expo-harmony-toolkit 1.9.0 → 1.9.2

package/README.en.md

@@ -9,7 +9,7 @@
   <p>
     <a href="https://github.com/BlackishGreen33/Expo-Harmony-Toolkit/actions/workflows/ci.yml"><img alt="Checks" src="https://img.shields.io/badge/checks-passing-16a34a?style=flat-square&logo=githubactions&logoColor=white"></a>
     <a href="./LICENSE"><img alt="License" src="https://img.shields.io/badge/license-MIT-0f766e?style=flat-square"></a>
-    <a href="https://github.com/BlackishGreen33/Expo-Harmony-Toolkit/releases"><img alt="Version" src="https://img.shields.io/badge/version-v1.9.0-111827?style=flat-square"></a>
+    <a href="https://github.com/BlackishGreen33/Expo-Harmony-Toolkit/releases"><img alt="Version" src="https://img.shields.io/badge/version-v1.9.2-111827?style=flat-square"></a>
     <a href="./docs/support-matrix.md"><img alt="Matrix" src="https://img.shields.io/badge/matrix-expo55--rnoh082--ui--stack-2563eb?style=flat-square"></a>
     <img alt="Input" src="https://img.shields.io/badge/input-Managed%2FCNG%20%2B%20bare%20intake-059669?style=flat-square">
   </p>
@@ -24,7 +24,7 @@
 </div>
 
 > [!IMPORTANT]
-> `v1.9.0` keeps the `verified + preview + experimental` model and brings bare workflow intake, five app foundation modules, and the `react-native-gesture-handler` formal slice onto the mainline tracker. The public promise remains tighter: `latest` only carries fully accepted `verified` capabilities, while `next` is reserved for preview fast-track work. The expanded goal still does not widen the current `verified` boundary yet.
+> `v1.9.2` keeps the `v1.9.1` build-hap security baseline and brings `@react-native-async-storage/async-storage`, `react-native-screens`, and `react-native-safe-area-context` into Third-party Native Wave A formal experimental onboarding. The public promise remains tighter: `latest` only carries fully accepted `verified` capabilities, and Wave A does not widen the current `verified` boundary.
 
 > [!TIP]
 > The two validated `@react-native-oh-tpl/*` adapters in the public matrix are currently consumed via exact Git URLs and commits. For repository development and the official UI-stack sample, prefer `pnpm install --ignore-scripts` so adapter prepare hooks do not fail on private upstream resources.
@@ -48,13 +48,13 @@
 <!-- GENERATED:readme-current-status:start -->
 | Item | Status |
 | --- | --- |
-| Current version | `v1.9.0` |
+| Current version | `v1.9.2` |
 | Support model | `verified + preview + experimental` |
 | Public `verified` matrix | `expo55-rnoh082-ui-stack` |
 | Supported input | Managed/CNG Expo projects; bare workflow intake baseline |
 | `verified` JS/UI capabilities | `expo-router`, `expo-linking`, `expo-constants`, `react-native-reanimated`, `react-native-svg` |
 | `preview` native capabilities | `expo-file-system`, `expo-image-picker`, `expo-location`, `expo-camera`, `expo-secure-store`, `expo-asset`, `expo-device`, `expo-clipboard`, `expo-haptics` |
-| `experimental` capabilities | `expo-notifications`, `react-native-gesture-handler` |
+| `experimental` capabilities | `expo-notifications`, `react-native-gesture-handler`, `@react-native-async-storage/async-storage`, `react-native-screens`, `react-native-safe-area-context` |
 | Release tracks | `latest` = fully accepted `verified` only; `next` = preview fast track |
 | Capability telemetry | `runtimeMode` + `evidence(...)` + `evidenceSource(...)` + `coverageProfile` + `nextActions` |
 | Build path | `doctor -> init -> bundle -> build-hap` |
@@ -71,6 +71,7 @@
 - `expo-secure-store`, `expo-asset`, `expo-device`, `expo-clipboard`, and `expo-haptics` remain the `preview` shim baseline
 - `expo-notifications`
 - `react-native-gesture-handler` remains a formal experimental slice
+- `@react-native-async-storage/async-storage`, `react-native-screens`, and `react-native-safe-area-context` remain Wave A experimental onboarding
 - multiple public matrices
 
 </details>
@@ -176,7 +177,7 @@ Common decision points:
 <!-- GENERATED:readme-support-matrix:start -->
 - `verified`: the only public matrix remains `expo55-rnoh082-ui-stack`
 - `preview`: `expo-file-system`, `expo-image-picker`, `expo-location`, `expo-camera`, `expo-secure-store`, `expo-asset`, `expo-device`, `expo-clipboard`, `expo-haptics`
-- `experimental`: `expo-notifications`, `react-native-gesture-handler`
+- `experimental`: `expo-notifications`, `react-native-gesture-handler`, `@react-native-async-storage/async-storage`, `react-native-screens`, `react-native-safe-area-context`
 
 `doctor --strict` still means `verified` only. `doctor --target-tier preview` allows the same runtime matrix plus preview-tier capabilities, but that does not promote them into the formal public promise.
 

package/README.md

@@ -9,7 +9,7 @@
   <p>
     <a href="https://github.com/BlackishGreen33/Expo-Harmony-Toolkit/actions/workflows/ci.yml"><img alt="Checks" src="https://img.shields.io/badge/checks-passing-16a34a?style=flat-square&logo=githubactions&logoColor=white"></a>
     <a href="./LICENSE"><img alt="License" src="https://img.shields.io/badge/license-MIT-0f766e?style=flat-square"></a>
-    <a href="https://github.com/BlackishGreen33/Expo-Harmony-Toolkit/releases"><img alt="Version" src="https://img.shields.io/badge/version-v1.9.0-111827?style=flat-square"></a>
+    <a href="https://github.com/BlackishGreen33/Expo-Harmony-Toolkit/releases"><img alt="Version" src="https://img.shields.io/badge/version-v1.9.2-111827?style=flat-square"></a>
     <a href="./docs/support-matrix.md"><img alt="Matrix" src="https://img.shields.io/badge/matrix-expo55--rnoh082--ui--stack-2563eb?style=flat-square"></a>
     <img alt="Input" src="https://img.shields.io/badge/input-Managed%2FCNG%20%2B%20bare%20intake-059669?style=flat-square">
   </p>
@@ -24,7 +24,7 @@
 </div>
 
 > [!IMPORTANT]
-> `v1.9.0` 延续 `verified + preview + experimental` 三层支持模型，并把 bare workflow intake、五个 app foundation modules 与 `react-native-gesture-handler` formal slice 纳入主线追踪。当前公开承诺仍然收紧为：`latest` 只承诺完整验收的 `verified` 能力，`next` 用于 preview fast track。目标扩大不等于当前 `verified` 边界已经放宽。
+> `v1.9.2` 延续 `v1.9.1` 的 build-hap 安全基线，并把 `@react-native-async-storage/async-storage`、`react-native-screens`、`react-native-safe-area-context` 纳入 Third-party Native Wave A formal experimental onboarding。当前公开承诺仍然收紧为：`latest` 只承诺完整验收的 `verified` 能力，Wave A 不放宽当前 `verified` 边界。
 
 > [!TIP]
 > 由于当前公开矩阵内的两套 `@react-native-oh-tpl/*` adapter 依赖以 Git URL + exact commit 形式接入，仓库开发和官方 UI-stack sample 推荐使用 `pnpm install --ignore-scripts`，避免 Git adapter 在 prepare 阶段拉取私有资源而中断安装。
@@ -48,13 +48,13 @@
 <!-- GENERATED:readme-current-status:start -->
 | 项目 | 说明 |
 | --- | --- |
-| 当前版本 | `v1.9.0` |
+| 当前版本 | `v1.9.2` |
 | 支持模型 | `verified + preview + experimental` |
 | 唯一 `verified` 公开矩阵 | `expo55-rnoh082-ui-stack` |
 | 输入范围 | Managed/CNG Expo 项目；bare workflow intake baseline |
 | `verified` JS/UI 能力 | `expo-router`、`expo-linking`、`expo-constants`、`react-native-reanimated`、`react-native-svg` |
 | `preview` 原生能力 | `expo-file-system`、`expo-image-picker`、`expo-location`、`expo-camera`、`expo-secure-store`、`expo-asset`、`expo-device`、`expo-clipboard`、`expo-haptics` |
-| `experimental` 能力 | `expo-notifications`、`react-native-gesture-handler` |
+| `experimental` 能力 | `expo-notifications`、`react-native-gesture-handler`、`@react-native-async-storage/async-storage`、`react-native-screens`、`react-native-safe-area-context` |
 | 发布轨 | `latest` = fully accepted verified only；`next` = preview fast track |
 | capability 遥测 | `runtimeMode` + `evidence(...)` + `evidenceSource(...)` + `coverageProfile` + `nextActions` |
 | 构建链 | `doctor -> init -> bundle -> build-hap` |
@@ -71,6 +71,7 @@
 - `expo-secure-store`、`expo-asset`、`expo-device`、`expo-clipboard`、`expo-haptics` 仍只属于 `preview` shim baseline
 - `expo-notifications`
 - `react-native-gesture-handler` 仍只属于 formal experimental slice
+- `@react-native-async-storage/async-storage`、`react-native-screens`、`react-native-safe-area-context` 仍只属于 Wave A experimental onboarding
 - 多矩阵并行支持
 
 </details>
@@ -176,7 +177,7 @@ pnpm exec expo-harmony build-hap --mode release
 <!-- GENERATED:readme-support-matrix:start -->
 - `verified`：唯一公开矩阵仍是 `expo55-rnoh082-ui-stack`
 - `preview`：`expo-file-system`, `expo-image-picker`, `expo-location`, `expo-camera`, `expo-secure-store`, `expo-asset`, `expo-device`, `expo-clipboard`, `expo-haptics`
-- `experimental`：`expo-notifications`, `react-native-gesture-handler`
+- `experimental`：`expo-notifications`, `react-native-gesture-handler`, `@react-native-async-storage/async-storage`, `react-native-screens`, `react-native-safe-area-context`
 
 `doctor --strict` 继续只代表 `verified`。`doctor --target-tier preview` 会在同一 runtime matrix 下额外放行 preview 能力，但这不等于它们已经进入正式承诺。
 

package/build/cli.js

@@ -40,6 +40,7 @@ async function run(argv = process.argv) {
         .description('Build a Harmony HAP from the validated sidecar and bundle outputs')
         .option('-p, --project-root <path>', 'path to the Expo project')
         .option('--mode <mode>', 'build mode: debug or release', 'debug')
+        .option('--no-har-normalize', 'let ohpm consume file:*.har dependencies without extracting local HARs')
         .action(buildHap_1.runBuildHapCommand);
     program
         .command('init')

package/build/commands/buildHap.d.ts

@@ -1,5 +1,6 @@
 export interface BuildHapCommandOptions {
     projectRoot?: string;
     mode?: 'debug' | 'release';
+    harNormalize?: boolean;
 }
 export declare function runBuildHapCommand(options: BuildHapCommandOptions): Promise<void>;

package/build/commands/buildHap.js

@@ -17,6 +17,7 @@ async function runBuildHapCommand(options) {
     }
     const report = await (0, build_1.buildHapProject)(projectRoot, {
         mode,
+        skipHarNormalize: options.harNormalize === false,
     });
     await (0, metadata_1.writeBuildReport)(projectRoot, report);
     if (report.status === 'failed') {

package/build/core/build/localHar.js

@@ -83,9 +83,10 @@ async function extractHarArchiveToDirectory(archivePath, extractionRoot, package
     if (!(await fs_extra_1.default.pathExists(archivePath))) {
         throw new Error(`Local Harmony archive not found: ${archivePath}`);
     }
-    const destinationPath = path_1.default.join(extractionRoot, `${sanitizePackageName(packageName)}-${path_1.default.basename(archivePath, path_1.default.extname(archivePath))}`);
+    const destinationPath = path_1.default.join(extractionRoot, `${sanitizePackageName(packageName)}-${sanitizePathComponent(path_1.default.basename(archivePath, path_1.default.extname(archivePath)))}`);
     const stagingRoot = await fs_extra_1.default.mkdtemp(path_1.default.join(os_1.default.tmpdir(), 'expo-harmony-har-'));
     try {
+        await validateHarArchiveMemberNames(archivePath);
         await execFileAsync('tar', ['-xzf', archivePath, '-C', stagingRoot], {
             maxBuffer: 20 * 1024 * 1024,
         });
@@ -93,6 +94,7 @@ async function extractHarArchiveToDirectory(archivePath, extractionRoot, package
         const sourceRoot = (await fs_extra_1.default.pathExists(path_1.default.join(packagedRoot, 'oh-package.json5')))
             ? packagedRoot
             : stagingRoot;
+        await validateExtractedHarTree(sourceRoot, stagingRoot);
         if (!(await fs_extra_1.default.pathExists(path_1.default.join(sourceRoot, 'oh-package.json5')))) {
             throw new Error(`oh-package.json5 not found after extracting ${archivePath}`);
         }
@@ -115,7 +117,61 @@ async function extractHarArchiveToDirectory(archivePath, extractionRoot, package
     }
 }
 function sanitizePackageName(packageName) {
-    return packageName.replace(/[^a-zA-Z0-9._-]+/g, '-').replace(/^-+|-+$/g, '');
+    return sanitizePathComponent(packageName);
+}
+function sanitizePathComponent(value) {
+    return value.replace(/[^a-zA-Z0-9._-]+/g, '-').replace(/^-+|-+$/g, '') || 'archive';
+}
+async function validateHarArchiveMemberNames(archivePath) {
+    const { stdout } = await execFileAsync('tar', ['-tzf', archivePath], {
+        maxBuffer: 20 * 1024 * 1024,
+    });
+    for (const rawMemberName of stdout.split('\n')) {
+        const memberName = rawMemberName.trim();
+        if (!memberName) {
+            continue;
+        }
+        const segments = memberName.split('/').filter(Boolean);
+        if (path_1.default.isAbsolute(memberName) ||
+            memberName.includes('\\') ||
+            segments.some((segment) => segment === '..')) {
+            throw new Error(`Unsafe path in local Harmony archive: ${memberName}`);
+        }
+    }
+}
+async function validateExtractedHarTree(rootPath, stagingRoot) {
+    const stagingRealPath = await fs_extra_1.default.realpath(stagingRoot);
+    const rootRealPath = await fs_extra_1.default.realpath(rootPath);
+    if (!isPathInside(rootRealPath, stagingRealPath)) {
+        throw new Error(`Extracted local Harmony archive root escaped the staging directory: ${rootPath}`);
+    }
+    await walkExtractedHarTree(rootPath, rootRealPath);
+}
+async function walkExtractedHarTree(currentPath, rootRealPath) {
+    const currentStats = await fs_extra_1.default.lstat(currentPath);
+    if (currentStats.isSymbolicLink()) {
+        throw new Error(`Symbolic links are not allowed in local Harmony archives: ${currentPath}`);
+    }
+    if (currentStats.isFile() && currentStats.nlink > 1) {
+        throw new Error(`Hard links are not allowed in local Harmony archives: ${currentPath}`);
+    }
+    if (!currentStats.isDirectory() && !currentStats.isFile()) {
+        throw new Error(`Unsupported file type in local Harmony archive: ${currentPath}`);
+    }
+    const currentRealPath = await fs_extra_1.default.realpath(currentPath);
+    if (!isPathInside(currentRealPath, rootRealPath)) {
+        throw new Error(`Extracted local Harmony archive entry escaped the package directory: ${currentPath}`);
+    }
+    if (!currentStats.isDirectory()) {
+        return;
+    }
+    for (const entryName of await fs_extra_1.default.readdir(currentPath)) {
+        await walkExtractedHarTree(path_1.default.join(currentPath, entryName), rootRealPath);
+    }
+}
+function isPathInside(candidatePath, parentPath) {
+    const relativePath = path_1.default.relative(parentPath, candidatePath);
+    return relativePath === '' || (!relativePath.startsWith('..') && !path_1.default.isAbsolute(relativePath));
 }
 async function readNormalizedLocalHarPackageMetadata(directoryPath, packageName) {
     await ensureNormalizedLocalHarModuleJson5(directoryPath);
@@ -331,7 +387,7 @@ async function alignRnohCodegenWithNormalizedLocalPackage(harmonyProjectRoot, lo
     if (!relativeRnohModulePath.startsWith('.')) {
         relativeRnohModulePath = `./${relativeRnohModulePath}`;
     }
-    const updatedHvigorFile = originalHvigorFile.replace(/rnohModulePath:\s*['"][^'"]+['"]/, `rnohModulePath: '${relativeRnohModulePath}'`);
+    const updatedHvigorFile = originalHvigorFile.replace(/rnohModulePath:\s*['"][^'"]+['"]/, `rnohModulePath: ${JSON.stringify(relativeRnohModulePath)}`);
     if (updatedHvigorFile !== originalHvigorFile) {
         await fs_extra_1.default.writeFile(hvigorFilePath, updatedHvigorFile);
     }

package/build/core/build.d.ts

@@ -2,6 +2,7 @@ import type { BuildReport } from '../types';
 import type { CommandRunner } from './build/commands';
 export type { CommandRunner, CommandRunnerResult } from './build/commands';
 export { renderBuildReport } from './build/reporting';
+export declare const SKIP_HAR_NORMALIZE_WARNING = "Local HAR normalization is disabled; ohpm will consume file:*.har dependencies directly and normalized build-profile/RNOH compatibility steps will be skipped.";
 interface BundleProjectOptions {
     env?: NodeJS.ProcessEnv;
     runner?: CommandRunner;
@@ -11,6 +12,7 @@ interface BuildHapProjectOptions {
     mode: 'debug' | 'release';
     env?: NodeJS.ProcessEnv;
     runner?: CommandRunner;
+    skipHarNormalize?: boolean;
 }
 export declare function bundleProject(projectRoot: string, options?: BundleProjectOptions): Promise<BuildReport>;
 export declare function buildHapProject(projectRoot: string, options: BuildHapProjectOptions): Promise<BuildReport>;

package/build/core/build.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.renderBuildReport = void 0;
+exports.SKIP_HAR_NORMALIZE_WARNING = exports.renderBuildReport = void 0;
 exports.bundleProject = bundleProject;
 exports.buildHapProject = buildHapProject;
 exports.getDesiredHarmonyScripts = getDesiredHarmonyScripts;
@@ -18,8 +18,10 @@ const localHar_1 = require("./build/localHar");
 const commands_1 = require("./build/commands");
 const reporting_1 = require("./build/reporting");
 const rnohCompatibility_1 = require("./build/rnohCompatibility");
+const signing_1 = require("./signing");
 var reporting_2 = require("./build/reporting");
 Object.defineProperty(exports, "renderBuildReport", { enumerable: true, get: function () { return reporting_2.renderBuildReport; } });
+exports.SKIP_HAR_NORMALIZE_WARNING = 'Local HAR normalization is disabled; ohpm will consume file:*.har dependencies directly and normalized build-profile/RNOH compatibility steps will be skipped.';
 async function bundleProject(projectRoot, options = {}) {
     const runtimeEnv = options.env ?? process.env;
     const runCommand = options.runner ?? commands_1.defaultCommandRunner;
@@ -193,6 +195,7 @@ async function bundleProject(projectRoot, options = {}) {
 async function buildHapProject(projectRoot, options) {
     const runtimeEnv = options.env ?? process.env;
     const runCommand = options.runner ?? commands_1.defaultCommandRunner;
+    const skipHarNormalize = options.skipHarNormalize === true || runtimeEnv.EXPO_HARMONY_SKIP_HAR_NORMALIZE === '1';
     const loadedProject = await (0, project_1.loadProject)(projectRoot);
     const envReport = await (0, env_1.buildEnvReport)(loadedProject.projectRoot, {
         env: runtimeEnv,
@@ -202,6 +205,9 @@ async function buildHapProject(projectRoot, options) {
         ...envReport.warnings.filter((warning) => !warning.startsWith('Harmony sidecar files are not present yet.')),
         ...relevantEnvAdvisories.map((issue) => `${issue.code}: ${issue.message}`),
     ];
+    if (skipHarNormalize) {
+        warnings.push(exports.SKIP_HAR_NORMALIZE_WARNING);
+    }
     const blockingIssues = [];
     if (!envReport.hvigorPath) {
         blockingIssues.push({
@@ -286,39 +292,42 @@ async function buildHapProject(projectRoot, options) {
     let restoreNormalizedRnohCliAutolinkingTemplates = async () => { };
     let restoreNormalizedRnohCodegenAlignment = async () => { };
     let restoreNormalizedHarmonyPackageJsons = async () => { };
-    try {
-        const normalizedLocalHarDependencies = await (0, localHar_1.normalizeLocalHarDependencies)(harmonyProjectRoot);
-        normalizedLocalHarPackages = normalizedLocalHarDependencies.packages;
-        restoreNormalizedDependencies = normalizedLocalHarDependencies.restore;
-        restoreNormalizedLocalHarModules = await (0, localHar_1.ensureHarmonyBuildProfileSupportsNormalizedLocalDeps)(harmonyProjectRoot, normalizedLocalHarDependencies.packages);
-        restoreNormalizedRnohCliAutolinkingTemplates =
-            await (0, rnohCompatibility_1.normalizeProjectRnohCliAutolinkingTemplates)(loadedProject.projectRoot);
-        restoreNormalizedHarmonyPackageJsons =
-            await (0, autolinking_1.normalizeKnownHarmonyPackageJsons)(loadedProject.projectRoot);
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        return (0, reporting_1.createBuildReport)({
-            projectRoot: loadedProject.projectRoot,
-            command: 'build-hap',
-            mode: options.mode,
-            status: 'failed',
-            harmonyProjectRoot,
-            entryFile: bundleReport.entryFile,
-            bundleOutputPath: bundleReport.bundleOutputPath,
-            assetsDestPath: bundleReport.assetsDestPath,
-            artifactPaths: [],
-            blockingIssues: [
-                {
-                    code: 'build.hap.failed',
-                    message,
-                },
-            ],
-            warnings: [...warnings, ...bundleReport.warnings],
-            steps,
-        });
+    let restoreLocalSigningBuildProfile = async () => { };
+    if (!skipHarNormalize) {
+        try {
+            const normalizedLocalHarDependencies = await (0, localHar_1.normalizeLocalHarDependencies)(harmonyProjectRoot);
+            normalizedLocalHarPackages = normalizedLocalHarDependencies.packages;
+            restoreNormalizedDependencies = normalizedLocalHarDependencies.restore;
+            restoreNormalizedLocalHarModules = await (0, localHar_1.ensureHarmonyBuildProfileSupportsNormalizedLocalDeps)(harmonyProjectRoot, normalizedLocalHarDependencies.packages);
+            restoreNormalizedRnohCliAutolinkingTemplates =
+                await (0, rnohCompatibility_1.normalizeProjectRnohCliAutolinkingTemplates)(loadedProject.projectRoot);
+            restoreNormalizedHarmonyPackageJsons =
+                await (0, autolinking_1.normalizeKnownHarmonyPackageJsons)(loadedProject.projectRoot);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return (0, reporting_1.createBuildReport)({
+                projectRoot: loadedProject.projectRoot,
+                command: 'build-hap',
+                mode: options.mode,
+                status: 'failed',
+                harmonyProjectRoot,
+                entryFile: bundleReport.entryFile,
+                bundleOutputPath: bundleReport.bundleOutputPath,
+                assetsDestPath: bundleReport.assetsDestPath,
+                artifactPaths: [],
+                blockingIssues: [
+                    {
+                        code: 'build.hap.failed',
+                        message,
+                    },
+                ],
+                warnings: [...warnings, ...bundleReport.warnings],
+                steps,
+            });
+        }
+        restoreNormalizedRnohCodegenAlignment = await (0, localHar_1.alignRnohCodegenWithNormalizedLocalPackage)(harmonyProjectRoot, normalizedLocalHarPackages);
     }
-    restoreNormalizedRnohCodegenAlignment = await (0, localHar_1.alignRnohCodegenWithNormalizedLocalPackage)(harmonyProjectRoot, normalizedLocalHarPackages);
     const ohpmCommand = (0, commands_1.buildInvocation)(envReport.ohpmPath, ['install', '--all']);
     try {
         const ohpmResult = await runCommand(ohpmCommand.file, ohpmCommand.args, {
@@ -349,11 +358,16 @@ async function buildHapProject(projectRoot, options) {
                 steps,
             });
         }
-        if (!normalizedLocalHarPackages.some((localPackage) => localPackage.packageName === '@rnoh/react-native-openharmony')) {
-            await (0, localHar_1.ensureRnohGeneratedTsShim)(harmonyProjectRoot);
+        if (!skipHarNormalize) {
+            if (!normalizedLocalHarPackages.some((localPackage) => localPackage.packageName === '@rnoh/react-native-openharmony')) {
+                await (0, localHar_1.ensureRnohGeneratedTsShim)(harmonyProjectRoot);
+            }
+            await (0, localHar_1.patchRnohGeneratedCodegenForNormalizedLocalPackage)(harmonyProjectRoot);
         }
-        await (0, localHar_1.patchRnohGeneratedCodegenForNormalizedLocalPackage)(harmonyProjectRoot);
         await (0, localHar_1.patchKnownHarmonyAdapterCodegenOutputs)(harmonyProjectRoot);
+        if (options.mode === 'release') {
+            restoreLocalSigningBuildProfile = await temporarilyMergeLocalSigningIntoBuildProfile(loadedProject.projectRoot, harmonyProjectRoot);
+        }
         const hvigorCommand = (0, commands_1.buildInvocation)(envReport.hvigorPath, [
             'assembleHap',
             '--no-daemon',
@@ -407,6 +421,7 @@ async function buildHapProject(projectRoot, options) {
         });
     }
     finally {
+        await restoreLocalSigningBuildProfile();
         await restoreNormalizedHarmonyPackageJsons();
         await restoreNormalizedRnohCodegenAlignment();
         await restoreNormalizedRnohCliAutolinkingTemplates();
@@ -414,6 +429,25 @@ async function buildHapProject(projectRoot, options) {
         await restoreNormalizedDependencies();
     }
 }
+async function temporarilyMergeLocalSigningIntoBuildProfile(projectRoot, harmonyProjectRoot) {
+    const signingLocalConfig = await (0, signing_1.readSigningLocalConfig)(projectRoot);
+    if (!signingLocalConfig) {
+        return async () => { };
+    }
+    const buildProfilePath = path_1.default.join(harmonyProjectRoot, 'build-profile.json5');
+    if (!(await fs_extra_1.default.pathExists(buildProfilePath))) {
+        return async () => { };
+    }
+    const originalContents = await fs_extra_1.default.readFile(buildProfilePath, 'utf8');
+    const nextContents = (0, signing_1.mergeSigningLocalConfigIntoBuildProfile)(originalContents, signingLocalConfig, { includeSecrets: true });
+    if (nextContents === originalContents) {
+        return async () => { };
+    }
+    await fs_extra_1.default.writeFile(buildProfilePath, nextContents);
+    return async () => {
+        await fs_extra_1.default.writeFile(buildProfilePath, originalContents);
+    };
+}
 function getDesiredHarmonyScripts(projectRoot) {
     return (0, project_1.loadProject)(projectRoot).then((loadedProject) => (0, template_1.buildDesiredPackageScripts)(loadedProject.packageJson));
 }

package/build/core/constants.d.ts

@@ -1,6 +1,6 @@
 export declare const TOOLKIT_PACKAGE_NAME = "expo-harmony-toolkit";
 export declare const CLI_NAME = "expo-harmony";
-export declare const TOOLKIT_VERSION = "1.9.0";
+export declare const TOOLKIT_VERSION = "1.9.2";
 export declare const TEMPLATE_VERSION = "rnoh-0.82.29";
 export declare const RNOH_VERSION = "0.82.29";
 export declare const RNOH_CLI_VERSION = "0.82.29";

package/build/core/constants.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DESIRED_PACKAGE_SCRIPTS = exports.HARMONY_RUNTIME_PRELUDE_RELATIVE_PATH = exports.HARMONY_ROUTER_ENTRY_FILENAME = exports.STRICT_ENV_EXIT_CODE = exports.STRICT_DOCTOR_EXIT_CODE = exports.DEFAULT_HVIGOR_PLUGIN_FILENAME = exports.PREBUILD_METADATA_FILENAME = exports.TOOLKIT_CONFIG_FILENAME = exports.BUILD_REPORT_FILENAME = exports.ENV_REPORT_FILENAME = exports.DOCTOR_REPORT_FILENAME = exports.MANIFEST_FILENAME = exports.SIGNING_LOCAL_EXAMPLE_FILENAME = exports.SIGNING_LOCAL_FILENAME = exports.GENERATED_SHIMS_DIR = exports.GENERATED_DIR = exports.SUPPORTED_EXPO_SDKS = exports.RNOH_CLI_VERSION = exports.RNOH_VERSION = exports.TEMPLATE_VERSION = exports.TOOLKIT_VERSION = exports.CLI_NAME = exports.TOOLKIT_PACKAGE_NAME = void 0;
 exports.TOOLKIT_PACKAGE_NAME = 'expo-harmony-toolkit';
 exports.CLI_NAME = 'expo-harmony';
-exports.TOOLKIT_VERSION = '1.9.0';
+exports.TOOLKIT_VERSION = '1.9.2';
 exports.TEMPLATE_VERSION = 'rnoh-0.82.29';
 exports.RNOH_VERSION = '0.82.29';
 exports.RNOH_CLI_VERSION = '0.82.29';

package/build/core/report.js

@@ -26,11 +26,26 @@ const DEFAULT_RECORD = {
 const BARE_WORKFLOW_DIRECTORY_NAMES = ['android', 'ios'];
 const BARE_WORKFLOW_DEPENDENCIES = new Set(['expo-build-properties', 'expo-dev-client']);
 const FORMAL_EXPERIMENTAL_ADAPTER_PAIRS = [
+    {
+        canonicalPackageName: '@react-native-async-storage/async-storage',
+        adapterPackageName: '@react-native-oh-tpl/async-storage',
+    },
+    {
+        canonicalPackageName: 'react-native-screens',
+        adapterPackageName: '@react-native-oh-tpl/react-native-screens',
+    },
     {
         canonicalPackageName: 'react-native-gesture-handler',
         adapterPackageName: '@react-native-oh-tpl/react-native-gesture-handler',
     },
 ];
+const THIRD_PARTY_WAVE_A_PACKAGE_NAMES = new Set([
+    '@react-native-async-storage/async-storage',
+    '@react-native-oh-tpl/async-storage',
+    'react-native-screens',
+    '@react-native-oh-tpl/react-native-screens',
+    'react-native-safe-area-context',
+]);
 async function buildDoctorReport(projectRoot, options = {}) {
     const loadedProject = await (0, project_1.loadProject)(projectRoot);
     const doctorConfig = (0, project_1.resolveExpoHarmonyDoctorConfig)(loadedProject.expoConfig);
@@ -477,7 +492,12 @@ function buildNextActions(input) {
             actions.push('Keep this project on the bare workflow track for now: preserve the native directories, use `expo-harmony doctor --project-root .` for classification, and only claim verified support after bare workflow support lands in the mainline capability catalog.');
             break;
         case 'third-party-native-heavy':
-            actions.push('Isolate third-party native packages and onboard them through the mainline capability catalog one by one; start with `react-native-gesture-handler` if it is present, and treat unknown native surfaces as explicit unblockers rather than matrix drift.');
+            if (dependencies.some((dependency) => THIRD_PARTY_WAVE_A_PACKAGE_NAMES.has(dependency.name))) {
+                actions.push('Keep Third-party Native Wave A on `doctor --target-tier experimental`: pair async-storage and screens with their Harmony adapters, keep safe-area on the toolkit shim, and close device/release evidence before any promotion.');
+            }
+            else {
+                actions.push('Isolate third-party native packages and onboard them through the mainline capability catalog one by one; start with `react-native-gesture-handler` if it is present, and treat unknown native surfaces as explicit unblockers rather than matrix drift.');
+            }
             break;
     }
     if (hasRouterBlockingIssues) {

package/build/core/signing.d.ts

@@ -3,10 +3,13 @@ type SigningLocalAppFragment = {
     signingConfigs?: JsonRecord[];
     products?: JsonRecord[];
 };
+interface MergeSigningOptions {
+    includeSecrets?: boolean;
+}
 export declare function getSigningLocalPath(projectRoot: string): string;
 export declare function getSigningLocalExamplePath(projectRoot: string): string;
 export declare function readSigningLocalConfig(projectRoot: string): Promise<SigningLocalAppFragment | null>;
-export declare function mergeSigningLocalConfigIntoBuildProfile(rawBuildProfileContents: string, signingLocalConfig: SigningLocalAppFragment | null): string;
+export declare function mergeSigningLocalConfigIntoBuildProfile(rawBuildProfileContents: string, signingLocalConfig: SigningLocalAppFragment | null, options?: MergeSigningOptions): string;
 export declare function hasSigningConfiguration(rawBuildProfileContents: string | null, signingLocalConfig?: SigningLocalAppFragment | null): boolean;
 export declare function hasSigningLocalConfiguration(signingLocalConfig: SigningLocalAppFragment | null): boolean;
 export declare function renderSigningLocalExampleConfig(): string;

package/build/core/signing.js

@@ -28,12 +28,12 @@ async function readSigningLocalConfig(projectRoot) {
     const rawConfig = (await fs_extra_1.default.readJson(signingLocalPath));
     return normalizeSigningLocalConfig(rawConfig);
 }
-function mergeSigningLocalConfigIntoBuildProfile(rawBuildProfileContents, signingLocalConfig) {
+function mergeSigningLocalConfigIntoBuildProfile(rawBuildProfileContents, signingLocalConfig, options = {}) {
     if (!signingLocalConfig) {
         return rawBuildProfileContents;
     }
     const parsed = json5_1.default.parse(rawBuildProfileContents);
-    const merged = mergeSigningLocalConfig(parsed, signingLocalConfig);
+    const merged = mergeSigningLocalConfig(parsed, signingLocalConfig, options);
     return JSON.stringify(merged, null, 2) + '\n';
 }
 function hasSigningConfiguration(rawBuildProfileContents, signingLocalConfig = null) {
@@ -99,7 +99,7 @@ function normalizeSigningLocalConfig(rawConfig) {
         ...(products ? { products } : {}),
     };
 }
-function mergeSigningLocalConfig(buildProfile, signingLocalConfig) {
+function mergeSigningLocalConfig(buildProfile, signingLocalConfig, options) {
     const nextBuildProfile = {
         ...buildProfile,
         app: isJsonRecord(buildProfile.app)
@@ -109,7 +109,7 @@ function mergeSigningLocalConfig(buildProfile, signingLocalConfig) {
             : {},
     };
     if (Array.isArray(signingLocalConfig.signingConfigs)) {
-        nextBuildProfile.app.signingConfigs = signingLocalConfig.signingConfigs.map((entry) => ({ ...entry }));
+        nextBuildProfile.app.signingConfigs = signingLocalConfig.signingConfigs.map((entry) => cloneSigningConfigForBuildProfile(entry, options));
     }
     if (Array.isArray(signingLocalConfig.products)) {
         const currentProducts = Array.isArray(nextBuildProfile.app.products)
@@ -135,6 +135,21 @@ function mergeSigningLocalConfig(buildProfile, signingLocalConfig) {
     }
     return nextBuildProfile;
 }
+function cloneSigningConfigForBuildProfile(entry, options) {
+    const nextEntry = { ...entry };
+    if (options.includeSecrets) {
+        return nextEntry;
+    }
+    delete nextEntry.storePassword;
+    delete nextEntry.keyPassword;
+    if (isJsonRecord(nextEntry.material)) {
+        const material = { ...nextEntry.material };
+        delete material.storePassword;
+        delete material.keyPassword;
+        nextEntry.material = material;
+    }
+    return nextEntry;
+}
 function hasNonEmptySigningConfigList(signingConfigs) {
     return Array.isArray(signingConfigs) && signingConfigs.some(isJsonRecord);
 }

package/build/core/template/capabilityRegistry.js

@@ -8,6 +8,7 @@ const camera_1 = require("./renderers/camera");
 const fileSystem_1 = require("./renderers/fileSystem");
 const imagePicker_1 = require("./renderers/imagePicker");
 const location_1 = require("./renderers/location");
+const runtimeShims_1 = require("./runtimeShims");
 const CAPABILITY_SHIM_RENDERERS = {
     'expo-file-system': {
         adapter: fileSystem_1.renderExpoFileSystemHarmonyAdapterShim,
@@ -45,6 +46,10 @@ const CAPABILITY_SHIM_RENDERERS = {
         adapter: appFoundation_1.renderExpoHapticsPreviewShim,
         preview: appFoundation_1.renderExpoHapticsPreviewShim,
     },
+    'react-native-safe-area-context': {
+        adapter: runtimeShims_1.renderReactNativeSafeAreaContextHarmonyShim,
+        preview: runtimeShims_1.renderReactNativeSafeAreaContextHarmonyShim,
+    },
 };
 exports.MANAGED_EXPO_HARMONY_MODULE_RENDERERS = [
     {

package/build/core/template/metro.js

@@ -3,8 +3,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderMetroConfig = renderMetroConfig;
 function renderMetroConfig(enabledCapabilities) {
     const previewCapabilityAliases = enabledCapabilities
-        .filter((capability) => capability.supportTier === 'preview' ||
-        capability.supportTier === 'experimental')
+        .filter((capability) => capability.packageName !== 'react-native-safe-area-context' &&
+        (capability.packageName.startsWith('expo-') || capability.runtimeMode === 'shim') &&
+        (capability.supportTier === 'preview' ||
+            capability.supportTier === 'experimental'))
         .map((capability) => `  '${capability.packageName}': path.resolve(__dirname, '.expo-harmony/shims/${capability.packageName}'),`)
         .join('\n');
     return `const fs = require('fs');

package/build/data/capabilities.js

@@ -42,6 +42,18 @@ const APP_FOUNDATION_BASELINE_EVIDENCE_SOURCE = {
     device: 'none',
     release: 'none',
 };
+const THIRD_PARTY_WAVE_A_BASELINE_EVIDENCE = {
+    bundle: true,
+    debugBuild: true,
+    device: false,
+    release: false,
+};
+const THIRD_PARTY_WAVE_A_BASELINE_EVIDENCE_SOURCE = {
+    bundle: 'automated',
+    debugBuild: 'automated',
+    device: 'none',
+    release: 'none',
+};
 exports.CAPABILITY_DEFINITIONS = [
     {
         id: 'expo-file-system',
@@ -261,6 +273,63 @@ exports.CAPABILITY_DEFINITIONS = [
             'Record debug HAP evidence before any promotion decision; device and release remain separate gates.',
         ],
     },
+    {
+        id: 'async-storage',
+        packageName: '@react-native-async-storage/async-storage',
+        status: 'manual',
+        supportTier: 'experimental',
+        runtimeMode: 'adapter',
+        evidence: THIRD_PARTY_WAVE_A_BASELINE_EVIDENCE,
+        evidenceSource: THIRD_PARTY_WAVE_A_BASELINE_EVIDENCE_SOURCE,
+        note: 'v1.9.2 Wave A tracks Async Storage through its Harmony adapter, but persistence behavior remains experimental until device and release evidence are closed.',
+        docsUrl: 'https://github.com/react-native-oh-library/usage-docs',
+        nativePackageNames: ['@react-native-oh-tpl/async-storage'],
+        harmonyPermissions: [],
+        sampleRoute: '/third-party-wave-a/async-storage',
+        acceptanceChecklist: [
+            'Install the canonical package with the matching Harmony adapter.',
+            'Bundle a minimal Async Storage read/write/remove surface.',
+            'Keep real persistence, migration, and release HAP runtime behavior pending device evidence.',
+        ],
+    },
+    {
+        id: 'react-native-screens',
+        packageName: 'react-native-screens',
+        status: 'manual',
+        supportTier: 'experimental',
+        runtimeMode: 'adapter',
+        evidence: THIRD_PARTY_WAVE_A_BASELINE_EVIDENCE,
+        evidenceSource: THIRD_PARTY_WAVE_A_BASELINE_EVIDENCE_SOURCE,
+        note: 'v1.9.2 Wave A tracks Screens through its Harmony adapter metadata, while managed autolinking and navigation-stack runtime behavior remain promotion gaps.',
+        docsUrl: 'https://github.com/react-native-oh-library',
+        nativePackageNames: ['@react-native-oh-tpl/react-native-screens'],
+        harmonyPermissions: [],
+        sampleRoute: '/third-party-wave-a/screens',
+        acceptanceChecklist: [
+            'Install the canonical package with the matching Harmony adapter.',
+            'Bundle a minimal navigation stack that imports react-native-screens.',
+            'Do not claim verified support until adapter autolinking, device, and release evidence are recorded.',
+        ],
+    },
+    {
+        id: 'react-native-safe-area-context',
+        packageName: 'react-native-safe-area-context',
+        status: 'manual',
+        supportTier: 'experimental',
+        runtimeMode: 'shim',
+        evidence: THIRD_PARTY_WAVE_A_BASELINE_EVIDENCE,
+        evidenceSource: THIRD_PARTY_WAVE_A_BASELINE_EVIDENCE_SOURCE,
+        note: 'v1.9.2 Wave A formalizes the existing toolkit safe-area shim so app-shell layouts keep bundling while native safe-area measurements stay outside verified.',
+        docsUrl: 'https://github.com/react-native-oh-library',
+        nativePackageNames: [],
+        harmonyPermissions: [],
+        sampleRoute: '/third-party-wave-a/safe-area',
+        acceptanceChecklist: [
+            'Render SafeAreaProvider, SafeAreaView, and safe-area hooks through the toolkit shim.',
+            'Keep the Metro alias on .expo-harmony/shims/react-native-safe-area-context.',
+            'Validate real native inset measurement separately before any adapter promotion.',
+        ],
+    },
 ];
 exports.CAPABILITY_BY_PACKAGE = Object.fromEntries(exports.CAPABILITY_DEFINITIONS.map((definition) => [definition.packageName, definition]));
 const SUPPORT_TIER_ORDER = {

package/build/data/dependencyCatalog.js

@@ -138,19 +138,19 @@ exports.DEPENDENCY_CATALOG = {
     '@react-native-async-storage/async-storage': {
         status: 'manual',
         supportTier: 'experimental',
-        note: 'Async storage is a high-frequency startup dependency. Treat it as an experimental Harmony intake dependency until the managed adapter path has stable doctor, sample, and build coverage.',
+        note: 'v1.9.2 Wave A tracks Async Storage through its Harmony adapter, but persistence behavior still needs device and release evidence before verified promotion.',
         docsUrl: 'https://github.com/react-native-oh-library',
     },
     'react-native-safe-area-context': {
-        status: 'supported',
+        status: 'manual',
         supportTier: 'experimental',
-        note: 'Safe-area handling is shimmed by the toolkit for Harmony so App Shell layouts can keep rendering while the native path remains outside the verified matrix.',
+        note: 'v1.9.2 Wave A formalizes the toolkit-managed safe-area shim while real native inset measurement remains outside the verified matrix.',
         docsUrl: 'https://github.com/react-native-oh-library',
     },
     'react-native-screens': {
         status: 'manual',
         supportTier: 'experimental',
-        note: 'Navigation stacks frequently depend on react-native-screens. Keep it on the experimental lane until the Harmony adapter path has repeatable sample and device coverage.',
+        note: 'v1.9.2 Wave A tracks Screens through its Harmony adapter metadata; navigation-stack runtime behavior still needs device and release evidence.',
         docsUrl: 'https://github.com/react-native-oh-library',
     },
     'react-native-webview': {

package/build/data/publicDocs.d.ts

@@ -8,4 +8,4 @@ export declare const SUPPORTING_SAMPLE_PATHS: readonly ["examples/official-app-s
 export declare const VERIFIED_JS_UI_CAPABILITY_NAMES: readonly ["expo-router", "expo-linking", "expo-constants", ...("react-native-reanimated" | "react-native-svg")[]];
 export declare const PREVIEW_CAPABILITY_DEFINITIONS: import("..").CapabilityDefinition[];
 export declare const EXPERIMENTAL_CAPABILITY_NAMES: readonly string[];
-export declare const PUBLIC_CURRENT_VERSION = "1.9.0";
+export declare const PUBLIC_CURRENT_VERSION = "1.9.2";

package/docs/cli-build.md

@@ -1,6 +1,6 @@
 # CLI 构建指南
 
-`v1.9.0` 延续 `verified + preview + experimental` 支持分层，把 bare workflow 放进 intake baseline，并把五个 app foundation modules 纳入 preview shim baseline；`expo55-rnoh082-ui-stack` 仍是唯一 verified 矩阵。
+`v1.9.2` 延续 `verified + preview + experimental` 支持分层，把 Third-party Native Wave A 纳入 formal experimental onboarding；`expo55-rnoh082-ui-stack` 仍是唯一 verified 矩阵。
 
 CLI 命令集合不变：
 
@@ -48,6 +48,9 @@ expo-harmony build-hap --mode debug
 当前 experimental formal slice：
 
 - `react-native-gesture-handler`
+- `@react-native-async-storage/async-storage`
+- `react-native-screens`
+- `react-native-safe-area-context`
 
 ## UI stack 依赖安装注意事项
 
@@ -90,7 +93,7 @@ pnpm install --ignore-scripts
 
 额外说明：
 
-- `react-native-gesture-handler` 已进入 formal experimental slice，但仍不属于 verified 公开承诺
+- `react-native-gesture-handler` 与 Wave A 第三方 native packages 已进入 formal experimental onboarding，但仍不属于 verified 公开承诺
 - bare workflow 当前只有 intake / debug baseline，不代表 release-ready
 - `doctor --strict` 仍只代表完整验收的 verified 能力
 
@@ -105,6 +108,27 @@ expo-harmony env --strict
 expo-harmony build-hap --mode debug
 ```
 
+### HAR normalize opt-out
+
+默认情况下，`build-hap` 会把 root / entry `oh-package.json5` 里的 `file:*.har` 本地依赖解压到 `harmony/expo-harmony-local-deps`，再让 `ohpm` 消费解压后的目录。这条路径仍是默认 verified build path。
+
+如果项目已经确认当前 DevEco / ohpm 能直接消费纯 HAR，可以显式跳过这一步：
+
+```bash
+EXPO_HARMONY_SKIP_HAR_NORMALIZE=1 expo-harmony build-hap --mode debug
+expo-harmony build-hap --mode debug --no-har-normalize
+```
+
+开启后：
+
+- `file:../node_modules/.../*.har` specifier 会保持原样
+- 不生成 `expo-harmony-local-deps`
+- 不临时注册 normalized local HAR modules 到 `build-profile.json5`
+- 不执行依赖 normalized local RNOH 目录的 codegen / path 兜底
+- `ohpm install --all` 与 `hvigor assembleHap` 继续执行
+
+该开关是 escape hatch，不代表 opt-out 路径和默认路径具备完全相同的兼容兜底。
+
 ### Release
 
 ```bash

package/docs/official-minimal-sample.md

@@ -45,7 +45,7 @@ pnpm run harmony:build:release
 
 - `.expo-harmony/signing.local.example.json` 是可直接复制的本地 signing 範本
 - `.expo-harmony/signing.local.json` 是本地 signing 入口
-- toolkit 会把本地 signing 合并进 `harmony/build-profile.json5`
+- toolkit 只会把非密钥 signing 引用写进 `harmony/build-profile.json5`；`storePassword` 与 `keyPassword` 会留在本地 signing 文件，并在 release build 期间临时注入
 - 如果 signing 没配置，`harmony:env` 会明确报缺失；这属于预期阻断
 
 ## 不覆盖的内容

package/docs/official-native-capabilities-sample.md

@@ -182,7 +182,7 @@ pnpm run harmony:build:release
 
 - `.expo-harmony/signing.local.example.json` 是可直接复制的本地 signing 範本
 - `.expo-harmony/signing.local.json` 是本地 signing 入口
-- toolkit 会把本地 signing 合并进 `harmony/build-profile.json5`
+- toolkit 只会把非密钥 signing 引用写进 `harmony/build-profile.json5`；`storePassword` 与 `keyPassword` 会留在本地 signing 文件，并在 release build 期间临时注入
 - 即使 release 构建可走通，在没有真机前，这四项能力也仍保持 `preview`
 
 ## 当前结论

package/docs/roadmap.md

@@ -66,7 +66,7 @@
 
 ## 当前主线
 
-`v1.8.x` 已完成 repo 内可收口项，当前主线切到 `v1.9.x`。`v1.9.0` 先落 bare workflow baseline、app foundation modules 与 `react-native-gesture-handler` formal slice；剩余需要真机或 release HAP 的证据继续保留在 v1.8.x capability board，不阻塞 v1.9.x 的 bare / foundation / third-party onboarding 工作。
+`v1.8.x` 已完成 repo 内可收口项，当前主线切到 `v1.9.x`。`v1.9.0` 先落 bare workflow baseline、app foundation modules 与 `react-native-gesture-handler` formal slice；`v1.9.1` 作为 build-hap patch release，补上 HAR normalize opt-out；`v1.9.2` 推进 Third-party Native Wave A，把 async-storage、screens 与 safe-area 拉进 formal experimental onboarding。剩余需要真机或 release HAP 的证据继续保留在 v1.8.x capability board，不阻塞 v1.9.x 的 bare / foundation / third-party onboarding 工作。
 
 ### v1.8.0 Intake Hardening + Parallel Promotion
 
@@ -153,10 +153,33 @@
   - acceptance 记录
 - 本阶段不改变 `verified` 边界；foundation modules 以 `preview` + `runtimeMode=shim` 记录，`react-native-gesture-handler` 以 `experimental` + formal adapter slice 记录
 
-### v1.9.1 Third-party Native Wave A
+### v1.9.1 Build HAP HAR Normalize Opt-out
+
+目标日期：`2026-06-02`
+
+目标：把 issue #1 中的本地 HAR 解压 opt-out 做成正式 patch release，同时不改变默认 verified build path。
+
+- `build-hap` 新增显式 opt-out：
+  - `EXPO_HARMONY_SKIP_HAR_NORMALIZE=1`
+  - `expo-harmony build-hap --no-har-normalize`
+- 默认继续执行现有 `normalizeLocalHarDependencies` 路径：
+  - 解压 `file:*.har` 到 `expo-harmony-local-deps`
+  - 临时改写 root / entry `oh-package.json5`
+  - 注册 normalized local HAR modules
+  - 执行依赖 normalized local package 的 RNOH codegen / path 兜底
+- opt-out 开启后：
+  - 保留 `file:../node_modules/.../*.har`
+  - 让 `ohpm install --all` 直接消费纯 HAR
+  - 在 build report / CLI 文档里明确提示跳过的自动兜底
+- 本阶段只改变 build-hap escape hatch，不扩大 `verified` 能力边界
+- `v1.9.0` 已经存在于 npm `next`，本阶段发布为 `v1.9.1` 并进入 `latest`
+
+### v1.9.2 Third-party Native Wave A
 
 目标日期：`2026-09-30`
 
+状态：implementation baseline complete；device / release evidence carryover。
+
 目标：优先清掉最容易挡住“任何 Expo 项目”的高频第三方 native blocker。
 
 - 第一批高频第三方 native blocker 进入正式 onboarding：
@@ -171,8 +194,13 @@
   - sample / fixture
   - debug + release evidence
 - 任何进入 Wave A 的 blocker，都不允许继续停留在“矩阵外模糊探索”
+- 本阶段发布为 `v1.9.2` 并进入 `latest`，但不改变 `verified` 边界：
+  - `@react-native-async-storage/async-storage` 以 `experimental` + `runtimeMode=adapter` 记录
+  - `react-native-screens` 以 `experimental` + `runtimeMode=adapter` 记录
+  - `react-native-safe-area-context` 以 `experimental` + `runtimeMode=shim` 记录
+  - `doctor --strict` 与 `doctor --target-tier preview` 仍阻断 Wave A
 
-### v1.9.2 Third-party Native Wave B + Regression Farm
+### v1.9.3 Third-party Native Wave B + Regression Farm
 
 目标日期：`2026-10-31`
 

package/docs/signing-and-release.md

@@ -8,7 +8,7 @@
 
 - DevEco Studio / Harmony SDK 已正确安装
 - 项目已生成 `harmony/`
-- `harmony/build-profile.json5` 中存在可用的 `signingConfigs`
+- `.expo-harmony/signing.local.json` 中存在可用的 `signingConfigs`
 - AppGallery Connect / 本地签名材料与工程配置一致
 
 `.expo-harmony/signing.local.json` 的最小结构与 `.expo-harmony/signing.local.example.json` 一致：
@@ -59,6 +59,8 @@ expo-harmony env
 - `release` 构建不应视为 ready
 - 可以直接从 `.expo-harmony/signing.local.example.json` 复制出 `.expo-harmony/signing.local.json` 再填入真实材料
 
+`expo-harmony init` / `sync-template` 只会把非密钥 signing 引用写入可版本化的 `harmony/build-profile.json5`。`storePassword` 与 `keyPassword` 只应保留在 `.expo-harmony/signing.local.json`；`build-hap --mode release` 会在本地构建期间临时注入这些 secret，并在 Hvigor 结束后恢复 `build-profile.json5`。
+
 ## 推荐流程
 
 ### Debug 验证

package/docs/support-matrix.md

@@ -14,7 +14,7 @@
 - bare workflow 与第三方 native package 不再被描述成“收官后才考虑的另一条 extension 终局”
 - `v2.0.0` 本身被定义成“任何 Expo 项目都能可靠打包成鸿蒙 App”的目标版本
 - 但当前公开承诺依旧没有放宽；它们只是进入同一主线 backlog，而不是已经进入 `verified`
-- `v1.9.0` 新增的是 bare intake baseline、app foundation preview shim baseline 与 `react-native-gesture-handler` formal experimental slice，不是 verified 扩容
+- `v1.9.2` 新增的是 Third-party Native Wave A formal experimental onboarding，不是 verified 扩容
 
 `doctor --strict` 继续只代表 `verified`。
 
@@ -138,6 +138,9 @@
 | --- | --- | --- | --- | --- |
 | `expo-notifications` | `experimental` | `shim` | `bundle=no, debugBuild=no, device=no, release=no` | 服务链路与交付故事未打通 |
 | `react-native-gesture-handler` | `experimental` | `adapter` | `bundle=yes[automated], debugBuild=yes[automated], device=no[none], release=no[none]` | v1.9.0 formal acceptance slice；必须与 `@react-native-oh-tpl/react-native-gesture-handler` 成对接入，仍不在公开 verified 矩阵内 |
+| `@react-native-async-storage/async-storage` | `experimental` | `adapter` | `bundle=yes[automated], debugBuild=yes[automated], device=no[none], release=no[none]` | v1.9.2 Wave A formal onboarding；必须与 `@react-native-oh-tpl/async-storage` 成对接入，持久化行为仍需 device / release evidence |
+| `react-native-screens` | `experimental` | `adapter` | `bundle=yes[automated], debugBuild=yes[automated], device=no[none], release=no[none]` | v1.9.2 Wave A formal onboarding；必须与 `@react-native-oh-tpl/react-native-screens` 成对接入，navigation-stack runtime 仍需 evidence |
+| `react-native-safe-area-context` | `experimental` | `shim` | `bundle=yes[automated], debugBuild=yes[automated], device=no[none], release=no[none]` | v1.9.2 Wave A formal onboarding；当前仍走 toolkit-managed safe-area shim，不切换到 native adapter |
 
 ## UI Stack 配对规则
 
@@ -269,6 +272,7 @@ toolkit 受管的核心产物仍包括：
 
 - bare Expo；当前只进入 intake / debug baseline
 - `expo-secure-store`、`expo-asset`、`expo-device`、`expo-clipboard`、`expo-haptics` 当前仍只是 preview shim baseline
+- `@react-native-async-storage/async-storage`、`react-native-screens`、`react-native-safe-area-context` 当前仍只是 Wave A experimental onboarding
 - 多 Expo / RNOH 并行 verified 矩阵
 - 任意第三方 native package 的即时正式承诺
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-harmony-toolkit",
-  "version": "1.9.0",
+  "version": "1.9.2",
   "description": "面向 Managed/CNG Expo 项目的 HarmonyOS 迁移、准入检查与 UI-stack 构建工具链",
   "main": "app.plugin.js",
   "types": "build/index.d.ts",