craft-native 0.0.89 → 0.0.91

package/dist/cli.js

@@ -48,10 +48,10 @@ import {
   lstatSync,
   mkdirSync,
   mkdtempSync,
-  readFileSync,
+  readFileSync as readFileSync2,
   readdirSync,
   rmSync,
-  writeFileSync
+  writeFileSync as writeFileSync2
 } from "fs";
 import { homedir, tmpdir } from "os";
 import { basename, join } from "path";
@@ -488,7 +488,7 @@ function createMacOSAppBundle(opts) {
         return { success: false, error: `Provisioning profile not found: ${provisioningProfile}` };
       copyFileSync(provisioningProfile, join(contents, "embedded.provisionprofile"));
     }
-    writeFileSync(join(contents, "Info.plist"), macOSInfoPlist({ ...opts, iconName }));
+    writeFileSync2(join(contents, "Info.plist"), macOSInfoPlist({ ...opts, iconName }));
     return { success: true };
   } catch (error) {
     return { success: false, error: error.message };
@@ -626,7 +626,7 @@ async function createPKG(opts) {
     const bundleName = basename(opts.appBundlePath);
     cpSync(opts.appBundlePath, join(appsDir, bundleName), { recursive: true });
     const componentPlistPath = join(tempDir, "component.plist");
-    writeFileSync(componentPlistPath, pkgbuildComponentPlist(`Applications/${bundleName}`));
+    writeFileSync2(componentPlistPath, pkgbuildComponentPlist(`Applications/${bundleName}`));
     const built = await runTool("pkgbuild", pkgbuildArguments({
       root,
       componentPlistPath,
@@ -716,7 +716,7 @@ async function createMSI(opts) {
     const wxsPath = join(tempDir, "installer.wxs");
     const wixobjPath = join(tempDir, "installer.wixobj");
     copyFileSync(opts.binaryPath, sourcePath);
-    writeFileSync(wxsPath, renderWixSource(opts, binaryName));
+    writeFileSync2(wxsPath, renderWixSource(opts, binaryName));
     await runCommand("candle.exe", candleArguments(opts.architecture, wixobjPath, wxsPath), tempDir);
     await runCommand("light.exe", ["-nologo", "-sval", "-out", opts.outputPath, wixobjPath], tempDir);
     if (opts.certificatePath) {
@@ -738,9 +738,9 @@ async function createMSI(opts) {
 }
 async function createZIP(opts) {
   try {
-    const data = new Uint8Array(readFileSync(opts.binaryPath));
+    const data = new Uint8Array(readFileSync2(opts.binaryPath));
     const zip = buildZip([{ name: `${opts.name}.exe`, data }]);
-    writeFileSync(opts.outputPath, zip);
+    writeFileSync2(opts.outputPath, zip);
     return { success: true, outputPath: opts.outputPath };
   } catch (err) {
     return { success: false, error: `Failed to write ZIP: ${err.message}` };
@@ -788,7 +788,7 @@ Depends: ${opts.dependencies.join(", ")}
 Maintainer: ${maintainer}
 Description: ${description || opts.name}
 `;
-      writeFileSync(join(debianDir, "control"), controlContent);
+      writeFileSync2(join(debianDir, "control"), controlContent);
       const desktopContent = `[Desktop Entry]
 Type=Application
 Name=${opts.name}
@@ -796,7 +796,7 @@ Exec=/usr/bin/${binaryName}
 Terminal=false
 Categories=Utility;
 `;
-      writeFileSync(join(applicationsDir, `${binaryName}.desktop`), desktopContent);
+      writeFileSync2(join(applicationsDir, `${binaryName}.desktop`), desktopContent);
       const proc = spawn("dpkg-deb", ["--build", tempDir, opts.outputPath]);
       proc.on("close", (code) => {
         rmSync(tempDir, { recursive: true, force: true });
@@ -865,7 +865,7 @@ install -m 755 %{SOURCE0} %{buildroot}/usr/bin/${sanitizedName}
 /usr/bin/${sanitizedName}
 `;
       const specPath = join(specDir, `${opts.name.toLowerCase()}.spec`);
-      writeFileSync(specPath, specContent);
+      writeFileSync2(specPath, specContent);
       const proc = spawn("rpmbuild", ["-bb", specPath]);
       proc.on("close", (code) => {
         if (code === 0) {
@@ -907,7 +907,7 @@ HERE=\${SELF%/*}
 export PATH="\${HERE}/usr/bin/:\${PATH}"
 exec "\${HERE}/usr/bin/${binaryName}" "$@"
 `;
-      writeFileSync(join(appDirPath, "AppRun"), appRunContent);
+      writeFileSync2(join(appDirPath, "AppRun"), appRunContent);
       chmodSync(join(appDirPath, "AppRun"), 493);
       const desktopContent = `[Desktop Entry]
 Type=Application
@@ -917,7 +917,7 @@ Terminal=false
 Categories=Utility;
 Icon=${binaryName}
 `;
-      writeFileSync(join(appDirPath, `${binaryName}.desktop`), desktopContent);
+      writeFileSync2(join(appDirPath, `${binaryName}.desktop`), desktopContent);
       if (opts.iconPath && existsSync3(opts.iconPath)) {
         copyFileSync(opts.iconPath, join(appDirPath, `${binaryName}.png`));
       } else {
@@ -992,7 +992,7 @@ Icon=${binaryName}
           96,
           130
         ]);
-        writeFileSync(join(appDirPath, `${binaryName}.png`), placeholderPng);
+        writeFileSync2(join(appDirPath, `${binaryName}.png`), placeholderPng);
       }
       const proc = spawn("appimagetool", [appDirPath, opts.outputPath], {
         env: { ...process.env, ARCH: "x86_64" }
@@ -1071,7 +1071,7 @@ __export(exports_src, {
   build: () => build,
   bootSimulator: () => bootSimulator
 });
-import { cpSync as cpSync2, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync as readdirSync2, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "fs";
+import { cpSync as cpSync2, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync3, readdirSync as readdirSync2, rmSync as rmSync2, statSync, writeFileSync as writeFileSync3 } from "fs";
 import { dirname, join as join2, resolve } from "path";
 function renderDeviceFamilies(config) {
   const values = new Set(((config.deviceFamilies?.length) ? config.deviceFamilies : ["iphone", "ipad"]).map((family) => family === "ipad" ? "2" : "1"));
@@ -1170,7 +1170,7 @@ ${plistArray(config.appGroups)}
   }
   if (config.enablePushNotifications) {
     entries.push(`    <key>aps-environment</key>
-    <string>development</string>`);
+    <string>$(CRAFT_APNS_ENVIRONMENT)</string>`);
   }
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -1258,7 +1258,7 @@ function renderAssetCatalog(output, config) {
   const launchBackground = join2(catalog, "LaunchBackground.colorset");
   mkdirSync2(appIcon, { recursive: true });
   mkdirSync2(launchBackground, { recursive: true });
-  writeFileSync2(join2(catalog, "Contents.json"), `${JSON.stringify({ info: { author: "xcode", version: 1 } }, null, 2)}
+  writeFileSync3(join2(catalog, "Contents.json"), `${JSON.stringify({ info: { author: "xcode", version: 1 } }, null, 2)}
 `);
   const iconFilename = config.appIconPath ? "AppIcon-1024.png" : undefined;
   if (config.appIconPath) {
@@ -1266,7 +1266,7 @@ function renderAssetCatalog(output, config) {
       throw new Error(`App icon not found: ${config.appIconPath}`);
     cpSync2(config.appIconPath, join2(appIcon, iconFilename));
   }
-  writeFileSync2(join2(appIcon, "Contents.json"), `${JSON.stringify({
+  writeFileSync3(join2(appIcon, "Contents.json"), `${JSON.stringify({
     images: iconFilename ? [{
       filename: iconFilename,
       idiom: "universal",
@@ -1279,7 +1279,7 @@ function renderAssetCatalog(output, config) {
   const color = config.backgroundColor?.replace(/^#/, "") || "000000";
   const normalized = color.length === 3 ? [...color].map((value) => `${value}${value}`).join("") : color.padEnd(6, "0").slice(0, 6);
   const components = [0, 2, 4].map((index) => (Number.parseInt(normalized.slice(index, index + 2), 16) / 255).toFixed(3));
-  writeFileSync2(join2(launchBackground, "Contents.json"), `${JSON.stringify({
+  writeFileSync3(join2(launchBackground, "Contents.json"), `${JSON.stringify({
     colors: [{
       color: {
         "color-space": "srgb",
@@ -1364,7 +1364,7 @@ async function init(options) {
 `);
   const dirs = [output, join2(output, "Sources"), join2(output, "Shared"), join2(output, "dist")];
   if (options.config?.enableWatchApp)
-    dirs.push(join2(output, "WatchApp"));
+    dirs.push(join2(output, "WatchApp"), join2(output, "WatchExtension"));
   for (const dir of dirs) {
     if (!existsSync4(dir)) {
       mkdirSync2(dir, { recursive: true });
@@ -1381,17 +1381,17 @@ async function init(options) {
   };
   if (config.enableBackgroundLocation)
     config.enableGeolocation = true;
-  writeFileSync2(join2(output, "craft.config.json"), JSON.stringify(config, null, 2));
-  const swiftTemplate = readFileSync2(join2(TEMPLATES_DIR, "CraftApp.swift"), "utf-8");
+  writeFileSync3(join2(output, "craft.config.json"), JSON.stringify(config, null, 2));
+  const swiftTemplate = readFileSync3(join2(TEMPLATES_DIR, "CraftApp.swift"), "utf-8");
   const swiftSource = swiftTemplate.replace(/CraftApp/g, `${name}App`).replace(/\{\{BUNDLE_ID\}\}/g, finalBundleId);
-  writeFileSync2(join2(output, "Sources", `${name}App.swift`), swiftSource);
-  const infoPlistTemplate = readFileSync2(join2(TEMPLATES_DIR, "Info.plist.template"), "utf-8");
+  writeFileSync3(join2(output, "Sources", `${name}App.swift`), swiftSource);
+  const infoPlistTemplate = readFileSync3(join2(TEMPLATES_DIR, "Info.plist.template"), "utf-8");
   const infoPlist = infoPlistTemplate.replace(/\{\{APP_NAME\}\}/g, name).replace(/\{\{BUNDLE_ID\}\}/g, finalBundleId).replace(/\{\{VERSION\}\}/g, config.version || "1.0.0").replace(/\{\{BUILD_NUMBER\}\}/g, config.buildNumber || "1").replace(/\{\{UI_STYLE\}\}/g, config.darkMode ? "Dark" : "Light").replace(/\{\{ORIENTATIONS\}\}/g, renderOrientations(config)).replace(/\{\{USAGE_DESCRIPTIONS\}\}/g, renderUsageDescriptions(config)).replace(/\{\{URL_TYPES\}\}/g, renderUrlTypes(config)).replace(/\{\{BACKGROUND_MODES\}\}/g, renderBackgroundModes(config)).replace(/\{\{LIVE_ACTIVITY_SUPPORT\}\}/g, config.enableLiveActivities ? `    <key>NSSupportsLiveActivities</key>
     <true/>
     <key>NSSupportsLiveActivitiesFrequentUpdates</key>
     <true/>` : "");
-  writeFileSync2(join2(output, "Info.plist"), infoPlist);
-  const projectYmlTemplate = readFileSync2(join2(TEMPLATES_DIR, "project.yml.template"), "utf-8");
+  writeFileSync3(join2(output, "Info.plist"), infoPlist);
+  const projectYmlTemplate = readFileSync3(join2(TEMPLATES_DIR, "project.yml.template"), "utf-8");
   const nativeDependencies = [];
   if (config.enableLiveActivities)
     nativeDependencies.push(`      - target: ${name}LiveActivity`);
@@ -1416,7 +1416,7 @@ async function init(options) {
   }
   if (config.enableWatchApp) {
     nativeTargets.push(`  ${name}Watch:
-    type: application
+    type: application.watchapp2
     platform: watchOS
     deploymentTarget: "${config.watchosVersion || "9.0"}"
     sources:
@@ -1426,6 +1426,21 @@ async function init(options) {
       CODE_SIGN_ENTITLEMENTS: WatchApp/Watch.entitlements
       PRODUCT_BUNDLE_IDENTIFIER: ${finalBundleId}.watchkitapp
       SWIFT_VERSION: "5.0"
+      SKIP_INSTALL: YES
+    dependencies:
+      - target: ${name}WatchExtension
+  ${name}WatchExtension:
+    type: watchkit2-extension
+    platform: watchOS
+    deploymentTarget: "${config.watchosVersion || "9.0"}"
+    sources:
+      - WatchExtension
+    settings:
+      INFOPLIST_FILE: WatchExtension/Info.plist
+      CODE_SIGN_ENTITLEMENTS: WatchExtension/Watch.entitlements
+      PRODUCT_BUNDLE_IDENTIFIER: ${finalBundleId}.watchkitapp.watchkitextension
+      SWIFT_VERSION: "5.0"
+      APPLICATION_EXTENSION_API_ONLY: YES
       SKIP_INSTALL: YES`);
   }
   const runtimeDir = resolveRuntimeDir(options.runtimeDir);
@@ -1439,24 +1454,27 @@ async function init(options) {
 ${nativeDependencies.join(`
 `)}` : "").replace(/\{\{NATIVE_TARGETS\}\}/g, nativeTargets.join(`
 `));
-  writeFileSync2(join2(output, "project.yml"), projectYml);
-  writeFileSync2(join2(output, "Craft.entitlements"), renderEntitlements(config));
-  writeFileSync2(join2(output, "PrivacyInfo.xcprivacy"), renderPrivacyManifest(config));
+  writeFileSync3(join2(output, "project.yml"), projectYml);
+  writeFileSync3(join2(output, "Craft.entitlements"), renderEntitlements(config));
+  writeFileSync3(join2(output, "PrivacyInfo.xcprivacy"), renderPrivacyManifest(config));
   renderAssetCatalog(output, config);
   cpSync2(join2(TEMPLATES_DIR, "CraftActivityAttributes.swift"), join2(output, "Shared", "CraftActivityAttributes.swift"));
   if (config.enableLiveActivities) {
     mkdirSync2(join2(output, "WidgetExtension"), { recursive: true });
-    const widgetSource = readFileSync2(join2(TEMPLATES_DIR, "CraftLiveActivityWidget.swift.template"), "utf8").replace(/\{\{APP_NAME\}\}/g, name);
-    writeFileSync2(join2(output, "WidgetExtension", `${name}LiveActivity.swift`), widgetSource);
-    const widgetInfo = readFileSync2(join2(TEMPLATES_DIR, "WidgetExtension.Info.plist"), "utf8");
-    writeFileSync2(join2(output, "WidgetExtension", "Info.plist"), widgetInfo);
+    const widgetSource = readFileSync3(join2(TEMPLATES_DIR, "CraftLiveActivityWidget.swift.template"), "utf8").replace(/\{\{APP_NAME\}\}/g, name);
+    writeFileSync3(join2(output, "WidgetExtension", `${name}LiveActivity.swift`), widgetSource);
+    const widgetInfo = readFileSync3(join2(TEMPLATES_DIR, "WidgetExtension.Info.plist"), "utf8");
+    writeFileSync3(join2(output, "WidgetExtension", "Info.plist"), widgetInfo);
   }
   if (config.enableWatchApp) {
-    const watchSource = readFileSync2(join2(TEMPLATES_DIR, "CraftWatchApp.swift.template"), "utf8").replace(/\{\{APP_NAME\}\}/g, name);
-    writeFileSync2(join2(output, "WatchApp", `${name}WatchApp.swift`), watchSource);
-    const watchInfo = readFileSync2(join2(TEMPLATES_DIR, "WatchApp.Info.plist.template"), "utf8").replace(/\{\{APP_NAME\}\}/g, name).replace(/\{\{BUNDLE_ID\}\}/g, finalBundleId);
-    writeFileSync2(join2(output, "WatchApp", "Info.plist"), watchInfo);
-    writeFileSync2(join2(output, "WatchApp", "Watch.entitlements"), renderWatchEntitlements(config));
+    const watchSource = readFileSync3(join2(TEMPLATES_DIR, "CraftWatchApp.swift.template"), "utf8").replace(/\{\{APP_NAME\}\}/g, name);
+    writeFileSync3(join2(output, "WatchExtension", `${name}WatchApp.swift`), watchSource);
+    const watchInfo = readFileSync3(join2(TEMPLATES_DIR, "WatchApp.Info.plist.template"), "utf8").replace(/\{\{APP_NAME\}\}/g, name).replace(/\{\{BUNDLE_ID\}\}/g, finalBundleId);
+    writeFileSync3(join2(output, "WatchApp", "Info.plist"), watchInfo);
+    writeFileSync3(join2(output, "WatchApp", "Watch.entitlements"), renderWatchEntitlements(config));
+    const watchExtensionInfo = readFileSync3(join2(TEMPLATES_DIR, "WatchExtension.Info.plist.template"), "utf8").replace(/\{\{APP_NAME\}\}/g, name).replace(/\{\{BUNDLE_ID\}\}/g, finalBundleId);
+    writeFileSync3(join2(output, "WatchExtension", "Info.plist"), watchExtensionInfo);
+    writeFileSync3(join2(output, "WatchExtension", "Watch.entitlements"), renderWatchEntitlements(config));
   }
   const placeholderHtml = `<!DOCTYPE html>
 <html>
@@ -1496,7 +1514,7 @@ ${nativeDependencies.join(`
   </script>
 </body>
 </html>`;
-  writeFileSync2(join2(output, "dist", "index.html"), placeholderHtml);
+  writeFileSync3(join2(output, "dist", "index.html"), placeholderHtml);
   console.log("\u2705 Project initialized");
   console.log("");
   console.log("Next steps:");
@@ -1514,12 +1532,12 @@ async function build(options) {
   if (!existsSync4(configPath)) {
     throw new Error(`No craft.config.json found in ${output}. Run 'craft ios init' first.`);
   }
-  const config = JSON.parse(readFileSync2(configPath, "utf-8"));
+  const config = JSON.parse(readFileSync3(configPath, "utf-8"));
   if (devServer) {
     config.devServerURL = devServer;
     const origin = new URL(devServer).origin;
     config.trustedOrigins = [...new Set([...config.trustedOrigins ?? [], origin])];
-    writeFileSync2(configPath, JSON.stringify(config, null, 2));
+    writeFileSync3(configPath, JSON.stringify(config, null, 2));
     console.log(`   Dev server: ${devServer}`);
   }
   if (htmlPath) {
@@ -1614,7 +1632,7 @@ async function run(options) {
   const configPath = join2(output, "craft.config.json");
   if (!existsSync4(configPath))
     throw new Error(`No craft.config.json found in ${output}. Run 'craft-ios init' first.`);
-  const config = JSON.parse(readFileSync2(configPath, "utf-8"));
+  const config = JSON.parse(readFileSync3(configPath, "utf-8"));
   if (simulator) {
     console.log("\uD83D\uDCF1 Building and running on simulator...");
     const device = await pickSimulator();
@@ -1718,25 +1736,149 @@ __export(exports_src2, {
   init: () => init2,
   build: () => build2
 });
-import { cpSync as cpSync3, existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync3, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname2, join as join3, resolve as resolve2 } from "path";
+import { cpSync as cpSync3, existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync4, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname2, extname, isAbsolute, join as join3, relative, resolve as resolve2, sep } from "path";
+function renderAndroidPromiseRuntime(indent = "") {
+  return ANDROID_PROMISE_RUNTIME.trim().split(`
+`).map((line) => `${indent}${line}`).join(`
+`);
+}
+function escapeXml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+}
+function escapeKotlinString(value) {
+  return value.replaceAll("\\", "\\\\").replaceAll('"', "\\\"").replaceAll("$", "\\$").replaceAll("\r", "\\r").replaceAll(`
+`, "\\n");
+}
+function generatedPackageSegment(name) {
+  const normalized = name.toLowerCase().replace(/[^a-z0-9_]/g, "");
+  if (!normalized)
+    return "app";
+  return /^[a-z_]/.test(normalized) ? normalized : `app${normalized}`;
+}
+function generatedGradleProjectName(name) {
+  const invalidCharacters = ["/", "\\", ":", "<", ">", '"', "?", "*", "|"];
+  const normalized = invalidCharacters.reduce((value, character) => value.replaceAll(character, "-"), name).trim();
+  return normalized || "craft-app";
+}
+function requireRegularFile(path2, label) {
+  if (!existsSync5(path2))
+    throw new Error(`${label} not found: ${path2}`);
+  if (!statSync2(path2).isFile())
+    throw new Error(`${label} must be a file: ${path2}`);
+}
+function containsPath(parent, candidate) {
+  const relativePath = relative(parent, candidate);
+  return relativePath === "" || relativePath !== ".." && !relativePath.startsWith(`..${sep}`) && !isAbsolute(relativePath);
+}
+function validateGoogleServicesFile(path2, packageName) {
+  requireRegularFile(path2, "Google services file");
+  let document;
+  try {
+    document = JSON.parse(readFileSync4(path2, "utf8"));
+  } catch (error) {
+    throw new Error(`Google services file must contain valid JSON: ${path2}`, { cause: error });
+  }
+  const matchingClient = document.client?.some((client) => {
+    return client.client_info?.android_client_info?.package_name === packageName;
+  });
+  if (!matchingClient) {
+    throw new Error(`Google services file has no client for Android package ${packageName}: ${path2}`);
+  }
+}
+function androidWebUrl(value, field) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`Invalid ${field}: ${value}`);
+  }
+  const localDevelopment = url.protocol === "http:" && LOCAL_DEVELOPMENT_HOSTS.has(url.hostname);
+  if (url.protocol !== "https:" && !localDevelopment || url.username || url.password) {
+    throw new Error(`${field} must use HTTPS or local HTTP without credentials: ${value}`);
+  }
+  return url;
+}
+function normalizeAndroidNetworkConfig(config) {
+  const schemes = config.urlSchemes?.map((value) => value.trim().toLowerCase()) ?? [];
+  if (schemes.some((value) => !/^[a-z][a-z0-9+.-]*$/.test(value))) {
+    throw new Error("Android deep-link schemes must be valid URI schemes");
+  }
+  config.urlSchemes = [...new Set(schemes)];
+  if (config.enableDeepLinks && config.urlSchemes.length === 0) {
+    throw new Error("Android deep links require at least one URL scheme");
+  }
+  const trustedOrigins = (config.trustedOrigins ?? []).map((value) => {
+    return androidWebUrl(value, "Android trusted origin").origin;
+  });
+  if (config.devServerURL) {
+    const devServer = androidWebUrl(config.devServerURL, "Android dev server URL");
+    config.devServerURL = devServer.toString();
+    trustedOrigins.push(devServer.origin);
+  }
+  config.trustedOrigins = [...new Set(trustedOrigins)];
+}
+function validateAndroidConfig(config) {
+  if (!config.appName.trim())
+    throw new Error("Android app name must not be empty");
+  const packageSegments = config.packageName.split(".");
+  if (packageSegments.length < 2 || packageSegments.some((segment) => !/^[A-Za-z_][A-Za-z0-9_]*$/.test(segment) || KOTLIN_KEYWORDS.has(segment))) {
+    throw new Error(`Invalid Android package name: ${config.packageName}`);
+  }
+  if (!/^#(?:[\dA-F]{3,4}|[\dA-F]{6}|[\dA-F]{8})$/i.test(config.backgroundColor ?? "")) {
+    throw new Error(`Invalid Android background color: ${config.backgroundColor}`);
+  }
+  for (const [name, value] of [
+    ["versionCode", config.versionCode],
+    ["minSdk", config.minSdk],
+    ["compileSdk", config.compileSdk],
+    ["targetSdk", config.targetSdk]
+  ]) {
+    if (!Number.isInteger(value) || Number(value) < 1) {
+      throw new Error(`Android ${name} must be a positive integer`);
+    }
+  }
+  if (Number(config.minSdk) > Number(config.targetSdk)) {
+    throw new Error("Android minSdk must not exceed targetSdk");
+  }
+  if (Number(config.targetSdk) > Number(config.compileSdk)) {
+    throw new Error("Android targetSdk must not exceed compileSdk");
+  }
+}
+function writeAndroidConfig(output, config) {
+  writeFileSync4(join3(output, "craft.config.json"), JSON.stringify(config, null, 2));
+  const runtimeConfig = { ...config };
+  delete runtimeConfig.appIconPath;
+  delete runtimeConfig.googleServicesFile;
+  writeFileSync4(join3(output, "app/src/main/assets/craft.config.json"), JSON.stringify(runtimeConfig, null, 2));
+}
 function syncAndroidWebAssets(source, output) {
   const sourcePath = resolve2(source);
   if (!existsSync5(sourcePath))
     throw new Error(`Web asset path not found: ${source}`);
-  const assetsDir = join3(output, "app/src/main/assets");
+  const sourceStat = statSync2(sourcePath);
+  if (!sourceStat.isDirectory() && !sourceStat.isFile()) {
+    throw new Error(`Web asset path must be a file or directory: ${source}`);
+  }
+  const assetsDir = resolve2(output, "app/src/main/assets");
+  if (containsPath(sourcePath, assetsDir) || containsPath(assetsDir, sourcePath)) {
+    throw new Error(`Web asset source must not overlap generated asset directory: ${source}`);
+  }
+  if (sourceStat.isDirectory()) {
+    requireRegularFile(join3(sourcePath, "index.html"), "Web asset directory entry point");
+  }
   const configPath = join3(assetsDir, "craft.config.json");
-  const config = existsSync5(configPath) ? readFileSync3(configPath) : undefined;
+  const config = existsSync5(configPath) ? readFileSync4(configPath) : undefined;
   rmSync3(assetsDir, { recursive: true, force: true });
   mkdirSync3(assetsDir, { recursive: true });
-  if (statSync2(sourcePath).isDirectory())
+  if (sourceStat.isDirectory())
     cpSync3(sourcePath, assetsDir, { recursive: true });
   else
     cpSync3(sourcePath, join3(assetsDir, "index.html"));
   if (!existsSync5(join3(assetsDir, "index.html")))
     throw new Error(`Web asset directory must contain index.html: ${source}`);
   if (config)
-    writeFileSync3(configPath, config);
+    writeFileSync4(configPath, config);
 }
 function renderAndroidPermissions(config) {
   const permissions = new Set(["android.permission.INTERNET", "android.permission.ACCESS_NETWORK_STATE"]);
@@ -1792,8 +1934,33 @@ async function init2(options) {
 \u26A1 Initializing Craft Android project: ${name}`);
   console.log(`   Output: ${output}
 `);
-  const finalPackageName = packageName || `com.craft.${name.toLowerCase().replace(/[^a-z0-9]/g, "")}`;
+  const finalPackageName = packageName || `com.craft.${generatedPackageSegment(name)}`;
   const packagePath = finalPackageName.replace(/\./g, "/");
+  const config = {
+    ...DEFAULT_CONFIG2,
+    ...options.config,
+    appName: name,
+    packageName: finalPackageName
+  };
+  if (config.enableBackgroundLocation)
+    config.enableGeolocation = true;
+  if (config.enableHealthConnect) {
+    config.minSdk = Math.max(config.minSdk ?? 26, 26);
+    config.compileSdk = Math.max(config.compileSdk ?? 36, 36);
+  }
+  normalizeAndroidNetworkConfig(config);
+  validateAndroidConfig(config);
+  if (config.enablePushNotifications && !config.googleServicesFile) {
+    throw new Error("Android push notifications require a googleServicesFile");
+  }
+  if (config.googleServicesFile)
+    validateGoogleServicesFile(config.googleServicesFile, finalPackageName);
+  if (config.appIconPath)
+    requireRegularFile(config.appIconPath, "App icon");
+  const appIconExtension = config.appIconPath ? extname(config.appIconPath).toLowerCase() : undefined;
+  if (config.appIconPath && ![".gif", ".jpg", ".png", ".webp"].includes(appIconExtension ?? "")) {
+    throw new Error(`Unsupported Android app icon format: ${appIconExtension || "(none)"}`);
+  }
   const dirs = [
     output,
     join3(output, "app/src/main/java", packagePath),
@@ -1803,32 +1970,24 @@ async function init2(options) {
     join3(output, "app/src/main/assets"),
     join3(output, "gradle/wrapper")
   ];
+  if (existsSync5(output) && !statSync2(output).isDirectory()) {
+    throw new Error(`Android project output must be a directory: ${output}`);
+  }
   for (const dir of dirs) {
     if (!existsSync5(dir)) {
       mkdirSync3(dir, { recursive: true });
     }
   }
-  const config = {
-    ...DEFAULT_CONFIG2,
-    appName: name,
-    packageName: finalPackageName,
-    ...options.config
-  };
-  if (config.enableBackgroundLocation)
-    config.enableGeolocation = true;
-  writeFileSync3(join3(output, "craft.config.json"), JSON.stringify(config, null, 2));
-  writeFileSync3(join3(output, "app/src/main/assets/craft.config.json"), JSON.stringify(config, null, 2));
+  writeAndroidConfig(output, config);
   const hasGoogleServices = Boolean(config.googleServicesFile);
   if (config.googleServicesFile) {
-    if (!existsSync5(config.googleServicesFile))
-      throw new Error(`Google services file not found: ${config.googleServicesFile}`);
     cpSync3(config.googleServicesFile, join3(output, "app/google-services.json"));
   }
-  const mainActivityTemplate = readFileSync3(join3(TEMPLATES_DIR2, "MainActivity.kt.template"), "utf-8");
+  const mainActivityTemplate = readFileSync4(join3(TEMPLATES_DIR2, "MainActivity.kt.template"), "utf-8");
   const mainActivity = mainActivityTemplate.replace(/\{\{PACKAGE_NAME\}\}/g, finalPackageName).replace(/\{\{APP_NAME\}\}/g, name);
-  writeFileSync3(join3(output, "app/src/main/java", packagePath, "MainActivity.kt"), mainActivity);
-  const craftBridgeTemplate = readFileSync3(join3(TEMPLATES_DIR2, "CraftBridge.kt.template"), "utf-8");
-  const craftBridge = craftBridgeTemplate.replace(/\{\{PACKAGE_NAME\}\}/g, finalPackageName).replace(/\{\{ENABLE_SPEECH\}\}/g, String(Boolean(config.enableSpeechRecognition))).replace(/\{\{ENABLE_HAPTICS\}\}/g, String(Boolean(config.enableHaptics))).replace(/\{\{ENABLE_SHARE\}\}/g, String(Boolean(config.enableShare))).replace(/\{\{ENABLE_CAMERA\}\}/g, String(Boolean(config.enableCamera))).replace(/\{\{ENABLE_BIOMETRIC\}\}/g, String(Boolean(config.enableBiometric))).replace(/\{\{ENABLE_PUSH\}\}/g, String(Boolean(config.enablePushNotifications))).replace(/\{\{ENABLE_SECURE_STORAGE\}\}/g, String(Boolean(config.enableSecureStorage))).replace(/\{\{ENABLE_GEOLOCATION\}\}/g, String(Boolean(config.enableGeolocation))).replace(/\{\{ENABLE_BACKGROUND_LOCATION\}\}/g, String(Boolean(config.enableBackgroundLocation))).replace(/\{\{ENABLE_KEEP_AWAKE\}\}/g, String(Boolean(config.enableKeepAwake))).replace(/\{\{ENABLE_DEEP_LINKS\}\}/g, String(Boolean(config.enableDeepLinks))).replace(/\{\{ENABLE_HEALTH_CONNECT\}\}/g, String(Boolean(config.enableHealthConnect))).replace(/\{\{FIREBASE_IMPORT\}\}/g, config.enablePushNotifications ? "import com.google.firebase.messaging.FirebaseMessaging" : "").replace(/\{\{REGISTER_PUSH_IMPLEMENTATION\}\}/g, config.enablePushNotifications ? `activity.runOnUiThread {
+  writeFileSync4(join3(output, "app/src/main/java", packagePath, "MainActivity.kt"), mainActivity);
+  const craftBridgeTemplate = readFileSync4(join3(TEMPLATES_DIR2, "CraftBridge.kt.template"), "utf-8");
+  const craftBridge = craftBridgeTemplate.replace(/\{\{PROMISE_RUNTIME\}\}/g, () => renderAndroidPromiseRuntime("            ")).replace(/\{\{PACKAGE_NAME\}\}/g, finalPackageName).replace(/\{\{ENABLE_SPEECH\}\}/g, String(Boolean(config.enableSpeechRecognition))).replace(/\{\{ENABLE_HAPTICS\}\}/g, String(Boolean(config.enableHaptics))).replace(/\{\{ENABLE_SHARE\}\}/g, String(Boolean(config.enableShare))).replace(/\{\{ENABLE_CAMERA\}\}/g, String(Boolean(config.enableCamera))).replace(/\{\{ENABLE_BIOMETRIC\}\}/g, String(Boolean(config.enableBiometric))).replace(/\{\{ENABLE_PUSH\}\}/g, String(Boolean(config.enablePushNotifications))).replace(/\{\{ENABLE_SECURE_STORAGE\}\}/g, String(Boolean(config.enableSecureStorage))).replace(/\{\{ENABLE_GEOLOCATION\}\}/g, String(Boolean(config.enableGeolocation))).replace(/\{\{ENABLE_BACKGROUND_LOCATION\}\}/g, String(Boolean(config.enableBackgroundLocation))).replace(/\{\{ENABLE_KEEP_AWAKE\}\}/g, String(Boolean(config.enableKeepAwake))).replace(/\{\{ENABLE_DEEP_LINKS\}\}/g, String(Boolean(config.enableDeepLinks))).replace(/\{\{ENABLE_HEALTH_CONNECT\}\}/g, String(Boolean(config.enableHealthConnect))).replace(/\{\{FIREBASE_IMPORT\}\}/g, config.enablePushNotifications ? "import com.google.firebase.messaging.FirebaseMessaging" : "").replace(/\{\{REGISTER_PUSH_IMPLEMENTATION\}\}/g, config.enablePushNotifications ? `activity.runOnUiThread {
             if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU
                 && ContextCompat.checkSelfPermission(activity, Manifest.permission.POST_NOTIFICATIONS) != PackageManager.PERMISSION_GRANTED) {
                 ActivityCompat.requestPermissions(activity, arrayOf(Manifest.permission.POST_NOTIFICATIONS), 4204)
@@ -1838,27 +1997,26 @@ async function init2(options) {
                     val token = if (task.isSuccessful) task.result else null
                     val callback = if (token.isNullOrBlank()) "window._craftPushReject" else "window._craftPushResolve"
                     val payload = JSONObject.quote(token ?: task.exception?.message ?: "Firebase Cloud Messaging is not configured")
-                    webView.evaluateJavascript("$callback && $callback($payload)", null)
+                    evaluatePromiseJavascript("$callback && $callback($payload)")
                 }
             } catch (error: Exception) {
                 val payload = JSONObject.quote(error.message ?: "Firebase Cloud Messaging is not configured")
-                webView.evaluateJavascript("window._craftPushReject && window._craftPushReject($payload)", null)
+                evaluatePromiseJavascript("window._craftPushReject && window._craftPushReject($payload)")
             }
-        }` : `activity.runOnUiThread {
-            webView.evaluateJavascript(
-                "window._craftPushReject && window._craftPushReject('Push notifications are disabled')",
-                null
-            )
-        }`);
-  writeFileSync3(join3(output, "app/src/main/java", packagePath, "CraftBridge.kt"), craftBridge);
-  const healthTemplate = readFileSync3(join3(TEMPLATES_DIR2, config.enableHealthConnect ? "CraftHealthConnect.kt.template" : "CraftHealthConnectStub.kt.template"), "utf-8");
-  writeFileSync3(join3(output, "app/src/main/java", packagePath, "CraftHealthConnect.kt"), healthTemplate.replace(/\{\{PACKAGE_NAME\}\}/g, finalPackageName));
-  if (config.enableBackgroundLocation) {
-    const serviceTemplate = readFileSync3(join3(TEMPLATES_DIR2, "LocationRecordingService.kt.template"), "utf-8");
-    writeFileSync3(join3(output, "app/src/main/java", packagePath, "LocationRecordingService.kt"), serviceTemplate.replace(/\{\{PACKAGE_NAME\}\}/g, finalPackageName));
-  }
-  const manifestTemplate = readFileSync3(join3(TEMPLATES_DIR2, "AndroidManifest.xml.template"), "utf-8");
-  const manifest = manifestTemplate.replace(/\{\{PACKAGE_NAME\}\}/g, finalPackageName).replace(/\{\{APP_NAME\}\}/g, name).replace(/\{\{PERMISSIONS\}\}/g, renderAndroidPermissions(config)).replace(/\{\{USES_CLEARTEXT\}\}/g, config.devServerURL?.startsWith("http://") ? "true" : "false").replace(/\{\{DEEP_LINK_INTENT_FILTERS\}\}/g, renderAndroidDeepLinks(config)).replace(/\{\{BACKGROUND_SERVICE\}\}/g, config.enableBackgroundLocation ? '        <service android:name=".LocationRecordingService" android:exported="false" android:foregroundServiceType="location" android:stopWithTask="false" />' : "").replace(/\{\{HEALTH_CONNECT_QUERIES\}\}/g, config.enableHealthConnect ? `    <queries>
+        }` : `evaluatePromiseJavascript(
+            "window._craftPushReject && window._craftPushReject('Push notifications are disabled')"
+        )`);
+  writeFileSync4(join3(output, "app/src/main/java", packagePath, "CraftBridge.kt"), craftBridge);
+  const craftNative = readFileSync4(join3(TEMPLATES_DIR2, "CraftNative.kt.template"), "utf-8");
+  const nativeDir = join3(output, "app/src/main/java/com/craft/runtime");
+  mkdirSync3(nativeDir, { recursive: true });
+  writeFileSync4(join3(nativeDir, "CraftNative.kt"), craftNative);
+  const serviceTemplate = readFileSync4(join3(TEMPLATES_DIR2, "LocationRecordingService.kt.template"), "utf-8");
+  writeFileSync4(join3(nativeDir, "LocationRecordingService.kt"), serviceTemplate);
+  const healthTemplate = readFileSync4(join3(TEMPLATES_DIR2, config.enableHealthConnect ? "CraftHealthConnect.kt.template" : "CraftHealthConnectStub.kt.template"), "utf-8");
+  writeFileSync4(join3(output, "app/src/main/java", packagePath, "CraftHealthConnect.kt"), healthTemplate.replace(/\{\{PACKAGE_NAME\}\}/g, finalPackageName));
+  const manifestTemplate = readFileSync4(join3(TEMPLATES_DIR2, "AndroidManifest.xml.template"), "utf-8");
+  const manifest = manifestTemplate.replace(/\{\{PACKAGE_NAME\}\}/g, finalPackageName).replace(/\{\{APP_NAME\}\}/g, name).replace(/\{\{PERMISSIONS\}\}/g, renderAndroidPermissions(config)).replace(/\{\{USES_CLEARTEXT\}\}/g, config.devServerURL?.startsWith("http://") ? "true" : "false").replace(/\{\{DEEP_LINK_INTENT_FILTERS\}\}/g, renderAndroidDeepLinks(config)).replace(/\{\{BACKGROUND_SERVICE\}\}/g, config.enableBackgroundLocation ? '        <service android:name="com.craft.runtime.LocationRecordingService" android:exported="false" android:foregroundServiceType="location" android:stopWithTask="false" />' : "").replace(/\{\{HEALTH_CONNECT_QUERIES\}\}/g, config.enableHealthConnect ? `    <queries>
         <package android:name="com.google.android.apps.healthdata" />
     </queries>` : "").replace(/\{\{HEALTH_CONNECT_RATIONALE\}\}/g, config.enableHealthConnect ? `            <intent-filter>
                 <action android:name="androidx.health.ACTION_SHOW_PERMISSIONS_RATIONALE" />
@@ -1867,25 +2025,25 @@ async function init2(options) {
                 <action android:name="android.intent.action.VIEW_PERMISSION_USAGE" />
                 <category android:name="android.intent.category.HEALTH_PERMISSIONS" />
             </intent-filter>` : "");
-  writeFileSync3(join3(output, "app/src/main/AndroidManifest.xml"), manifest);
-  const projectGradleTemplate = readFileSync3(join3(TEMPLATES_DIR2, "build.gradle.kts.project.template"), "utf-8");
-  writeFileSync3(join3(output, "build.gradle.kts"), projectGradleTemplate.replace(/\{\{GOOGLE_SERVICES_PLUGIN\}\}/g, hasGoogleServices ? '    id("com.google.gms.google-services") version "4.4.2" apply false' : ""));
-  const appGradleTemplate = readFileSync3(join3(TEMPLATES_DIR2, "build.gradle.kts.app.template"), "utf-8");
-  const appGradle = appGradleTemplate.replace(/\{\{PACKAGE_NAME\}\}/g, finalPackageName).replace(/\{\{VERSION_NAME\}\}/g, config.version || "1.0.0").replace(/\{\{VERSION_CODE\}\}/g, String(config.versionCode || 1)).replace(/\{\{MIN_SDK\}\}/g, String(config.minSdk || 24)).replace(/\{\{COMPILE_SDK\}\}/g, String(Math.max(config.compileSdk || 36, config.enableHealthConnect ? 36 : 1))).replace(/\{\{TARGET_SDK\}\}/g, String(config.targetSdk || 35)).replace(/\{\{GOOGLE_SERVICES_PLUGIN\}\}/g, hasGoogleServices ? '    id("com.google.gms.google-services")' : "").replace(/\{\{FIREBASE_MESSAGING_DEPENDENCY\}\}/g, config.enablePushNotifications ? '    implementation("com.google.firebase:firebase-messaging:24.1.0")' : "").replace(/\{\{HEALTH_CONNECT_DEPENDENCIES\}\}/g, config.enableHealthConnect ? `    implementation("androidx.health.connect:connect-client:1.1.0")
+  writeFileSync4(join3(output, "app/src/main/AndroidManifest.xml"), manifest);
+  const projectGradleTemplate = readFileSync4(join3(TEMPLATES_DIR2, "build.gradle.kts.project.template"), "utf-8");
+  writeFileSync4(join3(output, "build.gradle.kts"), projectGradleTemplate.replace(/\{\{GOOGLE_SERVICES_PLUGIN\}\}/g, hasGoogleServices ? '    id("com.google.gms.google-services") version "4.4.2" apply false' : ""));
+  const appGradleTemplate = readFileSync4(join3(TEMPLATES_DIR2, "build.gradle.kts.app.template"), "utf-8");
+  const appGradle = appGradleTemplate.replace(/\{\{PACKAGE_NAME\}\}/g, finalPackageName).replace(/\{\{VERSION_NAME\}\}/g, escapeKotlinString(config.version || "1.0.0")).replace(/\{\{VERSION_CODE\}\}/g, String(config.versionCode || 1)).replace(/\{\{MIN_SDK\}\}/g, String(config.minSdk || 24)).replace(/\{\{COMPILE_SDK\}\}/g, String(config.compileSdk || 36)).replace(/\{\{TARGET_SDK\}\}/g, String(config.targetSdk || 35)).replace(/\{\{GOOGLE_SERVICES_PLUGIN\}\}/g, hasGoogleServices ? '    id("com.google.gms.google-services")' : "").replace(/\{\{FIREBASE_MESSAGING_DEPENDENCY\}\}/g, config.enablePushNotifications ? '    implementation("com.google.firebase:firebase-messaging:24.1.0")' : "").replace(/\{\{HEALTH_CONNECT_DEPENDENCIES\}\}/g, config.enableHealthConnect ? `    implementation("androidx.health.connect:connect-client:1.1.0")
     implementation("org.jetbrains.kotlinx:kotlinx-coroutines-android:1.8.1")` : "");
-  writeFileSync3(join3(output, "app/build.gradle.kts"), appGradle);
-  const proguardTemplate = readFileSync3(join3(TEMPLATES_DIR2, "proguard-rules.pro.template"), "utf-8");
-  writeFileSync3(join3(output, "app/proguard-rules.pro"), proguardTemplate.replace(/\{\{PACKAGE_NAME\}\}/g, finalPackageName));
-  const settingsTemplate = readFileSync3(join3(TEMPLATES_DIR2, "settings.gradle.kts.template"), "utf-8");
-  const settings2 = settingsTemplate.replace(/\{\{APP_NAME\}\}/g, name);
-  writeFileSync3(join3(output, "settings.gradle.kts"), settings2);
+  writeFileSync4(join3(output, "app/build.gradle.kts"), appGradle);
+  const proguardTemplate = readFileSync4(join3(TEMPLATES_DIR2, "proguard-rules.pro.template"), "utf-8");
+  writeFileSync4(join3(output, "app/proguard-rules.pro"), proguardTemplate.replace(/\{\{PACKAGE_NAME\}\}/g, finalPackageName));
+  const settingsTemplate = readFileSync4(join3(TEMPLATES_DIR2, "settings.gradle.kts.template"), "utf-8");
+  const settings2 = settingsTemplate.replace(/\{\{APP_NAME\}\}/g, escapeKotlinString(generatedGradleProjectName(name)));
+  writeFileSync4(join3(output, "settings.gradle.kts"), settings2);
   const gradleProperties = `org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8
 android.useAndroidX=true
 kotlin.code.style=official
 android.nonTransitiveRClass=true
 `;
-  writeFileSync3(join3(output, "gradle.properties"), gradleProperties);
-  writeFileSync3(join3(output, "local.properties"), `# SDK location will be set by Android Studio
+  writeFileSync4(join3(output, "gradle.properties"), gradleProperties);
+  writeFileSync4(join3(output, "local.properties"), `# SDK location will be set by Android Studio
 `);
   const gradleWrapperProps = `distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
@@ -1895,13 +2053,13 @@ validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
 `;
-  writeFileSync3(join3(output, "gradle/wrapper/gradle-wrapper.properties"), gradleWrapperProps);
+  writeFileSync4(join3(output, "gradle/wrapper/gradle-wrapper.properties"), gradleWrapperProps);
   const stringsXml = `<?xml version="1.0" encoding="utf-8"?>
 <resources>
-    <string name="app_name">${name}</string>
+    <string name="app_name">${escapeXml(name)}</string>
 </resources>
 `;
-  writeFileSync3(join3(output, "app/src/main/res/values/strings.xml"), stringsXml);
+  writeFileSync4(join3(output, "app/src/main/res/values/strings.xml"), stringsXml);
   const colorsXml = `<?xml version="1.0" encoding="utf-8"?>
 <resources>
     <color name="primary">#1a1a2e</color>
@@ -1910,7 +2068,7 @@ zipStorePath=wrapper/dists
     <color name="background">${config.backgroundColor}</color>
 </resources>
 `;
-  writeFileSync3(join3(output, "app/src/main/res/values/colors.xml"), colorsXml);
+  writeFileSync4(join3(output, "app/src/main/res/values/colors.xml"), colorsXml);
   const appIconXml = `<?xml version="1.0" encoding="utf-8"?>
 <vector xmlns:android="http://schemas.android.com/apk/res/android"
     android:width="108dp"
@@ -1922,11 +2080,9 @@ zipStorePath=wrapper/dists
 </vector>
 `;
   if (config.appIconPath) {
-    if (!existsSync5(config.appIconPath))
-      throw new Error(`App icon not found: ${config.appIconPath}`);
-    cpSync3(config.appIconPath, join3(output, "app/src/main/res/drawable/craft_app_icon.png"));
+    cpSync3(config.appIconPath, join3(output, `app/src/main/res/drawable/craft_app_icon${appIconExtension}`));
   } else {
-    writeFileSync3(join3(output, "app/src/main/res/drawable/craft_app_icon.xml"), appIconXml);
+    writeFileSync4(join3(output, "app/src/main/res/drawable/craft_app_icon.xml"), appIconXml);
   }
   const themesXml = `<?xml version="1.0" encoding="utf-8"?>
 <resources>
@@ -1937,7 +2093,7 @@ zipStorePath=wrapper/dists
     </style>
 </resources>
 `;
-  writeFileSync3(join3(output, "app/src/main/res/values/themes.xml"), themesXml);
+  writeFileSync4(join3(output, "app/src/main/res/values/themes.xml"), themesXml);
   const activityMainXml = `<?xml version="1.0" encoding="utf-8"?>
 <androidx.coordinatorlayout.widget.CoordinatorLayout
     xmlns:android="http://schemas.android.com/apk/res/android"
@@ -1952,13 +2108,13 @@ zipStorePath=wrapper/dists
 
 </androidx.coordinatorlayout.widget.CoordinatorLayout>
 `;
-  writeFileSync3(join3(output, "app/src/main/res/layout/activity_main.xml"), activityMainXml);
+  writeFileSync4(join3(output, "app/src/main/res/layout/activity_main.xml"), activityMainXml);
   const placeholderHtml = `<!DOCTYPE html>
 <html>
 <head>
   <meta charset="UTF-8">
   <meta name="viewport" content="viewport-fit=cover, width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
-  <title>${name}</title>
+  <title>${escapeXml(name)}</title>
   <style>
     * { margin: 0; padding: 0; box-sizing: border-box; }
     body {
@@ -1978,7 +2134,7 @@ zipStorePath=wrapper/dists
 </head>
 <body>
   <div class="container">
-    <h1>\u26A1 ${name}</h1>
+    <h1>\u26A1 ${escapeXml(name)}</h1>
     <p>Built with Craft Android</p>
     <p class="ready" id="status">Waiting for Craft bridge...</p>
   </div>
@@ -1990,7 +2146,7 @@ zipStorePath=wrapper/dists
   </script>
 </body>
 </html>`;
-  writeFileSync3(join3(output, "app/src/main/assets/index.html"), placeholderHtml);
+  writeFileSync4(join3(output, "app/src/main/assets/index.html"), placeholderHtml);
   console.log("\u2705 Project initialized");
   console.log("");
   console.log("Next steps:");
@@ -2008,19 +2164,21 @@ async function build2(options) {
   if (!existsSync5(configPath)) {
     throw new Error(`No craft.config.json found in ${output}. Run 'craft android init' first.`);
   }
-  const config = JSON.parse(readFileSync3(configPath, "utf-8"));
+  const config = JSON.parse(readFileSync4(configPath, "utf-8"));
   if (devServer) {
-    config.devServerURL = devServer;
-    config.trustedOrigins = [...new Set([...config.trustedOrigins ?? [], new URL(devServer).origin])];
-    writeFileSync3(configPath, JSON.stringify(config, null, 2));
-    writeFileSync3(join3(output, "app/src/main/assets/craft.config.json"), JSON.stringify(config, null, 2));
+    const url = androidWebUrl(devServer, "Android dev server URL");
+    config.devServerURL = url.toString();
+    config.trustedOrigins = [...new Set([
+      ...(config.trustedOrigins ?? []).map((value) => androidWebUrl(value, "Android trusted origin").origin),
+      url.origin
+    ])];
+    writeAndroidConfig(output, config);
     console.log(`   Dev server: ${devServer}`);
   }
   if (htmlPath) {
     syncAndroidWebAssets(htmlPath, output);
     config.hasBundledFallback = Boolean(devServer);
-    writeFileSync3(configPath, JSON.stringify(config, null, 2));
-    writeFileSync3(join3(output, "app/src/main/assets/craft.config.json"), JSON.stringify(config, null, 2));
+    writeAndroidConfig(output, config);
     console.log(`   Synced: ${htmlPath} \u2192 assets/`);
   }
   if (!compile)
@@ -2075,7 +2233,7 @@ async function run2(options) {
     } else {
       await $2`adb install -r ${apkPath}`;
     }
-    const config = JSON.parse(readFileSync3(join3(output, "craft.config.json"), "utf-8"));
+    const config = JSON.parse(readFileSync4(join3(output, "craft.config.json"), "utf-8"));
     const launchCmd = `${config.packageName}/.MainActivity`;
     if (device) {
       await $2`adb -s ${device} shell am start -n ${launchCmd}`;
@@ -2090,10 +2248,106 @@ async function run2(options) {
     throw error;
   }
 }
-var $2, TEMPLATES_DIR2, DEFAULT_CONFIG2;
+var $2, ANDROID_PROMISE_RUNTIME = `
+if (window.__craftRejectPendingPromises) {
+    window.__craftRejectPendingPromises('Android bridge reinitialized');
+}
+if (window.__craftRejectPermissionRequests) {
+    window.__craftRejectPermissionRequests('Android bridge reinitialized');
+}
+window.__craftPromiseRuntimeClosed = false;
+window.__craftPendingPromises = Object.create(null);
+window.__craftPromise = function(channel, resolveName, rejectName, invoke, timeoutMs, timeoutError) {
+    if (window.__craftPromiseRuntimeClosed) {
+        return Promise.reject(new Error('Android bridge is closed'));
+    }
+    if (window.__craftPendingPromises[channel]) {
+        return Promise.reject(new Error('A '.concat(channel, ' request is already in progress')));
+    }
+
+    return new Promise(function(resolve, reject) {
+        var entry = {settled: false, timer: null, settle: null};
+        var resolveCallback;
+        var rejectCallback;
+
+        entry.settle = function(succeeded, value) {
+            if (entry.settled || window.__craftPendingPromises[channel] !== entry) return;
+            entry.settled = true;
+            if (entry.timer !== null) clearTimeout(entry.timer);
+            if (window[resolveName] === resolveCallback) window[resolveName] = null;
+            if (window[rejectName] === rejectCallback) window[rejectName] = null;
+            delete window.__craftPendingPromises[channel];
+            if (succeeded) resolve(value);
+            else reject(value);
+        };
+
+        resolveCallback = function(value) {
+            entry.settle(true, value);
+        };
+        rejectCallback = function(error) {
+            entry.settle(false, error);
+        };
+        window[resolveName] = resolveCallback;
+        window[rejectName] = rejectCallback;
+        window.__craftPendingPromises[channel] = entry;
+
+        if (timeoutMs > 0) {
+            entry.timer = setTimeout(function() {
+                entry.settle(false, timeoutError || new Error(channel.concat(' request timed out')));
+            }, timeoutMs);
+        }
+
+        try {
+            invoke();
+        }
+        catch (error) {
+            entry.settle(false, error);
+        }
+    });
+};
+
+window.__craftRejectPendingPromises = function(message) {
+    window.__craftPromiseRuntimeClosed = true;
+    Object.keys(window.__craftPendingPromises).forEach(function(channel) {
+        var entry = window.__craftPendingPromises[channel];
+        if (entry) entry.settle(false, new Error(message || 'Android bridge closed'));
+    });
+};
+`, TEMPLATES_DIR2, LOCAL_DEVELOPMENT_HOSTS, KOTLIN_KEYWORDS, DEFAULT_CONFIG2;
 var init_src2 = __esm(() => {
   ({ $: $2 } = globalThis.Bun);
   TEMPLATES_DIR2 = join3(dirname2(import.meta.dir), "templates");
+  LOCAL_DEVELOPMENT_HOSTS = new Set(["localhost", "127.0.0.1", "10.0.2.2"]);
+  KOTLIN_KEYWORDS = new Set([
+    "as",
+    "break",
+    "class",
+    "continue",
+    "do",
+    "else",
+    "false",
+    "for",
+    "fun",
+    "if",
+    "in",
+    "interface",
+    "is",
+    "null",
+    "object",
+    "package",
+    "return",
+    "super",
+    "this",
+    "throw",
+    "true",
+    "try",
+    "typealias",
+    "typeof",
+    "val",
+    "var",
+    "when",
+    "while"
+  ]);
   DEFAULT_CONFIG2 = {
     version: "1.0.0",
     versionCode: 1,
@@ -4262,8 +4516,28 @@ function craftBinaryNotFoundMessage(triedPath) {
   ].join(`
 `);
 }
+
+// src/scaffold-version.ts
+import { readFileSync, writeFileSync } from "fs";
+function pinCraftNativeDependency(packagePath, craftVersion) {
+  const manifest = JSON.parse(readFileSync(packagePath, "utf-8"));
+  const sections = [manifest.dependencies, manifest.devDependencies];
+  let found = false;
+  for (const dependencies of sections) {
+    if (dependencies && Object.hasOwn(dependencies, "craft-native")) {
+      dependencies["craft-native"] = `^${craftVersion}`;
+      found = true;
+    }
+  }
+  if (!found) {
+    manifest.dependencies ??= {};
+    manifest.dependencies["craft-native"] = `^${craftVersion}`;
+  }
+  writeFileSync(packagePath, `${JSON.stringify(manifest, null, 2)}
+`);
+}
 // package.json
-var version = "0.0.89";
+var version = "0.0.91";
 
 // bin/cli.ts
 var spawnedFrom = process6.env[CRAFT_CLI_SPAWN_MARKER];
@@ -4757,7 +5031,7 @@ cli.command("init <name>", "Initialize a new Craft project").option("--template
   const template = options?.template || "blank";
   const bundleId = options?.bundleId || `com.example.${name.toLowerCase().replace(/[^a-z0-9]/g, "")}`;
   const appNameSlug = name.toLowerCase().replace(/[^a-z0-9]/g, "-");
-  const { mkdirSync: mkdirSync4, writeFileSync: writeFileSync4, existsSync: existsSync7, readdirSync: readdirSync3, readFileSync: readFileSync4, cpSync: cpSync4 } = await import("fs");
+  const { mkdirSync: mkdirSync4, writeFileSync: writeFileSync5, existsSync: existsSync7, readdirSync: readdirSync3, readFileSync: readFileSync5, cpSync: cpSync4 } = await import("fs");
   const { join: join4, dirname: dirname3 } = await import("path");
   const replaceVars = (content) => {
     return content.replace(/\{\{APP_NAME\}\}/g, name).replace(/\{\{APP_NAME_SLUG\}\}/g, appNameSlug).replace(/\{\{BUNDLE_ID\}\}/g, bundleId).replace(/\{\{AUTHOR\}\}/g, "Developer");
@@ -4779,9 +5053,9 @@ cli.command("init <name>", "Initialize a new Craft project").option("--template
         if (entry.isDirectory()) {
           copyRecursive(srcPath, destPath);
         } else {
-          const content = readFileSync4(srcPath, "utf-8");
+          const content = readFileSync5(srcPath, "utf-8");
           const processedContent = replaceVars(content);
-          writeFileSync4(destPath, processedContent);
+          writeFileSync5(destPath, processedContent);
         }
       }
     };
@@ -4796,7 +5070,7 @@ cli.command("init <name>", "Initialize a new Craft project").option("--template
     const copied = await copyTemplate(template, name);
     if (!copied) {
       mkdirSync4(join4(name, "src"), { recursive: true });
-      writeFileSync4(join4(name, "index.html"), replaceVars(`<!DOCTYPE html>
+      writeFileSync5(join4(name, "index.html"), replaceVars(`<!DOCTYPE html>
 <html lang="en">
 <head>
   <meta charset="UTF-8">
@@ -4810,7 +5084,7 @@ cli.command("init <name>", "Initialize a new Craft project").option("--template
   </div>
 </body>
 </html>`));
-      writeFileSync4(join4(name, "package.json"), replaceVars(JSON.stringify({
+      writeFileSync5(join4(name, "package.json"), replaceVars(JSON.stringify({
         name: "{{APP_NAME_SLUG}}",
         version: "1.0.0",
         private: true,
@@ -4820,10 +5094,11 @@ cli.command("init <name>", "Initialize a new Craft project").option("--template
           build: "craft build"
         },
         dependencies: {
-          "craft-native": "workspace:*"
+          "craft-native": `^${version}`
         }
       }, null, 2)));
     }
+    pinCraftNativeDependency(join4(name, "package.json"), version);
     console.log(`\u2705 ${template} project created`);
   }
   if (template === "desktop" || template === "all") {
@@ -4843,7 +5118,7 @@ export default {
   },
 } satisfies CraftConfig
 `;
-    writeFileSync4(`${name}/craft.config.ts`, configContent);
+    writeFileSync5(`${name}/craft.config.ts`, configContent);
     const htmlContent = `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -4874,7 +5149,7 @@ export default {
 </body>
 </html>
 `;
-    writeFileSync4(`${name}/index.html`, htmlContent);
+    writeFileSync5(`${name}/index.html`, htmlContent);
     const packageJson = {
       name: appNameSlug,
       version: "0.1.0",
@@ -4887,10 +5162,11 @@ export default {
         "ios:open": "craft ios open"
       },
       devDependencies: {
-        "craft-native": "*"
+        "craft-native": `^${version}`
       }
     };
-    writeFileSync4(`${name}/package.json`, JSON.stringify(packageJson, null, 2));
+    writeFileSync5(`${name}/package.json`, JSON.stringify(packageJson, null, 2));
+    pinCraftNativeDependency(`${name}/package.json`, version);
     console.log("\u2705 Desktop project created");
   }
   if (template === "ios" || template === "all") {