android: wrapper propio, con los permisos que faltaban para las videollamadas

Hasta ahora la APK salia re-firmando la de epsylon, y su classes.dex no implementa
WebChromeClient.onPermissionRequest. Sin ese metodo el WebView deniega por defecto
todo getUserMedia, asi que las videollamadas de Karvan no podian funcionar por mucho
que se parchease el manifest: la lista de permisos es estatica y se fija al compilar.

El wrapper cierra las dos puertas. Declara CAMERA, RECORD_AUDIO y
MODIFY_AUDIO_SETTINGS, pero no se conceden al instalar: son permisos peligrosos y se
piden en tiempo de ejecucion la primera vez que se pulsa Llamar. Si nadie llama, no
se pide nada. uses-feature required=false evita excluir dispositivos sin camara.

Reutiliza las tres librerias nativas tal cual: libnode.so es nodejs-mobile v18.20.4
oficial y libnative-lib.so son 6,8 KB con un unico simbolo JNI. De ahi que el
namespace sea com.solarnethub.oasis —JNI resuelve por nombre— mientras el
applicationId es net.laenre.oasis, que permite instalarla junto a la oficial. No
hace falta NDK ni compilar Node.

De paso corrige cosas del APK actual: targetSdk 35, trafico en claro permitido solo
hacia loopback en vez de usesCleartextTraffic global, allowBackup a false para que
adb backup no saque el .ssb, y el backend en un servicio en primer plano en el
proceso :node, que ademas es lo que permitira reiniciarlo limpio para el cambio de
identidad. El APK actual declara FOREGROUND_SERVICE pero no registra ningun servicio,
de modo que el backend muere al pasar a segundo plano.

Los binarios no se versionan: scripts/prepare.sh extrae las librerias y empaqueta el
backend. La keystore se pasa por entorno.

Verificado: ./gradlew assembleDebug construye una APK de 52 MB con las tres librerias,
targetSdk 35 y los permisos declarados; su DEX contiene onPermissionRequest,
PermissionRequest, CAMERA y RECORD_AUDIO, donde el APK actual tiene cero de los cuatro.
Falta probarla en un dispositivo real.

android/.gitignore

@@ -0,0 +1,7 @@
+# artefactos y binarios grandes: los prepara scripts/prepare.sh
+app/src/main/jniLibs/
+app/src/main/assets/nodejs-project.zip
+.gradle/
+build/
+app/build/
+local.properties

android/README.md

@@ -0,0 +1,90 @@
+# Wrapper Android propio
+
+Proyecto Gradle para construir la APK de la rama sin depender del APK oficial como
+molde.
+
+## Por que existe
+
+El APK que se venia usando es el de epsylon re-firmado, y su `classes.dex` **no
+implementa `WebChromeClient.onPermissionRequest`**. Sin ese metodo el WebView de
+Android deniega por defecto toda peticion de `getUserMedia()`, de modo que las
+videollamadas de Karvan no pueden funcionar por mucho que se parchee el manifest:
+la lista de permisos es estatica y hay que declararla al compilar.
+
+Este wrapper resuelve las dos puertas: declara los permisos y los concede al
+contenido web solo tras el consentimiento del usuario.
+
+## Permisos: declarados, no concedidos
+
+`CAMERA`, `RECORD_AUDIO` y `MODIFY_AUDIO_SETTINGS` figuran en el manifest porque
+Android exige que la lista sea fija. Pero son permisos peligrosos: **se piden en
+tiempo de ejecucion la primera vez que se pulsa Llamar**, no al instalar. Si nadie
+llama, no se pide nada y la app no accede a la camara ni al microfono.
+
+`uses-feature ... required="false"` evita excluir de la tienda a dispositivos sin
+camara o sin microfono.
+
+## Que reutiliza y que es nuevo
+
+Las tres librerias nativas se toman tal cual del APK existente:
+
+- `libnode.so` — nodejs-mobile **v18.20.4** oficial (OpenSSL 3.0.13+quic), un
+  artefacto publico; no hay que compilar Node.
+- `libnative-lib.so` — 6,8 KB, un solo simbolo JNI:
+  `Java_com_solarnethub_oasis_OasisActivity_startNodeWithArguments`.
+- `libc++_shared.so`
+
+Por eso el `namespace` del modulo es `com.solarnethub.oasis`: JNI resuelve por
+nombre y la clase puente tiene que vivir en ese paquete. El `applicationId` si es
+propio (`net.laenre.oasis`), asi que la app se instala junto a la oficial sin
+pisarla.
+
+Si algun dia se quiere soltar el `.so` de epsylon, reimplementar esos 6,8 KB son
+unas 40 lineas de C++ contra las cabeceras de nodejs-mobile, y ahi si haria falta
+el NDK.
+
+## Mejoras sobre el APK actual
+
+- `targetSdk 35` (el actual se quedo en uno ya caducado para la tienda).
+- Trafico en claro permitido **solo hacia loopback** via
+  `network_security_config`, en vez de `usesCleartextTraffic="true"` global.
+- `allowBackup="false"`: `adb backup` deja de poder extraer `~/.ssb`.
+- El backend corre en un servicio en primer plano, en el proceso `:node`, asi que
+  sobrevive en segundo plano — imprescindible para recibir llamadas. El APK actual
+  declara `FOREGROUND_SERVICE` pero no registra ningun servicio.
+- Al descomprimir el backend se descartan las entradas con rutas sospechosas
+  (zip slip).
+
+## Construir
+
+```sh
+# 1. dependencias del backend (una vez)
+(cd ../src/server && npm install)
+
+# 2. librerias nativas + empaquetado del backend
+./scripts/prepare.sh ../../oasis_mobile      # o la ruta de un APK
+
+# 3. compilar
+./gradlew assembleDebug                       # o assembleRelease
+```
+
+Para firmar la release, por entorno (la keystore nunca al repositorio):
+
+```sh
+export OASIS_KEYSTORE=/ruta/oasis-alfa-key.jks
+export OASIS_KEYSTORE_PASS=...
+export OASIS_KEY_ALIAS=oasis
+./gradlew assembleRelease
+```
+
+## Requisitos
+
+JDK 17 o superior **con compilador**. El OpenJDK del sistema puede ser solo
+runtime; `gradle.properties` apunta al JDK que trae Android Studio. Cambia esa
+linea si compilas en otra maquina.
+
+## Estado
+
+Compila y genera APK con los permisos y el `onPermissionRequest` en su sitio.
+**Falta probarlo en un dispositivo real**: que arranque el backend, que la
+interfaz cargue y que `getUserMedia` resuelva al pulsar Llamar.

android/app/build.gradle.kts

@@ -0,0 +1,60 @@
+plugins {
+  id("com.android.application")
+  id("org.jetbrains.kotlin.android")
+}
+
+android {
+  // El .so nativo exporta Java_com_solarnethub_oasis_OasisActivity_startNodeWithArguments,
+  // asi que la clase puente tiene que vivir en ese paquete para que el simbolo resuelva.
+  // El applicationId si es propio: la app se instala junto a la oficial sin pisarla.
+  namespace = "com.solarnethub.oasis"
+  compileSdk = 35
+
+  defaultConfig {
+    applicationId = "net.laenre.oasis"
+    minSdk = 24
+    targetSdk = 35
+    versionCode = 1
+    versionName = "0.9.5"
+    ndk { abiFilters += listOf("arm64-v8a") }
+  }
+
+  signingConfigs {
+    create("release") {
+      val ks = System.getenv("OASIS_KEYSTORE")
+      if (ks != null) {
+        storeFile = file(ks)
+        storePassword = System.getenv("OASIS_KEYSTORE_PASS")
+        keyAlias = System.getenv("OASIS_KEY_ALIAS") ?: "oasis"
+        keyPassword = System.getenv("OASIS_KEY_PASS") ?: System.getenv("OASIS_KEYSTORE_PASS")
+      }
+    }
+  }
+
+  buildTypes {
+    release {
+      isMinifyEnabled = false
+      if (System.getenv("OASIS_KEYSTORE") != null) signingConfig = signingConfigs.getByName("release")
+    }
+  }
+
+  buildFeatures { buildConfig = true }
+
+  packaging {
+    jniLibs {
+      // libnode.so son 49 MB: sin comprimir se carga por mmap y arranca mas rapido
+      useLegacyPackaging = false
+    }
+  }
+
+  compileOptions {
+    sourceCompatibility = JavaVersion.VERSION_17
+    targetCompatibility = JavaVersion.VERSION_17
+  }
+  kotlinOptions { jvmTarget = "17" }
+}
+
+dependencies {
+  implementation("androidx.appcompat:appcompat:1.7.0")
+  implementation("androidx.core:core-ktx:1.13.1")
+}

android/app/src/main/AndroidManifest.xml

@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+
+  <uses-permission android:name="android.permission.INTERNET" />
+  <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+  <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+  <uses-permission android:name="android.permission.FOREGROUND_SERVICE_DATA_SYNC" />
+  <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+
+  <!-- Camara y microfono para las videollamadas de Karvan.
+       Se declaran aqui porque Android exige que la lista sea estatica, pero NO se
+       conceden al instalar: son permisos peligrosos y se piden en tiempo de ejecucion
+       la primera vez que se pulsa Llamar. Si nadie llama, no se pide nada y la app
+       nunca accede a la camara ni al microfono. -->
+  <uses-permission android:name="android.permission.CAMERA" />
+  <uses-permission android:name="android.permission.RECORD_AUDIO" />
+  <uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS" />
+
+  <!-- required=false para no excluir de la tienda a dispositivos sin camara o sin microfono -->
+  <uses-feature android:name="android.hardware.camera" android:required="false" />
+  <uses-feature android:name="android.hardware.microphone" android:required="false" />
+
+  <application
+      android:label="@string/app_name"
+      android:icon="@mipmap/ic_launcher"
+      android:allowBackup="false"
+      android:fullBackupContent="false"
+      android:networkSecurityConfig="@xml/network_security_config"
+      android:supportsRtl="true"
+      android:theme="@style/Theme.Oasis">
+
+    <!-- El backend Node vive en su propio proceso: asi sobrevive en segundo plano
+         y se puede reiniciar limpio (nodejs-mobile solo permite arrancar node una
+         vez por proceso). -->
+    <service
+        android:name="net.laenre.oasis.NodeService"
+        android:process=":node"
+        android:exported="false"
+        android:foregroundServiceType="dataSync" />
+
+    <activity
+        android:name="net.laenre.oasis.MainActivity"
+        android:exported="true"
+        android:configChanges="orientation|screenSize|keyboardHidden|screenLayout|uiMode"
+        android:launchMode="singleTask">
+      <intent-filter>
+        <action android:name="android.intent.action.MAIN" />
+        <category android:name="android.intent.category.LAUNCHER" />
+      </intent-filter>
+    </activity>
+
+  </application>
+</manifest>

android/app/src/main/java/com/solarnethub/oasis/OasisActivity.kt

@@ -0,0 +1,22 @@
+package com.solarnethub.oasis
+
+/**
+ * Puente con el runtime de Node.
+ *
+ * El nombre de la clase y del metodo no son libres: libnative-lib.so exporta
+ * Java_com_solarnethub_oasis_OasisActivity_startNodeWithArguments, y JNI resuelve
+ * por nombre. De ahi que el namespace del modulo sea com.solarnethub.oasis aunque
+ * el applicationId sea net.laenre.oasis.
+ *
+ * No es una Activity pese al nombre; solo declara el metodo nativo.
+ */
+object OasisActivity {
+  init {
+    System.loadLibrary("node")
+    System.loadLibrary("native-lib")
+  }
+
+  /** Arranca node en el hilo actual. No retorna hasta que el runtime termina. */
+  @JvmStatic
+  external fun startNodeWithArguments(arguments: Array<String>): Int
+}

android/app/src/main/java/net/laenre/oasis/MainActivity.kt

@@ -0,0 +1,127 @@
+package net.laenre.oasis
+
+import android.Manifest
+import android.content.Intent
+import android.content.pm.PackageManager
+import android.net.Uri
+import android.os.Build
+import android.os.Bundle
+import android.os.Handler
+import android.os.Looper
+import android.webkit.PermissionRequest
+import android.webkit.WebChromeClient
+import android.webkit.WebResourceRequest
+import android.webkit.WebView
+import android.webkit.WebViewClient
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.appcompat.app.AppCompatActivity
+import androidx.core.content.ContextCompat
+import com.solarnethub.oasis.BuildConfig
+import java.net.HttpURLConnection
+import java.net.URL
+
+class MainActivity : AppCompatActivity() {
+
+  private lateinit var web: WebView
+  private var pending: PermissionRequest? = null
+
+  private val askAndroid = registerForActivityResult(ActivityResultContracts.RequestMultiplePermissions()) { granted ->
+    val req = pending
+    pending = null
+    if (req == null) return@registerForActivityResult
+    // Solo se concede al contenido web lo que el sistema nos ha concedido a nosotros.
+    val allowed = req.resources.filter { res ->
+      when (res) {
+        PermissionRequest.RESOURCE_VIDEO_CAPTURE -> granted[Manifest.permission.CAMERA] == true
+        PermissionRequest.RESOURCE_AUDIO_CAPTURE -> granted[Manifest.permission.RECORD_AUDIO] == true
+        else -> false
+      }
+    }.toTypedArray()
+    if (allowed.isEmpty()) req.deny() else req.grant(allowed)
+  }
+
+  override fun onCreate(savedInstanceState: Bundle?) {
+    super.onCreate(savedInstanceState)
+    startService(Intent(this, NodeService::class.java))
+
+    web = WebView(this)
+    setContentView(web)
+    WebView.setWebContentsDebuggingEnabled(BuildConfig.DEBUG)
+
+    web.settings.apply {
+      javaScriptEnabled = true
+      domStorageEnabled = true
+      mediaPlaybackRequiresUserGesture = false   // permite reproducir el audio remoto de la llamada
+      allowFileAccess = false
+      allowContentAccess = false
+    }
+
+    // La navegacion se queda dentro del backend local; lo de fuera va al navegador.
+    web.webViewClient = object : WebViewClient() {
+      override fun shouldOverrideUrlLoading(v: WebView?, r: WebResourceRequest?): Boolean {
+        val u = r?.url ?: return false
+        if (isLocal(u)) return false
+        startActivity(Intent(Intent.ACTION_VIEW, u))
+        return true
+      }
+    }
+
+    // Sin este WebChromeClient.onPermissionRequest, el WebView DENIEGA por defecto
+    // toda peticion de getUserMedia y no hay videollamada posible, aunque los
+    // permisos esten declarados en el manifest. Es la puerta que faltaba.
+    web.webChromeClient = object : WebChromeClient() {
+      override fun onPermissionRequest(request: PermissionRequest) {
+        runOnUiThread {
+          if (!isLocal(request.origin)) { request.deny(); return@runOnUiThread }
+          val needed = mutableListOf<String>()
+          for (res in request.resources) {
+            when (res) {
+              PermissionRequest.RESOURCE_VIDEO_CAPTURE ->
+                if (!has(Manifest.permission.CAMERA)) needed += Manifest.permission.CAMERA
+              PermissionRequest.RESOURCE_AUDIO_CAPTURE ->
+                if (!has(Manifest.permission.RECORD_AUDIO)) needed += Manifest.permission.RECORD_AUDIO
+            }
+          }
+          if (needed.isEmpty()) {
+            request.grant(request.resources)
+          } else {
+            // Aqui es donde el usuario ve el dialogo del sistema: al pulsar Llamar,
+            // no al instalar la app.
+            pending = request
+            askAndroid.launch(needed.toTypedArray())
+          }
+        }
+      }
+    }
+
+    waitForBackend()
+  }
+
+  private fun has(p: String) =
+    ContextCompat.checkSelfPermission(this, p) == PackageManager.PERMISSION_GRANTED
+
+  private fun isLocal(u: Uri?): Boolean {
+    val h = u?.host ?: return false
+    return (h == "127.0.0.1" || h == "localhost") && u.port == 3000
+  }
+
+  /** Sondea el backend y carga la interfaz en cuanto responde. */
+  private fun waitForBackend(attempt: Int = 0) {
+    Thread {
+      val up = try {
+        val c = URL("http://127.0.0.1:3000/").openConnection() as HttpURLConnection
+        c.connectTimeout = 1500; c.readTimeout = 1500; c.requestMethod = "HEAD"
+        c.responseCode in 200..399
+      } catch (_: Exception) { false }
+      Handler(Looper.getMainLooper()).post {
+        if (up) web.loadUrl("http://127.0.0.1:3000/")
+        else if (attempt < 120) Handler(Looper.getMainLooper()).postDelayed({ waitForBackend(attempt + 1) }, 500)
+      }
+    }.start()
+  }
+
+  @Deprecated("Deprecated in Java")
+  override fun onBackPressed() {
+    if (web.canGoBack()) web.goBack() else super.onBackPressed()
+  }
+}

android/app/src/main/java/net/laenre/oasis/NodeService.kt

@@ -0,0 +1,103 @@
+package net.laenre.oasis
+
+import android.app.Notification
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.Service
+import android.content.Context
+import android.content.Intent
+import android.os.Build
+import android.os.IBinder
+import android.util.Log
+import com.solarnethub.oasis.OasisActivity
+import com.solarnethub.oasis.R
+import java.io.File
+import java.io.FileOutputStream
+import java.util.zip.ZipInputStream
+
+/**
+ * Servicio en primer plano que sostiene el backend Node.
+ *
+ * Vive en el proceso :node por dos razones: nodejs-mobile solo permite arrancar el
+ * runtime una vez por proceso —cambiar de identidad exige matar el proceso, no vale
+ * reiniciar dentro—, y asi el backend sobrevive cuando la app pasa a segundo plano,
+ * que es imprescindible para recibir llamadas.
+ */
+class NodeService : Service() {
+
+  companion object {
+    private const val TAG = "OasisNode"
+    private const val CHANNEL = "oasis-node"
+    private const val NOTIF_ID = 1
+    @Volatile private var started = false
+  }
+
+  override fun onBind(intent: Intent?): IBinder? = null
+
+  override fun onCreate() {
+    super.onCreate()
+    startForeground(NOTIF_ID, buildNotification())
+    if (started) return
+    started = true
+    Thread({ runNode() }, "node-main").start()
+  }
+
+  private fun buildNotification(): Notification {
+    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+      val ch = NotificationChannel(CHANNEL, getString(R.string.node_channel), NotificationManager.IMPORTANCE_LOW)
+      ch.setShowBadge(false)
+      (getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager).createNotificationChannel(ch)
+    }
+    val b = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) Notification.Builder(this, CHANNEL)
+            else @Suppress("DEPRECATION") Notification.Builder(this)
+    return b.setContentTitle(getString(R.string.app_name))
+            .setContentText(getString(R.string.node_running))
+            .setSmallIcon(android.R.drawable.stat_notify_sync)
+            .setOngoing(true)
+            .build()
+  }
+
+  private fun runNode() {
+    try {
+      val root = File(filesDir, "nodejs-project")
+      extractProjectIfNeeded(root)
+      val main = File(root, "main.js")
+      if (!main.exists()) { Log.e(TAG, "no encuentro main.js en ${root.absolutePath}"); return }
+      // HOME cuelga del almacenamiento privado de la app: ahi vive ~/.ssb
+      val rc = OasisActivity.startNodeWithArguments(arrayOf("node", main.absolutePath))
+      Log.w(TAG, "el runtime de node ha terminado con codigo $rc")
+    } catch (e: Throwable) {
+      Log.e(TAG, "fallo arrancando node", e)
+    }
+  }
+
+  /** Descomprime assets/nodejs-project.zip la primera vez y tras cada actualizacion. */
+  private fun extractProjectIfNeeded(root: File) {
+    val stamp = File(root, ".version")
+    val current = packageManager.getPackageInfo(packageName, 0).versionName ?: "0"
+    if (stamp.exists() && stamp.readText() == current) return
+    if (root.exists()) root.deleteRecursively()
+    root.mkdirs()
+    assets.open("nodejs-project.zip").use { input ->
+      ZipInputStream(input).use { zip ->
+        var entry = zip.nextEntry
+        while (entry != null) {
+          val out = File(root, entry.name.removePrefix("nodejs-project/"))
+          // no confiar en las rutas del zip: evita escribir fuera del directorio (zip slip)
+          if (!out.canonicalPath.startsWith(root.canonicalPath + File.separator) &&
+              out.canonicalPath != root.canonicalPath) {
+            Log.w(TAG, "entrada de zip descartada por ruta sospechosa: ${entry.name}")
+          } else if (entry.isDirectory) {
+            out.mkdirs()
+          } else {
+            out.parentFile?.mkdirs()
+            FileOutputStream(out).use { fos -> zip.copyTo(fos) }
+          }
+          zip.closeEntry()
+          entry = zip.nextEntry
+        }
+      }
+    }
+    stamp.writeText(current)
+  }
+}

android/app/src/main/res/drawable/ic_launcher_foreground.xml

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Hexagono, el mismo motivo que la rejilla de navegacion de la interfaz -->
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="108dp" android:height="108dp"
+    android:viewportWidth="108" android:viewportHeight="108">
+  <path
+      android:pathData="M54,28 L74,40 L74,64 L54,76 L34,64 L34,40 Z"
+      android:strokeColor="#FFB400" android:strokeWidth="5" android:fillColor="#00000000"/>
+  <path
+      android:pathData="M54,44 L63,49 L63,59 L54,64 L45,59 L45,49 Z"
+      android:fillColor="#FFB400"/>
+</vector>

android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+  <background android:drawable="@color/ic_launcher_background"/>
+  <foreground android:drawable="@drawable/ic_launcher_foreground"/>
+</adaptive-icon>

android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+  <background android:drawable="@color/ic_launcher_background"/>
+  <foreground android:drawable="@drawable/ic_launcher_foreground"/>
+</adaptive-icon>

android/app/src/main/res/values/ic_launcher_background.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+  <color name="ic_launcher_background">#121212</color>
+</resources>

android/app/src/main/res/values/strings.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+  <string name="app_name">Oasis</string>
+  <string name="node_channel">Servicio de Oasis</string>
+  <string name="node_running">Oasis esta activo</string>
+</resources>

android/app/src/main/res/values/themes.xml

@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+  <style name="Theme.Oasis" parent="Theme.AppCompat.NoActionBar">
+    <item name="android:windowBackground">#121212</item>
+    <item name="android:statusBarColor">#121212</item>
+  </style>
+</resources>

android/app/src/main/res/xml/network_security_config.xml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- El backend corre en 127.0.0.1:3000 sin TLS, asi que hay que permitir texto en
+     claro, pero SOLO hacia loopback. El resto de la red queda en cifrado obligatorio.
+     El APK actual declara usesCleartextTraffic=true a secas, que abre cualquier host. -->
+<network-security-config>
+  <domain-config cleartextTrafficPermitted="true">
+    <domain includeSubdomains="false">127.0.0.1</domain>
+    <domain includeSubdomains="false">localhost</domain>
+  </domain-config>
+  <base-config cleartextTrafficPermitted="false" />
+</network-security-config>

android/build.gradle.kts

@@ -0,0 +1,4 @@
+plugins {
+  id("com.android.application") version "8.5.2" apply false
+  id("org.jetbrains.kotlin.android") version "1.9.24" apply false
+}

android/gradle.properties

@@ -0,0 +1,8 @@
+org.gradle.jvmargs=-Xmx2048m
+android.useAndroidX=true
+kotlin.code.style=official
+android.nonTransitiveRClass=true
+
+# El OpenJDK del sistema es solo runtime (sin javac). Se usa el JDK que trae
+# Android Studio. Si compilas en otra maquina, cambia esta ruta o instala un JDK 17+.
+org.gradle.java.home=/opt/android-studio/jbr

android/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,7 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.10.2-bin.zip
+networkTimeout=10000
+validateDistributionUrl=true
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists

android/gradlew

@@ -0,0 +1,252 @@
+#!/bin/sh
+
+#
+# Copyright © 2015-2021 the original authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+##############################################################################
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
+##############################################################################
+
+# Attempt to set APP_HOME
+
+# Resolve links: $0 may be a link
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
+done
+
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s
+' "$PWD" ) || exit
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD=maximum
+
+warn () {
+    echo "$*"
+} >&2
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+} >&2
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
+esac
+
+CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD=$JAVA_HOME/jre/sh/java
+    else
+        JAVACMD=$JAVA_HOME/bin/java
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD=java
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+fi
+
+# Increase the maximum file descriptors if we can.
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
+    esac
+fi
+
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
+        fi
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
+    done
+fi
+
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        org.gradle.wrapper.GradleWrapperMain \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
+
+exec "$JAVACMD" "$@"

android/gradlew.bat

@@ -0,0 +1,94 @@
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
+
+@if "%DEBUG%"=="" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if %ERRORLEVEL% equ 0 goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
+
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
+
+:end
+@rem End local scope for the variables with windows NT shell
+if %ERRORLEVEL% equ 0 goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega

android/scripts/prepare.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# Prepara lo que el proyecto Android no lleva en git:
+#   - las librerias nativas (libnode.so son 49 MB; no tiene sentido versionarlas)
+#   - assets/nodejs-project.zip con el backend Node y sus dependencias
+#
+# Uso:  ./scripts/prepare.sh [ruta-a-un-apk-o-directorio-con-lib/arm64-v8a]
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")/.." && pwd)"
+REPO="$(cd "$HERE/.." && pwd)"
+JNI="$HERE/app/src/main/jniLibs/arm64-v8a"
+ASSETS="$HERE/app/src/main/assets"
+SRC="${1:-}"
+
+mkdir -p "$JNI" "$ASSETS"
+
+# --- 1) librerias nativas -----------------------------------------------------
+need_libs=(libnode.so libnative-lib.so libc++_shared.so)
+missing=0
+for l in "${need_libs[@]}"; do [ -f "$JNI/$l" ] || missing=1; done
+
+if [ "$missing" = "1" ]; then
+  if [ -z "$SRC" ]; then
+    echo "Faltan las librerias nativas en $JNI"
+    echo "Pasa un APK o un directorio que tenga lib/arm64-v8a/, por ejemplo:"
+    echo "  ./scripts/prepare.sh ../../oasis_mobile"
+    exit 1
+  fi
+  if [ -d "$SRC/lib/arm64-v8a" ]; then
+    cp "$SRC/lib/arm64-v8a"/*.so "$JNI/"
+  elif [ -f "$SRC" ]; then
+    tmp="$(mktemp -d)"; unzip -qo "$SRC" 'lib/arm64-v8a/*' -d "$tmp"
+    cp "$tmp/lib/arm64-v8a"/*.so "$JNI/"; rm -rf "$tmp"
+  else
+    echo "No encuentro librerias en $SRC"; exit 1
+  fi
+  echo "librerias nativas copiadas:"; ls -la "$JNI" | tail -n +2 | awk '{print "  "$NF" ("$5" bytes)"}'
+fi
+
+# --- 2) dependencias del backend ---------------------------------------------
+if [ ! -d "$REPO/src/server/node_modules" ]; then
+  echo "Faltan las dependencias del backend. Instalalas antes:"
+  echo "  (cd $REPO/src/server && npm install)"
+  exit 1
+fi
+
+# --- 3) empaquetar el backend -------------------------------------------------
+# Sin comprimir (-0): el zip se descomprime en el arranque y asi va mas rapido.
+tmp="$(mktemp -d)"
+mkdir -p "$tmp/nodejs-project"
+cp "$REPO/main.js" "$tmp/nodejs-project/" 2>/dev/null || true
+cp "$REPO/package.json" "$tmp/nodejs-project/" 2>/dev/null || true
+cp -r "$REPO/src" "$tmp/nodejs-project/"
+( cd "$tmp" && zip -0 -q -r "$ASSETS/nodejs-project.zip" nodejs-project )
+rm -rf "$tmp"
+echo "backend empaquetado: $(du -h "$ASSETS/nodejs-project.zip" | cut -f1) en assets/nodejs-project.zip"
+echo
+echo "Listo. Ahora:  ./gradlew assembleRelease"

android/settings.gradle.kts

@@ -0,0 +1,9 @@
+pluginManagement {
+  repositories { google(); mavenCentral(); gradlePluginPortal() }
+}
+dependencyResolutionManagement {
+  repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
+  repositories { google(); mavenCentral() }
+}
+rootProject.name = "OasisMobile"
+include(":app")