# APK Direct Release Guide (Local Build + Cloudflare R2)

This is the Dewemoji direct APK release flow.

## 1) One-time setup

### Required tools (local machine)

```bash
brew install awscli
brew install --cask android-platform-tools
```

### Required environment variables

```bash
export R2_ACCOUNT_ID="..."
export R2_ACCESS_KEY_ID="..."
export R2_SECRET_ACCESS_KEY="..."
export R2_BUCKET="dewemoji-downloads"
export R2_PUBLIC_BASE_URL="https://downloads.dewemoji.com"
```

Optional:

```bash
export DEWEMOJI_APK_URL="https://dewemoji.com/downloads/dewemoji-latest.apk"
```

### Optional signing environment (recommended)

```bash
export ANDROID_KEYSTORE_PATH="/absolute/path/release.jks"
export ANDROID_KEYSTORE_PASSWORD="..."
export ANDROID_KEY_ALIAS="..."
export ANDROID_KEY_PASSWORD="..."
```

---

## 2) Canonical URLs used by app updater

- `https://dewemoji.com/downloads/version.json`
- `https://dewemoji.com/downloads/dewemoji-latest.apk`

These endpoints redirect to R2 objects.

---

## 3) Release steps

Run from repo root.

### A. Build APK

```bash
./scripts/apk/build-release.sh
```

Output APK:

- `dewemoji-capacitor/dist/apk/dewemoji-v{versionName}-{versionCode}.apk`

### B. Publish APK + metadata to R2

```bash
./scripts/apk/publish-r2.sh \
  --apk dewemoji-capacitor/dist/apk/dewemoji-v1.1.2-112.apk \
  --version-name 1.1.2 \
  --version-code 112 \
  --min-supported-version-code 100 \
  --notes "Bug fixes and update UX improvements" \
  --force false
```

### C. Verify published release

```bash
./scripts/apk/verify-release.sh --base-url https://dewemoji.com/downloads
```

---

## 4) Versioning rules

1. Site-only deploy: do not bump APK version and do not publish new `version.json`.
2. Runtime/app-shell change: bump `versionCode` + `versionName`, then publish.
3. `versionCode` must always increase.
4. App update prompt appears only when remote `versionCode` is higher.

---

## 5) Rollback

1. Keep all versioned APK objects immutable (never overwrite).
2. Re-upload previous good APK to `apk/dewemoji-latest.apk`.
3. Re-publish `apk/version.json` with matching checksum/version fields.
4. Re-run verify script.

---

## 6) Notes

- Direct APK update is user-confirmed install (Android policy), not silent.
- Never embed R2 credentials in app.
- Keep app update payload over HTTPS only.