Native Signing & Bundling

`vesk-native bundle` produces the release artifacts for both platforms. Android builds AAB + release APK; iOS regenerates the Xcode project, archives, and exports an .ipa. Signing is configured in `veskconfig.ts` and pre-flighted before anything is built.

Requirement summaries

Android signing config

									
										export default defineConfig({
  signing: {
    android: {
      storeFile: 'keystore.jks',
      storePassword: 'env:KEYSTORE_PASSWORD',
      keyAlias: 'upload',
      keyPassword: 'env:KEY_PASSWORD',
    },
  },
  bundle: {
    android: ['aab', 'apk'],
  },
})
									
								

• `storeFile` — absolute or app-relative path to the upload-key keystore.
• Passwords reference environment variables as `env:NAME` strings — never plain values, so secrets never land in generated build files.
• No signing config → release artifacts are signed with the debug keystore. This is the dev flow only and is not for store distribution.
• Unknown `bundle.android` members are rejected up-front.

Android pre-flight checks

Before building release artifacts, `androidSigningChecks` runs:

• storeFile/storePassword/keyAlias/keyPassword present (or debug-keystore fallback accepted).
• `env:NAME` values resolve from the environment.
• `keytool -list -v` inspects the keystore/alias — wrong storepass or missing alias fails.
• RSA keys under 2048 bits produce a warning (Play rejects them).
• Certificates expiring on or before 2033-10-22 warn — keep validity well past that date.

Android bundle output

									
										vesk-native bundle          # android (default)

# Outputs:
# app/build/outputs/bundle/release/app-release.aab
# app/build/outputs/apk/release/app-release.apk
									
								

• `.aab` — Android App Bundle, required by Google Play (Play App Signing).
• `.apk` — standalone release APK for sideloading.
• Targets come from `bundle.android` (default `['aab', 'apk']`).

iOS signing config

									
										export default defineConfig({
  signing: {
    ios: {
      teamId: 'A1B2C3D4E5',
      style: 'automatic',           // 'automatic' | 'manual'
      appStoreConnectApiKey: {      // automatic on CI
        keyPath: 'keys/api.p8',
        keyId: 'ABC123DEF4',
        issuerId: '69a6de90-...',
      },
    },
  },
})
									
								

• `teamId` — the 10-character Apple Developer team id (DEVELOPMENT_TEAM).
• `style: 'automatic'` — Xcode-managed profiles with `-allowProvisioningUpdates`; add an App Store Connect API key for unattended CI.
• `style: 'manual'` — explicit distribution certificate (`.p12`, password as `env:NAME`), provisioning profile name/UUID, or a `profilesDir` scanned by bundle id.

iOS bundle flow

									
										vesk-native bundle ios
									
								

• 1. `requireIosSigning` — validates teamId format (`[A-Z0-9]{10}`), cert/profile presence for manual style, `env:` resolution, darwin host, xcodebuild, and the bundle method.
• 2. Regenerates the Xcode project at `ios/VeskApp.xcodeproj` (deployment target 17.0, AppIcon 1024x1024 from `icon.foreground` or `assets/icon.png`, Info.plist privacy strings pruned from device-API usage).
• 3. `xcodebuild archive` — scheme default `VeskApp`, Release, generic iOS destination.
• 4. Reads the embedded provisioning-profile UUID out of the fresh archive (never a stale config) and stages it into `~/Library/MobileDevice/Provisioning Profiles`.
• 5. Writes `ExportOptions.plist` via `iosExportOptions` — method from `bundle.ios.method`.
• 6. `xcodebuild -exportArchive` — manual style imports the cert into `vesk-build.keychain`; automatic passes `-allowProvisioningUpdates` plus ASC API key args when configured.
• 7. Output: `VeskApp.ipa` under the ios export directory.

iOS export options

vesk-native verify bundle

									
										vesk-native verify bundle            # all platforms
vesk-native verify bundle android
vesk-native verify bundle ios
									
								

• Read-only. Runs every pre-flight check for the platform(s) without building anything.
• Prints PASS/WARN/FAIL per check; exits non-zero when any check FAILs.
• Ideal for CI gating before a release.