vxrn 2.0.0-beta.98.1 → 2.6.0

package/src/exports/prebuildWithoutExpo.ts

@@ -1,17 +1,47 @@
 import { execFileSync } from 'node:child_process'
+import { createHash } from 'node:crypto'
 import module from 'node:module'
 import path from 'node:path'
 import { pathToFileURL } from 'node:url'
-import { validateNativeApp, type NativeAppManifest } from '@vxrn/utils/nativeAppManifest'
+import {
+  validateNativeApp,
+  type NativeAppManifest,
+  type PlistValue,
+} from '@vxrn/utils/nativeAppManifest'
 import FSExtra from 'fs-extra'
 import sharp from 'sharp'
-import { swiftPackageId } from '../utils/swiftPackageId'
+import { swiftPackageDirectories } from '../utils/swiftPackageId'
 
 type NativeProjectPatches = {
+  ONE_NOTIFICATIONS: {
+    enabledInfoPlistKey: string
+    pushInfoPlistKey: string
+    apsEnvironment: string
+    androidPermissions: string[]
+    receiver: string
+    receiverAction: string
+    pushService: string
+    pushServiceAction: string
+    pushGradleProperty: string
+  }
+  ONE_UPDATES: {
+    urlInfoPlistKey: string
+    runtimeVersionInfoPlistKey: string
+    bridgingHeaderImport: string
+  }
+  pointReleaseBundleURLAtOneUpdates(appDelegate: string): string
+  ONE_LAUNCH_SCREEN: { bridgingHeaderImport: string }
+  holdLaunchScreenOverRootView(appDelegate: string): string
+  holdLaunchScreenInMainActivity(mainActivity: string): string
   addSetCliPathToBundleReactNativeShellScript(input: string): string
   addPodHermescToBundleReactNativeShellScript(input: string): string
   addDepsPatchToBundleReactNativeShellScript(input: string): string
+  addEmbeddedUpdatesManifestToBundleReactNativeShellScript(
+    input: string,
+    runtimeVersion: string
+  ): string
   injectFmtCxx17FixIntoPodfile(input: string): string
+  injectWebGPUHeaderPathsIntoPodfile(input: string): string
   injectOneSwiftPackagesIntoPodfile(input: string): string
   injectHermesMinificationPatchIntoPodfile(input: string): string
   injectReactNativeScreensGammaIntoPodfile(input: string): string
@@ -22,15 +52,27 @@ type NativeProjectPatches = {
   addReactNativeScreensFix(input: string): string
 }
 
-const nativeProjectPatches = module.createRequire(import.meta.url)(
+const requireVxrn = module.createRequire(import.meta.url)
+const nativeProjectPatches = requireVxrn(
   '../../native-project-patches.cjs'
 ) as NativeProjectPatches
+const notificationsHost = nativeProjectPatches.ONE_NOTIFICATIONS
+const updatesHost = nativeProjectPatches.ONE_UPDATES
 
 /*
 This code block is partially copied from meta owned repos.
 Copyright (c) Facebook, Inc. and its affiliates.
 */
 
+const PORTRAIT_ORIENTATIONS = [
+  'UIInterfaceOrientationPortrait',
+  'UIInterfaceOrientationPortraitUpsideDown',
+]
+const LANDSCAPE_ORIENTATIONS = [
+  'UIInterfaceOrientationLandscapeLeft',
+  'UIInterfaceOrientationLandscapeRight',
+]
+
 // the manifest is one({ native: { app } }), defined once in @vxrn/utils. the
 // one cli validates the full manifest before passing it here; vxrn
 // re-validates through the same definition so direct callers fail before
@@ -52,7 +94,7 @@ const IOS_BUNDLE_PLACEHOLDER =
 const ANDROID_PACKAGE_PLACEHOLDER = 'com.helloworld'
 const ANDROID_PACKAGE_PATH = 'com/helloworld'
 
-function patchIosBundlePhase(project: string): string {
+function patchIosBundlePhase(project: string, updatesRuntimeVersion?: string): string {
   let patchedBundlePhases = 0
   const patchedProject = project.replace(
     /shellScript = ("(?:\\.|[^"\\])*");/g,
@@ -78,6 +120,20 @@ function patchIosBundlePhase(project: string): string {
       ) {
         throw new Error('[vxrn] failed to apply required iOS bundle phase patches')
       }
+      if (updatesRuntimeVersion !== undefined) {
+        patched =
+          nativeProjectPatches.addEmbeddedUpdatesManifestToBundleReactNativeShellScript(
+            patched,
+            updatesRuntimeVersion
+          )
+        if (
+          !patched.includes(
+            '[vxrn/one] the embedded update manifest lands beside the release bundle'
+          )
+        ) {
+          throw new Error('[vxrn] failed to apply the iOS embedded updates manifest patch')
+        }
+      }
       patchedBundlePhases++
       return `shellScript = ${JSON.stringify(patched)};`
     }
@@ -117,21 +173,14 @@ import ReactAppDependencyProvider
 class SceneDelegate: UIResponder, UIWindowSceneDelegate {
   var window: UIWindow?
 
-  var reactNativeDelegate: ReactNativeDelegate?
-  var reactNativeFactory: RCTReactNativeFactory?
-
   func scene(
     _ scene: UIScene,
     willConnectTo session: UISceneSession,
     options connectionOptions: UIScene.ConnectionOptions
   ) {
     guard let windowScene = scene as? UIWindowScene else { return }
-    let delegate = ReactNativeDelegate()
-    let factory = RCTReactNativeFactory(delegate: delegate)
-    delegate.dependencyProvider = RCTAppDependencyProvider()
-
-    reactNativeDelegate = delegate
-    reactNativeFactory = factory
+    guard let appDelegate = UIApplication.shared.delegate as? AppDelegate,
+      let factory = appDelegate.reactNativeFactory else { return }
 
     let window = UIWindow(windowScene: windowScene)
     self.window = window
@@ -213,7 +262,12 @@ ${anchor}`
   )
 }
 
-function patchIosAppDelegateSceneLifecycle(rendered: string, appName: string): string {
+function patchIosAppDelegateSceneLifecycle(
+  rendered: string,
+  appName: string,
+  backgroundTasks: boolean,
+  appIntents: boolean
+): string {
   const anchor = `@main
 class AppDelegate: UIResponder, UIApplicationDelegate {
   var window: UIWindow?
@@ -252,38 +306,60 @@ class AppDelegate: UIResponder, UIApplicationDelegate {
     anchor,
     `@main
 class AppDelegate: UIResponder, UIApplicationDelegate {
+  var reactNativeDelegate: ReactNativeDelegate?
+  var reactNativeFactory: RCTReactNativeFactory?
+
   func application(
     _ application: UIApplication,
     didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]? = nil
   ) -> Bool {
-    true
+    let delegate = ReactNativeDelegate()
+    let factory = RCTReactNativeFactory(delegate: delegate)
+    delegate.dependencyProvider = RCTAppDependencyProvider()
+    reactNativeDelegate = delegate
+    reactNativeFactory = factory
+${backgroundTasks ? `    OneBackgroundTasksRegisterHost(factory, launchOptions)
+` : ''}${appIntents ? `    OneAppIntentsRegisterHost(factory, launchOptions)
+` : ''}    return true
   }
+}`
+  )
+}
 
-  // remote push answers land here; the notifications module observes the
-  // forward. inert unless something calls registerForRemoteNotifications.
-  func application(
-    _ application: UIApplication,
-    didRegisterForRemoteNotificationsWithDeviceToken deviceToken: Data
-  ) {
-    NotificationCenter.default.post(
-      name: NSNotification.Name("OneNativePushTokenDidRegister"),
-      object: nil,
-      userInfo: ["deviceToken": deviceToken]
-    )
-  }
+const ONE_BRIDGING_HEADER_NAME = 'One-Bridging-Header.h'
 
-  func application(
-    _ application: UIApplication,
-    didFailToRegisterForRemoteNotificationsWithError error: Error
-  ) {
-    NotificationCenter.default.post(
-      name: NSNotification.Name("OneNativePushTokenDidFail"),
-      object: nil,
-      userInfo: ["error": error.localizedDescription]
+function renderOneBridgingHeader(app: NativeAppManifest): string {
+  const imports = [nativeProjectPatches.ONE_LAUNCH_SCREEN.bridgingHeaderImport]
+  if (app.updates !== undefined) imports.push(updatesHost.bridgingHeaderImport)
+  if (app.ios?.backgroundTasks !== undefined) imports.push('#import "OneBackgroundTasksBridge.h"')
+  if (app.ios?.appIntents !== undefined) imports.push('#import "OneAppIntentsBridge.h"')
+  return `// generated by one prebuild: exposes One's c entry points to AppDelegate
+// without importing the One module.
+${imports.join('\n')}
+`
+}
+
+function generateOneBridgingHeader(dest: string, app: NativeAppManifest): void {
+  FSExtra.writeFileSync(
+    path.join(dest, app.name, ONE_BRIDGING_HEADER_NAME),
+    renderOneBridgingHeader(app)
+  )
+}
+
+function patchIosPbxprojOneBridgingHeader(project: string, appName: string): string {
+  // both app-target configurations point at the generated bridging header.
+  // the anchor is the app plist, which only those two settings own.
+  const anchor = `INFOPLIST_FILE = ${appName}/Info.plist;`
+  const setting = `SWIFT_OBJC_BRIDGING_HEADER = "${appName}/${ONE_BRIDGING_HEADER_NAME}";`
+  const occurrences = project.split(anchor).length - 1
+  if (occurrences !== 2) {
+    throw new Error(
+      '[vxrn] prebuild template project.pbxproj changed shape: cannot point the app target at the One bridging header'
     )
   }
-}`
-  )
+  return project
+    .split(anchor)
+    .join(`${anchor}\n\t\t\t\t${setting}`)
 }
 
 function patchIosPbxprojSceneDelegate(rendered: string, appName: string): string {
@@ -318,8 +394,184 @@ function patchIosPbxprojSceneDelegate(rendered: string, appName: string): string
   return patched
 }
 
-function patchIosPbxprojPushEntitlements(rendered: string, appName: string): string {
-  // the aps-environment entitlement only when the app opts into push. the
+function patchIosPbxprojAppIntents(rendered: string, appName: string): string {
+  const name = 'OneAppIntents.swift'
+  const fileRef = pbxprojId('one-app-intents-file')
+  const buildFile = pbxprojId('one-app-intents-build')
+  const edits: Array<[string, string]> = [
+    [
+      '/* AppDelegate.swift in Sources */ = {isa = PBXBuildFile;',
+      `\t\t${buildFile} /* ${name} in Sources */ = {isa = PBXBuildFile; fileRef = ${fileRef} /* ${name} */; };`,
+    ],
+    [
+      '/* AppDelegate.swift */ = {isa = PBXFileReference;',
+      `\t\t${fileRef} /* ${name} */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; name = ${name}; path = ${appName}/${name}; sourceTree = "<group>"; };`,
+    ],
+    ['/* AppDelegate.swift */,', `\t\t\t\t${fileRef} /* ${name} */,`],
+    ['/* AppDelegate.swift in Sources */,', `\t\t\t\t${buildFile} /* ${name} in Sources */,`],
+  ]
+  let patched = rendered
+  for (const [anchor, insertion] of edits) {
+    const next = insertAfterLine(patched, anchor, insertion)
+    if (next === patched) {
+      throw new Error(`[vxrn] prebuild template project.pbxproj lost its AppDelegate.swift anchor (${anchor})`)
+    }
+    patched = next
+  }
+  return patched
+}
+
+function swiftLiteral(value: string): string {
+  return JSON.stringify(value).replace(/\\u([0-9a-fA-F]{4})/g, (_match, hex: string) => `\\u{${hex}}`)
+}
+
+function swiftShortcutPhrase(value: string): string {
+  return `"${value.split('{app}').map((part) => swiftLiteral(part).slice(1, -1)).join('\\(.applicationName)')}"`
+}
+
+export function renderIosAppIntentsSwift(actions: NonNullable<NonNullable<NativeAppManifest['ios']>['appIntents']>['actions']): string {
+  const types = actions.map((action, index) => {
+    const summaryTitle = swiftLiteral(action.title).slice(1, -1)
+    const text = action.textParameterTitle === undefined ? '' : `
+  @Parameter(title: ${swiftLiteral(action.textParameterTitle)}) var text: String
+
+  static var parameterSummary: some ParameterSummary {
+    Summary("${summaryTitle} \\(\\.$text)")
+  }
+`
+    return `struct OneAppIntent${index}: AppIntent {
+  static let title: LocalizedStringResource = ${swiftLiteral(action.title)}
+${text}
+  func perform() async throws -> some IntentResult & ReturnsValue<String> {
+    let result = try await oneAppIntentsRun(${swiftLiteral(action.id)}, ${text ? 'text' : 'nil'})
+    return .result(value: result)
+  }
+}`
+  })
+  const shortcuts = actions.map((action, index) => `    AppShortcut(
+      intent: OneAppIntent${index}(),
+      phrases: [${swiftShortcutPhrase(action.shortcutPhrase)}],
+      shortTitle: ${swiftLiteral(action.title)},
+      systemImageName: "bolt.fill"
+    )`).join('\n')
+  return `import AppIntents
+import Foundation
+
+private func oneAppIntentsRun(_ identifier: String, _ text: String?) async throws -> String {
+  try await withCheckedThrowingContinuation { continuation in
+    OneAppIntentsPerform(identifier, text) { result, error in
+      if let error { continuation.resume(throwing: error) }
+      else if let result { continuation.resume(returning: result) }
+      else { continuation.resume(throwing: NSError(domain: "OneAppIntents", code: 3)) }
+    }
+  }
+}
+
+${types.join('\n\n')}
+
+struct OneAppShortcuts: AppShortcutsProvider {
+  static var appShortcuts: [AppShortcut] {
+${shortcuts}
+  }
+}
+`
+}
+
+function fontFileName(font: string): string {
+  return path.basename(font)
+}
+
+function pbxprojId(seed: string): string {
+  return createHash('sha1').update(seed).digest('hex').slice(0, 24).toUpperCase()
+}
+
+const GOOGLE_SERVICES_PLIST = 'GoogleService-Info.plist'
+const GOOGLE_SERVICES_VERSION = '4.4.4'
+
+// the files prebuild bundles next to the ios app sources: native.app fonts and
+// the firebase plist.
+function iosResourceFiles(app: NativeAppManifest): string[] {
+  return [
+    ...(app.fonts ?? []).map(fontFileName),
+    ...(app.ios?.googleServicesFile ? [GOOGLE_SERVICES_PLIST] : []),
+  ]
+}
+
+// each bundled file becomes an app-group file in the Resources phase, the way
+// expo's font and google services plugins add theirs.
+function patchIosPbxprojResources(rendered: string, appName: string, names: string[]): string {
+  let patched = rendered
+  for (const name of names) {
+    const fileRef = pbxprojId(`one-resource-file:${name}`)
+    const buildFile = pbxprojId(`one-resource-build:${name}`)
+    const fileType = name.endsWith('.plist') ? 'text.plist.xml' : 'file'
+    const edits: Array<[string, string]> = [
+      [
+        '/* Images.xcassets in Resources */ = {isa = PBXBuildFile;',
+        `\t\t${buildFile} /* ${name} in Resources */ = {isa = PBXBuildFile; fileRef = ${fileRef} /* ${name} */; };`,
+      ],
+      [
+        '/* Images.xcassets */ = {isa = PBXFileReference;',
+        `\t\t${fileRef} /* ${name} */ = {isa = PBXFileReference; lastKnownFileType = ${fileType}; name = ${name}; path = ${appName}/${name}; sourceTree = "<group>"; };`,
+      ],
+      ['/* Images.xcassets */,', `\t\t\t\t${fileRef} /* ${name} */,`],
+      ['/* Images.xcassets in Resources */,', `\t\t\t\t${buildFile} /* ${name} in Resources */,`],
+    ]
+    for (const [anchor, insertion] of edits) {
+      const next = insertAfterLine(patched, anchor, insertion)
+      if (next === patched) {
+        throw new Error(
+          `[vxrn] prebuild template project.pbxproj lost its Images.xcassets anchor (${anchor})`
+        )
+      }
+      patched = next
+    }
+  }
+  return patched
+}
+
+// ios copies fonts and the firebase plist next to the app sources; android
+// loads fonts from assets/fonts and the gradle plugin reads
+// app/google-services.json.
+function copyAppResources({
+  root,
+  dest,
+  platform,
+  app,
+}: {
+  root: string
+  dest: string
+  platform: 'ios' | 'android'
+  app: NativeAppManifest
+}): void {
+  const copies: Array<[string, string]> = (app.fonts ?? []).map((font) => [
+    font,
+    platform === 'ios'
+      ? path.join(dest, app.name, fontFileName(font))
+      : path.join(dest, 'app', 'src', 'main', 'assets', 'fonts', fontFileName(font)),
+  ])
+  const googleServices =
+    platform === 'ios' ? app.ios?.googleServicesFile : app.android?.googleServicesFile
+  if (googleServices) {
+    copies.push([
+      googleServices,
+      platform === 'ios'
+        ? path.join(dest, app.name, GOOGLE_SERVICES_PLIST)
+        : path.join(dest, 'app', 'google-services.json'),
+    ])
+  }
+  for (const [file, target] of copies) {
+    const source = path.resolve(root, file)
+    if (!FSExtra.existsSync(source)) {
+      throw new Error(`[vxrn] native.app names ${file}, which does not exist`)
+    }
+    FSExtra.mkdirSync(path.dirname(target), { recursive: true })
+    FSExtra.copyFileSync(source, target)
+  }
+}
+
+function patchIosPbxprojAppEntitlements(rendered: string, appName: string): string {
+  // the app entitlement file only when the app has an entitlement. the
   // community template ships no entitlements file, so this adds the file
   // reference plus the CODE_SIGN_ENTITLEMENTS setting on the app target.
   const edits: Array<[string, string]> = [
@@ -355,18 +607,117 @@ function patchIosPbxprojPushEntitlements(rendered: string, appName: string): str
     )
 }
 
-function renderPushEntitlements(): string {
+function renderPlistValue(value: PlistValue, indent: string): string {
+  if (typeof value === 'string') return `${indent}<string>${escapeXml(value)}</string>`
+  if (typeof value === 'boolean') return `${indent}<${value}/>`
+  if (typeof value === 'number') {
+    return Number.isInteger(value)
+      ? `${indent}<integer>${value}</integer>`
+      : `${indent}<real>${value}</real>`
+  }
+  if (Array.isArray(value)) {
+    return `${indent}<array>\n${value.map((item) => renderPlistValue(item, `${indent}\t`)).join('\n')}\n${indent}</array>`
+  }
+  return `${indent}<dict>\n${renderPlistEntries(value, `${indent}\t`)}\n${indent}</dict>`
+}
+
+function renderPlistEntries(entries: Record<string, PlistValue>, indent: string): string {
+  return Object.entries(entries)
+    .map(([key, value]) => `${indent}<key>${escapeXml(key)}</key>\n${renderPlistValue(value, indent)}`)
+    .join('\n')
+}
+
+// every app-target entitlement in one file: push, the widget app group,
+// associated domains, sign in with apple, then the app's own keys. a key the
+// manifest already models cannot be set twice through ios.entitlements.
+function appEntitlements(app: NativeAppManifest): Record<string, PlistValue> {
+  const modeled: Record<string, PlistValue> = {}
+  if (app.notifications?.push === true || app.ios?.widgets?.pushNotifications) {
+    modeled['aps-environment'] =
+      app.notifications?.apsEnvironment ?? notificationsHost.apsEnvironment
+  }
+  if (app.ios?.widgets) {
+    modeled['com.apple.security.application-groups'] = [app.ios.widgets.appGroup]
+  }
+  if (app.ios?.associatedDomains?.length) {
+    modeled['com.apple.developer.associated-domains'] = app.ios.associatedDomains
+  }
+  if (app.ios?.usesAppleSignIn) {
+    modeled['com.apple.developer.applesignin'] = ['Default']
+  }
+  for (const key of Object.keys(app.ios?.entitlements ?? {})) {
+    if (key in modeled) {
+      throw new Error(
+        `[vxrn] native.app.ios.entitlements sets ${key}, which native.app already writes: use its field`
+      )
+    }
+  }
+  return { ...modeled, ...app.ios?.entitlements }
+}
+
+function renderEntitlements(entries: Record<string, PlistValue>): string {
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-\t<key>aps-environment</key>
-\t<string>development</string>
+${renderPlistEntries(entries, '\t')}
 </dict>
 </plist>
 `
 }
 
+function patchAndroidMainApplicationUpdatesHost(rendered: string): string {
+  // One's factory takes the same named arguments, so swapping the import
+  // repoints the call site at the delegate that re-asks the launcher.
+  const anchor = 'import com.facebook.react.defaults.DefaultReactHost.getDefaultReactHost'
+  if (!rendered.includes(anchor)) {
+    throw new Error(
+      '[vxrn] prebuild template MainApplication.kt changed shape: cannot point the ReactHost at One.Updates'
+    )
+  }
+  return rendered.replace(
+    anchor,
+    'import com.margelo.nitro.one.OneUpdatesReactHost.getDefaultReactHost'
+  )
+}
+
+function escapeGradleString(value: string): string {
+  return value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')
+}
+
+function patchAndroidBuildGradleUpdatesManifest(
+  rendered: string,
+  runtimeVersion: string
+): string {
+  // every bundle task writes the embedded manifest into its own assets
+  // output beside index.android.bundle, with an id and timestamp generated
+  // at build time. the react block above was just replaced, so its
+  // autolink call is the anchor.
+  const anchor = '    autolinkLibrariesWithApp()\n}'
+  if (!rendered.includes(anchor)) {
+    throw new Error(
+      '[vxrn] cannot stamp the embedded updates manifest: expected the replaced react block in app/build.gradle'
+    )
+  }
+  const snippet = `${anchor}
+
+// [vxrn/one] the embedded update manifest lands beside the release bundle
+tasks.matching { it.name.startsWith("createBundle") && it.name.endsWith("JsAndAssets") }.configureEach { bundleTask ->
+    // capture the output directory provider at configuration time, so the
+    // action below holds no task reference at execution time.
+    def bundleDir = bundleTask.jsBundleDir
+    bundleTask.doLast {
+        def manifestFile = new File(bundleDir.get().asFile, "one-updates-embedded.json")
+        manifestFile.text = groovy.json.JsonOutput.toJson([
+            id: java.util.UUID.randomUUID().toString(),
+            createdAt: java.time.Instant.now().toString(),
+            runtimeVersion: "${escapeGradleString(runtimeVersion)}",
+        ])
+    }
+}`
+  return rendered.replace(anchor, snippet)
+}
+
 function patchIosPbxprojWidgets(project: string, app: NativeAppManifest): string {
   const name = app.name
   const bundleId = app.ios!.bundleId
@@ -528,16 +879,25 @@ function generateSceneDelegate(args: {
     path.join(dest, app.name, 'SceneDelegate.swift'),
     renderSceneDelegateSwift(app.name)
   )
-  // widgets use the same app entitlement file for the app group and apns.
-  // without widgets, push gets its own entitlement file.
-  if (app.notifications?.push === true && !app.ios?.widgets) {
+  // widgets write the app entitlements into their shared file; without
+  // widgets the app gets its own file when it has any entitlement.
+  const entitlements = appEntitlements(app)
+  if (Object.keys(entitlements).length && !app.ios?.widgets) {
     FSExtra.writeFileSync(
       path.join(dest, app.name, `${app.name}.entitlements`),
-      renderPushEntitlements()
+      renderEntitlements(entitlements)
     )
   }
 }
 
+function generateIosAppIntents(dest: string, platform: 'ios' | 'android', app: NativeAppManifest): void {
+  if (platform !== 'ios' || !app.ios?.appIntents) return
+  FSExtra.writeFileSync(
+    path.join(dest, app.name, 'OneAppIntents.swift'),
+    renderIosAppIntentsSwift(app.ios.appIntents.actions)
+  )
+}
+
 function generateIosWidgets(dest: string, app: NativeAppManifest): void {
   const widgets = app.ios?.widgets
   if (!widgets) return
@@ -550,12 +910,7 @@ function generateIosWidgets(dest: string, app: NativeAppManifest): void {
 `
   FSExtra.writeFileSync(
     path.join(appDir, 'OneAppWidgets.entitlements'),
-    widgets.pushNotifications || app.notifications?.push
-      ? entitlements.replace(
-          '</dict></plist>',
-          '<key>aps-environment</key><string>development</string></dict></plist>'
-        )
-      : entitlements
+    renderEntitlements(appEntitlements(app))
   )
   FSExtra.writeFileSync(path.join(extensionDir, 'OneWidgets.entitlements'), entitlements)
   FSExtra.writeFileSync(
@@ -1085,6 +1440,14 @@ export interface RenderedPrebuildFile {
   content: string | null
 }
 
+const IPAD_APP_ICON_SIZES: Array<[string, string[]]> = [
+  ['20x20', ['1x', '2x']],
+  ['29x29', ['1x', '2x']],
+  ['40x40', ['1x', '2x']],
+  ['76x76', ['1x', '2x']],
+  ['83.5x83.5', ['2x']],
+]
+
 async function generateAppIcons(args: {
   root: string
   dest: string
@@ -1094,38 +1457,66 @@ async function generateAppIcons(args: {
   const { root, dest, platform, app } = args
   if (!app.icon) return
 
+  if (platform === 'ios') {
+    const assetsDir = path.join(dest, app.name, 'Images.xcassets')
+    const template: {
+      images: Array<{ idiom: string; scale: string; size: string; filename?: string }>
+      info: { author: string; version: number }
+    } = JSON.parse(FSExtra.readFileSync(path.join(assetsDir, 'AppIcon.appiconset', 'Contents.json'), 'utf8'))
+    const icons: Array<[string, { source: string; backgroundColor: string }]> = [
+      ['AppIcon', app.icon],
+      ...Object.entries(app.ios?.alternateIcons ?? {}),
+    ]
+    for (const [name, icon] of icons) {
+      const source = path.resolve(root, icon.source)
+      if (!FSExtra.existsSync(source)) {
+        throw new Error(`[vxrn] native.app icon source does not exist: ${source}`)
+      }
+      const metadata = await sharp(source).metadata()
+      if (metadata.width !== metadata.height || metadata.width === undefined || metadata.width < 1024) {
+        throw new Error(`[vxrn] native.app icon source must be a square image at least 1024px wide: ${source}`)
+      }
+      const iconDir = path.join(assetsDir, `${name}.appiconset`)
+      FSExtra.mkdirSync(iconDir, { recursive: true })
+      const contents = structuredClone(template)
+      // the template is iPhone-only. App Store upload rejects a tablet build
+      // without the iPad sizes (ITMS-90023, 152 and 167 pixels among them).
+      if (app.ios?.tablet) {
+        for (const [size, scales] of IPAD_APP_ICON_SIZES) {
+          for (const scale of scales) contents.images.push({ idiom: 'ipad', scale, size })
+        }
+      }
+      for (const image of contents.images) {
+        const points = Number.parseFloat(image.size.split('x')[0])
+        const scale = Number.parseInt(image.scale, 10)
+        const pixels = points * scale
+        const filename = image.idiom === 'ios-marketing'
+          ? 'icon-1024.png' : `icon-${points}@${image.scale}.png`
+        image.filename = filename
+        await sharp(source)
+          .rotate()
+          .resize(pixels, pixels, { fit: 'cover' })
+          .flatten({ background: icon.backgroundColor })
+          .png()
+          .toFile(path.join(iconDir, filename))
+      }
+      FSExtra.writeFileSync(path.join(iconDir, 'Contents.json'), `${JSON.stringify(contents, null, 2)}\n`)
+    }
+    return
+  }
+
   const source = path.resolve(root, app.icon.source)
   if (!FSExtra.existsSync(source)) {
     throw new Error(`[vxrn] native.app.icon source does not exist: ${source}`)
   }
   const metadata = await sharp(source).metadata()
-  if (
-    metadata.width === undefined ||
-    metadata.height === undefined ||
-    metadata.width !== metadata.height ||
-    metadata.width < 1024
-  ) {
-    throw new Error(
-      '[vxrn] native.app.icon source must be a square image at least 1024px wide'
-    )
+  if (metadata.width !== metadata.height || metadata.width === undefined || metadata.width < 1024) {
+    throw new Error('[vxrn] native.app.icon source must be a square image at least 1024px wide')
   }
-
-  if (platform === 'ios') {
-    const iconDir = path.join(dest, app.name, 'Images.xcassets', 'AppIcon.appiconset')
-    const contentsPath = path.join(iconDir, 'Contents.json')
-    const contents: {
-      images: Array<{ idiom: string; scale: string; size: string; filename?: string }>
-      info: { author: string; version: number }
-    } = JSON.parse(FSExtra.readFileSync(contentsPath, 'utf8'))
-    for (const image of contents.images) {
-      const points = Number.parseFloat(image.size.split('x')[0])
-      const scale = Number.parseInt(image.scale, 10)
-      const pixels = points * scale
-      const filename =
-        image.idiom === 'ios-marketing'
-          ? 'icon-1024.png'
-          : `icon-${points}@${image.scale}.png`
-      image.filename = filename
+  for (const [density, multiplier] of Object.entries(ANDROID_DENSITIES)) {
+    const pixels = 48 * multiplier
+    const iconDir = path.join(dest, 'app', 'src', 'main', 'res', `mipmap-${density}`)
+    for (const filename of ['ic_launcher.png', 'ic_launcher_round.png']) {
       await sharp(source)
         .rotate()
         .resize(pixels, pixels, { fit: 'cover' })
@@ -1133,22 +1524,116 @@ async function generateAppIcons(args: {
         .png()
         .toFile(path.join(iconDir, filename))
     }
-    FSExtra.writeFileSync(contentsPath, `${JSON.stringify(contents, null, 2)}\n`)
-    return
   }
+}
 
-  for (const [density, multiplier] of Object.entries(ANDROID_DENSITIES)) {
-    const pixels = 48 * multiplier
-    const iconDir = path.join(dest, 'app', 'src', 'main', 'res', `mipmap-${density}`)
-    for (const filename of ['ic_launcher.png', 'ic_launcher_round.png']) {
+// the android 8+ launcher icon: foreground, background and monochrome
+// layers at 108dp per density, wired by mipmap-anydpi-v26. a background color
+// lives in its own resource file, as android studio's image asset tool writes
+// it, so the splash's colors.xml never collides with it.
+async function generateAdaptiveIcon(args: {
+  root: string
+  dest: string
+  app: NativeAppManifest
+}): Promise<void> {
+  const { root, dest, app } = args
+  const adaptiveIcon = app.android?.adaptiveIcon
+  if (!adaptiveIcon) return
+
+  const res = path.join(dest, 'app', 'src', 'main', 'res')
+  const layers = {
+    foreground: adaptiveIcon.foreground,
+    background: adaptiveIcon.background,
+    monochrome: adaptiveIcon.monochrome,
+  }
+  for (const [layer, file] of Object.entries(layers)) {
+    if (!file) continue
+    const source = path.resolve(root, file)
+    if (!FSExtra.existsSync(source)) {
+      throw new Error(`[vxrn] native.app.android.adaptiveIcon.${layer} does not exist: ${source}`)
+    }
+    for (const [density, multiplier] of Object.entries(ANDROID_DENSITIES)) {
+      const pixels = 108 * multiplier
       await sharp(source)
         .rotate()
         .resize(pixels, pixels, { fit: 'cover' })
-        .flatten({ background: app.icon.backgroundColor })
         .png()
-        .toFile(path.join(iconDir, filename))
+        .toFile(path.join(res, `mipmap-${density}`, `ic_launcher_${layer}.png`))
+    }
+  }
+  if (!adaptiveIcon.background) {
+    FSExtra.writeFileSync(
+      path.join(res, 'values', 'ic_launcher_background.xml'),
+      `<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <color name="ic_launcher_background">${adaptiveIcon.backgroundColor ?? '#FFFFFF'}</color>
+</resources>
+`
+    )
+  }
+  const adaptiveXml = `<?xml version="1.0" encoding="utf-8"?>
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+    <background android:drawable="${adaptiveIcon.background ? '@mipmap/ic_launcher_background' : '@color/ic_launcher_background'}"/>
+    <foreground android:drawable="@mipmap/ic_launcher_foreground"/>
+${adaptiveIcon.monochrome ? '    <monochrome android:drawable="@mipmap/ic_launcher_monochrome"/>\n' : ''}</adaptive-icon>
+`
+  const anydpi = path.join(res, 'mipmap-anydpi-v26')
+  FSExtra.mkdirSync(anydpi, { recursive: true })
+  for (const filename of ['ic_launcher.xml', 'ic_launcher_round.xml']) {
+    FSExtra.writeFileSync(path.join(anydpi, filename), adaptiveXml)
+  }
+}
+
+const IOS_DARK_APPEARANCE = [{ appearance: 'luminosity', value: 'dark' }]
+
+function srgb(hex: string) {
+  return {
+    red: Number.parseInt(hex.slice(1, 3), 16) / 255,
+    green: Number.parseInt(hex.slice(3, 5), 16) / 255,
+    blue: Number.parseInt(hex.slice(5, 7), 16) / 255,
+  }
+}
+
+// an asset catalog color entry, with its dark appearance when one is given.
+function xcodeColorSet(light: string, dark: string | undefined): string {
+  const entry = (hex: string) => {
+    const { red, green, blue } = srgb(hex)
+    return {
+      color: {
+        'color-space': 'srgb',
+        components: {
+          red: red.toFixed(3),
+          green: green.toFixed(3),
+          blue: blue.toFixed(3),
+          alpha: '1.000',
+        },
+      },
+      idiom: 'universal',
     }
   }
+  return `${JSON.stringify(
+    {
+      colors: [
+        entry(light),
+        ...(dark ? [{ appearances: IOS_DARK_APPEARANCE, ...entry(dark) }] : []),
+      ],
+      info: { author: 'xcode', version: 1 },
+    },
+    null,
+    2
+  )}\n`
+}
+
+// the AccentColor asset the Info.plist names as the app's tint.
+function generateAccentColor(args: { dest: string; app: NativeAppManifest }): void {
+  const accent = args.app.ios?.accentColor
+  if (!accent) return
+  const colorDir = path.join(args.dest, args.app.name, 'Images.xcassets', 'AccentColor.colorset')
+  FSExtra.mkdirSync(colorDir, { recursive: true })
+  FSExtra.writeFileSync(
+    path.join(colorDir, 'Contents.json'),
+    xcodeColorSet(accent.light, accent.dark)
+  )
 }
 
 async function generateSplashScreen(args: {
@@ -1160,42 +1645,112 @@ async function generateSplashScreen(args: {
   const { root, dest, platform, app } = args
   if (!app.splash) return
 
-  const source = path.resolve(root, app.splash.source)
-  if (!FSExtra.existsSync(source)) {
-    throw new Error(`[vxrn] native.app.splash source does not exist: ${source}`)
-  }
-  const { data: artwork, info: metadata } = await sharp(source)
-    .rotate()
-    .trim({ background: app.splash.backgroundColor })
-    .png()
-    .toBuffer({ resolveWithObject: true })
-  if (!metadata.width || !metadata.height) {
-    throw new Error('[vxrn] native.app.splash source must be an image')
+  // a cover splash fills the launch screen, so its artwork keeps its margins.
+  const cover = app.splash.resizeMode === 'cover'
+  const prepareArtwork = async (sourcePath: string, backgroundColor: string) => {
+    const source = path.resolve(root, sourcePath)
+    if (!FSExtra.existsSync(source)) {
+      throw new Error(`[vxrn] native.app.splash source does not exist: ${source}`)
+    }
+    // a vector source rasterizes at the density its largest use needs: the
+    // @3x launch artwork, or the android xxxhdpi splash.
+    const { width: sourceWidth, format } = await sharp(source).metadata()
+    const density =
+      format === 'svg' && sourceWidth && !cover
+        ? Math.min(2400, Math.ceil((72 * 4 * (app.splash?.width ?? 200)) / sourceWidth))
+        : undefined
+    const image = sharp(source, density ? { density } : {}).rotate()
+    const prepared = await (cover ? image : image.trim({ background: backgroundColor }))
+      .png()
+      .toBuffer({ resolveWithObject: true })
+    if (!prepared.info.width || !prepared.info.height) {
+      throw new Error('[vxrn] native.app.splash source must be an image')
+    }
+    return prepared
   }
+  const { data: artwork, info: metadata } = await prepareArtwork(
+    app.splash.source,
+    app.splash.backgroundColor
+  )
+  const dark = app.splash.dark
+  const darkArtwork = dark?.source
+    ? (await prepareArtwork(dark.source, dark.backgroundColor)).data
+    : undefined
   const artworkWidth = app.splash.width ?? 200
   const artworkHeight = Number(
     (artworkWidth * (metadata.height / metadata.width)).toFixed(3)
   )
+  // a full-bleed background keeps its own resolution on both platforms; the
+  // launch surface scales it (aspect-fill on ios, fill on android).
+  const readBackground = (sourcePath: string) => {
+    const source = path.resolve(root, sourcePath)
+    if (!FSExtra.existsSync(source)) {
+      throw new Error(`[vxrn] native.app.splash backgroundImage does not exist: ${source}`)
+    }
+    return sharp(source).rotate().png().toBuffer({ resolveWithObject: true })
+  }
 
   if (platform === 'ios') {
     const appDir = path.join(dest, app.name)
-    const splashDir = path.join(appDir, 'Images.xcassets', 'Splash.imageset')
-    FSExtra.mkdirSync(splashDir, { recursive: true })
-    await sharp(artwork).toFile(path.join(splashDir, 'splash.png'))
+    const assets = path.join(appDir, 'Images.xcassets')
+    // one imageset per image, each with an optional dark appearance. contain
+    // artwork is drawn at 1x, 2x and 3x of its launch width; a full-bleed
+    // image keeps its own resolution.
+    const writeImageSet = async (
+      name: string,
+      light: Buffer,
+      dark: Buffer | undefined,
+      pointWidth: number | undefined
+    ) => {
+      const dir = path.join(assets, `${name}.imageset`)
+      FSExtra.mkdirSync(dir, { recursive: true })
+      const scales = pointWidth === undefined ? [1] : [1, 2, 3]
+      const images: Array<Record<string, unknown>> = []
+      for (const [variant, suffix, appearances] of [
+        [light, '', undefined],
+        [dark, '-dark', IOS_DARK_APPEARANCE],
+      ] as const) {
+        if (!variant) continue
+        for (const scale of scales) {
+          const filename = `${name.toLowerCase()}${suffix}${scale === 1 ? '' : `@${scale}x`}.png`
+          const output = sharp(variant)
+          await (pointWidth === undefined
+            ? output
+            : output.resize({ width: Math.round(pointWidth * scale) })
+          )
+            .png()
+            .toFile(path.join(dir, filename))
+          images.push({
+            ...(appearances ? { appearances } : {}),
+            filename,
+            idiom: 'universal',
+            scale: `${scale}x`,
+          })
+        }
+      }
+      FSExtra.writeFileSync(
+        path.join(dir, 'Contents.json'),
+        `${JSON.stringify({ images, info: { author: 'xcode', version: 1 } }, null, 2)}\n`
+      )
+    }
+    await writeImageSet('Splash', artwork, darkArtwork, cover ? undefined : artworkWidth)
+    const background = app.splash.backgroundImage
+      ? await readBackground(app.splash.backgroundImage)
+      : undefined
+    const darkBackground = dark?.backgroundImage
+      ? (await readBackground(dark.backgroundImage)).data
+      : undefined
+    if (background) {
+      await writeImageSet('SplashBackgroundImage', background.data, darkBackground, undefined)
+    }
+    // the launch background is a named color so a dark launch gets its own.
+    const colorDir = path.join(assets, 'SplashBackground.colorset')
+    FSExtra.mkdirSync(colorDir, { recursive: true })
     FSExtra.writeFileSync(
-      path.join(splashDir, 'Contents.json'),
-      `${JSON.stringify(
-        {
-          images: [{ filename: 'splash.png', idiom: 'universal', scale: '1x' }],
-          info: { author: 'xcode', version: 1 },
-        },
-        null,
-        2
-      )}\n`
+      path.join(colorDir, 'Contents.json'),
+      xcodeColorSet(app.splash.backgroundColor, dark?.backgroundColor)
     )
-    const red = Number.parseInt(app.splash.backgroundColor.slice(1, 3), 16) / 255
-    const green = Number.parseInt(app.splash.backgroundColor.slice(3, 5), 16) / 255
-    const blue = Number.parseInt(app.splash.backgroundColor.slice(5, 7), 16) / 255
+    const { red, green, blue } = srgb(app.splash.backgroundColor)
     FSExtra.writeFileSync(
       path.join(appDir, 'LaunchScreen.storyboard'),
       `<?xml version="1.0" encoding="UTF-8"?>
@@ -1212,15 +1767,35 @@ async function generateSplashScreen(args: {
         <viewController id="launch-controller" sceneMemberID="viewController">
           <view key="view" contentMode="scaleToFill" id="launch-view">
             <rect key="frame" x="0.0" y="0.0" width="390" height="844"/>
-            <subviews>
-              <imageView userInteractionEnabled="NO" contentMode="scaleAspectFit" image="Splash" translatesAutoresizingMaskIntoConstraints="NO" id="splash-image"/>
+            <subviews>${
+              background
+                ? `
+              <imageView userInteractionEnabled="NO" contentMode="scaleAspectFill" image="SplashBackgroundImage" translatesAutoresizingMaskIntoConstraints="NO" id="splash-background"/>`
+                : ''
+            }
+              <imageView userInteractionEnabled="NO" contentMode="${cover ? 'scaleAspectFill' : 'scaleAspectFit'}" image="Splash" translatesAutoresizingMaskIntoConstraints="NO" id="splash-image"/>
             </subviews>
-            <color key="backgroundColor" red="${red}" green="${green}" blue="${blue}" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
-            <constraints>
-              <constraint firstItem="splash-image" firstAttribute="centerX" secondItem="launch-view" secondAttribute="centerX" id="splash-center-x"/>
+            <color key="backgroundColor" name="SplashBackground"/>
+            <constraints>${
+              background
+                ? `
+              <constraint firstItem="splash-background" firstAttribute="leading" secondItem="launch-view" secondAttribute="leading" id="splash-background-leading"/>
+              <constraint firstItem="splash-background" firstAttribute="trailing" secondItem="launch-view" secondAttribute="trailing" id="splash-background-trailing"/>
+              <constraint firstItem="splash-background" firstAttribute="top" secondItem="launch-view" secondAttribute="top" id="splash-background-top"/>
+              <constraint firstItem="splash-background" firstAttribute="bottom" secondItem="launch-view" secondAttribute="bottom" id="splash-background-bottom"/>`
+                : ''
+            }
+${
+  cover
+    ? `              <constraint firstItem="splash-image" firstAttribute="leading" secondItem="launch-view" secondAttribute="leading" id="splash-leading"/>
+              <constraint firstItem="splash-image" firstAttribute="trailing" secondItem="launch-view" secondAttribute="trailing" id="splash-trailing"/>
+              <constraint firstItem="splash-image" firstAttribute="top" secondItem="launch-view" secondAttribute="top" id="splash-top"/>
+              <constraint firstItem="splash-image" firstAttribute="bottom" secondItem="launch-view" secondAttribute="bottom" id="splash-bottom"/>`
+    : `              <constraint firstItem="splash-image" firstAttribute="centerX" secondItem="launch-view" secondAttribute="centerX" id="splash-center-x"/>
               <constraint firstItem="splash-image" firstAttribute="centerY" secondItem="launch-view" secondAttribute="centerY" id="splash-center-y"/>
               <constraint firstItem="splash-image" firstAttribute="width" constant="${artworkWidth}" id="splash-width"/>
-              <constraint firstItem="splash-image" firstAttribute="height" constant="${artworkHeight}" id="splash-height"/>
+              <constraint firstItem="splash-image" firstAttribute="height" constant="${artworkHeight}" id="splash-height"/>`
+}
             </constraints>
           </view>
         </viewController>
@@ -1229,7 +1804,15 @@ async function generateSplashScreen(args: {
     </scene>
   </scenes>
   <resources>
-    <image name="Splash" width="${metadata.width}" height="${metadata.height}"/>
+    <image name="Splash" width="${cover ? metadata.width : artworkWidth}" height="${cover ? metadata.height : artworkHeight}"/>${
+      background
+        ? `
+    <image name="SplashBackgroundImage" width="${background.info.width}" height="${background.info.height}"/>`
+        : ''
+    }
+    <namedColor name="SplashBackground">
+      <color red="${red}" green="${green}" blue="${blue}" alpha="1" colorSpace="custom" customColorSpace="sRGB"/>
+    </namedColor>
   </resources>
 </document>
 `
@@ -1239,42 +1822,77 @@ async function generateSplashScreen(args: {
 
   const mainRes = path.join(dest, 'app', 'src', 'main', 'res')
   const drawable = path.join(mainRes, 'drawable')
-  for (const [density, multiplier] of Object.entries(ANDROID_DENSITIES)) {
-    const canvasSize = 288 * multiplier
-    const imageSize = Math.round(artworkWidth * multiplier)
-    const contained = await sharp(artwork)
-      .resize(imageSize, imageSize, {
-        fit: 'contain',
-        background: { r: 0, g: 0, b: 0, alpha: 0 },
-      })
-      .png()
-      .toBuffer()
-    const drawableDensity = path.join(mainRes, `drawable-${density}`)
-    FSExtra.mkdirSync(drawableDensity, { recursive: true })
-    await sharp({
-      create: {
-        width: canvasSize,
-        height: canvasSize,
-        channels: 4,
-        background: { r: 0, g: 0, b: 0, alpha: 0 },
-      },
-    })
-      .composite([
-        {
-          input: contained,
-          left: Math.round((canvasSize - imageSize) / 2),
-          top: Math.round((canvasSize - imageSize) / 2),
+  const variants: Array<[Buffer, string]> = [[artwork, 'drawable']]
+  if (darkArtwork) variants.push([darkArtwork, 'drawable-night'])
+  for (const [variantArtwork, drawablePrefix] of variants) {
+    for (const [density, multiplier] of Object.entries(ANDROID_DENSITIES)) {
+      const canvasSize = 288 * multiplier
+      const imageSize = Math.round(artworkWidth * multiplier)
+      const contained = await sharp(variantArtwork)
+        .resize(imageSize, imageSize, {
+          fit: 'contain',
+          background: { r: 0, g: 0, b: 0, alpha: 0 },
+        })
+        .png()
+        .toBuffer()
+      const drawableDensity = path.join(mainRes, `${drawablePrefix}-${density}`)
+      FSExtra.mkdirSync(drawableDensity, { recursive: true })
+      await sharp({
+        create: {
+          width: canvasSize,
+          height: canvasSize,
+          channels: 4,
+          background: { r: 0, g: 0, b: 0, alpha: 0 },
         },
-      ])
-      .png()
-      .toFile(path.join(drawableDensity, 'splash.png'))
+      })
+        .composite([
+          {
+            input: contained,
+            left: Math.round((canvasSize - imageSize) / 2),
+            top: Math.round((canvasSize - imageSize) / 2),
+          },
+        ])
+        .png()
+        .toFile(path.join(drawableDensity, 'splash.png'))
+    }
+  }
+  // the background paints full-bleed under the mark. one nodpi asset per
+  // appearance: gravity fill stretches it over the layer bounds on every
+  // screen, which the gradient art this contract carries survives exactly.
+  // a night appearance without its own image falls back to the light one,
+  // the way the ios imageset falls back to its universal entry.
+  const background = app.splash.backgroundImage
+    ? await readBackground(app.splash.backgroundImage)
+    : undefined
+  const darkBackground = dark?.backgroundImage
+    ? (await readBackground(dark.backgroundImage)).data
+    : undefined
+  if (background) {
+    const nodpi = path.join(mainRes, 'drawable-nodpi')
+    FSExtra.mkdirSync(nodpi, { recursive: true })
+    FSExtra.writeFileSync(path.join(nodpi, 'splash_background.png'), background.data)
+    if (darkBackground) {
+      const nightNodpi = path.join(mainRes, 'drawable-night-nodpi')
+      FSExtra.mkdirSync(nightNodpi, { recursive: true })
+      FSExtra.writeFileSync(
+        path.join(nightNodpi, 'splash_background.png'),
+        darkBackground
+      )
+    }
   }
   FSExtra.writeFileSync(
     path.join(drawable, 'launch_screen.xml'),
     `<?xml version="1.0" encoding="utf-8"?>
 <layer-list xmlns:android="http://schemas.android.com/apk/res/android">
     <item android:drawable="@color/splash_background" />
-    <item>
+${
+  background
+    ? `    <item>
+        <bitmap android:gravity="fill" android:src="@drawable/splash_background" />
+    </item>
+`
+    : ''
+}    <item>
         <bitmap android:gravity="center" android:src="@drawable/splash" />
     </item>
 </layer-list>
@@ -1288,6 +1906,17 @@ async function generateSplashScreen(args: {
 </resources>
 `
   )
+  if (dark) {
+    FSExtra.mkdirSync(path.join(mainRes, 'values-night'), { recursive: true })
+    FSExtra.writeFileSync(
+      path.join(mainRes, 'values-night', 'colors.xml'),
+      `<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <color name="splash_background">${dark.backgroundColor}</color>
+</resources>
+`
+    )
+  }
   const stylesPath = path.join(mainRes, 'values', 'styles.xml')
   const styles = FSExtra.readFileSync(stylesPath, 'utf8').replace(
     '        <!-- Customize your theme here. -->',
@@ -1296,16 +1925,19 @@ async function generateSplashScreen(args: {
   FSExtra.writeFileSync(stylesPath, styles)
   const stylesV31 = path.join(mainRes, 'values-v31')
   FSExtra.mkdirSync(stylesV31, { recursive: true })
+  // a values-v31 AppTheme replaces the base one on API 31+, so it is the base
+  // theme (parent included) plus the system splash items, never a bare style.
+  if (!styles.includes('</style>')) {
+    throw new Error('[vxrn] prebuild template styles.xml lost its AppTheme </style> anchor')
+  }
   FSExtra.writeFileSync(
     path.join(stylesV31, 'styles.xml'),
-    `<?xml version="1.0" encoding="utf-8"?>
-<resources>
-    <style name="AppTheme">
-        <item name="android:windowSplashScreenBackground">@color/splash_background</item>
+    styles.replace(
+      '</style>',
+      `    <item name="android:windowSplashScreenBackground">@color/splash_background</item>
         <item name="android:windowSplashScreenAnimatedIcon">@drawable/splash</item>
-    </style>
-</resources>
-`
+    </style>`
+    )
   )
 }
 
@@ -1374,20 +2006,107 @@ ${schemes.map((scheme) => `\t\t\t\t<string>${scheme}</string>`).join('\n')}
           `\t<key>ITSAppUsesNonExemptEncryption</key>\n\t<${app.ios.usesNonExemptEncryption ? 'true' : 'false'}/>`
         )
       }
+      if (app.ios?.accentColor) {
+        stamps.push('\t<key>NSAccentColorName</key>\n\t<string>AccentColor</string>')
+      }
       if (app.ios?.fileSharing) {
         stamps.push(
           `\t<key>UIFileSharingEnabled</key>\n\t<true/>\n\t<key>LSSupportsOpeningDocumentsInPlace</key>\n\t<true/>`
         )
       }
+      if (app.photoLibrary?.readWrite !== undefined) {
+        stamps.push('\t<key>PHPhotoLibraryPreventAutomaticLimitedAccessAlert</key>\n\t<true/>')
+      }
       if (app.notifications !== undefined) {
         // gates the UNUserNotificationCenter delegate install: apps that link
-        // @vxrn/native without notifications keep whatever delegate their own
+        // one without notifications keep whatever delegate their own
         // push library sets.
-        stamps.push(`\t<key>OneNativeNotificationsEnabled</key>\n\t<true/>`)
+        stamps.push(`\t<key>${notificationsHost.enabledInfoPlistKey}</key>\n\t<true/>`)
+      }
+      if (app.notifications?.push === true) {
+        // without the aps-environment entitlement the simulator never answers
+        // registerForRemoteNotifications, so the token getter reads this to
+        // reject at once like android's nopush flavor.
+        stamps.push(`\t<key>${notificationsHost.pushInfoPlistKey}</key>\n\t<true/>`)
       }
       if (app.ios?.widgets) {
         stamps.push('\t<key>NSSupportsLiveActivities</key>\n\t<true/>')
       }
+      const refreshTasks = app.ios?.backgroundTasks?.refresh ?? []
+      const processingTasks = app.ios?.backgroundTasks?.processing ?? []
+      if (refreshTasks.length || processingTasks.length) {
+        const plistArray = (key: string, identifiers: string[]) =>
+          `\t<key>${key}</key>\n\t<array>\n${identifiers.map((identifier) => `\t\t<string>${escapeXml(identifier)}</string>`).join('\n')}\n\t</array>`
+        stamps.push(plistArray('BGTaskSchedulerPermittedIdentifiers', [...refreshTasks, ...processingTasks]))
+        stamps.push(plistArray('OneBackgroundRefreshTaskIdentifiers', refreshTasks))
+        stamps.push(plistArray('OneBackgroundProcessingTaskIdentifiers', processingTasks))
+      }
+      if (app.ios?.appIntents) {
+        stamps.push(
+          `\t<key>OneAppIntentIdentifiers</key>\n\t<array>\n${app.ios.appIntents.actions.map((action) => `\t\t<string>${escapeXml(action.id)}</string>`).join('\n')}\n\t</array>`
+        )
+      }
+      const backgroundModes = [
+        ...(app.pictureInPicture || app.audio?.background ? ['audio'] : []),
+        ...(app.location?.background ? ['location'] : []),
+        ...(refreshTasks.length ? ['fetch'] : []),
+        ...(processingTasks.length ? ['processing'] : []),
+      ]
+      if (backgroundModes.length) {
+        stamps.push(
+          `\t<key>UIBackgroundModes</key>\n\t<array>\n${backgroundModes.map((mode) => `\t\t<string>${mode}</string>`).join('\n')}\n\t</array>`
+        )
+      }
+      if (app.updates !== undefined) {
+        // the launcher reads both; without the url the embedded bundle
+        // launches with updates disabled.
+        if (app.updates.url !== undefined) {
+          stamps.push(
+            `\t<key>${updatesHost.urlInfoPlistKey}</key>\n\t<string>${escapeXml(app.updates.url)}</string>`
+          )
+        }
+        stamps.push(
+          `\t<key>${updatesHost.runtimeVersionInfoPlistKey}</key>\n\t<string>${escapeXml(app.updates.runtimeVersion)}</string>`
+        )
+      }
+      if (app.fonts?.length) {
+        stamps.push(
+          `\t<key>UIAppFonts</key>\n\t<array>\n${app.fonts.map((font) => `\t\t<string>${escapeXml(fontFileName(font))}</string>`).join('\n')}\n\t</array>`
+        )
+      }
+      if (app.userInterfaceStyle !== undefined) {
+        stamps.push(
+          `\t<key>UIUserInterfaceStyle</key>\n\t<string>${app.userInterfaceStyle === 'light' ? 'Light' : app.userInterfaceStyle === 'dark' ? 'Dark' : 'Automatic'}</string>`
+        )
+      }
+      if (app.orientation !== undefined) {
+        // expo's orientation mapping: it sets the phone list only.
+        const phoneOrientations =
+          app.orientation === 'portrait'
+            ? PORTRAIT_ORIENTATIONS
+            : app.orientation === 'landscape'
+              ? LANDSCAPE_ORIENTATIONS
+              : [...PORTRAIT_ORIENTATIONS, ...LANDSCAPE_ORIENTATIONS]
+        const phoneList =
+          /\t<key>UISupportedInterfaceOrientations<\/key>\n\t<array>\n[\s\S]*?\t<\/array>/
+        if (!phoneList.test(rendered)) {
+          throw new Error(
+            `[vxrn] prebuild template ${relativePath} lost its UISupportedInterfaceOrientations list`
+          )
+        }
+        rendered = rendered.replace(
+          phoneList,
+          `\t<key>UISupportedInterfaceOrientations</key>\n\t<array>\n${phoneOrientations.map((orientation) => `\t\t<string>${orientation}</string>`).join('\n')}\n\t</array>`
+        )
+      }
+      for (const [key, value] of Object.entries(app.ios?.infoPlist ?? {})) {
+        if (rendered.includes(`<key>${key}</key>`) || stamps.some((stamp) => stamp.includes(`<key>${key}</key>`))) {
+          throw new Error(
+            `[vxrn] native.app.ios.infoPlist sets ${key}, which the template or native.app already writes: use its field`
+          )
+        }
+        stamps.push(renderPlistEntries({ [key]: value }, '\t'))
+      }
       if (stamps.length) {
         const anchor = '\t<key>LSRequiresIPhoneOS</key>'
         if (!rendered.includes(anchor))
@@ -1400,17 +2119,64 @@ ${schemes.map((scheme) => `\t\t\t\t<string>${scheme}</string>`).join('\n')}
     if (
       platform === 'android' &&
       relativePath === 'app/src/main/AndroidManifest.xml' &&
-      app.imagePicker?.camera !== undefined
+      (app.imagePicker?.camera !== undefined || app.speech !== undefined)
     ) {
       const anchor = '<uses-permission android:name="android.permission.INTERNET" />'
       if (!rendered.includes(anchor)) {
         throw new Error(
-          '[vxrn] cannot stamp the camera permission: expected the INTERNET permission in app/src/main/AndroidManifest.xml'
+          '[vxrn] cannot stamp the camera or microphone permission: expected the INTERNET permission in app/src/main/AndroidManifest.xml'
+        )
+      }
+      const stamps: string[] = []
+      if (app.imagePicker?.camera !== undefined) {
+        stamps.push('    <uses-permission android:name="android.permission.CAMERA" />')
+      }
+      if (app.speech !== undefined) {
+        // package visibility (android 11+) hides the recognition service
+        // from SpeechRecognizer.isRecognitionAvailable without the query
+        stamps.push(
+          '    <uses-permission android:name="android.permission.RECORD_AUDIO" />',
+          '    <queries>\n      <intent>\n        <action android:name="android.speech.RecognitionService" />\n      </intent>\n    </queries>'
+        )
+      }
+      rendered = rendered.replace(anchor, `${anchor}\n${stamps.join('\n')}`)
+    }
+    if (
+      platform === 'android' &&
+      relativePath === 'app/src/main/AndroidManifest.xml' &&
+      app.location !== undefined
+    ) {
+      const anchor = '<uses-permission android:name="android.permission.INTERNET" />'
+      if (!rendered.includes(anchor)) {
+        throw new Error(
+          '[vxrn] cannot stamp location permissions: expected the INTERNET permission in app/src/main/AndroidManifest.xml'
+        )
+      }
+      const stamps = [
+        '    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />',
+        '    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />',
+      ]
+      if (app.location.background) {
+        stamps.push(
+          '    <uses-permission android:name="android.permission.ACCESS_BACKGROUND_LOCATION" />'
+        )
+      }
+      rendered = rendered.replace(anchor, `${anchor}\n${stamps.join('\n')}`)
+    }
+    if (
+      platform === 'android' &&
+      relativePath === 'app/src/main/AndroidManifest.xml' &&
+      app.pedometer !== undefined
+    ) {
+      const anchor = '<uses-permission android:name="android.permission.INTERNET" />'
+      if (!rendered.includes(anchor)) {
+        throw new Error(
+          '[vxrn] cannot stamp the pedometer permission: expected the INTERNET permission in app/src/main/AndroidManifest.xml'
         )
       }
       rendered = rendered.replace(
         anchor,
-        `${anchor}\n    <uses-permission android:name="android.permission.CAMERA" />`
+        `${anchor}\n    <uses-permission android:name="android.permission.ACTIVITY_RECOGNITION" />`
       )
     }
     if (
@@ -1426,9 +2192,14 @@ ${schemes.map((scheme) => `\t\t\t\t<string>${scheme}</string>`).join('\n')}
       }
       rendered = rendered.replace(
         anchor,
-        `${anchor}\n    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />\n    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />`
+        [
+          anchor,
+          ...notificationsHost.androidPermissions.map(
+            (permission) => `    <uses-permission android:name="${permission}" />`
+          ),
+        ].join('\n')
       )
-      if (!rendered.includes('android.permission.POST_NOTIFICATIONS')) {
+      if (!rendered.includes(notificationsHost.androidPermissions[0])) {
         throw new Error(
           '[vxrn] failed to stamp notification permissions into app manifest'
         )
@@ -1438,9 +2209,9 @@ ${schemes.map((scheme) => `\t\t\t\t<string>${scheme}</string>`).join('\n')}
       // arrive as explicit intents; only boot needs the filter.
       rendered = rendered.replace(
         '      </activity>\n    </application>',
-        '      </activity>\n      <receiver android:name="dev.onejs.onenative.OneNativeNotificationsReceiver" android:exported="false">\n          <intent-filter>\n              <action android:name="android.intent.action.BOOT_COMPLETED" />\n          </intent-filter>\n      </receiver>\n    </application>'
+        `      </activity>\n      <receiver android:name="${notificationsHost.receiver}" android:exported="false">\n          <intent-filter>\n              <action android:name="${notificationsHost.receiverAction}" />\n          </intent-filter>\n      </receiver>\n    </application>`
       )
-      if (!rendered.includes('OneNativeNotificationsReceiver')) {
+      if (!rendered.includes(notificationsHost.receiver)) {
         throw new Error(
           '[vxrn] failed to stamp the notification receiver into app manifest'
         )
@@ -1454,7 +2225,7 @@ ${schemes.map((scheme) => `\t\t\t\t<string>${scheme}</string>`).join('\n')}
       // the fcm refresh service lives in the app manifest, never the
       // library one, so apps without push never start it. push implies the
       // notifications block above, so the receiver anchor is present.
-      const anchor = 'dev.onejs.onenative.OneNativeNotificationsReceiver'
+      const anchor = notificationsHost.receiver
       if (!rendered.includes(anchor)) {
         throw new Error(
           '[vxrn] cannot stamp the push service: expected the notification receiver in app/src/main/AndroidManifest.xml'
@@ -1462,12 +2233,174 @@ ${schemes.map((scheme) => `\t\t\t\t<string>${scheme}</string>`).join('\n')}
       }
       rendered = rendered.replace(
         '      </receiver>\n    </application>',
-        '      </receiver>\n      <service android:name="dev.onejs.onenative.OneNativePushService" android:exported="false">\n          <intent-filter>\n              <action android:name="com.google.firebase.MESSAGING_EVENT" />\n          </intent-filter>\n      </service>\n    </application>'
+        `      </receiver>\n      <service android:name="${notificationsHost.pushService}" android:exported="false">\n          <intent-filter>\n              <action android:name="${notificationsHost.pushServiceAction}" />\n          </intent-filter>\n      </service>\n    </application>`
       )
-      if (!rendered.includes('OneNativePushService')) {
+      if (!rendered.includes(notificationsHost.pushService)) {
         throw new Error('[vxrn] failed to stamp the push service into app manifest')
       }
     }
+    // after the notification receiver and push service stamps, which own
+    // the activity and receiver anchors; this block only needs </application>.
+    if (
+      platform === 'android' &&
+      relativePath === 'app/src/main/AndroidManifest.xml' &&
+      (app.audio !== undefined ||
+        app.photoLibrary !== undefined ||
+        app.contacts !== undefined ||
+        app.calendar !== undefined ||
+        app.ios?.backgroundTasks !== undefined)
+    ) {
+      const anchor = '<uses-permission android:name="android.permission.INTERNET" />'
+      if (!rendered.includes(anchor)) {
+        throw new Error(
+          '[vxrn] cannot stamp media permissions: expected the INTERNET permission in app/src/main/AndroidManifest.xml'
+        )
+      }
+      const stamps: string[] = []
+      if (
+        app.audio?.microphone !== undefined &&
+        !rendered.includes('android.permission.RECORD_AUDIO')
+      ) {
+        stamps.push('    <uses-permission android:name="android.permission.RECORD_AUDIO" />')
+      }
+      if (app.photoLibrary?.readWrite !== undefined) {
+        stamps.push(
+          '    <uses-permission android:name="android.permission.READ_MEDIA_IMAGES" />',
+          '    <uses-permission android:name="android.permission.READ_MEDIA_VIDEO" />',
+          '    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" android:maxSdkVersion="32" />'
+        )
+      }
+      if (app.photoLibrary?.addOnly !== undefined) {
+        // no install-time permission past 28; the meta-data below is the
+        // declaration the Kotlin add check reads.
+        stamps.push(
+          '    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" android:maxSdkVersion="28" />'
+        )
+      }
+      if (app.contacts !== undefined) {
+        stamps.push(
+          '    <uses-permission android:name="android.permission.READ_CONTACTS" />',
+          '    <uses-permission android:name="android.permission.WRITE_CONTACTS" />'
+        )
+      }
+      if (app.calendar?.usage !== undefined) {
+        stamps.push(
+          '    <uses-permission android:name="android.permission.READ_CALENDAR" />',
+          '    <uses-permission android:name="android.permission.WRITE_CALENDAR" />'
+        )
+      }
+      if (app.calendar?.remindersUsage !== undefined) {
+        if (!rendered.includes('android.permission.POST_NOTIFICATIONS')) {
+          stamps.push('    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />')
+        }
+        if (!rendered.includes('android.permission.RECEIVE_BOOT_COMPLETED')) {
+          stamps.push('    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />')
+        }
+      }
+      if (app.audio?.background === true) {
+        stamps.push(
+          '    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />',
+          '    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK" />'
+        )
+      }
+      if (stamps.length) {
+        rendered = rendered.replace(anchor, `${anchor}\n${stamps.join('\n')}`)
+      }
+      // config markers the Kotlin manifest checks read: add-only has no
+      // permission past 28, and background playback gates the service.
+      const appStamps: string[] = []
+      if (app.calendar?.remindersUsage !== undefined) {
+        appStamps.push(
+          '      <meta-data android:name="one.calendar.reminders" android:value="true" />'
+        )
+      }
+      if (app.photoLibrary?.addOnly !== undefined) {
+        appStamps.push(
+          '      <meta-data android:name="one.photoLibrary.addOnly" android:value="true" />'
+        )
+      }
+      if (app.audio?.background === true) {
+        appStamps.push(
+          '      <meta-data android:name="one.audio.background" android:value="true" />',
+          '      <service android:name="com.margelo.nitro.one.OneAudioService" android:exported="false" android:foregroundServiceType="mediaPlayback" />'
+        )
+      }
+      // background task identifiers use the shared ios declaration on both
+      // platforms, so the Android WorkManager half accepts the same
+      // identifiers the iOS BGTaskScheduler half does. no new public API.
+      if (app.ios?.backgroundTasks !== undefined) {
+        const refreshTasks = app.ios.backgroundTasks.refresh ?? []
+        const processingTasks = app.ios.backgroundTasks.processing ?? []
+        if (refreshTasks.length) {
+          appStamps.push(
+            `      <meta-data android:name="one.backgroundTasks.refresh" android:value="${escapeXml(refreshTasks.join(','))}" />`
+          )
+        }
+        if (processingTasks.length) {
+          appStamps.push(
+            `      <meta-data android:name="one.backgroundTasks.processing" android:value="${escapeXml(processingTasks.join(','))}" />`
+          )
+        }
+      }
+      if (appStamps.length) {
+        // before the application close, so this composes with the
+        // notification receiver stamp that owns the activity anchor.
+        const appAnchor = '    </application>'
+        if (!rendered.includes(appAnchor)) {
+          throw new Error(
+            '[vxrn] cannot stamp media components: expected </application> in app/src/main/AndroidManifest.xml'
+          )
+        }
+        rendered = rendered.replace(
+          appAnchor,
+          `${appStamps.join('\n')}\n${appAnchor}`
+        )
+      }
+    }
+    if (
+      platform === 'android' &&
+      relativePath === 'app/src/main/java/com/helloworld/MainApplication.kt' &&
+      app.updates !== undefined
+    ) {
+      rendered = patchAndroidMainApplicationUpdatesHost(rendered)
+    }
+    if (
+      platform === 'android' &&
+      relativePath === 'app/src/main/AndroidManifest.xml' &&
+      app.updates !== undefined
+    ) {
+      // the launcher reads both; without the url the embedded bundle
+      // launches with updates disabled.
+      const anchor = '    </application>'
+      if (!rendered.includes(anchor)) {
+        throw new Error(
+          '[vxrn] cannot stamp the updates config: expected </application> in app/src/main/AndroidManifest.xml'
+        )
+      }
+      const stamps: string[] = []
+      if (app.updates.url !== undefined) {
+        stamps.push(
+          `      <meta-data android:name="dev.onejs.updates.url" android:value="${escapeXml(app.updates.url)}" />`
+        )
+      }
+      stamps.push(
+        '      <meta-data android:name="dev.onejs.updates.runtimeVersion" android:value="@string/one_updates_runtime_version" />'
+      )
+      rendered = rendered.replace(anchor, `${stamps.join('\n')}\n${anchor}`)
+    }
+    if (
+      platform === 'android' &&
+      relativePath === 'app/src/main/res/values/strings.xml' &&
+      app.updates !== undefined
+    ) {
+      // aapt infers an inline numeric version as an integer. a string resource
+      // preserves the exact runtime identifier read by the native launcher.
+      const version = app.updates.runtimeVersion.replace(/\\/g, '\\\\').replace(/"/g, '\\"')
+      rendered = rendered.replace(
+        '</resources>',
+        `    <string name="one_updates_runtime_version" translatable="false">"${escapeXml(version)}"</string>\n</resources>`
+      )
+    }
     if (
       platform === 'android' &&
       relativePath === 'app/src/main/AndroidManifest.xml' &&
@@ -1489,11 +2422,11 @@ ${schemes.map((scheme) => `\t\t\t\t<string>${scheme}</string>`).join('\n')}
       relativePath === 'gradle.properties' &&
       app.notifications?.push === true
     ) {
-      // the flag @vxrn/native reads to compile the fcm source set in. it
+      // the flag one reads to compile the fcm source set in. it
       // lives in the root gradle.properties so library builds see it through
       // the root project; without it the file is untouched and firebase
       // messaging stays out of the app.
-      const line = 'oneNativePush=true'
+      const line = `${notificationsHost.pushGradleProperty}=true`
       if (!rendered.includes(line)) {
         const trailed = rendered.endsWith('\n') ? rendered : `${rendered}\n`
         rendered = `${trailed}\n# Remote push: set by native.app.notifications.push.\n${line}\n`
@@ -1504,7 +2437,7 @@ ${schemes.map((scheme) => `\t\t\t\t<string>${scheme}</string>`).join('\n')}
       relativePath === 'gradle.properties' &&
       app.android?.googleMapsApiKey !== undefined
     ) {
-      // the flag @vxrn/native reads to compile the maps source set in. it
+      // the flag one reads to compile the maps source set in. it
       // lives in the root gradle.properties so library builds see it through
       // the root project; without the key the file is untouched and maps
       // stays out of the app.
@@ -1514,6 +2447,111 @@ ${schemes.map((scheme) => `\t\t\t\t<string>${scheme}</string>`).join('\n')}
         rendered = `${trailed}\n# One.UI.Map: set by native.app.android.googleMapsApiKey.\n${line}\n`
       }
     }
+    if (
+      platform === 'android' &&
+      relativePath === 'app/src/main/res/values/styles.xml' &&
+      (app.userInterfaceStyle === 'light' || app.userInterfaceStyle === 'dark')
+    ) {
+      // the template's DayNight theme follows the system; a locked style
+      // takes the matching fixed appcompat theme.
+      const dayNight = 'parent="Theme.AppCompat.DayNight.NoActionBar"'
+      if (!rendered.includes(dayNight)) {
+        throw new Error(
+          `[vxrn] cannot lock userInterfaceStyle: expected ${dayNight} in app/src/main/res/values/styles.xml`
+        )
+      }
+      rendered = rendered.replace(
+        dayNight,
+        app.userInterfaceStyle === 'light'
+          ? 'parent="Theme.AppCompat.Light.NoActionBar"'
+          : 'parent="Theme.AppCompat.NoActionBar"'
+      )
+    }
+    if (
+      platform === 'android' &&
+      relativePath === 'app/src/main/AndroidManifest.xml' &&
+      (app.android?.permissions?.length || app.android?.blockedPermissions?.length)
+    ) {
+      const anchor = '<uses-permission android:name="android.permission.INTERNET" />'
+      if (!rendered.includes(anchor)) {
+        throw new Error(
+          '[vxrn] cannot stamp permissions: expected the INTERNET permission in app/src/main/AndroidManifest.xml'
+        )
+      }
+      // a bare name is an android.permission, as expo reads it.
+      const permissionName = (name: string) =>
+        name.includes('.') ? name : `android.permission.${name}`
+      const lines = [
+        ...(app.android?.permissions ?? []).map(
+          (name) => `    <uses-permission android:name="${permissionName(name)}" />`
+        ),
+        ...(app.android?.blockedPermissions ?? []).map(
+          (name) =>
+            `    <uses-permission android:name="${permissionName(name)}" tools:node="remove" />`
+        ),
+      ]
+      rendered = rendered.replace(anchor, `${anchor}\n${lines.join('\n')}`)
+      if (app.android?.blockedPermissions?.length && !rendered.includes('xmlns:tools=')) {
+        rendered = rendered.replace(
+          'xmlns:android="http://schemas.android.com/apk/res/android"',
+          'xmlns:android="http://schemas.android.com/apk/res/android"\n    xmlns:tools="http://schemas.android.com/tools"'
+        )
+      }
+    }
+    if (
+      platform === 'android' &&
+      relativePath === 'app/src/main/AndroidManifest.xml' &&
+      app.android?.appLinks?.length
+    ) {
+      rendered = rendered.replace(
+        '      </activity>',
+        `        <intent-filter android:autoVerify="true">
+            <action android:name="android.intent.action.VIEW" />
+            <category android:name="android.intent.category.DEFAULT" />
+            <category android:name="android.intent.category.BROWSABLE" />
+            <data android:scheme="https" />
+${app.android.appLinks
+  .map(
+    (link) =>
+      `            <data android:host="${link.host}"${link.pathPrefix ? ` android:pathPrefix="${link.pathPrefix}"` : ''} />`
+  )
+  .join('\n')}
+        </intent-filter>
+      </activity>`
+      )
+    }
+    if (
+      platform === 'android' &&
+      relativePath === 'app/src/main/AndroidManifest.xml' &&
+      app.orientation !== undefined
+    ) {
+      const anchor = 'android:name=".MainActivity"'
+      if (!rendered.includes(anchor)) {
+        throw new Error(
+          '[vxrn] cannot stamp the orientation: expected .MainActivity in app/src/main/AndroidManifest.xml'
+        )
+      }
+      rendered = rendered.replace(
+        anchor,
+        `${anchor}\n        android:screenOrientation="${app.orientation === 'default' ? 'unspecified' : app.orientation}"`
+      )
+    }
+    if (
+      platform === 'android' &&
+      relativePath === 'app/src/main/AndroidManifest.xml' &&
+      app.pictureInPicture
+    ) {
+      const anchor = 'android:name=".MainActivity"'
+      if (!rendered.includes(anchor)) {
+        throw new Error(
+          '[vxrn] cannot stamp picture in picture: expected .MainActivity in app/src/main/AndroidManifest.xml'
+        )
+      }
+      rendered = rendered.replace(
+        anchor,
+        `${anchor}\n        android:supportsPictureInPicture="true"`
+      )
+    }
     if (
       platform === 'android' &&
       relativePath === 'app/src/main/AndroidManifest.xml' &&
@@ -1554,25 +2592,127 @@ ${schemes.map((scheme) => `            <data android:scheme="${scheme}" />`).joi
         )
       }
     }
+    if (platform === 'ios' && relativePath.endsWith('.xcodeproj/project.pbxproj') &&
+      app.ios?.alternateIcons !== undefined) {
+      const anchor = 'ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;'
+      if (!rendered.includes(anchor)) {
+        throw new Error('[vxrn] prebuild template lost its primary app icon build setting')
+      }
+      const names = Object.keys(app.ios.alternateIcons).sort().join(' ')
+      rendered = rendered.replaceAll(anchor,
+        `${anchor}\n\t\t\t\tASSETCATALOG_COMPILER_ALTERNATE_APPICON_NAMES = "${names}";`)
+    }
     if (platform === 'ios' && relativePath.endsWith('/Info.plist')) {
       // schemes, usesNonExemptEncryption, and fileSharing stamp above in one
-      // anchored block; only the camera description stamps here.
+      // anchored block; only the usage descriptions stamp here.
+      const usage = new Map<string, string>()
       if (app.imagePicker?.camera !== undefined) {
+        usage.set('NSCameraUsageDescription', app.imagePicker.camera)
+      }
+      if (app.imagePicker?.microphone !== undefined) {
+        usage.set('NSMicrophoneUsageDescription', app.imagePicker.microphone)
+      }
+      if (app.photoLibrary !== undefined) {
+        if (app.photoLibrary.addOnly !== undefined) {
+          usage.set('NSPhotoLibraryAddUsageDescription', app.photoLibrary.addOnly)
+        }
+        if (app.photoLibrary.readWrite !== undefined) {
+          usage.set('NSPhotoLibraryUsageDescription', app.photoLibrary.readWrite)
+        }
+      }
+      if (app.contacts !== undefined) {
+        usage.set('NSContactsUsageDescription', app.contacts.usage)
+      }
+      if (app.calendar !== undefined) {
+        if (app.calendar.usage !== undefined) {
+          usage.set('NSCalendarsFullAccessUsageDescription', app.calendar.usage)
+        }
+        if (app.calendar.remindersUsage !== undefined) {
+          usage.set('NSRemindersFullAccessUsageDescription', app.calendar.remindersUsage)
+        }
+      }
+      if (app.location !== undefined) {
+        usage.set('NSLocationWhenInUseUsageDescription', app.location.whenInUse)
+        if (app.location.alwaysAndWhenInUse !== undefined) {
+          usage.set(
+            'NSLocationAlwaysAndWhenInUseUsageDescription',
+            app.location.alwaysAndWhenInUse
+          )
+        }
+      }
+      if (app.pedometer !== undefined) {
+        usage.set('NSMotionUsageDescription', app.pedometer.usage)
+      }
+      if (app.ios?.faceIdUsageDescription !== undefined) {
+        usage.set('NSFaceIDUsageDescription', app.ios.faceIdUsageDescription)
+      }
+      if (app.speech !== undefined) {
+        usage.set('NSSpeechRecognitionUsageDescription', app.speech.recognition)
+        usage.set('NSMicrophoneUsageDescription', app.speech.microphone)
+      }
+      if (app.audio?.microphone !== undefined) {
+        usage.set('NSMicrophoneUsageDescription', app.audio.microphone)
+      }
+      const additions: [string, string][] = []
+      for (const [key, text] of usage) {
+        const existing = new RegExp(`(<key>${key}</key>\\s*<string>)[^<]*(</string>)`)
+        if (existing.test(rendered)) {
+          rendered = rendered.replace(
+            existing,
+            (_match, before: string, after: string) => `${before}${escapeXml(text)}${after}`
+          )
+        } else {
+          additions.push([key, text])
+        }
+      }
+      if (additions.length) {
         const anchor = '\t<key>LSRequiresIPhoneOS</key>'
         if (!rendered.includes(anchor)) {
           throw new Error(
-            '[vxrn] cannot stamp NSCameraUsageDescription: expected LSRequiresIPhoneOS in Info.plist'
+            `[vxrn] cannot stamp ${additions[0][0]}: expected LSRequiresIPhoneOS in Info.plist`
           )
         }
         rendered = rendered.replace(
           anchor,
-          `\t<key>NSCameraUsageDescription</key>\n\t<string>${escapeXml(app.imagePicker.camera)}</string>\n${anchor}`
+          `${additions.map(([key, text]) => `\t<key>${key}</key>\n\t<string>${escapeXml(text)}</string>\n`).join('')}${anchor}`
         )
       }
+      // the template ships an empty location purpose string; an empty one is
+      // never valid, so a key the manifest did not fill leaves the plist.
+      rendered = rendered.replace(
+        /\t<key>NS\w+UsageDescription<\/key>\s*<string><\/string>\n/g,
+        ''
+      )
       rendered = patchIosInfoPlistSceneManifest(rendered)
     }
     if (platform === 'ios' && relativePath.endsWith('/AppDelegate.swift')) {
-      rendered = patchIosAppDelegateSceneLifecycle(rendered, appName)
+      rendered = patchIosAppDelegateSceneLifecycle(
+        rendered,
+        appName,
+        !!app.ios?.backgroundTasks,
+        !!app.ios?.appIntents
+      )
+      rendered = nativeProjectPatches.holdLaunchScreenOverRootView(rendered)
+      // the one native template uses hermes. request precompiled dev bytes so
+      // lazy routes do not compile on the device while navigation is pending.
+      const bundleURLProvider =
+        'RCTBundleURLProvider.sharedSettings().jsBundleURL(forBundleRoot: "index")'
+      if (!rendered.includes(bundleURLProvider)) {
+        throw new Error(
+          '[vxrn] cannot request hermes dev bytecode: expected the template bundle URL provider'
+        )
+      }
+      rendered = rendered.replace(
+        bundleURLProvider,
+        `guard let bundleURL = RCTBundleURLProvider.sharedSettings().jsBundleURL(forBundleRoot: "index") else { return nil }
+    if bundleURL.isFileURL { return bundleURL }
+    var components = URLComponents(url: bundleURL, resolvingAgainstBaseURL: false)!
+    components.queryItems!.append(URLQueryItem(name: "bytecode", value: "hermes"))
+    return components.url`
+      )
+      if (app.updates !== undefined) {
+        rendered = nativeProjectPatches.pointReleaseBundleURLAtOneUpdates(rendered)
+      }
     }
     if (platform === 'ios' && app.ios?.deploymentTarget) {
       rendered = rendered
@@ -1600,12 +2740,17 @@ end`
       }
     }
     if (platform === 'ios' && relativePath.endsWith('.xcodeproj/project.pbxproj')) {
-      rendered = patchIosBundlePhase(rendered)
+      rendered = patchIosBundlePhase(rendered, app.updates?.runtimeVersion)
       rendered = patchIosPbxprojSceneDelegate(rendered, appName)
-      if (app.notifications?.push === true && !app.ios?.widgets) {
-        rendered = patchIosPbxprojPushEntitlements(rendered, appName)
+      if (app.ios?.appIntents) rendered = patchIosPbxprojAppIntents(rendered, appName)
+      rendered = patchIosPbxprojOneBridgingHeader(rendered, appName)
+      if (Object.keys(appEntitlements(app)).length && !app.ios?.widgets) {
+        rendered = patchIosPbxprojAppEntitlements(rendered, appName)
       }
       if (app.ios?.widgets) rendered = patchIosPbxprojWidgets(rendered, app)
+      if (iosResourceFiles(app).length) {
+        rendered = patchIosPbxprojResources(rendered, appName, iosResourceFiles(app))
+      }
     }
     if (platform === 'ios' && relativePath === 'Podfile') {
       if (app.ios?.ccache) rendered = `ENV['USE_CCACHE'] ||= '1'\n${rendered}`
@@ -1619,11 +2764,20 @@ end`
         rendered = nativeProjectPatches.injectReactNativeScreensGammaIntoPodfile(rendered)
       }
       rendered = nativeProjectPatches.injectFmtCxx17FixIntoPodfile(rendered)
+      rendered = nativeProjectPatches.injectWebGPUHeaderPathsIntoPodfile(rendered)
       rendered = nativeProjectPatches.injectOneSwiftPackagesIntoPodfile(rendered)
       if (nitroWebImage)
         rendered =
           nativeProjectPatches.injectNitroWebImageModularHeaderIntoPodfile(rendered)
       rendered = nativeProjectPatches.injectHermesMinificationPatchIntoPodfile(rendered)
+      const nativeModulesCall = 'config = use_native_modules!'
+      if (rendered.split(nativeModulesCall).length !== 2) {
+        throw new Error('[vxrn] expected one iOS native module discovery call')
+      }
+      rendered = rendered.replace(
+        nativeModulesCall,
+        `config = use_native_modules!(['node', '-e', "process.argv=['', '', 'config'];require(require('module').createRequire(require.resolve('vxrn/package.json')).resolve('@react-native-community/cli')).run()"])`
+      )
       if (
         !rendered.includes('[vxrn/one] fmt c++17 fix') ||
         !rendered.includes('[vxrn/one] minify iOS Hermes Release bundle input')
@@ -1640,6 +2794,12 @@ end`
       ) {
         throw new Error('[vxrn] failed to apply required Android Gradle patches')
       }
+      if (app.updates !== undefined) {
+        rendered = patchAndroidBuildGradleUpdatesManifest(
+          rendered,
+          app.updates.runtimeVersion
+        )
+      }
       if (app.version !== undefined) {
         rendered = rendered.replace(
           /versionName "[^"]*"/g,
@@ -1663,13 +2823,67 @@ end`
         hardcodedGradlePlugin,
         `includeBuild(new File(["node", "--print", "require('module').createRequire(require.resolve('react-native/package.json')).resolve('@react-native/gradle-plugin/package.json')"].execute(null, settingsDir).text.trim()).parentFile.canonicalPath)`
       )
-    }
-    if (platform === 'android' && app.android?.minSdk !== undefined) {
+      const autolinkCommand = 'ex.autolinkLibrariesFromCommand()'
+      if (rendered.split(autolinkCommand).length !== 2) {
+        throw new Error('[vxrn] expected one React Native autolinking command')
+      }
       rendered = rendered.replace(
-        /minSdkVersion = \d+/g,
-        `minSdkVersion = ${app.android.minSdk}`
+        autolinkCommand,
+        `ex.autolinkLibrariesFromCommand(["node", ["node", "--print", "require('module').createRequire(require.resolve('vxrn/package.json')).resolve('@react-native-community/cli/build/bin.js')"].execute(null, settingsDir).text.trim(), "config"])`
       )
     }
+    if (platform === 'android' && relativePath === 'app/build.gradle' && app.android?.minify) {
+      const minify = 'def enableProguardInReleaseBuilds = false'
+      const minifyEnabled = 'minifyEnabled enableProguardInReleaseBuilds'
+      if (!rendered.includes(minify) || !rendered.includes(minifyEnabled)) {
+        throw new Error('[vxrn] prebuild template app/build.gradle lost its proguard switch')
+      }
+      rendered = rendered.replace(minify, 'def enableProguardInReleaseBuilds = true')
+      if (app.android.shrinkResources) {
+        rendered = rendered.replace(
+          minifyEnabled,
+          `${minifyEnabled}\n            shrinkResources true`
+        )
+      }
+    }
+    if (platform === 'android' && app.android?.googleServicesFile) {
+      const edits: Array<[string, string, string]> = [
+        [
+          'build.gradle',
+          'classpath("org.jetbrains.kotlin:kotlin-gradle-plugin")',
+          `        classpath("com.google.gms:google-services:${GOOGLE_SERVICES_VERSION}")`,
+        ],
+        [
+          'app/build.gradle',
+          'apply plugin: "com.facebook.react"',
+          'apply plugin: "com.google.gms.google-services"',
+        ],
+      ]
+      for (const [file, anchor, insertion] of edits) {
+        if (relativePath !== file) continue
+        const next = insertAfterLine(rendered, anchor, insertion)
+        if (next === rendered) {
+          throw new Error(`[vxrn] prebuild template ${file} lost its ${anchor} anchor`)
+        }
+        rendered = next
+      }
+    }
+    if (
+      platform === 'android' &&
+      relativePath === 'app/proguard-rules.pro' &&
+      app.android?.proguardRules
+    ) {
+      rendered = `${rendered.trimEnd()}\n\n${app.android.proguardRules.trim()}\n`
+    }
+    for (const [field, setting] of [
+      ['minSdk', 'minSdkVersion'],
+      ['targetSdk', 'targetSdkVersion'],
+      ['compileSdk', 'compileSdkVersion'],
+    ] as const) {
+      const value = platform === 'android' ? app.android?.[field] : undefined
+      if (value === undefined) continue
+      rendered = rendered.replace(new RegExp(`${setting} = \\d+`, 'g'), `${setting} = ${value}`)
+    }
   }
 
   return { destRelativePath, content: rendered }
@@ -1684,9 +2898,7 @@ export const generateForPlatform = async (
   validatePrebuildApp(app, platform)
   const dest = outDir
   const require = module.createRequire(root + '/')
-  const importPath = require.resolve('@react-native-community/cli/build/tools/walk.js', {
-    paths: [root],
-  })
+  const importPath = requireVxrn.resolve('@react-native-community/cli/build/tools/walk.js')
   const src = path.join(
     path.dirname(
       require.resolve('@react-native-community/template/template/package.json', {
@@ -1740,38 +2952,202 @@ export const generateForPlatform = async (
   }
 
   await generateAppIcons({ root, dest, platform, app })
+  if (platform === 'android') await generateAdaptiveIcon({ root, dest, app })
   await generateSplashScreen({ root, dest, platform, app })
+  if (platform === 'ios') generateAccentColor({ dest, app })
+  copyAppResources({ root, dest, platform, app })
   generateSceneDelegate({ dest, platform, app })
+  generateIosAppIntents(dest, platform, app)
+  if (platform === 'ios') generateOneBridgingHeader(dest, app)
   if (platform === 'ios') generateIosWidgets(dest, app)
-  if (platform === 'ios') generateSwiftPackages({ root, dest })
+  if (platform === 'ios') await generateSwiftPackages({ root, dest })
+  if (platform === 'android') await generateKotlinSources({ root, dest })
 }
 
-// every directory under the app root holding a Package.swift becomes one local
-// pod: its sources compile as their own module against VxrnNative (which
-// supplies RNXPackage and JSON), the @main entry is renamed so it does not
-// clash with the app's main, and an objc +load files the entry with the
-// registry the OneSwiftHost view reads. the bundler resolves an import of any
-// .swift file in the package to a host view naming the same package id.
-function generateSwiftPackages({ root, dest }: { root: string; dest: string }) {
-  const skip = new Set(['node_modules', 'ios', 'android', 'dist', 'types', 'build'])
-  const packageDirs: string[] = []
-  const walk = (dir: string) => {
-    const entries = FSExtra.readdirSync(dir, { withFileTypes: true })
-    if (entries.some((entry) => entry.isFile() && entry.name === 'Package.swift')) {
-      packageDirs.push(dir)
+// an imported kotlin source can reach past the base ui/foundation/material3
+// closure: each import prefix below names the gradle artifact that supplies
+// it, so the source compiles without the app declaring the dependency.
+const KOTLIN_IMPORT_ARTIFACTS = [
+  {
+    importPrefix: 'androidx.compose.material.icons',
+    artifact: 'androidx.compose.material:material-icons-core',
+    versionKey: 'materialIconsVersion',
+    version: '1.7.6',
+  },
+]
+
+function kotlinSourceImports(dir: string): Set<string> {
+  const imports = new Set<string>()
+  if (!FSExtra.existsSync(dir)) return imports
+  const visit = (entry: string) => {
+    if (FSExtra.statSync(entry).isDirectory()) {
+      for (const child of FSExtra.readdirSync(entry)) visit(path.join(entry, child))
       return
     }
-    for (const entry of entries) {
-      if (!entry.isDirectory() || entry.name.startsWith('.') || skip.has(entry.name))
-        continue
-      walk(path.join(dir, entry.name))
+    if (!entry.endsWith('.kt')) return
+    for (const line of FSExtra.readFileSync(entry, 'utf8').split('\n')) {
+      const match = /^\s*import\s+([A-Za-z0-9_.]+)/.exec(line)
+      if (match) imports.add(match[1])
     }
   }
-  walk(root)
+  visit(dir)
+  return imports
+}
 
-  for (const packageDir of packageDirs) {
-    const id = swiftPackageId(packageDir)
+export function enableAppComposeIntegration(dest: string) {
+  const rootBuildGradlePath = path.join(dest, 'build.gradle')
+  if (FSExtra.existsSync(rootBuildGradlePath)) {
+    let content = FSExtra.readFileSync(rootBuildGradlePath, 'utf8')
+    const composePluginClasspath =
+      '        classpath("org.jetbrains.kotlin.plugin.compose:org.jetbrains.kotlin.plugin.compose.gradle.plugin:$kotlinVersion")'
+    if (!content.includes('org.jetbrains.kotlin.plugin.compose')) {
+      const anchor = content.includes('classpath("org.jetbrains.kotlin:kotlin-gradle-plugin")')
+        ? 'classpath("org.jetbrains.kotlin:kotlin-gradle-plugin")'
+        : 'classpath "org.jetbrains.kotlin:kotlin-gradle-plugin"'
+      content = insertAfterLine(content, anchor, composePluginClasspath)
+      FSExtra.writeFileSync(rootBuildGradlePath, content, 'utf8')
+    }
+  }
+
+  const appBuildGradlePath = path.join(dest, 'app/build.gradle')
+  if (FSExtra.existsSync(appBuildGradlePath)) {
+    let content = FSExtra.readFileSync(appBuildGradlePath, 'utf8')
+    if (!content.includes('org.jetbrains.kotlin.plugin.compose')) {
+      const pluginAnchor = content.includes('apply plugin: "org.jetbrains.kotlin.android"')
+        ? 'apply plugin: "org.jetbrains.kotlin.android"'
+        : "apply plugin: 'org.jetbrains.kotlin.android'"
+      content = insertAfterLine(
+        content,
+        pluginAnchor,
+        'apply plugin: "org.jetbrains.kotlin.plugin.compose"'
+      )
+    }
+    if (!content.includes('compose true')) {
+      content = insertAfterLine(
+        content,
+        'android {',
+        '    buildFeatures {\n        compose true\n    }'
+      )
+    }
+    if (!content.includes('androidx.compose.ui:ui')) {
+      const composeDeps = [
+        '    def composeUiVersion = rootProject.ext.has("composeUiVersion") ? rootProject.ext.get("composeUiVersion") : "1.11.4"',
+        '    def material3Version = rootProject.ext.has("material3Version") ? rootProject.ext.get("material3Version") : "1.5.0-alpha17"',
+        '    implementation "androidx.compose.ui:ui:$composeUiVersion"',
+        '    implementation "androidx.compose.foundation:foundation:$composeUiVersion"',
+        '    implementation "androidx.compose.material3:material3:$material3Version"',
+        // swiftui carries navigation; compose ships it as its own artifact, so a
+        // kotlin view importing NavHost needs it on the app classpath.
+        '    def navigationComposeVersion = rootProject.ext.has("navigationComposeVersion") ? rootProject.ext.get("navigationComposeVersion") : "2.10.2"',
+        '    implementation "androidx.navigation:navigation-compose:$navigationComposeVersion"',
+      ].join('\n')
+      const depsAnchor = content.includes('implementation("com.facebook.react:react-android")')
+        ? 'implementation("com.facebook.react:react-android")'
+        : 'implementation "com.facebook.react:react-android"'
+      content = insertAfterLine(content, depsAnchor, composeDeps)
+    }
+    // each import rule carries its own guard, so a re-prebuild adds a newly
+    // needed artifact without touching the rest of the file.
+    const imports = kotlinSourceImports(path.join(dest, 'app/src/main/java/one/source'))
+    for (const rule of KOTLIN_IMPORT_ARTIFACTS) {
+      const needed = [...imports].some(
+        (name) => name === rule.importPrefix || name.startsWith(`${rule.importPrefix}.`)
+      )
+      if (!needed || content.includes(rule.artifact)) continue
+      const reactAnchor = content.includes('implementation("com.facebook.react:react-android")')
+        ? 'implementation("com.facebook.react:react-android")'
+        : 'implementation "com.facebook.react:react-android"'
+      const anchor = content.includes('androidx.compose.material3:material3')
+        ? 'androidx.compose.material3:material3'
+        : reactAnchor
+      content = insertAfterLine(
+        content,
+        anchor,
+        [
+          `    def ${rule.versionKey} = rootProject.ext.has("${rule.versionKey}") ? rootProject.ext.get("${rule.versionKey}") : "${rule.version}"`,
+          `    implementation "${rule.artifact}:$${rule.versionKey}"`,
+        ].join('\n')
+      )
+    }
+    FSExtra.writeFileSync(appBuildGradlePath, content, 'utf8')
+  }
+}
+
+// the native source contract loads only for an app that has kotlin or swift
+// sources to generate glue for.
+export async function generateKotlinSources({ root, dest }: { root: string; dest: string }) {
+  // evidence holds preserved proof sources, never app sources; sweeping it
+  // breaks :app:compileDebugKotlin when two preserved copies declare one class.
+  const skip = new Set(['node_modules', 'ios', 'android', 'dist', 'types', 'build', 'tests', '__tests__', 'scripts', 'evidence'])
+  const sources: string[] = []
+  const manifest = FSExtra.existsSync(path.join(root, 'package.json'))
+    ? FSExtra.readJsonSync(path.join(root, 'package.json'))
+    : {}
+  const workspacePatterns: string[] = Array.isArray(manifest.workspaces)
+    ? manifest.workspaces
+    : manifest.workspaces?.packages ?? []
+  const { default: glob } = await import('fast-glob')
+  const workspaceRoots = new Set(glob.sync(workspacePatterns, {
+    cwd: root, absolute: true, onlyDirectories: true,
+    ignore: ['**/node_modules/**', '**/ios/**', '**/android/**'],
+  }).map((directory) => path.resolve(directory)))
+  const collect = (dir: string) => {
+    // declared workspace packages belong to this build; other nested packages
+    // own their sources and fixtures.
+    if (dir !== root && FSExtra.existsSync(path.join(dir, 'package.json')) && !workspaceRoots.has(dir)) return
+    for (const entry of FSExtra.readdirSync(dir, { withFileTypes: true })) {
+      if (entry.name.startsWith('.') || skip.has(entry.name)) continue
+      const source = path.join(dir, entry.name)
+      if (entry.isDirectory()) collect(source)
+      else if (entry.isFile() && entry.name.endsWith('.kt')) sources.push(source)
+    }
+  }
+  collect(root)
+  // the generator owns this directory: rebuild it so a moved or deleted source
+  // cannot leave a stale copy that redeclares a live class.
+  const output = path.join(dest, 'app/src/main/java/one/source')
+  FSExtra.removeSync(output)
+  if (sources.length === 0) return
+  const { kotlinSourceId, renderKotlinSourceGlue, writeNativeSourceDeclaration } = await import(
+    '../utils/nativeSourceContract'
+  )
+  let hasViews = false
+  for (const source of sources) {
+    const id = kotlinSourceId(root, source)
+    const target = path.join(output, id)
+    FSExtra.mkdirSync(target, { recursive: true })
+    FSExtra.copyFileSync(source, path.join(target, path.basename(source)))
+    const contract = writeNativeSourceDeclaration(source)
+    if (contract.views.length > 0) hasViews = true
+    if (contract.modules.length > 0 || contract.views.length > 0) {
+      FSExtra.writeFileSync(
+        path.join(target, `OneNativeSource_${id}.kt`),
+        renderKotlinSourceGlue(id, contract).source
+      )
+    }
+  }
+  if (hasViews) {
+    enableAppComposeIntegration(dest)
+  }
+}
+
+// every directory under the app root holding a Package.swift becomes one local
+// pod: its sources compile as their own module against One (which
+// supplies PeachPackage and JSON), the @main entry is renamed so it does not
+// clash with the app's main, and an objc +load files the entry with the
+// registry the OneSwiftHost view reads. the bundler resolves an import of any
+// .swift file in the package to a host view naming the same package id.
+async function generateSwiftPackages({ root, dest }: { root: string; dest: string }) {
+  const skip = new Set(['node_modules', 'ios', 'android', 'dist', 'types', 'build'])
+  const packages = swiftPackageDirectories(root)
+  if (packages.size === 0) return
+  const { swiftPodManifest, writeSwiftPackageArtifacts } = await import('../utils/nativeSourceContract')
+  for (const [id, packageDir] of packages) {
     const podDir = path.join(dest, 'OneSwiftPackages', id)
+    const manifest = swiftPodManifest(
+      path.join(packageDir, 'Package.swift'),
+      FSExtra.readFileSync(path.join(packageDir, 'Package.swift'), 'utf8')
+    )
     const sources: string[] = []
     const collect = (dir: string) => {
       for (const entry of FSExtra.readdirSync(dir, { withFileTypes: true })) {
@@ -1784,6 +3160,12 @@ function generateSwiftPackages({ root, dest }: { root: string; dest: string }) {
       }
     }
     collect(packageDir)
+    const artifacts = writeSwiftPackageArtifacts(packageDir)
+    const contracts = artifacts.contracts
+    const hasView = contracts.some((contract) => contract.defaultView)
+    if (contracts.filter((contract) => contract.defaultView).length > 1) {
+      throw new Error(`[vxrn] swift package ${packageDir} has more than one @main type`)
+    }
     // cocoapods globs do not descend into symlinked directories, so mirror the
     // tree with real directories and link each file.
     for (const source of sources) {
@@ -1791,6 +3173,12 @@ function generateSwiftPackages({ root, dest }: { root: string; dest: string }) {
       FSExtra.mkdirSync(path.dirname(link), { recursive: true })
       FSExtra.symlinkSync(FSExtra.realpathSync(source), link)
     }
+    if (artifacts.glue) {
+      FSExtra.writeFileSync(
+        path.join(podDir, 'Sources', 'OneNativeSource.generated.swift'),
+        artifacts.glue
+      )
+    }
     FSExtra.writeFileSync(
       path.join(podDir, `${id}.podspec`),
       `Pod::Spec.new do |s|
@@ -1801,18 +3189,18 @@ function generateSwiftPackages({ root, dest }: { root: string; dest: string }) {
   s.license = 'MIT'
   s.author = 'one'
   s.source = { :path => '.' }
-  s.swift_version = '6.0'
+  s.swift_version = '${manifest.languageMode}.0'
   s.source_files = 'Sources/**/*.swift', 'Register.m'
-  s.dependency 'VxrnNative'
+  s.dependency 'One'
   s.pod_target_xcconfig = {
-    'OTHER_SWIFT_FLAGS' => '$(inherited) -Xfrontend -import-module -Xfrontend VxrnNative -Xfrontend -entry-point-function-name -Xfrontend ${id}_main',
+    'OTHER_SWIFT_FLAGS' => '$(inherited) -cxx-interoperability-mode=default -Xcc -std=c++20 -Xfrontend -import-module -Xfrontend One${manifest.mainActorIsolation ? ' -default-isolation MainActor' : ''}${hasView ? ` -Xfrontend -entry-point-function-name -Xfrontend ${id}_main` : ''}',
   }
 end
 `
     )
     FSExtra.writeFileSync(
       path.join(podDir, 'Register.m'),
-      `#import <Foundation/Foundation.h>
+      hasView ? `#import <Foundation/Foundation.h>
 
 extern int ${id}_main(int argc, char **argv);
 extern void OneSwiftRegisterPackage(const char *name, int (*entry)(int, char **));
@@ -1825,7 +3213,7 @@ extern void OneSwiftRegisterPackage(const char *name, int (*entry)(int, char **)
   OneSwiftRegisterPackage("${id}", ${id}_main);
 }
 @end
-`
+` : '#import <Foundation/Foundation.h>\n'
     )
   }
 }
@@ -1863,8 +3251,8 @@ export function applyAndroidDependencyPatches(args: {
     ...app.android.applicationId.split('.'),
     'MainActivity.kt'
   )
-  const rendered = nativeProjectPatches.addReactNativeScreensFix(
-    FSExtra.readFileSync(activityPath, 'utf8')
+  const rendered = nativeProjectPatches.holdLaunchScreenInMainActivity(
+    nativeProjectPatches.addReactNativeScreensFix(FSExtra.readFileSync(activityPath, 'utf8'))
   )
   if (!rendered.includes('RNScreensFragmentFactory')) {
     throw new Error('[vxrn] failed to apply the react-native-screens activity patch')
@@ -1877,10 +3265,7 @@ export function applyAndroidDependencyPatches(args: {
 export async function getNativeDependencyInventory(
   root: string
 ): Promise<NativeDependencyInventory[]> {
-  const require = module.createRequire(root + '/')
-  const cliConfigPath = require.resolve('@react-native-community/cli-config', {
-    paths: [root],
-  })
+  const cliConfigPath = requireVxrn.resolve('@react-native-community/cli-config')
   const cliConfig = (await import(pathToFileURL(cliConfigPath).href)) as {
     loadConfigAsync: (options: { projectRoot: string }) => Promise<{
       dependencies: Record<
@@ -1921,8 +3306,13 @@ export function installNativeDependencies(args: {
 }): void {
   const { root, platform } = args
   if (!platform || platform === 'ios') {
+    // cocoapods reads podfiles and native module config as the locale's
+    // encoding; a shell without a utf-8 locale fails on any non-ascii byte.
+    // one owns this pod install, so react native's notice pointing users at
+    // expo or the community cli does not apply.
     execFileSync('pod', ['install', `--project-directory=${path.join(root, 'ios')}`], {
       stdio: 'inherit',
+      env: { ...process.env, LC_ALL: 'en_US.UTF-8', RCT_IGNORE_PODS_DEPRECATION: '1' },
     })
   }
 }