indraq_cli 2.1.0 → 2.2.1

package/templates/jenkins/Jenkinsfile-Mobile-App

@@ -1,759 +1,759 @@
-pipeline {
-    agent any
-
-    options {
-        timestamps()
-        disableConcurrentBuilds()
-        buildDiscarder(logRotator(daysToKeepStr: '30', numToKeepStr: '30', artifactDaysToKeepStr: '30', artifactNumToKeepStr: '30'))
-        skipDefaultCheckout(true)
-    }
-
-    environment {
-        ANDROID_HOME = '/opt/android-sdk'
-        ANDROID_SDK_ROOT = '/opt/android-sdk'
-        MOBILE_BUILDER_HOME = '/opt/mobile-builder'
-        CI = '1'
-        BUILD_RETENTION_DAYS = '30'
-        PATH = "/opt/android-sdk/cmdline-tools/latest/bin:/opt/android-sdk/platform-tools:/usr/local/bin:/usr/bin:/bin:${env.PATH}"
-    }
-
-    parameters {
-        // Requires Jenkins "File Parameter" plugin (ID: file-parameters).
-        // IndraQ CLI uploads both files through Jenkins buildWithParameters.
-        stashedFile 'SOURCE_BUNDLE'
-        stashedFile 'ENV_FILE'
-
-        string(name: 'PROJECT_ID', defaultValue: '', description: 'Stable IndraQ project ID. Supplied by IndraQ CLI.')
-        string(name: 'APP_NAME', defaultValue: '', description: 'Application name. Supplied by IndraQ CLI.')
-        string(name: 'APP_VERSION', defaultValue: '0.1', description: 'Android versionName supplied by IndraQ CLI.')
-        string(name: 'APP_VERSION_CODE', defaultValue: '1', description: 'Android versionCode supplied by IndraQ CLI.')
-        string(name: 'SOURCE_SHA256', defaultValue: '', description: 'SHA-256 of the uploaded source archive.')
-
-        choice(name: 'PROJECT_TYPE', choices: ['Expo', 'React Native CLI'], description: 'Mobile project type')
-        choice(name: 'BUILD_ENVIRONMENT', choices: ['Development', 'Staging', 'Production'], description: 'Build environment')
-        choice(name: 'BUILD_OUTPUT', choices: ['Development Client', 'Debug APK', 'Release APK', 'Release AAB'], description: 'Build output')
-        choice(name: 'BUILD_PROFILE', choices: ['FAST', 'CLEAN', 'FULL_RESET'], description: 'Build profile')
-
-        string(name: 'SOURCE_REVISION', defaultValue: 'local', description: 'Local Git revision if available.')
-        booleanParam(name: 'SOURCE_DIRTY', defaultValue: false, description: 'True when the developer had uncommitted changes.')
-        booleanParam(name: 'VERBOSE_BUILD', defaultValue: false, description: 'Enable Gradle --stacktrace and --info logs.')
-    }
-
-    stages {
-        stage('Validate Request') {
-            steps {
-                script {
-                    if (!params.PROJECT_ID?.trim() || !(params.PROJECT_ID ==~ /[A-Za-z0-9._-]+/)) {
-                        error 'PROJECT_ID is missing or invalid.'
-                    }
-                    if (!params.APP_NAME?.trim() || params.APP_NAME.trim().length() > 80 || !(params.APP_NAME ==~ /[A-Za-z0-9][A-Za-z0-9 ._-]*/)) {
-                        error 'APP_NAME must be 1-80 characters using letters, numbers, spaces, dots, underscores, or hyphens.'
-                    }
-                    if (!params.APP_VERSION?.trim() || !(params.APP_VERSION ==~ /\d+(?:\.\d+)*/)) {
-                        error 'APP_VERSION must be numeric dotted text such as 0.1 or 1.2.3.'
-                    }
-                    if (!params.APP_VERSION_CODE?.trim() || !(params.APP_VERSION_CODE ==~ /\d+/)) {
-                        error 'APP_VERSION_CODE must be a positive integer.'
-                    }
-                    def parsedVersionCode = params.APP_VERSION_CODE.toLong()
-                    if (parsedVersionCode < 1 || parsedVersionCode > 2100000000L) {
-                        error 'APP_VERSION_CODE must be between 1 and 2100000000.'
-                    }
-                    if (!(params.SOURCE_SHA256 ==~ /[a-fA-F0-9]{64}/)) {
-                        error 'SOURCE_SHA256 must be a 64-character SHA-256 digest.'
-                    }
-
-                    env.APP_ROOT = "${env.MOBILE_BUILDER_HOME}/${params.PROJECT_ID}"
-                    env.SOURCE_DIR = "${env.WORKSPACE}/source"
-                    env.ARTIFACT_ROOT = "${env.APP_ROOT}/artifacts"
-                    env.LOG_ROOT = "${env.APP_ROOT}/logs"
-                    env.BUILD_ARTIFACT_DIR = "${env.ARTIFACT_ROOT}/build-${env.BUILD_NUMBER}"
-                    env.BUILD_LOG_FILE = "${env.BUILD_ARTIFACT_DIR}/build.log"
-                    env.BUILD_JSON_FILE = "${env.BUILD_ARTIFACT_DIR}/build.json"
-
-                    // Reuse the Jenkins machine's shared Gradle cache. The previous
-                    // Git-based mobile pipeline used the normal Jenkins HOME/.gradle
-                    // cache, so already-installed wrapper distributions are available
-                    // without downloading Gradle again for every IndraQ source snapshot.
-                    def serverHome = env.HOME?.trim() ?: '/var/jenkins_home'
-                    env.GRADLE_USER_HOME = "${serverHome}/.gradle"
-
-                    // npm / Expo caches remain project-scoped so FULL_RESET cannot
-                    // destroy caches used by unrelated Jenkins jobs.
-                    env.NPM_CONFIG_CACHE = "${env.APP_ROOT}/.npm-cache"
-                    env.EXPO_HOME = "${env.APP_ROOT}/.expo-home"
-
-                    env.NODE_ENV_VALUE = params.BUILD_ENVIRONMENT == 'Development' ? 'development' : 'production'
-
-                    if (params.PROJECT_TYPE == 'Expo') {
-                        if (params.BUILD_ENVIRONMENT == 'Development' && params.BUILD_OUTPUT != 'Development Client') {
-                            error 'Invalid combination: Expo Development only supports Development Client.'
-                        }
-                        if ((params.BUILD_ENVIRONMENT == 'Staging' || params.BUILD_ENVIRONMENT == 'Production') &&
-                            !(params.BUILD_OUTPUT in ['Release APK', 'Release AAB'])) {
-                            error "Invalid combination: Expo ${params.BUILD_ENVIRONMENT} only supports Release APK or Release AAB."
-                        }
-                    } else if (params.PROJECT_TYPE == 'React Native CLI') {
-                        if (params.BUILD_ENVIRONMENT == 'Development' && params.BUILD_OUTPUT != 'Debug APK') {
-                            error 'Invalid combination: React Native CLI Development only supports Debug APK.'
-                        }
-                        if ((params.BUILD_ENVIRONMENT == 'Staging' || params.BUILD_ENVIRONMENT == 'Production') &&
-                            !(params.BUILD_OUTPUT in ['Release APK', 'Release AAB'])) {
-                            error "Invalid combination: React Native CLI ${params.BUILD_ENVIRONMENT} only supports Release APK or Release AAB."
-                        }
-                    } else {
-                        error "Unknown PROJECT_TYPE: ${params.PROJECT_TYPE}"
-                    }
-
-                    switch (params.BUILD_OUTPUT) {
-                        case 'Development Client':
-                            env.GRADLE_TASK = 'assembleDebug'
-                            env.NEEDS_ENV_FILE = 'false'
-                            env.ARTIFACT_EXT = 'apk'
-                            env.ARTIFACT_SEARCH_DIR = "${env.SOURCE_DIR}/android/app/build/outputs/apk/debug"
-                            env.ARTIFACT_FILE_PATTERN = '*.apk'
-                            break
-                        case 'Debug APK':
-                            env.GRADLE_TASK = 'assembleDebug'
-                            env.NEEDS_ENV_FILE = 'true'
-                            env.ARTIFACT_EXT = 'apk'
-                            env.ARTIFACT_SEARCH_DIR = "${env.SOURCE_DIR}/android/app/build/outputs/apk/debug"
-                            env.ARTIFACT_FILE_PATTERN = '*.apk'
-                            break
-                        case 'Release APK':
-                            env.GRADLE_TASK = 'assembleRelease'
-                            env.NEEDS_ENV_FILE = 'true'
-                            env.ARTIFACT_EXT = 'apk'
-                            env.ARTIFACT_SEARCH_DIR = "${env.SOURCE_DIR}/android/app/build/outputs/apk/release"
-                            env.ARTIFACT_FILE_PATTERN = '*.apk'
-                            break
-                        case 'Release AAB':
-                            env.GRADLE_TASK = 'bundleRelease'
-                            env.NEEDS_ENV_FILE = 'true'
-                            env.ARTIFACT_EXT = 'aab'
-                            env.ARTIFACT_SEARCH_DIR = "${env.SOURCE_DIR}/android/app/build/outputs/bundle/release"
-                            env.ARTIFACT_FILE_PATTERN = '*.aab'
-                            break
-                        default:
-                            error "Unknown BUILD_OUTPUT: ${params.BUILD_OUTPUT}"
-                    }
-
-                    echo '========== IndraQ Mobile Build Request =========='
-                    echo "App: ${params.APP_NAME}"
-                    echo "Project ID: ${params.PROJECT_ID}"
-                    echo "Version: ${params.APP_VERSION}"
-                    echo "versionCode: ${params.APP_VERSION_CODE}"
-                    echo "Project type: ${params.PROJECT_TYPE}"
-                    echo "Environment: ${params.BUILD_ENVIRONMENT}"
-                    echo "Output: ${params.BUILD_OUTPUT}"
-                    echo "Profile: ${params.BUILD_PROFILE}"
-                    echo "Source revision: ${params.SOURCE_REVISION}"
-                    echo "Source has local changes: ${params.SOURCE_DIRTY}"
-                    echo "Gradle task: ${env.GRADLE_TASK}"
-                }
-            }
-        }
-
-        stage('Prepare Folders') {
-            steps {
-                sh '''#!/usr/bin/env bash
-set -Eeuo pipefail
-mkdir -p "$APP_ROOT" "$ARTIFACT_ROOT" "$LOG_ROOT" "$BUILD_ARTIFACT_DIR" "$GRADLE_USER_HOME" "$NPM_CONFIG_CACHE" "$EXPO_HOME"
-rm -rf "$SOURCE_DIR"
-mkdir -p "$SOURCE_DIR"
-touch "$BUILD_LOG_FILE"
-'''
-            }
-        }
-
-        stage('Receive Source Snapshot') {
-            steps {
-                dir("${env.SOURCE_DIR}") {
-                    unstash 'SOURCE_BUNDLE'
-                    sh '''#!/usr/bin/env bash
-set -Eeuo pipefail
-exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
-
-ACTUAL_SHA=$(sha256sum SOURCE_BUNDLE | awk '{print $1}')
-if [ "$ACTUAL_SHA" != "$SOURCE_SHA256" ]; then
-  echo "Source bundle SHA-256 mismatch."
-  echo "Expected: $SOURCE_SHA256"
-  echo "Actual:   $ACTUAL_SHA"
-  exit 1
-fi
-
-if tar -tzf SOURCE_BUNDLE | grep -Eq '(^/|(^|/)[.][.](/|$))'; then
-  echo "Unsafe path detected inside uploaded source archive."
-  exit 1
-fi
-
-tar -xzf SOURCE_BUNDLE --strip-components=1
-rm -f SOURCE_BUNDLE
-
-echo "Source snapshot verified and extracted."
-'''
-                }
-            }
-        }
-
-        stage('Prepare Environment') {
-            steps {
-                dir("${env.SOURCE_DIR}") {
-                    unstash 'ENV_FILE'
-                    sh '''#!/usr/bin/env bash
-set -Eeuo pipefail
-set +x
-
-if [ "$NEEDS_ENV_FILE" = "true" ] && [ ! -s ENV_FILE ]; then
-  echo "A non-empty root .env file is required for this build output."
-  exit 1
-fi
-
-if [ -s ENV_FILE ]; then
-  mv ENV_FILE .env
-  chmod 600 .env || true
-  echo "Root .env received. Values are hidden."
-else
-  rm -f ENV_FILE
-  echo "No root .env supplied; this build output does not require one."
-fi
-'''
-                }
-            }
-        }
-
-        stage('Cleanup Old Build Files') {
-            steps {
-                sh '''#!/usr/bin/env bash
-set -Eeuo pipefail
-exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
-RETENTION_DAYS="${BUILD_RETENTION_DAYS:-30}"
-
-if ! [[ "$RETENTION_DAYS" =~ ^[0-9]+$ ]] || [ "$RETENTION_DAYS" -lt 1 ]; then
-  echo "Invalid BUILD_RETENTION_DAYS: $RETENTION_DAYS"
-  exit 1
-fi
-
-if [ -d "$ARTIFACT_ROOT" ]; then
-  while IFS= read -r -d '' OLD_BUILD_DIR; do
-    [ "$OLD_BUILD_DIR" = "$BUILD_ARTIFACT_DIR" ] && continue
-    if ! find "$OLD_BUILD_DIR" -type f -mtime "-$RETENTION_DAYS" -print -quit | grep -q .; then
-      echo "Deleting old artifact directory: $OLD_BUILD_DIR"
-      rm -rf -- "$OLD_BUILD_DIR"
-    fi
-  done < <(find "$ARTIFACT_ROOT" -mindepth 1 -maxdepth 1 -type d -name 'build-*' -print0)
-fi
-
-echo "Cleanup completed."
-'''
-            }
-        }
-
-        stage('FULL_RESET') {
-            when {
-                expression { params.BUILD_PROFILE == 'FULL_RESET' }
-            }
-            steps {
-                sh '''#!/usr/bin/env bash
-set -Eeuo pipefail
-exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
-
-echo "FULL_RESET: clearing project-local npm/Expo caches and generated build state."
-echo "Shared Jenkins Gradle cache is intentionally preserved: $GRADLE_USER_HOME"
-rm -rf "$NPM_CONFIG_CACHE" "$EXPO_HOME"
-mkdir -p "$NPM_CONFIG_CACHE" "$EXPO_HOME"
-
-# The uploaded source tree is already fresh, but clear Android-generated state
-# so FULL_RESET remains stronger than CLEAN without deleting the server's
-# shared Gradle distributions/caches.
-rm -rf "$SOURCE_DIR/android/.gradle" "$SOURCE_DIR/android/build" "$SOURCE_DIR/android/app/build"
-'''
-            }
-        }
-
-        stage('Environment Check') {
-            steps {
-                dir("${env.SOURCE_DIR}") {
-                    sh '''#!/usr/bin/env bash
-set -Eeuo pipefail
-exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
-
-echo "========== Build Machine =========="
-echo "JAVA:"
-java -version
-echo "NODE:"
-node -v
-echo "NPM:"
-npm -v
-echo "ANDROID SDK:"
-echo "ANDROID_HOME=$ANDROID_HOME"
-echo "ANDROID_SDK_ROOT=$ANDROID_SDK_ROOT"
-echo "GRADLE CACHE:"
-echo "GRADLE_USER_HOME=$GRADLE_USER_HOME"
-if command -v gradle >/dev/null 2>&1; then
-  echo "SYSTEM GRADLE:"
-  gradle --version | sed -n '1,8p'
-else
-  echo "SYSTEM GRADLE: not in PATH (project wrapper will use the shared Jenkins Gradle cache)."
-fi
-echo "ANDROID CLI:"
-sdkmanager --version || true
-'''
-                }
-            }
-        }
-
-        stage('CLEAN') {
-            when {
-                expression { params.BUILD_PROFILE == 'CLEAN' }
-            }
-            steps {
-                dir("${env.SOURCE_DIR}") {
-                    sh '''#!/usr/bin/env bash
-set -Eeuo pipefail
-exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
-
-rm -rf node_modules .gradle .metro .turbo dist build coverage
-if [ "$PROJECT_TYPE" = "Expo" ]; then
-  rm -rf android ios .expo
-else
-  rm -rf android/.gradle android/build android/app/build android/.cxx android/app/.cxx
-fi
-
-echo "Project-level CLEAN completed."
-'''
-                }
-            }
-        }
-
-        stage('Install Dependencies') {
-            steps {
-                dir("${env.SOURCE_DIR}") {
-                    sh '''#!/usr/bin/env bash
-set -Eeuo pipefail
-exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
-
-if [ ! -f package.json ]; then
-  echo "package.json is missing from the uploaded project root."
-  exit 1
-fi
-
-if [ "$BUILD_PROFILE" = "FAST" ]; then
-  npm install --prefer-offline --no-audit
-elif [ -f package-lock.json ]; then
-  npm ci --no-audit
-else
-  npm install --no-audit
-fi
-'''
-                }
-            }
-        }
-
-        stage('Validate Project Type') {
-            steps {
-                dir("${env.SOURCE_DIR}") {
-                    sh '''#!/usr/bin/env bash
-set -Eeuo pipefail
-exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
-
-node <<'NODE'
-const fs = require('fs');
-const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
-const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
-const projectType = process.env.PROJECT_TYPE;
-if (projectType === 'Expo' && !deps.expo) throw new Error('Expo selected, but expo is missing from package.json.');
-if (projectType === 'React Native CLI' && !deps['react-native']) throw new Error('React Native CLI selected, but react-native is missing from package.json.');
-NODE
-
-if [ "$PROJECT_TYPE" = "React Native CLI" ]; then
-  [ -d android ] || { echo "React Native CLI project must contain android/."; exit 1; }
-  [ -f android/gradlew ] || { echo "android/gradlew not found."; exit 1; }
-fi
-'''
-                }
-            }
-        }
-
-        stage('Validate Development Client') {
-            when {
-                expression { params.PROJECT_TYPE == 'Expo' && params.BUILD_OUTPUT == 'Development Client' }
-            }
-            steps {
-                dir("${env.SOURCE_DIR}") {
-                    sh '''#!/usr/bin/env bash
-set -Eeuo pipefail
-node <<'NODE'
-const fs = require('fs');
-const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
-const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
-if (!deps['expo-dev-client']) throw new Error('Development Client requires expo-dev-client. Run: npx expo install expo-dev-client');
-NODE
-'''
-                }
-            }
-        }
-
-        stage('Expo Prebuild') {
-            when {
-                expression { params.PROJECT_TYPE == 'Expo' }
-            }
-            steps {
-                dir("${env.SOURCE_DIR}") {
-                    sh '''#!/usr/bin/env bash
-set -Eeuo pipefail
-exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
-if [ "$BUILD_PROFILE" = "FAST" ]; then
-  NODE_ENV="$NODE_ENV_VALUE" CI=1 npx expo prebuild --platform android
-else
-  NODE_ENV="$NODE_ENV_VALUE" CI=1 npx expo prebuild --platform android --clean
-fi
-'''
-                }
-            }
-        }
-
-        stage('Prepare Android Project') {
-            steps {
-                dir("${env.SOURCE_DIR}/android") {
-                    sh '''#!/usr/bin/env bash
-set -Eeuo pipefail
-exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
-
-[ -f gradlew ] || { echo "gradlew not found inside android/."; exit 1; }
-[ -f gradle/wrapper/gradle-wrapper.jar ] || { echo "gradle-wrapper.jar not found."; exit 1; }
-[ -f gradle/wrapper/gradle-wrapper.properties ] || { echo "gradle-wrapper.properties not found."; exit 1; }
-
-# The source snapshot can originate on Windows. A CRLF gradlew has a hidden
-# carriage return in its shebang and Linux reports:
-#   ./gradlew: cannot execute: required file not found
-# Normalize only the wrapper script; source files themselves are left intact.
-sed -i 's/\r$//' gradlew
-chmod +x gradlew
-
-# The Jenkins machine supplies Java, Android SDK/NDK and the shared Gradle
-# installation/cache. Keep the project wrapper as the compatibility source of
-# truth, but prefer an already-installed server Gradle when it exactly matches
-# the wrapper version. If the wrapper ever has to download, give it enough time
-# for a real network rather than Gradle's short default timeout.
-echo "sdk.dir=$ANDROID_HOME" > local.properties
-
-WRAPPER_PROPS="gradle/wrapper/gradle-wrapper.properties"
-if grep -q '^networkTimeout=' "$WRAPPER_PROPS"; then
-  sed -i 's/^networkTimeout=.*/networkTimeout=120000/' "$WRAPPER_PROPS"
-else
-  printf '\nnetworkTimeout=120000\n' >> "$WRAPPER_PROPS"
-fi
-
-WRAPPER_URL=$(grep '^distributionUrl=' "$WRAPPER_PROPS" | tail -n 1 | cut -d= -f2-)
-WRAPPER_FILE=$(basename "$WRAPPER_URL")
-WRAPPER_VERSION=${WRAPPER_FILE#gradle-}
-WRAPPER_VERSION=${WRAPPER_VERSION%-bin.zip}
-WRAPPER_VERSION=${WRAPPER_VERSION%-all.zip}
-SYSTEM_GRADLE_VERSION=''
-if command -v gradle >/dev/null 2>&1; then
-  SYSTEM_GRADLE_VERSION=$(gradle --version 2>/dev/null | awk '/^Gradle / { print $2; exit }')
-fi
-
-cat > .indraq-gradle <<'GRADLE_RUNNER'
-#!/usr/bin/env bash
-set -Eeuo pipefail
-WRAPPER_PROPS="gradle/wrapper/gradle-wrapper.properties"
-WRAPPER_URL=$(grep '^distributionUrl=' "$WRAPPER_PROPS" | tail -n 1 | cut -d= -f2-)
-WRAPPER_FILE=$(basename "$WRAPPER_URL")
-WRAPPER_VERSION=${WRAPPER_FILE#gradle-}
-WRAPPER_VERSION=${WRAPPER_VERSION%-bin.zip}
-WRAPPER_VERSION=${WRAPPER_VERSION%-all.zip}
-CACHED_GRADLE=''
-if [ -n "$WRAPPER_VERSION" ] && [ -d "${GRADLE_USER_HOME:-$HOME/.gradle}/wrapper/dists" ]; then
-  CACHED_GRADLE=$(find "${GRADLE_USER_HOME:-$HOME/.gradle}/wrapper/dists" -type f -path "*/gradle-$WRAPPER_VERSION/bin/gradle" -print -quit 2>/dev/null || true)
-fi
-
-# Exact cached wrapper distribution is safest because it matches the project.
-if [ -n "$CACHED_GRADLE" ]; then
-  exec bash ./gradlew "$@"
-fi
-
-# If the Jenkins host has Gradle installed, reuse it when it is the same major
-# line as the requested wrapper. This avoids an internet download while still
-# refusing obviously incompatible Gradle generations (for example 8.x vs 9.x).
-if command -v gradle >/dev/null 2>&1; then
-  SYSTEM_VERSION=$(gradle --version 2>/dev/null | awk '/^Gradle / { print $2; exit }')
-  WRAPPER_MAJOR=${WRAPPER_VERSION%%.*}
-  SYSTEM_MAJOR=${SYSTEM_VERSION%%.*}
-  if [ -n "$WRAPPER_MAJOR" ] && [ "$SYSTEM_MAJOR" = "$WRAPPER_MAJOR" ]; then
-    if [ "$SYSTEM_VERSION" != "$WRAPPER_VERSION" ]; then
-      echo "IndraQ: using server Gradle $SYSTEM_VERSION for wrapper request $WRAPPER_VERSION (same major version)." >&2
-    fi
-    exec gradle "$@"
-  fi
-fi
-
-# Last resort: project wrapper. Its networkTimeout is raised to 120 seconds and
-# it uses the shared Jenkins Gradle cache, so any download happens at most once.
-exec bash ./gradlew "$@"
-GRADLE_RUNNER
-chmod +x .indraq-gradle
-
-CACHED_GRADLE=''
-if [ -n "$WRAPPER_VERSION" ] && [ -d "$GRADLE_USER_HOME/wrapper/dists" ]; then
-  CACHED_GRADLE=$(find "$GRADLE_USER_HOME/wrapper/dists" -type f -path "*/gradle-$WRAPPER_VERSION/bin/gradle" -print -quit 2>/dev/null || true)
-fi
-
-echo "========== Android Build Toolchain =========="
-echo "Android SDK        : $ANDROID_HOME"
-echo "Shared Gradle cache: $GRADLE_USER_HOME"
-echo "Wrapper shebang    : $(head -n 1 gradlew)"
-echo "Wrapper Gradle     : ${WRAPPER_VERSION:-unknown}"
-if [ -n "$SYSTEM_GRADLE_VERSION" ]; then
-  echo "System Gradle      : $SYSTEM_GRADLE_VERSION"
-else
-  echo "System Gradle      : not in PATH"
-fi
-if [ -n "$CACHED_GRADLE" ]; then
-  echo "Cached wrapper     : yes ($CACHED_GRADLE)"
-elif [ -n "$SYSTEM_GRADLE_VERSION" ] && [ "$SYSTEM_GRADLE_VERSION" = "$WRAPPER_VERSION" ]; then
-  echo "Gradle source      : matching server Gradle executable"
-else
-  echo "Cached wrapper     : not found; wrapper may download once (timeout raised to 120s)."
-fi
-if [ -d "$ANDROID_HOME/ndk" ]; then
-  echo "Installed NDKs:"
-  find "$ANDROID_HOME/ndk" -mindepth 1 -maxdepth 1 -type d -printf '  %f\n' | sort || true
-fi
-echo "============================================="
-'''
-                }
-            }
-        }
-
-        stage('Apply Android Version') {
-            steps {
-                dir("${env.SOURCE_DIR}") {
-                    sh '''#!/usr/bin/env bash
-set -Eeuo pipefail
-exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
-
-node <<'NODE'
-const fs = require('fs');
-const path = require('path');
-const version = process.env.APP_VERSION;
-const versionCode = process.env.APP_VERSION_CODE;
-const candidates = [
-  path.join('android', 'app', 'build.gradle'),
-  path.join('android', 'app', 'build.gradle.kts')
-];
-const gradleFile = candidates.find((candidate) => fs.existsSync(candidate));
-if (!gradleFile) throw new Error('android/app/build.gradle or build.gradle.kts was not found.');
-
-const original = fs.readFileSync(gradleFile, 'utf8');
-let codeUpdated = false;
-let nameUpdated = false;
-const lines = original.split(/\\r?\\n/).map((line) => {
-  if (!codeUpdated) {
-    let match = line.match(/^(\\s*versionCode\\s*=\\s*).+$/);
-    if (match) {
-      codeUpdated = true;
-      return `${match[1]}${versionCode}`;
-    }
-    match = line.match(/^(\\s*versionCode\\s+).+$/);
-    if (match) {
-      codeUpdated = true;
-      return `${match[1]}${versionCode}`;
-    }
-  }
-  if (!nameUpdated) {
-    let match = line.match(/^(\\s*versionName\\s*=\\s*).+$/);
-    if (match) {
-      nameUpdated = true;
-      return `${match[1]}"${version}"`;
-    }
-    match = line.match(/^(\\s*versionName\\s+).+$/);
-    if (match) {
-      nameUpdated = true;
-      return `${match[1]}"${version}"`;
-    }
-  }
-  return line;
-});
-
-if (!codeUpdated || !nameUpdated) {
-  throw new Error(`Unable to apply Android version. versionCode updated=${codeUpdated}, versionName updated=${nameUpdated}. Check ${gradleFile}.`);
-}
-fs.writeFileSync(gradleFile, lines.join('\\n'));
-console.log(`Android version applied in ${gradleFile}: versionName=${version}, versionCode=${versionCode}`);
-NODE
-'''
-                }
-            }
-        }
-
-        stage('Gradle Clean') {
-            when {
-                expression { params.BUILD_PROFILE == 'CLEAN' || params.BUILD_PROFILE == 'FULL_RESET' }
-            }
-            steps {
-                dir("${env.SOURCE_DIR}/android") {
-                    sh '''#!/usr/bin/env bash
-set -Eeuo pipefail
-exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
-bash ./.indraq-gradle --stop || true
-NODE_ENV="$NODE_ENV_VALUE" bash ./.indraq-gradle clean --console=plain --no-build-cache
-'''
-                }
-            }
-        }
-
-        stage('Build Android') {
-            steps {
-                dir("${env.SOURCE_DIR}/android") {
-                    script {
-                        if (params.BUILD_PROFILE == 'FAST') {
-                            if (params.VERBOSE_BUILD) {
-                                sh '''#!/usr/bin/env bash
-set -Eeuo pipefail
-exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
-NODE_ENV="$NODE_ENV_VALUE" bash ./.indraq-gradle "$GRADLE_TASK" --console=plain --stacktrace --info
-'''
-                            } else {
-                                sh '''#!/usr/bin/env bash
-set -Eeuo pipefail
-exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
-NODE_ENV="$NODE_ENV_VALUE" bash ./.indraq-gradle "$GRADLE_TASK" --console=plain
-'''
-                            }
-                        } else if (params.VERBOSE_BUILD) {
-                            sh '''#!/usr/bin/env bash
-set -Eeuo pipefail
-exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
-NODE_ENV="$NODE_ENV_VALUE" bash ./.indraq-gradle "$GRADLE_TASK" --console=plain --no-build-cache --rerun-tasks --stacktrace --info
-'''
-                        } else {
-                            sh '''#!/usr/bin/env bash
-set -Eeuo pipefail
-exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
-NODE_ENV="$NODE_ENV_VALUE" bash ./.indraq-gradle "$GRADLE_TASK" --console=plain --no-build-cache --rerun-tasks
-'''
-                        }
-                    }
-                }
-            }
-        }
-
-        stage('Generate Build Metadata') {
-            steps {
-                sh '''#!/usr/bin/env bash
-set -Eeuo pipefail
-exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
-BUILD_TIME=$(TZ=Asia/Kolkata date '+%Y-%m-%dT%H:%M:%S%z')
-cat > "$BUILD_JSON_FILE" <<JSON
-{
-  "app": "$APP_NAME",
-  "projectId": "$PROJECT_ID",
-  "version": "$APP_VERSION",
-  "versionCode": $APP_VERSION_CODE,
-  "projectType": "$PROJECT_TYPE",
-  "environment": "$BUILD_ENVIRONMENT",
-  "output": "$BUILD_OUTPUT",
-  "profile": "$BUILD_PROFILE",
-  "buildNumber": "$BUILD_NUMBER",
-  "sourceRevision": "$SOURCE_REVISION",
-  "sourceDirty": "$SOURCE_DIRTY",
-  "sourceSha256": "$SOURCE_SHA256",
-  "buildTime": "$BUILD_TIME"
-}
-JSON
-cat "$BUILD_JSON_FILE"
-'''
-            }
-        }
-
-        stage('Collect Artifacts') {
-            steps {
-                sh '''#!/usr/bin/env bash
-set -Eeuo pipefail
-exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
-
-rm -rf "$WORKSPACE/jenkins-artifacts"
-mkdir -p "$WORKSPACE/jenkins-artifacts"
-
-[ -d "$ARTIFACT_SEARCH_DIR" ] || { echo "Artifact directory does not exist: $ARTIFACT_SEARCH_DIR"; exit 1; }
-mapfile -t ARTIFACTS < <(find "$ARTIFACT_SEARCH_DIR" -maxdepth 1 -type f -name "$ARTIFACT_FILE_PATTERN" | sort)
-[ "${#ARTIFACTS[@]}" -gt 0 ] || { echo "No .$ARTIFACT_EXT artifact found."; exit 1; }
-
-PRIMARY_ARTIFACT="${ARTIFACTS[0]}"
-SAFE_APP_NAME=$(printf '%s' "$APP_NAME" | sed -E 's/[^A-Za-z0-9._-]+/_/g; s/^_+//; s/_+$//')
-[ -n "$SAFE_APP_NAME" ] || SAFE_APP_NAME="app"
-BUILD_STAMP=$(TZ=Asia/Kolkata date '+%Y-%m-%d_%H%M')
-PRIMARY_ARTIFACT_NAME="${SAFE_APP_NAME}_${APP_VERSION}_${APP_VERSION_CODE}_${BUILD_STAMP}.${ARTIFACT_EXT}"
-
-cp "$PRIMARY_ARTIFACT" "$WORKSPACE/jenkins-artifacts/$PRIMARY_ARTIFACT_NAME"
-cp "$PRIMARY_ARTIFACT" "$BUILD_ARTIFACT_DIR/$PRIMARY_ARTIFACT_NAME"
-cp "$BUILD_LOG_FILE" "$WORKSPACE/jenkins-artifacts/build.log"
-cp "$BUILD_JSON_FILE" "$WORKSPACE/jenkins-artifacts/build.json"
-echo "$PRIMARY_ARTIFACT_NAME" > "$WORKSPACE/jenkins-artifacts/primary-artifact-name.txt"
-
-echo "Primary artifact: $PRIMARY_ARTIFACT_NAME"
-echo "Artifact timestamp timezone: Asia/Kolkata (IST)"
-'''
-            }
-        }
-
-        stage('Archive & Publish Download Link') {
-            steps {
-                script {
-                    archiveArtifacts(artifacts: 'jenkins-artifacts/**/*', allowEmptyArchive: false, fingerprint: true)
-                    env.PRIMARY_ARTIFACT_NAME = readFile("${env.WORKSPACE}/jenkins-artifacts/primary-artifact-name.txt").trim()
-                    env.PRIMARY_ARTIFACT_URL = "${env.BUILD_URL}artifact/jenkins-artifacts/${env.PRIMARY_ARTIFACT_NAME}"
-                    currentBuild.description = "Download: ${env.PRIMARY_ARTIFACT_NAME}"
-                    echo '=============================================='
-                    echo 'DOWNLOAD READY'
-                    echo "File: ${env.PRIMARY_ARTIFACT_NAME}"
-                    echo "URL: ${env.PRIMARY_ARTIFACT_URL}"
-                    echo '=============================================='
-                }
-            }
-        }
-    }
-
-    post {
-        always {
-            sh '''#!/usr/bin/env bash
-set +e
-# Never leave the developer's environment file in the Jenkins workspace.
-if [ -n "${SOURCE_DIR:-}" ] && [ "$SOURCE_DIR" != "/" ]; then
-  rm -f "$SOURCE_DIR/.env" "$SOURCE_DIR/ENV_FILE"
-fi
-if [ -n "${WORKSPACE:-}" ] && [ "$WORKSPACE" != "/" ]; then
-  rm -f "$WORKSPACE/ENV_FILE" "$WORKSPACE/SOURCE_BUNDLE"
-fi
-'''
-        }
-        success {
-            echo '=============================================='
-            echo 'BUILD SUCCESSFUL'
-            echo "App: ${params.APP_NAME}"
-            echo "Version: ${params.APP_VERSION}"
-            echo "versionCode: ${params.APP_VERSION_CODE}"
-            echo "Environment: ${params.BUILD_ENVIRONMENT}"
-            echo "Output: ${params.BUILD_OUTPUT}"
-            echo "Profile: ${params.BUILD_PROFILE}"
-            echo "File: ${env.PRIMARY_ARTIFACT_NAME}"
-            echo "Download: ${env.PRIMARY_ARTIFACT_URL}"
-            echo "Server backup: ${env.BUILD_ARTIFACT_DIR}"
-            echo '=============================================='
-        }
-        failure {
-            echo '=============================================='
-            echo 'BUILD FAILED'
-            echo "App: ${params.APP_NAME}"
-            echo "Version: ${params.APP_VERSION}"
-            echo "versionCode: ${params.APP_VERSION_CODE}"
-            echo "Environment: ${params.BUILD_ENVIRONMENT}"
-            echo "Output: ${params.BUILD_OUTPUT}"
-            echo "Profile: ${params.BUILD_PROFILE}"
-            echo 'Check console logs above.'
-            echo '=============================================='
-        }
-    }
-}
+pipeline {
+    agent any
+
+    options {
+        timestamps()
+        disableConcurrentBuilds()
+        buildDiscarder(logRotator(daysToKeepStr: '30', numToKeepStr: '30', artifactDaysToKeepStr: '30', artifactNumToKeepStr: '30'))
+        skipDefaultCheckout(true)
+    }
+
+    environment {
+        ANDROID_HOME = '/opt/android-sdk'
+        ANDROID_SDK_ROOT = '/opt/android-sdk'
+        MOBILE_BUILDER_HOME = '/opt/mobile-builder'
+        CI = '1'
+        BUILD_RETENTION_DAYS = '30'
+        PATH = "/opt/android-sdk/cmdline-tools/latest/bin:/opt/android-sdk/platform-tools:/usr/local/bin:/usr/bin:/bin:${env.PATH}"
+    }
+
+    parameters {
+        // Requires Jenkins "File Parameter" plugin (ID: file-parameters).
+        // IndraQ CLI uploads both files through Jenkins buildWithParameters.
+        stashedFile 'SOURCE_BUNDLE'
+        stashedFile 'ENV_FILE'
+
+        string(name: 'PROJECT_ID', defaultValue: '', description: 'Stable IndraQ project ID. Supplied by IndraQ CLI.')
+        string(name: 'APP_NAME', defaultValue: '', description: 'Application name. Supplied by IndraQ CLI.')
+        string(name: 'APP_VERSION', defaultValue: '0.1', description: 'Android versionName supplied by IndraQ CLI.')
+        string(name: 'APP_VERSION_CODE', defaultValue: '1', description: 'Android versionCode supplied by IndraQ CLI.')
+        string(name: 'SOURCE_SHA256', defaultValue: '', description: 'SHA-256 of the uploaded source archive.')
+
+        choice(name: 'PROJECT_TYPE', choices: ['Expo', 'React Native CLI'], description: 'Mobile project type')
+        choice(name: 'BUILD_ENVIRONMENT', choices: ['Development', 'Staging', 'Production'], description: 'Build environment')
+        choice(name: 'BUILD_OUTPUT', choices: ['Development Client', 'Debug APK', 'Release APK', 'Release AAB'], description: 'Build output')
+        choice(name: 'BUILD_PROFILE', choices: ['FAST', 'CLEAN', 'FULL_RESET'], description: 'Build profile')
+
+        string(name: 'SOURCE_REVISION', defaultValue: 'local', description: 'Local Git revision if available.')
+        booleanParam(name: 'SOURCE_DIRTY', defaultValue: false, description: 'True when the developer had uncommitted changes.')
+        booleanParam(name: 'VERBOSE_BUILD', defaultValue: false, description: 'Enable Gradle --stacktrace and --info logs.')
+    }
+
+    stages {
+        stage('Validate Request') {
+            steps {
+                script {
+                    if (!params.PROJECT_ID?.trim() || !(params.PROJECT_ID ==~ /[A-Za-z0-9._-]+/)) {
+                        error 'PROJECT_ID is missing or invalid.'
+                    }
+                    if (!params.APP_NAME?.trim() || params.APP_NAME.trim().length() > 80 || !(params.APP_NAME ==~ /[A-Za-z0-9][A-Za-z0-9 ._-]*/)) {
+                        error 'APP_NAME must be 1-80 characters using letters, numbers, spaces, dots, underscores, or hyphens.'
+                    }
+                    if (!params.APP_VERSION?.trim() || !(params.APP_VERSION ==~ /\d+(?:\.\d+)*/)) {
+                        error 'APP_VERSION must be numeric dotted text such as 0.1 or 1.2.3.'
+                    }
+                    if (!params.APP_VERSION_CODE?.trim() || !(params.APP_VERSION_CODE ==~ /\d+/)) {
+                        error 'APP_VERSION_CODE must be a positive integer.'
+                    }
+                    def parsedVersionCode = params.APP_VERSION_CODE.toLong()
+                    if (parsedVersionCode < 1 || parsedVersionCode > 2100000000L) {
+                        error 'APP_VERSION_CODE must be between 1 and 2100000000.'
+                    }
+                    if (!(params.SOURCE_SHA256 ==~ /[a-fA-F0-9]{64}/)) {
+                        error 'SOURCE_SHA256 must be a 64-character SHA-256 digest.'
+                    }
+
+                    env.APP_ROOT = "${env.MOBILE_BUILDER_HOME}/${params.PROJECT_ID}"
+                    env.SOURCE_DIR = "${env.WORKSPACE}/source"
+                    env.ARTIFACT_ROOT = "${env.APP_ROOT}/artifacts"
+                    env.LOG_ROOT = "${env.APP_ROOT}/logs"
+                    env.BUILD_ARTIFACT_DIR = "${env.ARTIFACT_ROOT}/build-${env.BUILD_NUMBER}"
+                    env.BUILD_LOG_FILE = "${env.BUILD_ARTIFACT_DIR}/build.log"
+                    env.BUILD_JSON_FILE = "${env.BUILD_ARTIFACT_DIR}/build.json"
+
+                    // Reuse the Jenkins machine's shared Gradle cache. The previous
+                    // Git-based mobile pipeline used the normal Jenkins HOME/.gradle
+                    // cache, so already-installed wrapper distributions are available
+                    // without downloading Gradle again for every IndraQ source snapshot.
+                    def serverHome = env.HOME?.trim() ?: '/var/jenkins_home'
+                    env.GRADLE_USER_HOME = "${serverHome}/.gradle"
+
+                    // npm / Expo caches remain project-scoped so FULL_RESET cannot
+                    // destroy caches used by unrelated Jenkins jobs.
+                    env.NPM_CONFIG_CACHE = "${env.APP_ROOT}/.npm-cache"
+                    env.EXPO_HOME = "${env.APP_ROOT}/.expo-home"
+
+                    env.NODE_ENV_VALUE = params.BUILD_ENVIRONMENT == 'Development' ? 'development' : 'production'
+
+                    if (params.PROJECT_TYPE == 'Expo') {
+                        if (params.BUILD_ENVIRONMENT == 'Development' && params.BUILD_OUTPUT != 'Development Client') {
+                            error 'Invalid combination: Expo Development only supports Development Client.'
+                        }
+                        if ((params.BUILD_ENVIRONMENT == 'Staging' || params.BUILD_ENVIRONMENT == 'Production') &&
+                            !(params.BUILD_OUTPUT in ['Release APK', 'Release AAB'])) {
+                            error "Invalid combination: Expo ${params.BUILD_ENVIRONMENT} only supports Release APK or Release AAB."
+                        }
+                    } else if (params.PROJECT_TYPE == 'React Native CLI') {
+                        if (params.BUILD_ENVIRONMENT == 'Development' && params.BUILD_OUTPUT != 'Debug APK') {
+                            error 'Invalid combination: React Native CLI Development only supports Debug APK.'
+                        }
+                        if ((params.BUILD_ENVIRONMENT == 'Staging' || params.BUILD_ENVIRONMENT == 'Production') &&
+                            !(params.BUILD_OUTPUT in ['Release APK', 'Release AAB'])) {
+                            error "Invalid combination: React Native CLI ${params.BUILD_ENVIRONMENT} only supports Release APK or Release AAB."
+                        }
+                    } else {
+                        error "Unknown PROJECT_TYPE: ${params.PROJECT_TYPE}"
+                    }
+
+                    switch (params.BUILD_OUTPUT) {
+                        case 'Development Client':
+                            env.GRADLE_TASK = 'assembleDebug'
+                            env.NEEDS_ENV_FILE = 'false'
+                            env.ARTIFACT_EXT = 'apk'
+                            env.ARTIFACT_SEARCH_DIR = "${env.SOURCE_DIR}/android/app/build/outputs/apk/debug"
+                            env.ARTIFACT_FILE_PATTERN = '*.apk'
+                            break
+                        case 'Debug APK':
+                            env.GRADLE_TASK = 'assembleDebug'
+                            env.NEEDS_ENV_FILE = 'true'
+                            env.ARTIFACT_EXT = 'apk'
+                            env.ARTIFACT_SEARCH_DIR = "${env.SOURCE_DIR}/android/app/build/outputs/apk/debug"
+                            env.ARTIFACT_FILE_PATTERN = '*.apk'
+                            break
+                        case 'Release APK':
+                            env.GRADLE_TASK = 'assembleRelease'
+                            env.NEEDS_ENV_FILE = 'true'
+                            env.ARTIFACT_EXT = 'apk'
+                            env.ARTIFACT_SEARCH_DIR = "${env.SOURCE_DIR}/android/app/build/outputs/apk/release"
+                            env.ARTIFACT_FILE_PATTERN = '*.apk'
+                            break
+                        case 'Release AAB':
+                            env.GRADLE_TASK = 'bundleRelease'
+                            env.NEEDS_ENV_FILE = 'true'
+                            env.ARTIFACT_EXT = 'aab'
+                            env.ARTIFACT_SEARCH_DIR = "${env.SOURCE_DIR}/android/app/build/outputs/bundle/release"
+                            env.ARTIFACT_FILE_PATTERN = '*.aab'
+                            break
+                        default:
+                            error "Unknown BUILD_OUTPUT: ${params.BUILD_OUTPUT}"
+                    }
+
+                    echo '========== IndraQ Mobile Build Request =========='
+                    echo "App: ${params.APP_NAME}"
+                    echo "Project ID: ${params.PROJECT_ID}"
+                    echo "Version: ${params.APP_VERSION}"
+                    echo "versionCode: ${params.APP_VERSION_CODE}"
+                    echo "Project type: ${params.PROJECT_TYPE}"
+                    echo "Environment: ${params.BUILD_ENVIRONMENT}"
+                    echo "Output: ${params.BUILD_OUTPUT}"
+                    echo "Profile: ${params.BUILD_PROFILE}"
+                    echo "Source revision: ${params.SOURCE_REVISION}"
+                    echo "Source has local changes: ${params.SOURCE_DIRTY}"
+                    echo "Gradle task: ${env.GRADLE_TASK}"
+                }
+            }
+        }
+
+        stage('Prepare Folders') {
+            steps {
+                sh '''#!/usr/bin/env bash
+set -Eeuo pipefail
+mkdir -p "$APP_ROOT" "$ARTIFACT_ROOT" "$LOG_ROOT" "$BUILD_ARTIFACT_DIR" "$GRADLE_USER_HOME" "$NPM_CONFIG_CACHE" "$EXPO_HOME"
+rm -rf "$SOURCE_DIR"
+mkdir -p "$SOURCE_DIR"
+touch "$BUILD_LOG_FILE"
+'''
+            }
+        }
+
+        stage('Receive Source Snapshot') {
+            steps {
+                dir("${env.SOURCE_DIR}") {
+                    unstash 'SOURCE_BUNDLE'
+                    sh '''#!/usr/bin/env bash
+set -Eeuo pipefail
+exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
+
+ACTUAL_SHA=$(sha256sum SOURCE_BUNDLE | awk '{print $1}')
+if [ "$ACTUAL_SHA" != "$SOURCE_SHA256" ]; then
+  echo "Source bundle SHA-256 mismatch."
+  echo "Expected: $SOURCE_SHA256"
+  echo "Actual:   $ACTUAL_SHA"
+  exit 1
+fi
+
+if tar -tzf SOURCE_BUNDLE | grep -Eq '(^/|(^|/)[.][.](/|$))'; then
+  echo "Unsafe path detected inside uploaded source archive."
+  exit 1
+fi
+
+tar -xzf SOURCE_BUNDLE --strip-components=1
+rm -f SOURCE_BUNDLE
+
+echo "Source snapshot verified and extracted."
+'''
+                }
+            }
+        }
+
+        stage('Prepare Environment') {
+            steps {
+                dir("${env.SOURCE_DIR}") {
+                    unstash 'ENV_FILE'
+                    sh '''#!/usr/bin/env bash
+set -Eeuo pipefail
+set +x
+
+if [ "$NEEDS_ENV_FILE" = "true" ] && [ ! -s ENV_FILE ]; then
+  echo "A non-empty root .env file is required for this build output."
+  exit 1
+fi
+
+if [ -s ENV_FILE ]; then
+  mv ENV_FILE .env
+  chmod 600 .env || true
+  echo "Root .env received. Values are hidden."
+else
+  rm -f ENV_FILE
+  echo "No root .env supplied; this build output does not require one."
+fi
+'''
+                }
+            }
+        }
+
+        stage('Cleanup Old Build Files') {
+            steps {
+                sh '''#!/usr/bin/env bash
+set -Eeuo pipefail
+exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
+RETENTION_DAYS="${BUILD_RETENTION_DAYS:-30}"
+
+if ! [[ "$RETENTION_DAYS" =~ ^[0-9]+$ ]] || [ "$RETENTION_DAYS" -lt 1 ]; then
+  echo "Invalid BUILD_RETENTION_DAYS: $RETENTION_DAYS"
+  exit 1
+fi
+
+if [ -d "$ARTIFACT_ROOT" ]; then
+  while IFS= read -r -d '' OLD_BUILD_DIR; do
+    [ "$OLD_BUILD_DIR" = "$BUILD_ARTIFACT_DIR" ] && continue
+    if ! find "$OLD_BUILD_DIR" -type f -mtime "-$RETENTION_DAYS" -print -quit | grep -q .; then
+      echo "Deleting old artifact directory: $OLD_BUILD_DIR"
+      rm -rf -- "$OLD_BUILD_DIR"
+    fi
+  done < <(find "$ARTIFACT_ROOT" -mindepth 1 -maxdepth 1 -type d -name 'build-*' -print0)
+fi
+
+echo "Cleanup completed."
+'''
+            }
+        }
+
+        stage('FULL_RESET') {
+            when {
+                expression { params.BUILD_PROFILE == 'FULL_RESET' }
+            }
+            steps {
+                sh '''#!/usr/bin/env bash
+set -Eeuo pipefail
+exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
+
+echo "FULL_RESET: clearing project-local npm/Expo caches and generated build state."
+echo "Shared Jenkins Gradle cache is intentionally preserved: $GRADLE_USER_HOME"
+rm -rf "$NPM_CONFIG_CACHE" "$EXPO_HOME"
+mkdir -p "$NPM_CONFIG_CACHE" "$EXPO_HOME"
+
+# The uploaded source tree is already fresh, but clear Android-generated state
+# so FULL_RESET remains stronger than CLEAN without deleting the server's
+# shared Gradle distributions/caches.
+rm -rf "$SOURCE_DIR/android/.gradle" "$SOURCE_DIR/android/build" "$SOURCE_DIR/android/app/build"
+'''
+            }
+        }
+
+        stage('Environment Check') {
+            steps {
+                dir("${env.SOURCE_DIR}") {
+                    sh '''#!/usr/bin/env bash
+set -Eeuo pipefail
+exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
+
+echo "========== Build Machine =========="
+echo "JAVA:"
+java -version
+echo "NODE:"
+node -v
+echo "NPM:"
+npm -v
+echo "ANDROID SDK:"
+echo "ANDROID_HOME=$ANDROID_HOME"
+echo "ANDROID_SDK_ROOT=$ANDROID_SDK_ROOT"
+echo "GRADLE CACHE:"
+echo "GRADLE_USER_HOME=$GRADLE_USER_HOME"
+if command -v gradle >/dev/null 2>&1; then
+  echo "SYSTEM GRADLE:"
+  gradle --version | sed -n '1,8p'
+else
+  echo "SYSTEM GRADLE: not in PATH (project wrapper will use the shared Jenkins Gradle cache)."
+fi
+echo "ANDROID CLI:"
+sdkmanager --version || true
+'''
+                }
+            }
+        }
+
+        stage('CLEAN') {
+            when {
+                expression { params.BUILD_PROFILE == 'CLEAN' }
+            }
+            steps {
+                dir("${env.SOURCE_DIR}") {
+                    sh '''#!/usr/bin/env bash
+set -Eeuo pipefail
+exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
+
+rm -rf node_modules .gradle .metro .turbo dist build coverage
+if [ "$PROJECT_TYPE" = "Expo" ]; then
+  rm -rf android ios .expo
+else
+  rm -rf android/.gradle android/build android/app/build android/.cxx android/app/.cxx
+fi
+
+echo "Project-level CLEAN completed."
+'''
+                }
+            }
+        }
+
+        stage('Install Dependencies') {
+            steps {
+                dir("${env.SOURCE_DIR}") {
+                    sh '''#!/usr/bin/env bash
+set -Eeuo pipefail
+exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
+
+if [ ! -f package.json ]; then
+  echo "package.json is missing from the uploaded project root."
+  exit 1
+fi
+
+if [ "$BUILD_PROFILE" = "FAST" ]; then
+  npm install --prefer-offline --no-audit
+elif [ -f package-lock.json ]; then
+  npm ci --no-audit
+else
+  npm install --no-audit
+fi
+'''
+                }
+            }
+        }
+
+        stage('Validate Project Type') {
+            steps {
+                dir("${env.SOURCE_DIR}") {
+                    sh '''#!/usr/bin/env bash
+set -Eeuo pipefail
+exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
+
+node <<'NODE'
+const fs = require('fs');
+const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
+const projectType = process.env.PROJECT_TYPE;
+if (projectType === 'Expo' && !deps.expo) throw new Error('Expo selected, but expo is missing from package.json.');
+if (projectType === 'React Native CLI' && !deps['react-native']) throw new Error('React Native CLI selected, but react-native is missing from package.json.');
+NODE
+
+if [ "$PROJECT_TYPE" = "React Native CLI" ]; then
+  [ -d android ] || { echo "React Native CLI project must contain android/."; exit 1; }
+  [ -f android/gradlew ] || { echo "android/gradlew not found."; exit 1; }
+fi
+'''
+                }
+            }
+        }
+
+        stage('Validate Development Client') {
+            when {
+                expression { params.PROJECT_TYPE == 'Expo' && params.BUILD_OUTPUT == 'Development Client' }
+            }
+            steps {
+                dir("${env.SOURCE_DIR}") {
+                    sh '''#!/usr/bin/env bash
+set -Eeuo pipefail
+node <<'NODE'
+const fs = require('fs');
+const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
+if (!deps['expo-dev-client']) throw new Error('Development Client requires expo-dev-client. Run: npx expo install expo-dev-client');
+NODE
+'''
+                }
+            }
+        }
+
+        stage('Expo Prebuild') {
+            when {
+                expression { params.PROJECT_TYPE == 'Expo' }
+            }
+            steps {
+                dir("${env.SOURCE_DIR}") {
+                    sh '''#!/usr/bin/env bash
+set -Eeuo pipefail
+exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
+if [ "$BUILD_PROFILE" = "FAST" ]; then
+  NODE_ENV="$NODE_ENV_VALUE" CI=1 npx expo prebuild --platform android
+else
+  NODE_ENV="$NODE_ENV_VALUE" CI=1 npx expo prebuild --platform android --clean
+fi
+'''
+                }
+            }
+        }
+
+        stage('Prepare Android Project') {
+            steps {
+                dir("${env.SOURCE_DIR}/android") {
+                    sh '''#!/usr/bin/env bash
+set -Eeuo pipefail
+exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
+
+[ -f gradlew ] || { echo "gradlew not found inside android/."; exit 1; }
+[ -f gradle/wrapper/gradle-wrapper.jar ] || { echo "gradle-wrapper.jar not found."; exit 1; }
+[ -f gradle/wrapper/gradle-wrapper.properties ] || { echo "gradle-wrapper.properties not found."; exit 1; }
+
+# The source snapshot can originate on Windows. A CRLF gradlew has a hidden
+# carriage return in its shebang and Linux reports:
+#   ./gradlew: cannot execute: required file not found
+# Normalize only the wrapper script; source files themselves are left intact.
+sed -i 's/\r$//' gradlew
+chmod +x gradlew
+
+# The Jenkins machine supplies Java, Android SDK/NDK and the shared Gradle
+# installation/cache. Keep the project wrapper as the compatibility source of
+# truth, but prefer an already-installed server Gradle when it exactly matches
+# the wrapper version. If the wrapper ever has to download, give it enough time
+# for a real network rather than Gradle's short default timeout.
+echo "sdk.dir=$ANDROID_HOME" > local.properties
+
+WRAPPER_PROPS="gradle/wrapper/gradle-wrapper.properties"
+if grep -q '^networkTimeout=' "$WRAPPER_PROPS"; then
+  sed -i 's/^networkTimeout=.*/networkTimeout=120000/' "$WRAPPER_PROPS"
+else
+  printf '\nnetworkTimeout=120000\n' >> "$WRAPPER_PROPS"
+fi
+
+WRAPPER_URL=$(grep '^distributionUrl=' "$WRAPPER_PROPS" | tail -n 1 | cut -d= -f2-)
+WRAPPER_FILE=$(basename "$WRAPPER_URL")
+WRAPPER_VERSION=${WRAPPER_FILE#gradle-}
+WRAPPER_VERSION=${WRAPPER_VERSION%-bin.zip}
+WRAPPER_VERSION=${WRAPPER_VERSION%-all.zip}
+SYSTEM_GRADLE_VERSION=''
+if command -v gradle >/dev/null 2>&1; then
+  SYSTEM_GRADLE_VERSION=$(gradle --version 2>/dev/null | awk '/^Gradle / { print $2; exit }')
+fi
+
+cat > .indraq-gradle <<'GRADLE_RUNNER'
+#!/usr/bin/env bash
+set -Eeuo pipefail
+WRAPPER_PROPS="gradle/wrapper/gradle-wrapper.properties"
+WRAPPER_URL=$(grep '^distributionUrl=' "$WRAPPER_PROPS" | tail -n 1 | cut -d= -f2-)
+WRAPPER_FILE=$(basename "$WRAPPER_URL")
+WRAPPER_VERSION=${WRAPPER_FILE#gradle-}
+WRAPPER_VERSION=${WRAPPER_VERSION%-bin.zip}
+WRAPPER_VERSION=${WRAPPER_VERSION%-all.zip}
+CACHED_GRADLE=''
+if [ -n "$WRAPPER_VERSION" ] && [ -d "${GRADLE_USER_HOME:-$HOME/.gradle}/wrapper/dists" ]; then
+  CACHED_GRADLE=$(find "${GRADLE_USER_HOME:-$HOME/.gradle}/wrapper/dists" -type f -path "*/gradle-$WRAPPER_VERSION/bin/gradle" -print -quit 2>/dev/null || true)
+fi
+
+# Exact cached wrapper distribution is safest because it matches the project.
+if [ -n "$CACHED_GRADLE" ]; then
+  exec bash ./gradlew "$@"
+fi
+
+# If the Jenkins host has Gradle installed, reuse it when it is the same major
+# line as the requested wrapper. This avoids an internet download while still
+# refusing obviously incompatible Gradle generations (for example 8.x vs 9.x).
+if command -v gradle >/dev/null 2>&1; then
+  SYSTEM_VERSION=$(gradle --version 2>/dev/null | awk '/^Gradle / { print $2; exit }')
+  WRAPPER_MAJOR=${WRAPPER_VERSION%%.*}
+  SYSTEM_MAJOR=${SYSTEM_VERSION%%.*}
+  if [ -n "$WRAPPER_MAJOR" ] && [ "$SYSTEM_MAJOR" = "$WRAPPER_MAJOR" ]; then
+    if [ "$SYSTEM_VERSION" != "$WRAPPER_VERSION" ]; then
+      echo "IndraQ: using server Gradle $SYSTEM_VERSION for wrapper request $WRAPPER_VERSION (same major version)." >&2
+    fi
+    exec gradle "$@"
+  fi
+fi
+
+# Last resort: project wrapper. Its networkTimeout is raised to 120 seconds and
+# it uses the shared Jenkins Gradle cache, so any download happens at most once.
+exec bash ./gradlew "$@"
+GRADLE_RUNNER
+chmod +x .indraq-gradle
+
+CACHED_GRADLE=''
+if [ -n "$WRAPPER_VERSION" ] && [ -d "$GRADLE_USER_HOME/wrapper/dists" ]; then
+  CACHED_GRADLE=$(find "$GRADLE_USER_HOME/wrapper/dists" -type f -path "*/gradle-$WRAPPER_VERSION/bin/gradle" -print -quit 2>/dev/null || true)
+fi
+
+echo "========== Android Build Toolchain =========="
+echo "Android SDK        : $ANDROID_HOME"
+echo "Shared Gradle cache: $GRADLE_USER_HOME"
+echo "Wrapper shebang    : $(head -n 1 gradlew)"
+echo "Wrapper Gradle     : ${WRAPPER_VERSION:-unknown}"
+if [ -n "$SYSTEM_GRADLE_VERSION" ]; then
+  echo "System Gradle      : $SYSTEM_GRADLE_VERSION"
+else
+  echo "System Gradle      : not in PATH"
+fi
+if [ -n "$CACHED_GRADLE" ]; then
+  echo "Cached wrapper     : yes ($CACHED_GRADLE)"
+elif [ -n "$SYSTEM_GRADLE_VERSION" ] && [ "$SYSTEM_GRADLE_VERSION" = "$WRAPPER_VERSION" ]; then
+  echo "Gradle source      : matching server Gradle executable"
+else
+  echo "Cached wrapper     : not found; wrapper may download once (timeout raised to 120s)."
+fi
+if [ -d "$ANDROID_HOME/ndk" ]; then
+  echo "Installed NDKs:"
+  find "$ANDROID_HOME/ndk" -mindepth 1 -maxdepth 1 -type d -printf '  %f\n' | sort || true
+fi
+echo "============================================="
+'''
+                }
+            }
+        }
+
+        stage('Apply Android Version') {
+            steps {
+                dir("${env.SOURCE_DIR}") {
+                    sh '''#!/usr/bin/env bash
+set -Eeuo pipefail
+exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
+
+node <<'NODE'
+const fs = require('fs');
+const path = require('path');
+const version = process.env.APP_VERSION;
+const versionCode = process.env.APP_VERSION_CODE;
+const candidates = [
+  path.join('android', 'app', 'build.gradle'),
+  path.join('android', 'app', 'build.gradle.kts')
+];
+const gradleFile = candidates.find((candidate) => fs.existsSync(candidate));
+if (!gradleFile) throw new Error('android/app/build.gradle or build.gradle.kts was not found.');
+
+const original = fs.readFileSync(gradleFile, 'utf8');
+let codeUpdated = false;
+let nameUpdated = false;
+const lines = original.split(/\\r?\\n/).map((line) => {
+  if (!codeUpdated) {
+    let match = line.match(/^(\\s*versionCode\\s*=\\s*).+$/);
+    if (match) {
+      codeUpdated = true;
+      return `${match[1]}${versionCode}`;
+    }
+    match = line.match(/^(\\s*versionCode\\s+).+$/);
+    if (match) {
+      codeUpdated = true;
+      return `${match[1]}${versionCode}`;
+    }
+  }
+  if (!nameUpdated) {
+    let match = line.match(/^(\\s*versionName\\s*=\\s*).+$/);
+    if (match) {
+      nameUpdated = true;
+      return `${match[1]}"${version}"`;
+    }
+    match = line.match(/^(\\s*versionName\\s+).+$/);
+    if (match) {
+      nameUpdated = true;
+      return `${match[1]}"${version}"`;
+    }
+  }
+  return line;
+});
+
+if (!codeUpdated || !nameUpdated) {
+  throw new Error(`Unable to apply Android version. versionCode updated=${codeUpdated}, versionName updated=${nameUpdated}. Check ${gradleFile}.`);
+}
+fs.writeFileSync(gradleFile, lines.join('\\n'));
+console.log(`Android version applied in ${gradleFile}: versionName=${version}, versionCode=${versionCode}`);
+NODE
+'''
+                }
+            }
+        }
+
+        stage('Gradle Clean') {
+            when {
+                expression { params.BUILD_PROFILE == 'CLEAN' || params.BUILD_PROFILE == 'FULL_RESET' }
+            }
+            steps {
+                dir("${env.SOURCE_DIR}/android") {
+                    sh '''#!/usr/bin/env bash
+set -Eeuo pipefail
+exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
+bash ./.indraq-gradle --stop || true
+NODE_ENV="$NODE_ENV_VALUE" bash ./.indraq-gradle clean --console=plain --no-build-cache
+'''
+                }
+            }
+        }
+
+        stage('Build Android') {
+            steps {
+                dir("${env.SOURCE_DIR}/android") {
+                    script {
+                        if (params.BUILD_PROFILE == 'FAST') {
+                            if (params.VERBOSE_BUILD) {
+                                sh '''#!/usr/bin/env bash
+set -Eeuo pipefail
+exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
+NODE_ENV="$NODE_ENV_VALUE" bash ./.indraq-gradle "$GRADLE_TASK" --console=plain --stacktrace --info
+'''
+                            } else {
+                                sh '''#!/usr/bin/env bash
+set -Eeuo pipefail
+exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
+NODE_ENV="$NODE_ENV_VALUE" bash ./.indraq-gradle "$GRADLE_TASK" --console=plain
+'''
+                            }
+                        } else if (params.VERBOSE_BUILD) {
+                            sh '''#!/usr/bin/env bash
+set -Eeuo pipefail
+exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
+NODE_ENV="$NODE_ENV_VALUE" bash ./.indraq-gradle "$GRADLE_TASK" --console=plain --no-build-cache --rerun-tasks --stacktrace --info
+'''
+                        } else {
+                            sh '''#!/usr/bin/env bash
+set -Eeuo pipefail
+exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
+NODE_ENV="$NODE_ENV_VALUE" bash ./.indraq-gradle "$GRADLE_TASK" --console=plain --no-build-cache --rerun-tasks
+'''
+                        }
+                    }
+                }
+            }
+        }
+
+        stage('Generate Build Metadata') {
+            steps {
+                sh '''#!/usr/bin/env bash
+set -Eeuo pipefail
+exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
+BUILD_TIME=$(TZ=Asia/Kolkata date '+%Y-%m-%dT%H:%M:%S%z')
+cat > "$BUILD_JSON_FILE" <<JSON
+{
+  "app": "$APP_NAME",
+  "projectId": "$PROJECT_ID",
+  "version": "$APP_VERSION",
+  "versionCode": $APP_VERSION_CODE,
+  "projectType": "$PROJECT_TYPE",
+  "environment": "$BUILD_ENVIRONMENT",
+  "output": "$BUILD_OUTPUT",
+  "profile": "$BUILD_PROFILE",
+  "buildNumber": "$BUILD_NUMBER",
+  "sourceRevision": "$SOURCE_REVISION",
+  "sourceDirty": "$SOURCE_DIRTY",
+  "sourceSha256": "$SOURCE_SHA256",
+  "buildTime": "$BUILD_TIME"
+}
+JSON
+cat "$BUILD_JSON_FILE"
+'''
+            }
+        }
+
+        stage('Collect Artifacts') {
+            steps {
+                sh '''#!/usr/bin/env bash
+set -Eeuo pipefail
+exec > >(tee -a "$BUILD_LOG_FILE") 2>&1
+
+rm -rf "$WORKSPACE/jenkins-artifacts"
+mkdir -p "$WORKSPACE/jenkins-artifacts"
+
+[ -d "$ARTIFACT_SEARCH_DIR" ] || { echo "Artifact directory does not exist: $ARTIFACT_SEARCH_DIR"; exit 1; }
+mapfile -t ARTIFACTS < <(find "$ARTIFACT_SEARCH_DIR" -maxdepth 1 -type f -name "$ARTIFACT_FILE_PATTERN" | sort)
+[ "${#ARTIFACTS[@]}" -gt 0 ] || { echo "No .$ARTIFACT_EXT artifact found."; exit 1; }
+
+PRIMARY_ARTIFACT="${ARTIFACTS[0]}"
+SAFE_APP_NAME=$(printf '%s' "$APP_NAME" | sed -E 's/[^A-Za-z0-9._-]+/_/g; s/^_+//; s/_+$//')
+[ -n "$SAFE_APP_NAME" ] || SAFE_APP_NAME="app"
+BUILD_STAMP=$(TZ=Asia/Kolkata date '+%Y-%m-%d_%H%M')
+PRIMARY_ARTIFACT_NAME="${SAFE_APP_NAME}_${APP_VERSION}_${APP_VERSION_CODE}_${BUILD_STAMP}.${ARTIFACT_EXT}"
+
+cp "$PRIMARY_ARTIFACT" "$WORKSPACE/jenkins-artifacts/$PRIMARY_ARTIFACT_NAME"
+cp "$PRIMARY_ARTIFACT" "$BUILD_ARTIFACT_DIR/$PRIMARY_ARTIFACT_NAME"
+cp "$BUILD_LOG_FILE" "$WORKSPACE/jenkins-artifacts/build.log"
+cp "$BUILD_JSON_FILE" "$WORKSPACE/jenkins-artifacts/build.json"
+echo "$PRIMARY_ARTIFACT_NAME" > "$WORKSPACE/jenkins-artifacts/primary-artifact-name.txt"
+
+echo "Primary artifact: $PRIMARY_ARTIFACT_NAME"
+echo "Artifact timestamp timezone: Asia/Kolkata (IST)"
+'''
+            }
+        }
+
+        stage('Archive & Publish Download Link') {
+            steps {
+                script {
+                    archiveArtifacts(artifacts: 'jenkins-artifacts/**/*', allowEmptyArchive: false, fingerprint: true)
+                    env.PRIMARY_ARTIFACT_NAME = readFile("${env.WORKSPACE}/jenkins-artifacts/primary-artifact-name.txt").trim()
+                    env.PRIMARY_ARTIFACT_URL = "${env.BUILD_URL}artifact/jenkins-artifacts/${env.PRIMARY_ARTIFACT_NAME}"
+                    currentBuild.description = "Download: ${env.PRIMARY_ARTIFACT_NAME}"
+                    echo '=============================================='
+                    echo 'DOWNLOAD READY'
+                    echo "File: ${env.PRIMARY_ARTIFACT_NAME}"
+                    echo "URL: ${env.PRIMARY_ARTIFACT_URL}"
+                    echo '=============================================='
+                }
+            }
+        }
+    }
+
+    post {
+        always {
+            sh '''#!/usr/bin/env bash
+set +e
+# Never leave the developer's environment file in the Jenkins workspace.
+if [ -n "${SOURCE_DIR:-}" ] && [ "$SOURCE_DIR" != "/" ]; then
+  rm -f "$SOURCE_DIR/.env" "$SOURCE_DIR/ENV_FILE"
+fi
+if [ -n "${WORKSPACE:-}" ] && [ "$WORKSPACE" != "/" ]; then
+  rm -f "$WORKSPACE/ENV_FILE" "$WORKSPACE/SOURCE_BUNDLE"
+fi
+'''
+        }
+        success {
+            echo '=============================================='
+            echo 'BUILD SUCCESSFUL'
+            echo "App: ${params.APP_NAME}"
+            echo "Version: ${params.APP_VERSION}"
+            echo "versionCode: ${params.APP_VERSION_CODE}"
+            echo "Environment: ${params.BUILD_ENVIRONMENT}"
+            echo "Output: ${params.BUILD_OUTPUT}"
+            echo "Profile: ${params.BUILD_PROFILE}"
+            echo "File: ${env.PRIMARY_ARTIFACT_NAME}"
+            echo "Download: ${env.PRIMARY_ARTIFACT_URL}"
+            echo "Server backup: ${env.BUILD_ARTIFACT_DIR}"
+            echo '=============================================='
+        }
+        failure {
+            echo '=============================================='
+            echo 'BUILD FAILED'
+            echo "App: ${params.APP_NAME}"
+            echo "Version: ${params.APP_VERSION}"
+            echo "versionCode: ${params.APP_VERSION_CODE}"
+            echo "Environment: ${params.BUILD_ENVIRONMENT}"
+            echo "Output: ${params.BUILD_OUTPUT}"
+            echo "Profile: ${params.BUILD_PROFILE}"
+            echo 'Check console logs above.'
+            echo '=============================================='
+        }
+    }
+}