cd /f/Coding/SoulStream
if [ "$REL" = "1" ]; then
    UNSIGNED=src-tauri/gen/android/app/build/outputs/apk/arm64/release/app-arm64-release-unsigned.apk
    if [ ! -f "$UNSIGNED" ]; then
        echo "no release APK — gradle's tail is above. The two failures we expect:"
        echo "  R8 missing class — its own list is at src-tauri/gen/android/app/build/outputs/mapping/arm64Release/missing_rules.txt;"
        echo "                     add what it names to src-tauri/android/proguard-soulstream.pro and run again"
        echo "  lintVital       — re-run gradle by hand with -x lintVitalArm64Release"
        echo "                     (AGP 8 splits it; -x lintVitalAnalyzeArm64Release may be the one)"
        exit 1
    fi
    KS="$HOME/.android/debug.keystore"
    test -f "$KS" || { echo "no $KS — the release APK is unsigned and no phone will install it"; exit 1; }
    BT="$(ls -d "$SDK"/build-tools/* 2>/dev/null | sort -V | tail -1 || true)"
    test -n "$BT" || { echo "no build-tools under $SDK — cannot sign"; exit 1; }
    APK=src-tauri/gen/android/app/build/outputs/apk/arm64/release/app-arm64-release.apk
    echo "== sign $(date +%T) ($(basename "$BT"))"
    "$BT/zipalign.exe" -p -f 4 "$UNSIGNED" "$APK"
    # The SAME key the debug builds are signed with, deliberately. A release
    # APK signed with any other key cannot be installed over the app already
    # on the phone, and the obvious next move — uninstall, then install —
    # takes the app's data with it. This is a test build, not a distributable
    # one; a real one needs a real key and this script is not where that goes.
    MSYS_NO_PATHCONV=1 "$BT/apksigner.bat" sign --ks "$(cygpath -w "$KS")" --ks-key-alias androiddebugkey --ks-pass pass:android --key-pass pass:android "$APK"
else
    APK=src-tauri/gen/android/app/build/outputs/apk/arm64/debug/app-arm64-debug.apk
fi
ls -la "$APK"