🍒 [PM-21537] Fix remove individual vault collection selection cherrypick (#5261 )

🍒PM-17660: Sync learn more cherry pick (#5249 )
🍒Bump authenticatorbridge to 1.0.1 (#5248 )
2026-05-21 11:56:35 -05:00 · 2025-05-23 20:40:48 +01:00 · 2025-05-22 19:01:54 +00:00 · 2025-05-22 17:58:58 +00:00 · 2025-05-22 12:48:08 -05:00 · 2025-05-22 13:39:52 -04:00
2199 changed files with 67453 additions and 59771 deletions
--- a/.github/actions/log-inputs/action.yml
+++ b/.github/actions/log-inputs/action.yml
@@ -1,20 +0,0 @@
-name: 'Log Inputs to Job Summary'
-description: 'Log workflow inputs to the GitHub Actions job summary'
-
-inputs:
-  inputs:
-    description: 'Workflow inputs as JSON'
-    required: true
-
-runs:
-  using: 'composite'
-  steps:
-    - name: Log inputs to job summary
-      shell: bash
-      run: |
-        echo "<details><summary>Job Inputs</summary>" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo '```json' >> $GITHUB_STEP_SUMMARY
-        echo '${{ inputs.inputs }}' >> $GITHUB_STEP_SUMMARY
-        echo '```' >> $GITHUB_STEP_SUMMARY
-        echo "</details>" >> $GITHUB_STEP_SUMMARY
--- a/.github/actions/setup-android-build/action.yml
+++ b/.github/actions/setup-android-build/action.yml
@@ -1,49 +0,0 @@
-name: 'Setup Android Build'
-description: 'Setup Android build environment with Gradle, Ruby, and Fastlane'
-inputs:
-  java-version:
-    description: 'Java version to use'
-    required: false
-    default: '17'
-runs:
-  using: 'composite'
-  steps:
-    - name: Validate Gradle wrapper
-      uses: gradle/actions/wrapper-validation@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
-
-    - name: Cache Gradle files
-      uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
-      with:
-        path: |
-          ~/.gradle/caches
-          ~/.gradle/wrapper
-        key: ${{ runner.os }}-gradle-v2-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', '**/libs.versions.toml') }}
-        restore-keys: |
-          ${{ runner.os }}-gradle-v2-
-
-    - name: Cache build output
-      uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
-      with:
-        path: |
-          ${{ github.workspace }}/build-cache
-        key: ${{ runner.os }}-build-cache-${{ github.sha }}
-        restore-keys: |
-          ${{ runner.os }}-build-
-
-    - name: Configure Ruby
-      uses: ruby/setup-ruby@829114fc20da43a41d27359103ec7a63020954d4 # v1.255.0
-      with:
-        bundler-cache: true
-
-    - name: Configure JDK
-      uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
-      with:
-        distribution: "temurin"
-        java-version: ${{ inputs.java-version }}
-
-    - name: Install Fastlane
-      shell: bash
-      run: |
-        gem install bundler:2.2.27
-        bundle config path vendor/bundle
-        bundle install --jobs 4 --retry 3
--- a/.github/scripts/jira-get-release-notes/README.md
+++ b/.github/scripts/jira-get-release-notes/README.md
@@ -1,133 +0,0 @@
-# Get Release Notes from Jira script
-
-Fetches release notes from Jira issues.
-
-## Prerequisites
-
- Python dev environment - use [uv](https://github.com/astral-sh/uv)
- Jira API token. Generate one at: https://id.atlassian.com/manage-profile/security/api-tokens
- Install dependencies:
-
-```bash
-uv pip install -r pyproject.toml
-```
-
-## Usage
-
-```bash
-./jira_release_notes.py RELEASE-1762 example@example.com T0k3n123
-```
-
-# Output Format
-
-The script retrieves the content from a custom field and handles two types of Jira release notes formats:
-
-1. Bullet Points:
-```
-• Point 1
-• Point 2
-• Point 3
-```
-
-2. Single Line:
-```
-Single line of release notes text
-```
-
-## Jira JSON format example
-
-### Single line
-
-```json
-...
-"customfield_10335": {
-    "type": "doc",
-    "version": 1,
-    "content": [
-        {
-            "type": "paragraph",
-            "content": [
-                {
-                    "type": "text",
-                    "text": "Single line release notes"
-                }
-            ]
-        }
-    ]
-},
-...
-```
-
-### Bullet points
-
-```json
-...
-"customfield_10335": {
-    "type": "doc",
-    "version": 1,
-    "content": [
-        {
-            "type": "bulletList",
-            "content": [
-                {
-                    "type": "listItem",
-                    "content": [
-                        {
-                            "type": "paragraph",
-                            "content": [
-                                {
-                                    "type": "text",
-                                    "text": "Release notes list item 1"
-                                }
-                            ]
-                        }
-                    ]
-                },
-                {
-                    "type": "listItem",
-                    "content": [
-                        {
-                            "type": "paragraph",
-                            "content": [
-                                {
-                                    "type": "text",
-                                    "text": "Release notes list item 2"
-                                }
-                            ]
-                        }
-                    ]
-                },
-                {
-                    "type": "listItem",
-                    "content": [
-                        {
-                            "type": "paragraph",
-                            "content": [
-                                {
-                                    "type": "text",
-                                    "text": "Release notes list item 3"
-                                }
-                            ]
-                        }
-                    ]
-                },
-                {
-                    "type": "listItem",
-                    "content": [
-                        {
-                            "type": "paragraph",
-                            "content": [
-                                {
-                                    "type": "text",
-                                    "text": "Release notes list item 4"
-                                }
-                            ]
-                        }
-                    ]
-                }
-            ]
-        }
-    ]
-},
-...
-```
--- a/.github/scripts/jira-get-release-notes/jira_release_notes.py
+++ b/.github/scripts/jira-get-release-notes/jira_release_notes.py
@@ -1,70 +0,0 @@
-#!/usr/bin/env python3
-
-import sys
-import base64
-import json
-import requests
-
-def extract_text_from_content(content):
-    if isinstance(content, list):
-        texts = [extract_text_from_content(item) for item in content]
-        return '\n'.join(text for text in texts if text.strip())
-
-    if isinstance(content, dict):
-        if content.get('type') == 'text':
-            return content.get('text', '')
-        elif content.get('type') == 'paragraph':
-            return extract_text_from_content(content.get('content', []))
-        elif content.get('type') == 'bulletList':
-            return extract_text_from_content(content.get('content', []))
-        elif content.get('type') == 'listItem':
-            item_text = extract_text_from_content(content.get('content', []))
-            return f"* {item_text.strip()}"
-
-    return ''
-
-def parse_release_notes(response_json):
-    try:
-        fields = response_json.get('fields', {})
-        release_notes_field = fields.get('customfield_10335', {})
-
-        if not release_notes_field or not release_notes_field.get('content'):
-            return ''
-
-        release_notes = extract_text_from_content(release_notes_field.get('content', []))
-        return release_notes
-
-    except Exception as e:
-        print(f"Error parsing release notes: {str(e)}", file=sys.stderr)
-        return ''
-
-def main():
-    if len(sys.argv) != 4:
-        print(f"Usage: {sys.argv[0]} <issue_id> <jira_email> <jira_api_token>")
-        sys.exit(1)
-
-    jira_issue_id = sys.argv[1]
-    jira_email = sys.argv[2]
-    jira_api_token = sys.argv[3]
-    jira_base_url = "https://bitwarden.atlassian.net"
-
-    auth = base64.b64encode(f"{jira_email}:{jira_api_token}".encode()).decode()
-    headers = {
-        "Authorization": f"Basic {auth}",
-        "Content-Type": "application/json"
-    }
-
-    response = requests.get(
-        f"{jira_base_url}/rest/api/3/issue/{jira_issue_id}",
-        headers=headers
-    )
-
-    if response.status_code != 200:
-        print(f"Error fetching Jira issue: {response.status_code}", file=sys.stderr)
-        sys.exit(1)
-
-    release_notes = parse_release_notes(response.json())
-    print(release_notes)
-
-if __name__ == "__main__":
-    main()
--- a/.github/scripts/jira-get-release-notes/pyproject.toml
+++ b/.github/scripts/jira-get-release-notes/pyproject.toml
@@ -1,9 +0,0 @@
-[project]
-name = "jira-get-release-notes"
-version = "0.1.0"
-description = "Add your description here"
-readme = "README.md"
-requires-python = ">=3.12"
-dependencies = [
-    "requests>=2.32.3",
-]
--- a/.github/scripts/jira-get-release-notes/uv.lock
+++ b/.github/scripts/jira-get-release-notes/uv.lock
@@ -1,91 +0,0 @@
-version = 1
-revision = 2
-requires-python = ">=3.12"
-
-[[package]]
-name = "certifi"
-version = "2025.4.26"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/e8/9e/c05b3920a3b7d20d3d3310465f50348e5b3694f4f88c6daf736eef3024c4/certifi-2025.4.26.tar.gz", hash = "sha256:0a816057ea3cdefcef70270d2c515e4506bbc954f417fa5ade2021213bb8f0c6", size = 160705, upload-time = "2025-04-26T02:12:29.51Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/4a/7e/3db2bd1b1f9e95f7cddca6d6e75e2f2bd9f51b1246e546d88addca0106bd/certifi-2025.4.26-py3-none-any.whl", hash = "sha256:30350364dfe371162649852c63336a15c70c6510c2ad5015b21c2345311805f3", size = 159618, upload-time = "2025-04-26T02:12:27.662Z" },
-]
-
-[[package]]
-name = "charset-normalizer"
-version = "3.4.2"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/e4/33/89c2ced2b67d1c2a61c19c6751aa8902d46ce3dacb23600a283619f5a12d/charset_normalizer-3.4.2.tar.gz", hash = "sha256:5baececa9ecba31eff645232d59845c07aa030f0c81ee70184a90d35099a0e63", size = 126367, upload-time = "2025-05-02T08:34:42.01Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/d7/a4/37f4d6035c89cac7930395a35cc0f1b872e652eaafb76a6075943754f095/charset_normalizer-3.4.2-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:0c29de6a1a95f24b9a1aa7aefd27d2487263f00dfd55a77719b530788f75cff7", size = 199936, upload-time = "2025-05-02T08:32:33.712Z" },
-    { url = "https://files.pythonhosted.org/packages/ee/8a/1a5e33b73e0d9287274f899d967907cd0bf9c343e651755d9307e0dbf2b3/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:cddf7bd982eaa998934a91f69d182aec997c6c468898efe6679af88283b498d3", size = 143790, upload-time = "2025-05-02T08:32:35.768Z" },
-    { url = "https://files.pythonhosted.org/packages/66/52/59521f1d8e6ab1482164fa21409c5ef44da3e9f653c13ba71becdd98dec3/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:fcbe676a55d7445b22c10967bceaaf0ee69407fbe0ece4d032b6eb8d4565982a", size = 153924, upload-time = "2025-05-02T08:32:37.284Z" },
-    { url = "https://files.pythonhosted.org/packages/86/2d/fb55fdf41964ec782febbf33cb64be480a6b8f16ded2dbe8db27a405c09f/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:d41c4d287cfc69060fa91cae9683eacffad989f1a10811995fa309df656ec214", size = 146626, upload-time = "2025-05-02T08:32:38.803Z" },
-    { url = "https://files.pythonhosted.org/packages/8c/73/6ede2ec59bce19b3edf4209d70004253ec5f4e319f9a2e3f2f15601ed5f7/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4e594135de17ab3866138f496755f302b72157d115086d100c3f19370839dd3a", size = 148567, upload-time = "2025-05-02T08:32:40.251Z" },
-    { url = "https://files.pythonhosted.org/packages/09/14/957d03c6dc343c04904530b6bef4e5efae5ec7d7990a7cbb868e4595ee30/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:cf713fe9a71ef6fd5adf7a79670135081cd4431c2943864757f0fa3a65b1fafd", size = 150957, upload-time = "2025-05-02T08:32:41.705Z" },
-    { url = "https://files.pythonhosted.org/packages/0d/c8/8174d0e5c10ccebdcb1b53cc959591c4c722a3ad92461a273e86b9f5a302/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:a370b3e078e418187da8c3674eddb9d983ec09445c99a3a263c2011993522981", size = 145408, upload-time = "2025-05-02T08:32:43.709Z" },
-    { url = "https://files.pythonhosted.org/packages/58/aa/8904b84bc8084ac19dc52feb4f5952c6df03ffb460a887b42615ee1382e8/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:a955b438e62efdf7e0b7b52a64dc5c3396e2634baa62471768a64bc2adb73d5c", size = 153399, upload-time = "2025-05-02T08:32:46.197Z" },
-    { url = "https://files.pythonhosted.org/packages/c2/26/89ee1f0e264d201cb65cf054aca6038c03b1a0c6b4ae998070392a3ce605/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:7222ffd5e4de8e57e03ce2cef95a4c43c98fcb72ad86909abdfc2c17d227fc1b", size = 156815, upload-time = "2025-05-02T08:32:48.105Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/07/68e95b4b345bad3dbbd3a8681737b4338ff2c9df29856a6d6d23ac4c73cb/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:bee093bf902e1d8fc0ac143c88902c3dfc8941f7ea1d6a8dd2bcb786d33db03d", size = 154537, upload-time = "2025-05-02T08:32:49.719Z" },
-    { url = "https://files.pythonhosted.org/packages/77/1a/5eefc0ce04affb98af07bc05f3bac9094513c0e23b0562d64af46a06aae4/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:dedb8adb91d11846ee08bec4c8236c8549ac721c245678282dcb06b221aab59f", size = 149565, upload-time = "2025-05-02T08:32:51.404Z" },
-    { url = "https://files.pythonhosted.org/packages/37/a0/2410e5e6032a174c95e0806b1a6585eb21e12f445ebe239fac441995226a/charset_normalizer-3.4.2-cp312-cp312-win32.whl", hash = "sha256:db4c7bf0e07fc3b7d89ac2a5880a6a8062056801b83ff56d8464b70f65482b6c", size = 98357, upload-time = "2025-05-02T08:32:53.079Z" },
-    { url = "https://files.pythonhosted.org/packages/6c/4f/c02d5c493967af3eda9c771ad4d2bbc8df6f99ddbeb37ceea6e8716a32bc/charset_normalizer-3.4.2-cp312-cp312-win_amd64.whl", hash = "sha256:5a9979887252a82fefd3d3ed2a8e3b937a7a809f65dcb1e068b090e165bbe99e", size = 105776, upload-time = "2025-05-02T08:32:54.573Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/12/a93df3366ed32db1d907d7593a94f1fe6293903e3e92967bebd6950ed12c/charset_normalizer-3.4.2-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:926ca93accd5d36ccdabd803392ddc3e03e6d4cd1cf17deff3b989ab8e9dbcf0", size = 199622, upload-time = "2025-05-02T08:32:56.363Z" },
-    { url = "https://files.pythonhosted.org/packages/04/93/bf204e6f344c39d9937d3c13c8cd5bbfc266472e51fc8c07cb7f64fcd2de/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:eba9904b0f38a143592d9fc0e19e2df0fa2e41c3c3745554761c5f6447eedabf", size = 143435, upload-time = "2025-05-02T08:32:58.551Z" },
-    { url = "https://files.pythonhosted.org/packages/22/2a/ea8a2095b0bafa6c5b5a55ffdc2f924455233ee7b91c69b7edfcc9e02284/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3fddb7e2c84ac87ac3a947cb4e66d143ca5863ef48e4a5ecb83bd48619e4634e", size = 153653, upload-time = "2025-05-02T08:33:00.342Z" },
-    { url = "https://files.pythonhosted.org/packages/b6/57/1b090ff183d13cef485dfbe272e2fe57622a76694061353c59da52c9a659/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:98f862da73774290f251b9df8d11161b6cf25b599a66baf087c1ffe340e9bfd1", size = 146231, upload-time = "2025-05-02T08:33:02.081Z" },
-    { url = "https://files.pythonhosted.org/packages/e2/28/ffc026b26f441fc67bd21ab7f03b313ab3fe46714a14b516f931abe1a2d8/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6c9379d65defcab82d07b2a9dfbfc2e95bc8fe0ebb1b176a3190230a3ef0e07c", size = 148243, upload-time = "2025-05-02T08:33:04.063Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/0f/9abe9bd191629c33e69e47c6ef45ef99773320e9ad8e9cb08b8ab4a8d4cb/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:e635b87f01ebc977342e2697d05b56632f5f879a4f15955dfe8cef2448b51691", size = 150442, upload-time = "2025-05-02T08:33:06.418Z" },
-    { url = "https://files.pythonhosted.org/packages/67/7c/a123bbcedca91d5916c056407f89a7f5e8fdfce12ba825d7d6b9954a1a3c/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:1c95a1e2902a8b722868587c0e1184ad5c55631de5afc0eb96bc4b0d738092c0", size = 145147, upload-time = "2025-05-02T08:33:08.183Z" },
-    { url = "https://files.pythonhosted.org/packages/ec/fe/1ac556fa4899d967b83e9893788e86b6af4d83e4726511eaaad035e36595/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:ef8de666d6179b009dce7bcb2ad4c4a779f113f12caf8dc77f0162c29d20490b", size = 153057, upload-time = "2025-05-02T08:33:09.986Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/ff/acfc0b0a70b19e3e54febdd5301a98b72fa07635e56f24f60502e954c461/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:32fc0341d72e0f73f80acb0a2c94216bd704f4f0bce10aedea38f30502b271ff", size = 156454, upload-time = "2025-05-02T08:33:11.814Z" },
-    { url = "https://files.pythonhosted.org/packages/92/08/95b458ce9c740d0645feb0e96cea1f5ec946ea9c580a94adfe0b617f3573/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:289200a18fa698949d2b39c671c2cc7a24d44096784e76614899a7ccf2574b7b", size = 154174, upload-time = "2025-05-02T08:33:13.707Z" },
-    { url = "https://files.pythonhosted.org/packages/78/be/8392efc43487ac051eee6c36d5fbd63032d78f7728cb37aebcc98191f1ff/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:4a476b06fbcf359ad25d34a057b7219281286ae2477cc5ff5e3f70a246971148", size = 149166, upload-time = "2025-05-02T08:33:15.458Z" },
-    { url = "https://files.pythonhosted.org/packages/44/96/392abd49b094d30b91d9fbda6a69519e95802250b777841cf3bda8fe136c/charset_normalizer-3.4.2-cp313-cp313-win32.whl", hash = "sha256:aaeeb6a479c7667fbe1099af9617c83aaca22182d6cf8c53966491a0f1b7ffb7", size = 98064, upload-time = "2025-05-02T08:33:17.06Z" },
-    { url = "https://files.pythonhosted.org/packages/e9/b0/0200da600134e001d91851ddc797809e2fe0ea72de90e09bec5a2fbdaccb/charset_normalizer-3.4.2-cp313-cp313-win_amd64.whl", hash = "sha256:aa6af9e7d59f9c12b33ae4e9450619cf2488e2bbe9b44030905877f0b2324980", size = 105641, upload-time = "2025-05-02T08:33:18.753Z" },
-    { url = "https://files.pythonhosted.org/packages/20/94/c5790835a017658cbfabd07f3bfb549140c3ac458cfc196323996b10095a/charset_normalizer-3.4.2-py3-none-any.whl", hash = "sha256:7f56930ab0abd1c45cd15be65cc741c28b1c9a34876ce8c17a2fa107810c0af0", size = 52626, upload-time = "2025-05-02T08:34:40.053Z" },
-]
-
-[[package]]
-name = "jira-get-release-notes"
-version = "0.1.0"
-source = { virtual = "." }
-dependencies = [
-    { name = "requests" },
-]
-
-[package.metadata]
-requires-dist = [{ name = "requests", specifier = ">=2.32.3" }]
-
-[[package]]
-name = "idna"
-version = "3.10"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/f1/70/7703c29685631f5a7590aa73f1f1d3fa9a380e654b86af429e0934a32f7d/idna-3.10.tar.gz", hash = "sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9", size = 190490, upload-time = "2024-09-15T18:07:39.745Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/76/c6/c88e154df9c4e1a2a66ccf0005a88dfb2650c1dffb6f5ce603dfbd452ce3/idna-3.10-py3-none-any.whl", hash = "sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3", size = 70442, upload-time = "2024-09-15T18:07:37.964Z" },
-]
-
-[[package]]
-name = "requests"
-version = "2.32.3"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "certifi" },
-    { name = "charset-normalizer" },
-    { name = "idna" },
-    { name = "urllib3" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/63/70/2bf7780ad2d390a8d301ad0b550f1581eadbd9a20f896afe06353c2a2913/requests-2.32.3.tar.gz", hash = "sha256:55365417734eb18255590a9ff9eb97e9e1da868d4ccd6402399eaf68af20a760", size = 131218, upload-time = "2024-05-29T15:37:49.536Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/f9/9b/335f9764261e915ed497fcdeb11df5dfd6f7bf257d4a6a2a686d80da4d54/requests-2.32.3-py3-none-any.whl", hash = "sha256:70761cfe03c773ceb22aa2f671b4757976145175cdfca038c02654d061d6dcc6", size = 64928, upload-time = "2024-05-29T15:37:47.027Z" },
-]
-
-[[package]]
-name = "urllib3"
-version = "2.4.0"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/8a/78/16493d9c386d8e60e442a35feac5e00f0913c0f4b7c217c11e8ec2ff53e0/urllib3-2.4.0.tar.gz", hash = "sha256:414bc6535b787febd7567804cc015fee39daab8ad86268f1310a9250697de466", size = 390672, upload-time = "2025-04-10T15:23:39.232Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/6b/11/cc635220681e93a0183390e26485430ca2c7b5f9d33b15c74c2861cb8091/urllib3-2.4.0-py3-none-any.whl", hash = "sha256:4e16665048960a0900c702d4a66415956a584919c03361cac9f1df5c5dd7e813", size = 128680, upload-time = "2025-04-10T15:23:37.377Z" },
-]
--- a/.github/workflows/build-authenticator.yml
+++ b/.github/workflows/build-authenticator.yml
@@ -4,7 +4,6 @@ on:
  push:
    branches:
      - main
-      - release/**/*
  workflow_dispatch:
    inputs:
      version-name:
@@ -30,34 +29,20 @@ env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  JAVA_VERSION: 17

-permissions:
-  contents: read
-  packages: read
-  id-token: write
-
 jobs:
  build:
    name: Build Authenticator
    runs-on: ubuntu-24.04

    steps:
-      - name: Log inputs to job summary
-        run: |
-          echo "<details><summary>Job Inputs</summary>" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo '```json' >> $GITHUB_STEP_SUMMARY
-          echo '${{ toJson(inputs) }}' >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
-          echo "</details>" >> $GITHUB_STEP_SUMMARY
-
      - name: Check out repo
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
+        uses: gradle/actions/wrapper-validation@06832c7b30a0129d7fb559bcc6e43d26f6374244 # v4.3.1

      - name: Cache Gradle files
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ~/.gradle/caches
@@ -67,7 +52,7 @@ jobs:
            ${{ runner.os }}-gradle-v2-

      - name: Cache build output
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ${{ github.workspace }}/build-cache
@@ -82,7 +67,7 @@ jobs:
          java-version: ${{ env.JAVA_VERSION }}

      - name: Configure Ruby
-        uses: ruby/setup-ruby@829114fc20da43a41d27359103ec7a63020954d4 # v1.255.0
+        uses: ruby/setup-ruby@ca041f971d66735f3e5ff1e21cc13e2d51e7e535 # v1.233.0
        with:
          bundler-cache: true

@@ -110,10 +95,10 @@ jobs:

    steps:
      - name: Check out repo
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Configure Ruby
-        uses: ruby/setup-ruby@829114fc20da43a41d27359103ec7a63020954d4 # v1.255.0
+        uses: ruby/setup-ruby@ca041f971d66735f3e5ff1e21cc13e2d51e7e535 # v1.233.0
        with:
          bundler-cache: true

@@ -124,18 +109,9 @@ jobs:
          bundle install --jobs 4 --retry 3

      - name: Log in to Azure
-        uses: bitwarden/gh-actions/azure-login@main
+        uses: Azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1
        with:
-          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
-          client_id: ${{ secrets.AZURE_CLIENT_ID }}
-
-      - name: Get Azure Key Vault secrets
-        id: get-kv-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
-        with:
-          keyvault: gh-android
-          secrets: "BWA-AAB-KEYSTORE-STORE-PASSWORD,BWA-AAB-KEYSTORE-KEY-PASSWORD,BWA-APK-KEYSTORE-STORE-PASSWORD,BWA-APK-KEYSTORE-KEY-PASSWORD"
+          creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}

      - name: Retrieve secrets
        env:
@@ -179,9 +155,6 @@ jobs:
          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name authenticator_play_store-creds.json --file ${{ github.workspace }}/secrets/authenticator_play_store-creds.json --output none

-      - name: AZ Logout
-        uses: bitwarden/gh-actions/azure-logout@main
-
      - name: Verify Play Store credentials
        if: ${{ inputs.publish-to-play-store }}
        run: |
@@ -189,10 +162,10 @@ jobs:
          json_key:${{ github.workspace }}/secrets/authenticator_play_store-creds.json }}

      - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
+        uses: gradle/actions/wrapper-validation@06832c7b30a0129d7fb559bcc6e43d26f6374244 # v4.3.1

      - name: Cache Gradle files
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ~/.gradle/caches
@@ -202,7 +175,7 @@ jobs:
            ${{ runner.os }}-gradle-v2-

      - name: Cache build output
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ${{ github.workspace }}/build-cache
@@ -216,25 +189,16 @@ jobs:
          distribution: "temurin"
          java-version: ${{ env.JAVA_VERSION }}

-      - name: Update app CI Build info
-        run: |
-          ./scripts/update_app_ci_build_info.sh \
-          $GITHUB_REPOSITORY \
-          $GITHUB_REF_NAME \
-          $GITHUB_SHA \
-          $GITHUB_RUN_ID \
-          $GITHUB_RUN_ATTEMPT
-
      - name: Increment version
        run: |
          DEFAULT_VERSION_CODE=$GITHUB_RUN_NUMBER
          VERSION_CODE="${{ inputs.version-code || '$DEFAULT_VERSION_CODE' }}"
-          bundle exec fastlane setBuildVersionInfo \
+          bundle exec fastlane setAuthenticatorBuildVersionInfo \
          versionCode:$VERSION_CODE \
          versionName:${{ inputs.version-name || '' }}

-          regex='appVersionName = "([^"]+)"'
-          if [[ "$(cat gradle/libs.versions.toml)" =~ $regex ]]; then
+          regex='versionName = "([^"]+)"'
+          if [[ "$(cat authenticator/build.gradle.kts)" =~ $regex ]]; then
            VERSION_NAME="${BASH_REMATCH[1]}"
          fi
          echo "Version Name: ${VERSION_NAME}" >> $GITHUB_STEP_SUMMARY
@@ -245,18 +209,18 @@ jobs:
        run: |
          bundle exec fastlane bundleAuthenticatorRelease \
          storeFile:${{ github.workspace }}/keystores/authenticator_aab-keystore.jks \
-          storePassword:'${{ steps.get-kv-secrets.outputs.BWA-AAB-KEYSTORE-STORE-PASSWORD }}' \
+          storePassword:'${{ secrets.BWA_AAB_KEYSTORE_STORE_PASSWORD }}' \
          keyAlias:authenticatorupload \
-          keyPassword:'${{ steps.get-kv-secrets.outputs.BWA-AAB-KEYSTORE-KEY-PASSWORD }}'
+          keyPassword:'${{ secrets.BWA_AAB_KEYSTORE_KEY_PASSWORD }}'

      - name: Generate release Play Store APK
        if: ${{ matrix.variant == 'apk' }}
        run: |
          bundle exec fastlane buildAuthenticatorRelease \
          storeFile:${{ github.workspace }}/keystores/authenticator_apk-keystore.jks \
-          storePassword:'${{ steps.get-kv-secrets.outputs.BWA-APK-KEYSTORE-STORE-PASSWORD }}' \
+          storePassword:'${{ secrets.BWA_APK_KEYSTORE_STORE_PASSWORD }}' \
          keyAlias:bitwardenauthenticator \
-          keyPassword:'${{ steps.get-kv-secrets.outputs.BWA-APK-KEYSTORE-KEY-PASSWORD }}'
+          keyPassword:'${{ secrets.BWA_APK_KEYSTORE_KEY_PASSWORD }}'

      - name: Upload release Play Store .aab artifact
        if: ${{ matrix.variant == 'aab' }}
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -4,7 +4,6 @@ on:
  push:
    branches:
      - main
-      - release/**/*
  workflow_dispatch:
    inputs:
      version-name:
@@ -31,34 +30,20 @@ env:
  JAVA_VERSION: 17
  GITHUB_ACTION_RUN_URL: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"

-permissions:
-  contents: read
-  packages: read
-  id-token: write
-
 jobs:
  build:
    name: Build
    runs-on: ubuntu-24.04

    steps:
-      - name: Log inputs to job summary
-        run: |
-          echo "<details><summary>Job Inputs</summary>" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo '```json' >> $GITHUB_STEP_SUMMARY
-          echo '${{ toJson(inputs) }}' >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
-          echo "</details>" >> $GITHUB_STEP_SUMMARY
-
      - name: Check out repo
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
+        uses: gradle/actions/wrapper-validation@06832c7b30a0129d7fb559bcc6e43d26f6374244 # v4.3.1

      - name: Cache Gradle files
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ~/.gradle/caches
@@ -68,7 +53,7 @@ jobs:
            ${{ runner.os }}-gradle-v2-

      - name: Cache build output
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ${{ github.workspace }}/build-cache
@@ -83,7 +68,7 @@ jobs:
          java-version: ${{ env.JAVA_VERSION }}

      - name: Configure Ruby
-        uses: ruby/setup-ruby@829114fc20da43a41d27359103ec7a63020954d4 # v1.255.0
+        uses: ruby/setup-ruby@ca041f971d66735f3e5ff1e21cc13e2d51e7e535 # v1.233.0
        with:
          bundler-cache: true

@@ -118,10 +103,10 @@ jobs:
        artifact: ["apk", "aab"]
    steps:
      - name: Check out repo
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Configure Ruby
-        uses: ruby/setup-ruby@829114fc20da43a41d27359103ec7a63020954d4 # v1.255.0
+        uses: ruby/setup-ruby@ca041f971d66735f3e5ff1e21cc13e2d51e7e535 # v1.233.0
        with:
          bundler-cache: true

@@ -132,18 +117,9 @@ jobs:
          bundle install --jobs 4 --retry 3

      - name: Log in to Azure
-        uses: bitwarden/gh-actions/azure-login@main
+        uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
        with:
-          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
-          client_id: ${{ secrets.AZURE_CLIENT_ID }}
-
-      - name: Get Azure Key Vault secrets
-        id: get-kv-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
-        with:
-          keyvault: gh-android
-          secrets: "UPLOAD-KEYSTORE-PASSWORD,UPLOAD-BETA-KEYSTORE-PASSWORD,UPLOAD-BETA-KEY-PASSWORD,PLAY-KEYSTORE-PASSWORD,PLAY-BETA-KEYSTORE-PASSWORD,PLAY-BETA-KEY-PASSWORD"
+          creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}

      - name: Retrieve secrets
        env:
@@ -180,14 +156,11 @@ jobs:
          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name app_play_prod_firebase-creds.json --file ${{ github.workspace }}/secrets/app_play_prod_firebase-creds.json --output none

-      - name: Log out from Azure
-        uses: bitwarden/gh-actions/azure-logout@main
-
      - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
+        uses: gradle/actions/wrapper-validation@06832c7b30a0129d7fb559bcc6e43d26f6374244 # v4.3.1

      - name: Cache Gradle files
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ~/.gradle/caches
@@ -197,7 +170,7 @@ jobs:
            ${{ runner.os }}-gradle-v2-

      - name: Cache build output
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ${{ github.workspace }}/build-cache
@@ -222,7 +195,7 @@ jobs:

      - name: Increment version
        run: |
-          DEFAULT_VERSION_CODE=$((11000+GITHUB_RUN_NUMBER))
+          DEFAULT_VERSION_CODE=$((11000+$GITHUB_RUN_NUMBER))
          bundle exec fastlane setBuildVersionInfo \
          versionCode:${{ inputs.version-code || '$DEFAULT_VERSION_CODE' }} \
          versionName:${{ inputs.version-name }}
@@ -230,48 +203,48 @@ jobs:
      - name: Generate release Play Store bundle
        if: ${{ matrix.variant == 'prod' && matrix.artifact == 'aab' }}
        env:
-          UPLOAD-KEYSTORE-PASSWORD: ${{ steps.get-kv-secrets.outputs.UPLOAD-KEYSTORE-PASSWORD }}
+          UPLOAD_KEYSTORE_PASSWORD: ${{ secrets.UPLOAD_KEYSTORE_PASSWORD }}
        run: |
          bundle exec fastlane bundlePlayStoreRelease \
          storeFile:app_upload-keystore.jks \
-          storePassword:${{ env.UPLOAD-KEYSTORE-PASSWORD }} \
+          storePassword:${{ env.UPLOAD_KEYSTORE_PASSWORD }} \
          keyAlias:upload \
-          keyPassword:${{ env.UPLOAD-KEYSTORE-PASSWORD }}
+          keyPassword:${{ env.UPLOAD_KEYSTORE_PASSWORD }}

      - name: Generate beta Play Store bundle
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'aab') }}
        env:
-          UPLOAD-BETA-KEYSTORE-PASSWORD: ${{ steps.get-kv-secrets.outputs.UPLOAD-BETA-KEYSTORE-PASSWORD }}
-          UPLOAD-BETA-KEY-PASSWORD: ${{ steps.get-kv-secrets.outputs.UPLOAD-BETA-KEY-PASSWORD }}
+          UPLOAD_BETA_KEYSTORE_PASSWORD: ${{ secrets.UPLOAD_BETA_KEYSTORE_PASSWORD }}
+          UPLOAD_BETA_KEY_PASSWORD: ${{ secrets.UPLOAD_BETA_KEY_PASSWORD }}
        run: |
          bundle exec fastlane bundlePlayStoreBeta \
          storeFile:app_beta_upload-keystore.jks \
-          storePassword:${{ env.UPLOAD-BETA-KEYSTORE-PASSWORD }} \
+          storePassword:${{ env.UPLOAD_BETA_KEYSTORE_PASSWORD }} \
          keyAlias:bitwarden-beta-upload \
-          keyPassword:${{ env.UPLOAD-BETA-KEY-PASSWORD }}
+          keyPassword:${{ env.UPLOAD_BETA_KEY_PASSWORD }}

      - name: Generate release Play Store APK
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'apk') }}
        env:
-          PLAY-KEYSTORE-PASSWORD: ${{ steps.get-kv-secrets.outputs.PLAY-KEYSTORE-PASSWORD }}
+          PLAY_KEYSTORE_PASSWORD: ${{ secrets.PLAY_KEYSTORE_PASSWORD }}
        run: |
          bundle exec fastlane assemblePlayStoreReleaseApk \
          storeFile:app_play-keystore.jks \
-          storePassword:${{ env.PLAY-KEYSTORE-PASSWORD }} \
+          storePassword:${{ env.PLAY_KEYSTORE_PASSWORD }} \
          keyAlias:bitwarden \
-          keyPassword:${{ env.PLAY-KEYSTORE-PASSWORD }}
+          keyPassword:${{ env.PLAY_KEYSTORE_PASSWORD }}

      - name: Generate beta Play Store APK
        if: ${{ (matrix.variant == 'prod') && (matrix.artifact == 'apk') }}
        env:
-          PLAY-BETA-KEYSTORE-PASSWORD: ${{ steps.get-kv-secrets.outputs.PLAY-BETA-KEYSTORE-PASSWORD }}
-          PLAY-BETA-KEY-PASSWORD: ${{ steps.get-kv-secrets.outputs.PLAY-BETA-KEY-PASSWORD }}
+          PLAY_BETA_KEYSTORE_PASSWORD: ${{ secrets.PLAY_BETA_KEYSTORE_PASSWORD }}
+          PLAY_BETA_KEY_PASSWORD: ${{ secrets.PLAY_BETA_KEY_PASSWORD }}
        run: |
          bundle exec fastlane assemblePlayStoreBetaApk \
          storeFile:app_beta_play-keystore.jks \
-          storePassword:${{ env.PLAY-BETA-KEYSTORE-PASSWORD }} \
+          storePassword:${{ env.PLAY_BETA_KEYSTORE_PASSWORD }} \
          keyAlias:bitwarden-beta \
-          keyPassword:${{ env.PLAY-BETA-KEY-PASSWORD }}
+          keyPassword:${{ env.PLAY_BETA_KEY_PASSWORD }}

      - name: Generate debug Play Store APKs
        if: ${{ (matrix.variant != 'prod') && (matrix.artifact == 'apk') }}
@@ -429,10 +402,10 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Check out repo
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Configure Ruby
-        uses: ruby/setup-ruby@829114fc20da43a41d27359103ec7a63020954d4 # v1.255.0
+        uses: ruby/setup-ruby@ca041f971d66735f3e5ff1e21cc13e2d51e7e535 # v1.233.0
        with:
          bundler-cache: true

@@ -443,18 +416,9 @@ jobs:
          bundle install --jobs 4 --retry 3

      - name: Log in to Azure
-        uses: bitwarden/gh-actions/azure-login@main
+        uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
        with:
-          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
-          client_id: ${{ secrets.AZURE_CLIENT_ID }}
-
-      - name: Get Azure Key Vault secrets
-        id: get-kv-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
-        with:
-          keyvault: gh-android
-          secrets: "FDROID-KEYSTORE-PASSWORD,FDROID-BETA-KEYSTORE-PASSWORD,FDROID-BETA-KEY-PASSWORD"
+          creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}

      - name: Retrieve secrets
        env:
@@ -477,14 +441,11 @@ jobs:
          az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
          --name app_fdroid_firebase-creds.json --file ${{ github.workspace }}/secrets/app_fdroid_firebase-creds.json --output none

-      - name: Log out from Azure
-        uses: bitwarden/gh-actions/azure-logout@main
-
      - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
+        uses: gradle/actions/wrapper-validation@06832c7b30a0129d7fb559bcc6e43d26f6374244 # v4.3.1

      - name: Cache Gradle files
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ~/.gradle/caches
@@ -494,7 +455,7 @@ jobs:
            ${{ runner.os }}-gradle-v2-

      - name: Cache build output
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ${{ github.workspace }}/build-cache
@@ -520,21 +481,21 @@ jobs:
      # Start from 11000 to prevent collisions with mobile build version codes
      - name: Increment version
        run: |
-          DEFAULT_VERSION_CODE=$((11000+GITHUB_RUN_NUMBER))
+          DEFAULT_VERSION_CODE=$((11000+$GITHUB_RUN_NUMBER))
          VERSION_CODE="${{ inputs.version-code || '$DEFAULT_VERSION_CODE' }}"
          bundle exec fastlane setBuildVersionInfo \
          versionCode:$VERSION_CODE \
          versionName:${{ inputs.version-name || '' }}

-          regex='appVersionName = "([^"]+)"'
-          if [[ "$(cat gradle/libs.versions.toml)" =~ $regex ]]; then
+          regex='versionName = "([^"]+)"'
+          if [[ "$(cat app/build.gradle.kts)" =~ $regex ]]; then
            VERSION_NAME="${BASH_REMATCH[1]}"
          fi
          echo "Version Name: ${VERSION_NAME}" >> $GITHUB_STEP_SUMMARY
          echo "Version Number: $VERSION_CODE" >> $GITHUB_STEP_SUMMARY
      - name: Generate F-Droid artifacts
        env:
-          FDROID_STORE_PASSWORD: ${{ steps.get-kv-secrets.outputs.FDROID-KEYSTORE-PASSWORD }}
+          FDROID_STORE_PASSWORD: ${{ secrets.FDROID_KEYSTORE_PASSWORD }}
        run: |
          bundle exec fastlane assembleFDroidReleaseApk \
          storeFile:app_fdroid-keystore.jks \
@@ -544,14 +505,14 @@ jobs:

      - name: Generate F-Droid Beta Artifacts
        env:
-          FDROID-BETA-KEYSTORE-PASSWORD: ${{ steps.get-kv-secrets.outputs.FDROID-BETA-KEYSTORE-PASSWORD }}
-          FDROID-BETA-KEY-PASSWORD: ${{ steps.get-kv-secrets.outputs.FDROID-BETA-KEY-PASSWORD }}
+          FDROID_BETA_KEYSTORE_PASSWORD: ${{ secrets.FDROID_BETA_KEYSTORE_PASSWORD }}
+          FDROID_BETA_KEY_PASSWORD: ${{ secrets.FDROID_BETA_KEY_PASSWORD }}
        run: |
          bundle exec fastlane assembleFDroidBetaApk \
          storeFile:app_beta_fdroid-keystore.jks \
-          storePassword:"${{ env.FDROID-BETA-KEYSTORE-PASSWORD }}" \
+          storePassword:"${{ env.FDROID_BETA_KEYSTORE_PASSWORD }}" \
          keyAlias:bitwarden-beta \
-          keyPassword:"${{ env.FDROID-BETA-KEY-PASSWORD }}"
+          keyPassword:"${{ env.FDROID_BETA_KEY_PASSWORD }}"

      - name: Upload F-Droid .apk artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
--- a/.github/workflows/cron-sync-google-priviledged-browsers.yml
+++ b/.github/workflows/cron-sync-google-priviledged-browsers.yml
@@ -21,7 +21,7 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2

      - name: Download Google Privileged Browsers List
        run: curl -s $SOURCE_URL -o $GOOGLE_FILE
--- a/.github/workflows/crowdin-pull-authenticator.yml
+++ b/.github/workflows/crowdin-pull-authenticator.yml
@@ -0,0 +1,56 @@
+name: Crowdin Sync - Authenticator
+
+on:
+  workflow_dispatch:
+    inputs: {}
+  schedule:
+    - cron: '0 0 * * 5'
+
+jobs:
+  crowdin-sync:
+    name: Autosync
+    runs-on: ubuntu-24.04
+    env:
+      _CROWDIN_PROJECT_ID: "673718"
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Log in to Azure - CI Subscription
+        uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
+        with:
+          creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
+
+      - name: Retrieve secrets
+        id: retrieve-secrets
+        uses: bitwarden/gh-actions/get-keyvault-secrets@main
+        with:
+          keyvault: "bitwarden-ci"
+          secrets: "github-gpg-private-key, github-gpg-private-key-passphrase"
+
+      - name: Generate GH App token
+        uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
+        id: app-token
+        with:
+          app-id: ${{ secrets.BW_GHAPP_ID }}
+          private-key: ${{ secrets.BW_GHAPP_KEY }}
+
+      - name: Download translations
+        uses: crowdin/github-action@b8012bd5491b8aa8578b73ab5b5f5e7c94aaa6e2 # v2.7.0
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+          CROWDIN_API_TOKEN: ${{ secrets.CROWDIN_API_TOKEN }}
+        with:
+          config: crowdin-bwa.yml
+          upload_sources: false
+          upload_translations: false
+          download_translations: true
+          github_user_name: "bitwarden-devops-bot"
+          github_user_email: "106330231+bitwarden-devops-bot@users.noreply.github.com"
+          commit_message: "Autosync the updated translations"
+          localization_branch_name: crowdin-auto-sync
+          create_pull_request: true
+          pull_request_title: "Autosync Crowdin Translations"
+          pull_request_body: "Autosync the updated translations"
+          gpg_private_key: ${{ steps.retrieve-secrets.outputs.github-gpg-private-key }}
+          gpg_passphrase: ${{ steps.retrieve-secrets.outputs.github-gpg-private-key-passphrase }}
--- a/.github/workflows/crowdin-pull.yml
+++ b/.github/workflows/crowdin-pull.yml
@@ -1,36 +1,25 @@
-name: Cron / Crowdin Pull
-run-name: Crowdin Pull - ${{ github.event_name == 'workflow_dispatch' && 'Manual' || 'Scheduled' }}
+name: Crowdin Sync

 on:
  workflow_dispatch:
+    inputs: {}
  schedule:
    - cron: '0 0 * * 5'

 jobs:
  crowdin-sync:
-    name: Crowdin Pull - ${{ github.event_name }}
+    name: Autosync
    runs-on: ubuntu-24.04
-    permissions:
-      contents: write
-      pull-requests: write
-      id-token: write
+    env:
+      _CROWDIN_PROJECT_ID: "269690"
    steps:
      - name: Checkout repo
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

-      - name: Log in to Azure
-        uses: bitwarden/gh-actions/azure-login@main
+      - name: Login to Azure - CI Subscription
+        uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
        with:
-          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
-          client_id: ${{ secrets.AZURE_CLIENT_ID }}
-
-      - name: Get Azure Key Vault secrets
-        id: get-kv-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
-        with:
-          keyvault: gh-org-bitwarden
-          secrets: "BW-GHAPP-ID,BW-GHAPP-KEY"
+          creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}

      - name: Retrieve secrets
        id: retrieve-secrets
@@ -39,22 +28,18 @@ jobs:
          keyvault: "bitwarden-ci"
          secrets: "crowdin-api-token, github-gpg-private-key, github-gpg-private-key-passphrase"

-      - name: Log out from Azure
-        uses: bitwarden/gh-actions/azure-logout@main
-
      - name: Generate GH App token
-        uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1
+        uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
        id: app-token
        with:
-          app-id: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-ID }}
-          private-key: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-KEY }}
+          app-id: ${{ secrets.BW_GHAPP_ID }}
+          private-key: ${{ secrets.BW_GHAPP_KEY }}

      - name: Download translations
-        uses: crowdin/github-action@590c05e09a29f392b203faf4d6aa8e0cd32c7835 # v2.9.1
+        uses: crowdin/github-action@b8012bd5491b8aa8578b73ab5b5f5e7c94aaa6e2 # v2.7.0
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          CROWDIN_API_TOKEN: ${{ steps.retrieve-secrets.outputs.crowdin-api-token }}
-          _CROWDIN_PROJECT_ID: "269690"
        with:
          config: crowdin.yml
          upload_sources: false
@@ -62,10 +47,10 @@ jobs:
          download_translations: true
          github_user_name: "bitwarden-devops-bot"
          github_user_email: "106330231+bitwarden-devops-bot@users.noreply.github.com"
-          commit_message: "Crowdin Pull"
-          localization_branch_name: "crowdin-pull"
+          commit_message: "Autosync the updated translations"
+          localization_branch_name: crowdin-auto-sync
          create_pull_request: true
-          pull_request_title: "Crowdin Pull"
-          pull_request_body: ":inbox_tray: New translations received!"
+          pull_request_title: "Autosync Crowdin Translations"
+          pull_request_body: "Autosync the updated translations"
          gpg_private_key: ${{ steps.retrieve-secrets.outputs.github-gpg-private-key }}
          gpg_passphrase: ${{ steps.retrieve-secrets.outputs.github-gpg-private-key-passphrase }}
--- a/.github/workflows/crowdin-push-authenticator.yml
+++ b/.github/workflows/crowdin-push-authenticator.yml
@@ -0,0 +1,30 @@
+name: Crowdin Push - Authenticator
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - "main"
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  JAVA_VERSION: 17
+
+jobs:
+  crowdin-push:
+    name: Crowdin Push
+    runs-on: ubuntu-24.04
+    env:
+      _CROWDIN_PROJECT_ID: "673718"
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Upload sources
+        uses: crowdin/github-action@b8012bd5491b8aa8578b73ab5b5f5e7c94aaa6e2 # v2.7.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CROWDIN_API_TOKEN: ${{ secrets.CROWDIN_API_TOKEN }}
+        with:
+          config: crowdin-bwa.yml
+          upload_sources: true
+          upload_translations: false
--- a/.github/workflows/crowdin-push.yml
+++ b/.github/workflows/crowdin-push.yml
@@ -1,29 +1,25 @@
-name: CI / Crowdin Push
-run-name: Crowdin Push - ${{ github.event_name == 'workflow_dispatch' && 'Manual' || 'CI' }}
+name: Crowdin Push

 on:
  workflow_dispatch:
  push:
    branches:
-      - main
+      - "main"

 jobs:
  crowdin-push:
-    name: Crowdin Push - ${{ github.event_name }}
+    name: Crowdin Push
    runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-      id-token: write
+    env:
+      _CROWDIN_PROJECT_ID: "269690"
    steps:
      - name: Check out repo
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Log in to Azure
-        uses: bitwarden/gh-actions/azure-login@main
+        uses: Azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1
        with:
-          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
-          client_id: ${{ secrets.AZURE_CLIENT_ID }}
+          creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}

      - name: Retrieve secrets
        id: retrieve-secrets
@@ -33,15 +29,11 @@ jobs:
          secrets: "crowdin-api-token"

      - name: Upload sources
-        uses: crowdin/github-action@590c05e09a29f392b203faf4d6aa8e0cd32c7835 # v2.9.1
+        uses: crowdin/github-action@b8012bd5491b8aa8578b73ab5b5f5e7c94aaa6e2 # v2.7.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CROWDIN_API_TOKEN: ${{ steps.retrieve-secrets.outputs.crowdin-api-token }}
-          _CROWDIN_PROJECT_ID: "269690"
        with:
          config: crowdin.yml
          upload_sources: true
          upload_translations: false
-
-      - name: Log out from Azure
-        uses: bitwarden/gh-actions/azure-logout@main
--- a/.github/workflows/github-release.yml
+++ b/.github/workflows/github-release.yml
@@ -3,116 +3,82 @@ name: Create GitHub Release
 on:
  workflow_dispatch:
    inputs:
+      version-name:
+        description: 'Version Name - E.g. "2024.11.1"'
+        required: true
+        type: string
+      version-number:
+        description: 'Version Number - E.g. "123456"'
+        required: true
+        type: string
      artifact-run-id:
        description: 'GitHub Action Run ID containing artifacts'
        required: true
        type: string
-      release-ticket-id:
-        description: 'Release Ticket ID - e.g. RELEASE-1762'
-        required: true
-        type: string
-
+      draft:
+        description: 'Create as draft release'
+        type: boolean
+        default: true
+      prerelease:
+        description: 'Mark as pre-release'
+        type: boolean
+        default: true
+      make-latest:
+        description: 'Set as the latest release'
+        type: boolean
+      branch-protection-type:
+        description: 'Branch protection type'
+        type: choice
+        options:
+          - Branch Name
+          - GitHub API
+        default: Branch Name
 env:
    ARTIFACTS_PATH: artifacts
-
 jobs:
  create-release:
    name: Create GitHub Release
    runs-on: ubuntu-24.04
    permissions:
      contents: write
-      id-token: write
+      actions: read

    steps:
      - name: Check out repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

-      - name: Log inputs to job summary
-        uses: ./.github/actions/log-inputs
-        with:
-          inputs: ${{ toJson(inputs) }}
-
      - name: Get branch from workflow run
        id: get_release_branch
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ARTIFACT_RUN_ID: ${{ inputs.artifact-run-id }}
+          BRANCH_PROTECTION_TYPE: ${{ inputs.branch-protection-type }}
        run: |
-          workflow_data=$(gh run view $ARTIFACT_RUN_ID --json headBranch,workflowName)
-          release_branch=$(echo "$workflow_data" | jq -r .headBranch)
-          workflow_name=$(echo "$workflow_data" | jq -r .workflowName)
+          release_branch=$(gh run view $ARTIFACT_RUN_ID --json headBranch -q .headBranch)

-          # branch protection check
-          if [[ "$release_branch" != "main" && ! "$release_branch" =~ ^release/ ]]; then
-            echo "::error::Branch '$release_branch' is not 'main' or a release branch starting with 'release/'. Releases must be created from protected branches."
-            exit 1
-          fi
-
-          echo "🔖 Release branch: $release_branch"
-          echo "🔖 Workflow name: $workflow_name"
-          echo "release_branch=$release_branch" >> $GITHUB_OUTPUT
-          echo "workflow_name=$workflow_name" >> $GITHUB_OUTPUT
-
-          case "$workflow_name" in
-            *"Password Manager"* | "Build")
-              app_name="Password Manager"
-              app_name_suffix="bwpm"
+          case "$BRANCH_PROTECTION_TYPE" in
+            "Branch Name")
+              if [[ "$release_branch" != "main" && ! "$release_branch" =~ ^release/ ]]; then
+                echo "::error::Branch '$release_branch' is not 'main' or a release branch starting with 'release/'. Releases must be created from protected branches."
+                exit 1
+              fi
              ;;
-            *"Authenticator"*)
-              app_name="Authenticator"
-              app_name_suffix="bwa"
+            "GitHub API")
+              #NOTE requires token with "administration:read" scope
+              if ! gh api "repos/${{ github.repository }}/branches/$release_branch/protection" | grep -q "required_status_checks"; then
+                echo "::error::Branch '$release_branch' is not protected. Releases must be created from protected branches. If that's not correct, confirm if the github token user has the 'administration:read' scope."
+                exit 1
+              fi
              ;;
            *)
-              echo "::error::Unknown workflow name: $workflow_name"
+              echo "::error::Unsupported branch protection type: $BRANCH_PROTECTION_TYPE"
              exit 1
              ;;
          esac
-          echo "🔖 App name: $app_name"
-          echo "🔖 App name suffix: $app_name_suffix"
-          echo "app_name=$app_name" >> $GITHUB_OUTPUT
-          echo "app_name_suffix=$app_name_suffix" >> $GITHUB_OUTPUT

-      - name: Get version info from run logs and set release tag name
-        id: get_release_info
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          ARTIFACT_RUN_ID: ${{ inputs.artifact-run-id }}
-          _APP_NAME_SUFFIX: ${{ steps.get_release_branch.outputs.app_name_suffix }}
-        run: |
-          workflow_log=$(gh run view $ARTIFACT_RUN_ID --log)
-
-          version_number_with_trailing_dot=$(grep -m 1 "Setting version code to" <<< "$workflow_log" | sed 's/.*Setting version code to //')
-          version_number=${version_number_with_trailing_dot%.} # remove trailing dot
-
-          version_name_with_trailing_dot=$(grep -m 1 "Setting version name to" <<< "$workflow_log" | sed 's/.*Setting version name to //')
-          version_name=${version_name_with_trailing_dot%.} # remove trailing dot
-
-          if [[ -z "$version_name" ]]; then
-            echo "::warning::Version name not found. Using default value - 0.0.0"
-            version_name="0.0.0"
-          else
-            echo "✅ Found version name: $version_name"
-          fi
-
-          if [[ -z "$version_number" ]]; then
-            echo "::warning::Version number not found. Using default value - 0"
-            version_number="0"
-          else
-            echo "✅ Found version number: $version_number"
-          fi
-
-          echo "version_number=$version_number" >> $GITHUB_OUTPUT
-          echo "version_name=$version_name" >> $GITHUB_OUTPUT
-
-          tag_name="v$version_name-$_APP_NAME_SUFFIX" # e.g. v2025.6.0-bwpm
-          echo "🔖 New tag name: $tag_name"
-          echo "tag_name=$tag_name" >> $GITHUB_OUTPUT
-
-          last_release_tag=$(git tag -l --sort=-authordate | grep "$_APP_NAME_SUFFIX" | head -n 1)
-          echo "🔖 Last release tag: $last_release_tag"
-          echo "last_release_tag=$last_release_tag" >> $GITHUB_OUTPUT
+          echo "release_branch=$release_branch" >> $GITHUB_OUTPUT

      - name: Download artifacts
        env:
@@ -127,156 +93,37 @@ jobs:
            find $ARTIFACTS_PATH -type f
          fi

-          # Files that won't be included in any release
-          files_to_remove=(
-            "com.x8bit.bitwarden.aab"
-            "com.x8bit.bitwarden.aab-sha256.txt"
-
-            "com.x8bit.bitwarden.beta.apk"
-            "com.x8bit.bitwarden.beta.apk-sha256.txt"
-            "com.x8bit.bitwarden.beta.aab"
-            "com.x8bit.bitwarden.beta.aab-sha256.txt"
-
-            "com.x8bit.bitwarden.beta-fdroid.apk"
-            "com.x8bit.bitwarden.beta-fdroid.apk-sha256.txt"
-
-            "com.x8bit.bitwarden.dev.apk"
-            "com.x8bit.bitwarden.dev.apk-sha256.txt"
-
-            "com.bitwarden.authenticator.aab"
-            "authenticator-android-aab-sha256.txt"
-          )
-
-          for file in "${files_to_remove[@]}"; do
-            find $ARTIFACTS_PATH -name "$file" -type f -delete
-          done
-          echo "🔖 Removed internal artifacts."
-          echo ""
-          echo "🔖 Files to be included in the release:"
-          find $ARTIFACTS_PATH -type f
-
-      - name: Log in to Azure
-        uses: bitwarden/gh-actions/azure-login@main
-        with:
-          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
-          client_id: ${{ secrets.AZURE_CLIENT_ID }}
-
-      - name: Get Azure Key Vault secrets
-        id: get-kv-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
-        with:
-          keyvault: gh-android
-          secrets: "JIRA-API-EMAIL,JIRA-API-TOKEN"
-
-      - name: Log out from Azure
-        uses: bitwarden/gh-actions/azure-logout@main
-
-      - name: Get product release notes
-        id: get_release_notes
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          ARTIFACT_RUN_ID: ${{ inputs.artifact-run-id }}
-          _VERSION_NAME: ${{ steps.get_release_info.outputs.version_name }}
-          _RELEASE_TICKET_ID: ${{ inputs.release-ticket-id }}
-          _JIRA_API_EMAIL: ${{ steps.get-kv-secrets.outputs.JIRA-API-EMAIL }}
-          _JIRA_API_TOKEN: ${{ steps.get-kv-secrets.outputs.JIRA-API-TOKEN }}
-        run: |
-          echo "Getting product release notes"
-          product_release_notes=$(python3 .github/scripts/jira-get-release-notes/jira_release_notes.py $_RELEASE_TICKET_ID $_JIRA_API_EMAIL $_JIRA_API_TOKEN)
-
-          if [[ -z "$product_release_notes" || $product_release_notes == "Error checking"* ]]; then
-            echo "::warning::Failed to fetch release notes from Jira. Output: $product_release_notes"
-            product_release_notes="<insert product release notes here>"
-          else
-            echo "✅ Product release notes:"
-            echo "$product_release_notes"
-          fi
-
-          echo "$product_release_notes" > product_release_notes.txt
-
      - name: Create Release
        id: create_release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          _APP_NAME: ${{ steps.get_release_branch.outputs.app_name }}
-          _VERSION_NAME: ${{ steps.get_release_info.outputs.version_name }}
-          _VERSION_NUMBER: ${{ steps.get_release_info.outputs.version_number }}
-          _TARGET_COMMIT: ${{ steps.get_release_branch.outputs.release_branch }}
-          _TAG_NAME: ${{ steps.get_release_info.outputs.tag_name }}
-          _LAST_RELEASE_TAG: ${{ steps.get_release_info.outputs.last_release_tag }}
-        run: |
-          is_latest_release=false
-          if [[ "$_APP_NAME" == "Password Manager" ]]; then
-            is_latest_release=true
-          fi
-
-          echo "⌛️ Creating release for $_APP_NAME $_VERSION_NAME ($_VERSION_NUMBER) on $_TARGET_COMMIT"
-          release_url=$(gh release create "$_TAG_NAME" \
-            --title "$_APP_NAME $_VERSION_NAME ($_VERSION_NUMBER)" \
-            --target "$_TARGET_COMMIT" \
-            --generate-notes \
-            --notes-start-tag "$_LAST_RELEASE_TAG" \
-            --latest=$is_latest_release \
-            --draft \
-            $ARTIFACTS_PATH/*/*)
-
-          # Extract release tag from URL
-          release_id_from_url=$(echo "$release_url" | sed 's/.*\/tag\///')
-          echo "release_id_from_url=$release_id_from_url" >> $GITHUB_OUTPUT
-          echo "url=$release_url" >> $GITHUB_OUTPUT
-
-          echo "✅ Release created: $release_url"
-          echo "🔖 Release ID from URL: $release_id_from_url"
+        uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2.2.2
+        with:
+          tag_name: "v${{ inputs.version-name }}"
+          name: "${{ inputs.version-name }} (${{ inputs.version-number }})"
+          prerelease: ${{ inputs.prerelease }}
+          draft: ${{ inputs.draft }}
+          make_latest: ${{ inputs.make-latest }}
+          target_commitish: ${{ steps.get_release_branch.outputs.release_branch }}
+          generate_release_notes: true
+          files: |
+            artifacts/**/*

      - name: Update Release Description
-        id: update_release_description
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_ID: ${{ steps.create_release.outputs.id }}
+          RELEASE_URL: ${{ steps.create_release.outputs.url }}
          ARTIFACT_RUN_ID: ${{ inputs.artifact-run-id }}
-          _VERSION_NAME: ${{ steps.get_release_info.outputs.version_name }}
-          _RELEASE_ID: ${{ steps.create_release.outputs.release_id_from_url }}
        run: |
-          echo "Getting current release body. Release ID: $_RELEASE_ID"
-          current_body=$(gh release view "$_RELEASE_ID" --json body --jq .body)
+          # Get current release body
+          current_body=$(gh api /repos/${{ github.repository }}/releases/$RELEASE_ID --jq .body)

-          product_release_notes=$(cat product_release_notes.txt)
-
-          # Update release description with product release notes and builds source
-          updated_body="# Overview
-          ${product_release_notes}
-
-          ${current_body}
+          # Append build source to the end
+          updated_body="${current_body}
          **Builds Source:** https://github.com/${{ github.repository }}/actions/runs/$ARTIFACT_RUN_ID"

-          new_release_url=$(gh release edit "$_RELEASE_ID" --notes "$updated_body")
+          # Update release
+          gh api --method PATCH /repos/${{ github.repository }}/releases/$RELEASE_ID \
+            -f body="$updated_body"

-          # draft release links change after editing
-          echo "release_url=$new_release_url" >> $GITHUB_OUTPUT
-
-      - name: Add Release Summary
-        env:
-          _RELEASE_TAG: ${{ steps.get_release_info.outputs.tag_name }}
-          _LAST_RELEASE_TAG: ${{ steps.get_release_info.outputs.last_release_tag }}
-          _VERSION_NAME: ${{ steps.get_release_info.outputs.version_name }}
-          _VERSION_NUMBER: ${{ steps.get_release_info.outputs.version_number }}
-          _RELEASE_BRANCH: ${{ steps.get_release_branch.outputs.release_branch }}
-          _RELEASE_URL: ${{ steps.update_release_description.outputs.release_url }}
-        run: |
-          echo "# :fish_cake: Release ready at:" >> $GITHUB_STEP_SUMMARY
-          echo "$_RELEASE_URL" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-          if [[ "$_VERSION_NAME" == "0.0.0" || "$_VERSION_NUMBER" == "0" ]]; then
-            echo "> [!CAUTION]" >> $GITHUB_STEP_SUMMARY
-            echo "> Version name or number wasn't previously found and a default value was used. You'll need to manually update the release Title, Tag and Description, specifically, the "Full Changelog" link." >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          echo ":clipboard: Confirm that the defined GitHub Release options are correct:"  >> $GITHUB_STEP_SUMMARY
-          echo " * :bookmark: New tag name: \`$_RELEASE_TAG\`" >> $GITHUB_STEP_SUMMARY
-          echo " * :palm_tree: Target branch: \`$_RELEASE_BRANCH\`" >> $GITHUB_STEP_SUMMARY
-          echo " * :ocean: Previous tag set in the description \"Full Changelog\" link: \`$_LAST_RELEASE_TAG\`" >> $GITHUB_STEP_SUMMARY
-          echo " * :white_check_mark: Description has automated release notes and they match the commits in the release branch" >> $GITHUB_STEP_SUMMARY
-          echo "> [!NOTE]" >> $GITHUB_STEP_SUMMARY
-          echo "> Commits directly pushed to branches without a Pull Request won't appear in the automated release notes." >> $GITHUB_STEP_SUMMARY
+          echo "# :rocket: Release ready at:" >> $GITHUB_STEP_SUMMARY
+          echo "$RELEASE_URL" >> $GITHUB_STEP_SUMMARY
--- a/.github/workflows/publish-github-release.yml
+++ b/.github/workflows/publish-github-release.yml
@@ -1,36 +0,0 @@
-name: Publish Password Manager and Authenticator GitHub Release as newest
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 3 * * 1-5'
-
-permissions:
-  contents: write
-  id-token: write
-  actions: read
-
-jobs:
-  publish-release-password-manager:
-    name: Publish Password Manager Release
-    uses: bitwarden/gh-actions/.github/workflows/_publish-mobile-github-release.yml@main
-    with:
-      release_name: "Password Manager"
-      workflow_name: "publish-github-release.yml"
-      credentials_filename: "play_creds.json"
-      project_type: android
-      check_release_command: >
-        bundle exec fastlane getLatestPlayStoreVersion package_name:com.x8bit.bitwarden track:production
-    secrets: inherit
-
-  publish-release-authenticator:
-    name: Publish Authenticator Release
-    uses: bitwarden/gh-actions/.github/workflows/_publish-mobile-github-release.yml@main
-    with:
-      release_name: "Authenticator"
-      workflow_name: "publish-github-release.yml"
-      credentials_filename: "authenticator_play_store-creds.json"
-      project_type: android
-      check_release_command: >
-        bundle exec fastlane getLatestPlayStoreVersion package_name:com.bitwarden.authenticator track:production
-    secrets: inherit
--- a/.github/workflows/publish-store.yml
+++ b/.github/workflows/publish-store.yml
@@ -1,160 +0,0 @@
-name: Publish to Google Play
-run-name: "Promoting ${{ inputs.product }} ${{ inputs.version-code }} from ${{ inputs.track-from }} to ${{ inputs.track-target }}"
-on:
-  workflow_dispatch:
-    inputs:
-      product:
-        description: "Which app is being released."
-        type: choice
-        options:
-          - Password Manager
-          - Authenticator
-      version-name:
-        description: "Version name to promote to production ex 2025.1.1"
-        type: string
-      version-code:
-        description: "Build number to promote to production."
-        required: true
-        type: string
-      rollout-percentage:
-          description: "Percentage of users who will receive this version update."
-          required: true
-          type: choice
-          options:
-            - 10%
-            - 30%
-            - 50%
-            - 100%
-          default: 10%
-      release-notes:
-        description: "Change notes to be included with this release."
-        type: string
-        default: "Bug fixes."
-        required: true
-      track-from:
-        description: "Track to promote from."
-        type: choice
-        options:
-          - internal
-          - Fastlane Automation Source
-        required: true
-        default: "internal"
-      track-target:
-        description: "Track to promote to."
-        type: choice
-        options:
-          - production
-          - Fastlane Automation Target
-        required: true
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GITHUB_ACTION_RUN_URL: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-
-permissions:
-  contents: read
-  packages: read
-  id-token: write
-
-jobs:
-    promote:
-      runs-on: ubuntu-24.04
-      name: Promote build to Production in Play Store
-
-      steps:
-        - name: Log inputs to job summary
-          run: |
-            echo "<details><summary>Job Inputs</summary>" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo '```json' >> $GITHUB_STEP_SUMMARY
-            echo '${{ toJson(inputs) }}' >> $GITHUB_STEP_SUMMARY
-            echo '```' >> $GITHUB_STEP_SUMMARY
-            echo "</details>" >> $GITHUB_STEP_SUMMARY
-
-        - name: Check out repo
-          uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-
-        - name: Configure Ruby
-          uses: ruby/setup-ruby@829114fc20da43a41d27359103ec7a63020954d4 # v1.255.0
-          with:
-            bundler-cache: true
-
-        - name: Install Fastlane
-          run: |
-            gem install bundler:2.2.27
-            bundle config path vendor/bundle
-            bundle install --jobs 4 --retry 3
-
-        - name: Log in to Azure
-          uses: bitwarden/gh-actions/azure-login@main
-          with:
-            subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-            tenant_id: ${{ secrets.AZURE_TENANT_ID }}
-            client_id: ${{ secrets.AZURE_CLIENT_ID }}
-
-        - name: Get Azure Key Vault secrets
-          id: get-kv-secrets
-          uses: bitwarden/gh-actions/get-keyvault-secrets@main
-          with:
-            keyvault: gh-android
-            secrets: "PLAY-BETA-KEYSTORE-PASSWORD,PLAY-BETA-KEY-PASSWORD"
-
-        - name: Retrieve secrets
-          env:
-            ACCOUNT_NAME: bitwardenci
-            CONTAINER_NAME: mobile
-          run: |
-            mkdir -p ${{ github.workspace }}/secrets
-            mkdir -p ${{ github.workspace }}/app/src/standardRelease
-
-            az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
-            --name play_creds.json --file ${{ github.workspace }}/secrets/play_creds.json --output none
-
-            az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
-            --name authenticator_play_store-creds.json --file ${{ github.workspace }}/secrets/authenticator_play_store-creds.json --output none
-
-        - name: Log out from Azure
-          uses: bitwarden/gh-actions/azure-logout@main
-
-        - name: Format Release Notes
-          run: |
-            FORMATTED_MESSAGE="$(echo "${{ inputs.release-notes }}" | sed 's/  /\n/g')"
-            echo "RELEASE_NOTES<<EOF" >> $GITHUB_ENV
-            echo "$FORMATTED_MESSAGE" >> $GITHUB_ENV
-            echo "EOF" >> $GITHUB_ENV
-        - name: Promote Play Store version to production
-          env:
-            PLAY_KEYSTORE_PASSWORD: ${{ steps.get-kv-secrets.outputs.PLAY-BETA-KEYSTORE-PASSWORD }}
-            PLAY_KEY_PASSWORD: ${{ steps.get-kv-secrets.outputs.PLAY-BETA-KEY-PASSWORD }}
-            VERSION_CODE_INPUT: ${{ inputs.version-code }}
-            VERSION_NAME: ${{inputs.version-name}}
-            ROLLOUT_PERCENTAGE: ${{ inputs.rollout-percentage }}
-            PRODUCT: ${{ inputs.product }}
-            TRACK_FROM: ${{ inputs.track-from }}
-            TRACK_TARGET: ${{ inputs.track-target }}
-          run: |
-            if [ "$PRODUCT" = "Password Manager" ]; then
-              PACKAGE_NAME="com.x8bit.bitwarden"
-            elif [ "$PRODUCT" = "Authenticator" ]; then
-              PACKAGE_NAME="com.bitwarden.authenticator"
-            else
-              echo "Unsupported product: $PRODUCT"
-              exit 1
-            fi
-
-            VERSION_CODE=$(echo "${VERSION_CODE_INPUT}" | tr -d ',')
-
-            decimal=$(echo "scale=2; ${ROLLOUT_PERCENTAGE/\%/} / 100" | bc)
-
-            bundle exec fastlane updateReleaseNotes \
-              releaseNotes:"$RELEASE_NOTES" \
-              versionCode:"$VERSION_CODE" \
-              packageName:"$PACKAGE_NAME"
-
-            bundle exec fastlane promoteToProduction \
-              versionCode:"$VERSION_CODE" \
-              versionName:"$VERSION_NAME" \
-              rolloutPercentage:"$decimal" \
-              packageName:"$PACKAGE_NAME" \
-              releaseNotes:"$RELEASE_NOTES" \
-              track:"$TRACK_FROM" \
-              trackPromoteTo:"$TRACK_TARGET"
--- a/.github/workflows/release-branch.yml
+++ b/.github/workflows/release-branch.yml
@@ -9,9 +9,7 @@ on:
        type: choice
        options:
          - RC
-          - Hotfix Password Manager
-          - Hotfix Authenticator
-          - Test
+          - Hotfix

 jobs:
  create-release-branch:
@@ -19,54 +17,38 @@ jobs:
    runs-on: ubuntu-24.04
    permissions:
      contents: write
-      actions: write
    steps:
      - name: Check out repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

-      - name: Create RC or Test Branch
-        id: rc_branch
-        if: inputs.release_type == 'RC' || inputs.release_type == 'Test'
+      - name: Create RC Branch
+        if: inputs.release_type == 'RC'
        env:
-          _TEST_MODE: ${{ inputs.release_type == 'Test' }}
-          _RELEASE_TYPE: ${{ inputs.release_type }}
+          RC_PREFIX_DATE: "true" # replace with input if needed
        run: |
-          current_date=$(date +'%Y.%-m')
-          branch_name="${current_date}-rc${{ github.run_number }}"
-
-          if [ "$_TEST_MODE" = "true" ]; then
-            branch_name="WORKFLOW-TEST-${branch_name}"
+          if [ "$RC_PREFIX_DATE" = "true" ]; then
+            current_date=$(date +'%Y.%m')
+            branch_name="release/${current_date}-rc${{ github.run_number }}"
+          else
+            branch_name="release/rc${{ github.run_number }}"
          fi
-          branch_name="release/${branch_name}"
-
          git switch main
          git switch -c $branch_name
          git push origin $branch_name
-          echo "# :cherry_blossom: ${_RELEASE_TYPE} branch: ${branch_name}" >> $GITHUB_STEP_SUMMARY
-          echo "branch_name=$branch_name" >> $GITHUB_OUTPUT
+          echo "# :cherry_blossom: RC branch: ${branch_name}" >> $GITHUB_STEP_SUMMARY

      - name: Create Hotfix Branch
-        id: hotfix_branch
-        if: startsWith(inputs.release_type, 'Hotfix')
-        env:
-          _RELEASE_TYPE: ${{ inputs.release_type }}
+        if: inputs.release_type == 'Hotfix'
        run: |
-          app_codename="bwpm"
-          if [ "$_RELEASE_TYPE" == "Hotfix Authenticator" ]; then
-            app_codename="bwa"
-          fi
-          echo "🌿 app codename: $app_codename"
-
-          latest_tag=$(git tag -l --sort=-creatordate | grep "$app_codename" | head -n 1)
+          latest_tag=$(git tag -l --sort=-creatordate | head -n 1)
          if [ -z "$latest_tag" ]; then
            echo "::error::No tags found in the repository"
            exit 1
          fi
          branch_name="release/hotfix-${latest_tag}"
          echo "🌿 branch name: $branch_name"
-          echo "branch_name=$branch_name" >> $GITHUB_OUTPUT
          if git show-ref --verify --quiet "refs/remotes/origin/$branch_name"; then
            echo "# :fire: :warning: Hotfix branch already exists: ${branch_name}" >> $GITHUB_STEP_SUMMARY
            exit 0
@@ -74,12 +56,3 @@ jobs:
          git switch -c $branch_name $latest_tag
          git push origin $branch_name
          echo "# :fire: Hotfix branch: ${branch_name}" >> $GITHUB_STEP_SUMMARY
-
-      - name: Trigger CI Workflows
-        env:
-          GH_TOKEN: ${{ github.token }}
-          _BRANCH_NAME: ${{ steps.rc_branch.outputs.branch_name || steps.hotfix_branch.outputs.branch_name }}
-        run: |
-          echo "🌿 branch name: $_BRANCH_NAME"
-          gh workflow run build.yml --ref $_BRANCH_NAME -f distribute-to-firebase=true -f publish-to-play-store=true
-          gh workflow run build-authenticator.yml --ref $_BRANCH_NAME -f distribute-to-firebase=true -f publish-to-play-store=true
--- a/.github/workflows/scan-ci.yml
+++ b/.github/workflows/scan-ci.yml
@@ -6,30 +6,55 @@ on:
    branches:
      - "main"

-permissions: {}
-
 jobs:
  sast:
-    name: Checkmarx
-    uses: bitwarden/gh-actions/.github/workflows/_checkmarx.yml@main
-    secrets:
-      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+    name: SAST scan
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
-      pull-requests: write
      security-events: write
-      id-token: write
+
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: Scan with Checkmarx
+        uses: checkmarx/ast-github-action@ef93013c95adc60160bc22060875e90800d3ecfc # 2.3.19
+        with:
+          project_name: ${{ github.repository }}
+          cx_tenant: ${{ secrets.CHECKMARX_TENANT }}
+          base_uri: https://ast.checkmarx.net/
+          cx_client_id: ${{ secrets.CHECKMARX_CLIENT_ID }}
+          cx_client_secret: ${{ secrets.CHECKMARX_SECRET }}
+          additional_params: |
+            --report-format sarif \
+            --filter "state=TO_VERIFY;PROPOSED_NOT_EXPLOITABLE;CONFIRMED;URGENT" \
+            --output-path .
+
+      - name: Upload Checkmarx results to GitHub
+        uses: github/codeql-action/upload-sarif@45775bd8235c68ba998cffa5171334d58593da47 # v3.28.15
+        with:
+          sarif_file: cx_result.sarif

  quality:
-    name: Sonar
-    uses: bitwarden/gh-actions/.github/workflows/_sonar.yml@main
-    secrets:
-      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+    name: Quality scan
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
-      pull-requests: write
-      id-token: write
+
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: Scan with SonarCloud
+        uses: sonarsource/sonarqube-scan-action@aa494459d7c39c106cc77b166de8b4250a32bb97 # v5.1.0
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        with:
+          args: >
+            -Dsonar.organization=${{ github.repository_owner }}
+            -Dsonar.projectKey=${{ github.repository_owner }}_${{ github.event.repository.name }}
--- a/.github/workflows/scan.yml
+++ b/.github/workflows/scan.yml
@@ -11,38 +11,69 @@ on:
    branches:
      - main

-permissions: {}
-
 jobs:
  check-run:
    name: Check PR run
    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
-    permissions:
-      contents: read

  sast:
-    name: Checkmarx
-    uses: bitwarden/gh-actions/.github/workflows/_checkmarx.yml@main
+    name: SAST scan
+    runs-on: ubuntu-24.04
    needs: check-run
-    secrets:
-      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
    permissions:
      contents: read
      pull-requests: write
      security-events: write
-      id-token: write
+
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{  github.event.pull_request.head.sha }}
+
+      - name: Scan with Checkmarx
+        uses: checkmarx/ast-github-action@ef93013c95adc60160bc22060875e90800d3ecfc # 2.3.19
+        env:
+          INCREMENTAL: "${{ contains(github.event_name, 'pull_request') && '--sast-incremental' || '' }}"
+        with:
+          project_name: ${{ github.repository }}
+          cx_tenant: ${{ secrets.CHECKMARX_TENANT }}
+          base_uri: https://ast.checkmarx.net/
+          cx_client_id: ${{ secrets.CHECKMARX_CLIENT_ID }}
+          cx_client_secret: ${{ secrets.CHECKMARX_SECRET }}
+          additional_params: |
+            --report-format sarif \
+            --filter "state=TO_VERIFY;PROPOSED_NOT_EXPLOITABLE;CONFIRMED;URGENT" \
+            --output-path . ${{ env.INCREMENTAL }}
+
+      - name: Upload Checkmarx results to GitHub
+        uses: github/codeql-action/upload-sarif@45775bd8235c68ba998cffa5171334d58593da47 # v3.28.15
+        with:
+          sarif_file: cx_result.sarif
+          sha: ${{ contains(github.event_name, 'pull_request') && github.event.pull_request.head.sha || github.sha }}
+          ref: ${{ contains(github.event_name, 'pull_request') && format('refs/pull/{0}/head', github.event.pull_request.number) || github.ref }}

  quality:
-    name: Sonar
-    uses: bitwarden/gh-actions/.github/workflows/_sonar.yml@main
+    name: Quality scan
+    runs-on: ubuntu-24.04
    needs: check-run
-    secrets:
-      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
    permissions:
      contents: read
      pull-requests: write
-      id-token: write
+
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+          ref: ${{  github.event.pull_request.head.sha }}
+
+      - name: Scan with SonarCloud
+        uses: sonarsource/sonarqube-scan-action@aa494459d7c39c106cc77b166de8b4250a32bb97 # v5.1.0
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        with:
+          args: >
+            -Dsonar.organization=${{ github.repository_owner }}
+            -Dsonar.projectKey=${{ github.repository_owner }}_${{ github.event.repository.name }}
+            -Dsonar.pullrequest.key=${{ github.event.pull_request.number }}
--- a/.github/workflows/sdlc-sdk-update.yml
+++ b/.github/workflows/sdlc-sdk-update.yml
@@ -1,167 +0,0 @@
-name: SDLC / SDK Update
-run-name: "SDK ${{inputs.run-mode == 'Update' && format('Update - {0}', inputs.sdk-version) || format('Test #{0} - {1}', inputs.pr-id, inputs.sdk-version)}}"
-
-on:
-  workflow_dispatch:
-    inputs:
-      run-mode:
-        description: "Run Mode"
-        type: choice
-        options:
-          - Test # used for testing sdk-internal repo PRs
-          - Update # opens a PR in this repo updating the SDK
-        default: Test
-      sdk-package:
-        description: "SDK Package ID"
-        required: true
-        default: "com.bitwarden:sdk-android.dev"
-      sdk-version:
-        description: "SDK Version"
-        required: true
-        default: "1.0.0-2686-km-update-kdf-sdk"
-      pr-id:
-        description: "Pull Request ID"
-
-jobs:
-  update:
-    name: Update and PR
-    if: ${{ inputs.run-mode == 'Update' }}
-    runs-on: ubuntu-24.04
-    permissions:
-      id-token: write
-
-    steps:
-      - name: Log in to Azure
-        uses: bitwarden/gh-actions/azure-login@main
-        with:
-          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
-          client_id: ${{ secrets.AZURE_CLIENT_ID }}
-
-      - name: Get Azure Key Vault secrets
-        id: get-kv-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
-        with:
-          keyvault: gh-org-bitwarden
-          secrets: "BW-GHAPP-ID,BW-GHAPP-KEY"
-
-      - name: Log out from Azure
-        uses: bitwarden/gh-actions/azure-logout@main
-
-      - name: Generate GH App token
-        uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1
-        id: app-token
-        with:
-          app-id: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-ID }}
-          private-key: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-KEY }}
-
-      - name: Check out repo
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          token: ${{ steps.app-token.outputs.token }}
-
-      - name: Log inputs to job summary
-        uses: ./.github/actions/log-inputs
-        with:
-          inputs: ${{ toJson(inputs) }}
-
-      - name: Switch to branch
-        id: switch-branch
-        run: |
-          BRANCH_NAME="sdlc/sdk-update"
-          echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT
-          git switch -c $BRANCH_NAME
-
-      - name: Get current SDK version
-        id: get-current-sdk
-        run: |
-          SDK_VERSION=$(grep "bitwardenSdk =" gradle/libs.versions.toml | cut -d'"' -f2)
-          GIT_REF=$(echo "$SDK_VERSION" | cut -d'-' -f3-) # handles both commit hashes and branch names
-          echo "Current SDK version: $SDK_VERSION"
-          echo "Current SDK git ref: $GIT_REF"
-          echo "version=$SDK_VERSION" >> $GITHUB_OUTPUT
-          echo "git_ref=$GIT_REF" >> $GITHUB_OUTPUT
-
-      - name: Update SDK Version
-        env:
-          _SDK_PACKAGE: ${{ inputs.sdk-package }}
-          _SDK_VERSION: ${{ inputs.sdk-version }}
-        run: |
-          ./scripts/update-sdk-version.sh "$_SDK_PACKAGE" "$_SDK_VERSION"
-
-      - name: Create branch and commit
-        env:
-          _SDK_PACKAGE: ${{ inputs.sdk-package }}
-          _SDK_VERSION: ${{ inputs.sdk-version }}
-          _BRANCH_NAME: ${{ steps.switch-branch.outputs.branch_name }}
-        run: |
-          echo "👀 Committing SDK version update..."
-
-          git config user.name "bw-ghapp[bot]"
-          git config user.email "178206702+bw-ghapp[bot]@users.noreply.github.com"
-
-          git add gradle/libs.versions.toml
-          git commit -m "SDK Update - $_SDK_PACKAGE $_SDK_VERSION"
-          git push origin $_BRANCH_NAME
-
-      - name: Create Pull Request
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          _BRANCH_NAME: ${{ steps.switch-branch.outputs.branch_name }}
-          _SDK_PACKAGE: ${{ inputs.sdk-package }}
-          _SDK_VERSION: ${{ inputs.sdk-version }}
-          _OLD_SDK_VERSION: ${{ steps.get-current-sdk.outputs.version }}
-          _OLD_SDK_GIT_REF: ${{ steps.get-current-sdk.outputs.git_ref }}
-        run: |
-          NEW_SDK_GIT_REF=$(echo "$_SDK_VERSION" | cut -d'-' -f3-)
-          CHANGELOG=$(./scripts/get-repo-changelog.sh "bitwarden/sdk-internal" "$_OLD_SDK_GIT_REF" "$NEW_SDK_GIT_REF")
-          PR_BODY="Updates the SDK version from \`$_OLD_SDK_VERSION\` to \`$_SDK_PACKAGE $_SDK_VERSION\`
-
-          ## What's Changed
-
-          $CHANGELOG"
-
-          # Use echo -e to interpret escape sequences and pipe to gh pr create
-          PR_URL=$(echo -e "$PR_BODY" | gh pr create \
-            --title "Update SDK to $_SDK_VERSION" \
-            --body-file - \
-            --base main \
-            --head $_BRANCH_NAME \
-            --label "automated-pr" \
-            --label "t:ci")
-
-          echo "🚀 Created PR: $PR_URL"
-          echo "## 🚀 Created PR: $PR_URL" >> $GITHUB_STEP_SUMMARY
-
-  test:
-    name: Test Update
-    if: ${{ inputs.run-mode == 'Test' }}
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-      packages: read
-
-    steps:
-      - name: Check out repo
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-
-      - name: Log inputs to job summary
-        uses: ./.github/actions/log-inputs
-        with:
-          inputs: ${{ toJson(inputs) }}
-
-      - name: Setup Android Build
-        uses: ./.github/actions/setup-android-build
-
-      - name: Update SDK Version
-        env:
-          _SDK_PACKAGE: ${{ inputs.sdk-package }}
-          _SDK_VERSION: ${{ inputs.sdk-version }}
-        run: |
-          ./scripts/update-sdk-version.sh "$_SDK_PACKAGE" "$_SDK_VERSION"
-
-      - name: Build
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Used in settings.gradle.kts to download the SDK from GitHub Maven Packages
-        run: |
-          ./gradlew assembleDebug --warn
--- a/.github/workflows/test-device.yml
+++ b/.github/workflows/test-device.yml
@@ -1,16 +0,0 @@
-name: Test Device
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  test:
-    name: Test Device
-    runs-on: ubuntu-24.04
-
-    steps:
-    - name: Placeholder step
-      run: echo "Placeholder workflow step"
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -9,7 +9,7 @@ on:
  pull_request:
    types: [opened, synchronize]
  merge_group:
-    types: [checks_requested]
+    type: [checks_requested]
  workflow_dispatch:

 env:
@@ -27,13 +27,13 @@ jobs:

    steps:
      - name: Check out repo
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
+        uses: gradle/actions/wrapper-validation@06832c7b30a0129d7fb559bcc6e43d26f6374244 # v4.3.1

      - name: Cache Gradle files
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ~/.gradle/caches
@@ -43,7 +43,7 @@ jobs:
            ${{ runner.os }}-gradle-v2-

      - name: Cache build output
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: |
            ${{ github.workspace }}/build-cache
@@ -52,7 +52,7 @@ jobs:
            ${{ runner.os }}-build-

      - name: Configure Ruby
-        uses: ruby/setup-ruby@829114fc20da43a41d27359103ec7a63020954d4 # v1.255.0
+        uses: ruby/setup-ruby@ca041f971d66735f3e5ff1e21cc13e2d51e7e535 # v1.233.0
        with:
          bundler-cache: true

@@ -91,7 +91,7 @@ jobs:

      - name: Upload to codecov.io
        id: upload-to-codecov
-        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
+        uses: codecov/codecov-action@ad3126e916f78f00edff4ed0317cf185271ccc2d # v5.4.2
        if: github.event_name == 'push' || github.event_name == 'pull_request'
        continue-on-error: true
        with:
@@ -110,7 +110,7 @@ jobs:
          echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
          echo "> Uploading code coverage report failed. Please check the \"Upload to codecov.io\" step of \"Process Test Reports\" job for more details." >> $GITHUB_STEP_SUMMARY

-          if [ -n "$PR_NUMBER" ]; then
+          if [ ! -z "$PR_NUMBER" ]; then
            message=$'> [!WARNING]\n> @'$RUN_ACTOR' Uploading code coverage report failed. Please check the "Upload to codecov.io" step of [Process Test Reports job]('$_GITHUB_ACTION_RUN_URL') for more details.'
            gh pr comment --repo $GITHUB_REPOSITORY $PR_NUMBER --body "$message"
          fi
--- a/.gitignore
+++ b/.gitignore
@@ -3,13 +3,6 @@
 fastlane/report.xml
 fastlane/README.md

-# Ruby / Bundler
-.bundle/
-vendor/
-
-# Backup files
-*.bak
-
 # General
 .DS_Store
 Thumbs.db
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-3.4.2
+3.3.1
--- a/9
+++ b/9
@@ -7,12 +7,3 @@ gem 'time'

 plugins_path = File.join(File.dirname(__FILE__), 'fastlane', 'Pluginfile')
 eval_gemfile(plugins_path) if File.exist?(plugins_path)
-
-# Since ruby 3.4.0 these are not included in the standard library
-gem 'abbrev'
-gem 'logger'
-gem 'mutex_m'
-gem 'csv'
-
-# Starting with Ruby 3.5.0, these are not included in the standard library
-gem 'ostruct'
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -5,39 +5,35 @@ GEM
      base64
      nkf
      rexml
-    abbrev (0.1.2)
    addressable (2.8.7)
      public_suffix (>= 2.0.2, < 7.0)
    artifactory (3.0.17)
    atomos (0.1.3)
-    aws-eventstream (1.4.0)
-    aws-partitions (1.1139.0)
-    aws-sdk-core (3.228.0)
+    aws-eventstream (1.3.2)
+    aws-partitions (1.1102.0)
+    aws-sdk-core (3.223.0)
      aws-eventstream (~> 1, >= 1.3.0)
      aws-partitions (~> 1, >= 1.992.0)
      aws-sigv4 (~> 1.9)
      base64
-      bigdecimal
      jmespath (~> 1, >= 1.6.1)
      logger
-    aws-sdk-kms (1.109.0)
-      aws-sdk-core (~> 3, >= 3.228.0)
+    aws-sdk-kms (1.100.0)
+      aws-sdk-core (~> 3, >= 3.216.0)
      aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.195.0)
-      aws-sdk-core (~> 3, >= 3.228.0)
+    aws-sdk-s3 (1.185.0)
+      aws-sdk-core (~> 3, >= 3.216.0)
      aws-sdk-kms (~> 1)
      aws-sigv4 (~> 1.5)
-    aws-sigv4 (1.12.1)
+    aws-sigv4 (1.11.0)
      aws-eventstream (~> 1, >= 1.0.2)
    babosa (1.0.4)
-    base64 (0.3.0)
-    bigdecimal (3.2.2)
+    base64 (0.2.0)
    claide (1.1.0)
    colored (1.2)
    colored2 (3.1.2)
    commander (4.6.0)
      highline (~> 2.0.0)
-    csv (3.3.5)
    date (3.4.1)
    declarative (0.0.20)
    digest-crc (0.7.0)
@@ -62,10 +58,10 @@ GEM
      faraday (>= 0.8.0)
      http-cookie (~> 1.0.0)
    faraday-em_http (1.0.0)
-    faraday-em_synchrony (1.0.1)
+    faraday-em_synchrony (1.0.0)
    faraday-excon (1.1.0)
    faraday-httpclient (1.0.1)
-    faraday-multipart (1.1.1)
+    faraday-multipart (1.1.0)
      multipart-post (~> 2.0)
    faraday-net_http (1.0.2)
    faraday-net_http_persistent (1.2.0)
@@ -75,7 +71,7 @@ GEM
    faraday_middleware (1.2.1)
      faraday (~> 1.0)
    fastimage (2.4.0)
-    fastlane (2.228.0)
+    fastlane (2.227.2)
      CFPropertyList (>= 2.3, < 4.0.0)
      addressable (>= 2.8, < 3.0.0)
      artifactory (~> 3.0)
@@ -169,24 +165,23 @@ GEM
    httpclient (2.9.0)
      mutex_m
    jmespath (1.6.2)
-    json (2.13.2)
-    jwt (2.10.2)
+    json (2.11.3)
+    jwt (2.10.1)
      base64
    logger (1.7.0)
    mini_magick (4.13.2)
    mini_mime (1.1.5)
-    multi_json (1.17.0)
+    multi_json (1.15.0)
    multipart-post (2.4.1)
    mutex_m (0.3.0)
    nanaimo (0.4.0)
-    naturally (2.3.0)
+    naturally (2.2.1)
    nkf (0.2.0)
    optparse (0.6.0)
    os (1.1.4)
-    ostruct (0.6.3)
    plist (3.7.2)
    public_suffix (6.0.2)
-    rake (13.3.0)
+    rake (13.2.1)
    representable (3.2.0)
      declarative (< 0.1.0)
      trailblazer-option (>= 0.1.1, < 0.2.0)
@@ -235,17 +230,12 @@ PLATFORMS
  ruby

 DEPENDENCIES
-  abbrev
-  csv
  fastlane
  fastlane-plugin-firebase_app_distribution
-  logger
-  mutex_m
-  ostruct
  time

 RUBY VERSION
-   ruby 3.4.2p28
+   ruby 3.3.1p55

 BUNDLED WITH
-   2.6.9
+   2.6.6
--- a/README.md
+++ b/README.md
@@ -52,47 +52,6 @@

    Please avoid mixing formatting and logical changes in the same commit/PR. When possible, fix any large formatting issues in a separate PR before opening one to make logical changes to the same code. This helps others focus on the meaningful code changes when reviewing the code.

-4. Setup JDK `Version` `17`:
-
-    - Navigate to `Preferences > Build, Execution, Deployment > Build Tools > Gradle`.
-    - Hit the selected Gradle JDK next to `Gradle JDK:`.
-    - Select a `17.x` version or hit `Download JDK...` if not present.
-    - Select `Version` `17`.
-    - Select your preferred `Vendor`.
-    - Hit `Download`.
-    - Hit `Apply`.
-
-5. Setup `detekt` pre-commit hook (optional):
-
-Run the following script from the root of the repository to install the hook. This will overwrite any existing pre-commit hook if present.
-
-```shell
-echo "Writing detekt pre-commit hook..."
-cat << 'EOL' > .git/hooks/pre-commit
-#!/usr/bin/env bash
-
-echo "Running detekt check..."
-OUTPUT="/tmp/detekt-$(date +%s)"
-./gradlew -Pprecommit=true detekt > $OUTPUT
-EXIT_CODE=$?
-if [ $EXIT_CODE -ne 0 ]; then
-  cat $OUTPUT
-  rm $OUTPUT
-  echo "***********************************************"
-  echo "                 detekt failed                 "
-  echo " Please fix the above issues before committing "
-  echo "***********************************************"
-  exit $EXIT_CODE
-fi
-rm $OUTPUT
-EOL
-echo "detekt pre-commit hook written to .git/hooks/pre-commit"
-echo "Making the hook executable"
-chmod +x .git/hooks/pre-commit
-
-echo "detekt pre-commit hook installed successfully to .git/hooks/pre-commit"
-```
-
 ## Theme

 ### Icons & Illustrations
--- a/annotation/.gitignore
+++ b/annotation/.gitignore
@@ -1 +0,0 @@
-/build
--- a/annotation/build.gradle.kts
+++ b/annotation/build.gradle.kts
@@ -1,42 +0,0 @@
-import org.jetbrains.kotlin.gradle.dsl.JvmTarget
-
-plugins {
-    alias(libs.plugins.android.library)
-    alias(libs.plugins.kotlin.android)
-}
-
-android {
-    namespace = "com.bitwarden.annotation"
-    compileSdk = libs.versions.compileSdk.get().toInt()
-
-    defaultConfig {
-        minSdk = libs.versions.minSdkBwa.get().toInt()
-
-        testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
-        consumerProguardFiles("consumer-rules.pro")
-    }
-
-    buildTypes {
-        release {
-            isMinifyEnabled = false
-            proguardFiles(
-                getDefaultProguardFile("proguard-android-optimize.txt"),
-                "proguard-rules.pro",
-            )
-        }
-    }
-    compileOptions {
-        sourceCompatibility(libs.versions.jvmTarget.get())
-        targetCompatibility(libs.versions.jvmTarget.get())
-    }
-    @Suppress("UnstableApiUsage")
-    testFixtures {
-        enable = true
-    }
-}
-
-kotlin {
-    compilerOptions {
-        jvmTarget = JvmTarget.fromTarget(libs.versions.jvmTarget.get())
-    }
-}
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -10,7 +10,6 @@ import java.util.Properties

 plugins {
    alias(libs.plugins.android.application)
-    alias(libs.plugins.androidx.room)
    // Crashlytics is enabled for all builds initially but removed for FDroid builds in gradle and
    // standardDebug builds in the merged manifest.
    alias(libs.plugins.crashlytics)
@@ -47,32 +46,26 @@ android {
    namespace = "com.x8bit.bitwarden"
    compileSdk = libs.versions.compileSdk.get().toInt()

-    room {
-        schemaDirectory("$projectDir/schemas")
-    }
-
    defaultConfig {
        applicationId = "com.x8bit.bitwarden"
        minSdk = libs.versions.minSdk.get().toInt()
        targetSdk = libs.versions.targetSdk.get().toInt()
-        versionCode = libs.versions.appVersionCode.get().toInt()
-        versionName = libs.versions.appVersionName.get()
+        versionCode = 1
+        versionName = "2025.4.0"
+
+        setProperty("archivesBaseName", "com.x8bit.bitwarden")
+
+        ksp {
+            // The location in which the generated Room Database Schemas will be stored in the repo.
+            arg("room.schemaLocation", "$projectDir/schemas")
+        }

        testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"

-        // Set the base archive name for publishing purposes. This is used to derive the APK and AAB
-        // artifact names when uploading to Firebase and Play Store.
-        base.archivesName = "com.x8bit.bitwarden"
-
        buildConfigField(
            type = "String",
            name = "CI_INFO",
-            value = "${ciProperties.getOrDefault("ci.info", "\"\uD83D\uDCBB local\"")}",
-        )
-        buildConfigField(
-            type = "String",
-            name = "SDK_VERSION",
-            value = "\"${libs.versions.bitwardenSdk.get()}\"",
+            value = "${ciProperties.getOrDefault("ci.info", "\"local\"")}",
        )
    }

@@ -106,7 +99,6 @@ android {
            applicationIdSuffix = ".beta"
            isDebuggable = false
            isMinifyEnabled = true
-            isShrinkResources = true
            matchingFallbacks += listOf("release")
            proguardFiles(
                getDefaultProguardFile("proguard-android-optimize.txt"),
@@ -119,7 +111,6 @@ android {
        release {
            isDebuggable = false
            isMinifyEnabled = true
-            isShrinkResources = true
            proguardFiles(
                getDefaultProguardFile("proguard-android-optimize.txt"),
                "proguard-rules.pro",
@@ -202,7 +193,7 @@ android {

 kotlin {
    compilerOptions {
-        jvmTarget = JvmTarget.fromTarget(libs.versions.jvmTarget.get())
+        jvmTarget.set(JvmTarget.fromTarget(libs.versions.jvmTarget.get()))
    }
 }

@@ -222,7 +213,6 @@ dependencies {

    implementation(files("libs/authenticatorbridge-1.0.1-release.aar"))

-    implementation(project(":annotation"))
    implementation(project(":core"))
    implementation(project(":data"))
    implementation(project(":network"))
@@ -264,10 +254,11 @@ dependencies {
    implementation(libs.kotlinx.collections.immutable)
    implementation(libs.kotlinx.coroutines.android)
    implementation(libs.kotlinx.serialization)
-    implementation(platform(libs.square.okhttp.bom))
    implementation(libs.square.okhttp)
+    implementation(libs.square.okhttp.logging)
    implementation(platform(libs.square.retrofit.bom))
    implementation(libs.square.retrofit)
+    implementation(libs.square.retrofit.kotlinx.serialization)
    implementation(libs.timber)
    implementation(libs.zxing.zxing.core)

@@ -295,6 +286,7 @@ dependencies {
    testImplementation(libs.kotlinx.coroutines.test)
    testImplementation(libs.mockk.mockk)
    testImplementation(libs.robolectric.robolectric)
+    testImplementation(libs.square.okhttp.mockwebserver)
    testImplementation(libs.square.turbine)
 }

@@ -303,7 +295,8 @@ tasks {
        useJUnitPlatform()
        maxHeapSize = "2g"
        maxParallelForks = Runtime.getRuntime().availableProcessors()
-        jvmArgs = jvmArgs.orEmpty() + "-XX:+UseParallelGC" + "-Duser.country=US"
+        jvmArgs = jvmArgs.orEmpty() + "-XX:+UseParallelGC"
+        android.sourceSets["main"].res.srcDirs("src/test/res")
    }
 }

@@ -328,7 +321,6 @@ private fun renameFile(path: String, newName: String) {
    if (originalFile.renameTo(newFile)) {
        println("Renamed $originalFile to $newFile")
    } else {
-        @Suppress("TooGenericExceptionThrown")
        throw RuntimeException("Failed to rename $originalFile to $newFile")
    }
 }
--- a/app/schemas/com.x8bit.bitwarden.data.credentials.datasource.disk.database.PrivilegedAppDatabase/1.json
+++ b/app/schemas/com.x8bit.bitwarden.data.credentials.datasource.disk.database.PrivilegedAppDatabase/1.json
@@ -1,38 +0,0 @@
-{
-  "formatVersion": 1,
-  "database": {
-    "version": 1,
-    "identityHash": "ce40856ec88770d11b7afb587c7deabc",
-    "entities": [
-      {
-        "tableName": "privileged_apps",
-        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`package_name` TEXT NOT NULL, `signature` TEXT NOT NULL, PRIMARY KEY(`package_name`, `signature`))",
-        "fields": [
-          {
-            "fieldPath": "packageName",
-            "columnName": "package_name",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "signature",
-            "columnName": "signature",
-            "affinity": "TEXT",
-            "notNull": true
-          }
-        ],
-        "primaryKey": {
-          "autoGenerate": false,
-          "columnNames": [
-            "package_name",
-            "signature"
-          ]
-        }
-      }
-    ],
-    "setupQueries": [
-      "CREATE TABLE IF NOT EXISTS room_master_table (id INTEGER PRIMARY KEY,identity_hash TEXT)",
-      "INSERT OR REPLACE INTO room_master_table (id,identity_hash) VALUES(42, 'ce40856ec88770d11b7afb587c7deabc')"
-    ]
-  }
-}
--- a/app/schemas/com.x8bit.bitwarden.data.vault.datasource.disk.database.VaultDatabase/7.json
+++ b/app/schemas/com.x8bit.bitwarden.data.vault.datasource.disk.database.VaultDatabase/7.json
@@ -1,252 +0,0 @@
-{
-  "formatVersion": 1,
-  "database": {
-    "version": 7,
-    "identityHash": "4c6ad1f5268d7e8add7407201788aa2e",
-    "entities": [
-      {
-        "tableName": "ciphers",
-        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` TEXT NOT NULL, `user_id` TEXT NOT NULL, `has_totp` INTEGER NOT NULL DEFAULT 1, `cipher_type` TEXT NOT NULL, `cipher_json` TEXT NOT NULL, PRIMARY KEY(`id`))",
-        "fields": [
-          {
-            "fieldPath": "id",
-            "columnName": "id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "userId",
-            "columnName": "user_id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "hasTotp",
-            "columnName": "has_totp",
-            "affinity": "INTEGER",
-            "notNull": true,
-            "defaultValue": "1"
-          },
-          {
-            "fieldPath": "cipherType",
-            "columnName": "cipher_type",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "cipherJson",
-            "columnName": "cipher_json",
-            "affinity": "TEXT",
-            "notNull": true
-          }
-        ],
-        "primaryKey": {
-          "autoGenerate": false,
-          "columnNames": [
-            "id"
-          ]
-        },
-        "indices": [
-          {
-            "name": "index_ciphers_user_id",
-            "unique": false,
-            "columnNames": [
-              "user_id"
-            ],
-            "orders": [],
-            "createSql": "CREATE INDEX IF NOT EXISTS `index_ciphers_user_id` ON `${TABLE_NAME}` (`user_id`)"
-          }
-        ]
-      },
-      {
-        "tableName": "collections",
-        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` TEXT NOT NULL, `user_id` TEXT NOT NULL, `organization_id` TEXT NOT NULL, `should_hide_passwords` INTEGER NOT NULL, `name` TEXT NOT NULL, `external_id` TEXT, `read_only` INTEGER NOT NULL, `manage` INTEGER, PRIMARY KEY(`id`))",
-        "fields": [
-          {
-            "fieldPath": "id",
-            "columnName": "id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "userId",
-            "columnName": "user_id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "organizationId",
-            "columnName": "organization_id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "shouldHidePasswords",
-            "columnName": "should_hide_passwords",
-            "affinity": "INTEGER",
-            "notNull": true
-          },
-          {
-            "fieldPath": "name",
-            "columnName": "name",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "externalId",
-            "columnName": "external_id",
-            "affinity": "TEXT"
-          },
-          {
-            "fieldPath": "isReadOnly",
-            "columnName": "read_only",
-            "affinity": "INTEGER",
-            "notNull": true
-          },
-          {
-            "fieldPath": "canManage",
-            "columnName": "manage",
-            "affinity": "INTEGER"
-          }
-        ],
-        "primaryKey": {
-          "autoGenerate": false,
-          "columnNames": [
-            "id"
-          ]
-        },
-        "indices": [
-          {
-            "name": "index_collections_user_id",
-            "unique": false,
-            "columnNames": [
-              "user_id"
-            ],
-            "orders": [],
-            "createSql": "CREATE INDEX IF NOT EXISTS `index_collections_user_id` ON `${TABLE_NAME}` (`user_id`)"
-          }
-        ]
-      },
-      {
-        "tableName": "domains",
-        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`user_id` TEXT NOT NULL, `domains_json` TEXT, PRIMARY KEY(`user_id`))",
-        "fields": [
-          {
-            "fieldPath": "userId",
-            "columnName": "user_id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "domainsJson",
-            "columnName": "domains_json",
-            "affinity": "TEXT"
-          }
-        ],
-        "primaryKey": {
-          "autoGenerate": false,
-          "columnNames": [
-            "user_id"
-          ]
-        }
-      },
-      {
-        "tableName": "folders",
-        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` TEXT NOT NULL, `user_id` TEXT NOT NULL, `name` TEXT, `revision_date` INTEGER NOT NULL, PRIMARY KEY(`id`))",
-        "fields": [
-          {
-            "fieldPath": "id",
-            "columnName": "id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "userId",
-            "columnName": "user_id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "name",
-            "columnName": "name",
-            "affinity": "TEXT"
-          },
-          {
-            "fieldPath": "revisionDate",
-            "columnName": "revision_date",
-            "affinity": "INTEGER",
-            "notNull": true
-          }
-        ],
-        "primaryKey": {
-          "autoGenerate": false,
-          "columnNames": [
-            "id"
-          ]
-        },
-        "indices": [
-          {
-            "name": "index_folders_user_id",
-            "unique": false,
-            "columnNames": [
-              "user_id"
-            ],
-            "orders": [],
-            "createSql": "CREATE INDEX IF NOT EXISTS `index_folders_user_id` ON `${TABLE_NAME}` (`user_id`)"
-          }
-        ]
-      },
-      {
-        "tableName": "sends",
-        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` TEXT NOT NULL, `user_id` TEXT NOT NULL, `send_type` TEXT NOT NULL, `send_json` TEXT NOT NULL, PRIMARY KEY(`id`))",
-        "fields": [
-          {
-            "fieldPath": "id",
-            "columnName": "id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "userId",
-            "columnName": "user_id",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "sendType",
-            "columnName": "send_type",
-            "affinity": "TEXT",
-            "notNull": true
-          },
-          {
-            "fieldPath": "sendJson",
-            "columnName": "send_json",
-            "affinity": "TEXT",
-            "notNull": true
-          }
-        ],
-        "primaryKey": {
-          "autoGenerate": false,
-          "columnNames": [
-            "id"
-          ]
-        },
-        "indices": [
-          {
-            "name": "index_sends_user_id",
-            "unique": false,
-            "columnNames": [
-              "user_id"
-            ],
-            "orders": [],
-            "createSql": "CREATE INDEX IF NOT EXISTS `index_sends_user_id` ON `${TABLE_NAME}` (`user_id`)"
-          }
-        ]
-      }
-    ],
-    "setupQueries": [
-      "CREATE TABLE IF NOT EXISTS room_master_table (id INTEGER PRIMARY KEY,identity_hash TEXT)",
-      "INSERT OR REPLACE INTO room_master_table (id,identity_hash) VALUES(42, '4c6ad1f5268d7e8add7407201788aa2e')"
-    ]
-  }
-}
--- a/app/src/beta/AndroidManifest.xml
+++ b/app/src/beta/AndroidManifest.xml
@@ -1,21 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools">
-
-    <application tools:ignore="MissingApplicationIcon">
-        <activity
-            android:name=".MainActivity">
-            <intent-filter android:autoVerify="true">
-                <action android:name="android.intent.action.VIEW" />
-
-                <category android:name="android.intent.category.DEFAULT" />
-                <category android:name="android.intent.category.BROWSABLE" />
-
-                <data android:scheme="https" />
-                <data android:host="*.bitwarden.pw" />
-                <data android:pathPattern="/redirect-connector.*" />
-            </intent-filter>
-        </activity>
-    </application>
-
-</manifest>
--- a/app/src/debug/AndroidManifest.xml
+++ b/app/src/debug/AndroidManifest.xml
@@ -7,20 +7,6 @@
        <meta-data
            android:name="firebase_crashlytics_collection_enabled"
            android:value="false" />
-        <activity
-            android:name=".MainActivity"
-            tools:ignore="IntentFilterExportedReceiver">
-            <intent-filter android:autoVerify="true">
-                <action android:name="android.intent.action.VIEW" />
-
-                <category android:name="android.intent.category.DEFAULT" />
-                <category android:name="android.intent.category.BROWSABLE" />
-
-                <data android:scheme="https" />
-                <data android:host="*.bitwarden.pw" />
-                <data android:pathPattern="/redirect-connector.*" />
-            </intent-filter>
-        </activity>
    </application>

 </manifest>
--- a/app/src/debug/res/xml/network_security_config.xml
+++ b/app/src/debug/res/xml/network_security_config.xml
@@ -1,27 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<network-security-config xmlns:tools="http://schemas.android.com/tools">
-
-    <base-config
-        cleartextTrafficPermitted="true"
-        tools:ignore="InsecureBaseConfiguration">
-        <trust-anchors>
-            <!-- Trust pre-installed CAs -->
-            <certificates src="system" />
-            <!-- Additionally trust user added CAs -->
-            <certificates
-                src="user"
-                tools:ignore="AcceptsUserCertificates" />
-        </trust-anchors>
-    </base-config>
-
-    <domain-config cleartextTrafficPermitted="false">
-        <domain includeSubdomains="true">bitwarden.com</domain>
-        <domain includeSubdomains="true">bitwarden.eu</domain>
-        <domain includeSubdomains="true">bitwarden.pw</domain>
-        <trust-anchors>
-            <!-- Only trust pre-installed CAs for Bitwarden domains and all subdomains -->
-            <certificates src="system" />
-        </trust-anchors>
-    </domain-config>
-
-</network-security-config>
--- a/app/src/debug/res/xml/provider.xml
+++ b/app/src/debug/res/xml/provider.xml
@@ -1,7 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<credential-provider>
-    <capabilities>
-        <capability name="android.credentials.TYPE_PASSWORD_CREDENTIAL" />
-        <capability name="androidx.credentials.TYPE_PUBLIC_KEY_CREDENTIAL" />
-    </capabilities>
-</credential-provider>
--- a/app/src/fdroid/kotlin/com/x8bit/bitwarden/data/platform/manager/LogsManagerImpl.kt
+++ b/app/src/fdroid/kotlin/com/x8bit/bitwarden/data/platform/manager/LogsManagerImpl.kt
--- a/app/src/fdroid/kotlin/com/x8bit/bitwarden/ui/platform/manager/review/AppReviewManagerImpl.kt
+++ b/app/src/fdroid/kotlin/com/x8bit/bitwarden/ui/platform/manager/review/AppReviewManagerImpl.kt
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -37,18 +37,15 @@
        android:dataExtractionRules="@xml/data_extraction_rules"
        android:fullBackupContent="@xml/backup_rules"
        android:icon="@mipmap/ic_launcher"
-        android:intentMatchingFlags="enforceIntentFilter"
        android:label="@string/app_name"
        android:networkSecurityConfig="@xml/network_security_config"
        android:roundIcon="@mipmap/ic_launcher_round"
        android:supportsRtl="true"
        android:theme="@style/LaunchTheme"
-        tools:ignore="CredentialDependency"
        tools:replace="appComponentFactory"
-        tools:targetApi="36">
+        tools:targetApi="33">
        <activity
            android:name=".MainActivity"
-            android:configChanges="uiMode"
            android:exported="true"
            android:launchMode="@integer/launchModeAPIlevel"
            android:theme="@style/LaunchTheme"
@@ -81,12 +78,12 @@
                <data android:scheme="https" />
                <data android:host="*.bitwarden.com" />
                <data android:host="*.bitwarden.eu" />
+                <data android:host="*.bitwarden.pw" />
                <data android:pathPattern="/redirect-connector.*" />
            </intent-filter>
            <intent-filter>
                <action android:name="com.x8bit.bitwarden.credentials.ACTION_CREATE_PASSKEY" />
                <action android:name="com.x8bit.bitwarden.credentials.ACTION_GET_PASSKEY" />
-                <action android:name="com.x8bit.bitwarden.credentials.ACTION_GET_PASSWORD" />
                <action android:name="com.x8bit.bitwarden.credentials.ACTION_UNLOCK_ACCOUNT" />

                <category android:name="android.intent.category.DEFAULT" />
@@ -115,11 +112,11 @@
            android:theme="@android:style/Theme.NoDisplay" />

        <activity
-            android:name=".AutofillCallbackActivity"
+            android:name=".AutofillTotpCopyActivity"
            android:exported="true"
            android:launchMode="singleTop"
            android:noHistory="true"
-            android:theme="@style/AutofillCallbackTheme" />
+            android:theme="@style/AutofillTotpCopyTheme" />

        <activity
            android:name=".AuthCallbackActivity"
@@ -133,6 +130,16 @@
                <category android:name="android.intent.category.DEFAULT" />
                <category android:name="android.intent.category.BROWSABLE" />

+                <data
+                    android:host="captcha-callback"
+                    android:scheme="bitwarden" />
+            </intent-filter>
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+
                <data
                    android:host="duo-callback"
                    android:scheme="bitwarden" />
@@ -320,19 +327,11 @@
            <action android:name="android.intent.action.MAIN" />
            <category android:name="android.intent.category.HOME" />
        </intent>
-        <!-- To Query Privileged Apps -->
-        <intent>
-            <action android:name="android.intent.action.VIEW" />
-            <data android:scheme="http" />
-        </intent>
        <!-- To Query Chrome Beta: -->
        <package android:name="com.chrome.beta" />

        <!-- To Query Chrome Stable: -->
        <package android:name="com.android.chrome" />
-
-        <!-- To Query Brave Stable: -->
-        <package android:name="com.brave.browser" />
    </queries>

 </manifest>
--- a/app/src/main/assets/fido2_privileged_google.json
+++ b/app/src/main/assets/fido2_privileged_google.json
@@ -779,42 +779,6 @@
          }
        ]
      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "cz.seznam.sbrowser",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "DB:95:40:66:10:78:83:6E:4E:B1:66:F6:9E:F4:07:30:9E:8D:AE:33:34:68:5E:C8:F6:FA:2F:13:81:B9:AC:F6"
-          }
-        ]
-      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "com.opera.mini.native",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "57:AC:BC:52:5F:1B:2E:BD:19:19:6C:D6:F0:14:39:7C:C9:10:FD:18:84:1E:0A:E8:50:FE:BC:3E:1E:59:3F:F2"
-          }
-        ]
-      }
-    },
-    {
-      "type": "android",
-      "info": {
-        "package_name": "com.opera.mini.native.beta",
-        "signatures": [
-          {
-            "build": "release",
-            "cert_fingerprint_sha256": "57:AC:BC:52:5F:1B:2E:BD:19:19:6C:D6:F0:14:39:7C:C9:10:FD:18:84:1E:0A:E8:50:FE:BC:3E:1E:59:3F:F2"
-          }
-        ]
-      }
    }
  ]
 }
--- a/app/src/main/kotlin/com/x8bit/bitwarden/AccessibilityActivity.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/AccessibilityActivity.kt
@@ -1,11 +1,8 @@
 package com.x8bit.bitwarden

-import android.app.ComponentCaller
-import android.content.Intent
 import android.os.Bundle
 import androidx.appcompat.app.AppCompatActivity
-import com.bitwarden.annotation.OmitFromCoverage
-import com.bitwarden.ui.platform.util.validate
+import com.bitwarden.core.annotation.OmitFromCoverage

 /**
 * An activity to be launched and then immediately closed so that the OS Shade can be collapsed
@@ -14,16 +11,7 @@ import com.bitwarden.ui.platform.util.validate
@OmitFromCoverage
 class AccessibilityActivity : AppCompatActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
-        intent = intent.validate()
        super.onCreate(savedInstanceState)
        finish()
    }
-
-    override fun onNewIntent(intent: Intent) {
-        super.onNewIntent(intent.validate())
-    }
-
-    override fun onNewIntent(intent: Intent, caller: ComponentCaller) {
-        super.onNewIntent(intent.validate(), caller)
-    }
 }
--- a/app/src/main/kotlin/com/x8bit/bitwarden/AuthCallbackActivity.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/AuthCallbackActivity.kt
@@ -1,12 +1,10 @@
 package com.x8bit.bitwarden

-import android.app.ComponentCaller
 import android.content.Intent
 import android.os.Bundle
 import androidx.activity.viewModels
 import androidx.appcompat.app.AppCompatActivity
-import com.bitwarden.annotation.OmitFromCoverage
-import com.bitwarden.ui.platform.util.validate
+import com.bitwarden.core.annotation.OmitFromCoverage
 import dagger.hilt.android.AndroidEntryPoint

 /**
@@ -23,7 +21,6 @@ class AuthCallbackActivity : AppCompatActivity() {
    private val viewModel: AuthCallbackViewModel by viewModels()

    override fun onCreate(savedInstanceState: Bundle?) {
-        intent = intent.validate()
        super.onCreate(savedInstanceState)

        viewModel.trySendAction(AuthCallbackAction.IntentReceive(intent = intent))
@@ -38,12 +35,4 @@ class AuthCallbackActivity : AppCompatActivity() {
        startActivity(intent)
        finish()
    }
-
-    override fun onNewIntent(intent: Intent) {
-        super.onNewIntent(intent.validate())
-    }
-
-    override fun onNewIntent(intent: Intent, caller: ComponentCaller) {
-        super.onNewIntent(intent.validate(), caller)
-    }
 }
--- a/app/src/main/kotlin/com/x8bit/bitwarden/AuthCallbackViewModel.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/AuthCallbackViewModel.kt
@@ -3,6 +3,7 @@ package com.x8bit.bitwarden
 import android.content.Intent
 import com.bitwarden.ui.platform.base.BaseViewModel
 import com.x8bit.bitwarden.data.auth.repository.AuthRepository
+import com.x8bit.bitwarden.data.auth.repository.util.getCaptchaCallbackTokenResult
 import com.x8bit.bitwarden.data.auth.repository.util.getDuoCallbackTokenResult
 import com.x8bit.bitwarden.data.auth.repository.util.getSsoCallbackResult
 import com.x8bit.bitwarden.data.auth.repository.util.getWebAuthResultOrNull
@@ -26,6 +27,7 @@ class AuthCallbackViewModel @Inject constructor(
    private fun handleIntentReceived(action: AuthCallbackAction.IntentReceive) {
        val yubiKeyResult = action.intent.getYubiKeyResultOrNull()
        val webAuthResult = action.intent.getWebAuthResultOrNull()
+        val captchaCallbackTokenResult = action.intent.getCaptchaCallbackTokenResult()
        val duoCallbackTokenResult = action.intent.getDuoCallbackTokenResult()
        val ssoCallbackResult = action.intent.getSsoCallbackResult()
        when {
@@ -33,6 +35,12 @@ class AuthCallbackViewModel @Inject constructor(
                authRepository.setYubiKeyResult(yubiKeyResult = yubiKeyResult)
            }

+            captchaCallbackTokenResult != null -> {
+                authRepository.setCaptchaCallbackTokenResult(
+                    tokenResult = captchaCallbackTokenResult,
+                )
+            }
+
            duoCallbackTokenResult != null -> {
                authRepository.setDuoCallbackTokenResult(
                    tokenResult = duoCallbackTokenResult,
--- a/app/src/main/kotlin/com/x8bit/bitwarden/AutofillCallbackActivity.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/AutofillCallbackActivity.kt
@@ -1,13 +1,10 @@
 package com.x8bit.bitwarden

-import android.app.ComponentCaller
-import android.content.Intent
 import android.os.Bundle
 import androidx.activity.viewModels
 import androidx.appcompat.app.AppCompatActivity
 import androidx.lifecycle.lifecycleScope
-import com.bitwarden.annotation.OmitFromCoverage
-import com.bitwarden.ui.platform.util.validate
+import com.bitwarden.core.annotation.OmitFromCoverage
 import com.x8bit.bitwarden.data.autofill.manager.AutofillCompletionManager
 import dagger.hilt.android.AndroidEntryPoint
 import kotlinx.coroutines.flow.launchIn
@@ -15,43 +12,43 @@ import kotlinx.coroutines.flow.onEach
 import javax.inject.Inject

 /**
- * An activity that is launched to complete Autofill. This is done when an autofill item is selected
- * and is associated with a valid cipher. Due to the constraints of the autofill framework, we also
- * have to re-fulfill the autofill for the views that are being filled.
+ * An activity for copying a TOTP code to the clipboard. This is done when an autofill item is
+ * selected and it requires TOTP authentication. Due to the constraints of the autofill framework,
+ * we also have to re-fulfill the autofill for the views that are being filled.
 */
@OmitFromCoverage
@AndroidEntryPoint
-class AutofillCallbackActivity : AppCompatActivity() {
+class AutofillTotpCopyActivity : AppCompatActivity() {

    @Inject
    lateinit var autofillCompletionManager: AutofillCompletionManager

-    private val viewModel: AutofillCallbackViewModel by viewModels()
+    private val autofillTotpCopyViewModel: AutofillTotpCopyViewModel by viewModels()

    override fun onCreate(savedInstanceState: Bundle?) {
-        intent = intent.validate()
        super.onCreate(savedInstanceState)

        observeViewModelEvents()

-        viewModel.trySendAction(AutofillCallbackAction.IntentReceived(intent = intent))
-    }
-
-    override fun onNewIntent(intent: Intent) {
-        super.onNewIntent(intent.validate())
-    }
-
-    override fun onNewIntent(intent: Intent, caller: ComponentCaller) {
-        super.onNewIntent(intent.validate(), caller)
+        autofillTotpCopyViewModel.trySendAction(
+            AutofillTotpCopyAction.IntentReceived(
+                intent = intent,
+            ),
+        )
    }

    private fun observeViewModelEvents() {
-        viewModel
+        autofillTotpCopyViewModel
            .eventFlow
            .onEach { event ->
                when (event) {
-                    is AutofillCallbackEvent.CompleteAutofill -> handleCompleteAutofill(event)
-                    is AutofillCallbackEvent.FinishActivity -> finishActivity()
+                    is AutofillTotpCopyEvent.CompleteAutofill -> {
+                        handleCompleteAutofill(event)
+                    }
+
+                    is AutofillTotpCopyEvent.FinishActivity -> {
+                        finishActivity()
+                    }
                }
            }
            .launchIn(lifecycleScope)
@@ -60,7 +57,7 @@ class AutofillCallbackActivity : AppCompatActivity() {
    /**
     * Complete autofill with the provided data.
     */
-    private fun handleCompleteAutofill(event: AutofillCallbackEvent.CompleteAutofill) {
+    private fun handleCompleteAutofill(event: AutofillTotpCopyEvent.CompleteAutofill) {
        autofillCompletionManager.completeAutofill(
            activity = this,
            cipherView = event.cipherView,
--- a/app/src/main/kotlin/com/x8bit/bitwarden/AutofillCallbackViewModel.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/AutofillCallbackViewModel.kt
@@ -5,15 +5,14 @@ import androidx.lifecycle.viewModelScope
 import com.bitwarden.ui.platform.base.BaseViewModel
 import com.bitwarden.vault.CipherView
 import com.x8bit.bitwarden.data.auth.repository.AuthRepository
-import com.x8bit.bitwarden.data.autofill.util.getAutofillCallbackIntentOrNull
+import com.x8bit.bitwarden.data.autofill.util.getTotpCopyIntentOrNull
 import com.x8bit.bitwarden.data.platform.util.launchWithTimeout
-import com.x8bit.bitwarden.data.vault.manager.model.GetCipherResult
 import com.x8bit.bitwarden.data.vault.repository.VaultRepository
 import com.x8bit.bitwarden.data.vault.repository.model.VaultUnlockData
 import com.x8bit.bitwarden.data.vault.repository.util.statusFor
 import dagger.hilt.android.lifecycle.HiltViewModel
 import kotlinx.coroutines.flow.first
-import timber.log.Timber
+import kotlinx.coroutines.flow.mapNotNull
 import javax.inject.Inject

 /**
@@ -22,65 +21,53 @@ import javax.inject.Inject
 private const val CIPHER_WAIT_TIMEOUT_MILLIS: Long = 500

 /**
- * A view model that handles logic for the [AutofillCallbackActivity].
+ * A view model that handles logic for the [AutofillTotpCopyActivity].
 */
@HiltViewModel
-class AutofillCallbackViewModel @Inject constructor(
+class AutofillTotpCopyViewModel @Inject constructor(
    private val authRepository: AuthRepository,
    private val vaultRepository: VaultRepository,
-) : BaseViewModel<Unit, AutofillCallbackEvent, AutofillCallbackAction>(Unit) {
+) : BaseViewModel<Unit, AutofillTotpCopyEvent, AutofillTotpCopyAction>(Unit) {
    private val activeUserId: String? get() = authRepository.activeUserId

-    override fun handleAction(action: AutofillCallbackAction): Unit = when (action) {
-        is AutofillCallbackAction.IntentReceived -> handleIntentReceived(action)
+    override fun handleAction(action: AutofillTotpCopyAction): Unit = when (action) {
+        is AutofillTotpCopyAction.IntentReceived -> handleIntentReceived(action)
    }

    /**
     * Process the received intent and alert the activity of what to do next.
     */
-    private fun handleIntentReceived(action: AutofillCallbackAction.IntentReceived) {
+    private fun handleIntentReceived(action: AutofillTotpCopyAction.IntentReceived) {
        viewModelScope
            .launchWithTimeout(
-                timeoutBlock = {
-                    Timber.w("Autofill -- Timeout")
-                    finishActivity()
-                },
+                timeoutBlock = { finishActivity() },
                timeoutDuration = CIPHER_WAIT_TIMEOUT_MILLIS,
            ) {
                // Extract TOTP copy data from the intent.
                val cipherId = action
                    .intent
-                    .getAutofillCallbackIntentOrNull()
+                    .getTotpCopyIntentOrNull()
                    ?.cipherId

-                if (cipherId == null) {
-                    Timber.w("Autofill -- Cipher was not provided")
-                    finishActivity()
-                    return@launchWithTimeout
-                }
-                if (isVaultLocked()) {
-                    Timber.w("Autofill -- Vault is locked")
+                if (cipherId == null || isVaultLocked()) {
                    finishActivity()
                    return@launchWithTimeout
                }

                // Try and find the matching cipher.
-                when (val result = vaultRepository.getCipher(cipherId = cipherId)) {
-                    GetCipherResult.CipherNotFound -> {
-                        Timber.w("Autofill -- Cipher not found")
-                        finishActivity()
+                vaultRepository
+                    .ciphersStateFlow
+                    .mapNotNull { it.data }
+                    .first()
+                    .find { it.id == cipherId }
+                    ?.let { cipherView ->
+                        sendEvent(
+                            AutofillTotpCopyEvent.CompleteAutofill(
+                                cipherView = cipherView,
+                            ),
+                        )
                    }
-
-                    is GetCipherResult.Failure -> {
-                        Timber.w(result.error, "Autofill -- Get cipher failure")
-                        finishActivity()
-                    }
-
-                    is GetCipherResult.Success -> {
-                        Timber.d("Autofill -- Cipher found")
-                        sendEvent(AutofillCallbackEvent.CompleteAutofill(result.cipherView))
-                    }
-                }
+                    ?: finishActivity()
            }
    }

@@ -88,7 +75,7 @@ class AutofillCallbackViewModel @Inject constructor(
     * Send an event to the activity that signals it to finish.
     */
    private fun finishActivity() {
-        sendEvent(AutofillCallbackEvent.FinishActivity)
+        sendEvent(AutofillTotpCopyEvent.FinishActivity)
    }

    private suspend fun isVaultLocked(): Boolean {
@@ -105,30 +92,30 @@ class AutofillCallbackViewModel @Inject constructor(
 }

 /**
- * Represents actions that can be sent to the [AutofillCallbackViewModel].
+ * Represents actions that can be sent to the [AutofillTotpCopyViewModel].
 */
-sealed class AutofillCallbackAction {
+sealed class AutofillTotpCopyAction {
    /**
     * An [intent] has been received and is ready to be processed.
     */
    data class IntentReceived(
        val intent: Intent,
-    ) : AutofillCallbackAction()
+    ) : AutofillTotpCopyAction()
 }

 /**
- * Represents events emitted by the [AutofillCallbackViewModel].
+ * Represents events emitted by the [AutofillTotpCopyViewModel].
 */
-sealed class AutofillCallbackEvent {
+sealed class AutofillTotpCopyEvent {
    /**
     * Complete autofill with the provided [cipherView].
     */
    data class CompleteAutofill(
        val cipherView: CipherView,
-    ) : AutofillCallbackEvent()
+    ) : AutofillTotpCopyEvent()

    /**
     * Finish the activity.
     */
-    data object FinishActivity : AutofillCallbackEvent()
+    data object FinishActivity : AutofillTotpCopyEvent()
 }
--- a/app/src/main/kotlin/com/x8bit/bitwarden/BitwardenAppComponentFactory.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/BitwardenAppComponentFactory.kt
@@ -5,7 +5,7 @@ import android.content.Intent
 import android.os.Build
 import androidx.annotation.Keep
 import androidx.core.app.AppComponentFactory
-import com.bitwarden.annotation.OmitFromCoverage
+import com.bitwarden.core.annotation.OmitFromCoverage
 import com.x8bit.bitwarden.data.autofill.BitwardenAutofillService
 import com.x8bit.bitwarden.data.autofill.accessibility.BitwardenAccessibilityService
 import com.x8bit.bitwarden.data.credentials.BitwardenCredentialProviderService
--- a/app/src/main/kotlin/com/x8bit/bitwarden/BitwardenApplication.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/BitwardenApplication.kt
@@ -1,14 +1,13 @@
 package com.x8bit.bitwarden

 import android.app.Application
-import com.bitwarden.annotation.OmitFromCoverage
+import com.bitwarden.core.annotation.OmitFromCoverage
 import com.x8bit.bitwarden.data.auth.manager.AuthRequestNotificationManager
 import com.x8bit.bitwarden.data.platform.manager.LogsManager
 import com.x8bit.bitwarden.data.platform.manager.event.OrganizationEventManager
 import com.x8bit.bitwarden.data.platform.manager.network.NetworkConfigManager
 import com.x8bit.bitwarden.data.platform.manager.network.NetworkConnectionManager
 import com.x8bit.bitwarden.data.platform.manager.restriction.RestrictionManager
-import com.x8bit.bitwarden.data.platform.repository.EnvironmentRepository
 import dagger.hilt.android.HiltAndroidApp
 import timber.log.Timber
 import javax.inject.Inject
@@ -39,17 +38,6 @@ class BitwardenApplication : Application() {
    @Inject
    lateinit var restrictionManager: RestrictionManager

-    @Inject
-    lateinit var environmentRepository: EnvironmentRepository
-
-    override fun onCreate() {
-        super.onCreate()
-        // These must be initialized in order to ensure that the restrictionManager does not
-        // override the environmentRepository values.
-        restrictionManager.initialize()
-        environmentRepository.initialize()
-    }
-
    override fun onLowMemory() {
        super.onLowMemory()
        Timber.w("onLowMemory")
--- a/app/src/main/kotlin/com/x8bit/bitwarden/BitwardenLegacyAppComponents.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/BitwardenLegacyAppComponents.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/MainActivity.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/MainActivity.kt
@@ -1,30 +1,25 @@
 package com.x8bit.bitwarden

-import android.app.ComponentCaller
 import android.content.Intent
 import android.os.Build
 import android.os.Bundle
 import android.view.KeyEvent
 import android.view.MotionEvent
 import android.view.WindowManager
+import android.widget.Toast
 import androidx.activity.compose.setContent
 import androidx.activity.viewModels
 import androidx.appcompat.app.AppCompatActivity
 import androidx.appcompat.app.AppCompatDelegate
-import androidx.compose.runtime.Composable
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.remember
-import androidx.core.app.ActivityCompat
 import androidx.core.os.LocaleListCompat
 import androidx.core.splashscreen.SplashScreen.Companion.installSplashScreen
 import androidx.lifecycle.compose.collectAsStateWithLifecycle
-import androidx.navigation.NavController
 import androidx.navigation.compose.NavHost
-import com.bitwarden.annotation.OmitFromCoverage
+import com.bitwarden.core.annotation.OmitFromCoverage
 import com.bitwarden.ui.platform.base.util.EventsEffect
 import com.bitwarden.ui.platform.theme.BitwardenTheme
-import com.bitwarden.ui.platform.util.setupEdgeToEdge
-import com.bitwarden.ui.platform.util.validate
 import com.x8bit.bitwarden.data.autofill.accessibility.manager.AccessibilityCompletionManager
 import com.x8bit.bitwarden.data.autofill.manager.AutofillActivityManager
 import com.x8bit.bitwarden.data.autofill.manager.AutofillCompletionManager
@@ -40,11 +35,8 @@ import com.x8bit.bitwarden.ui.platform.feature.rootnav.rootNavDestination
 import com.x8bit.bitwarden.ui.platform.feature.settings.appearance.model.AppLanguage
 import com.x8bit.bitwarden.ui.platform.util.appLanguage
 import dagger.hilt.android.AndroidEntryPoint
-import kotlinx.coroutines.flow.map
 import javax.inject.Inject

-private const val ANDROID_15_BUG_MAX_REVISION: Int = 241007
-
 /**
 * Primary entry point for the application.
 */
@@ -70,30 +62,66 @@ class MainActivity : AppCompatActivity() {
    @Inject
    lateinit var debugLaunchManager: DebugMenuLaunchManager

+    @Suppress("LongMethod")
    override fun onCreate(savedInstanceState: Bundle?) {
-        intent = intent.validate()
        var shouldShowSplashScreen = true
        installSplashScreen().setKeepOnScreenCondition { shouldShowSplashScreen }
        super.onCreate(savedInstanceState)
-        window.decorView.filterTouchesWhenObscured = true
+
        if (savedInstanceState == null) {
-            mainViewModel.trySendAction(MainAction.ReceiveFirstIntent(intent = intent))
+            mainViewModel.trySendAction(
+                MainAction.ReceiveFirstIntent(
+                    intent = intent,
+                ),
+            )
        }

        // Within the app the theme will change dynamically and will be managed by the
        // OS, but we need to ensure we properly set the values when upgrading from older versions
        // that handle this differently or when the activity restarts.
        AppCompatDelegate.setDefaultNightMode(settingsRepository.appTheme.osValue)
-        setupEdgeToEdge(appThemeFlow = mainViewModel.stateFlow.map { it.theme })
        setContent {
-            val navController = rememberBitwardenNavController(name = "MainActivity")
-            SetupEventsEffect(navController = navController)
            val state by mainViewModel.stateFlow.collectAsStateWithLifecycle()
+            val navController = rememberBitwardenNavController(name = "MainActivity")
+            EventsEffect(viewModel = mainViewModel) { event ->
+                when (event) {
+                    is MainEvent.CompleteAccessibilityAutofill -> {
+                        handleCompleteAccessibilityAutofill(event)
+                    }
+
+                    is MainEvent.CompleteAutofill -> handleCompleteAutofill(event)
+                    MainEvent.Recreate -> handleRecreate()
+                    MainEvent.NavigateToDebugMenu -> navController.navigateToDebugMenuScreen()
+                    is MainEvent.ShowToast -> {
+                        Toast
+                            .makeText(
+                                baseContext,
+                                event.message.invoke(resources),
+                                Toast.LENGTH_SHORT,
+                            )
+                            .show()
+                    }
+
+                    is MainEvent.UpdateAppLocale -> {
+                        AppCompatDelegate.setApplicationLocales(
+                            LocaleListCompat.forLanguageTags(event.localeName),
+                        )
+                    }
+
+                    is MainEvent.UpdateAppTheme -> {
+                        AppCompatDelegate.setDefaultNightMode(event.osTheme)
+                    }
+                }
+            }
            updateScreenCapture(isScreenCaptureAllowed = state.isScreenCaptureAllowed)
            LocalManagerProvider(featureFlagsState = state.featureFlagsState) {
                ObserveScreenDataEffect(
                    onDataUpdate = remember(mainViewModel) {
-                        { mainViewModel.trySendAction(MainAction.ResumeScreenDataReceived(it)) }
+                        {
+                            mainViewModel.trySendAction(
+                                MainAction.ResumeScreenDataReceived(it),
+                            )
+                        }
                    },
                )
                BitwardenTheme(
@@ -119,15 +147,12 @@ class MainActivity : AppCompatActivity() {
    }

    override fun onNewIntent(intent: Intent) {
-        val newIntent = intent.validate()
-        super.onNewIntent(newIntent)
-        mainViewModel.trySendAction(action = MainAction.ReceiveNewIntent(intent = newIntent))
-    }
-
-    override fun onNewIntent(intent: Intent, caller: ComponentCaller) {
-        val newIntent = intent.validate()
-        super.onNewIntent(newIntent, caller)
-        mainViewModel.trySendAction(action = MainAction.ReceiveNewIntent(intent = newIntent))
+        super.onNewIntent(intent)
+        mainViewModel.trySendAction(
+            action = MainAction.ReceiveNewIntent(
+                intent = intent,
+            ),
+        )
    }

    override fun onResume() {
@@ -174,28 +199,6 @@ class MainActivity : AppCompatActivity() {
        .takeIf { it }
        ?: super.dispatchKeyEvent(event)

-    @Composable
-    private fun SetupEventsEffect(navController: NavController) {
-        EventsEffect(viewModel = mainViewModel) { event ->
-            when (event) {
-                is MainEvent.CompleteAccessibilityAutofill -> {
-                    handleCompleteAccessibilityAutofill(event)
-                }
-
-                is MainEvent.CompleteAutofill -> handleCompleteAutofill(event)
-                MainEvent.Recreate -> handleRecreate()
-                MainEvent.NavigateToDebugMenu -> navController.navigateToDebugMenuScreen()
-                is MainEvent.UpdateAppLocale -> {
-                    AppCompatDelegate.setApplicationLocales(
-                        LocaleListCompat.forLanguageTags(event.localeName),
-                    )
-                }
-
-                is MainEvent.UpdateAppTheme -> AppCompatDelegate.setDefaultNightMode(event.osTheme)
-            }
-        }
-    }
-
    private fun sendOpenDebugMenuEvent() {
        mainViewModel.trySendAction(MainAction.OpenDebugMenu)
    }
@@ -217,35 +220,7 @@ class MainActivity : AppCompatActivity() {
    }

    private fun handleRecreate() {
-        val isOldAndroidBuildRevision = {
-            // This fetches the date portion of the ID in order to determine the revision of
-            // Android 15 being used and whether we want to use the `recreate` API or not.
-            // If we fail to parse a date, we assume it is not an old revision.
-            "\\.([^.]+)\\."
-                .toRegex()
-                .find(Build.ID)
-                ?.groups
-                ?.get(1)
-                ?.value
-                ?.toIntOrNull()
-                ?.let { it <= ANDROID_15_BUG_MAX_REVISION } == true
-        }
-        if (Build.VERSION.SDK_INT == Build.VERSION_CODES.VANILLA_ICE_CREAM &&
-            isOldAndroidBuildRevision()
-        ) {
-            // This is done to avoid a bug in specific older revisions of Android 15. The bug has
-            // been fixed but certain phones that are no longer supported will never get the fix.
-            // The OS bug is tracked here: https://issuetracker.google.com/issues/370180732
-            startActivity(
-                Intent
-                    .makeMainActivity(componentName)
-                    .addFlags(Intent.FLAG_ACTIVITY_NO_ANIMATION),
-            )
-            finish()
-            overrideActivityTransition(OVERRIDE_TRANSITION_CLOSE, 0, 0)
-        } else {
-            ActivityCompat.recreate(this)
-        }
+        recreate()
    }

    private fun updateScreenCapture(isScreenCaptureAllowed: Boolean) {
--- a/app/src/main/kotlin/com/x8bit/bitwarden/MainViewModel.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/MainViewModel.kt
@@ -4,11 +4,10 @@ import android.content.Intent
 import android.os.Parcelable
 import androidx.lifecycle.SavedStateHandle
 import androidx.lifecycle.viewModelScope
-import com.bitwarden.core.data.manager.toast.ToastManager
 import com.bitwarden.ui.platform.base.BaseViewModel
 import com.bitwarden.ui.platform.feature.settings.appearance.model.AppTheme
-import com.bitwarden.ui.platform.manager.IntentManager
-import com.bitwarden.ui.platform.resource.BitwardenString
+import com.bitwarden.ui.util.Text
+import com.bitwarden.ui.util.asText
 import com.bitwarden.vault.CipherView
 import com.x8bit.bitwarden.data.auth.manager.AddTotpItemFromAuthenticatorManager
 import com.x8bit.bitwarden.data.auth.repository.AuthRepository
@@ -23,12 +22,13 @@ import com.x8bit.bitwarden.data.credentials.manager.BitwardenCredentialManager
 import com.x8bit.bitwarden.data.credentials.util.getCreateCredentialRequestOrNull
 import com.x8bit.bitwarden.data.credentials.util.getFido2AssertionRequestOrNull
 import com.x8bit.bitwarden.data.credentials.util.getGetCredentialsRequestOrNull
-import com.x8bit.bitwarden.data.credentials.util.getProviderGetPasswordRequestOrNull
 import com.x8bit.bitwarden.data.platform.manager.AppResumeManager
+import com.x8bit.bitwarden.data.platform.manager.FeatureFlagManager
 import com.x8bit.bitwarden.data.platform.manager.SpecialCircumstanceManager
 import com.x8bit.bitwarden.data.platform.manager.garbage.GarbageCollectionManager
 import com.x8bit.bitwarden.data.platform.manager.model.AppResumeScreenData
 import com.x8bit.bitwarden.data.platform.manager.model.CompleteRegistrationData
+import com.x8bit.bitwarden.data.platform.manager.model.FlagKey
 import com.x8bit.bitwarden.data.platform.manager.model.SpecialCircumstance
 import com.x8bit.bitwarden.data.platform.repository.EnvironmentRepository
 import com.x8bit.bitwarden.data.platform.repository.SettingsRepository
@@ -36,6 +36,7 @@ import com.x8bit.bitwarden.data.platform.util.isAddTotpLoginItemFromAuthenticato
 import com.x8bit.bitwarden.data.vault.manager.model.VaultStateEvent
 import com.x8bit.bitwarden.data.vault.repository.VaultRepository
 import com.x8bit.bitwarden.ui.platform.feature.settings.appearance.model.AppLanguage
+import com.x8bit.bitwarden.ui.platform.manager.intent.IntentManager
 import com.x8bit.bitwarden.ui.platform.model.FeatureFlagsState
 import com.x8bit.bitwarden.ui.platform.util.isAccountSecurityShortcut
 import com.x8bit.bitwarden.ui.platform.util.isMyVaultShortcut
@@ -43,15 +44,12 @@ import com.x8bit.bitwarden.ui.platform.util.isPasswordGeneratorShortcut
 import com.x8bit.bitwarden.ui.vault.model.TotpData
 import com.x8bit.bitwarden.ui.vault.util.getTotpDataOrNull
 import dagger.hilt.android.lifecycle.HiltViewModel
-import kotlinx.coroutines.FlowPreview
-import kotlinx.coroutines.flow.debounce
+import kotlinx.coroutines.delay
 import kotlinx.coroutines.flow.distinctUntilChanged
 import kotlinx.coroutines.flow.drop
-import kotlinx.coroutines.flow.filter
 import kotlinx.coroutines.flow.first
 import kotlinx.coroutines.flow.launchIn
 import kotlinx.coroutines.flow.map
-import kotlinx.coroutines.flow.merge
 import kotlinx.coroutines.flow.onEach
 import kotlinx.coroutines.flow.update
 import kotlinx.coroutines.launch
@@ -60,17 +58,17 @@ import java.time.Clock
 import javax.inject.Inject

 private const val SPECIAL_CIRCUMSTANCE_KEY = "special-circumstance"
-private const val ANIMATION_DEBOUNCE_DELAY_MS = 500L
+private const val ANIMATION_REFRESH_DELAY = 500L

 /**
 * A view model that helps launch actions for the [MainActivity].
 */
-@OptIn(FlowPreview::class)
@Suppress("LongParameterList", "TooManyFunctions")
@HiltViewModel
 class MainViewModel @Inject constructor(
    accessibilitySelectionManager: AccessibilitySelectionManager,
    autofillSelectionManager: AutofillSelectionManager,
+    featureFlagManager: FeatureFlagManager,
    private val addTotpItemFromAuthenticatorManager: AddTotpItemFromAuthenticatorManager,
    private val specialCircumstanceManager: SpecialCircumstanceManager,
    private val garbageCollectionManager: GarbageCollectionManager,
@@ -83,11 +81,13 @@ class MainViewModel @Inject constructor(
    private val savedStateHandle: SavedStateHandle,
    private val appResumeManager: AppResumeManager,
    private val clock: Clock,
-    private val toastManager: ToastManager,
 ) : BaseViewModel<MainState, MainEvent, MainAction>(
    initialState = MainState(
        theme = settingsRepository.appTheme,
        isScreenCaptureAllowed = settingsRepository.isScreenCaptureAllowed,
+        isErrorReportingDialogEnabled = featureFlagManager.getFeatureFlag(
+            key = FlagKey.MobileErrorReporting,
+        ),
        isDynamicColorsEnabled = settingsRepository.isDynamicColorsEnabled,
    ),
 ) {
@@ -106,6 +106,12 @@ class MainViewModel @Inject constructor(
            .onEach { specialCircumstance = it }
            .launchIn(viewModelScope)

+        featureFlagManager
+            .getFeatureFlagFlow(key = FlagKey.MobileErrorReporting)
+            .map { MainAction.Internal.OnMobileErrorReportingReceive(it) }
+            .onEach(::sendAction)
+            .launchIn(viewModelScope)
+
        accessibilitySelectionManager
            .accessibilitySelectionFlow
            .map { MainAction.Internal.AccessibilitySelectionReceive(it) }
@@ -139,23 +145,36 @@ class MainViewModel @Inject constructor(
            .onEach(::trySendAction)
            .launchIn(viewModelScope)

-        merge(
-            authRepository
-                .userStateFlow
-                .drop(count = 1)
-                // Trigger an action whenever the current user changes or we go into/out of a
-                // pending account state (which acts like switching to a temporary user).
-                .map { it?.activeUserId to it?.hasPendingAccountAddition }
-                .distinctUntilChanged(),
-            vaultRepository
-                .vaultStateEventFlow
-                .filter { it is VaultStateEvent.Locked },
-        )
-            // This debounce ensure we do not emit multiple times rapidly and also acts as a short
-            // delay to give animations time to finish (ex: account switcher).
-            .debounce(timeoutMillis = ANIMATION_DEBOUNCE_DELAY_MS)
-            .map { MainAction.Internal.CurrentUserOrVaultStateChange }
-            .onEach(::sendAction)
+        authRepository
+            .userStateFlow
+            .drop(count = 1)
+            // Trigger an action whenever the current user changes or we go into/out of a pending
+            // account state (which acts like switching to a temporary user).
+            .map { it?.activeUserId to it?.hasPendingAccountAddition }
+            .distinctUntilChanged()
+            .onEach {
+                // Switching between account states often involves some kind of animation (ex:
+                // account switcher) that we might want to give time to finish before triggering
+                // a refresh.
+                delay(ANIMATION_REFRESH_DELAY)
+                trySendAction(MainAction.Internal.CurrentUserStateChange)
+            }
+            .launchIn(viewModelScope)
+
+        vaultRepository
+            .vaultStateEventFlow
+            .onEach {
+                when (it) {
+                    is VaultStateEvent.Locked -> {
+                        // Similar to account switching, triggering this action too soon can
+                        // interfere with animations or navigation logic, so we will delay slightly.
+                        delay(ANIMATION_REFRESH_DELAY)
+                        trySendAction(MainAction.Internal.VaultUnlockStateChange)
+                    }
+
+                    is VaultStateEvent.Unlocked -> Unit
+                }
+            }
            .launchIn(viewModelScope)

        // On app launch, mark all active users as having previously logged in.
@@ -193,13 +212,22 @@ class MainViewModel @Inject constructor(
                handleAutofillSelectionReceive(action)
            }

-            is MainAction.Internal.CurrentUserOrVaultStateChange -> {
-                handleCurrentUserOrVaultStateChange()
-            }
-
+            is MainAction.Internal.CurrentUserStateChange -> handleCurrentUserStateChange()
            is MainAction.Internal.ScreenCaptureUpdate -> handleScreenCaptureUpdate(action)
            is MainAction.Internal.ThemeUpdate -> handleAppThemeUpdated(action)
+            is MainAction.Internal.VaultUnlockStateChange -> handleVaultUnlockStateChange()
            is MainAction.Internal.DynamicColorsUpdate -> handleDynamicColorsUpdate(action)
+            is MainAction.Internal.OnMobileErrorReportingReceive -> {
+                handleOnMobileErrorReportingReceive(action)
+            }
+        }
+    }
+
+    private fun handleOnMobileErrorReportingReceive(
+        action: MainAction.Internal.OnMobileErrorReportingReceive,
+    ) {
+        mutableStateFlow.update {
+            it.copy(isErrorReportingDialogEnabled = action.isErrorReportingEnabled)
        }
    }

@@ -232,9 +260,8 @@ class MainViewModel @Inject constructor(
        sendEvent(MainEvent.CompleteAutofill(cipherView = action.cipherView))
    }

-    private fun handleCurrentUserOrVaultStateChange() {
-        sendEvent(MainEvent.Recreate)
-        garbageCollectionManager.tryCollect()
+    private fun handleCurrentUserStateChange() {
+        recreateUiAndGarbageCollect()
    }

    private fun handleScreenCaptureUpdate(action: MainAction.Internal.ScreenCaptureUpdate) {
@@ -246,6 +273,10 @@ class MainViewModel @Inject constructor(
        sendEvent(MainEvent.UpdateAppTheme(osTheme = action.theme.osValue))
    }

+    private fun handleVaultUnlockStateChange() {
+        recreateUiAndGarbageCollect()
+    }
+
    private fun handleDynamicColorsUpdate(action: MainAction.Internal.DynamicColorsUpdate) {
        mutableStateFlow.update { it.copy(isDynamicColorsEnabled = action.isDynamicColorsEnabled) }
    }
@@ -294,7 +325,6 @@ class MainViewModel @Inject constructor(
        val createCredentialRequest = intent.getCreateCredentialRequestOrNull()
        val getCredentialsRequest = intent.getGetCredentialsRequestOrNull()
        val fido2AssertCredentialRequest = intent.getFido2AssertionRequestOrNull()
-        val providerGetPasswordRequest = intent.getProviderGetPasswordRequestOrNull()
        when {
            passwordlessRequestData != null -> {
                authRepository.activeUserId?.let {
@@ -385,19 +415,6 @@ class MainViewModel @Inject constructor(
                    )
            }

-            providerGetPasswordRequest != null -> {
-                // Set the user's verification status when a new GetPassword request is
-                // received to force explicit verification if the user's vault is
-                // unlocked when the request is received.
-                bitwardenCredentialManager.isUserVerified =
-                    providerGetPasswordRequest.isUserPreVerified
-
-                specialCircumstanceManager.specialCircumstance =
-                    SpecialCircumstance.ProviderGetPasswordRequest(
-                        passwordGetRequest = providerGetPasswordRequest,
-                    )
-            }
-
            getCredentialsRequest != null -> {
                specialCircumstanceManager.specialCircumstance =
                    SpecialCircumstance.ProviderGetCredentials(
@@ -421,6 +438,11 @@ class MainViewModel @Inject constructor(
        }
    }

+    private fun recreateUiAndGarbageCollect() {
+        sendEvent(MainEvent.Recreate)
+        garbageCollectionManager.tryCollect()
+    }
+
    private fun handleCompleteRegistrationData(data: CompleteRegistrationData) {
        viewModelScope.launch {
            // Attempt to load the environment for the user if they have a pre-auth environment
@@ -433,15 +455,15 @@ class MainViewModel @Inject constructor(
            )
            when (emailTokenResult) {
                is EmailTokenResult.Error -> {
-                    emailTokenResult
-                        .message
-                        ?.let { toastManager.show(message = it) }
-                        ?: run {
-                            toastManager.show(
-                                messageId = BitwardenString
-                                    .there_was_an_issue_validating_the_registration_token,
-                            )
-                        }
+                    sendEvent(
+                        MainEvent.ShowToast(
+                            message = emailTokenResult
+                                .message
+                                ?.asText()
+                                ?: R.string.there_was_an_issue_validating_the_registration_token
+                                    .asText(),
+                        ),
+                    )
                }

                EmailTokenResult.Expired -> {
@@ -473,12 +495,15 @@ data class MainState(
    val theme: AppTheme,
    val isScreenCaptureAllowed: Boolean,
    val isDynamicColorsEnabled: Boolean,
+    private val isErrorReportingDialogEnabled: Boolean,
 ) : Parcelable {
    /**
     * Contains all feature flags that are available to the UI.
     */
    val featureFlagsState: FeatureFlagsState
-        get() = FeatureFlagsState
+        get() = FeatureFlagsState(
+            isErrorReportingDialogEnabled = isErrorReportingDialogEnabled,
+        )
 }

 /**
@@ -523,6 +548,13 @@ sealed class MainAction {
            val cipherView: CipherView,
        ) : Internal()

+        /**
+         * Indicates the Mobile Error Reporting feature flag has been updated.
+         */
+        data class OnMobileErrorReportingReceive(
+            val isErrorReportingEnabled: Boolean,
+        ) : Internal()
+
        /**
         * Indicates the user has manually selected the given [cipherView] for autofill.
         */
@@ -531,9 +563,9 @@ sealed class MainAction {
        ) : Internal()

        /**
-         * Indicates a relevant change in the current user state or vault locked state.
+         * Indicates a relevant change in the current user state.
         */
-        data object CurrentUserOrVaultStateChange : Internal()
+        data object CurrentUserStateChange : Internal()

        /**
         * Indicates that the screen capture state has changed.
@@ -549,6 +581,11 @@ sealed class MainAction {
            val theme: AppTheme,
        ) : Internal()

+        /**
+         * Indicates a relevant change in the current vault lock state.
+         */
+        data object VaultUnlockStateChange : Internal()
+
        /**
         * Indicates that the dynamic colors state has changed.
         */
@@ -584,6 +621,11 @@ sealed class MainEvent {
     */
    data object NavigateToDebugMenu : MainEvent()

+    /**
+     * Show a toast with the given [message].
+     */
+    data class ShowToast(val message: Text) : MainEvent()
+
    /**
     * Indicates that the app language has been updated.
     */
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/AuthDiskSource.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/AuthDiskSource.kt
@@ -1,6 +1,5 @@
 package com.x8bit.bitwarden.data.auth.datasource.disk

-import com.bitwarden.network.model.AccountKeysJson
 import com.bitwarden.network.model.SyncResponseJson
 import com.bitwarden.network.provider.AppIdProvider
 import com.x8bit.bitwarden.data.auth.datasource.disk.model.AccountTokensJson
@@ -127,34 +126,13 @@ interface AuthDiskSource : AppIdProvider {
    /**
     * Retrieves a private key using a [userId].
     */
-    @Deprecated(
-        message = "Use getAccountKeys instead.",
-        replaceWith = ReplaceWith("getAccountKeys"),
-    )
    fun getPrivateKey(userId: String): String?

    /**
     * Stores a private key using a [userId].
     */
-    @Deprecated(
-        message = "Use storeAccountKeys instead.",
-        replaceWith = ReplaceWith("storeAccountKeys"),
-    )
    fun storePrivateKey(userId: String, privateKey: String?)

-    /**
-     * Returns the profile account keys for the given [userId].
-     */
-    fun getAccountKeys(userId: String): AccountKeysJson?
-
-    /**
-     * Stores the profile account keys for the given [userId].
-     */
-    fun storeAccountKeys(
-        userId: String,
-        accountKeys: AccountKeysJson?,
-    )
-
    /**
     * Retrieves a user auto-unlock key for the given [userId].
     */
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/AuthDiskSourceImpl.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/AuthDiskSourceImpl.kt
@@ -4,7 +4,6 @@ import android.content.SharedPreferences
 import com.bitwarden.core.data.repository.util.bufferedMutableSharedFlow
 import com.bitwarden.core.data.util.decodeFromStringOrNull
 import com.bitwarden.data.datasource.disk.BaseEncryptedDiskSource
-import com.bitwarden.network.model.AccountKeysJson
 import com.bitwarden.network.model.SyncResponseJson
 import com.x8bit.bitwarden.data.auth.datasource.disk.model.AccountTokensJson
 import com.x8bit.bitwarden.data.auth.datasource.disk.model.OnboardingStatus
@@ -49,7 +48,6 @@ private const val USES_KEY_CONNECTOR = "usesKeyConnector"
 private const val ONBOARDING_STATUS_KEY = "onboardingStatus"
 private const val SHOW_IMPORT_LOGINS_KEY = "showImportLogins"
 private const val LAST_LOCK_TIMESTAMP = "lastLockTimestamp"
-private const val PROFILE_ACCOUNT_KEYS_KEY = "profileAccountKeys"

 /**
 * Primary implementation of [AuthDiskSource].
@@ -144,7 +142,6 @@ class AuthDiskSourceImpl(
        storePinProtectedUserKey(userId = userId, pinProtectedUserKey = null)
        storeEncryptedPin(userId = userId, encryptedPin = null)
        storePrivateKey(userId = userId, privateKey = null)
-        storeAccountKeys(userId = userId, accountKeys = null)
        storeOrganizationKeys(userId = userId, organizationKeys = null)
        storeOrganizations(userId = userId, organizations = null)
        storeUserBiometricInitVector(userId = userId, iv = null)
@@ -231,11 +228,9 @@ class AuthDiskSourceImpl(
        )
    }

-    @Deprecated("Use getAccountKeys instead.", replaceWith = ReplaceWith("getAccountKeys"))
    override fun getPrivateKey(userId: String): String? =
        getString(key = MASTER_KEY_ENCRYPTION_PRIVATE_KEY.appendIdentifier(userId))

-    @Deprecated("Use storeAccountKeys instead.", replaceWith = ReplaceWith("storeAccountKeys"))
    override fun storePrivateKey(userId: String, privateKey: String?) {
        putString(
            key = MASTER_KEY_ENCRYPTION_PRIVATE_KEY.appendIdentifier(userId),
@@ -243,20 +238,6 @@ class AuthDiskSourceImpl(
        )
    }

-    override fun getAccountKeys(userId: String): AccountKeysJson? =
-        getEncryptedString(key = PROFILE_ACCOUNT_KEYS_KEY.appendIdentifier(userId))
-            ?.let { json.decodeFromStringOrNull(it) }
-
-    override fun storeAccountKeys(
-        userId: String,
-        accountKeys: AccountKeysJson?,
-    ) {
-        putEncryptedString(
-            key = PROFILE_ACCOUNT_KEYS_KEY.appendIdentifier(userId),
-            value = accountKeys?.let { json.encodeToString(it) },
-        )
-    }
-
    override fun getUserAutoUnlockKey(userId: String): String? =
        getEncryptedString(
            key = USER_AUTO_UNLOCK_KEY_KEY.appendIdentifier(userId),
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/di/AuthDiskModule.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/di/AuthDiskModule.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/AccountJson.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/AccountJson.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/AccountTokensJson.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/AccountTokensJson.kt
@@ -2,14 +2,12 @@ package com.x8bit.bitwarden.data.auth.datasource.disk.model

 import kotlinx.serialization.SerialName
 import kotlinx.serialization.Serializable
-import java.time.Instant

 /**
 * Container for the user's API tokens.
 *
 * @property accessToken The user's primary access token.
 * @property refreshToken The user's refresh token.
- * @property expiresAtSec The time at which the token expires in epoch seconds.
 */
@Serializable
 data class AccountTokensJson(
@@ -18,9 +16,6 @@ data class AccountTokensJson(

    @SerialName("refreshToken")
    val refreshToken: String?,
-
-    @SerialName("expiresAtSec")
-    val expiresAtSec: Long = Instant.MAX.epochSecond,
 ) {
    /**
     * Returns `true` if the user is logged in, `false otherwise.
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/ForcePasswordResetReason.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/ForcePasswordResetReason.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/OnboardingStatus.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/OnboardingStatus.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/PendingAuthRequestJson.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/PendingAuthRequestJson.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/UserStateJson.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/disk/model/UserStateJson.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/network/di/AuthNetworkModule.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/network/di/AuthNetworkModule.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/network/model/DeviceDataModel.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/network/model/DeviceDataModel.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/sdk/AuthSdkSource.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/sdk/AuthSdkSource.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/sdk/AuthSdkSourceImpl.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/sdk/AuthSdkSourceImpl.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/sdk/di/AuthSdkModule.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/sdk/di/AuthSdkModule.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/sdk/model/PasswordStrength.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/sdk/model/PasswordStrength.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/sdk/util/KdfExtensions.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/sdk/util/KdfExtensions.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/sdk/util/PasswordStrengthExtensions.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/sdk/util/PasswordStrengthExtensions.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/AddTotpItemFromAuthenticatorManager.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/AddTotpItemFromAuthenticatorManager.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/AddTotpItemFromAuthenticatorManagerImpl.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/AddTotpItemFromAuthenticatorManagerImpl.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/AuthRequestManager.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/AuthRequestManager.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/AuthRequestManagerImpl.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/AuthRequestManagerImpl.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/AuthRequestNotificationManager.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/AuthRequestNotificationManager.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/AuthRequestNotificationManagerImpl.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/AuthRequestNotificationManagerImpl.kt
@@ -7,13 +7,12 @@ import androidx.compose.ui.graphics.Color
 import androidx.core.app.NotificationChannelCompat
 import androidx.core.app.NotificationCompat
 import androidx.core.app.NotificationManagerCompat
-import com.bitwarden.annotation.OmitFromCoverage
-import com.bitwarden.core.util.toPendingIntentMutabilityFlag
+import com.bitwarden.core.annotation.OmitFromCoverage
 import com.bitwarden.data.manager.DispatcherManager
-import com.bitwarden.ui.platform.resource.BitwardenDrawable
-import com.bitwarden.ui.platform.resource.BitwardenString
+import com.x8bit.bitwarden.R
 import com.x8bit.bitwarden.data.auth.datasource.disk.AuthDiskSource
 import com.x8bit.bitwarden.data.auth.util.createPasswordlessRequestDataIntent
+import com.x8bit.bitwarden.data.autofill.util.toPendingIntentMutabilityFlag
 import com.x8bit.bitwarden.data.platform.manager.PushManager
 import com.x8bit.bitwarden.data.platform.manager.model.PasswordlessRequestData
 import kotlinx.coroutines.CoroutineScope
@@ -49,14 +48,14 @@ class AuthRequestNotificationManagerImpl(
                    NOTIFICATION_CHANNEL_ID,
                    NotificationManagerCompat.IMPORTANCE_DEFAULT,
                )
-                .setName(context.getString(BitwardenString.pending_log_in_requests))
+                .setName(context.getString(R.string.pending_log_in_requests))
                .build(),
        )
        if (!notificationManager.areNotificationsEnabled(NOTIFICATION_CHANNEL_ID)) return
        // Create the notification
        val builder = NotificationCompat.Builder(context, NOTIFICATION_CHANNEL_ID)
            .setContentIntent(createContentIntent(data))
-            .setContentTitle(context.getString(BitwardenString.log_in_requested))
+            .setContentTitle(context.getString(R.string.log_in_requested))
            .setContentText(
                authDiskSource
                    .userState
@@ -64,10 +63,10 @@ class AuthRequestNotificationManagerImpl(
                    ?.get(data.userId)
                    ?.profile
                    ?.email
-                    ?.let { context.getString(BitwardenString.confim_log_in_attemp_for_x, it) }
-                    ?: context.getString(BitwardenString.confirm_log_in),
+                    ?.let { context.getString(R.string.confim_log_in_attemp_for_x, it) }
+                    ?: context.getString(R.string.confirm_log_in),
            )
-            .setSmallIcon(BitwardenDrawable.ic_notification)
+            .setSmallIcon(R.drawable.ic_notification)
            .setColor(Color.White.value.toInt())
            .setAutoCancel(true)
            .setTimeoutAfter(NOTIFICATION_DEFAULT_TIMEOUT_MILLIS)
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/AuthTokenManager.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/AuthTokenManager.kt
--- a/app/src/main/java/com/x8bit/bitwarden/data/auth/manager/AuthTokenManagerImpl.kt
+++ b/app/src/main/java/com/x8bit/bitwarden/data/auth/manager/AuthTokenManagerImpl.kt
@@ -0,0 +1,17 @@
+package com.x8bit.bitwarden.data.auth.manager
+
+import com.x8bit.bitwarden.data.auth.datasource.disk.AuthDiskSource
+
+/**
+ * Default implementation of [AuthTokenManager].
+ */
+class AuthTokenManagerImpl(
+    private val authDiskSource: AuthDiskSource,
+) : AuthTokenManager {
+
+    override fun getActiveAccessTokenOrNull(): String? = authDiskSource
+        .userState
+        ?.activeUserId
+        ?.let { authDiskSource.getAccountTokens(it) }
+        ?.accessToken
+}
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/KeyConnectorManager.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/KeyConnectorManager.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/KeyConnectorManagerImpl.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/KeyConnectorManagerImpl.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/TrustedDeviceManager.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/TrustedDeviceManager.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/TrustedDeviceManagerImpl.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/TrustedDeviceManagerImpl.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/UserLogoutManager.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/UserLogoutManager.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/UserLogoutManagerImpl.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/UserLogoutManagerImpl.kt
@@ -1,10 +1,11 @@
 package com.x8bit.bitwarden.data.auth.manager

+import android.content.Context
+import android.widget.Toast
 import androidx.annotation.StringRes
-import com.bitwarden.core.data.manager.toast.ToastManager
 import com.bitwarden.core.data.repository.util.bufferedMutableSharedFlow
 import com.bitwarden.data.manager.DispatcherManager
-import com.bitwarden.ui.platform.resource.BitwardenString
+import com.x8bit.bitwarden.R
 import com.x8bit.bitwarden.data.auth.datasource.disk.AuthDiskSource
 import com.x8bit.bitwarden.data.auth.manager.model.LogoutEvent
 import com.x8bit.bitwarden.data.auth.repository.model.LogoutReason
@@ -26,15 +27,15 @@ import timber.log.Timber
 */
@Suppress("LongParameterList")
 class UserLogoutManagerImpl(
+    private val context: Context,
    private val authDiskSource: AuthDiskSource,
    private val generatorDiskSource: GeneratorDiskSource,
    private val passwordHistoryDiskSource: PasswordHistoryDiskSource,
    private val pushDiskSource: PushDiskSource,
    private val settingsDiskSource: SettingsDiskSource,
-    private val toastManager: ToastManager,
    private val vaultDiskSource: VaultDiskSource,
-    private val vaultSdkSource: VaultSdkSource,
    dispatcherManager: DispatcherManager,
+    private val vaultSdkSource: VaultSdkSource,
 ) : UserLogoutManager {
    private val scope = CoroutineScope(dispatcherManager.unconfined)
    private val mainScope = CoroutineScope(dispatcherManager.main)
@@ -48,7 +49,7 @@ class UserLogoutManagerImpl(
        Timber.d("logout reason=$reason")
        val isExpired = reason == LogoutReason.SecurityStamp
        if (isExpired) {
-            showToast(message = BitwardenString.login_expired)
+            showToast(message = R.string.login_expired)
        }

        val ableToSwitchToNewAccount = switchUserIfAvailable(
@@ -70,7 +71,7 @@ class UserLogoutManagerImpl(
        Timber.d("softLogout reason=$reason")
        val isExpired = reason == LogoutReason.SecurityStamp
        if (isExpired) {
-            showToast(message = BitwardenString.login_expired)
+            showToast(message = R.string.login_expired)
        }
        authDiskSource.storeAccountTokens(
            userId = userId,
@@ -80,7 +81,6 @@ class UserLogoutManagerImpl(
        // Save any data that will still need to be retained after otherwise clearing all dat
        val vaultTimeoutInMinutes = settingsDiskSource.getVaultTimeoutInMinutes(userId = userId)
        val vaultTimeoutAction = settingsDiskSource.getVaultTimeoutAction(userId = userId)
-        val pinProtectedUserKey = authDiskSource.getPinProtectedUserKey(userId = userId)

        switchUserIfAvailable(
            currentUserId = userId,
@@ -102,10 +102,6 @@ class UserLogoutManagerImpl(
                vaultTimeoutAction = vaultTimeoutAction,
            )
        }
-        authDiskSource.storePinProtectedUserKey(
-            userId = userId,
-            pinProtectedUserKey = pinProtectedUserKey,
-        )
    }

    private fun clearData(userId: String) {
@@ -121,7 +117,7 @@ class UserLogoutManagerImpl(
    }

    private fun showToast(@StringRes message: Int) {
-        mainScope.launch { toastManager.show(messageId = message) }
+        mainScope.launch { Toast.makeText(context, message, Toast.LENGTH_SHORT).show() }
    }

    private fun switchUserIfAvailable(
@@ -140,7 +136,7 @@ class UserLogoutManagerImpl(
        // Check if there is a new active user
        return if (updatedAccounts.isNotEmpty()) {
            if (currentUserId == currentUserState.activeUserId && !isExpired) {
-                showToast(message = BitwardenString.account_switched_automatically)
+                showToast(message = R.string.account_switched_automatically)
            }

            // If we logged out a non-active user, we want to leave the active user unchanged.
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/di/AuthManagerModule.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/di/AuthManagerModule.kt
@@ -1,7 +1,6 @@
 package com.x8bit.bitwarden.data.auth.manager.di

 import android.content.Context
-import com.bitwarden.core.data.manager.toast.ToastManager
 import com.bitwarden.data.manager.DispatcherManager
 import com.bitwarden.network.service.AccountsService
 import com.bitwarden.network.service.AuthRequestsService
@@ -108,23 +107,23 @@ object AuthManagerModule {
    @Provides
    @Singleton
    fun provideUserLogoutManager(
+        @ApplicationContext context: Context,
        authDiskSource: AuthDiskSource,
        generatorDiskSource: GeneratorDiskSource,
        passwordHistoryDiskSource: PasswordHistoryDiskSource,
        pushDiskSource: PushDiskSource,
        settingsDiskSource: SettingsDiskSource,
-        toastManager: ToastManager,
        vaultDiskSource: VaultDiskSource,
        vaultSdkSource: VaultSdkSource,
        dispatcherManager: DispatcherManager,
    ): UserLogoutManager =
        UserLogoutManagerImpl(
+            context = context,
            authDiskSource = authDiskSource,
            generatorDiskSource = generatorDiskSource,
            passwordHistoryDiskSource = passwordHistoryDiskSource,
            pushDiskSource = pushDiskSource,
            settingsDiskSource = settingsDiskSource,
-            toastManager = toastManager,
            vaultDiskSource = vaultDiskSource,
            vaultSdkSource = vaultSdkSource,
            dispatcherManager = dispatcherManager,
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/model/AuthRequest.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/model/AuthRequest.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/model/AuthRequestResult.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/model/AuthRequestResult.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/model/AuthRequestType.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/model/AuthRequestType.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/model/AuthRequestUpdatesResult.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/model/AuthRequestUpdatesResult.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/model/AuthRequestsResult.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/model/AuthRequestsResult.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/model/AuthRequestsUpdatesResult.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/model/AuthRequestsUpdatesResult.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/model/CreateAuthRequestResult.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/model/CreateAuthRequestResult.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/model/LogoutEvent.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/model/LogoutEvent.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/model/MigrateExistingUserToKeyConnectorResult.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/model/MigrateExistingUserToKeyConnectorResult.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/util/AuthRequestTypeExtensions.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/util/AuthRequestTypeExtensions.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/util/TrustDeviceResponseExtensions.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/util/TrustDeviceResponseExtensions.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/repository/AuthRepository.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/repository/AuthRepository.kt
@@ -15,6 +15,7 @@ import com.x8bit.bitwarden.data.auth.repository.model.LeaveOrganizationResult
 import com.x8bit.bitwarden.data.auth.repository.model.LoginResult
 import com.x8bit.bitwarden.data.auth.repository.model.LogoutReason
 import com.x8bit.bitwarden.data.auth.repository.model.NewSsoUserResult
+import com.x8bit.bitwarden.data.auth.repository.model.OrganizationDomainSsoDetailsResult
 import com.x8bit.bitwarden.data.auth.repository.model.PasswordHintResult
 import com.x8bit.bitwarden.data.auth.repository.model.PasswordStrengthResult
 import com.x8bit.bitwarden.data.auth.repository.model.PolicyInformation
@@ -32,6 +33,7 @@ import com.x8bit.bitwarden.data.auth.repository.model.ValidatePasswordResult
 import com.x8bit.bitwarden.data.auth.repository.model.ValidatePinResult
 import com.x8bit.bitwarden.data.auth.repository.model.VerifiedOrganizationDomainSsoDetailsResult
 import com.x8bit.bitwarden.data.auth.repository.model.VerifyOtpResult
+import com.x8bit.bitwarden.data.auth.repository.util.CaptchaCallbackTokenResult
 import com.x8bit.bitwarden.data.auth.repository.util.DuoCallbackTokenResult
 import com.x8bit.bitwarden.data.auth.repository.util.SsoCallbackResult
 import com.x8bit.bitwarden.data.auth.repository.util.WebAuthResult
@@ -55,6 +57,12 @@ interface AuthRepository : AuthenticatorProvider, AuthRequestManager {
     */
    val userStateFlow: StateFlow<UserState?>

+    /**
+     * Flow of the current [CaptchaCallbackTokenResult]. Subscribers should listen to the flow
+     * in order to receive updates whenever [setCaptchaCallbackTokenResult] is called.
+     */
+    val captchaTokenResultFlow: Flow<CaptchaCallbackTokenResult>
+
    /**
     * Flow of the current [DuoCallbackTokenResult]. Subscribers should listen to the flow
     * in order to receive updates whenever [setDuoCallbackTokenResult] is called.
@@ -179,6 +187,7 @@ interface AuthRepository : AuthenticatorProvider, AuthRequestManager {
    suspend fun login(
        email: String,
        password: String,
+        captchaToken: String?,
    ): LoginResult

    /**
@@ -193,6 +202,7 @@ interface AuthRepository : AuthenticatorProvider, AuthRequestManager {
        asymmetricalKey: String,
        requestPrivateKey: String,
        masterPasswordHash: String?,
+        captchaToken: String?,
    ): LoginResult

    /**
@@ -204,6 +214,7 @@ interface AuthRepository : AuthenticatorProvider, AuthRequestManager {
        email: String,
        password: String?,
        twoFactorData: TwoFactorDataModel,
+        captchaToken: String?,
        orgIdentifier: String?,
    ): LoginResult

@@ -216,6 +227,7 @@ interface AuthRepository : AuthenticatorProvider, AuthRequestManager {
        ssoCode: String,
        ssoCodeVerifier: String,
        ssoRedirectUri: String,
+        captchaToken: String?,
        organizationIdentifier: String,
    ): LoginResult

@@ -228,6 +240,7 @@ interface AuthRepository : AuthenticatorProvider, AuthRequestManager {
        email: String,
        password: String?,
        newDeviceOtp: String,
+        captchaToken: String?,
        orgIdentifier: String?,
    ): LoginResult

@@ -282,6 +295,7 @@ interface AuthRepository : AuthenticatorProvider, AuthRequestManager {
        masterPassword: String,
        masterPasswordHint: String?,
        emailVerificationToken: String? = null,
+        captchaToken: String?,
        shouldCheckDataBreaches: Boolean,
        isMasterPasswordStrong: Boolean,
    ): RegisterResult
@@ -319,6 +333,11 @@ interface AuthRepository : AuthenticatorProvider, AuthRequestManager {
        passwordHint: String?,
    ): SetPasswordResult

+    /**
+     * Set the value of [captchaTokenResultFlow].
+     */
+    fun setCaptchaCallbackTokenResult(tokenResult: CaptchaCallbackTokenResult)
+
    /**
     * Set the value of [duoTokenResultFlow].
     */
@@ -334,6 +353,13 @@ interface AuthRepository : AuthenticatorProvider, AuthRequestManager {
     */
    fun setWebAuthResult(webAuthResult: WebAuthResult)

+    /**
+     * Checks for a claimed domain organization for the [email] that can be used for an SSO request.
+     */
+    suspend fun getOrganizationDomainSsoDetails(
+        email: String,
+    ): OrganizationDomainSsoDetailsResult
+
    /**
     * Get the verified organization domain SSO details for the given [email].
     */
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/repository/AuthRepositoryImpl.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/repository/AuthRepositoryImpl.kt
@@ -65,6 +65,7 @@ import com.x8bit.bitwarden.data.auth.repository.model.LeaveOrganizationResult
 import com.x8bit.bitwarden.data.auth.repository.model.LoginResult
 import com.x8bit.bitwarden.data.auth.repository.model.LogoutReason
 import com.x8bit.bitwarden.data.auth.repository.model.NewSsoUserResult
+import com.x8bit.bitwarden.data.auth.repository.model.OrganizationDomainSsoDetailsResult
 import com.x8bit.bitwarden.data.auth.repository.model.PasswordHintResult
 import com.x8bit.bitwarden.data.auth.repository.model.PasswordStrengthResult
 import com.x8bit.bitwarden.data.auth.repository.model.PolicyInformation
@@ -87,6 +88,7 @@ import com.x8bit.bitwarden.data.auth.repository.model.VaultUnlockType
 import com.x8bit.bitwarden.data.auth.repository.model.VerifiedOrganizationDomainSsoDetailsResult
 import com.x8bit.bitwarden.data.auth.repository.model.VerifyOtpResult
 import com.x8bit.bitwarden.data.auth.repository.model.toLoginErrorResult
+import com.x8bit.bitwarden.data.auth.repository.util.CaptchaCallbackTokenResult
 import com.x8bit.bitwarden.data.auth.repository.util.DuoCallbackTokenResult
 import com.x8bit.bitwarden.data.auth.repository.util.SsoCallbackResult
 import com.x8bit.bitwarden.data.auth.repository.util.WebAuthResult
@@ -110,6 +112,7 @@ import com.x8bit.bitwarden.data.auth.util.YubiKeyResult
 import com.x8bit.bitwarden.data.auth.util.toSdkParams
 import com.x8bit.bitwarden.data.platform.error.MissingPropertyException
 import com.x8bit.bitwarden.data.platform.error.NoActiveUserException
+import com.x8bit.bitwarden.data.platform.manager.FeatureFlagManager
 import com.x8bit.bitwarden.data.platform.manager.FirstTimeActionManager
 import com.x8bit.bitwarden.data.platform.manager.LogsManager
 import com.x8bit.bitwarden.data.platform.manager.PolicyManager
@@ -145,7 +148,6 @@ import kotlinx.coroutines.flow.onEach
 import kotlinx.coroutines.flow.receiveAsFlow
 import kotlinx.coroutines.flow.stateIn
 import kotlinx.coroutines.flow.update
-import java.time.Clock
 import javax.inject.Singleton

 /**
@@ -154,7 +156,6 @@ import javax.inject.Singleton
@Suppress("LargeClass", "LongParameterList", "TooManyFunctions")
@Singleton
 class AuthRepositoryImpl(
-    private val clock: Clock,
    private val accountsService: AccountsService,
    private val devicesService: DevicesService,
    private val haveIBeenPwnedService: HaveIBeenPwnedService,
@@ -172,6 +173,7 @@ class AuthRepositoryImpl(
    private val trustedDeviceManager: TrustedDeviceManager,
    private val userLogoutManager: UserLogoutManager,
    private val policyManager: PolicyManager,
+    private val featureFlagManager: FeatureFlagManager,
    firstTimeActionManager: FirstTimeActionManager,
    logsManager: LogsManager,
    pushManager: PushManager,
@@ -330,6 +332,10 @@ class AuthRepositoryImpl(
                ),
        )

+    private val captchaTokenChannel = Channel<CaptchaCallbackTokenResult>(capacity = Int.MAX_VALUE)
+    override val captchaTokenResultFlow: Flow<CaptchaCallbackTokenResult> =
+        captchaTokenChannel.receiveAsFlow()
+
    private val duoTokenChannel = Channel<DuoCallbackTokenResult>(capacity = Int.MAX_VALUE)
    override val duoTokenResultFlow: Flow<DuoCallbackTokenResult> = duoTokenChannel.receiveAsFlow()

@@ -401,7 +407,10 @@ class AuthRepositoryImpl(
            .onEach {
                val userId = activeUserId ?: return@onEach
                // TODO: [PM-20593] Investigate why tokens are explicitly refreshed.
-                refreshAccessTokenSynchronously(userId = userId)
+                refreshAccessTokenSynchronouslyInternal(
+                    userId = userId,
+                    logOutOnFailure = false,
+                )
                vaultRepository.sync(forced = true)
            }
            // This requires the ioScope to ensure that refreshAccessTokenSynchronously
@@ -558,10 +567,6 @@ class AuthRepositoryImpl(
                            .map { keys }
                    }
                    .onSuccess { keys ->
-                        // TDE and SSO user creation still uses crypto-v1. These users are not
-                        // expected to have the AEAD keys so we only store the private key for now.
-                        // See https://github.com/bitwarden/android/pull/5682#discussion_r2273940332
-                        // for more details.
                        authDiskSource.storePrivateKey(
                            userId = userId,
                            privateKey = keys.privateKey,
@@ -590,15 +595,11 @@ class AuthRepositoryImpl(
        val profile = authDiskSource.userState?.activeAccount?.profile
            ?: return LoginResult.Error(errorMessage = null, error = NoActiveUserException())
        val userId = profile.userId
-        val accountKeys = authDiskSource.getAccountKeys(userId = userId)
-        val privateKey = accountKeys?.publicKeyEncryptionKeyPair?.wrappedPrivateKey
-            ?: authDiskSource.getPrivateKey(userId = userId)
+        val privateKey = authDiskSource.getPrivateKey(userId = userId)
            ?: return LoginResult.Error(
                errorMessage = null,
                error = MissingPropertyException("Private Key"),
            )
-        val signingKey = accountKeys?.signatureKeyPair?.wrappedSigningKey
-        val securityState = accountKeys?.securityState?.securityState

        checkForVaultUnlockError(
            onVaultUnlockError = { error ->
@@ -608,8 +609,6 @@ class AuthRepositoryImpl(
            unlockVault(
                accountProfile = profile,
                privateKey = privateKey,
-                signingKey = signingKey,
-                securityState = securityState,
                initUserCryptoMethod = InitUserCryptoMethod.AuthRequest(
                    requestPrivateKey = requestPrivateKey,
                    method = AuthRequestMethod.UserKey(protectedUserKey = asymmetricalKey),
@@ -624,6 +623,7 @@ class AuthRepositoryImpl(
    override suspend fun login(
        email: String,
        password: String,
+        captchaToken: String?,
    ): LoginResult = identityService
        .preLogin(email = email)
        .flatMap {
@@ -642,6 +642,7 @@ class AuthRepositoryImpl(
                    username = email,
                    password = passwordHash,
                ),
+                captchaToken = captchaToken,
            )
        }
        .fold(
@@ -661,6 +662,7 @@ class AuthRepositoryImpl(
        asymmetricalKey: String,
        requestPrivateKey: String,
        masterPasswordHash: String?,
+        captchaToken: String?,
    ): LoginResult =
        loginCommon(
            email = email,
@@ -675,12 +677,14 @@ class AuthRepositoryImpl(
                asymmetricalKey = asymmetricalKey,
                privateKey = requestPrivateKey,
            ),
+            captchaToken = captchaToken,
        )

    override suspend fun login(
        email: String,
        password: String?,
        twoFactorData: TwoFactorDataModel,
+        captchaToken: String?,
        orgIdentifier: String?,
    ): LoginResult = identityTokenAuthModel
        ?.let {
@@ -689,6 +693,7 @@ class AuthRepositoryImpl(
                password = password,
                authModel = it,
                twoFactorData = twoFactorData,
+                captchaToken = captchaToken ?: twoFactorResponse?.captchaToken,
                deviceData = twoFactorDeviceData,
                orgIdentifier = orgIdentifier,
            )
@@ -702,6 +707,7 @@ class AuthRepositoryImpl(
        email: String,
        password: String?,
        newDeviceOtp: String,
+        captchaToken: String?,
        orgIdentifier: String?,
    ): LoginResult = identityTokenAuthModel
        ?.let {
@@ -710,6 +716,7 @@ class AuthRepositoryImpl(
                password = password,
                authModel = it,
                newDeviceOtp = newDeviceOtp,
+                captchaToken = captchaToken ?: twoFactorResponse?.captchaToken,
                deviceData = twoFactorDeviceData,
                orgIdentifier = orgIdentifier,
            )
@@ -743,6 +750,7 @@ class AuthRepositoryImpl(
        ssoCode: String,
        ssoCodeVerifier: String,
        ssoRedirectUri: String,
+        captchaToken: String?,
        organizationIdentifier: String,
    ): LoginResult = loginCommon(
        email = email,
@@ -751,62 +759,15 @@ class AuthRepositoryImpl(
            ssoCodeVerifier = ssoCodeVerifier,
            ssoRedirectUri = ssoRedirectUri,
        ),
+        captchaToken = captchaToken,
        orgIdentifier = organizationIdentifier,
    )

-    override fun refreshAccessTokenSynchronously(
-        userId: String,
-    ): Result<String> {
-        val refreshToken = authDiskSource
-            .getAccountTokens(userId = userId)
-            ?.refreshToken
-            ?: return IllegalStateException("Must be logged in.").asFailure()
-        return identityService
-            .refreshTokenSynchronously(refreshToken)
-            .flatMap { refreshTokenResponse ->
-                // Check to make sure the user is still logged in after making the request
-                authDiskSource
-                    .userState
-                    ?.accounts
-                    ?.get(userId)
-                    ?.let { refreshTokenResponse.asSuccess() }
-                    ?: IllegalStateException("Must be logged in.").asFailure()
-            }
-            .flatMap { refreshTokenResponse ->
-                when (refreshTokenResponse) {
-                    is RefreshTokenResponseJson.Error -> {
-                        if (refreshTokenResponse.isInvalidGrant) {
-                            logout(userId = userId, reason = LogoutReason.InvalidGrant)
-                        }
-                        IllegalStateException(refreshTokenResponse.error).asFailure()
-                    }
-
-                    is RefreshTokenResponseJson.Forbidden -> {
-                        logout(userId = userId, reason = LogoutReason.RefreshForbidden)
-                        refreshTokenResponse.error.asFailure()
-                    }
-
-                    is RefreshTokenResponseJson.Unauthorized -> {
-                        logout(userId = userId, reason = LogoutReason.RefreshUnauthorized)
-                        refreshTokenResponse.error.asFailure()
-                    }
-
-                    is RefreshTokenResponseJson.Success -> {
-                        // Store the new token information
-                        authDiskSource.storeAccountTokens(
-                            userId = userId,
-                            accountTokens = AccountTokensJson(
-                                accessToken = refreshTokenResponse.accessToken,
-                                refreshToken = refreshTokenResponse.refreshToken,
-                                expiresAtSec = clock.instant().epochSecond +
-                                    refreshTokenResponse.expiresIn,
-                            ),
-                        )
-                        refreshTokenResponse.accessToken.asSuccess()
-                    }
-                }
-            }
-    }
+    override fun refreshAccessTokenSynchronously(userId: String): Result<RefreshTokenResponseJson> =
+        refreshAccessTokenSynchronouslyInternal(
+            userId = userId,
+            logOutOnFailure = true,
+        )

    override fun logout(reason: LogoutReason) {
        activeUserId?.let { userId -> logout(userId = userId, reason = reason) }
@@ -900,6 +861,7 @@ class AuthRepositoryImpl(
        masterPassword: String,
        masterPasswordHint: String?,
        emailVerificationToken: String?,
+        captchaToken: String?,
        shouldCheckDataBreaches: Boolean,
        isMasterPasswordStrong: Boolean,
    ): RegisterResult {
@@ -934,6 +896,7 @@ class AuthRepositoryImpl(
                            email = email,
                            masterPasswordHash = registerKeyResponse.masterPasswordHash,
                            masterPasswordHint = masterPasswordHint,
+                            captchaResponse = captchaToken,
                            key = registerKeyResponse.encryptedUserKey,
                            keys = RegisterRequestJson.Keys(
                                publicKey = registerKeyResponse.keys.public,
@@ -950,6 +913,7 @@ class AuthRepositoryImpl(
                            masterPasswordHash = registerKeyResponse.masterPasswordHash,
                            masterPasswordHint = masterPasswordHint,
                            emailVerificationToken = emailVerificationToken,
+                            captchaResponse = captchaToken,
                            userSymmetricKey = registerKeyResponse.encryptedUserKey,
                            userAsymmetricKeys = RegisterFinishRequestJson.Keys(
                                publicKey = registerKeyResponse.keys.public,
@@ -964,9 +928,18 @@ class AuthRepositoryImpl(
            .fold(
                onSuccess = {
                    when (it) {
+                        is RegisterResponseJson.CaptchaRequired -> {
+                            it.validationErrors.captchaKeys.firstOrNull()
+                                ?.let { key -> RegisterResult.CaptchaRequired(captchaId = key) }
+                                ?: RegisterResult.Error(
+                                    errorMessage = null,
+                                    error = MissingPropertyException("Captcha ID"),
+                                )
+                        }
+
                        is RegisterResponseJson.Success -> {
                            settingsRepository.hasUserLoggedInOrCreatedAccount = true
-                            RegisterResult.Success
+                            RegisterResult.Success(captchaToken = it.captchaBypassToken)
                        }

                        is RegisterResponseJson.Invalid -> {
@@ -1180,9 +1153,6 @@ class AuthRepositoryImpl(
                    )
                    .onSuccess {
                        rsaKeys?.private?.let {
-                            // This process is used by TDE and Enterprise accounts during initial
-                            // login. We continue to store the locally generated keys
-                            // until TDE and Enterprise accounts support AEAD keys.
                            authDiskSource.storePrivateKey(userId = userId, privateKey = it)
                        }
                        authDiskSource.storeUserKey(userId = userId, userKey = encryptedUserKey)
@@ -1215,6 +1185,10 @@ class AuthRepositoryImpl(
            )
    }

+    override fun setCaptchaCallbackTokenResult(tokenResult: CaptchaCallbackTokenResult) {
+        captchaTokenChannel.trySend(tokenResult)
+    }
+
    override fun setDuoCallbackTokenResult(tokenResult: DuoCallbackTokenResult) {
        duoTokenChannel.trySend(tokenResult)
    }
@@ -1227,6 +1201,23 @@ class AuthRepositoryImpl(
        webAuthResultChannel.trySend(webAuthResult)
    }

+    override suspend fun getOrganizationDomainSsoDetails(
+        email: String,
+    ): OrganizationDomainSsoDetailsResult = organizationService
+        .getOrganizationDomainSsoDetails(
+            email = email,
+        )
+        .fold(
+            onSuccess = {
+                OrganizationDomainSsoDetailsResult.Success(
+                    isSsoAvailable = it.isSsoAvailable,
+                    organizationIdentifier = it.organizationIdentifier,
+                    verifiedDate = it.verifiedDate,
+                )
+            },
+            onFailure = { OrganizationDomainSsoDetailsResult.Failure(error = it) },
+        )
+
    override suspend fun getVerifiedOrganizationDomainSsoDetails(
        email: String,
    ): VerifiedOrganizationDomainSsoDetailsResult = organizationService
@@ -1451,6 +1442,42 @@ class AuthRepositoryImpl(
            onFailure = { LeaveOrganizationResult.Error(error = it) },
        )

+    private fun refreshAccessTokenSynchronouslyInternal(
+        userId: String,
+        logOutOnFailure: Boolean,
+    ): Result<RefreshTokenResponseJson> {
+        val refreshToken = authDiskSource
+            .getAccountTokens(userId = userId)
+            ?.refreshToken
+            ?: return IllegalStateException("Must be logged in.").asFailure()
+        return identityService
+            .refreshTokenSynchronously(refreshToken)
+            .flatMap { refreshTokenResponse ->
+                // Check to make sure the user is still logged in after making the request
+                authDiskSource
+                    .userState
+                    ?.accounts
+                    ?.get(userId)
+                    ?.let { refreshTokenResponse.asSuccess() }
+                    ?: IllegalStateException("Must be logged in.").asFailure()
+            }
+            .onFailure {
+                if (logOutOnFailure) {
+                    logout(userId = userId, reason = LogoutReason.TokenRefreshFail)
+                }
+            }
+            .onSuccess { refreshTokenResponse ->
+                // Update the existing UserState with updated token information
+                authDiskSource.storeAccountTokens(
+                    userId = userId,
+                    accountTokens = AccountTokensJson(
+                        accessToken = refreshTokenResponse.accessToken,
+                        refreshToken = refreshTokenResponse.refreshToken,
+                    ),
+                )
+            }
+    }
+
    @Suppress("CyclomaticComplexMethod")
    private suspend fun validatePasswordAgainstPolicy(
        password: String,
@@ -1606,6 +1633,7 @@ class AuthRepositoryImpl(
        twoFactorData: TwoFactorDataModel? = null,
        deviceData: DeviceDataModel? = null,
        orgIdentifier: String? = null,
+        captchaToken: String?,
        newDeviceOtp: String? = null,
    ): LoginResult = identityService
        .getToken(
@@ -1613,6 +1641,7 @@ class AuthRepositoryImpl(
            email = email,
            authModel = authModel,
            twoFactorData = twoFactorData ?: getRememberedTwoFactorData(email),
+            captchaToken = captchaToken,
            newDeviceOtp = newDeviceOtp,
        )
        .fold(
@@ -1631,6 +1660,10 @@ class AuthRepositoryImpl(
            },
            onSuccess = { loginResponse ->
                when (loginResponse) {
+                    is GetTokenResponseJson.CaptchaRequired -> LoginResult.CaptchaRequired(
+                        captchaId = loginResponse.captchaKey,
+                    )
+
                    is GetTokenResponseJson.TwoFactorRequired -> handleLoginCommonTwoFactorRequired(
                        loginResponse = loginResponse,
                        email = email,
@@ -1767,7 +1800,6 @@ class AuthRepositoryImpl(
            accountTokens = AccountTokensJson(
                accessToken = loginResponse.accessToken,
                refreshToken = loginResponse.refreshToken,
-                expiresAtSec = clock.instant().epochSecond + loginResponse.expiresInSeconds,
            ),
        )
        settingsRepository.hasUserLoggedInOrCreatedAccount = true
@@ -1778,18 +1810,11 @@ class AuthRepositoryImpl(
            // when we completed the pending admin auth request.
            authDiskSource.storeUserKey(userId = userId, userKey = it)
        }
-        // We continue to store the private key for backwards compatibility. Key connector
-        // conversion still relies on the private key.
        loginResponse.privateKey?.let {
            // Only set the value if it's present, since we may have set it already
            // when we completed the key connector conversion.
            authDiskSource.storePrivateKey(userId = userId, privateKey = it)
        }
-        loginResponse.accountKeys?.let {
-            // Only set the value if it's present, since we may have set it already
-            // when we completed the key connector conversion.
-            authDiskSource.storeAccountKeys(userId = userId, accountKeys = it)
-        }
        // If the user just authenticated with a two-factor code and selected the option to
        // remember it, then the API response will return a token that will be used in place
        // of the two-factor code on the next login attempt.
@@ -1890,8 +1915,6 @@ class AuthRepositoryImpl(
                            masterKey = it.masterKey,
                            userKey = key,
                        ),
-                        securityState = loginResponse.accountKeys?.securityState?.securityState,
-                        signingKey = loginResponse.accountKeys?.signatureKeyPair?.wrappedSigningKey,
                    )
                }
                .fold(
@@ -1915,8 +1938,6 @@ class AuthRepositoryImpl(
                    val result = unlockVault(
                        accountProfile = profile,
                        privateKey = keyConnectorResponse.keys.private,
-                        securityState = loginResponse.accountKeys?.securityState?.securityState,
-                        signingKey = loginResponse.accountKeys?.signatureKeyPair?.wrappedSigningKey,
                        initUserCryptoMethod = InitUserCryptoMethod.KeyConnector(
                            masterKey = keyConnectorResponse.masterKey,
                            userKey = keyConnectorResponse.encryptedUserKey,
@@ -1929,16 +1950,10 @@ class AuthRepositoryImpl(
                            userId = profile.userId,
                            userKey = keyConnectorResponse.encryptedUserKey,
                        )
-                        // We continue to store the private key for backwards compatibility since
-                        // key connector conversion still relies on the private key.
                        authDiskSource.storePrivateKey(
                            userId = profile.userId,
                            privateKey = keyConnectorResponse.keys.private,
                        )
-                        authDiskSource.storeAccountKeys(
-                            userId = profile.userId,
-                            accountKeys = loginResponse.accountKeys,
-                        )
                    }
                    result
                }
@@ -1960,13 +1975,11 @@ class AuthRepositoryImpl(
    ): VaultUnlockResult? {
        // Attempt to unlock the vault with password if possible.
        val masterPassword = password ?: return null
-        val privateKey = loginResponse.privateKeyOrNull() ?: return null
+        val privateKey = loginResponse.privateKey ?: return null
        val key = loginResponse.key ?: return null
        return unlockVault(
            accountProfile = profile,
            privateKey = privateKey,
-            securityState = loginResponse.accountKeys?.securityState?.securityState,
-            signingKey = loginResponse.accountKeys?.signatureKeyPair?.wrappedSigningKey,
            initUserCryptoMethod = InitUserCryptoMethod.Password(
                password = masterPassword,
                userKey = key,
@@ -1984,15 +1997,13 @@ class AuthRepositoryImpl(
    ): VaultUnlockResult? {
        // Attempt to unlock the vault with auth request if possible.
        // These values will only be null during the Just-in-Time provisioning flow.
-        val privateKey = loginResponse.privateKeyOrNull()
+        val privateKey = loginResponse.privateKey
        val key = loginResponse.key
        if (privateKey != null && key != null) {
            deviceData?.let { model ->
                return unlockVault(
                    accountProfile = profile,
                    privateKey = privateKey,
-                    securityState = loginResponse.accountKeys?.securityState?.securityState,
-                    signingKey = loginResponse.accountKeys?.signatureKeyPair?.wrappedSigningKey,
                    initUserCryptoMethod = InitUserCryptoMethod.AuthRequest(
                        requestPrivateKey = model.privateKey,
                        method = model
@@ -2017,26 +2028,13 @@ class AuthRepositoryImpl(
            .userDecryptionOptions
            ?.trustedDeviceUserDecryptionOptions
            ?.let { options ->
-                loginResponse.accountKeys
-                    ?.let { accountKeys ->
-                        unlockVaultWithTrustedDeviceUserDecryptionOptionsAndStoreKeys(
-                            options = options,
-                            profile = profile,
-                            privateKey = accountKeys.publicKeyEncryptionKeyPair.wrappedPrivateKey,
-                            securityState = accountKeys.securityState?.securityState,
-                            signingKey = accountKeys.signatureKeyPair?.wrappedSigningKey,
-                        )
-                    }
-                    ?: loginResponse.privateKey
-                        ?.let { privateKey ->
-                            unlockVaultWithTrustedDeviceUserDecryptionOptionsAndStoreKeys(
-                                options = options,
-                                profile = profile,
-                                privateKey = privateKey,
-                                securityState = null,
-                                signingKey = null,
-                            )
-                        }
+                loginResponse.privateKey?.let { privateKey ->
+                    unlockVaultWithTrustedDeviceUserDecryptionOptionsAndStoreKeys(
+                        options = options,
+                        profile = profile,
+                        privateKey = privateKey,
+                    )
+                }
            }
    }

@@ -2048,8 +2046,6 @@ class AuthRepositoryImpl(
        options: TrustedDeviceUserDecryptionOptionsJson,
        profile: AccountJson.Profile,
        privateKey: String,
-        securityState: String?,
-        signingKey: String?,
    ): VaultUnlockResult? {
        var vaultUnlockResult: VaultUnlockResult? = null
        val userId = profile.userId
@@ -2068,8 +2064,6 @@ class AuthRepositoryImpl(
                    vaultUnlockResult = unlockVault(
                        accountProfile = profile,
                        privateKey = privateKey,
-                        signingKey = signingKey,
-                        securityState = securityState,
                        initUserCryptoMethod = InitUserCryptoMethod.AuthRequest(
                            requestPrivateKey = pendingRequest.requestPrivateKey,
                            method = AuthRequestMethod.UserKey(protectedUserKey = userKey),
@@ -2097,8 +2091,6 @@ class AuthRepositoryImpl(
        vaultUnlockResult = unlockVault(
            accountProfile = profile,
            privateKey = privateKey,
-            securityState = securityState,
-            signingKey = signingKey,
            initUserCryptoMethod = InitUserCryptoMethod.DeviceKey(
                deviceKey = deviceKey,
                protectedDevicePrivateKey = encryptedPrivateKey,
@@ -2118,8 +2110,6 @@ class AuthRepositoryImpl(
    private suspend fun unlockVault(
        accountProfile: AccountJson.Profile,
        privateKey: String,
-        securityState: String?,
-        signingKey: String?,
        initUserCryptoMethod: InitUserCryptoMethod,
    ): VaultUnlockResult {
        val userId = accountProfile.userId
@@ -2128,8 +2118,6 @@ class AuthRepositoryImpl(
            email = accountProfile.email,
            kdf = accountProfile.toSdkParams(),
            privateKey = privateKey,
-            signingKey = signingKey,
-            securityState = securityState,
            initUserCryptoMethod = initUserCryptoMethod,
            // The value for the organization keys here will typically be null. We can separately
            // unlock the vault for organization data after receiving the sync response if this
@@ -2173,11 +2161,3 @@ class AuthRepositoryImpl(
        }
    }
 }
-
-/**
- * Convenience function to extract the private key from the
- * [GetTokenResponseJson.Success] response.
- */
-private fun GetTokenResponseJson.Success.privateKeyOrNull(): String? =
-    this.accountKeys?.publicKeyEncryptionKeyPair?.wrappedPrivateKey
-        ?: this.privateKey
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/repository/di/AuthRepositoryModule.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/repository/di/AuthRepositoryModule.kt
@@ -15,6 +15,7 @@ import com.x8bit.bitwarden.data.auth.manager.TrustedDeviceManager
 import com.x8bit.bitwarden.data.auth.manager.UserLogoutManager
 import com.x8bit.bitwarden.data.auth.repository.AuthRepository
 import com.x8bit.bitwarden.data.auth.repository.AuthRepositoryImpl
+import com.x8bit.bitwarden.data.platform.manager.FeatureFlagManager
 import com.x8bit.bitwarden.data.platform.manager.FirstTimeActionManager
 import com.x8bit.bitwarden.data.platform.manager.LogsManager
 import com.x8bit.bitwarden.data.platform.manager.PolicyManager
@@ -27,7 +28,6 @@ import dagger.Module
 import dagger.Provides
 import dagger.hilt.InstallIn
 import dagger.hilt.components.SingletonComponent
-import java.time.Clock
 import javax.inject.Singleton

 /**
@@ -40,7 +40,6 @@ object AuthRepositoryModule {
    @Provides
    @Singleton
    fun providesAuthRepository(
-        clock: Clock,
        accountsService: AccountsService,
        devicesService: DevicesService,
        identityService: IdentityService,
@@ -60,10 +59,10 @@ object AuthRepositoryModule {
        userLogoutManager: UserLogoutManager,
        pushManager: PushManager,
        policyManager: PolicyManager,
+        featureFlagManager: FeatureFlagManager,
        firstTimeActionManager: FirstTimeActionManager,
        logsManager: LogsManager,
    ): AuthRepository = AuthRepositoryImpl(
-        clock = clock,
        accountsService = accountsService,
        devicesService = devicesService,
        identityService = identityService,
@@ -83,6 +82,7 @@ object AuthRepositoryModule {
        userLogoutManager = userLogoutManager,
        pushManager = pushManager,
        policyManager = policyManager,
+        featureFlagManager = featureFlagManager,
        firstTimeActionManager = firstTimeActionManager,
        logsManager = logsManager,
    )
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/repository/model/AuthState.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/repository/model/AuthState.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/repository/model/BreachCountResult.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/repository/model/BreachCountResult.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/repository/model/DeleteAccountResult.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/repository/model/DeleteAccountResult.kt
--- a/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/repository/model/EmailTokenResult.kt
+++ b/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/repository/model/EmailTokenResult.kt
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
aj-rosado	1e665db8ae	🍒 [PM-21537] Fix remove individual vault collection selection cherrypick (#5261 )	2025-05-23 20:40:48 +01:00
David Perez	04e06904f2	🍒PM-17660: Sync learn more cherry pick (#5249 )	2025-05-22 19:01:54 +00:00
Patrick Honkonen	e738b458ef	🍒Bump authenticatorbridge to 1.0.1 (#5248 )	2025-05-22 17:58:58 +00:00
Patrick Honkonen	dc3ee85d16	🍒[PM-21385] Use flatMapLatest for accountSyncStateFlow (#5247 )	2025-05-22 12:48:08 -05:00
Patrick Honkonen	4e8e557040	🍒[PM-21385] Defer feature flag check for Bitwarden account sync (#5246 )	2025-05-22 13:39:52 -04:00
Patrick Honkonen	6f476061f1	🍒[PM-21386] Fix typo in sync with Bitwarden message (#5245 )	2025-05-22 13:39:36 -04:00
@@ -1 +1 @@
 .4.2
 .3.1