expo-harmony-toolkit 1.9.1 → 1.9.3

package/README.en.md

@@ -9,7 +9,7 @@
   <p>
     <a href="https://github.com/BlackishGreen33/Expo-Harmony-Toolkit/actions/workflows/ci.yml"><img alt="Checks" src="https://img.shields.io/badge/checks-passing-16a34a?style=flat-square&logo=githubactions&logoColor=white"></a>
     <a href="./LICENSE"><img alt="License" src="https://img.shields.io/badge/license-MIT-0f766e?style=flat-square"></a>
-    <a href="https://github.com/BlackishGreen33/Expo-Harmony-Toolkit/releases"><img alt="Version" src="https://img.shields.io/badge/version-v1.9.1-111827?style=flat-square"></a>
+    <a href="https://github.com/BlackishGreen33/Expo-Harmony-Toolkit/releases"><img alt="Version" src="https://img.shields.io/badge/version-v1.9.3-111827?style=flat-square"></a>
     <a href="./docs/support-matrix.md"><img alt="Matrix" src="https://img.shields.io/badge/matrix-expo55--rnoh082--ui--stack-2563eb?style=flat-square"></a>
     <img alt="Input" src="https://img.shields.io/badge/input-Managed%2FCNG%20%2B%20bare%20intake-059669?style=flat-square">
   </p>
@@ -24,7 +24,7 @@
 </div>
 
 > [!IMPORTANT]
-> `v1.9.1` keeps the `v1.9.0` bare workflow intake, app foundation modules, and `react-native-gesture-handler` formal slice, and adds a local HAR normalize opt-out for `build-hap`. The public promise remains tighter: `latest` only carries fully accepted `verified` capabilities, while `next` is reserved for preview fast-track work. The expanded goal still does not widen the current `verified` boundary yet.
+> `v1.9.3` keeps the `v1.9.2` Wave A baseline and brings ccnubox-first `react-native-webview`, JPush runtime, `expo-media-library`, `lottie-react-native`, and `@shopify/react-native-skia` into Third-party Native Wave B formal experimental onboarding. The public promise remains tighter: `latest` only carries fully accepted `verified` capabilities, and Wave B does not widen the current `verified` boundary.
 
 > [!TIP]
 > The two validated `@react-native-oh-tpl/*` adapters in the public matrix are currently consumed via exact Git URLs and commits. For repository development and the official UI-stack sample, prefer `pnpm install --ignore-scripts` so adapter prepare hooks do not fail on private upstream resources.
@@ -48,13 +48,13 @@
 <!-- GENERATED:readme-current-status:start -->
 | Item | Status |
 | --- | --- |
-| Current version | `v1.9.1` |
+| Current version | `v1.9.3` |
 | Support model | `verified + preview + experimental` |
 | Public `verified` matrix | `expo55-rnoh082-ui-stack` |
 | Supported input | Managed/CNG Expo projects; bare workflow intake baseline |
 | `verified` JS/UI capabilities | `expo-router`, `expo-linking`, `expo-constants`, `react-native-reanimated`, `react-native-svg` |
 | `preview` native capabilities | `expo-file-system`, `expo-image-picker`, `expo-location`, `expo-camera`, `expo-secure-store`, `expo-asset`, `expo-device`, `expo-clipboard`, `expo-haptics` |
-| `experimental` capabilities | `expo-notifications`, `react-native-gesture-handler` |
+| `experimental` capabilities | `expo-notifications`, `react-native-gesture-handler`, `@react-native-async-storage/async-storage`, `react-native-screens`, `react-native-safe-area-context`, `react-native-webview`, `jpush-react-native`, `expo-media-library`, `lottie-react-native`, `@shopify/react-native-skia` |
 | Release tracks | `latest` = fully accepted `verified` only; `next` = preview fast track |
 | Capability telemetry | `runtimeMode` + `evidence(...)` + `evidenceSource(...)` + `coverageProfile` + `nextActions` |
 | Build path | `doctor -> init -> bundle -> build-hap` |
@@ -71,6 +71,8 @@
 - `expo-secure-store`, `expo-asset`, `expo-device`, `expo-clipboard`, and `expo-haptics` remain the `preview` shim baseline
 - `expo-notifications`
 - `react-native-gesture-handler` remains a formal experimental slice
+- `@react-native-async-storage/async-storage`, `react-native-screens`, and `react-native-safe-area-context` remain Wave A experimental onboarding
+- `react-native-webview`, JPush runtime, `expo-media-library`, `lottie-react-native`, and `@shopify/react-native-skia` remain Wave B experimental onboarding
 - multiple public matrices
 
 </details>
@@ -176,7 +178,7 @@ Common decision points:
 <!-- GENERATED:readme-support-matrix:start -->
 - `verified`: the only public matrix remains `expo55-rnoh082-ui-stack`
 - `preview`: `expo-file-system`, `expo-image-picker`, `expo-location`, `expo-camera`, `expo-secure-store`, `expo-asset`, `expo-device`, `expo-clipboard`, `expo-haptics`
-- `experimental`: `expo-notifications`, `react-native-gesture-handler`
+- `experimental`: `expo-notifications`, `react-native-gesture-handler`, `@react-native-async-storage/async-storage`, `react-native-screens`, `react-native-safe-area-context`, `react-native-webview`, `jpush-react-native`, `expo-media-library`, `lottie-react-native`, `@shopify/react-native-skia`
 
 `doctor --strict` still means `verified` only. `doctor --target-tier preview` allows the same runtime matrix plus preview-tier capabilities, but that does not promote them into the formal public promise.
 

package/README.md

@@ -9,7 +9,7 @@
   <p>
     <a href="https://github.com/BlackishGreen33/Expo-Harmony-Toolkit/actions/workflows/ci.yml"><img alt="Checks" src="https://img.shields.io/badge/checks-passing-16a34a?style=flat-square&logo=githubactions&logoColor=white"></a>
     <a href="./LICENSE"><img alt="License" src="https://img.shields.io/badge/license-MIT-0f766e?style=flat-square"></a>
-    <a href="https://github.com/BlackishGreen33/Expo-Harmony-Toolkit/releases"><img alt="Version" src="https://img.shields.io/badge/version-v1.9.1-111827?style=flat-square"></a>
+    <a href="https://github.com/BlackishGreen33/Expo-Harmony-Toolkit/releases"><img alt="Version" src="https://img.shields.io/badge/version-v1.9.3-111827?style=flat-square"></a>
     <a href="./docs/support-matrix.md"><img alt="Matrix" src="https://img.shields.io/badge/matrix-expo55--rnoh082--ui--stack-2563eb?style=flat-square"></a>
     <img alt="Input" src="https://img.shields.io/badge/input-Managed%2FCNG%20%2B%20bare%20intake-059669?style=flat-square">
   </p>
@@ -24,7 +24,7 @@
 </div>
 
 > [!IMPORTANT]
-> `v1.9.1` 延续 `v1.9.0` 的 bare workflow intake、app foundation modules 与 `react-native-gesture-handler` formal slice，并为 `build-hap` 增加本地 HAR normalize opt-out。当前公开承诺仍然收紧为：`latest` 只承诺完整验收的 `verified` 能力，`next` 用于 preview fast track。目标扩大不等于当前 `verified` 边界已经放宽。
+> `v1.9.3` 延续 `v1.9.2` 的 Wave A 基线，并把 ccnubox 优先的 `react-native-webview`、JPush runtime、`expo-media-library`、`lottie-react-native` 与 `@shopify/react-native-skia` 纳入 Third-party Native Wave B formal experimental onboarding。当前公开承诺仍然收紧为：`latest` 只承诺完整验收的 `verified` 能力，Wave B 不放宽当前 `verified` 边界。
 
 > [!TIP]
 > 由于当前公开矩阵内的两套 `@react-native-oh-tpl/*` adapter 依赖以 Git URL + exact commit 形式接入，仓库开发和官方 UI-stack sample 推荐使用 `pnpm install --ignore-scripts`，避免 Git adapter 在 prepare 阶段拉取私有资源而中断安装。
@@ -48,13 +48,13 @@
 <!-- GENERATED:readme-current-status:start -->
 | 项目 | 说明 |
 | --- | --- |
-| 当前版本 | `v1.9.1` |
+| 当前版本 | `v1.9.3` |
 | 支持模型 | `verified + preview + experimental` |
 | 唯一 `verified` 公开矩阵 | `expo55-rnoh082-ui-stack` |
 | 输入范围 | Managed/CNG Expo 项目；bare workflow intake baseline |
 | `verified` JS/UI 能力 | `expo-router`、`expo-linking`、`expo-constants`、`react-native-reanimated`、`react-native-svg` |
 | `preview` 原生能力 | `expo-file-system`、`expo-image-picker`、`expo-location`、`expo-camera`、`expo-secure-store`、`expo-asset`、`expo-device`、`expo-clipboard`、`expo-haptics` |
-| `experimental` 能力 | `expo-notifications`、`react-native-gesture-handler` |
+| `experimental` 能力 | `expo-notifications`、`react-native-gesture-handler`、`@react-native-async-storage/async-storage`、`react-native-screens`、`react-native-safe-area-context`、`react-native-webview`、`jpush-react-native`、`expo-media-library`、`lottie-react-native`、`@shopify/react-native-skia` |
 | 发布轨 | `latest` = fully accepted verified only；`next` = preview fast track |
 | capability 遥测 | `runtimeMode` + `evidence(...)` + `evidenceSource(...)` + `coverageProfile` + `nextActions` |
 | 构建链 | `doctor -> init -> bundle -> build-hap` |
@@ -71,6 +71,8 @@
 - `expo-secure-store`、`expo-asset`、`expo-device`、`expo-clipboard`、`expo-haptics` 仍只属于 `preview` shim baseline
 - `expo-notifications`
 - `react-native-gesture-handler` 仍只属于 formal experimental slice
+- `@react-native-async-storage/async-storage`、`react-native-screens`、`react-native-safe-area-context` 仍只属于 Wave A experimental onboarding
+- `react-native-webview`、JPush runtime、`expo-media-library`、`lottie-react-native`、`@shopify/react-native-skia` 仍只属于 Wave B experimental onboarding
 - 多矩阵并行支持
 
 </details>
@@ -176,7 +178,7 @@ pnpm exec expo-harmony build-hap --mode release
 <!-- GENERATED:readme-support-matrix:start -->
 - `verified`：唯一公开矩阵仍是 `expo55-rnoh082-ui-stack`
 - `preview`：`expo-file-system`, `expo-image-picker`, `expo-location`, `expo-camera`, `expo-secure-store`, `expo-asset`, `expo-device`, `expo-clipboard`, `expo-haptics`
-- `experimental`：`expo-notifications`, `react-native-gesture-handler`
+- `experimental`：`expo-notifications`, `react-native-gesture-handler`, `@react-native-async-storage/async-storage`, `react-native-screens`, `react-native-safe-area-context`, `react-native-webview`, `jpush-react-native`, `expo-media-library`, `lottie-react-native`, `@shopify/react-native-skia`
 
 `doctor --strict` 继续只代表 `verified`。`doctor --target-tier preview` 会在同一 runtime matrix 下额外放行 preview 能力，但这不等于它们已经进入正式承诺。
 

package/build/core/build/localHar.js

@@ -83,9 +83,10 @@ async function extractHarArchiveToDirectory(archivePath, extractionRoot, package
     if (!(await fs_extra_1.default.pathExists(archivePath))) {
         throw new Error(`Local Harmony archive not found: ${archivePath}`);
     }
-    const destinationPath = path_1.default.join(extractionRoot, `${sanitizePackageName(packageName)}-${path_1.default.basename(archivePath, path_1.default.extname(archivePath))}`);
+    const destinationPath = path_1.default.join(extractionRoot, `${sanitizePackageName(packageName)}-${sanitizePathComponent(path_1.default.basename(archivePath, path_1.default.extname(archivePath)))}`);
     const stagingRoot = await fs_extra_1.default.mkdtemp(path_1.default.join(os_1.default.tmpdir(), 'expo-harmony-har-'));
     try {
+        await validateHarArchiveMemberNames(archivePath);
         await execFileAsync('tar', ['-xzf', archivePath, '-C', stagingRoot], {
             maxBuffer: 20 * 1024 * 1024,
         });
@@ -93,6 +94,7 @@ async function extractHarArchiveToDirectory(archivePath, extractionRoot, package
         const sourceRoot = (await fs_extra_1.default.pathExists(path_1.default.join(packagedRoot, 'oh-package.json5')))
             ? packagedRoot
             : stagingRoot;
+        await validateExtractedHarTree(sourceRoot, stagingRoot);
         if (!(await fs_extra_1.default.pathExists(path_1.default.join(sourceRoot, 'oh-package.json5')))) {
             throw new Error(`oh-package.json5 not found after extracting ${archivePath}`);
         }
@@ -115,7 +117,61 @@ async function extractHarArchiveToDirectory(archivePath, extractionRoot, package
     }
 }
 function sanitizePackageName(packageName) {
-    return packageName.replace(/[^a-zA-Z0-9._-]+/g, '-').replace(/^-+|-+$/g, '');
+    return sanitizePathComponent(packageName);
+}
+function sanitizePathComponent(value) {
+    return value.replace(/[^a-zA-Z0-9._-]+/g, '-').replace(/^-+|-+$/g, '') || 'archive';
+}
+async function validateHarArchiveMemberNames(archivePath) {
+    const { stdout } = await execFileAsync('tar', ['-tzf', archivePath], {
+        maxBuffer: 20 * 1024 * 1024,
+    });
+    for (const rawMemberName of stdout.split('\n')) {
+        const memberName = rawMemberName.trim();
+        if (!memberName) {
+            continue;
+        }
+        const segments = memberName.split('/').filter(Boolean);
+        if (path_1.default.isAbsolute(memberName) ||
+            memberName.includes('\\') ||
+            segments.some((segment) => segment === '..')) {
+            throw new Error(`Unsafe path in local Harmony archive: ${memberName}`);
+        }
+    }
+}
+async function validateExtractedHarTree(rootPath, stagingRoot) {
+    const stagingRealPath = await fs_extra_1.default.realpath(stagingRoot);
+    const rootRealPath = await fs_extra_1.default.realpath(rootPath);
+    if (!isPathInside(rootRealPath, stagingRealPath)) {
+        throw new Error(`Extracted local Harmony archive root escaped the staging directory: ${rootPath}`);
+    }
+    await walkExtractedHarTree(rootPath, rootRealPath);
+}
+async function walkExtractedHarTree(currentPath, rootRealPath) {
+    const currentStats = await fs_extra_1.default.lstat(currentPath);
+    if (currentStats.isSymbolicLink()) {
+        throw new Error(`Symbolic links are not allowed in local Harmony archives: ${currentPath}`);
+    }
+    if (currentStats.isFile() && currentStats.nlink > 1) {
+        throw new Error(`Hard links are not allowed in local Harmony archives: ${currentPath}`);
+    }
+    if (!currentStats.isDirectory() && !currentStats.isFile()) {
+        throw new Error(`Unsupported file type in local Harmony archive: ${currentPath}`);
+    }
+    const currentRealPath = await fs_extra_1.default.realpath(currentPath);
+    if (!isPathInside(currentRealPath, rootRealPath)) {
+        throw new Error(`Extracted local Harmony archive entry escaped the package directory: ${currentPath}`);
+    }
+    if (!currentStats.isDirectory()) {
+        return;
+    }
+    for (const entryName of await fs_extra_1.default.readdir(currentPath)) {
+        await walkExtractedHarTree(path_1.default.join(currentPath, entryName), rootRealPath);
+    }
+}
+function isPathInside(candidatePath, parentPath) {
+    const relativePath = path_1.default.relative(parentPath, candidatePath);
+    return relativePath === '' || (!relativePath.startsWith('..') && !path_1.default.isAbsolute(relativePath));
 }
 async function readNormalizedLocalHarPackageMetadata(directoryPath, packageName) {
     await ensureNormalizedLocalHarModuleJson5(directoryPath);
@@ -245,6 +301,10 @@ async function ensureHarmonyBuildProfileSupportsNormalizedLocalDeps(harmonyProje
                 moduleEntry?.name === localHarPackage.moduleName);
         });
         if (existingModule) {
+            if (existingModule.name !== localHarPackage.moduleName) {
+                existingModule.name = localHarPackage.moduleName;
+                didChange = true;
+            }
             if (existingModule.srcPath !== relativeDirectory) {
                 existingModule.srcPath = relativeDirectory;
                 didChange = true;
@@ -331,7 +391,7 @@ async function alignRnohCodegenWithNormalizedLocalPackage(harmonyProjectRoot, lo
     if (!relativeRnohModulePath.startsWith('.')) {
         relativeRnohModulePath = `./${relativeRnohModulePath}`;
     }
-    const updatedHvigorFile = originalHvigorFile.replace(/rnohModulePath:\s*['"][^'"]+['"]/, `rnohModulePath: '${relativeRnohModulePath}'`);
+    const updatedHvigorFile = originalHvigorFile.replace(/rnohModulePath:\s*['"][^'"]+['"]/, `rnohModulePath: ${JSON.stringify(relativeRnohModulePath)}`);
     if (updatedHvigorFile !== originalHvigorFile) {
         await fs_extra_1.default.writeFile(hvigorFilePath, updatedHvigorFile);
     }

package/build/core/build.js

@@ -18,6 +18,7 @@ const localHar_1 = require("./build/localHar");
 const commands_1 = require("./build/commands");
 const reporting_1 = require("./build/reporting");
 const rnohCompatibility_1 = require("./build/rnohCompatibility");
+const signing_1 = require("./signing");
 var reporting_2 = require("./build/reporting");
 Object.defineProperty(exports, "renderBuildReport", { enumerable: true, get: function () { return reporting_2.renderBuildReport; } });
 exports.SKIP_HAR_NORMALIZE_WARNING = 'Local HAR normalization is disabled; ohpm will consume file:*.har dependencies directly and normalized build-profile/RNOH compatibility steps will be skipped.';
@@ -291,6 +292,7 @@ async function buildHapProject(projectRoot, options) {
     let restoreNormalizedRnohCliAutolinkingTemplates = async () => { };
     let restoreNormalizedRnohCodegenAlignment = async () => { };
     let restoreNormalizedHarmonyPackageJsons = async () => { };
+    let restoreLocalSigningBuildProfile = async () => { };
     if (!skipHarNormalize) {
         try {
             const normalizedLocalHarDependencies = await (0, localHar_1.normalizeLocalHarDependencies)(harmonyProjectRoot);
@@ -363,6 +365,7 @@ async function buildHapProject(projectRoot, options) {
             await (0, localHar_1.patchRnohGeneratedCodegenForNormalizedLocalPackage)(harmonyProjectRoot);
         }
         await (0, localHar_1.patchKnownHarmonyAdapterCodegenOutputs)(harmonyProjectRoot);
+        restoreLocalSigningBuildProfile = await temporarilyMergeLocalSigningIntoBuildProfile(loadedProject.projectRoot, harmonyProjectRoot);
         const hvigorCommand = (0, commands_1.buildInvocation)(envReport.hvigorPath, [
             'assembleHap',
             '--no-daemon',
@@ -416,6 +419,7 @@ async function buildHapProject(projectRoot, options) {
         });
     }
     finally {
+        await restoreLocalSigningBuildProfile();
         await restoreNormalizedHarmonyPackageJsons();
         await restoreNormalizedRnohCodegenAlignment();
         await restoreNormalizedRnohCliAutolinkingTemplates();
@@ -423,6 +427,25 @@ async function buildHapProject(projectRoot, options) {
         await restoreNormalizedDependencies();
     }
 }
+async function temporarilyMergeLocalSigningIntoBuildProfile(projectRoot, harmonyProjectRoot) {
+    const signingLocalConfig = await (0, signing_1.readSigningLocalConfig)(projectRoot);
+    if (!signingLocalConfig) {
+        return async () => { };
+    }
+    const buildProfilePath = path_1.default.join(harmonyProjectRoot, 'build-profile.json5');
+    if (!(await fs_extra_1.default.pathExists(buildProfilePath))) {
+        return async () => { };
+    }
+    const originalContents = await fs_extra_1.default.readFile(buildProfilePath, 'utf8');
+    const nextContents = (0, signing_1.mergeSigningLocalConfigIntoBuildProfile)(originalContents, signingLocalConfig, { includeSecrets: true });
+    if (nextContents === originalContents) {
+        return async () => { };
+    }
+    await fs_extra_1.default.writeFile(buildProfilePath, nextContents);
+    return async () => {
+        await fs_extra_1.default.writeFile(buildProfilePath, originalContents);
+    };
+}
 function getDesiredHarmonyScripts(projectRoot) {
     return (0, project_1.loadProject)(projectRoot).then((loadedProject) => (0, template_1.buildDesiredPackageScripts)(loadedProject.packageJson));
 }

package/build/core/constants.d.ts

@@ -1,6 +1,6 @@
 export declare const TOOLKIT_PACKAGE_NAME = "expo-harmony-toolkit";
 export declare const CLI_NAME = "expo-harmony";
-export declare const TOOLKIT_VERSION = "1.9.1";
+export declare const TOOLKIT_VERSION = "1.9.3";
 export declare const TEMPLATE_VERSION = "rnoh-0.82.29";
 export declare const RNOH_VERSION = "0.82.29";
 export declare const RNOH_CLI_VERSION = "0.82.29";

package/build/core/constants.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DESIRED_PACKAGE_SCRIPTS = exports.HARMONY_RUNTIME_PRELUDE_RELATIVE_PATH = exports.HARMONY_ROUTER_ENTRY_FILENAME = exports.STRICT_ENV_EXIT_CODE = exports.STRICT_DOCTOR_EXIT_CODE = exports.DEFAULT_HVIGOR_PLUGIN_FILENAME = exports.PREBUILD_METADATA_FILENAME = exports.TOOLKIT_CONFIG_FILENAME = exports.BUILD_REPORT_FILENAME = exports.ENV_REPORT_FILENAME = exports.DOCTOR_REPORT_FILENAME = exports.MANIFEST_FILENAME = exports.SIGNING_LOCAL_EXAMPLE_FILENAME = exports.SIGNING_LOCAL_FILENAME = exports.GENERATED_SHIMS_DIR = exports.GENERATED_DIR = exports.SUPPORTED_EXPO_SDKS = exports.RNOH_CLI_VERSION = exports.RNOH_VERSION = exports.TEMPLATE_VERSION = exports.TOOLKIT_VERSION = exports.CLI_NAME = exports.TOOLKIT_PACKAGE_NAME = void 0;
 exports.TOOLKIT_PACKAGE_NAME = 'expo-harmony-toolkit';
 exports.CLI_NAME = 'expo-harmony';
-exports.TOOLKIT_VERSION = '1.9.1';
+exports.TOOLKIT_VERSION = '1.9.3';
 exports.TEMPLATE_VERSION = 'rnoh-0.82.29';
 exports.RNOH_VERSION = '0.82.29';
 exports.RNOH_CLI_VERSION = '0.82.29';

package/build/core/report.js

@@ -26,11 +26,56 @@ const DEFAULT_RECORD = {
 const BARE_WORKFLOW_DIRECTORY_NAMES = ['android', 'ios'];
 const BARE_WORKFLOW_DEPENDENCIES = new Set(['expo-build-properties', 'expo-dev-client']);
 const FORMAL_EXPERIMENTAL_ADAPTER_PAIRS = [
+    {
+        canonicalPackageName: '@react-native-async-storage/async-storage',
+        adapterPackageName: '@react-native-oh-tpl/async-storage',
+    },
+    {
+        canonicalPackageName: 'react-native-webview',
+        adapterPackageName: '@react-native-oh-tpl/react-native-webview',
+    },
+    {
+        canonicalPackageName: 'react-native-screens',
+        adapterPackageName: '@react-native-oh-tpl/react-native-screens',
+    },
     {
         canonicalPackageName: 'react-native-gesture-handler',
         adapterPackageName: '@react-native-oh-tpl/react-native-gesture-handler',
     },
+    {
+        canonicalPackageName: 'lottie-react-native',
+        adapterPackageName: '@react-native-oh-tpl/lottie-react-native',
+    },
+    {
+        canonicalPackageName: 'expo-media-library',
+        adapterPackageName: '@react-native-oh-tpl/camera-roll',
+    },
+    {
+        canonicalPackageName: '@shopify/react-native-skia',
+        adapterPackageName: '@react-native-oh-tpl/react-native-skia',
+    },
 ];
+const THIRD_PARTY_WAVE_A_PACKAGE_NAMES = new Set([
+    '@react-native-async-storage/async-storage',
+    '@react-native-oh-tpl/async-storage',
+    'react-native-screens',
+    '@react-native-oh-tpl/react-native-screens',
+    'react-native-safe-area-context',
+]);
+const THIRD_PARTY_WAVE_B_PACKAGE_NAMES = new Set([
+    'react-native-webview',
+    '@react-native-oh-tpl/react-native-webview',
+    'jpush-react-native',
+    'jcore-react-native',
+    'mx-jpush-expo',
+    'expo-notifications',
+    'expo-media-library',
+    '@react-native-oh-tpl/camera-roll',
+    'lottie-react-native',
+    '@react-native-oh-tpl/lottie-react-native',
+    '@shopify/react-native-skia',
+    '@react-native-oh-tpl/react-native-skia',
+]);
 async function buildDoctorReport(projectRoot, options = {}) {
     const loadedProject = await (0, project_1.loadProject)(projectRoot);
     const doctorConfig = (0, project_1.resolveExpoHarmonyDoctorConfig)(loadedProject.expoConfig);
@@ -477,7 +522,16 @@ function buildNextActions(input) {
             actions.push('Keep this project on the bare workflow track for now: preserve the native directories, use `expo-harmony doctor --project-root .` for classification, and only claim verified support after bare workflow support lands in the mainline capability catalog.');
             break;
         case 'third-party-native-heavy':
-            actions.push('Isolate third-party native packages and onboard them through the mainline capability catalog one by one; start with `react-native-gesture-handler` if it is present, and treat unknown native surfaces as explicit unblockers rather than matrix drift.');
+            if (dependencies.some((dependency) => THIRD_PARTY_WAVE_A_PACKAGE_NAMES.has(dependency.name))) {
+                actions.push('Keep Third-party Native Wave A on `doctor --target-tier experimental`: pair async-storage and screens with their Harmony adapters, keep safe-area on the toolkit shim, and close device/release evidence before any promotion.');
+            }
+            if (dependencies.some((dependency) => THIRD_PARTY_WAVE_B_PACKAGE_NAMES.has(dependency.name))) {
+                actions.push('Keep Third-party Native Wave B on `doctor --target-tier experimental`: pair ccnubox WebView, media-library, Lottie, and Skia surfaces with their Harmony adapters, keep JPush runtime evidence separate, and require debug/release simulator delivery gates before shipping.');
+            }
+            if (!dependencies.some((dependency) => THIRD_PARTY_WAVE_A_PACKAGE_NAMES.has(dependency.name)) &&
+                !dependencies.some((dependency) => THIRD_PARTY_WAVE_B_PACKAGE_NAMES.has(dependency.name))) {
+                actions.push('Isolate third-party native packages and onboard them through the mainline capability catalog one by one; start with `react-native-gesture-handler` if it is present, and treat unknown native surfaces as explicit unblockers rather than matrix drift.');
+            }
             break;
     }
     if (hasRouterBlockingIssues) {

package/build/core/signing.d.ts

@@ -3,10 +3,13 @@ type SigningLocalAppFragment = {
     signingConfigs?: JsonRecord[];
     products?: JsonRecord[];
 };
+interface MergeSigningOptions {
+    includeSecrets?: boolean;
+}
 export declare function getSigningLocalPath(projectRoot: string): string;
 export declare function getSigningLocalExamplePath(projectRoot: string): string;
 export declare function readSigningLocalConfig(projectRoot: string): Promise<SigningLocalAppFragment | null>;
-export declare function mergeSigningLocalConfigIntoBuildProfile(rawBuildProfileContents: string, signingLocalConfig: SigningLocalAppFragment | null): string;
+export declare function mergeSigningLocalConfigIntoBuildProfile(rawBuildProfileContents: string, signingLocalConfig: SigningLocalAppFragment | null, options?: MergeSigningOptions): string;
 export declare function hasSigningConfiguration(rawBuildProfileContents: string | null, signingLocalConfig?: SigningLocalAppFragment | null): boolean;
 export declare function hasSigningLocalConfiguration(signingLocalConfig: SigningLocalAppFragment | null): boolean;
 export declare function renderSigningLocalExampleConfig(): string;

package/build/core/signing.js

@@ -28,12 +28,12 @@ async function readSigningLocalConfig(projectRoot) {
     const rawConfig = (await fs_extra_1.default.readJson(signingLocalPath));
     return normalizeSigningLocalConfig(rawConfig);
 }
-function mergeSigningLocalConfigIntoBuildProfile(rawBuildProfileContents, signingLocalConfig) {
+function mergeSigningLocalConfigIntoBuildProfile(rawBuildProfileContents, signingLocalConfig, options = {}) {
     if (!signingLocalConfig) {
         return rawBuildProfileContents;
     }
     const parsed = json5_1.default.parse(rawBuildProfileContents);
-    const merged = mergeSigningLocalConfig(parsed, signingLocalConfig);
+    const merged = mergeSigningLocalConfig(parsed, signingLocalConfig, options);
     return JSON.stringify(merged, null, 2) + '\n';
 }
 function hasSigningConfiguration(rawBuildProfileContents, signingLocalConfig = null) {
@@ -99,7 +99,7 @@ function normalizeSigningLocalConfig(rawConfig) {
         ...(products ? { products } : {}),
     };
 }
-function mergeSigningLocalConfig(buildProfile, signingLocalConfig) {
+function mergeSigningLocalConfig(buildProfile, signingLocalConfig, options) {
     const nextBuildProfile = {
         ...buildProfile,
         app: isJsonRecord(buildProfile.app)
@@ -109,7 +109,7 @@ function mergeSigningLocalConfig(buildProfile, signingLocalConfig) {
             : {},
     };
     if (Array.isArray(signingLocalConfig.signingConfigs)) {
-        nextBuildProfile.app.signingConfigs = signingLocalConfig.signingConfigs.map((entry) => ({ ...entry }));
+        nextBuildProfile.app.signingConfigs = signingLocalConfig.signingConfigs.map((entry) => cloneSigningConfigForBuildProfile(entry, options));
     }
     if (Array.isArray(signingLocalConfig.products)) {
         const currentProducts = Array.isArray(nextBuildProfile.app.products)
@@ -135,6 +135,21 @@ function mergeSigningLocalConfig(buildProfile, signingLocalConfig) {
     }
     return nextBuildProfile;
 }
+function cloneSigningConfigForBuildProfile(entry, options) {
+    const nextEntry = { ...entry };
+    if (options.includeSecrets) {
+        return nextEntry;
+    }
+    delete nextEntry.storePassword;
+    delete nextEntry.keyPassword;
+    if (isJsonRecord(nextEntry.material)) {
+        const material = { ...nextEntry.material };
+        delete material.storePassword;
+        delete material.keyPassword;
+        nextEntry.material = material;
+    }
+    return nextEntry;
+}
 function hasNonEmptySigningConfigList(signingConfigs) {
     return Array.isArray(signingConfigs) && signingConfigs.some(isJsonRecord);
 }

package/build/core/template/capabilityRegistry.js

@@ -8,6 +8,7 @@ const camera_1 = require("./renderers/camera");
 const fileSystem_1 = require("./renderers/fileSystem");
 const imagePicker_1 = require("./renderers/imagePicker");
 const location_1 = require("./renderers/location");
+const runtimeShims_1 = require("./runtimeShims");
 const CAPABILITY_SHIM_RENDERERS = {
     'expo-file-system': {
         adapter: fileSystem_1.renderExpoFileSystemHarmonyAdapterShim,
@@ -45,6 +46,10 @@ const CAPABILITY_SHIM_RENDERERS = {
         adapter: appFoundation_1.renderExpoHapticsPreviewShim,
         preview: appFoundation_1.renderExpoHapticsPreviewShim,
     },
+    'react-native-safe-area-context': {
+        adapter: runtimeShims_1.renderReactNativeSafeAreaContextHarmonyShim,
+        preview: runtimeShims_1.renderReactNativeSafeAreaContextHarmonyShim,
+    },
 };
 exports.MANAGED_EXPO_HARMONY_MODULE_RENDERERS = [
     {

package/build/core/template/metro.js

@@ -3,8 +3,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderMetroConfig = renderMetroConfig;
 function renderMetroConfig(enabledCapabilities) {
     const previewCapabilityAliases = enabledCapabilities
-        .filter((capability) => capability.supportTier === 'preview' ||
-        capability.supportTier === 'experimental')
+        .filter((capability) => capability.packageName !== 'react-native-safe-area-context' &&
+        (capability.packageName.startsWith('expo-') || capability.runtimeMode === 'shim') &&
+        (capability.supportTier === 'preview' ||
+            capability.supportTier === 'experimental'))
         .map((capability) => `  '${capability.packageName}': path.resolve(__dirname, '.expo-harmony/shims/${capability.packageName}'),`)
         .join('\n');
     return `const fs = require('fs');

package/build/data/capabilities.js

@@ -18,25 +18,37 @@ const PREVIEW_BASELINE_EVIDENCE_SOURCE = {
     device: 'manual-doc',
     release: 'none',
 };
-const EXPLORATORY_EVIDENCE = {
-    bundle: false,
-    debugBuild: false,
+const APP_FOUNDATION_BASELINE_EVIDENCE = {
+    bundle: true,
+    debugBuild: true,
     device: false,
     release: false,
 };
-const EXPLORATORY_EVIDENCE_SOURCE = {
-    bundle: 'none',
-    debugBuild: 'none',
+const APP_FOUNDATION_BASELINE_EVIDENCE_SOURCE = {
+    bundle: 'automated',
+    debugBuild: 'automated',
     device: 'none',
     release: 'none',
 };
-const APP_FOUNDATION_BASELINE_EVIDENCE = {
+const THIRD_PARTY_WAVE_A_BASELINE_EVIDENCE = {
     bundle: true,
     debugBuild: true,
     device: false,
     release: false,
 };
-const APP_FOUNDATION_BASELINE_EVIDENCE_SOURCE = {
+const THIRD_PARTY_WAVE_A_BASELINE_EVIDENCE_SOURCE = {
+    bundle: 'automated',
+    debugBuild: 'automated',
+    device: 'none',
+    release: 'none',
+};
+const THIRD_PARTY_WAVE_B_BASELINE_EVIDENCE = {
+    bundle: true,
+    debugBuild: true,
+    device: false,
+    release: false,
+};
+const THIRD_PARTY_WAVE_B_BASELINE_EVIDENCE_SOURCE = {
     bundle: 'automated',
     debugBuild: 'automated',
     device: 'none',
@@ -229,17 +241,17 @@ exports.CAPABILITY_DEFINITIONS = [
         status: 'manual',
         supportTier: 'experimental',
         runtimeMode: 'shim',
-        evidence: EXPLORATORY_EVIDENCE,
-        evidenceSource: EXPLORATORY_EVIDENCE_SOURCE,
-        note: 'Notifications stay below the public promise until a complete Harmony delivery story is validated end to end.',
+        evidence: THIRD_PARTY_WAVE_B_BASELINE_EVIDENCE,
+        evidenceSource: THIRD_PARTY_WAVE_B_BASELINE_EVIDENCE_SOURCE,
+        note: 'v1.9.3 Wave B keeps Expo Notifications on a safe experimental shim for ccnubox push flows while JPush delivery and signed-runtime behavior remain separate evidence gates.',
         docsUrl: 'https://github.com/react-native-oh-library',
         nativePackageNames: [],
         harmonyPermissions: ['ohos.permission.NOTIFICATION_CONTROLLER'],
-        sampleRoute: '/notifications',
+        sampleRoute: '/third-party-wave-b/notifications',
         acceptanceChecklist: [
-            'Register for notifications on a signed build.',
-            'Receive a foreground notification.',
-            'Validate open-from-notification lifecycle.',
+            'Bundle notification permission and channel setup paths without crashing.',
+            'Keep foreground receipt, click, and cold-start delivery pending signed simulator and device evidence.',
+            'Do not treat simulator app-shell launch as notification delivery acceptance.',
         ],
     },
     {
@@ -261,6 +273,158 @@ exports.CAPABILITY_DEFINITIONS = [
             'Record debug HAP evidence before any promotion decision; device and release remain separate gates.',
         ],
     },
+    {
+        id: 'async-storage',
+        packageName: '@react-native-async-storage/async-storage',
+        status: 'manual',
+        supportTier: 'experimental',
+        runtimeMode: 'adapter',
+        evidence: THIRD_PARTY_WAVE_A_BASELINE_EVIDENCE,
+        evidenceSource: THIRD_PARTY_WAVE_A_BASELINE_EVIDENCE_SOURCE,
+        note: 'v1.9.2 Wave A tracks Async Storage through its Harmony adapter, but persistence behavior remains experimental until device and release evidence are closed.',
+        docsUrl: 'https://github.com/react-native-oh-library/usage-docs',
+        nativePackageNames: ['@react-native-oh-tpl/async-storage'],
+        harmonyPermissions: [],
+        sampleRoute: '/third-party-wave-a/async-storage',
+        acceptanceChecklist: [
+            'Install the canonical package with the matching Harmony adapter.',
+            'Bundle a minimal Async Storage read/write/remove surface.',
+            'Keep real persistence, migration, and release HAP runtime behavior pending device evidence.',
+        ],
+    },
+    {
+        id: 'react-native-screens',
+        packageName: 'react-native-screens',
+        status: 'manual',
+        supportTier: 'experimental',
+        runtimeMode: 'adapter',
+        evidence: THIRD_PARTY_WAVE_A_BASELINE_EVIDENCE,
+        evidenceSource: THIRD_PARTY_WAVE_A_BASELINE_EVIDENCE_SOURCE,
+        note: 'v1.9.2 Wave A tracks Screens through its Harmony adapter metadata, while managed autolinking and navigation-stack runtime behavior remain promotion gaps.',
+        docsUrl: 'https://github.com/react-native-oh-library',
+        nativePackageNames: ['@react-native-oh-tpl/react-native-screens'],
+        harmonyPermissions: [],
+        sampleRoute: '/third-party-wave-a/screens',
+        acceptanceChecklist: [
+            'Install the canonical package with the matching Harmony adapter.',
+            'Bundle a minimal navigation stack that imports react-native-screens.',
+            'Do not claim verified support until adapter autolinking, device, and release evidence are recorded.',
+        ],
+    },
+    {
+        id: 'react-native-safe-area-context',
+        packageName: 'react-native-safe-area-context',
+        status: 'manual',
+        supportTier: 'experimental',
+        runtimeMode: 'shim',
+        evidence: THIRD_PARTY_WAVE_A_BASELINE_EVIDENCE,
+        evidenceSource: THIRD_PARTY_WAVE_A_BASELINE_EVIDENCE_SOURCE,
+        note: 'v1.9.2 Wave A formalizes the existing toolkit safe-area shim so app-shell layouts keep bundling while native safe-area measurements stay outside verified.',
+        docsUrl: 'https://github.com/react-native-oh-library',
+        nativePackageNames: [],
+        harmonyPermissions: [],
+        sampleRoute: '/third-party-wave-a/safe-area',
+        acceptanceChecklist: [
+            'Render SafeAreaProvider, SafeAreaView, and safe-area hooks through the toolkit shim.',
+            'Keep the Metro alias on .expo-harmony/shims/react-native-safe-area-context.',
+            'Validate real native inset measurement separately before any adapter promotion.',
+        ],
+    },
+    {
+        id: 'react-native-webview',
+        packageName: 'react-native-webview',
+        status: 'manual',
+        supportTier: 'experimental',
+        runtimeMode: 'adapter',
+        evidence: THIRD_PARTY_WAVE_B_BASELINE_EVIDENCE,
+        evidenceSource: THIRD_PARTY_WAVE_B_BASELINE_EVIDENCE_SOURCE,
+        note: 'v1.9.3 Wave B tracks ccnubox WebView surfaces through the Harmony adapter, but navigation, injected scripts, and release runtime stability remain promotion evidence.',
+        docsUrl: 'https://github.com/react-native-oh-library/usage-docs/blob/master/en/react-native-webview.md',
+        nativePackageNames: ['@react-native-oh-tpl/react-native-webview'],
+        harmonyPermissions: [],
+        sampleRoute: '/third-party-wave-b/webview',
+        acceptanceChecklist: [
+            'Install react-native-webview with the matching Harmony adapter.',
+            'Bundle a minimal WebView surface with message passing and navigation callbacks.',
+            'Validate signed simulator startup and real WebView runtime behavior before any promotion.',
+        ],
+    },
+    {
+        id: 'jpush-react-native',
+        packageName: 'jpush-react-native',
+        status: 'manual',
+        supportTier: 'experimental',
+        runtimeMode: 'adapter',
+        evidence: THIRD_PARTY_WAVE_B_BASELINE_EVIDENCE,
+        evidenceSource: THIRD_PARTY_WAVE_B_BASELINE_EVIDENCE_SOURCE,
+        note: 'v1.9.3 Wave B keeps ccnubox JPush runtime dependencies in formal telemetry; registrationId, arrival, click, and cold-start payloads still require signed runtime evidence.',
+        docsUrl: 'https://docs.jiguang.cn/jpush/client/HarmonyOS/hmos_guide',
+        nativePackageNames: ['jcore-react-native'],
+        harmonyPermissions: ['ohos.permission.NOTIFICATION_CONTROLLER'],
+        sampleRoute: '/third-party-wave-b/jpush',
+        acceptanceChecklist: [
+            'Keep jpush-react-native, jcore-react-native, and mx-jpush-expo visible in doctor reports.',
+            'Bundle guarded JPush init and registrationId lookup paths without native-module crashes.',
+            'Record signed simulator and device push delivery evidence before any promotion.',
+        ],
+    },
+    {
+        id: 'expo-media-library',
+        packageName: 'expo-media-library',
+        status: 'manual',
+        supportTier: 'experimental',
+        runtimeMode: 'adapter',
+        evidence: THIRD_PARTY_WAVE_B_BASELINE_EVIDENCE,
+        evidenceSource: THIRD_PARTY_WAVE_B_BASELINE_EVIDENCE_SOURCE,
+        note: 'v1.9.3 Wave B tracks ccnubox media-library save flows through the camera-roll Harmony adapter while gallery write/read behavior remains runtime evidence.',
+        docsUrl: 'https://github.com/react-native-oh-library',
+        nativePackageNames: ['@react-native-oh-tpl/camera-roll'],
+        harmonyPermissions: ['ohos.permission.READ_IMAGEVIDEO', 'ohos.permission.WRITE_IMAGEVIDEO'],
+        sampleRoute: '/third-party-wave-b/media-library',
+        acceptanceChecklist: [
+            'Install expo-media-library with the camera-roll Harmony adapter available.',
+            'Bundle permission and create-asset code paths used by ccnubox screenshots.',
+            'Validate gallery write/read behavior on signed simulator and device before promotion.',
+        ],
+    },
+    {
+        id: 'lottie-react-native',
+        packageName: 'lottie-react-native',
+        status: 'manual',
+        supportTier: 'experimental',
+        runtimeMode: 'adapter',
+        evidence: THIRD_PARTY_WAVE_B_BASELINE_EVIDENCE,
+        evidenceSource: THIRD_PARTY_WAVE_B_BASELINE_EVIDENCE_SOURCE,
+        note: 'v1.9.3 Wave B tracks ccnubox Lottie animation surfaces through the Harmony adapter, but animation playback remains simulator and device smoke evidence.',
+        docsUrl: 'https://github.com/react-native-oh-library',
+        nativePackageNames: ['@react-native-oh-tpl/lottie-react-native'],
+        harmonyPermissions: [],
+        sampleRoute: '/third-party-wave-b/lottie',
+        acceptanceChecklist: [
+            'Install lottie-react-native with the matching Harmony adapter.',
+            'Bundle a minimal LottieView surface and local animation asset path.',
+            'Validate playback on signed simulator and device before promotion.',
+        ],
+    },
+    {
+        id: 'react-native-skia',
+        packageName: '@shopify/react-native-skia',
+        status: 'manual',
+        supportTier: 'experimental',
+        runtimeMode: 'adapter',
+        evidence: THIRD_PARTY_WAVE_B_BASELINE_EVIDENCE,
+        evidenceSource: THIRD_PARTY_WAVE_B_BASELINE_EVIDENCE_SOURCE,
+        note: 'v1.9.3 Wave B tracks ccnubox Skia timetable rendering through the Harmony adapter direction while canvas rendering remains runtime evidence.',
+        docsUrl: 'https://github.com/react-native-oh-library',
+        nativePackageNames: ['@react-native-oh-tpl/react-native-skia'],
+        harmonyPermissions: [],
+        sampleRoute: '/third-party-wave-b/skia',
+        acceptanceChecklist: [
+            'Install @shopify/react-native-skia with the Harmony Skia adapter available.',
+            'Bundle a minimal Canvas/Skia import surface used by timetable rendering.',
+            'Validate actual canvas rendering on signed simulator and device before promotion.',
+        ],
+    },
 ];
 exports.CAPABILITY_BY_PACKAGE = Object.fromEntries(exports.CAPABILITY_DEFINITIONS.map((definition) => [definition.packageName, definition]));
 const SUPPORT_TIER_ORDER = {

package/build/data/dependencyCatalog.js

@@ -138,25 +138,25 @@ exports.DEPENDENCY_CATALOG = {
     '@react-native-async-storage/async-storage': {
         status: 'manual',
         supportTier: 'experimental',
-        note: 'Async storage is a high-frequency startup dependency. Treat it as an experimental Harmony intake dependency until the managed adapter path has stable doctor, sample, and build coverage.',
+        note: 'v1.9.2 Wave A tracks Async Storage through its Harmony adapter, but persistence behavior still needs device and release evidence before verified promotion.',
         docsUrl: 'https://github.com/react-native-oh-library',
     },
     'react-native-safe-area-context': {
-        status: 'supported',
+        status: 'manual',
         supportTier: 'experimental',
-        note: 'Safe-area handling is shimmed by the toolkit for Harmony so App Shell layouts can keep rendering while the native path remains outside the verified matrix.',
+        note: 'v1.9.2 Wave A formalizes the toolkit-managed safe-area shim while real native inset measurement remains outside the verified matrix.',
         docsUrl: 'https://github.com/react-native-oh-library',
     },
     'react-native-screens': {
         status: 'manual',
         supportTier: 'experimental',
-        note: 'Navigation stacks frequently depend on react-native-screens. Keep it on the experimental lane until the Harmony adapter path has repeatable sample and device coverage.',
+        note: 'v1.9.2 Wave A tracks Screens through its Harmony adapter metadata; navigation-stack runtime behavior still needs device and release evidence.',
         docsUrl: 'https://github.com/react-native-oh-library',
     },
     'react-native-webview': {
         status: 'manual',
         supportTier: 'experimental',
-        note: 'WebView is a common app-shell blocker. Treat it as an experimental intake dependency until the Harmony runtime path is validated on device.',
+        note: 'v1.9.3 Wave B tracks ccnubox WebView usage through the Harmony adapter, but navigation, injected scripts, and release runtime behavior remain experimental evidence.',
         docsUrl: 'https://github.com/react-native-oh-library',
     },
     ...UI_STACK_COMPATIBILITY_RECORDS,
@@ -289,7 +289,7 @@ exports.DEPENDENCY_CATALOG = {
     'expo-media-library': {
         status: 'manual',
         supportTier: 'experimental',
-        note: 'Media-library write/read flows should be backed by the Harmony camera-roll adapter for screenshot save acceptance.',
+        note: 'v1.9.3 Wave B tracks media-library screenshot save flows through the Harmony camera-roll adapter; gallery write/read behavior still needs signed runtime evidence.',
         replacement: '@react-native-oh-tpl/camera-roll',
     },
     'expo-secure-store': {
@@ -325,19 +325,19 @@ exports.DEPENDENCY_CATALOG = {
     'jcore-react-native': {
         status: 'manual',
         supportTier: 'experimental',
-        note: 'JCore is accepted as part of the JPush Harmony intake path, but device-side SDK evidence is required.',
+        note: 'v1.9.3 Wave B keeps JCore visible as the JPush runtime foundation, but SDK registration and delivery still need signed runtime evidence.',
         docsUrl: 'https://docs.jiguang.cn/jpush/client/HarmonyOS/hmos_guide',
     },
     'jpush-react-native': {
         status: 'manual',
         supportTier: 'experimental',
-        note: 'JPush is a real runtime requirement for ccnubox. Keep it in the catalog and require a Harmony SDK bridge plus device evidence for registrationId, arrival, click, and cold-start payloads.',
+        note: 'v1.9.3 Wave B keeps JPush in formal telemetry for ccnubox; registrationId, arrival, click, and cold-start payloads require signed runtime evidence.',
         docsUrl: 'https://docs.jiguang.cn/jpush/client/HarmonyOS/hmos_guide',
     },
     'mx-jpush-expo': {
         status: 'manual',
         supportTier: 'experimental',
-        note: 'The Expo config plugin may be excluded from Harmony config processing, but the JPush runtime dependency must stay visible in doctor reports.',
+        note: 'v1.9.3 Wave B treats this config plugin as JPush intake metadata; it may be excluded from config processing while runtime JPush dependencies stay visible in doctor reports.',
         docsUrl: 'https://docs.jiguang.cn/jpush/client/HarmonyOS/hmos_guide',
     },
     'react-native-draggable-grid': {

package/build/data/publicDocs.d.ts

@@ -8,4 +8,4 @@ export declare const SUPPORTING_SAMPLE_PATHS: readonly ["examples/official-app-s
 export declare const VERIFIED_JS_UI_CAPABILITY_NAMES: readonly ["expo-router", "expo-linking", "expo-constants", ...("react-native-reanimated" | "react-native-svg")[]];
 export declare const PREVIEW_CAPABILITY_DEFINITIONS: import("..").CapabilityDefinition[];
 export declare const EXPERIMENTAL_CAPABILITY_NAMES: readonly string[];
-export declare const PUBLIC_CURRENT_VERSION = "1.9.1";
+export declare const PUBLIC_CURRENT_VERSION = "1.9.3";

package/build/docs/render.d.ts

@@ -5,5 +5,6 @@ export declare function renderSupportMatrixVerifiedMatrix(locale: DocsLocale): s
 export declare function renderSupportMatrixVerifiedAllowlist(): string;
 export declare function renderSupportMatrixCapabilityTelemetry(locale: DocsLocale): string;
 export declare function renderSupportMatrixPreviewCapabilities(locale: DocsLocale): string;
+export declare function renderSupportMatrixExperimentalCapabilities(locale: DocsLocale): string;
 export declare function renderSupportMatrixUiStackRules(locale: DocsLocale): string;
 export declare function renderSupportMatrixReleaseTracks(locale: DocsLocale): string;

package/build/docs/render.js

@@ -6,9 +6,11 @@ exports.renderSupportMatrixVerifiedMatrix = renderSupportMatrixVerifiedMatrix;
 exports.renderSupportMatrixVerifiedAllowlist = renderSupportMatrixVerifiedAllowlist;
 exports.renderSupportMatrixCapabilityTelemetry = renderSupportMatrixCapabilityTelemetry;
 exports.renderSupportMatrixPreviewCapabilities = renderSupportMatrixPreviewCapabilities;
+exports.renderSupportMatrixExperimentalCapabilities = renderSupportMatrixExperimentalCapabilities;
 exports.renderSupportMatrixUiStackRules = renderSupportMatrixUiStackRules;
 exports.renderSupportMatrixReleaseTracks = renderSupportMatrixReleaseTracks;
 const publicDocs_1 = require("../data/publicDocs");
+const capabilities_1 = require("../data/capabilities");
 const validatedMatrices_1 = require("../data/validatedMatrices");
 const uiStack_1 = require("../data/uiStack");
 const matrix = validatedMatrices_1.VALIDATED_RELEASE_MATRICES[validatedMatrices_1.DEFAULT_VALIDATED_MATRIX_ID];
@@ -183,6 +185,23 @@ function renderSupportMatrixPreviewCapabilities(locale) {
         }).map((row) => `| ${row} |`),
     ].join('\n');
 }
+function renderSupportMatrixExperimentalCapabilities(locale) {
+    const headers = locale === 'zh'
+        ? ['Expo 能力 / 依赖', '当前层级', 'runtimeMode', 'evidence', '说明']
+        : ['Expo capability / dependency', 'Support tier', 'runtimeMode', 'evidence', 'Notes'];
+    const experimentalCapabilities = capabilities_1.CAPABILITY_DEFINITIONS.filter((definition) => definition.supportTier === 'experimental');
+    return [
+        `| ${headers.join(' | ')} |`,
+        `| ${headers.map(() => '---').join(' | ')} |`,
+        ...experimentalCapabilities.map((definition) => [
+            `\`${definition.packageName}\``,
+            `\`${definition.supportTier}\``,
+            `\`${definition.runtimeMode}\``,
+            `\`${renderEvidence(definition)}\``,
+            renderExperimentalCapabilityNote(definition, locale),
+        ].join(' | ')).map((row) => `| ${row} |`),
+    ].join('\n');
+}
 function renderSupportMatrixUiStackRules(locale) {
     const intro = locale === 'zh'
         ? 'canonical 包与 Harmony adapter 包固定为双向强制：'
@@ -250,3 +269,12 @@ function renderEvidence(definition) {
         `release=${definition.evidence.release ? 'yes' : 'no'}[${definition.evidenceSource.release}]`,
     ].join(', ');
 }
+function renderExperimentalCapabilityNote(definition, locale) {
+    const dependencyDirection = definition.nativePackageNames.length > 0
+        ? definition.nativePackageNames.join(', ')
+        : 'toolkit-managed bridge';
+    if (locale === 'en') {
+        return `${definition.note} Direction: ${dependencyDirection}.`;
+    }
+    return `${definition.note} 依赖方向：${dependencyDirection}。`;
+}

package/docs/cli-build.md

@@ -1,6 +1,6 @@
 # CLI 构建指南
 
-`v1.9.1` 延续 `verified + preview + experimental` 支持分层，把 bare workflow 放进 intake baseline，并补上 `build-hap` 的本地 HAR normalize opt-out；`expo55-rnoh082-ui-stack` 仍是唯一 verified 矩阵。
+`v1.9.3` 延续 `verified + preview + experimental` 支持分层，把 ccnubox-first Third-party Native Wave B 纳入 formal experimental onboarding；`expo55-rnoh082-ui-stack` 仍是唯一 verified 矩阵。
 
 CLI 命令集合不变：
 
@@ -48,6 +48,14 @@ expo-harmony build-hap --mode debug
 当前 experimental formal slice：
 
 - `react-native-gesture-handler`
+- `@react-native-async-storage/async-storage`
+- `react-native-screens`
+- `react-native-safe-area-context`
+- `react-native-webview`
+- `jpush-react-native`
+- `expo-media-library`
+- `lottie-react-native`
+- `@shopify/react-native-skia`
 
 ## UI stack 依赖安装注意事项
 
@@ -90,7 +98,7 @@ pnpm install --ignore-scripts
 
 额外说明：
 
-- `react-native-gesture-handler` 已进入 formal experimental slice，但仍不属于 verified 公开承诺
+- `react-native-gesture-handler` 与 Wave A / Wave B 第三方 native packages 已进入 formal experimental onboarding，但仍不属于 verified 公开承诺
 - bare workflow 当前只有 intake / debug baseline，不代表 release-ready
 - `doctor --strict` 仍只代表完整验收的 verified 能力
 

package/docs/official-minimal-sample.md

@@ -45,7 +45,7 @@ pnpm run harmony:build:release
 
 - `.expo-harmony/signing.local.example.json` 是可直接复制的本地 signing 範本
 - `.expo-harmony/signing.local.json` 是本地 signing 入口
-- toolkit 会把本地 signing 合并进 `harmony/build-profile.json5`
+- toolkit 只会把非密钥 signing 引用写进 `harmony/build-profile.json5`；`storePassword` 与 `keyPassword` 会留在本地 signing 文件，并在 Hvigor build 期间临时注入后恢复
 - 如果 signing 没配置，`harmony:env` 会明确报缺失；这属于预期阻断
 
 ## 不覆盖的内容

package/docs/official-native-capabilities-sample.md

@@ -182,7 +182,7 @@ pnpm run harmony:build:release
 
 - `.expo-harmony/signing.local.example.json` 是可直接复制的本地 signing 範本
 - `.expo-harmony/signing.local.json` 是本地 signing 入口
-- toolkit 会把本地 signing 合并进 `harmony/build-profile.json5`
+- toolkit 只会把非密钥 signing 引用写进 `harmony/build-profile.json5`；`storePassword` 与 `keyPassword` 会留在本地 signing 文件，并在 Hvigor build 期间临时注入后恢复
 - 即使 release 构建可走通，在没有真机前，这四项能力也仍保持 `preview`
 
 ## 当前结论

package/docs/roadmap.md

@@ -66,7 +66,7 @@
 
 ## 当前主线
 
-`v1.8.x` 已完成 repo 内可收口项，当前主线切到 `v1.9.x`。`v1.9.0` 先落 bare workflow baseline、app foundation modules 与 `react-native-gesture-handler` formal slice；`v1.9.1` 作为 build-hap patch release，补上 HAR normalize opt-out，让已确认 ohpm 可直接消费纯 HAR 的项目可以绕过 `expo-harmony-local-deps`。剩余需要真机或 release HAP 的证据继续保留在 v1.8.x capability board，不阻塞 v1.9.x 的 bare / foundation / third-party onboarding 工作。
+`v1.8.x` 已完成 repo 内可收口项，当前主线切到 `v1.9.x`。`v1.9.0` 先落 bare workflow baseline、app foundation modules 与 `react-native-gesture-handler` formal slice；`v1.9.1` 作为 build-hap patch release，补上 HAR normalize opt-out；`v1.9.2` 推进 Third-party Native Wave A，把 async-storage、screens 与 safe-area 拉进 formal experimental onboarding；`v1.9.3` 推进 ccnubox-first Third-party Native Wave B 与 regression farm。剩余需要真机或 release HAP 的证据继续保留在 v1.8.x capability board，不阻塞 v1.9.x 的 bare / foundation / third-party onboarding 工作。
 
 ### v1.8.0 Intake Hardening + Parallel Promotion
 
@@ -178,6 +178,8 @@
 
 目标日期：`2026-09-30`
 
+状态：implementation baseline complete；device / release evidence carryover。
+
 目标：优先清掉最容易挡住“任何 Expo 项目”的高频第三方 native blocker。
 
 - 第一批高频第三方 native blocker 进入正式 onboarding：
@@ -192,20 +194,35 @@
   - sample / fixture
   - debug + release evidence
 - 任何进入 Wave A 的 blocker，都不允许继续停留在“矩阵外模糊探索”
+- 本阶段发布为 `v1.9.2` 并进入 `latest`，但不改变 `verified` 边界：
+  - `@react-native-async-storage/async-storage` 以 `experimental` + `runtimeMode=adapter` 记录
+  - `react-native-screens` 以 `experimental` + `runtimeMode=adapter` 记录
+  - `react-native-safe-area-context` 以 `experimental` + `runtimeMode=shim` 记录
+  - `doctor --strict` 与 `doctor --target-tier preview` 仍阻断 Wave A
 
 ### v1.9.3 Third-party Native Wave B + Regression Farm
 
 目标日期：`2026-10-31`
 
+状态：implementation baseline complete；simulator delivery gate pending target；device / release evidence carryover。
+
 目标：扩大第三方 native 覆盖，并把 `v1.9.0` 建好的最小 regression farm 扩容成持续回归面。
 
-- 第二批高频第三方 native 依赖进入主线
+- 第二批高频第三方 native 依赖进入主线：
+  - `react-native-webview`
+  - JPush runtime：`jpush-react-native`、`jcore-react-native`、`mx-jpush-expo`
+  - `expo-notifications`
+  - `expo-media-library`
+  - `lottie-react-native`
+  - `@shopify/react-native-skia`
 - 扩容 project-shape regression farm：
   - managed core
   - managed native heavy
   - bare
   - third-party native heavy
 - 至少维护一组“未知项目导入 -> doctor 分类 -> nextActions -> sample/build gate”的持续回归案例
+- ccnubox-first Wave B 以 `experimental` + formal adapter/shim slice 记录，不改变 `verified` 边界
+- debug / release HAP simulator delivery gate 必须单独记录；没有 `hdc` target 时不得把 build evidence 表述为 simulator pass
 - 继续收口 preview capability 的 release evidence，尽量减少 `v2.0.0` 前的残留灰区
 
 ### v1.10.0 Any-project Intake Freeze

package/docs/signing-and-release.md

@@ -8,7 +8,7 @@
 
 - DevEco Studio / Harmony SDK 已正确安装
 - 项目已生成 `harmony/`
-- `harmony/build-profile.json5` 中存在可用的 `signingConfigs`
+- `.expo-harmony/signing.local.json` 中存在可用的 `signingConfigs`
 - AppGallery Connect / 本地签名材料与工程配置一致
 
 `.expo-harmony/signing.local.json` 的最小结构与 `.expo-harmony/signing.local.example.json` 一致：
@@ -59,6 +59,8 @@ expo-harmony env
 - `release` 构建不应视为 ready
 - 可以直接从 `.expo-harmony/signing.local.example.json` 复制出 `.expo-harmony/signing.local.json` 再填入真实材料
 
+`expo-harmony init` / `sync-template` 只会把非密钥 signing 引用写入可版本化的 `harmony/build-profile.json5`。`storePassword` 与 `keyPassword` 只应保留在 `.expo-harmony/signing.local.json`；`build-hap` 会在本地 Hvigor 构建期间临时注入这些 secret，并在 Hvigor 结束后恢复 `build-profile.json5`。没有本地 signing config 的 debug 构建仍不需要 release signing。
+
 ## 推荐流程
 
 ### Debug 验证

package/docs/support-matrix.md

@@ -14,7 +14,7 @@
 - bare workflow 与第三方 native package 不再被描述成“收官后才考虑的另一条 extension 终局”
 - `v2.0.0` 本身被定义成“任何 Expo 项目都能可靠打包成鸿蒙 App”的目标版本
 - 但当前公开承诺依旧没有放宽；它们只是进入同一主线 backlog，而不是已经进入 `verified`
-- `v1.9.0` 新增的是 bare intake baseline、app foundation preview shim baseline 与 `react-native-gesture-handler` formal experimental slice，不是 verified 扩容
+- `v1.9.3` 新增的是 ccnubox-first Third-party Native Wave B formal experimental onboarding，不是 verified 扩容
 
 `doctor --strict` 继续只代表 `verified`。
 
@@ -134,10 +134,20 @@
 
 ## Experimental 能力
 
+<!-- GENERATED:support-matrix-experimental-capabilities:start -->
 | Expo 能力 / 依赖 | 当前层级 | runtimeMode | evidence | 说明 |
 | --- | --- | --- | --- | --- |
-| `expo-notifications` | `experimental` | `shim` | `bundle=no, debugBuild=no, device=no, release=no` | 服务链路与交付故事未打通 |
-| `react-native-gesture-handler` | `experimental` | `adapter` | `bundle=yes[automated], debugBuild=yes[automated], device=no[none], release=no[none]` | v1.9.0 formal acceptance slice；必须与 `@react-native-oh-tpl/react-native-gesture-handler` 成对接入，仍不在公开 verified 矩阵内 |
+| `expo-notifications` | `experimental` | `shim` | `bundle=yes[automated], debugBuild=yes[automated], device=no[none], release=no[none]` | v1.9.3 Wave B keeps Expo Notifications on a safe experimental shim for ccnubox push flows while JPush delivery and signed-runtime behavior remain separate evidence gates. 依赖方向：toolkit-managed bridge。 |
+| `react-native-gesture-handler` | `experimental` | `adapter` | `bundle=yes[automated], debugBuild=yes[automated], device=no[none], release=no[none]` | v1.9.0 formal acceptance slice tracks Gesture Handler through its Harmony adapter, but it remains experimental until device and release runtime evidence are closed. 依赖方向：@react-native-oh-tpl/react-native-gesture-handler。 |
+| `@react-native-async-storage/async-storage` | `experimental` | `adapter` | `bundle=yes[automated], debugBuild=yes[automated], device=no[none], release=no[none]` | v1.9.2 Wave A tracks Async Storage through its Harmony adapter, but persistence behavior remains experimental until device and release evidence are closed. 依赖方向：@react-native-oh-tpl/async-storage。 |
+| `react-native-screens` | `experimental` | `adapter` | `bundle=yes[automated], debugBuild=yes[automated], device=no[none], release=no[none]` | v1.9.2 Wave A tracks Screens through its Harmony adapter metadata, while managed autolinking and navigation-stack runtime behavior remain promotion gaps. 依赖方向：@react-native-oh-tpl/react-native-screens。 |
+| `react-native-safe-area-context` | `experimental` | `shim` | `bundle=yes[automated], debugBuild=yes[automated], device=no[none], release=no[none]` | v1.9.2 Wave A formalizes the existing toolkit safe-area shim so app-shell layouts keep bundling while native safe-area measurements stay outside verified. 依赖方向：toolkit-managed bridge。 |
+| `react-native-webview` | `experimental` | `adapter` | `bundle=yes[automated], debugBuild=yes[automated], device=no[none], release=no[none]` | v1.9.3 Wave B tracks ccnubox WebView surfaces through the Harmony adapter, but navigation, injected scripts, and release runtime stability remain promotion evidence. 依赖方向：@react-native-oh-tpl/react-native-webview。 |
+| `jpush-react-native` | `experimental` | `adapter` | `bundle=yes[automated], debugBuild=yes[automated], device=no[none], release=no[none]` | v1.9.3 Wave B keeps ccnubox JPush runtime dependencies in formal telemetry; registrationId, arrival, click, and cold-start payloads still require signed runtime evidence. 依赖方向：jcore-react-native。 |
+| `expo-media-library` | `experimental` | `adapter` | `bundle=yes[automated], debugBuild=yes[automated], device=no[none], release=no[none]` | v1.9.3 Wave B tracks ccnubox media-library save flows through the camera-roll Harmony adapter while gallery write/read behavior remains runtime evidence. 依赖方向：@react-native-oh-tpl/camera-roll。 |
+| `lottie-react-native` | `experimental` | `adapter` | `bundle=yes[automated], debugBuild=yes[automated], device=no[none], release=no[none]` | v1.9.3 Wave B tracks ccnubox Lottie animation surfaces through the Harmony adapter, but animation playback remains simulator and device smoke evidence. 依赖方向：@react-native-oh-tpl/lottie-react-native。 |
+| `@shopify/react-native-skia` | `experimental` | `adapter` | `bundle=yes[automated], debugBuild=yes[automated], device=no[none], release=no[none]` | v1.9.3 Wave B tracks ccnubox Skia timetable rendering through the Harmony adapter direction while canvas rendering remains runtime evidence. 依赖方向：@react-native-oh-tpl/react-native-skia。 |
+<!-- GENERATED:support-matrix-experimental-capabilities:end -->
 
 ## UI Stack 配对规则
 
@@ -269,6 +279,8 @@ toolkit 受管的核心产物仍包括：
 
 - bare Expo；当前只进入 intake / debug baseline
 - `expo-secure-store`、`expo-asset`、`expo-device`、`expo-clipboard`、`expo-haptics` 当前仍只是 preview shim baseline
+- `@react-native-async-storage/async-storage`、`react-native-screens`、`react-native-safe-area-context` 当前仍只是 Wave A experimental onboarding
+- `react-native-webview`、JPush runtime、`expo-media-library`、`lottie-react-native`、`@shopify/react-native-skia` 当前仍只是 Wave B experimental onboarding
 - 多 Expo / RNOH 并行 verified 矩阵
 - 任意第三方 native package 的即时正式承诺
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-harmony-toolkit",
-  "version": "1.9.1",
+  "version": "1.9.3",
   "description": "面向 Managed/CNG Expo 项目的 HarmonyOS 迁移、准入检查与 UI-stack 构建工具链",
   "main": "app.plugin.js",
   "types": "build/index.d.ts",