# TurnosXpress Android TWA

Minimal Android Trusted Web Activity app for `https://turnosxpress.com.ar`.

## Project

- Package/application id: `com.hdrdevs.turnosxpress`
- Launch URL: `https://turnosxpress.com.ar`
- TWA library: `com.google.androidbrowserhelper:androidbrowserhelper:2.7.2`
- Launcher activity: `com.google.androidbrowserhelper.trusted.LauncherActivity`

## Build

This folder intentionally does not include a Gradle wrapper. Open `tx-android` in Android Studio, or use an installed Gradle distribution:

```powershell
cd tx-android
gradle tasks
gradle assembleDebug
```

If Android Studio creates `local.properties`, keep it local. It is ignored by Git.

## Signing

For local debug builds Android uses the debug keystore. For Play Store releases, sign with the release keystore or Play App Signing certificate configured for this package.

Example local release keystore creation:

```powershell
keytool -genkeypair -v -keystore turnosxpress-release.jks -alias turnosxpress -keyalg RSA -keysize 2048 -validity 10000
```

Do not commit keystores or signing passwords. Put local signing values in `keystore.properties` if you later wire release signing into Gradle.

## SHA-256 Fingerprint

Digital Asset Links must use the SHA-256 fingerprint of the certificate that signs the installed APK.

Debug keystore example:

```powershell
keytool -list -v -alias androiddebugkey -keystore "$env:USERPROFILE\.android\debug.keystore" -storepass android -keypass android
```

Release keystore example:

```powershell
keytool -list -v -alias turnosxpress -keystore .\turnosxpress-release.jks
```

If Play App Signing is enabled, use the SHA-256 fingerprint from Play Console's app signing certificate, not only the upload key.

## Digital Asset Links

Publish this file publicly at:

```text
https://turnosxpress.com.ar/.well-known/assetlinks.json
```

Example:

```json
[
  {
    "relation": ["delegate_permission/common.handle_all_urls"],
    "target": {
      "namespace": "android_app",
      "package_name": "com.hdrdevs.turnosxpress",
      "sha256_cert_fingerprints": [
        "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99"
      ]
    }
  }
]
```

The JSON must be served over HTTPS with `Content-Type: application/json` and no redirects that break access to `/.well-known/assetlinks.json`.

## Play Protect And Local APK Notes

Local APK installs can show Play Protect warnings because the APK is not installed from Google Play and may be signed by a new or unknown certificate. This is expected during sideload testing and does not prove the TWA or Digital Asset Links setup is wrong.

The full-screen trusted experience only works when Android can verify the website-to-app relationship through Digital Asset Links for the certificate used to sign that APK. Until that is valid, Chrome may open the site with browser UI or behave like a Custom Tab.