catalyst-core 1.1.0 → 1.2.0-canary.2

package/dist/native/appIcon.js

@@ -0,0 +1,100 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.MIN_ICON_SIZE = void 0;
+exports.checkAppIcon = checkAppIcon;
+exports.readPngInfo = readPngInfo;
+var _fs = _interopRequireDefault(require("fs"));
+var _path = _interopRequireDefault(require("path"));
+var _utils = require("./utils.js");
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+// The single app icon both platforms build from: public/icon.png. App Store
+// Connect wants a 1024x1024 marketing icon, so that is the floor.
+const MIN_ICON_SIZE = exports.MIN_ICON_SIZE = 1024;
+const PNG_SIGNATURE = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+const ICON_ERROR_CODES = {
+  android: {
+    invalid: "ANDROID-010"
+  },
+  ios: {
+    invalid: "IOS-005",
+    alpha: "IOS-006"
+  }
+};
+
+/**
+ * Width, height and colour type from a PNG's IHDR, and whether it carries
+ * alpha: colour type 4 (grey + alpha) or 6 (RGBA), or a tRNS chunk (which
+ * must come before the image data). Null when the bytes are not a PNG.
+ *
+ * @param {Buffer} buffer
+ * @returns {{ width: number, height: number, bitDepth: number, colorType: number, hasAlpha: boolean } | null}
+ */
+function readPngInfo(buffer) {
+  if (!Buffer.isBuffer(buffer) || buffer.length < 33) return null;
+  if (!buffer.subarray(0, 8).equals(PNG_SIGNATURE)) return null;
+  if (buffer.toString("ascii", 12, 16) !== "IHDR") return null;
+  const width = buffer.readUInt32BE(16);
+  const height = buffer.readUInt32BE(20);
+  const bitDepth = buffer[24];
+  const colorType = buffer[25];
+  let hasTransparencyChunk = false;
+  let offset = 8;
+  while (offset + 8 <= buffer.length) {
+    const length = buffer.readUInt32BE(offset);
+    const type = buffer.toString("ascii", offset + 4, offset + 8);
+    if (type === "tRNS") {
+      hasTransparencyChunk = true;
+      break;
+    }
+    if (type === "IDAT" || type === "IEND") break;
+    offset += 12 + length;
+  }
+  return {
+    width,
+    height,
+    bitDepth,
+    colorType,
+    hasAlpha: colorType === 4 || colorType === 6 || hasTransparencyChunk
+  };
+}
+
+/**
+ * Check public/icon.png before it becomes the app icon. Not a PNG, not square
+ * or under 1024px is a coded error. Alpha is a warning, except for an iOS
+ * release, where App Store Connect would reject it (ITMS-90717).
+ *
+ * @param {string} file
+ * @param {object} options
+ * @param {"android"|"ios"} options.platform
+ * @param {boolean} [options.release]
+ * @param {(message: string, type?: string) => void} [options.log]
+ */
+function checkAppIcon(file, {
+  platform,
+  release = false,
+  log = () => {}
+}) {
+  const codes = ICON_ERROR_CODES[platform];
+  if (!codes) throw new Error(`No app icon error codes for platform "${platform}"`);
+  const info = readPngInfo(_fs.default.readFileSync(file));
+  // public/icon.png, not the absolute path, in what the user reads.
+  const relative = _path.default.relative(process.cwd(), file);
+  const name = relative && !relative.startsWith("..") ? relative : file;
+  if (!info) throw (0, _utils.nativeError)(codes.invalid, `${name} is not a PNG file`);
+  if (info.width !== info.height) {
+    throw (0, _utils.nativeError)(codes.invalid, `${name} is ${info.width}x${info.height}; it must be square`);
+  }
+  if (info.width < MIN_ICON_SIZE) {
+    throw (0, _utils.nativeError)(codes.invalid, `${name} is ${info.width}x${info.height}; it must be at least ${MIN_ICON_SIZE}x${MIN_ICON_SIZE}`);
+  }
+  if (info.hasAlpha) {
+    if (platform === "ios" && release) {
+      throw (0, _utils.nativeError)(codes.alpha, `${name} has an alpha channel`);
+    }
+    log(`${name} has an alpha channel. The App Store rejects icons with transparency; flatten it before an iOS release.`, "warning");
+  }
+  return info;
+}

package/dist/native/buildAndroid/assets.js

@@ -2,6 +2,9 @@
 
 const fs = require("fs");
 const path = require("path");
+const {
+  checkAppIcon
+} = require("../appIcon.js");
 function createAssetsPhase(ctx) {
   const {
     configPath,
@@ -123,7 +126,14 @@ function createAssetsPhase(ctx) {
   async function copySplashHtml() {
     await copyPublicHtml("splashscreen.html", "splash", true);
   }
-  async function copyIconAssets() {
+
+  /**
+   * Launcher icons, first match wins: per-density files in
+   * public/android/appIcons, then the single public/icon.png, then the
+   * Catalyst placeholder. The single icon is checked (square, >= 1024px)
+   * and goes where the placeholder does, mipmap-xxxhdpi.
+   */
+  async function copyIconAssets(androidConfig = {}) {
     try {
       const destPath = `${pwd}/androidProject/app/src/main/res`;
       const manifestPath = `${pwd}/androidProject/app/src/main/AndroidManifest.xml`;
@@ -186,15 +196,25 @@ function createAssetsPhase(ctx) {
           hasCustomIcons = true;
         }
       }
-      if (!hasCustomIcons && fallbackExists) {
+      const singleIconPath = path.join(publicPath, "icon.png"); // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - publicPath is process.cwd()/public; "icon.png" is a fixed literal.
+      let usedSingleIcon = false;
+      if (!hasCustomIcons && fs.existsSync(singleIconPath)) {
+        checkAppIcon(singleIconPath, {
+          platform: "android",
+          release: androidConfig.buildType === "release",
+          log: (message, type) => progress.log(message, type)
+        });
+        usedSingleIcon = true;
+      }
+      if (!hasCustomIcons && (usedSingleIcon || fallbackExists)) {
         const targetDir = path.join(destPath, "mipmap-xxxhdpi"); // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - destPath is derived from pwd (internal); "mipmap-xxxhdpi" is a fixed literal.
         fs.mkdirSync(targetDir, {
           recursive: true
         });
         cleanDensityDir(targetDir);
         const destination = path.join(targetDir, "icon.png"); // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - targetDir is derived from pwd (internal); "icon.png" is a fixed literal.
-        fs.copyFileSync(fallbackIconPath, destination);
-        usedFallback = true;
+        fs.copyFileSync(usedSingleIcon ? singleIconPath : fallbackIconPath, destination);
+        usedFallback = !usedSingleIcon;
       }
       const setManifestIcons = (iconValue, roundIconValue) => {
         let current;
@@ -207,7 +227,7 @@ function createAssetsPhase(ctx) {
         const updated = current.replace(/android:icon="[^"]*"/g, `android:icon="${iconValue}"`).replace(/android:roundIcon="[^"]*"/g, `android:roundIcon="${roundIconValue}"`);
         if (updated !== current) fs.writeFileSync(manifestPath, updated);
       };
-      if (!hasCustomIcons && !usedFallback) {
+      if (!hasCustomIcons && !usedFallback && !usedSingleIcon) {
         progress.log("No custom Android icons found; using default template icons.", "info");
         setManifestIcons("@mipmap/ic_launcher", "@mipmap/ic_launcher_round");
         return;
@@ -215,8 +235,12 @@ function createAssetsPhase(ctx) {
       setManifestIcons("@mipmap/icon", "@mipmap/icon");
       if (hasCustomIcons) {
         progress.log("Applied Android launcher icons from public/android/appIcons.", "success");
+      } else if (usedSingleIcon) {
+        progress.log("Applied the Android launcher icon from public/icon.png.", "success");
       }
     } catch (error) {
+      // An unusable public/icon.png is the user's to fix, not a warning to scroll past.
+      if (/^ANDROID-\d{3}$/.test(error?.code)) throw error;
       progress.log(`Warning: Error copying app icon assets: ${error.message}`, "warning");
     }
   }

package/dist/native/buildAndroid/build.js

@@ -4,14 +4,21 @@ const {
   spawn,
   execFileSync
 } = require("child_process");
-const fs = require("fs");
-const path = require("path");
 const {
   buildAndroidAAB
 } = require("../renameAndroidProject.js");
 const {
   ensureLocalProperties
 } = require("../utils.js");
+const {
+  signingGradleEnv
+} = require("./signing.js");
+const {
+  launchArgs
+} = require("./devices.js");
+const {
+  DEFAULT_VERSION_NAME
+} = require("../releaseOutput.js");
 
 // adb answers in milliseconds when healthy. A wedged adb server accepts the
 // connection and never replies, so without a bound the build sat on
@@ -23,106 +30,29 @@ const isToolTimeout = error => error?.code === "ETOOLTIMEOUT";
 const DEFAULT_DEPLOYMENT_PATH = "./deployment";
 const DEFAULT_OLD_PROJECT_NAME = "androidProject";
 const DEFAULT_OVERWRITE_EXISTING = true;
+
+/**
+ * Version and application id as Gradle project properties, passed through
+ * the environment (ORG_GRADLE_PROJECT_*) like the signing values. Without a
+ * package.json version the app ships 1.0.0, as on iOS, which is also what
+ * the release folder is named after.
+ */
+function versionGradleEnv({
+  applicationId,
+  version
+} = {}) {
+  const env = {};
+  if (applicationId) env.ORG_GRADLE_PROJECT_catalystApplicationId = applicationId;
+  if (version?.buildNumber) env.ORG_GRADLE_PROJECT_catalystVersionCode = String(version.buildNumber);
+  if (version) env.ORG_GRADLE_PROJECT_catalystVersionName = version.versionName || DEFAULT_VERSION_NAME;
+  return env;
+}
 function createBuildPhase(ctx) {
   const {
-    configPath,
+    configPath: defaultConfigPath,
     pwd,
-    progress,
-    ANDROID_PACKAGE
+    progress
   } = ctx;
-  async function detectPhysicalDevice(ADB_PATH) {
-    try {
-      progress.status("detecting physical devices");
-      // nosemgrep: javascript.lang.security.audit.dangerous-spawn-shell-command.dangerous-spawn-shell-command - ADB_PATH is derived from androidConfig.sdkPath, a trusted internal config value.
-      const devices = ctx.runCommand(`${ADB_PATH} devices -l`, {
-        timeout: ADB_TIMEOUT_MS
-      });
-      const lines = devices.split("\n").filter(line => line.trim() && !line.includes("List of devices"));
-      for (const line of lines) {
-        const parts = line.trim().split(/\s+/);
-        if (parts.length >= 2 && parts[1] === "device") {
-          const deviceId = parts[0];
-          if (!deviceId.startsWith("emulator-")) {
-            try {
-              // nosemgrep: javascript.lang.security.audit.dangerous-spawn-shell-command.dangerous-spawn-shell-command - deviceId comes from adb devices output, not user input.
-              const qemuCheck = ctx.runCommand(`${ADB_PATH} -s ${deviceId} shell getprop ro.kernel.qemu`, {
-                timeout: ADB_TIMEOUT_MS
-              });
-              if (!qemuCheck.trim()) {
-                progress.log(`Physical device detected: ${deviceId}`, "success");
-                let deviceModel = "Unknown Device";
-                try {
-                  // nosemgrep: javascript.lang.security.audit.dangerous-spawn-shell-command.dangerous-spawn-shell-command - deviceId comes from adb devices output, not user input.
-                  const model = ctx.runCommand(`${ADB_PATH} -s ${deviceId} shell getprop ro.product.model`, {
-                    timeout: ADB_TIMEOUT_MS
-                  });
-                  deviceModel = model.trim() || deviceModel;
-                } catch (e) {
-                  // Ignore model detection errors
-                }
-                return {
-                  id: deviceId,
-                  model: deviceModel
-                };
-              }
-            } catch (error) {
-              continue;
-            }
-          }
-        }
-      }
-      progress.log("No physical devices detected", "info");
-      return null;
-    } catch (error) {
-      if (isToolTimeout(error)) throw error;
-      progress.log("Error detecting physical devices: " + error.message, "error");
-      return null;
-    }
-  }
-  async function testPhysicalDeviceInstallation(ADB_PATH, deviceId) {
-    try {
-      progress.log(`Testing installation capability on device ${deviceId}...`, "info");
-
-      // nosemgrep: javascript.lang.security.audit.dangerous-spawn-shell-command.dangerous-spawn-shell-command - deviceId comes from adb devices output, not user input.
-      const connectionTest = ctx.runCommand(`${ADB_PATH} -s ${deviceId} shell echo "test"`);
-      if (!connectionTest.includes("test")) {
-        progress.log("Device connection test failed", "error");
-        return false;
-      }
-      try {
-        // nosemgrep: javascript.lang.security.audit.dangerous-spawn-shell-command.dangerous-spawn-shell-command - deviceId comes from adb devices output, not user input.
-        const developerOptions = ctx.runCommand(`${ADB_PATH} -s ${deviceId} shell settings get global development_settings_enabled`);
-        if (developerOptions.trim() !== "1") {
-          progress.log("Developer options not enabled on device", "warning");
-          return false;
-        }
-      } catch (error) {
-        progress.log("Cannot verify developer options status", "warning");
-      }
-      try {
-        // nosemgrep: javascript.lang.security.audit.dangerous-spawn-shell-command.dangerous-spawn-shell-command - deviceId comes from adb devices output, not user input.
-        const usbDebugging = ctx.runCommand(`${ADB_PATH} -s ${deviceId} shell settings get global adb_enabled`);
-        if (usbDebugging.trim() !== "1") {
-          progress.log("USB debugging not enabled on device", "warning");
-          return false;
-        }
-      } catch (error) {
-        progress.log("Cannot verify USB debugging status", "warning");
-      }
-      try {
-        // nosemgrep: javascript.lang.security.audit.dangerous-spawn-shell-command.dangerous-spawn-shell-command - deviceId comes from adb devices output, not user input.
-        ctx.runCommand(`${ADB_PATH} -s ${deviceId} shell pm list packages -3 | head -1`);
-      } catch (error) {
-        progress.log("Cannot access package manager on device", "error");
-        return false;
-      }
-      progress.log(`Device ${deviceId} is ready for installation`, "success");
-      return true;
-    } catch (error) {
-      progress.log(`Installation capability test failed: ${error.message}`, "error");
-      return false;
-    }
-  }
 
   // Returns the serial of an online emulator (adb state "device"), or null if
   // none is online. `devices.includes("emulator")` alone would also match a
@@ -132,7 +62,7 @@ function createBuildPhase(ctx) {
   async function checkEmulator(ADB_PATH) {
     try {
       // nosemgrep: javascript.lang.security.audit.dangerous-spawn-shell-command.dangerous-spawn-shell-command - ADB_PATH is derived from androidConfig.sdkPath, a trusted internal config value.
-      const devices = ctx.runCommand(`${ADB_PATH} devices`, {
+      const devices = ctx.runFile(ADB_PATH, ["devices"], {
         timeout: ADB_TIMEOUT_MS
       });
       const onlineEmulator = devices.split("\n").map(line => line.trim().split(/\s+/)).find(([id, state]) => id?.startsWith("emulator-") && state === "device");
@@ -153,23 +83,6 @@ function createBuildPhase(ctx) {
     return match ? match[1] : null;
   }
 
-  /**
-   * Run something that writes directly to the terminal, with the progress
-   * tree stood down for the duration.
-   *
-   * The resume must happen on the failure path too -- a build that throws
-   * while paused would otherwise leave the tree silent for the rest of the
-   * run, hiding exactly the output someone needs when a build fails.
-   */
-  async function withStreamedOutput(fn) {
-    progress.pause();
-    try {
-      return await fn();
-    } finally {
-      progress.resume();
-    }
-  }
-
   // The Android emulator binary is a long-running server process — it does not
   // exit after boot, it keeps running until the emulator window is closed. Using
   // runInteractiveCommand (which only resolves on the child's `close` event, see
@@ -226,7 +139,7 @@ function createBuildPhase(ctx) {
   function listEmulatorSerials(ADB_PATH) {
     try {
       // nosemgrep: javascript.lang.security.audit.dangerous-spawn-shell-command.dangerous-spawn-shell-command - ADB_PATH is derived from androidConfig.sdkPath, a trusted internal config value.
-      const devices = ctx.runCommand(`${ADB_PATH} devices`, {
+      const devices = ctx.runFile(ADB_PATH, ["devices"], {
         timeout: ADB_TIMEOUT_MS
       });
       return devices.split("\n").map(line => line.trim().split(/\s+/)[0]).filter(id => id && id.startsWith("emulator-"));
@@ -330,10 +243,21 @@ function createBuildPhase(ctx) {
     progress.log("Emulator booted successfully", "success");
     return {
       type: "emulator",
-      name: androidConfig.emulatorName
+      name: androidConfig.emulatorName,
+      serial
     };
   }
-  async function buildApp(ADB_PATH, androidConfig, buildOptimisation, targetDevice = null) {
+
+  /**
+   * Build the debug APK and install it on `serial` only. Gradle's
+   * installDebug installs on every connected device unless ANDROID_SERIAL
+   * names one.
+   */
+  async function buildApp(androidConfig, buildOptimisation, serial, {
+    configPath = defaultConfigPath,
+    applicationId,
+    version
+  } = {}) {
     progress.status("building and installing app");
     try {
       // Gradle needs the SDK location in local.properties. Only
@@ -345,10 +269,7 @@ function createBuildPhase(ctx) {
       // error output entirely. --console=rich emits ANSI redraws, which
       // are meaningless on a pipe; plain gives one line per task.
       // nosemgrep: javascript.lang.security.audit.dangerous-spawn-shell-command.dangerous-spawn-shell-command - pwd and configPath are internal resolved paths, not user input.
-      let buildCommand = `cd ${pwd}/androidProject && ./gradlew generateWebViewConfig -PconfigPath=${configPath} -PbuildOptimisation=${buildOptimisation} && ./gradlew clean installDebug -PconfigPath=${configPath} --console=plain`;
-      if (targetDevice && targetDevice.type === "physical") {
-        buildCommand = buildCommand.replace("installDebug", `installDebug -Pandroid.injected.target.device=${targetDevice.id}`);
-      }
+      const buildCommand = `cd ${pwd}/androidProject && ./gradlew generateWebViewConfig -PconfigPath=${configPath} -PcatalystBuildType=debug -PbuildOptimisation=${buildOptimisation} && ./gradlew clean installDebug -PconfigPath=${configPath} -PcatalystBuildType=debug --console=plain`;
 
       // Gradle emits hundreds of lines that nobody reads on success and
       // that the error path re-derives from error.output anyway. Show the
@@ -356,7 +277,17 @@ function createBuildPhase(ctx) {
       await ctx.runInteractiveCommand("sh", ["-c", buildCommand], {
         "BUILD SUCCESSFUL": ""
       }, {
-        onLine: line => progress.status(gradleTask(line))
+        onLine: line => progress.status(gradleTask(line)),
+        env: {
+          ...process.env,
+          ...versionGradleEnv({
+            applicationId,
+            version
+          }),
+          ...(serial ? {
+            ANDROID_SERIAL: serial
+          } : {})
+        }
       });
     } catch (error) {
       // Re-wrapping with a new Error dropped `output`, and with it the
@@ -365,27 +296,28 @@ function createBuildPhase(ctx) {
       throw error;
     }
   }
-  async function launchApp(ADB_PATH, buildType = "debug", targetDevice = null) {
-    if (!targetDevice) {
-      progress.log("No target device specified, skipping launch", "warning");
-      return;
-    }
-    if (targetDevice.type === "physical") {
-      progress.log(`App installed on physical device: ${targetDevice.model}`, "success");
-      progress.log("Open the app on your device to launch it", "note");
-      return;
-    }
+
+  /** Open the installed app on `serial`. A failure is a warning: the app is installed. */
+  function launchApp(ADB_PATH, serial, packageName) {
     try {
-      progress.status("launching app on emulator");
-      const packageName = `${ANDROID_PACKAGE}${buildType === "debug" ? ".debug" : ""}`;
-      // nosemgrep: javascript.lang.security.audit.dangerous-spawn-shell-command.dangerous-spawn-shell-command - ADB_PATH is derived from androidConfig.sdkPath, a trusted internal config value.
-      const launchCommand = `${ADB_PATH} shell monkey -p ${packageName} 1`;
-      await ctx.runInteractiveCommand("sh", ["-c", launchCommand], {});
+      progress.status("launching app");
+      execFileSync(ADB_PATH, launchArgs(serial, packageName), {
+        encoding: "utf8",
+        timeout: ADB_TIMEOUT_MS,
+        stdio: ["ignore", "pipe", "pipe"]
+      });
     } catch (error) {
-      progress.log(`Warning: Could not auto-launch app: ${error.message}`, "warning");
-      progress.log("App was installed successfully, but auto-launch failed", "info");
+      progress.log(`Could not open the app: ${error.message}. It is installed; open it on the device.`, "warning");
     }
   }
+  function aabNames(androidConfig) {
+    const newProjectName = androidConfig.newProjectName || androidConfig.appName || androidConfig.packageName?.split(".").pop() || "catalystapp";
+    const outputPath = androidConfig.outputPath || `${process.cwd()}/build-output`;
+    return {
+      newProjectName,
+      outputPath
+    };
+  }
   async function createAABConfig(androidConfig) {
     const DEFAULT_PROJECT_PATH = `${pwd}/androidProject`;
     const aabConfig = {
@@ -393,27 +325,11 @@ function createBuildPhase(ctx) {
       deploymentPath: DEFAULT_DEPLOYMENT_PATH,
       oldProjectName: DEFAULT_OLD_PROJECT_NAME,
       overwriteExisting: androidConfig.overwriteExisting !== undefined ? androidConfig.overwriteExisting : DEFAULT_OVERWRITE_EXISTING,
-      newProjectName: androidConfig.newProjectName || androidConfig.appName || androidConfig.packageName?.split(".").pop() || "catalystapp",
+      newProjectName: aabNames(androidConfig).newProjectName,
       packageName: androidConfig.packageName || null,
       createSignedAAB: true,
-      outputPath: androidConfig.outputPath || `${process.cwd()}/build-output`
+      outputPath: aabNames(androidConfig).outputPath
     };
-    if (androidConfig.keystoreConfig) {
-      aabConfig.keystoreConfig = androidConfig.keystoreConfig;
-    } else if (androidConfig.keystore) {
-      aabConfig.keystoreConfig = {
-        keyAlias: androidConfig.keystore.alias || "release",
-        storePassword: androidConfig.keystore.storePassword,
-        keyPassword: androidConfig.keystore.keyPassword,
-        validityYears: 25,
-        organizationInfo: {
-          companyName: androidConfig.keystore.organizationName || "YourCompany",
-          city: androidConfig.keystore.city || "YourCity",
-          state: androidConfig.keystore.state || "YourState",
-          countryCode: androidConfig.keystore.countryCode || "US"
-        }
-      };
-    }
     progress.log(`AAB Configuration:`, "info");
     progress.log(`  Project Path: ${aabConfig.projectPath} ${aabConfig.projectPath === DEFAULT_PROJECT_PATH ? "(default)" : "(configured)"}`, "info");
     progress.log(`  Deployment Path: ${aabConfig.deploymentPath} ${aabConfig.deploymentPath === DEFAULT_DEPLOYMENT_PATH ? "(default)" : "(configured)"}`, "info");
@@ -423,82 +339,54 @@ function createBuildPhase(ctx) {
     progress.log(`  Output Path: ${aabConfig.outputPath}`, "info");
     return aabConfig;
   }
-  async function moveApkToOutputPath(buildType, BUILD_OUTPUT_PATH, appName) {
-    try {
-      if (!BUILD_OUTPUT_PATH) {
-        progress.log("BUILD_OUTPUT_PATH not set, skipping APK move", "warning");
-        return null;
-      }
-      const currentDate = new Date().toLocaleDateString("en-GB").replace(/\//g, "-");
-      // 24-hour and locale-free: "02-05-09 PM" put a space in every
-      // artifact name, which breaks unquoted shell use of the path.
-      const currentTime = new Date().toTimeString().slice(0, 8).replace(/:/g, "-");
-      let destinationApkFileName = "";
-      if (appName) {
-        destinationApkFileName = buildType === "release" ? `${appName}-${currentTime}.release.apk` : `${appName}-${currentTime}.debug.apk`;
-      } else {
-        destinationApkFileName = buildType === "release" ? `app-${currentTime}.release.apk` : `app-${currentTime}.debug.apk`;
-      }
-      const sourceApkFileName = buildType === "release" ? `app.apk` : `app-debug.apk`;
-      const sourceApkPath = path.join(pwd,
-      // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - pwd is an internal resolved path.
-      "androidProject", "app", "build", "outputs", "apk", buildType,
-      // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - buildType is "debug" or "release" from config.
-      sourceApkFileName);
-      const destinationDir = path.join(process.cwd(), BUILD_OUTPUT_PATH,
-      // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - BUILD_OUTPUT_PATH is trusted application config.
-      "native", "android", currentDate, buildType // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - buildType is "debug" or "release" from config.
-      );
-      const destinationApkPath = path.join(destinationDir, destinationApkFileName); // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - destinationDir and destinationApkFileName are derived from internal config values, not user input.
 
-      if (!fs.existsSync(sourceApkPath)) {
-        progress.log(`APK not found at source path: ${sourceApkPath}`, "warning");
-        return null;
-      }
-      if (!fs.existsSync(destinationDir)) {
-        fs.mkdirSync(destinationDir, {
-          recursive: true
-        });
-      }
-      fs.copyFileSync(sourceApkPath, destinationApkPath);
-      return destinationApkPath;
-    } catch (error) {
-      progress.log(`Error moving APK: ${error.message}`, "error");
-      return null;
-    }
-  }
-  async function buildSignedAAB(androidConfig) {
+  /**
+   * Build the signed release bundle. The webview config is generated in
+   * the temp_build_<pkg> copy that Gradle then bundles, from the resolved
+   * release config and with -PcatalystBuildType=release, so the release
+   * branch of generateWebViewConfig actually runs. Signing and version
+   * values reach Gradle through the environment, never argv.
+   */
+  async function buildSignedAAB(androidConfig, {
+    configPath = defaultConfigPath,
+    signing,
+    version,
+    applicationId,
+    buildOptimisation = false,
+    finalAabPath
+  } = {}) {
     progress.log("Building signed AAB for release...", "info");
     try {
+      if (!signing) throw new Error("No upload key resolved for the release build");
       // Same as buildApp: gradle needs local.properties on a fresh machine.
       if (androidConfig.sdkPath) ensureLocalProperties(`${pwd}/androidProject`, androidConfig.sdkPath);
-      progress.log("Generating webview configuration for release...", "info");
-      try {
-        // nosemgrep: javascript.lang.security.audit.dangerous-spawn-shell-command.dangerous-spawn-shell-command - pwd and configPath are internal resolved paths, not user input.
-        const generateConfigCommand = `cd ${pwd}/androidProject && ./gradlew generateWebViewConfig -PconfigPath=${configPath}`;
-        await ctx.runInteractiveCommand("sh", ["-c", generateConfigCommand], {
-          "BUILD SUCCESSFUL": ""
-        }, {
-          onLine: line => progress.status(gradleTask(line))
-        });
-        progress.log("Webview config generated successfully", "success");
-      } catch (configError) {
-        progress.log(`Warning: Webview config generation failed: ${configError.message}`, "warning");
-        throw new Error("Webview config generation is required for release builds");
-      }
       const aabConfig = await createAABConfig(androidConfig);
-      // buildAndroidAAB shells out to `./gradlew bundleRelease` and prints
-      // its own progress lines, so it owns the screen for its duration.
-      await withStreamedOutput(() => buildAndroidAAB(aabConfig));
+      if (finalAabPath) aabConfig.finalAabPath = finalAabPath;
+      aabConfig.gradle = {
+        configPath,
+        buildOptimisation,
+        env: {
+          ...process.env,
+          ...versionGradleEnv({
+            applicationId,
+            version
+          }),
+          ...signingGradleEnv(signing)
+        }
+      };
+      // Its steps and details go through this progress: spinner detail
+      // by default, lines under --verbose; warnings always print.
+      const result = await buildAndroidAAB(aabConfig, {
+        progress
+      });
       progress.log("Signed AAB build completed successfully!", "success");
+      return result;
     } catch (error) {
       error.stage = "Building the signed AAB";
       throw error;
     }
   }
   return {
-    detectPhysicalDevice,
-    testPhysicalDeviceInstallation,
     checkEmulator,
     handleEmulatorSetup,
     startEmulator,
@@ -506,7 +394,6 @@ function createBuildPhase(ctx) {
     buildApp,
     launchApp,
     createAABConfig,
-    moveApkToOutputPath,
     buildSignedAAB
   };
 }