Publish the production mobile Bare runtime

.gitattributes

@@ -0,0 +1 @@
+*.patch whitespace=-blank-at-eol,-space-before-tab

.github/workflows/ci.yml

@@ -0,0 +1,77 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main, iris-wallet]
+
+permissions:
+  contents: read
+
+env:
+  RLN_VERSION: v0.11.0-beta.3
+  RUST_TOOLCHAIN: '1.88.0'
+
+jobs:
+  contract:
+    runs-on: macos-14
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Clone pinned rgb-lightning-node source
+        run: |
+          set -euo pipefail
+          RLN_DIR="$(cd "$GITHUB_WORKSPACE/../.." && pwd)/rgb-lightning-node"
+          git clone --recurse-submodules --shallow-submodules --depth 1 \
+            --branch "$RLN_VERSION" \
+            https://github.com/UTEXO-Protocol/rgb-lightning-node.git "$RLN_DIR"
+          git -C "$RLN_DIR" apply --check \
+            "$GITHUB_WORKSPACE/patches/c-ffi-utexo-patches-$RLN_VERSION.patch"
+          git -C "$RLN_DIR" apply \
+            "$GITHUB_WORKSPACE/patches/c-ffi-utexo-patches-$RLN_VERSION.patch"
+
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
+          components: rustfmt
+          # The pinned rust-lightning dependency emits one release-only warning.
+          # Keep it visible without converting third-party warnings into errors.
+          rustflags: ''
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+
+      - name: Install JavaScript dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Verify native patch integrity and contract tests
+        run: |
+          git -C ../../rgb-lightning-node diff --check
+          cargo test --locked --manifest-path ../../rgb-lightning-node/bindings/c-ffi/Cargo.toml wallet_snapshot
+          cargo test --locked --manifest-path ../../rgb-lightning-node/Cargo.toml wallet_sync_mode
+
+      - name: Build the host Bare addon and run the canary
+        run: |
+          case "$(uname -m)" in
+            arm64) HOST_TARGET=darwin-arm64 ;;
+            x86_64) HOST_TARGET=darwin-x64 ;;
+            *) echo "Unsupported host architecture: $(uname -m)"; exit 1 ;;
+          esac
+          npm run check:types
+          bash scripts/build-cffi.sh darwin
+          bash scripts/build-prebuilds.sh "$HOST_TARGET"
+          npm test
+
+      - name: Install pinned Android NDK
+        id: setup_ndk
+        run: |
+          echo "ndk-path=$(bash scripts/install-android-ndk.sh)" >> "$GITHUB_OUTPUT"
+
+      - name: Build and verify every supported Android addon
+        env:
+          ANDROID_NDK_HOME: ${{ steps.setup_ndk.outputs.ndk-path }}
+          RLN_BARE_SOURCE_DIR: ${{ github.workspace }}/../../rgb-lightning-node
+        run: node scripts/install-native-artifacts.js --platform android

.github/workflows/release.yml

@@ -67,17 +67,17 @@ jobs:
             os: android
             target: aarch64-linux-android
             platform: android-arm64
-            ndk_linker: aarch64-linux-android24-clang
+            ndk_linker: aarch64-linux-android29-clang
           - runner: macos-latest
             os: android
             target: armv7-linux-androideabi
             platform: android-arm
-            ndk_linker: armv7a-linux-androideabi24-clang
+            ndk_linker: armv7a-linux-androideabi29-clang
           - runner: macos-latest
             os: android
             target: x86_64-linux-android
             platform: android-x64
-            ndk_linker: x86_64-linux-android24-clang
+            ndk_linker: x86_64-linux-android29-clang
     runs-on: ${{ matrix.runner }}
     steps:
       - name: Checkout repository
@@ -136,12 +136,11 @@ jobs:
         if: matrix.os == 'android'
         run: cargo install --force --locked bindgen-cli --version 0.72.1
 
-      - name: Setup Android NDK
+      - name: Install pinned Android NDK
         if: matrix.os == 'android'
-        uses: nttld/setup-ndk@v1
         id: setup_ndk
-        with:
-          ndk-version: r27c
+        run: |
+          echo "ndk-path=$(bash scripts/install-android-ndk.sh)" >> "$GITHUB_OUTPUT"
 
       - name: Pin signer-external to RLN-compatible commit
         env:
@@ -209,7 +208,7 @@ jobs:
           export RANLIB_${TARGET_UNDERSCORE}="$TOOLCHAIN/bin/llvm-ranlib"
 
           # bindgen needs the Android sysroot for non-arm64 targets.
-          export BINDGEN_EXTRA_CLANG_ARGS="--sysroot=$TOOLCHAIN/sysroot -target ${TARGET}24"
+          export BINDGEN_EXTRA_CLANG_ARGS="--sysroot=$TOOLCHAIN/sysroot -target ${TARGET}29"
 
           cargo rustc --release --target ${{ matrix.target }} --crate-type staticlib
           "$TOOLCHAIN/bin/llvm-strip" --strip-debug "target/${{ matrix.target }}/release/librlncffi.a" || true
@@ -264,12 +263,11 @@ jobs:
           name: librlncffi-${{ matrix.platform }}
           path: lib/${{ matrix.platform }}
 
-      - name: Setup Android NDK
+      - name: Install pinned Android NDK
         if: startsWith(matrix.platform, 'android-')
-        uses: nttld/setup-ndk@v1
         id: setup_ndk
-        with:
-          ndk-version: r27c
+        run: |
+          echo "ndk-path=$(bash scripts/install-android-ndk.sh)" >> "$GITHUB_OUTPUT"
 
       - name: Build prebuild (Apple)
         if: ${{ !startsWith(matrix.platform, 'android-') }}
@@ -301,7 +299,7 @@ jobs:
             -Dcmake-npm_DIR="$PWD/node_modules/cmake-npm" \
             -DCMAKE_TOOLCHAIN_FILE="$ANDROID_NDK_HOME/build/cmake/android.toolchain.cmake" \
             -DANDROID_ABI=${{ matrix.android_abi }} \
-            -DANDROID_PLATFORM=android-24 \
+            -DANDROID_PLATFORM=android-29 \
             -DANDROID_ALLOW_UNDEFINED_SYMBOLS=TRUE
           cmake --build build-tmp
           BARE=$(find build-tmp -name "*.bare" -type f | head -1)

.gitignore

@@ -4,6 +4,7 @@ node_modules/
 # Build artefacts (large; distributed via GitHub Releases like rgb-lib-bare)
 lib/
 prebuilds/
+.utexo-native-overlay.json
 
 # CMake build dirs
 build/

CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## Unreleased
+
+- Persist a local VSS writer identity so abrupt process restarts reclaim their
+  own fence without enabling automatic cross-installation fence clearing.
+- Publish that identity with an Android-safe exclusive-create protocol instead
+  of filesystem hard links, with bounded concurrent-reader retry and
+  fail-closed corruption handling.
+
+## 0.1.0-beta.19
+
+- Expose the disk-backed native VLS signer required for channels to survive
+  mobile process restarts.
+- Bind native artifacts to the exact overlay commit, patch, toolchain, targets,
+  and content hashes so stale binaries cannot satisfy a newer package contract.
+- Add a production-shaped RGB payment regression for a persistent external
+  signer accepting an inbound trusted virtual channel.
+
 All notable changes to `@utexo/rgb-lightning-node-bare` are documented
 here.
 
@@ -10,6 +27,37 @@ while pre-`1.0`.
 ## [Unreleased]
 
 ### Added
+- Reproducible Android overlay artifacts for `arm64-v8a`, `armeabi-v7a`,
+  and `x86_64`, built from the same pinned native patch as iOS with exact
+  Rust, NDK, API-level, cargo-ndk, and bindgen inputs.
+- Platform-scoped native preparation for local and EAS builds, incremental
+  cross-platform artifact provenance, and ELF-aware exported-symbol checks.
+- Authoritative `listAddressReceipts(address)` settlement evidence backed by
+  the configured Electrum or Esplora indexer, including exact received
+  satoshis, transaction IDs, block heights, and confirmation counts.
+- Deterministic BTC and RGB on-chain send plans. `prepareBtcSend()` and
+  `prepareRgbSend()` reserve the exact unsigned plan inside the native wallet
+  and return only its opaque transaction identity, fee, input/output totals,
+  virtual size, and RGB batch identity. `commitPreparedBtcSend()` and
+  `commitPreparedRgbSend()` idempotently validate and submit that exact
+  native plan without exposing PSBT material to JavaScript.
+- Explicit RGB wallet UTXO setup plans. `prepareCreateUtxos()` reserves an
+  exact native transaction and returns only review-safe fee, input, output,
+  virtual-size, target-count, and output-size data.
+  `commitPreparedCreateUtxos()` signs and broadcasts that exact plan, while
+  `cancelCreateUtxosPlan()` releases only a matching setup reservation.
+- Preserve `pending_blinded` in every `listUnspents()` item so callers can
+  distinguish a genuinely free RGB allocation slot from a receive-reserved
+  colorable UTXO.
+- Idempotent BTC and RGB plan cancellation plus bounded pending-plan
+  inspection, allowing a wallet to release abandoned send reservations
+  without touching channel or UTXO-management operations.
+- `SdkNode.syncWallet()` and `SdkNode.walletSnapshot()` with the same pinned
+  native overlay as NodeJS: dual-keychain
+  FullSync/FullScan modes, bounded activity, coherent tip evidence, and
+  decimal-string amounts.
+- Strict public TypeScript declarations and pull-request CI that builds and
+  executes the host Bare addon against the pinned native contract.
 - `SdkNode.assetLinkCreate(request)` for the RLN v0.11 parent/child RGB
   asset-link contract.
 - `SdkNode.verifyMessage(message, signature)` with canonical Lightning
@@ -18,17 +66,46 @@ while pre-`1.0`.
   `listTransfersByTxid()` wrappers required by WDK's read-only account.
 - A release smoke test that loads the built Darwin addon and exercises node
   creation, external-signer initialization, and locked-state verification.
+- An explicit `RLN_BARE_JS_ONLY_INSTALL=1` mode for non-native CI tooling;
+  native app paths continue to require symbol-verified artifacts.
 
 ### Changed
+- Android Bare addons have debug sections stripped with the pinned NDK
+  toolchain before hashing and packaging.
 - Updated the transaction and transfer query bindings for the consolidated
   RLN v0.11 C-FFI filter signatures while retaining the existing JavaScript
   convenience methods.
 - Tag-specific C-FFI overlays are optional; current RLN tags build directly
   from upstream when no overlay exists.
 - CI and local package tests use the Bare runtime explicitly and reproducible
   `npm ci` installs.
+- Unsupported non-macOS Apple source builds fail with a direct platform error.
 
 ### Fixed
+- Prepared RGB UTXO setup atomically isolates allocation outputs on a fresh
+  colored address and advances the receive address again before returning the
+  plan. Existing and future witness invoices can no longer quarantine setup
+  outputs as `pending_witness`.
+- Explicit node shutdown and signer destruction now release their native
+  handles immediately, including persistent signer database locks, instead of
+  waiting for nondeterministic garbage collection.
+- Reopening a trusted virtual channel no longer fails after the previous
+  channel was safely abandoned. Active and abandon-pending sessions still
+  block duplicate opens; only the terminal abandoned state is reusable.
+- `decodeRgbInvoice()` now returns a stable tagged assignment object instead
+  of an implementation-defined Rust `Debug` string. The exact blind/witness
+  recipient type and nullable expiration remain preserved.
+- `decodeLnInvoice()` now preserves `min_final_cltv_expiry_delta` across the
+  C-FFI JSON boundary. A native contract test guards the complete mobile
+  response shape so the React Native runtime cannot silently lose CLTV data.
+- C-FFI network information now emits canonical lowercase network names,
+  matching the public TypeScript contract and wallet snapshot contract v1.
+- Git-commit consumers now build the checksum-pinned C-FFI overlay for the
+  declared iOS targets (or import explicitly supplied, symbol-verified CI
+  artifacts) instead of silently linking older release binaries. Registry
+  packages without overlay metadata retain the release-asset installer. The
+  CMake packages needed by this production install path are runtime build
+  dependencies rather than dev-only dependencies.
 - Replaced the nonexistent `cmake-bare-rebuild` package script with the
   repository's supported prebuild script.
 - Release version commits now include `package-lock.json`.

CMakeLists.txt

@@ -54,7 +54,6 @@ if(target MATCHES "ios")
       "-framework Security"
       "-framework SystemConfiguration"
       "-framework CoreFoundation"
-      "-lc++"
       "-lz"
       "-lsqlite3"
       "-lresolv"
@@ -66,7 +65,6 @@ elseif(target MATCHES "darwin")
       "-framework Security"
       "-framework SystemConfiguration"
       "-framework CoreFoundation"
-      "-lc++"
       "-lz"
       "-lsqlite3"
       "-lresolv"