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC;QACpC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,eAAe,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CAAC;YACX,CAAC,EAAE;gBACD,cAAc,EAAE,cAAc;gBAC9B,eAAe,EAAE,KAAK;gBACtB,eAAe,EAAE,eAAe;aACjC;SACF,CAAC,CAAC;IACL,CAAC;IAED,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAsC,CAAC;IAC/D,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,eAAe,CAAC;IAEvD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/plugin/build/lib/root_project.d.ts

@@ -0,0 +1,19 @@
+import { type ConfigPlugin } from "expo/config-plugins";
+export interface AndroidRootProjectPins {
+    /**
+     * Opt-in: only for hosts whose Kotlin predates the AARs' compiler. Current
+     * Expo defaults read the metadata, and forcing a Kotlin that Expo ships no
+     * compiler-plugin artifacts for breaks expo-modules-core.
+     */
+    kotlinVersion?: string;
+    /** Only alongside `kotlinVersion` — Expo's own lookup table may carry no entry for it. */
+    kspVersion?: string;
+    /** The AARs declare it as a consumer minimum. Independent of `minSdk`, so device support is unchanged. */
+    compileSdkVersion: number;
+    /** `group:name:version` coordinates forced everywhere, for deps whose newest release the host toolchain cannot consume. */
+    forcedDependencies: readonly string[];
+}
+/** Declares the pins ahead of `apply plugin: "expo-root-project"`. */
+export declare const withAndroidRootProjectPins: ConfigPlugin<AndroidRootProjectPins>;
+/** Pure form of the edit. Idempotent; a re-run replaces stale values rather than appending. */
+export declare function applyAndroidRootProjectPins(contents: string, pins: AndroidRootProjectPins): string;

package/plugin/build/lib/root_project.js

@@ -0,0 +1,109 @@
+"use strict";
+// `expo-root-project` resolves these through `extra.setIfNotExist`, so they only
+// take effect when declared before that plugin applies.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withAndroidRootProjectPins = void 0;
+exports.applyAndroidRootProjectPins = applyAndroidRootProjectPins;
+const config_plugins_1 = require("expo/config-plugins");
+const BEGIN_MARKER = "// === BEGIN smileid root-project pins ===";
+const END_MARKER = "// === END smileid root-project pins ===";
+const APPLY_ROOT_PROJECT = /^apply\s+plugin:\s*["']expo-root-project["']/m;
+// Bumping `ext.kotlinVersion` moves the dependency catalog but not the compiler, so
+// the classpath line needs pinning too. Version and parentheses are optional so an
+// already-pinned line and Groovy's space-call form still match.
+const KGP_CLASSPATH = /classpath\s*(?:\(\s*)?['"]org\.jetbrains\.kotlin:kotlin-gradle-plugin(?::[^'"]*)?['"](?:\s*\))?/;
+/** Declares the pins ahead of `apply plugin: "expo-root-project"`. */
+const withAndroidRootProjectPins = (config, pins) => (0, config_plugins_1.withProjectBuildGradle)(config, (config) => {
+    if (config.modResults.language !== "groovy") {
+        throw new Error("[smileid-android] Expected android/build.gradle to be Groovy DSL; refusing to edit " +
+            `a ${config.modResults.language} build script.`);
+    }
+    config.modResults.contents = applyAndroidRootProjectPins(config.modResults.contents, pins);
+    return config;
+});
+exports.withAndroidRootProjectPins = withAndroidRootProjectPins;
+/** Pure form of the edit. Idempotent; a re-run replaces stale values rather than appending. */
+function applyAndroidRootProjectPins(contents, pins) {
+    if (pins.kspVersion !== undefined && pins.kotlinVersion === undefined) {
+        throw new Error("[smileid-android] `kspVersion` only makes sense alongside `kotlinVersion`.");
+    }
+    validateGroovySafe(pins);
+    const pinned = pins.kotlinVersion === undefined
+        ? contents
+        : pinKotlinGradlePlugin(contents, pins.kotlinVersion);
+    return upsertPinBlock(pinned, renderPinBlock(pins));
+}
+// Every value lands in a single-quoted Groovy literal; reject anything that could close one.
+function validateGroovySafe(pins) {
+    const values = [
+        pins.kotlinVersion,
+        pins.kspVersion,
+        ...pins.forcedDependencies,
+    ].filter((value) => value !== undefined);
+    for (const value of values) {
+        if (/['\\\n\r\t$]/.test(value)) {
+            throw new Error(`[smileid-android] Refusing to edit android/build.gradle: '${value}' contains an unsafe character.`);
+        }
+    }
+}
+function pinKotlinGradlePlugin(contents, kotlinVersion) {
+    const pinned = `classpath('org.jetbrains.kotlin:kotlin-gradle-plugin:${kotlinVersion}')`;
+    if (!KGP_CLASSPATH.test(contents)) {
+        throw new Error("[smileid-android] Could not locate the kotlin-gradle-plugin classpath line in " +
+            "android/build.gradle. Refusing to silently no-op — the Smile ID analyzer modules do not " +
+            `compile unless the Kotlin compiler is pinned to ${kotlinVersion}.`);
+    }
+    return contents.replace(KGP_CLASSPATH, pinned);
+}
+// Adding a further root-project pin means adding an entry here.
+function renderPinBlock(pins) {
+    const extProperties = [];
+    if (pins.kotlinVersion !== undefined) {
+        extProperties.push(["kotlinVersion", `'${pins.kotlinVersion}'`]);
+    }
+    if (pins.kspVersion !== undefined) {
+        extProperties.push(["kspVersion", `'${pins.kspVersion}'`]);
+    }
+    extProperties.push(["compileSdkVersion", String(pins.compileSdkVersion)]);
+    const lines = extProperties.map(([name, value]) => `ext.${name} = ${value}`);
+    return [
+        BEGIN_MARKER,
+        ...lines,
+        ...renderForcedDependencies(pins.forcedDependencies),
+        END_MARKER,
+    ].join("\n");
+}
+// Its own `allprojects` block, which Gradle merges — editing the template's would
+// break the moment its shape changes.
+function renderForcedDependencies(coordinates) {
+    if (coordinates.length === 0) {
+        return [];
+    }
+    return [
+        "",
+        "// Forced to the newest release that resolves under the AGP Expo generates.",
+        "allprojects {",
+        "  configurations.all {",
+        "    resolutionStrategy {",
+        ...coordinates.map((coordinate) => `      force '${coordinate}'`),
+        "    }",
+        "  }",
+        "}",
+    ];
+}
+function upsertPinBlock(contents, block) {
+    const existing = new RegExp(`${escapeRegExp(BEGIN_MARKER)}[\\s\\S]*?${escapeRegExp(END_MARKER)}`, "m");
+    if (existing.test(contents)) {
+        return contents.replace(existing, block);
+    }
+    if (!APPLY_ROOT_PROJECT.test(contents)) {
+        throw new Error('[smileid-android] Could not locate `apply plugin: "expo-root-project"` in ' +
+            "android/build.gradle. Refusing to silently no-op — these pins only take effect when " +
+            "declared before that plugin applies.");
+    }
+    return contents.replace(APPLY_ROOT_PROJECT, (match) => `${block}\n\n${match}`);
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+//# sourceMappingURL=root_project.js.map

package/plugin/build/lib/root_project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"root_project.js","sourceRoot":"","sources":["../../src/lib/root_project.ts"],"names":[],"mappings":";AAAA,iFAAiF;AACjF,wDAAwD;;;AAiDxD,kEAeC;AA9DD,wDAAgF;AAiBhF,MAAM,YAAY,GAAG,4CAA4C,CAAC;AAClE,MAAM,UAAU,GAAG,0CAA0C,CAAC;AAE9D,MAAM,kBAAkB,GAAG,+CAA+C,CAAC;AAE3E,oFAAoF;AACpF,mFAAmF;AACnF,gEAAgE;AAChE,MAAM,aAAa,GACjB,iGAAiG,CAAC;AAEpG,sEAAsE;AAC/D,MAAM,0BAA0B,GAEnC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CACnB,IAAA,uCAAsB,EAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;IACxC,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,qFAAqF;YACnF,KAAK,MAAM,CAAC,UAAU,CAAC,QAAQ,gBAAgB,CAClD,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,UAAU,CAAC,QAAQ,GAAG,2BAA2B,CACtD,MAAM,CAAC,UAAU,CAAC,QAAQ,EAC1B,IAAI,CACL,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC,CAAC;AAfQ,QAAA,0BAA0B,8BAelC;AAEL,+FAA+F;AAC/F,SAAgB,2BAA2B,CACzC,QAAgB,EAChB,IAA4B;IAE5B,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,MAAM,GACV,IAAI,CAAC,aAAa,KAAK,SAAS;QAC9B,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1D,OAAO,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,6FAA6F;AAC7F,SAAS,kBAAkB,CAAC,IAA4B;IACtD,MAAM,MAAM,GAAG;QACb,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,UAAU;QACf,GAAG,IAAI,CAAC,kBAAkB;KAC3B,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,6DAA6D,KAAK,iCAAiC,CACpG,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAAgB,EAChB,aAAqB;IAErB,MAAM,MAAM,GAAG,wDAAwD,aAAa,IAAI,CAAC;IACzF,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,gFAAgF;YAC9E,0FAA0F;YAC1F,mDAAmD,aAAa,GAAG,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,gEAAgE;AAChE,SAAS,cAAc,CAAC,IAA4B;IAClD,MAAM,aAAa,GAA4B,EAAE,CAAC;IAClD,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACrC,aAAa,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC;IAC7E,OAAO;QACL,YAAY;QACZ,GAAG,KAAK;QACR,GAAG,wBAAwB,CAAC,IAAI,CAAC,kBAAkB,CAAC;QACpD,UAAU;KACX,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,kFAAkF;AAClF,sCAAsC;AACtC,SAAS,wBAAwB,CAAC,WAA8B;IAC9D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL,EAAE;QACF,6EAA6E;QAC7E,eAAe;QACf,wBAAwB;QACxB,0BAA0B;QAC1B,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,UAAU,GAAG,CAAC;QACjE,OAAO;QACP,KAAK;QACL,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,KAAa;IACrD,MAAM,QAAQ,GAAG,IAAI,MAAM,CACzB,GAAG,YAAY,CAAC,YAAY,CAAC,aAAa,YAAY,CAAC,UAAU,CAAC,EAAE,EACpE,GAAG,CACJ,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,sFAAsF;YACtF,sCAAsC,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CACrB,kBAAkB,EAClB,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,OAAO,KAAK,EAAE,CAClC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC"}

package/plugin/src/__tests__/mirrored_sources.test.ts

@@ -0,0 +1,57 @@
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+// Both packages write the same marked region of `android/build.gradle`, so if
+// their pins diverge the plugin Expo runs last silently wins.
+
+const workspaceRoot = fileURLToPath(new URL("../../../../", import.meta.url));
+
+function read(relativePath: string): string {
+  return readFileSync(`${workspaceRoot}${relativePath}`, "utf8");
+}
+
+describe("mirrored plugin sources", () => {
+  // `plugin/src/index.ts` is deliberately absent: only the face package composes the manifest-merge plugin.
+  it.each([
+    "plugin/src/lib/root_project.ts",
+    "plugin/tsconfig.json",
+    "app.plugin.js",
+  ])("keeps the mlkit packages' %s in step", (relativePath) => {
+    const face = read(`usesmileid_mlkit_face/${relativePath}`);
+    const document = read(`usesmileid_mlkit_document/${relativePath}`);
+
+    // The entry points differ only in the analyzer they name.
+    expect(normalise(face)).toBe(normalise(document));
+  });
+
+  it.each([
+    "plugin/src/lib/podfile.ts",
+    "plugin/src/lib/deployment_target.ts",
+    "plugin/tsconfig.json",
+    "app.plugin.js",
+  ])("keeps the vision packages' %s in step", (relativePath) => {
+    expect(read(`usesmileid_vision_face/${relativePath}`)).toBe(
+      read(`usesmileid_vision_document/${relativePath}`),
+    );
+  });
+
+  it("pins the same Android versions in both mlkit plugins", () => {
+    const pins =
+      /const (DEFAULT_KOTLIN_VERSION|COMPILE_SDK_VERSION|FORCED_DEPENDENCIES)[\s\S]*?;/g;
+    const face = read("usesmileid_mlkit_face/plugin/src/index.ts").match(pins);
+    const document = read(
+      "usesmileid_mlkit_document/plugin/src/index.ts",
+    ).match(pins);
+
+    expect(face).not.toBeNull();
+    expect(face).toHaveLength(3);
+    expect(face).toStrictEqual(document);
+  });
+});
+
+function normalise(source: string): string {
+  return source
+    .replace(/face/gi, "<analyzer>")
+    .replace(/document/gi, "<analyzer>");
+}

package/plugin/src/__tests__/mlkit_manifest.test.ts

@@ -0,0 +1,117 @@
+import { describe, expect, it } from "vitest";
+import { AndroidConfig } from "expo/config-plugins";
+
+import {
+  applyMlkitManifestMerge,
+  mergedModelDependencies,
+} from "../lib/mlkit_manifest";
+
+type AndroidManifest = AndroidConfig.Manifest.AndroidManifest;
+
+const META_DATA_NAME = "com.google.mlkit.vision.DEPENDENCIES";
+
+// xml2js form, as `withAndroidManifest` hands the prebuild manifest over.
+function template(): AndroidManifest {
+  return {
+    manifest: {
+      $: { "xmlns:android": "http://schemas.android.com/apk/res/android" },
+      application: [
+        {
+          $: { "android:name": ".MainApplication" },
+        },
+      ],
+    },
+  } as unknown as AndroidManifest;
+}
+
+function metaData(manifest: AndroidManifest) {
+  const application =
+    AndroidConfig.Manifest.getMainApplicationOrThrow(manifest);
+  return (application["meta-data"] ?? []).find(
+    (entry) => entry?.$?.["android:name"] === META_DATA_NAME,
+  );
+}
+
+describe("mergedModelDependencies", () => {
+  it("always declares the hint this package's AAR carries", () => {
+    expect(mergedModelDependencies([])).toBe("face");
+  });
+
+  it("appends the host app's other ML Kit hints", () => {
+    expect(mergedModelDependencies(["barcode_ui"])).toBe("face,barcode_ui");
+  });
+
+  it("deduplicates so a caller repeating the provider hint is harmless", () => {
+    expect(mergedModelDependencies(["face", "barcode_ui", "barcode_ui"])).toBe(
+      "face,barcode_ui",
+    );
+  });
+
+  it("rejects a value that could not be an ML Kit hint", () => {
+    expect(() => mergedModelDependencies(['face" />'])).toThrow(
+      /not a valid ML Kit model dependency/,
+    );
+  });
+});
+
+describe("applyMlkitManifestMerge", () => {
+  it("claims the attribute for every ML Kit library in the app", () => {
+    const manifest = applyMlkitManifestMerge(template(), "face,barcode_ui");
+    const entry = metaData(manifest);
+
+    expect(entry?.$["android:value"]).toBe("face,barcode_ui");
+    expect(entry?.$["tools:replace"]).toBe("android:value");
+  });
+
+  it("declares the tools namespace the tools:replace attribute needs", () => {
+    const manifest = applyMlkitManifestMerge(template(), "face");
+
+    expect(manifest.manifest.$["xmlns:tools"]).toBe(
+      "http://schemas.android.com/tools",
+    );
+  });
+
+  it("leaves a namespace the host already declared alone", () => {
+    const withNamespace = template();
+    withNamespace.manifest.$["xmlns:tools"] =
+      "http://schemas.android.com/tools";
+
+    const manifest = applyMlkitManifestMerge(withNamespace, "face");
+
+    expect(manifest.manifest.$["xmlns:tools"]).toBe(
+      "http://schemas.android.com/tools",
+    );
+  });
+
+  it("replaces a stale value instead of declaring the key twice", () => {
+    const once = applyMlkitManifestMerge(template(), "face");
+    const twice = applyMlkitManifestMerge(once, "face,barcode_ui");
+
+    const application = AndroidConfig.Manifest.getMainApplicationOrThrow(twice);
+    const entries = (application["meta-data"] ?? []).filter(
+      (entry) => entry?.$?.["android:name"] === META_DATA_NAME,
+    );
+
+    expect(entries).toHaveLength(1);
+    expect(entries[0]?.$["android:value"]).toBe("face,barcode_ui");
+  });
+
+  it("keeps unrelated meta-data the host declared", () => {
+    const withOther = template();
+    const application =
+      AndroidConfig.Manifest.getMainApplicationOrThrow(withOther);
+    application["meta-data"] = [
+      { $: { "android:name": "com.example.OTHER", "android:value": "keep" } },
+    ];
+
+    const manifest = applyMlkitManifestMerge(withOther, "face");
+    const merged =
+      AndroidConfig.Manifest.getMainApplicationOrThrow(manifest)["meta-data"];
+
+    expect(merged).toHaveLength(2);
+    expect(
+      merged?.find((entry) => entry.$["android:name"] === "com.example.OTHER")
+        ?.$["android:value"],
+    ).toBe("keep");
+  });
+});

package/plugin/src/__tests__/root_project.test.ts

@@ -0,0 +1,195 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  applyAndroidRootProjectPins,
+  type AndroidRootProjectPins,
+} from "../lib/root_project";
+
+const PINS: AndroidRootProjectPins = {
+  kotlinVersion: "2.4.10",
+  kspVersion: "2.3.10",
+  compileSdkVersion: 37,
+  forcedDependencies: [
+    "androidx.core:core:1.18.0",
+    "androidx.core:core-ktx:1.18.0",
+  ],
+};
+
+// Shaped like the `android/build.gradle` Expo prebuild generates.
+const TEMPLATE = `buildscript {
+  repositories {
+    google()
+    mavenCentral()
+  }
+  dependencies {
+    classpath('com.android.tools.build:gradle')
+    classpath('com.facebook.react:react-native-gradle-plugin')
+    classpath('org.jetbrains.kotlin:kotlin-gradle-plugin')
+  }
+}
+
+allprojects {
+  repositories {
+    google()
+    mavenCentral()
+    maven { url 'https://www.jitpack.io' }
+  }
+}
+
+apply plugin: "expo-root-project"
+apply plugin: "com.facebook.react.rootproject"
+`;
+
+describe("applyAndroidRootProjectPins", () => {
+  it("declares every pin before expo-root-project applies", () => {
+    const result = applyAndroidRootProjectPins(TEMPLATE, PINS);
+
+    expect(result).toContain("ext.kotlinVersion = '2.4.10'");
+    expect(result).toContain("ext.kspVersion = '2.3.10'");
+    expect(result).toContain("ext.compileSdkVersion = 37");
+    expect(result.indexOf("ext.kotlinVersion")).toBeLessThan(
+      result.indexOf('apply plugin: "expo-root-project"'),
+    );
+  });
+
+  it("pins the Kotlin Gradle Plugin classpath so the compiler moves too", () => {
+    const result = applyAndroidRootProjectPins(TEMPLATE, PINS);
+
+    expect(result).toContain(
+      "classpath('org.jetbrains.kotlin:kotlin-gradle-plugin:2.4.10')",
+    );
+  });
+
+  // A template using Groovy's space form must not abort prebuild.
+  it.each([
+    [
+      "space-call, double quotes",
+      'classpath "org.jetbrains.kotlin:kotlin-gradle-plugin"',
+    ],
+    [
+      "space-call, single quotes",
+      "classpath 'org.jetbrains.kotlin:kotlin-gradle-plugin'",
+    ],
+    [
+      "already versioned",
+      "classpath('org.jetbrains.kotlin:kotlin-gradle-plugin:2.1.20')",
+    ],
+  ])("pins the classpath written as %s", (_label, line) => {
+    const template = TEMPLATE.replace(
+      "classpath('org.jetbrains.kotlin:kotlin-gradle-plugin')",
+      line,
+    );
+
+    const result = applyAndroidRootProjectPins(template, PINS);
+
+    expect(result).toContain(
+      "classpath('org.jetbrains.kotlin:kotlin-gradle-plugin:2.4.10')",
+    );
+    expect(result).not.toContain("kotlin-gradle-plugin:2.1.20");
+  });
+
+  it("is idempotent across prebuilds", () => {
+    const once = applyAndroidRootProjectPins(TEMPLATE, PINS);
+
+    expect(applyAndroidRootProjectPins(once, PINS)).toBe(once);
+  });
+
+  it("replaces stale versions instead of appending a second block", () => {
+    const stale = applyAndroidRootProjectPins(TEMPLATE, {
+      kotlinVersion: "2.3.20",
+      kspVersion: "2.3.6",
+      compileSdkVersion: 36,
+      forcedDependencies: ["androidx.core:core:1.17.0"],
+    });
+
+    const result = applyAndroidRootProjectPins(stale, PINS);
+
+    expect(result).not.toContain("2.3.20");
+    expect(result).not.toContain("ext.compileSdkVersion = 36");
+    expect(result).not.toContain("androidx.core:core:1.17.0");
+    expect(result.match(/ext\.kotlinVersion/g)).toHaveLength(1);
+    expect(result.match(/resolutionStrategy/g)).toHaveLength(1);
+  });
+
+  it("forces the pinned dependency versions across every module", () => {
+    const result = applyAndroidRootProjectPins(TEMPLATE, PINS);
+
+    expect(result).toContain("allprojects {");
+    expect(result).toContain("force 'androidx.core:core:1.18.0'");
+    expect(result).toContain("force 'androidx.core:core-ktx:1.18.0'");
+  });
+
+  it("emits no resolution block when nothing is forced", () => {
+    const result = applyAndroidRootProjectPins(TEMPLATE, {
+      ...PINS,
+      forcedDependencies: [],
+    });
+
+    expect(result).not.toContain("resolutionStrategy");
+    expect(result).toContain("ext.compileSdkVersion = 37");
+  });
+
+  it("leaves the template's own allprojects block intact", () => {
+    const result = applyAndroidRootProjectPins(TEMPLATE, PINS);
+
+    expect(result).toContain("mavenCentral()");
+    expect(result.match(/allprojects \{/g)).toHaveLength(2);
+  });
+
+  it("rejects a coordinate that could break out of the Groovy literal", () => {
+    expect(() =>
+      applyAndroidRootProjectPins(TEMPLATE, {
+        ...PINS,
+        forcedDependencies: [
+          "androidx.core:core:1.18.0'; new File('/').delete()",
+        ],
+      }),
+    ).toThrow(/unsafe character/);
+  });
+
+  it("fails loudly when the Kotlin Gradle Plugin classpath is absent", () => {
+    const withoutKotlin = TEMPLATE.replace(
+      "    classpath('org.jetbrains.kotlin:kotlin-gradle-plugin')\n",
+      "",
+    );
+
+    expect(() => applyAndroidRootProjectPins(withoutKotlin, PINS)).toThrow(
+      /kotlin-gradle-plugin classpath/,
+    );
+  });
+
+  it("leaves the host's Kotlin untouched when no kotlinVersion is given", () => {
+    const result = applyAndroidRootProjectPins(TEMPLATE, {
+      compileSdkVersion: 37,
+      forcedDependencies: PINS.forcedDependencies,
+    });
+
+    expect(result).not.toContain("ext.kotlinVersion");
+    expect(result).not.toContain("ext.kspVersion");
+    expect(result).toContain(
+      "classpath('org.jetbrains.kotlin:kotlin-gradle-plugin')",
+    );
+    expect(result).toContain("ext.compileSdkVersion = 37");
+  });
+
+  it("rejects kspVersion without kotlinVersion", () => {
+    expect(() =>
+      applyAndroidRootProjectPins(TEMPLATE, {
+        kspVersion: "2.3.10",
+        compileSdkVersion: 37,
+        forcedDependencies: [],
+      }),
+    ).toThrow(/kspVersion/);
+  });
+
+  it("fails loudly when expo-root-project is absent", () => {
+    const withoutRootProject = TEMPLATE.replace(
+      'apply plugin: "expo-root-project"\n',
+      "",
+    );
+
+    expect(() => applyAndroidRootProjectPins(withoutRootProject, PINS)).toThrow(
+      /expo-root-project/,
+    );
+  });
+});

package/plugin/src/index.ts

@@ -0,0 +1,47 @@
+// The module is autolinked as a Gradle subproject, so it inherits the host's
+// Kotlin compiler and `compileSdk`; Expo's defaults for both are lower than the
+// AARs accept and a library cannot raise a setting the root project owns.
+
+import { type ConfigPlugin } from "expo/config-plugins";
+
+import { withAndroidRootProjectPins } from "./lib/root_project";
+import {
+  withMlkitManifestMerge,
+  type MlkitManifestMergeOptions,
+} from "./lib/mlkit_manifest";
+
+// Lowest Kotlin that reads the AARs' 2.4.x metadata AND has Expo
+// compiler-plugin (pika) artifacts; higher pins break expo-modules-core.
+// KSP is left to Expo's own kotlin→ksp lookup table.
+const DEFAULT_KOTLIN_VERSION = "2.3.20";
+const COMPILE_SDK_VERSION = 37;
+const FORCED_DEPENDENCIES = [
+  "androidx.core:core:1.18.0",
+  "androidx.core:core-ktx:1.18.0",
+];
+
+export interface MlkitFaceOptions extends MlkitManifestMergeOptions {
+  /** Overrides the default Kotlin pin (must read the AARs' metadata). */
+  kotlinVersion?: string;
+  /** Opt-in: only when Expo's lookup table lacks the pinned Kotlin. */
+  kspVersion?: string;
+}
+
+const withMlkitFace: ConfigPlugin<MlkitFaceOptions | void> = (
+  config,
+  options,
+) => {
+  const { kotlinVersion, kspVersion, ...manifestOptions } = options ?? {};
+  return withMlkitManifestMerge(
+    withAndroidRootProjectPins(config, {
+      kotlinVersion: kotlinVersion ?? DEFAULT_KOTLIN_VERSION,
+      ...(kspVersion !== undefined ? { kspVersion } : {}),
+      compileSdkVersion: COMPILE_SDK_VERSION,
+      forcedDependencies: FORCED_DEPENDENCIES,
+    }),
+    manifestOptions,
+  );
+};
+
+export default withMlkitFace;
+export type { MlkitManifestMergeOptions };

package/plugin/src/lib/mlkit_manifest.ts

@@ -0,0 +1,88 @@
+// The AAR declares this meta-data without `tools:replace`, so only the host `<application>` can claim it for every ML Kit consumer at once.
+
+import {
+  AndroidConfig,
+  type ConfigPlugin,
+  withAndroidManifest,
+} from "expo/config-plugins";
+
+type AndroidManifest = AndroidConfig.Manifest.AndroidManifest;
+
+// Expo's meta-data attribute type covers only the `android:*` names.
+type ReplaceableMetaData = {
+  $: AndroidConfig.Manifest.ManifestMetaData["$"] & {
+    "tools:replace"?: string;
+  };
+};
+
+const META_DATA_NAME = "com.google.mlkit.vision.DEPENDENCIES";
+const TOOLS_NAMESPACE = "http://schemas.android.com/tools";
+
+/** The hint this package's AAR declares; always part of the merged value. */
+const PROVIDER_MODEL_DEPENDENCY = "face";
+
+// ML Kit's own hint vocabulary — lowercase words and underscores.
+const MODEL_DEPENDENCY = /^[a-z0-9_]+$/;
+
+export interface MlkitManifestMergeOptions {
+  /** Hints your app's other ML Kit consumers declare, so their models prefetch at install time rather than on first use. */
+  readonly additionalModelDependencies?: readonly string[];
+}
+
+/** Provider hint first, then the caller's, deduplicated and order-stable. */
+export function mergedModelDependencies(additional: readonly string[]): string {
+  for (const dependency of additional) {
+    if (!MODEL_DEPENDENCY.test(dependency)) {
+      throw new Error(
+        `[smileid-android] '${dependency}' is not a valid ML Kit model dependency. ` +
+          "Expected a lowercase hint such as 'barcode_ui', as printed in the manifest-merger error.",
+      );
+    }
+  }
+  return [...new Set([PROVIDER_MODEL_DEPENDENCY, ...additional])].join(",");
+}
+
+/** Declares the merged `com.google.mlkit.vision.DEPENDENCIES` on the host `<application>` with `tools:replace`. */
+export const withMlkitManifestMerge: ConfigPlugin<
+  MlkitManifestMergeOptions | void
+> = (config, options) =>
+  withAndroidManifest(config, (config) => {
+    config.modResults = applyMlkitManifestMerge(
+      config.modResults,
+      mergedModelDependencies(options?.additionalModelDependencies ?? []),
+    );
+    return config;
+  });
+
+/** Pure form of the edit. Idempotent; a re-run replaces a stale value. */
+export function applyMlkitManifestMerge(
+  manifest: AndroidManifest,
+  value: string,
+): AndroidManifest {
+  const application =
+    AndroidConfig.Manifest.getMainApplicationOrThrow(manifest);
+  application["meta-data"] ??= [];
+  const entries = application["meta-data"] as ReplaceableMetaData[];
+
+  const existing = entries.find(
+    (entry) => entry?.$?.["android:name"] === META_DATA_NAME,
+  );
+  if (existing) {
+    existing.$["android:value"] = value;
+    existing.$["tools:replace"] = "android:value";
+  } else {
+    entries.push({
+      $: {
+        "android:name": META_DATA_NAME,
+        "android:value": value,
+        "tools:replace": "android:value",
+      },
+    });
+  }
+
+  // Without the namespace on <manifest>, `tools:replace` merges as an unknown attribute.
+  manifest.manifest.$ ??= {} as AndroidManifest["manifest"]["$"];
+  manifest.manifest.$["xmlns:tools"] ??= TOOLS_NAMESPACE;
+
+  return manifest;
+}

package/plugin/src/lib/root_project.ts

@@ -0,0 +1,160 @@
+// `expo-root-project` resolves these through `extra.setIfNotExist`, so they only
+// take effect when declared before that plugin applies.
+
+import { type ConfigPlugin, withProjectBuildGradle } from "expo/config-plugins";
+
+export interface AndroidRootProjectPins {
+  /**
+   * Opt-in: only for hosts whose Kotlin predates the AARs' compiler. Current
+   * Expo defaults read the metadata, and forcing a Kotlin that Expo ships no
+   * compiler-plugin artifacts for breaks expo-modules-core.
+   */
+  kotlinVersion?: string;
+  /** Only alongside `kotlinVersion` — Expo's own lookup table may carry no entry for it. */
+  kspVersion?: string;
+  /** The AARs declare it as a consumer minimum. Independent of `minSdk`, so device support is unchanged. */
+  compileSdkVersion: number;
+  /** `group:name:version` coordinates forced everywhere, for deps whose newest release the host toolchain cannot consume. */
+  forcedDependencies: readonly string[];
+}
+
+const BEGIN_MARKER = "// === BEGIN smileid root-project pins ===";
+const END_MARKER = "// === END smileid root-project pins ===";
+
+const APPLY_ROOT_PROJECT = /^apply\s+plugin:\s*["']expo-root-project["']/m;
+
+// Bumping `ext.kotlinVersion` moves the dependency catalog but not the compiler, so
+// the classpath line needs pinning too. Version and parentheses are optional so an
+// already-pinned line and Groovy's space-call form still match.
+const KGP_CLASSPATH =
+  /classpath\s*(?:\(\s*)?['"]org\.jetbrains\.kotlin:kotlin-gradle-plugin(?::[^'"]*)?['"](?:\s*\))?/;
+
+/** Declares the pins ahead of `apply plugin: "expo-root-project"`. */
+export const withAndroidRootProjectPins: ConfigPlugin<
+  AndroidRootProjectPins
+> = (config, pins) =>
+  withProjectBuildGradle(config, (config) => {
+    if (config.modResults.language !== "groovy") {
+      throw new Error(
+        "[smileid-android] Expected android/build.gradle to be Groovy DSL; refusing to edit " +
+          `a ${config.modResults.language} build script.`,
+      );
+    }
+    config.modResults.contents = applyAndroidRootProjectPins(
+      config.modResults.contents,
+      pins,
+    );
+    return config;
+  });
+
+/** Pure form of the edit. Idempotent; a re-run replaces stale values rather than appending. */
+export function applyAndroidRootProjectPins(
+  contents: string,
+  pins: AndroidRootProjectPins,
+): string {
+  if (pins.kspVersion !== undefined && pins.kotlinVersion === undefined) {
+    throw new Error(
+      "[smileid-android] `kspVersion` only makes sense alongside `kotlinVersion`.",
+    );
+  }
+  validateGroovySafe(pins);
+  const pinned =
+    pins.kotlinVersion === undefined
+      ? contents
+      : pinKotlinGradlePlugin(contents, pins.kotlinVersion);
+  return upsertPinBlock(pinned, renderPinBlock(pins));
+}
+
+// Every value lands in a single-quoted Groovy literal; reject anything that could close one.
+function validateGroovySafe(pins: AndroidRootProjectPins): void {
+  const values = [
+    pins.kotlinVersion,
+    pins.kspVersion,
+    ...pins.forcedDependencies,
+  ].filter((value): value is string => value !== undefined);
+  for (const value of values) {
+    if (/['\\\n\r\t$]/.test(value)) {
+      throw new Error(
+        `[smileid-android] Refusing to edit android/build.gradle: '${value}' contains an unsafe character.`,
+      );
+    }
+  }
+}
+
+function pinKotlinGradlePlugin(
+  contents: string,
+  kotlinVersion: string,
+): string {
+  const pinned = `classpath('org.jetbrains.kotlin:kotlin-gradle-plugin:${kotlinVersion}')`;
+  if (!KGP_CLASSPATH.test(contents)) {
+    throw new Error(
+      "[smileid-android] Could not locate the kotlin-gradle-plugin classpath line in " +
+        "android/build.gradle. Refusing to silently no-op — the Smile ID analyzer modules do not " +
+        `compile unless the Kotlin compiler is pinned to ${kotlinVersion}.`,
+    );
+  }
+  return contents.replace(KGP_CLASSPATH, pinned);
+}
+
+// Adding a further root-project pin means adding an entry here.
+function renderPinBlock(pins: AndroidRootProjectPins): string {
+  const extProperties: Array<[string, string]> = [];
+  if (pins.kotlinVersion !== undefined) {
+    extProperties.push(["kotlinVersion", `'${pins.kotlinVersion}'`]);
+  }
+  if (pins.kspVersion !== undefined) {
+    extProperties.push(["kspVersion", `'${pins.kspVersion}'`]);
+  }
+  extProperties.push(["compileSdkVersion", String(pins.compileSdkVersion)]);
+  const lines = extProperties.map(([name, value]) => `ext.${name} = ${value}`);
+  return [
+    BEGIN_MARKER,
+    ...lines,
+    ...renderForcedDependencies(pins.forcedDependencies),
+    END_MARKER,
+  ].join("\n");
+}
+
+// Its own `allprojects` block, which Gradle merges — editing the template's would
+// break the moment its shape changes.
+function renderForcedDependencies(coordinates: readonly string[]): string[] {
+  if (coordinates.length === 0) {
+    return [];
+  }
+  return [
+    "",
+    "// Forced to the newest release that resolves under the AGP Expo generates.",
+    "allprojects {",
+    "  configurations.all {",
+    "    resolutionStrategy {",
+    ...coordinates.map((coordinate) => `      force '${coordinate}'`),
+    "    }",
+    "  }",
+    "}",
+  ];
+}
+
+function upsertPinBlock(contents: string, block: string): string {
+  const existing = new RegExp(
+    `${escapeRegExp(BEGIN_MARKER)}[\\s\\S]*?${escapeRegExp(END_MARKER)}`,
+    "m",
+  );
+  if (existing.test(contents)) {
+    return contents.replace(existing, block);
+  }
+  if (!APPLY_ROOT_PROJECT.test(contents)) {
+    throw new Error(
+      '[smileid-android] Could not locate `apply plugin: "expo-root-project"` in ' +
+        "android/build.gradle. Refusing to silently no-op — these pins only take effect when " +
+        "declared before that plugin applies.",
+    );
+  }
+  return contents.replace(
+    APPLY_ROOT_PROJECT,
+    (match) => `${block}\n\n${match}`,
+  );
+}
+
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}

package/plugin/tsconfig.json

@@ -0,0 +1,24 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "./build",
+    "rootDir": "./src",
+    "module": "commonjs",
+    "moduleResolution": "node",
+    "ignoreDeprecations": "6.0",
+    "target": "ES2021",
+    "lib": ["ES2022"],
+    "types": ["node"],
+    "declaration": true,
+    "declarationMap": false,
+    "sourceMap": true,
+    "composite": false
+  },
+  "include": ["src/**/*"],
+  "exclude": [
+    "src/**/*.test.ts",
+    "src/**/__tests__/**",
+    "build",
+    "node_modules"
+  ]
+}