create-cmp-cli 0.2.0

package/template/composeApp/src/androidDebug/kotlin/com/example/app/inspector/InspectorHttpServer.kt

@@ -0,0 +1,322 @@
+package __PACKAGE__.inspector
+
+import android.graphics.Bitmap
+import android.graphics.Canvas
+import android.os.Handler
+import android.os.Looper
+import android.os.SystemClock
+import android.util.Log
+import android.view.MotionEvent
+import androidx.core.view.drawToBitmap
+import java.io.BufferedReader
+import java.io.ByteArrayOutputStream
+import java.io.InputStreamReader
+import java.net.InetAddress
+import java.net.ServerSocket
+import java.net.Socket
+import java.nio.charset.StandardCharsets
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.TimeUnit
+import java.util.concurrent.atomic.AtomicReference
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.floatOrNull
+import kotlinx.serialization.json.jsonObject
+import kotlinx.serialization.json.jsonPrimitive
+import kotlin.math.roundToInt
+
+/**
+ * Debug-only, zero-dependency inspection server: a hand-rolled HTTP/1.1 responder over a
+ * plain [ServerSocket]. Binds LOOPBACK ONLY (never on the LAN); the host reaches it via
+ * `adb forward tcp:9500 tcp:9500`.
+ *
+ * Routes (JSON unless noted, `Connection: close`):
+ *   GET  /inspect/health         → { status, schemaVersion, source, appId, buildType }
+ *   GET  /inspect/tree           → the semantics-tree contract document (source "live-android"),
+ *                                  read from the topmost Compose root ON THE MAIN THREAD.
+ *                                  503 while no Compose root is attached yet (cold start).
+ *   GET  /inspect/design-system  → the declared token catalog { colors, dimens }.
+ *   GET  /inspect/screenshot     → PNG bytes of the current Compose root (`image/png`) —
+ *                                  pixels for the HUMAN's live view, never for model context.
+ *   POST /inspect/tap            → body {"x":<px>,"y":<px>} (root-relative px, exactly as the
+ *                                  tree's bounds report them) → dispatches a down+up MotionEvent
+ *                                  pair to the root view → {"tapped":true,"x":…,"y":…}.
+ *   GET  /inspect/remote         → the self-contained remote-control HTML page (same-origin,
+ *                                  zero CORS): live screenshot + click-to-tap in a browser.
+ *
+ * Single-threaded accept loop on a daemon thread = one client at a time = bounded by design.
+ * Failure to bind logs a warning and gives up — the inspector must never crash or block
+ * app startup. This class exists only in the androidDebug source set; release builds do
+ * not compile it at all.
+ */
+object InspectorHttpServer {
+
+    const val PORT = 9500
+    private const val TAG = "CmpInspector"
+
+    // The main thread is busy during cold start (first setContent/layout) — be generous.
+    private const val MAIN_THREAD_TIMEOUT_MS = 5_000L
+
+    // Gap between the synthetic ACTION_DOWN and ACTION_UP — a natural, unambiguous tap
+    // (well under the long-press timeout).
+    private const val TAP_UP_DELAY_MS = 50L
+
+    private const val JSON_TYPE = "application/json; charset=utf-8"
+    private const val HTML_TYPE = "text/html; charset=utf-8"
+    private const val PNG_TYPE = "image/png"
+
+    @Volatile private var started = false
+
+    fun start(appId: String) {
+        if (started) return
+        started = true
+        val thread = Thread({ serve(appId) }, "cmp-inspector-http")
+        thread.isDaemon = true
+        thread.start()
+    }
+
+    private fun serve(appId: String) {
+        val socket = try {
+            ServerSocket(PORT, 1, InetAddress.getLoopbackAddress())
+        } catch (t: Throwable) {
+            Log.w(TAG, "inspector server failed to bind 127.0.0.1:$PORT — giving up", t)
+            return
+        }
+        Log.i(TAG, "inspector server listening on 127.0.0.1:$PORT (debug build only)")
+        while (true) {
+            val client = try {
+                socket.accept()
+            } catch (t: Throwable) {
+                Log.w(TAG, "inspector accept failed — stopping", t)
+                return
+            }
+            try {
+                client.use { handle(it, appId) }
+            } catch (t: Throwable) {
+                // Never let a bad request take the app (or the accept loop) down.
+                Log.w(TAG, "inspector request failed", t)
+            }
+        }
+    }
+
+    private fun handle(client: Socket, appId: String) {
+        client.soTimeout = 5_000
+        val reader = BufferedReader(InputStreamReader(client.getInputStream(), StandardCharsets.UTF_8))
+        val requestLine = reader.readLine() ?: return
+        // Drain headers; the only one we ever need is Content-Length (POST /inspect/tap).
+        var contentLength = 0
+        while (true) {
+            val line = reader.readLine() ?: break
+            if (line.isEmpty()) break
+            if (line.startsWith("Content-Length:", ignoreCase = true)) {
+                contentLength = line.substringAfter(':').trim().toIntOrNull() ?: 0
+            }
+        }
+        val parts = requestLine.split(" ")
+        val method = parts.getOrNull(0) ?: ""
+        val path = (parts.getOrNull(1) ?: "").substringBefore('?')
+
+        when {
+            method == "GET" && path == "/inspect/health" ->
+                writeJson(client, 200, healthJson(appId))
+            method == "GET" && path == "/inspect/tree" ->
+                treeResponse().let { (s, b) -> writeJson(client, s, b) }
+            method == "GET" && path == "/inspect/design-system" ->
+                writeJson(client, 200, InspectorCatalog.json())
+            method == "GET" && path == "/inspect/screenshot" ->
+                screenshotResponse(client)
+            method == "GET" && path == "/inspect/remote" ->
+                writeResponse(client, 200, RemoteControlPage.html(appId).toByteArray(StandardCharsets.UTF_8), HTML_TYPE)
+            method == "POST" && path == "/inspect/tap" ->
+                tapResponse(readBody(reader, contentLength)).let { (s, b) -> writeJson(client, s, b) }
+            method != "GET" && method != "POST" ->
+                writeJson(client, 405, errorJson("method not allowed"))
+            else ->
+                writeJson(client, 404, errorJson("unknown path"))
+        }
+    }
+
+    /**
+     * Read the request body. The stream is already wrapped in a UTF-8 reader, so we read
+     * [contentLength] CHARS — exact for the ASCII JSON `{"x":…,"y":…}` this route accepts
+     * (and never under-reads it), which is all this debug server needs.
+     */
+    private fun readBody(reader: BufferedReader, contentLength: Int): String {
+        if (contentLength <= 0) return ""
+        val buf = CharArray(contentLength.coerceAtMost(8_192))
+        var read = 0
+        while (read < buf.size) {
+            val n = reader.read(buf, read, buf.size - read)
+            if (n < 0) break
+            read += n
+        }
+        return String(buf, 0, read)
+    }
+
+    private fun healthJson(appId: String): String =
+        """{"status":"ok","schemaVersion":1,"source":"live-android","appId":${JsonPrimitive(appId)},"buildType":"debug"}"""
+
+    private fun treeResponse(): Pair<Int, String> {
+        val root = ComposeRootRegistry.current()
+            ?: return 503 to errorJson(
+                "compose root not ready yet — no Compose root attached (cold start?). Retry shortly."
+            )
+        // Semantics/layout nodes are not thread-safe: read the tree on the main thread and
+        // await with a generous timeout (the main thread is busy during first composition).
+        val result = AtomicReference<Pair<Int, String>>()
+        val latch = CountDownLatch(1)
+        Handler(Looper.getMainLooper()).post {
+            result.set(
+                try {
+                    // Merged tree — matches the Phase 0 harness (onRoot() default).
+                    200 to LiveSemanticsJson.dumpTree(root.semanticsOwner.rootSemanticsNode)
+                } catch (t: Throwable) {
+                    500 to errorJson("failed to walk semantics tree: ${t.message}")
+                }
+            )
+            latch.countDown()
+        }
+        return if (latch.await(MAIN_THREAD_TIMEOUT_MS, TimeUnit.MILLISECONDS)) {
+            result.get()
+        } else {
+            503 to errorJson("main thread did not respond within ${MAIN_THREAD_TIMEOUT_MS}ms — app busy (cold start?). Retry.")
+        }
+    }
+
+    /**
+     * PNG of the current Compose root. The Bitmap is rendered on the MAIN thread (views are
+     * not thread-safe); PNG compression — tens of ms for a full screen — happens back on the
+     * server thread so the UI never pays for it.
+     */
+    private fun screenshotResponse(client: Socket) {
+        val root = ComposeRootRegistry.current()
+        if (root == null) {
+            writeJson(
+                client, 503,
+                errorJson("compose root not ready yet — no Compose root attached (cold start?). Retry shortly.")
+            )
+            return
+        }
+        val bitmapRef = AtomicReference<Bitmap?>()
+        val errorRef = AtomicReference<String?>()
+        val latch = CountDownLatch(1)
+        Handler(Looper.getMainLooper()).post {
+            try {
+                val view = root.view
+                bitmapRef.set(
+                    try {
+                        // androidx.core.view.drawToBitmap (core-ktx — already an androidMain dep).
+                        view.drawToBitmap()
+                    } catch (t: Throwable) {
+                        // Not laid out yet / hardware path refused — plain Canvas draw fallback.
+                        Bitmap.createBitmap(
+                            view.width.coerceAtLeast(1),
+                            view.height.coerceAtLeast(1),
+                            Bitmap.Config.ARGB_8888,
+                        ).also { view.draw(Canvas(it)) }
+                    }
+                )
+            } catch (t: Throwable) {
+                errorRef.set("failed to render screenshot: ${t.message}")
+            }
+            latch.countDown()
+        }
+        if (!latch.await(MAIN_THREAD_TIMEOUT_MS, TimeUnit.MILLISECONDS)) {
+            writeJson(client, 503, errorJson("main thread did not respond within ${MAIN_THREAD_TIMEOUT_MS}ms — app busy (cold start?). Retry."))
+            return
+        }
+        errorRef.get()?.let {
+            writeJson(client, 500, errorJson(it))
+            return
+        }
+        val bitmap = bitmapRef.get()
+        if (bitmap == null) {
+            writeJson(client, 500, errorJson("failed to render screenshot: no bitmap produced"))
+            return
+        }
+        val bytes = ByteArrayOutputStream().use { out ->
+            bitmap.compress(Bitmap.CompressFormat.PNG, 100, out)
+            out.toByteArray()
+        }
+        bitmap.recycle()
+        writeResponse(client, 200, bytes, PNG_TYPE)
+    }
+
+    /**
+     * Dispatch a synthetic tap (ACTION_DOWN, then ACTION_UP ~50ms later) to the topmost
+     * Compose root, on the MAIN thread. Coordinates are root-relative px — exactly the
+     * space the tree's `bounds` report, so callers can tap what they just inspected.
+     */
+    private fun tapResponse(body: String): Pair<Int, String> {
+        val (x, y) = try {
+            val obj = Json.parseToJsonElement(body).jsonObject
+            val px = obj["x"]?.jsonPrimitive?.floatOrNull
+            val py = obj["y"]?.jsonPrimitive?.floatOrNull
+            if (px == null || py == null) {
+                return 400 to errorJson("""tap body must be {"x":<px>,"y":<px>} (root-relative px).""")
+            }
+            px to py
+        } catch (t: Throwable) {
+            return 400 to errorJson("""tap body must be {"x":<px>,"y":<px>} (root-relative px).""")
+        }
+        val root = ComposeRootRegistry.current()
+            ?: return 503 to errorJson(
+                "compose root not ready yet — no Compose root attached (cold start?). Retry shortly."
+            )
+        val latch = CountDownLatch(1)
+        val handler = Handler(Looper.getMainLooper())
+        handler.post {
+            try {
+                val view = root.view
+                val downTime = SystemClock.uptimeMillis()
+                val down = MotionEvent.obtain(downTime, downTime, MotionEvent.ACTION_DOWN, x, y, 0)
+                view.dispatchTouchEvent(down)
+                down.recycle()
+                handler.postDelayed({
+                    try {
+                        val up = MotionEvent.obtain(downTime, SystemClock.uptimeMillis(), MotionEvent.ACTION_UP, x, y, 0)
+                        view.dispatchTouchEvent(up)
+                        up.recycle()
+                    } finally {
+                        latch.countDown()
+                    }
+                }, TAP_UP_DELAY_MS)
+            } catch (t: Throwable) {
+                latch.countDown()
+            }
+        }
+        return if (latch.await(MAIN_THREAD_TIMEOUT_MS, TimeUnit.MILLISECONDS)) {
+            200 to """{"tapped":true,"x":${x.roundToInt()},"y":${y.roundToInt()}}"""
+        } else {
+            503 to errorJson("main thread did not respond within ${MAIN_THREAD_TIMEOUT_MS}ms — app busy (cold start?). Retry.")
+        }
+    }
+
+    private fun errorJson(message: String): String =
+        """{"error":${JsonPrimitive(message)}}"""
+
+    private fun writeJson(client: Socket, status: Int, body: String) =
+        writeResponse(client, status, body.toByteArray(StandardCharsets.UTF_8), JSON_TYPE)
+
+    private fun writeResponse(client: Socket, status: Int, bytes: ByteArray, contentType: String) {
+        val reason = when (status) {
+            200 -> "OK"
+            400 -> "Bad Request"
+            404 -> "Not Found"
+            405 -> "Method Not Allowed"
+            503 -> "Service Unavailable"
+            else -> "Internal Server Error"
+        }
+        val head = buildString {
+            append("HTTP/1.1 ").append(status).append(' ').append(reason).append("\r\n")
+            append("Content-Type: ").append(contentType).append("\r\n")
+            append("Content-Length: ").append(bytes.size).append("\r\n")
+            append("Connection: close\r\n")
+            append("\r\n")
+        }
+        val out = client.getOutputStream()
+        out.write(head.toByteArray(StandardCharsets.UTF_8))
+        out.write(bytes)
+        out.flush()
+    }
+}

package/template/composeApp/src/androidDebug/kotlin/com/example/app/inspector/InspectorInit.kt

@@ -0,0 +1,16 @@
+package __PACKAGE__.inspector
+
+import android.app.Application
+
+/**
+ * DEBUG variant: install the Compose root registry (must happen BEFORE any Activity so the
+ * `onViewCreatedCallback` hook catches every root), then start the loopback-only inspection
+ * server on 127.0.0.1:9500. Reach it from the host via `adb forward tcp:9500 tcp:9500`.
+ *
+ * The release source set carries a same-signature no-op twin — the compiler picks the variant
+ * body, so release builds contain no inspector code at all (structural absence, not a flag).
+ */
+fun Application.startInspector() {
+    ComposeRootRegistry.install()
+    InspectorHttpServer.start(appId = packageName)
+}

package/template/composeApp/src/androidDebug/kotlin/com/example/app/inspector/LiveSemanticsJson.kt

@@ -0,0 +1,102 @@
+package __PACKAGE__.inspector
+
+import androidx.compose.ui.semantics.SemanticsActions
+import androidx.compose.ui.semantics.SemanticsNode
+import androidx.compose.ui.semantics.SemanticsProperties
+import androidx.compose.ui.semantics.getOrNull
+import __PACKAGE__.presentation.theme.DesignTokenKey
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonElement
+import kotlinx.serialization.json.JsonNull
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.buildJsonArray
+import kotlinx.serialization.json.buildJsonObject
+import kotlin.math.roundToInt
+
+/**
+ * Walks a Compose [SemanticsNode] tree and serialises it to JSON matching the create-cmp
+ * inspector contract (schemaVersion 1, source "live-android"). This mirrors the Phase 0
+ * harness serializer (`inspector/harness/.../SemanticsJson.kt`) node-for-node — the live
+ * path yields the SAME SemanticsNode type, so tier-0 and tier-1 output are structurally
+ * identical by construction. Every node carries pixel, root-relative bounds and a (possibly
+ * empty) `children` array; testTag/text/contentDescription/designToken are nullable.
+ *
+ * Optional contract fields (still schemaVersion 1):
+ *  - `role`      string|null — [SemanticsProperties.Role] (e.g. "Button").
+ *  - `clickable` boolean     — presence of [SemanticsActions.OnClick].
+ *  - `disabled`  boolean     — presence of [SemanticsProperties.Disabled].
+ */
+object LiveSemanticsJson {
+
+    private val prettyJson = Json { prettyPrint = true }
+
+    /** Serialises [root] as the top-level contract document string. */
+    fun dumpTree(root: SemanticsNode): String {
+        val doc = buildJsonObject {
+            put("schemaVersion", JsonPrimitive(1))
+            put("source", JsonPrimitive("live-android"))
+            put("root", nodeToJson(root))
+        }
+        return prettyJson.encodeToString(JsonElement.serializer(), doc)
+    }
+
+    private fun nodeToJson(node: SemanticsNode): JsonObject = buildJsonObject {
+        put("testTag", node.testTag().toJson())
+        put("text", node.text().toJson())
+        put("contentDescription", node.contentDescription().toJson())
+        put("role", node.roleName().toJson())
+        put("clickable", JsonPrimitive(node.isClickable()))
+        put("disabled", JsonPrimitive(node.isDisabled()))
+        put("bounds", node.boundsJson())
+        put("designToken", node.designTokenJson())
+        put("children", buildJsonArray {
+            node.children.forEach { add(nodeToJson(it)) }
+        })
+    }
+
+    private fun SemanticsNode.testTag(): String? =
+        config.getOrNull(SemanticsProperties.TestTag)
+
+    private fun SemanticsNode.text(): String? =
+        config.getOrNull(SemanticsProperties.Text)
+            ?.joinToString(separator = " ") { it.text }
+            ?.takeIf { it.isNotEmpty() }
+
+    private fun SemanticsNode.contentDescription(): String? =
+        config.getOrNull(SemanticsProperties.ContentDescription)
+            ?.joinToString(separator = " ")
+            ?.takeIf { it.isNotEmpty() }
+
+    private fun SemanticsNode.roleName(): String? =
+        config.getOrNull(SemanticsProperties.Role)?.toString()
+
+    private fun SemanticsNode.isClickable(): Boolean =
+        config.contains(SemanticsActions.OnClick)
+
+    private fun SemanticsNode.isDisabled(): Boolean =
+        config.contains(SemanticsProperties.Disabled)
+
+    private fun SemanticsNode.boundsJson(): JsonObject {
+        val rect = boundsInRoot
+        return buildJsonObject {
+            put("x", JsonPrimitive(rect.left.roundToInt()))
+            put("y", JsonPrimitive(rect.top.roundToInt()))
+            put("width", JsonPrimitive(rect.width.roundToInt()))
+            put("height", JsonPrimitive(rect.height.roundToInt()))
+        }
+    }
+
+    private fun SemanticsNode.designTokenJson(): JsonElement {
+        val info = config.getOrNull(DesignTokenKey) ?: return JsonNull
+        return buildJsonObject {
+            put("tokens", buildJsonArray { info.tokens.forEach { add(JsonPrimitive(it)) } })
+            put("resolved", buildJsonObject {
+                info.resolved.forEach { (k, v) -> put(k, JsonPrimitive(v)) }
+            })
+        }
+    }
+
+    private fun String?.toJson(): JsonElement =
+        if (this == null) JsonNull else JsonPrimitive(this)
+}

package/template/composeApp/src/androidDebug/kotlin/com/example/app/inspector/RemoteControlPage.kt

@@ -0,0 +1,106 @@
+package __PACKAGE__.inspector
+
+/**
+ * The `/inspect/remote` page: a self-contained, same-origin (zero CORS) remote-control view
+ * of the running app — the "Running Devices window" for a browser. The HUMAN watches the live
+ * screenshot (re-fetched ~every 700ms with a cache-buster) and clicks it; the click is scaled
+ * from displayed-image space to device px and delivered via `POST /inspect/tap`, and the next
+ * poll shows the result. A light `/inspect/tree` poll (~every 3s) feeds the header stats.
+ *
+ * No external resources, dark-friendly, phone-aspect. Pixels here flow to the HUMAN's browser
+ * only — the agent keeps asserting on the tree. Debug builds only, loopback only, like every
+ * other route on this server.
+ */
+object RemoteControlPage {
+
+    fun html(appId: String): String = """<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>$appId — live device view</title>
+<style>
+  body { margin: 0; background: #101216; color: #e8eaed; display: flex; flex-direction: column;
+         min-height: 100vh; font: 13px/1.4 -apple-system, BlinkMacSystemFont, sans-serif; }
+  header { display: flex; justify-content: space-between; align-items: baseline; gap: 12px;
+           padding: 10px 16px; background: #1a1d23; position: sticky; top: 0;
+           border-bottom: 1px solid #2a2e36; }
+  header .app { font-weight: 600; }
+  #stats { color: #7ee2a8; font-variant-numeric: tabular-nums; }
+  main { flex: 1; display: flex; justify-content: center; align-items: flex-start; padding: 14px; }
+  #screen { max-height: calc(100vh - 92px); max-width: 94vw; border: 1px solid #2a2e36;
+            border-radius: 14px; background: #000; cursor: crosshair; }
+  #tapdot { position: fixed; width: 16px; height: 16px; border-radius: 50%; pointer-events: none;
+            background: rgba(126, 226, 168, .9); transform: translate(-50%, -50%); opacity: 0;
+            transition: opacity .4s; }
+  footer { padding: 6px 16px 10px; color: #7a8090; font-size: 11px; text-align: center; }
+</style>
+</head>
+<body>
+<header>
+  <span class="app">$appId · live device view</span>
+  <span id="stats">connecting…</span>
+</header>
+<main><img id="screen" alt="live device screen (click to tap)"></main>
+<div id="tapdot"></div>
+<footer>click the screen to tap the real device · create-cmp debug inspector · loopback only, debug builds only</footer>
+<script>
+"use strict";
+var img = document.getElementById("screen");
+var stats = document.getElementById("stats");
+var dot = document.getElementById("tapdot");
+var busy = false;
+
+// Live screenshot: re-fetch ~every 700ms (cache-busted); swap only once loaded (no flicker).
+function poll() {
+  if (busy) return;
+  busy = true;
+  var next = new Image();
+  next.onload = function () { img.src = next.src; busy = false; };
+  next.onerror = function () { busy = false; };
+  next.src = "/inspect/screenshot?t=" + Date.now();
+}
+setInterval(poll, 700);
+poll();
+
+// Click → scale displayed coords to device px (natural vs displayed size) → POST /inspect/tap.
+img.addEventListener("click", function (e) {
+  if (!img.naturalWidth) return;
+  var r = img.getBoundingClientRect();
+  var x = Math.round((e.clientX - r.left) * (img.naturalWidth / r.width));
+  var y = Math.round((e.clientY - r.top) * (img.naturalHeight / r.height));
+  dot.style.left = e.clientX + "px";
+  dot.style.top = e.clientY + "px";
+  dot.style.opacity = "1";
+  setTimeout(function () { dot.style.opacity = "0"; }, 350);
+  fetch("/inspect/tap", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ x: x, y: y })
+  }).catch(function () {});
+});
+
+// Header stats: a light tree poll — node + tagged counts, ~every 3s.
+function countNodes(node) {
+  var acc = { nodes: 1, tags: node.testTag ? 1 : 0 };
+  (node.children || []).forEach(function (c) {
+    var m = countNodes(c);
+    acc.nodes += m.nodes;
+    acc.tags += m.tags;
+  });
+  return acc;
+}
+function pollTree() {
+  fetch("/inspect/tree").then(function (res) { return res.json(); }).then(function (tree) {
+    if (!tree.root) { stats.textContent = "tree: not ready"; return; }
+    var n = countNodes(tree.root);
+    stats.textContent = n.nodes + " nodes · " + n.tags + " tagged";
+  }).catch(function () { stats.textContent = "tree: unreachable"; });
+}
+setInterval(pollTree, 3000);
+pollTree();
+</script>
+</body>
+</html>
+"""
+}

package/template/composeApp/src/androidDebug/res/xml/debug_network_security_config.xml

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <!-- Debug-only cleartext to the local Firebase emulators / dev backends. -->
+    <domain-config cleartextTrafficPermitted="true">
+        <domain includeSubdomains="true">127.0.0.1</domain>
+        <domain includeSubdomains="true">10.0.2.2</domain>
+        <domain includeSubdomains="true">localhost</domain>
+    </domain-config>
+</network-security-config>

package/template/composeApp/src/androidMain/AndroidManifest.xml

@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+
+    <application
+        android:name=".AppApplication"
+        android:label="__APP_NAME__"
+        android:icon="@mipmap/ic_launcher"
+        android:roundIcon="@mipmap/ic_launcher_round"
+        android:supportsRtl="true"
+        android:usesCleartextTraffic="${usesCleartextTraffic}"
+        android:theme="@style/Theme.App">
+
+        <activity
+            android:name=".MainActivity"
+            android:exported="true"
+            android:windowSoftInputMode="adjustResize">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+
+    </application>
+</manifest>

package/template/composeApp/src/androidMain/kotlin/com/example/app/AppApplication.kt

@@ -0,0 +1,72 @@
+package __PACKAGE__
+
+import android.app.Application
+// >>> cmp:feature firebase
+import __PACKAGE__.data.remote.FIREBASE_FUNCTIONS_REGION
+import dev.gitlive.firebase.Firebase
+import dev.gitlive.firebase.auth.auth
+import dev.gitlive.firebase.firestore.firestore
+import dev.gitlive.firebase.functions.functions
+import dev.gitlive.firebase.storage.storage
+// <<< cmp:feature firebase
+// >>> cmp:feature room
+import __PACKAGE__.data.local.AppDatabase
+import __PACKAGE__.data.local.appContext
+import __PACKAGE__.data.local.buildDatabase
+// <<< cmp:feature room
+import __PACKAGE__.core.connectivity.NetworkMonitor
+import __PACKAGE__.di.androidModule
+// >>> cmp:feature inspector
+import __PACKAGE__.inspector.startInspector
+// <<< cmp:feature inspector
+import __PACKAGE__.di.appModules
+import org.koin.android.ext.koin.androidContext
+import org.koin.android.ext.koin.androidLogger
+import org.koin.core.context.startKoin
+import org.koin.dsl.module
+
+class AppApplication : Application() {
+    override fun onCreate() {
+        super.onCreate()
+        // >>> cmp:feature inspector
+        // Debug builds only: the androidRelease twin is a no-op (see inspector/InspectorInit.kt).
+        // Must run before any Activity so the Compose root registry catches every root.
+        startInspector()
+        // <<< cmp:feature inspector
+        // >>> cmp:feature room
+        appContext = this
+        // <<< cmp:feature room
+        // >>> cmp:feature firebase
+        configureFirebaseEmulators()
+        // <<< cmp:feature firebase
+        startKoin {
+            androidLogger()
+            androidContext(this@AppApplication)
+            modules(
+                module {
+                    // >>> cmp:feature room
+                    single<AppDatabase> { buildDatabase() }
+                    // <<< cmp:feature room
+                    single { NetworkMonitor(androidContext()) }
+                },
+                androidModule,
+                *appModules.toTypedArray()
+            )
+        }
+    }
+
+    // >>> cmp:feature firebase
+    // Debug builds talk to the local Firebase emulators (BuildConfig flags set in build.gradle.kts).
+    private fun configureFirebaseEmulators() {
+        if (!BuildConfig.USE_FIREBASE_EMULATORS) return
+        val host = BuildConfig.FIREBASE_EMULATOR_HOST
+        runCatching {
+            Firebase.auth.useEmulator(host, BuildConfig.FIREBASE_AUTH_PORT)
+            Firebase.firestore.useEmulator(host, BuildConfig.FIREBASE_FIRESTORE_PORT)
+            Firebase.functions(FIREBASE_FUNCTIONS_REGION)
+                .useEmulator(host, BuildConfig.FIREBASE_FUNCTIONS_PORT)
+            Firebase.storage.useEmulator(host, BuildConfig.FIREBASE_STORAGE_PORT)
+        }
+    }
+    // <<< cmp:feature firebase
+}